Att K - Scope of Workv2.docx

Statement of Work Table of Contents Contents

EXECUTIVE SUMMARY

a. OVERVIEW

The Indiana Veterans’ Home (IVH) is a state-owned long-term care (LTC) facility located in West Lafayette, IN providing long-term skilled nursing care, short-term rehabilitation, and memory care services to honorably discharged Indiana veterans, their spouses, and Gold Star Parents.

The State seeks to engage the Contractor to provide and implement an LTC Electronic Health Record System (EHR), as well as train IVH personnel and necessary contractors on the proper use of the LTC EHR. IVH looks to expand care-giving capabilities, to modernize LTC EHR uses, and to reach compliance with Indiana EO 25-19 (GovRAMP) for cloud-based systems. See Objectives of the Engagement Section for detailed objectives.

II. BACKGROUND AND CURRENT STATE

a. CURRENT DESCRIPTION OVERVIEW

The environment for IVH’s current LTC EHR consists of an online, cloud-based LTC EHR. IVH has struggled to negate unnecessary manual processes causing risk of elevated error rates due to manual processes and basic usability issues, and inefficiencies. These challenges also have negative effects on resident care. Historical performance indicates that there is need for streamlined technology and processes, to reduce or eliminate the inefficiencies presented with IVH’s use of the current LTC EHR. The operating model involves multiple medical staff (and various other staff) utilizing the LTC EHR as a system of record for the care of residents. The State will classify LTC EHR data per privacy standards and will confirm migration scope (all records vs. last 24 months + active) in Requirements. Vendor must deliver a Data Migration Plan (inventory, mapping, transformation rules, validation sampling, reconciliation report, rollback plan), and a data retention and disposal plan aligned to classification. Major external partners are the residents and their families, the Centers for Medicare/Medicaid Services, the Department of Veterans Affairs, as well as medical facilities that are off-site and run by separate corporate entities.

Once the State finalizes the migration scope (full record set or time‑bounded subset), the Contractor shall define measurable validation criteria including sample-based reconciliation, documented error thresholds, audit trails, and a tested rollback procedure. These criteria must be approved by the State before migration activities begin.

III. SCOPE OF WORK

a. OBJECTIVES OF THE ENGAGEMENT

IVH seeks to accomplish several key objectives through this engagement including implementing and testing a LTC EHR, identifying and selecting an LTC EHR that reduces manual processes, reduces errors by medical and support staff, and reduces process timelines with streamlined technology and processes and provides support survey readiness, state mandates, and federal reporting requirements. GovRAMP Requirements (EO 25-19): vendor provides RAMP control matrix (NIST 800-53 rev. 5), authorization package, and continuous monitoring schedule reviewed by Indiana Office of Technology (IOT) before User Acceptance Testing.

Upon completion, IVH envisions a future state where the LTC EHR technology used by IVH staff enables faster decisions, better care, and time saved. This state should yield measurable improvements in compliance monitoring and reporting, operational efficiencies, and resident satisfaction. These improvements will be assessed though Key Performance Indicators (KPIs), which will be jointly finalized by the State and Contractor. Each stated objective will have associated KPIs that define measurable targets for success. KPIs will be used during acceptance and ongoing monitoring.

The IVH needs a fully integrated LTC EHR System that includes financial (billing, accounts receivable, general ledger, patient funds, etc.), ancillary clinical systems (pharmacy, labs, radiology, etc.), and human resource management module/components (scheduling, time and attendance, etc.) and capabilities to integrate with third-party financial systems (insurance carriers, CMS, VA, etc.). The LTC EHR system should focus on care documentation, compliance, and interoperability with pharmacies and other external systems, as-applicable. We are requiring integrations to use MuleSoft API Management (OAuth2/mTLS, IP allow‑listing) for synchronous APIs and GoAnywhere MFT for file transfers (MFA, key rotation, transfer audit). Document schemas, error handling and versioning should be included.

The system should allow the IVH to improve quality of care through e-prescribing, medication management (eMAR), and automated assessments (i.e. MDS). eRx/eMAR shall enforce MFA, role‑based access, immutable audit logs, and AES‑256/TLS 1.2+ encryption per State policies.

Key Features desired:

· Point of Care: LTC EHR Software should provide an interface for users to track patient care and health, including activities of daily living and dehydration risk.

· Ongoing Medication Administration

· Documentation and Resident Assessment

· ADL Charting

· Meal Tracking

· Personal Inventory List

· Wound Management and Infection Control (McGreer Criteria)

· Patient Relationship Management: LTC EHR software should include Customer Relationship Management-like functions to manage patient relationships, waitlist management, referrals tracking, and family/POA portal.

· Resident Fund Management

· Census Data with Payor Source

· E-Billing

· MDS Management: LTC EHR software should facilitate the management and reporting of Minimum Data Set (MDS) assessments, enabling electronic tracking and integration with point-of-care and charting solutions.

· Workflow Management: LTC EHR software should be capable of recording and storing large volumes of data, effectively managing, documenting, and maintaining all health-related workflows.

· E-Prescribing

· Faxing from system

· Signing orders through system

· Time Tracking (staff and contractors)

· Training (ongoing)

· Billing Efficiency: LTC EHR software must have an efficient billing process that evaluates various data sources, including patient plans and reports, to generate billing accurately. Ability to customize payors.

· Claims Management (Medicaid, VA, Medicare A/B, LTC insurance, private pay)

· Compliance Support: LTC EHR software should assist with compliance by ensuring adherence to regulatory standards.

· MDS

· PBJ Export for import at CMS

To avoid ambiguous pricing and scope interpretation, each EHR Section capability will be labeled as: “Required for this Contract,” “Desired” (but not required), or “Informational Only.” Respondents must have all required functionalities to be considered responsive, shall price only Required and Desired items, and may identify Informational capabilities as “available but out of scope.”

Basic Information System – Section 1 This section allows the provider to complete basic business functions like accepting and admitting a new patient/resident/client into a Long-Term and Post-Acute Care (LTPAC) setting. This section includes the following functionalities:

· Basic patient demographic information for admissions, discharge, and transfers (ADT); – Required for this Contract

· Regulatory, standard, or common assessment (like MDS, OASIS, IRF-PAI, InterRAI, etc.) or other information that the provider needs to collect; – Required for this Contract

· Care service delivery documentation by direct care service staff primarily for accounting and billing purposes; –Required for this Contract

· Accounting and billing capabilities with customization of payors; –Required for this Contract

· Electronic submission, using secure transport (TLS 1.2+), of assessment and care documentation data to regulatory agencies (if applicable). API keys/service accounts managed by the State. – Required for this Contract This section may or may not include electronic Point of Care (laptop, tablet, kiosk, hand-held), and/or billing component/integration. The respondent must have all Required functionalities implemented to qualify for this Section.

Basic EHR – Section 2 Functionalities included in this section make the information system qualify for a basic electronic health record (EHR). This section includes the following functionalities:

· Clinical Patient/Resident/Client History; – Required for this Contract

· Lists (diagnoses, problems, medications, allergies); – Required for this Contract

· Clinical charting and documentation; – Required for this Contract

· Care plan; and – Required for this Contract

· Interdisciplinary notes (by physician, nurse, therapist, pharmacist, etc.). – Desired This section may or may not include Point of Care (laptop, tablet, kiosk, hand-held, medication carts, etc.), and/or billing component/integration. The respondent must have all Required functionalities implemented to qualify for this Section.

Ancillary & Clinical Administration (Non-Integrated) – Section 3 This section extends the EHR beyond its basic setting-specific functionalities to other ancillary areas, and adds efficiency capabilities. This section includes the following functionalities:

· Orders (medications, lab., radiology, diagnostic tests, therapy, referrals); – Required for this Contract

· Electronic medication administration, treatment, and adherence record (if applicable) (not at Point of Care); – Required for this Contract

· Point of Care assessment and service documentation (laptop, tablet, kiosk, etc.); – Required for this Contract

· Workflow engine (workflow sheets, next step prompts, alerts, reminders, and tasks); and – Desired

· Results (e.g., medications, lab., radiology, diagnostic tests, therapy, etc.). – Desired The respondent must have all Required functionalities implemented to qualify for this Section; having any of the Desired functionalities is a plus.

Advanced EHR (Internal Quality-Focused) – Section 4 This section adds functionalities and capabilities that allow providers to use the EHR to improve care quality inside the organization. This section includes the following functionalities:

a. Clinical Decision Support (CDS) capabilities (e.g., INTERACT, reducing hospitalization, medications, fall prevention, pressure ulcers prevention, pressure ulcer treatment, wound care, reducing acquired infections, catheterizations, chronic disease management, etc.); – Required for this Contract

b. Electronic Medication Administration at the Point of Care (eMAR/eTAR, Unit Dispensing, Closed Loop Verification, Home Medication Dispensers [if applicable]) at Point of Care; – Required for this Contract

c. Quality Reports, Analytics, and Dashboards (e.g., Hospital Readmission, Quality Measures, Length of Stay [if applicable], etc.); – Required for this Contract

d. Therapy Documentation at the Point of Care (if applicable); – Desired

e. Decision Support at the Point of Care; and – Desired

f. Integration with Devices, including Point of Care Vital Sign Devices, Telehealth and Remote Monitoring (RPM), Medication Dispensers, Activity Monitoring, etc. (if applicable). – Desired

Note 1: Items a, b, d, and f are care setting/business line dependent.

Note 2: The respondent must have all Required functionalities implemented to qualify for this Section; having any of the Desired functionalities is a plus.

External Ancillary Services Integration – Section 5 This section focuses on basic integration between the EHR and other external and ancillary systems. This section includes the following functionalities:

· Pharmacy Integration; – Required for this Contract

· Electronic Referral and Discharge Systems of hospitals or other care providers; – Desired

· Lab. Integration; – Desired

· Diagnostics Integration; – Desired

· Radiology Integration; – Desired

· Eligibility/Coverage Checking (if applicable, especially for systems with integrated billing/ financials); and – Desired

· Formulary Checking. – Desired The respondent must have all Required functionalities implemented to qualify for this Section; having any of the Desired functionalities is a plus.

Engagement & Basic Information Exchange – Section 6 This section focuses on tools and capabilities that aim to engage different members of the care team, including the physician and possibly the patient/resident/client, as well as basic information exchange capabilities. This section includes the following functionalities:

· Physician Portal and eSignature; external user authentication shall use Access Indiana, MFA required. Internal users federate via Okta. – Required for this Contract

· Prescribing and Computerized Physician Order Entry (CPOE); – Required for this Contract

· Sending and/or Receiving Clinical Care Documents (CCD), Summaries, SBAR, Care Plans, and other information electronically as in human and machine-readable format (txt, pdf) (e.g., ONC Project Direct, eHealth Data Solution’s CareWatch Connect, etc.) directly to/from other providers; – Required for this Contract

· Patient/ Resident Portal or exporting data to a Personal Health Records (PHRs); – Desired

· Family/ Caregiver Portal or integration with such tools; – Desired

· Care Planning Portal or integration with such tools; – Desired

· Care Navigator/Care Coordinator Portal or integration with such tools; – Desired

· Secure Messaging between care team members; and – Desired

· Public Health Reporting. – Desired The respondent must have all Required functionalities implemented to qualify for this Section; having any of the Desired functionalities is a plus.

Interoperability & Health Information Exchange – Section 7 This section represents the ideal full interoperability section the sector strives for that allows the exchange of information in a standards-based data format that other EMRs/EHRs cannot only understand, but can also consume. This section includes the following functionalities:

· Sending/Receiving information to/from other EMRs/EHRs (including Physician and/or Hospital EHRs) electronically through an HIE or exchange entity in a standards-based consumable data format (e.g., XML, HL7, FIHR); – Required for this Contract

· Sending/Receiving information to/from EMRs/EHRs Repository in a standards-based consumable data format (e.g., XML, HL7, FIHR); and – Desired

· Sending/Receiving information to/from other EMRs/EHRs (including Physician and/or Hospital EHRs) electronically directly in a standards-based consumable data format (e.g., XML, HL7, FIHR). – Desired The respondent must have all Required functionalities implemented to qualify for this Section; having any of the Desired functionalities is a plus.

b. DELIVERABLES AND DEADLINES

The Contractor shall provide, at a minimum, the following deliverables according to a mutually agreed upon schedule. Each deliverable must include the required compliance evidence and will be subject to formal review and approval by the State. Deliverables, timelines, and quality measures will be validated through formal acceptance procedures established during Requirements & Needs Assessment. Deliverables should be submitted in editable and PDF formats and stored in a state-owned repository.

Deliverables with Acceptance Criteria include:

· Project Kickoff Package Includes kickoff agenda, team organization chart, and communication plan.

Acceptance Criteria: Signed kickoff meeting minutes and list of State participants.

· Requirements and Needs Assessment Includes a detailed requirements document and traceability matrix. This should also include information on data migration specifications.

Acceptance Criteria: Formal sign-off by the State.

· Project Management Plan Includes an integrated schedule with milestones and dependencies, a project organization and staffing plan, a requirements traceability matrix (RTM), issue and risk management procedures with escalation paths, a stakeholder communication plan, a quality management plan with standards and acceptance criteria, training and deployment plans, details on approved tools and collaboration platforms, and a change control process for scope management.

Acceptance Criteria: The Project Management Plan will be accepted when the State confirms that the document is complete; includes an approved baseline schedule and resource plan; contains validated governance (risk, issue, and change management) processes; includes a complete RTM, communications plan, and quality plan; documents approved tools, training, and deployment strategies; and receives formal State sign‑off through the established Deliverable Management Process.

· Design or Prototype Documentation Includes conceptual models, wireframes, or engineering drawings. This can also include demos of existing offerings that the Contractor believes will meet the needs of IVH.

Acceptance Criteria: Demonstration of prototype and documented feedback log.

· Technical or Implementation Specifications Includes configuration details, integration points, and data flows Acceptance Criteria: Peer review completed and State approval received. Data Migration acceptance shall include: (a) documented mapping and transformation rules, (b) State-approved validation sampling, (c) reconciliation reports with discrepancies and resolutions, (d) demonstrated rollback capability. Migration cannot be accepted until all criteria are met.

Note: Technical and Implementation Specifications must document compliance with Statewide IT Policies, Procedures, and Standards, including identity and access controls, encryption, audit logging, network architecture, backup/restore strategy, and least‑privilege role-based access control (RBAC). The Contractor must show how each component meets applicable State requirements.

· Test Plan and Quality Assurance Results Includes test cases, pass/fail results, and defect logs.

Acceptance Criteria: All critical defects resolved or approved waiver documented.

· Training and Knowledge Transfer Materials Includes training guides, recorded sessions, and competency sign-off forms.

Acceptance Criteria: Designated users confirm competency.

· Deployment or Handover Package Includes operational procedures, deployment checklist, and rollback plan.

Acceptance Criteria: Successful production cutover and verification completed.

· Final Report and Closeout Documentation Includes as-built documentation and lessons learned.

Acceptance Criteria: Formal closeout sign-off by the State.

· RAMP/NIST Control Mapping A complete control matrix mapping all system, application, and hosting controls to Indiana RAMP requirements (aligned with NIST SP 800‑53 rev.5)

· Network Architecture & Data Flow Diagrams Detailed, up‑to‑date diagrams showing:

• System components and trust boundaries

• External interfaces and integrations

• Data flows, protocols, and encryption points

• Any third‑party or cloud‑hosted services

· Key Management Procedures Documentation of key generation, rotation schedules, storage/handling, access controls, and lifecycle management for all cryptographic materials used in the solution.

· Backup & Restore Strategy A full backup/restore plan including:

• Backup frequency and retention

• Recovery Point Objective (RPO)

• Recovery Time Objective (RTO)

• Validation and testing procedures

• Rollback capability for failed deployments or data corruption events

· Vulnerability Management Program Evidence of a mature process covering:

• Regular scanning cadence (infrastructure + application)

• Patch management timelines

• Remediation workflows

• Reporting metrics

• Third‑party component monitoring (SBOM preferred)

· Least‑Privilege Role‑Based Access Control (RBAC) A defined RBAC model enforcing least‑privilege access, including:

• Role definitions and required permissions

• Administrative segregation of duties

• Periodic access reviews and attestation

• Procedures for provisioning/deprovisioning

· Warranty and Maintenance Transition Documentation Includes service level agreements, support contacts, and escalation procedures.

Acceptance Criteria: SLA executed and support process tested.

c. PAYMENT MILESTONES

Payments under this engagement will be tied to milestone completion and formal acceptance of deliverables by the State. No payments will be issued for initial activities such as project kickoff. Instead, payment will occur after milestone three, covering all work completed up to that point. Subsequent payments will be made upon acceptance of each major deliverable as outlined in the Deliverables and Deadlines Section. Invoices must reference the accepted Milestone number and Deliverable Covered, the date of acceptance, and include the acceptance record and any required compliance evidence.

The State is prohibited from issuing advance payments for services, supplies, materials, or equipment unless expressly authorized under Indiana Code 4-13-2-20. Exceptions may apply for specific categories such as subscriptions, license fees, or insurance premiums, subject to prior approval by the State Budget Agency. For full details, refer to Indiana Code 4-13-2-20.

IV. PROJECT MANAGEMENT

a. PROJECT MANAGEMENT PLAN

The Contractor shall deliver an initial draft of the Project Management Plan (PMP) within 15 days of contract start. A comprehensive PMP will be delivered no later than 15 days after the initial draft of the Project Management Plan is reviewed and approved. Final acceptance of the PMP is defined in the deliverables section. The PMP will include an integrated schedule with milestones and dependencies; a project organization and staffing plan; a requirements traceability matrix; issue and risk management processes with escalation paths; a communication plan for stakeholder engagement; a quality management plan with standards and acceptance criteria; training and deployment plans; and descriptions of approved tools and collaboration platforms. The PMP shall include a change control process to evaluate and approve scope changes. The PMP will be reviewed and approved by the State and updated as necessary.

Key elements to include:

b. KEY PERSONS

The following individuals are designated as key people for this engagement:

· Project Manager: Oversees project coordination, schedule management, and communication with the State. Manages risks and issues, tracks deliverables, provides status updates, and ensures the project remains on scope, on schedule, and in alignment with State requirements. Ensures contractor personnel and relevant clinical SMEs maintain HIPAA/security requirements.

· Technical Lead: Responsible for solution design, technical oversight, and integration activities.

Individuals designated for these roles will be appointed during the development of the PMP. Any substitution of key people must be approved in writing by the State. The Contractor shall ensure that any proposed replacement meets or exceeds the qualifications of the originally designated individual. The State reserves the right to request the replacement of any key person if, according to the State’s judgment, the individual does not meet performance expectations or project needs. Additionally, the State shall have the opportunity to interview any proposed replacement prior to approval to ensure suitability for the role.

c. OTHER PROJECT STAFF

The Contractor shall provide sufficient staffing levels with appropriate qualifications to meet the State’s delivery timelines and performance expectations. The Contractor shall prepare a Project Resource Staffing Plan that includes:

· The number, type, and categories of staff proposed for the engagement.

· Role descriptions and minimum qualifications for each position.

· Work location details and any remote work arrangements.

· Ongoing training requirements to ensure compliance and quality standards.

· A plan for onboarding new staff or replacing personnel during the engagement.

The State reserves the right to review staffing and to request changes if, in the State’s judgment, personnel do not meet performance expectations or project needs. The State will have the opportunity to interview proposed replacements prior to approval, and any replacements must meet or exceed the original qualifications.

Complete Attachment N - Resource Usage Matrix to provide the roles and associated number of hours the Respondent expects to commit to the project and the roles and associated number of hours estimated for the State resources both for the Key Persons and Other Project Staff. These amounts should be based on the functionality the State desires, included in this RFP.

d. DOCUMENT MANAGEMENT

The State will establish an electronic project library, utilizing SharePoint, as the primary repository for all deliverables and administrative documents. The State will decide which tool to use for the electronic project library, based on the needs of the project. The Contractor shall submit documents in editable and PDF formats, apply State-approved naming conventions, and maintain version control with an audit trail. Access permissions will be managed by the State to ensure confidentiality and compliance with applicable security and privacy standards.

e. STATUS UPDATES AND REPORTING

The Contractor shall provide weekly status reports, including updated risk and issue logs and schedule updates. Monthly meetings will review progress and address escalations. Quarterly business reviews will summarize work completed, upcoming priorities, and performance metrics. Reports shall include narrative summaries and a one-page executive dashboard that highlights schedule status (including critical path changes), risks and mitigations, and upcoming milestones. The State will collaborate with the Contractor to refine report templates to ensure they meet the needs and expectations of the State. More frequent status reports may be required, decided at the discretion of the State.

V. COMPLIANCE REQUIREMENTS

a. STATEWIDE IT POLICIES, PROCEDURES, AND STANDARDS

The State has robust and comprehensive security standards that permeate all levels of the organization. The Indiana Office of Technology (IOT) has been tasked with establishing and maintaining these security standards. The security standards include assessing security risks, developing and implementing effective security procedures, and monitoring the effectiveness of those procedures. If the proposed solution involves information technology-related products or services, all such products or services are to be compatible with any of the technology standards found in the Statewide IT Policies, Procedures, & Standards (https://www.in.gov/iot/policies-procedures-and-standards/) that are applicable, including the assistive technology standard. The Contractor will be required to sign a Non-Disclosure Agreement (NDA) to access the more sensitive standards and policies. The Contractor should review the Statewide IT Policies, Procedures, & Standards and ensure their proposed solution meets all standards therein.

b. ARTIFICIAL INTELLIGENCE STANDARDS

The State has adopted an enterprise-level policy governing the use of Artificial Intelligence (AI) within state government. The State’s AI Policy is issued and monitored by the Office of the Chief Data Officer (OCDO), in cooperation with the Chief Privacy Officer (CPO) and the Management Performance Hub (MPH). As a complement to the AI Policy, the State Agency Artificial Intelligence Systems Standard outlines the rationale behind the AI Readiness Assessment Process required for the implementation or any use of AI by a state agency. That Standard outlines the requirement for the submission of a Readiness Assessment Questionnaire prior to implementation or use of an AI tool or system. Any proposed solution meeting these requirements must support the State’s AI Policy and follow the AI Readiness Assessment Process. See https://www.in.gov/mph/AI/ for more detailed information.

VI. KEY PERFORMANCE INDICATORS (KPIs)

The State will use Key Performance Indicators (KPIs) to measure performance and outcomes of the Contract. The specific KPIs and their targets will be defined and agreed upon by the State and the Contractor during the initial phases of the requirements under the Contract. At a minimum, on-time delivery at quality standards of the scope provided within the budget set forth in the Contract will each be measured. Additionally, the State will collect a modified Net Promoter Score from customers to this Contract in its discretion. Low ratings on the modified Net Promoter Score or failure to meet any other KPIs may be deemed, at the discretion of the State, to constitute default under the Contract.

Baseline Establishment: The Contractor shall partner with IVH to measure current-state baselines for each KPI (performance, reliability, defect turnaround) during the Requirements & Needs Assessment and propose targets relative to those baselines.

VII. END OF CONTRACT TRANSITION AND TURNOVER

The Contractor shall develop a turnover plan 6 months prior to contract end, detailing activities for transferring responsibilities, non-proprietary components, data, and operational documentation to the State or its agent. The Contractor shall provide a knowledge transfer checklist (for example procedures, contacts, training materials) and deliver a data disposition certificate confirming deletion or return of State data within 6 months after contract completion unless otherwise agreed.