Attachment 1 PWS.pdf

Solicitation 140D0420R0038

Attachment 1-PWS

Performance Work Statement

Indian Health Service Resource and Patient Management System (RPMS) - Systems

Support Services

CONTENTS

1 Purpose

2 Background

3 Contract Objectives

4 Scope of Work

5 Performance

5.1 Period of Performance

5.2 Place of Performance

6 Travel

7 Tasks

7.1 IT Management

7.2 Cloud Support Services

7.3 End User Services

7.4 Compute Services

7.5 Application Services

7.6 Network Services

7.7 Security & Compliance Services

8 Contract Administration

8.1 Authorities of Government Personnel

8.2 Technical Monitoring, Inspection and Acceptance

8.3 Contract Transition Plan

8.4 Special Terms and Conditions

8.5 Contract Deliverables:

Appendix A: Reference Materials and Technical standards

Appendix B: Service Level Agreements

Appendix C: IHS Regional Sites ………………………………………………………Attached

1 PURPOSE

Indian Health Service requires expert services and support to innovate, maintain, configure and troubleshoot hardware, operating system software and ancillary devices in support of Health

Information Technology System (HITS) suite of applications. This support is necessary for continued operations or health information systems used in the delivery of patient care to population served by Indian Health Service.

2 BACKGROUND

IHS is the principal Federal health care provider and health advocate for Indian people and provides a comprehensive health service delivery system for approximately 2.2 million of the nation’s estimated 2.4 million American Indians (AI) and Alaska Natives (AN). IHS provides health services through a system of IHS (Federal), Tribal, and Urban (I/T/U) operated facilities and programs. These programs provide health services to nearly two million AI/AN people through numerous hospitals and health centers located in 35 states. The range of services includes traditional inpatient and ambulatory care, preventive services and public health activities.

The Resource and Patient Management System (RPMS) is a distributed health information system designed to support all aspects of patient care at I/T/U facilities throughout the United

States. The RPMS is a suite of over 60 clinical, administrative, and financial applications, originally derived from and with many similarities to the Veterans Administration’s Vista information system, but with many important differences as well. The RPMS application suite runs in an Intersystem Cache database environment, and can be configured to operate over either

Windows or AIX operating systems.

The information technology (IT) support environment at the IHS operates on a tiered structure.

Tier 1 consists of basic IT support that is provided at the local health care facility level. Tier 2 is an intermediate level of support that is invoked when Tier 1 capacity is exceeded; this support is generally provided by the IT staff at the IHS Area (regional) Office associated with the facility.

When the support issue is beyond the capacity of Tier 2, the support request is referred to the

IHS Office of Information Technology (OIT), which is considered Tier 3 troubleshooting and support. If the situation requires the intervention of a hardware vendor such as IBM, it is considered a Tier 4 support request. This Performance Work Statement (PWS) encompasses a scope of activities for Tier 3 support that primarily includes installation, configuration, maintenance and troubleshooting of RPMS databases running on Windows and AIX operating systems under the purview of the IHS Office of Information Technology, Division of

Information Technology (DIT), Configuration Support and Management Team (CSMT). The

IHS Fact Sheet web site gives more statistics on the IHS supported services:

https://www.ihs.gov/newsroom/factsheets/. The IHS Headquarters, Office of Information

Technology website provides additional information regarding IT Services at:

https://www.ihs.gov/OIT/aboutus/.

https://www.ihs.gov/newsroom/factsheets/ https://www.ihs.gov/OIT/aboutus/

3 CONTRACT OBJECTIVES

The objective of this contract is to provide continuous tier 3 support for approximately 400 + production and development database instances operating on a combination of Windows and

AIX environments, and continuous performance improvements of these systems. This will require the contractor to provide highly skilled, knowledgeable and professional IT support resources who shall perform critical operations and maintenance (O&M) services on databases as well as hardware.

4 SCOPE OF WORK

The scope of the work includes the maintenance and improvement to support availability, integrity and confidentiality of the health information systems within the HITS infrastructure architecture, through engineering, systems administration, and Tier 3 support services.

The contractor shall:

• Acknowledge and respond to Tier 3 services request initiated by federal, tribal and urban

RPMS system customers using the IHS Information Technology Service Management System

(ITSM) solution.

• Resolve and document the service provided and issue resolution of the service request within the ITSM.

• Provide Tier 3 technical hardware configuration and/or operating systems infrastructure consultation to Health Information Technology application developers.

• Resolve High Availability Cluster Multiprocessing (HACMP), OS and interoperability issues, and as necessary co-ordinate with hardware or software vendors

• Conduct analysis and develop key performance indicators for HITS Service Desk services to support continuous improvement

• Conduct analysis and develop performance indicators for HITS hardware and operating systems as a basis for recommendations to support optimization and modernization and overall performance improvement

• Ensure hardware and software are consistently operational and disaster recovery plans are continuously available and current for immediate implementation and in compliance with security policy

• Collaborate on new technologies, priorities and deployments of new Health system applications/hardware, Disaster Recovery, Continuous Diagnostics and Mitigation (CDM) and

Hybrid Cloud Service Management

• Initiate and maintain an inventory of HITS systems, infrastructure performance, availability and configurations.

• Conduct analytics and provide supporting reports for database metrics, infrastructure performance, configuration and availability

• Maintain and enhance the security and resiliency of critical HITS services and infrastructure

• Maintain and enhance Standard Operation Procedures, Configuration Management and

Change Control documentation of each HITS services and supporting infrastructure

• Provide Program and Project Management support services for projects within the purview of the CSMT program in accordance with practices established under the HITS

Portfolio, IHS project management standards and HHS Enterprise Performance Life Cycle

(EPLC) (https://www.hhs.gov/digitalstrategy/hhs-ocio-cpic-policy-2016.html#roles) where applicable (https://www.ihs.gov/CPIC/lifecycle/).

5 PERFORMANCE

5.1 PERIOD OF PERFORMANCE

The period of performance for this PWS support shall include one 12-month base year with four

12-month option years effective upon award.

The Contractor shall perform all requirements of this PWS in accordance with IHS and

Department of Health and Human Services (HHS) policies, procedures, and directives as referenced in the Appendix B of this PWS.

5.2 PLACE OF PERFORMANCE

Tasks within this PWS are to be performed at the contractor’s location with the capability of on-site support at the IHS Data Center location indicated below without additional costs.

• OIT Albuquerque Data Center (ADC): 1011 Indian School Rd NW, Albuquerque, NM

87104.

Location and Hours of Task Performance:

Duties Work Performed At: Estimated Hours

IT Management Contractor Location M-F 6AM-6PM MST

Cloud Support Services Contractor Location M-F 6AM-6PM MST

End User Services Contractor Location M-F 6AM-6PM MST

Compute Services Contractor Location M-F 6AM-6PM MST

Security & Compliance Contractor Location M-F 6AM-6PM MST

Emergency Services Contractor Location 24/7/365

Network Services Contractor Location M-F 6AM-6PM MST

Minor deviations in start and end times are acceptable upon approval by the Contracting Officer

Representative (COR).

Emergency Call Back:

The Contractor shall provide irregular, off hours (Weekends, Weekdays and Holidays, 24/7) critical HITS support remotely via Government approved remote software tools/applications. On site Data Center critical support may also be required as issues or emergencies are identified.

Emergency troubleshooting or repair work is occasionally required for unplanned outages or major issues impacting production Health Information Systems. Work may need to be performed on site or remotely during non-business hours. All scheduled maintenance work causing system outages must be performed during Off-Peak/Non-Business hours.

Holidays:

All federal holidays are observed. The only exception would be the support for critical systems or services outages. Contractor personnel shall not report to work nor remain at the work locations any time the Government unexpectedly closes their offices with the exception of emergency support required. The contractor will not be compensated for these Government closures. The contractor is responsible for all notifications of their contractor staff during times of closure. During office closures, the contractor may elect to reschedule work hours during the same pay period.

Holiday Date

New Year’s Day January 1st

Martin Luther King’s Birthday 3rd Monday in January

Inauguration Day January 20th, every four years

Presidents’ Day 3rd Monday in February

Memorial Day Last Monday in May

Independence Day July 4th

Labor Day 1st Monday in September

Columbus Day 2nd Monday in October

Veterans’ Day November 11th

Thanksgiving Day 4th Thursday in November

Christmas Day December 25th

6 TRAVEL

Travel within the continental United States and Alaska may be required in support of the tasks within this PWS. Travel locations will generally be to IHS Regional sites referred to as Area

Offices or medical facilities locations (See appendix C for a list of locations). All travel will require request and approval of cost by the COR.

7 TASKS

7.1 IT MANAGEMENT

7.1.1 Administrative Support

The Contractor shall assist the COR with administrative work related to IT Project management, information security and Area facility coordination activities related to testing and deployment of

Ensemble, system updates and services, or other support activities as required by IHS and HHS initiatives. This includes, but is not limited to, data collection related to system performance and availability analytics, Tier 3 user support, and HITS security. Also, Data Call coordination in support of the Operational Analysis and other HHS data reporting needs. The Contractor shall assist in maintaining accountability of Government Furnished Equipment (GFE) issued in support of this contract. The following additional administrative services and support shall be provided for all areas of the PWS:

7.1.1.1 Contract Management Plan: The contractor shall submit a contract management plan to include each of the tasks in the PWS. The contract management plan will be approved by IHS to ensure contract expectations and requirements are clearly understood. The contract management plan shall be prepared for IHS review and approval no more than ten (10) days after the contract award.

7.1.1.2 Quality Control and Quality Assurance Surveillance Plans: The Contractor shall prepare, implement and adhere to a Quality Control Plan (QCP). The Contractor shall submit the Draft QCP with the proposal and shall update the QCP within 10 days after award. The QCP shall document how the Contractor will meet and comply with the quality standards established in this PWS. The QCP must include a self-inspection plan and an outline of the procedures that the Contractor will use to maintain quality, timeliness, responsiveness, and customer satisfaction. The Government will monitor the Contractor’s performance under this contract according to the Service Level

Agreements (SLA) and the Quality Assurance Surveillance Plans (QASP). Yearly reporting will be provided within the CPARS reporting system.

7.1.1.3 Service Level Management: The Contractor shall document the baseline SLA for the tasks described in the PWS within 30 business days of contract award. The monitoring and reporting of the SLAs associated with each standard investment will require approval by IHS. The Contractor shall provide for continuous monitoring of their performance to meet the SLAs and report conformance results on a monthly basis.

7.1.1.4 Reporting: The Contractor shall assess and report on the costs of the services and support of each support task included within this PWS and according to the deliverable schedule identified in order to be in compliance with Technology Business

Management (TBM) standard cost reporting requirements. This will include the use of designated tools for both project level reporting and sustainment support against all labor categories for resource utilization reporting.

7.1.1.5 CSMT Tactical Operation Plan: The Contractor shall track all key activities and tasks within this PWS to include the status tracking of key activities and projects for reporting to the COR and DIT management on a monthly basis. This would include technical implementation projects such as major upgrades, technical alternative assessments, new processes or technical changes to be implemented within OIT and/or across IHS.

7.1.2 Project Management

The Contractor shall provide complete project management for all IT projects activities and initiatives on behalf of the CSMT in a manner that meets OMB and HHS requirements

(following HHS Enterprise Performance Lifecycle (EPLC) standards). This includes current operational project upgrades/replacements and any future major IT projects (technology modernization and enhancements). These projects are generally implementations of cloud services, or infrastructure upgrades and configuration management. The scope of project management support excludes Business application software development, enhancements or modernization. The Contractor shall support the IHS Capital Planning and Investment Control

(CPIC) Management team, the IT Project peer reviews and each of the required stage gate reviews (https://www.ihs.gov/CPIC/).

7.1.2.1 The Contractor shall provide support for the following EPLC project related activities and deliverables required for each major HITS project included as part of this task:

a. Identification and capturing of all project requirements.

b. Cost and resource estimates for HITS Projects.

c. Creation of HITS Project documentation deliverables.

d. Management of staffing resources for each initiative.

e. Management of project due dates, risks, issues, deliverables and general reporting.

f. Business Needs and Business Case requests for IT governance approvals.

g. Project Management Plans – including Project Charters, Change Management, Risk

Management and Communication plans.

h. Post Implementation Reports and Lessons Learned reviews.

7.1.2.2 The Contractor shall provide timely project management status reports on all contracted activities to include:

a. Performance assessment reports on all contract activities and improvement opportunities

b. Assistance with support to Federal Managers on the completion of the detailed project related documents for approved IT projects using approved Project

Management tools for managing, planning, and tracking the resources and costs for new HITS projects as well as Operations and management reporting and maintenance.

c. Weekly contract labor resource reports to show the number of hours worked on

HITS projects per labor category.

d. The Contractor shall document measurements for meeting project milestones and track all issues and risks as part of the monthly reporting to the COR.

https://www.ihs.gov/CPIC/

7.1.3 Program Management

The Contractor shall provide Program Management support, technical documentation support and other Information Technology Infrastructure Library (ITIL) related services that are required for effective management and sustainment of services. This shall include the management and oversight of the following functions:

7.1.3.1 Knowledge Management

a. The Contractor shall provide knowledgeable, experienced IT Technical documentation support for all systems engineering work to include:

• The creation and maintenance of all System Administrator Guides, process descriptions, implementation plans, contingency procedures, design documents, and workflows.

• The Contractor shall present draft materials to the COR in ongoing cycles of review, discussion, and improvement. Documentation modifications are required at various stages of the systems lifecycle and are to be up to date.

b. The Contractor shall maintain and update all internal documentation to include:

• Configuration management documents for each major Health IT Systems

• Enterprise Services Architectural Designs with data flow and application dependencies.

• Standard Operating Procedures (SOPs), test plans and implementation plans must be maintained and updated for upgrades, replacements, and new product installations.

• Maintain current HITS infrastructure configuration diagrams which include server and application configuration, Application Programming Interface and other relevant data. This includes maintaining updated network diagrams showing application dataflow and requirements in addition to other relevant data. All

Standard Operating Procedures must follow IHS naming convention guidelines and format.

• Customer facing technical notes, user guides and frequently asked questions and updates to the ITSM solution (Service Now) or IHS SharePoint.

• All documentation (contract related, metrics, and technical documentation and baseline procedures) must be stored in a federally managed IHS storage location as an accessible document repository location for reference to include version management and an updated document catalog. All content will remain as government property.

c. The Contractor shall maintain the following documentation according to OIT procedures. Documentation is used for planning and continuous availability capabilities.

• Service Interruption Documentation and Notices

• Monthly uptime report for all critical HITS services, Change Management Events, maintenance notices, issues log and risk logs

• Active IHS Dashboard metrics (includes System Uptime, Efficiency, Security compliance and Patch Management)

• System Configurations diagrams for critical systems

• Licensing utilization and Inventory Reports

• Active Directory RBAC status reports to an assigned set of user groups.

• Monthly security Compliance Reports as assigned by COR

d. The Contractor shall provide article contributions for the Quarterly OIT Newsletter to include meeting attendance, formatting, 508 compliance and presenting to COR for approval.

e. The Contractor shall provide support and content management of a collaborative

SharePoint or designated repository site for all areas identified within this PWS.

The Contractor shall ensure that all contract related SharePoint sites support the capabilities for dashboards, graphics, workflows and reporting based on the

Enterprise Client Access Licensing (ECAL) available to IHS.

7.1.3.2 Service Strategy: The Contractor shall provide recommendations to assist the COR and

Federal Managers with the development of strategic goals and tactical objectives regarding technical architecture, database support, customer support, security configurations and use of emerging technologies. The Contractor shall also support improvements of service level agreements, systems availability, Tier 3 support and overall systems architecture applicable to work assigned by COR and within scope of this contract.

7.1.3.3 Service Design: The Contractor shall assist with the assessment of new technologies and determine if a technology will support/satisfy new requirements, enhance the security posture of Health IT Systems, integrate into existing architecture and tool sets and can be properly accredited and authorized for use within IHS. The Contractor shall ensure that any new systems, applications and improvements are developed following

IHS CPIC and EPLC standard processes for IT Governance and approvals. An IT

Technical Review Board shall verify that the requirements are clearly defined and provide approvals to proceed with the next stage of the project lifecycle. The

Contractor shall NOT commence any production implementation until all research and design work for new projects, upgrades, and systems improvements are approved by the

COR. The Contractor shall complete all preliminary cost analysis, design documentation, risk assessments, and testing before IHS determines if a project is feasible, meets agency goals and objectives, and fits HITS architecture and performance plans. The COR will submit requests for new HITS projects for IT Governance approval. The Contractor’s analysis and design work shall follow IHS HITS

Architecture, Agency and ISAC priorities, HITS Strategic Planning, Division IT

Tactical planning goals and objectives, and IHS Mission plans, where available.

7.1.3.4 Risk Management:

The Contractor shall assess for risks associated with all tasks within this PWS to include the degree to which the risks associated with the support activities impact the success of deliverables, resources, IHS funding availability, and HITS services integration. All identified risks are to be assessed for probability, severity and impact along with planned mitigation recommendations for review and approval by the COR.

7.1.3.5 Service Transition: The Contractor shall provide for the operations and management for service transition to include change management, configuration management and release and final deployment of new services.

7.1.3.6 Change Management: The Contractor shall develop documented baselines and maintain all major software changes in an acceptable change management database.

a. The Contractor shall provide routine communication to the CSMT federal group regarding any necessary changes to existing features and functionality of HITS services that may impact end users due to any activities performed by the contractor or required by IHS as identified within the internal Change Control Board (CCB) process and procedural documentation.

b. The Contractor shall be required to perform all maintenance, patching and service changes for production systems during a predetermined maintenance window and during off peak hours to the maximum extent possible.

c. The Contractor shall ensure to require notifications of changes and assessment of any potential impact from all SYSADMIN, System Owners and Database administrators which should be provided at least five business days in advance of planned maintenance activities.

d. The Contractor shall document all changes in an approved Change Management database with reporting capabilities.

7.1.3.7 Release and Deployment Management: The Contractor shall ensure that all analysis work follow the IHS HITS Architecture, Strategic Planning, Tactical goals and objectives, Security policies and the IHS Mission. Therefore, the Contractor shall follow the ITIL guidelines for planning, scheduling, documenting and controlling the release of patches, versions, upgrades, and new applications. Test plans must be prepared and completed with approvals to proceed prior to implementation of major upgrades.

7.1.3.8 Service Operation: The Contractor shall ensure that all incident and problem management procedures are followed. This includes maintaining production infrastructure to prevent service interruptions and efficiently deliver HITS services.

The Contractor shall recommend hardware and software changes for problem solving, capacity limitations, performance “tuning,” system improvements, and process improvements. This includes the identification of where load balancing may improve system performance, reporting problem resolutions and developing a Trend Analysis and Recommendations report for review. For any identified incidences, all emergency system and network changes must be reported to the COR within 1 hour and take corrective action to restore to operational capabilities within 2 hours (this may depend on the criticality of the service and associated SLAs). The Contractor shall provide timely updates of actions taken to remediate outage and submit an outage analysis report to COR within 24 hours of remediation. Notification of any unplanned outages are required to be provided to the COR and Federal Manager immediately upon identification.

7.1.3.9 Continuous Service Improvements: Assigned Contractor personnel shall be knowledgeable of industry best practices related to the processes and procedures used to maintain systems and to recommend and implement system improvements for Health IT infrastructure and systems. The Contractor shall be familiar with all aspects of the ITIL

Service Management framework to assist with improving the effectiveness and efficiency of HITS services and support to the business and mission of the Indian

Health Service for both OIT internal and external customers. The Contractor shall develop and document best practices to promote continuous improvement to the IHS

HITS Tier III User Support, system support and other Administrative support with the ultimate goal of providing a higher level of service maturity and improved customer satisfaction.

7.1.3.10 Contract Staff Management:

a. The Contractor shall prepare a staffing management plan to include recruitment and retention of key personnel and support staff and present to the COR for approval. At a minimum, the following labor categories shall be key personnel: Information

Technology Specialist IV (Windows/Cloud Systems Specialist), Project Manager, Information Technology Specialist IV (UNIX/AIX Systems Specialist), and

Information Technology Specialist III (EHR/Healthshare Application Specialist).

b. Staff Security: The Contractor shall monitor and track all staffing Personal

Identification Verification (PIV) cards and certificate expirations and ensure that renewal documentation and certificate updates are completed in a timely manner according to HHS HSPD-12 policies and renewal requirements.

c. At least 30 days prior to diverting any of the specified individuals to other programs or contracts (or as soon as possible, if an individual must be replaced, for example, as a result of leaving the company), the Contractor shall notify the COR and

Contracting Officer (CO) and shall submit comprehensive justification for the diversion or replacement request (including proposed substitutions for key personnel) to permit evaluation by the Government of the impact on performance under this contract.

d. Staff Training:

• The Contractor shall ensure that each Contractor/subcontractor employee has completed the IHS Computer Security Awareness Training course

(www.ihs.gov/issa ) to include the associated role based training prior to performing any contract work, and thereafter completing the IHS-specified fiscal year refresher course prior to the due date identified.

• The Contractor shall ensure that all staff supported within this contract attend

CompTIA Server Plus CE training to include certification within three months of onboarding within IHS.

• The Contractor shall ensure that all staff supported within this contract attend

COMPTIA Cloud Plus CE training to include certification within three months of onboarding within IHS.

• The Contractor shall ensure that all staff supported within this contract attend

CompTIA Security Plus CE training to include certification within three months of onboarding within IHS.

• The Contractor shall be required to attend and document the completion of various IHS mandated trainings identified throughout the contract period.

• The Contractor shall maintain a listing by name and title of each Contractor and subcontractor employee working under this PWS of all trainings completed http://www.ihs.gov/issa during the course of the contract. Any revisions to this listing as a result of staffing changes shall be submitted with next required technical progress report.

• The Contractor shall provide any necessary technical training relating to applications, services and support being provided as part of this PWS for all contract staff in order to remain technically relevant and authoritative for all services. The Contractor shall maintain an up to date listing of all trainings completed during the course of the contract for each technical resource. Some trainings may be provided by IHS for critical projects, applications and systems as funding is available.

7.1.3.11 Consultation: The Contractor shall provide consultation for solving complex problems, design reviews, emerging technologies and systems analysis to Area Offices and field locations on an as needed basis.

7.1.3.12 End User Training Support: The Contractor shall provide as needed system training for

IHS users and lower level admins in HITS implementation plans to include training end users and lower level system administrators for developed production systems. The

Contractor shall provide training online, audio conferencing, offsite, or occasionally in an IHS supported training room. These trainings may be scheduled or unscheduled, as needed based on end user support needs.

7.1.3.13 Meetings and Conferences: The Contractor staff shall attend local and virtual meetings and conferences as directed by IHS staff for technical input, project guidance, etc.

7.1.3.14 Interagency Development and Support: The Contractor shall provide support for any development and implementation of specific technical solutions that may be required by the HHS and will require interagency project coordination and outside agency resource sharing management. The Contractor shall provide analysis, design, complex troubleshooting, and implementation services for work related to these outside entities.

7.2 CLOUD SUPPORT SERVICES

IHS will implement several FedRAMP approved Cloud Services to comply with multiple federal policies established in 2018. Specifically, IHS will improve citizen-facing services through the increased use of cloud-based solutions to align with the 2018 President’s Management Agenda.

IHS will also align with the HHS Information Technology Strategic Plan

(https://www.hhs.gov/sites/default/files/hhs-it-strategic-plan-final-fy2017-2020.pdf ). The

Contractor shall design, test, implement, operate, and technically maintain Cloud services supporting the IHS HITS (dependent on service agreement with Cloud Provider).

7.2.1.1 The Contractor shall provide experienced, knowledgeable technical support for the integration with any IHS approved, FEDRAMP Authorized Government Cloud Service

Provider (CSP) vendors and the IHS private cloud environment as part of the HQ Cloud

Strategic Plan and in alignment with NIST SP 800-145.

7.2.1.2 The Contractor shall assist in the assessment and identification of both the business and https://www.hhs.gov/sites/default/files/hhs-it-strategic-plan-final-fy2017-2020.pdf technical requirements, architectural requirements, use case identification, security and design reviews for the HQ Hybrid Cloud infrastructure implementation and integration with approved Cloud Service Providers (CSP). This includes providing and/or recommending solutions as well as to provide for the implementation and management support for cloud integration and brokering services.

7.2.1.3 The Contractor shall develop and implement the proof of concept testing and validation of technical designs and processes needed to support a Cloud/hybrid infrastructure in collaboration with various OIT business partners and vendors.

7.2.1.4 The Contractor shall provide a dedicated, knowledgeable, experienced support resource that would lead efforts to integrate IHS services to a FedRAMP authorized CSP.

7.2.1.5 The Contractor shall ensure integration of critical IHS infrastructure requirements such as Active Directory, Multifactor Authentication (MFA) and various support tools such as VMware are part of the IHS Hybrid Cloud management plan.

7.2.1.6 The Contractor shall assist with the tracking of all HITS cloud activities in use across the Agency through the use of IHS tools. Reports are to include what is consumed, what is FedRAMP approved and to facilitate the migration of existing services from non-approved sources to an approved IHS authorized, FedRAMP service.

7.2.1.7 The Contractor shall identify, implement and document all Health Information

Technology network, storage, and process changes and dependencies required for testing according to IHS policies and security practices.

7.3 END USER SERVICES

The Contractor shall provide Tier 3 support for the IHS Health IT Systems, infrastructure and applications. The following table represents current support statistics for this sub task:

Tier 3 Total

# of Service Tickets/year 5,800

# of Problem Tickets/year 2,500

7.3.1 HITS Service Support (Tier 3)

The HITS Tier 3 service team provides Tier 3 (SME escalation) support services according to the following scope:

• Thirteen Regional Areas geographically dispersed across continental U.S. and Alaska

• Approximately 400 Federal, Tribal, and Urban sites which have IT Systems Administrators with varied skill levels

• No support required for Foreign countries

7.3.1.1 The Contractor HITS Service Support, Tier 3 services for Health systems and supporting applications shall be supported for all of IHS and can be located at the

Contractor’s discretion. Support hours are to be from 6am to 6pm, MST, M-F

(excludes Federal Holidays).

7.3.1.2 The Contractor shall provide skilled, knowledgeable, experienced staff to man the

Service Support operations for Tier 3 support for all of IHS. The Contractor shall follow all IHS policy and procedures related to service support operations and service level agreements (see Appendix B). The Contractor shall understand the customer expectations, service requirements and triage/escalation of support requests as defined in existing Customer Support policies to include compliance with all SLAs.

7.3.1.3 The Contractor shall accept, manage and document field user support calls as well as

HQ User support calls including but not limited to the following subject matter areas:

a. General Information, direction and recommendations

b. Provide support for various IHS supported services including:

• Active Directory Management support requests for OU and Security group membership

• Domain user account group administration

• RPMS Hosting Applications (Windows, AIX, Healthshare) – access, troubleshooting, upgrades etc.

• RPMS Hosted Security related requests

• License management requests for Intersystem Ensemble software application.

• RPMS Infrastructure hardware and peripherals (printers, terminal servers and remote-desk top services).

7.3.1.4 The Contractor shall record all calls into the IHS supported ITSM Ticketing system.

Service Desk employees are responsible for recording required data (Customer contact information, issue to be addressed, etc.) for each call.

7.3.1.5 The Contractor Service Support staff shall accept, troubleshoot, triage and prioritize all support requests and then collect, document and store (knowledge database), and present information to agency users via the Service Desk Ticketing system. Referenced information to include in the support ticket will include, but is not limited to, Policies, Procedures, technical information, Frequently Asked Questions (FAQ), and contact information.

7.3.1.6 The Contractor shall research technical documentation, determine the urgency, provide instruction to the user, and either close the ticket or escalate the call.

7.3.1.7 The Contractor shall monitor the escalated tickets to insure they are being resolved according to defined SLAs and completing/closing tickets timely. Reminders and notifications to SME Supervisors may be required.

7.3.1.8 The Service Support staff shall assist in the maintenance and update service desk technical reference information, support communications and the Knowledge management database. The documentation will also include, but is not limited to, IHS support links, technical information, alerts, scheduled maintenance, Frequently Asked

Questions (FAQ), and contact information. The Service Support personnel shall notify the Configurations System Management Team Lead when data becomes outdated and coordinate the updating of the documentation.

7.3.1.9 The Contractor shall make every effort to resolve all issues at the time of ticket acknowledgement. This will be the initial method for resolving issues at the lowest possible tier level before escalating the ticket for additional support.

7.3.1.10 The Contractor shall log and assign priorities for all requests not resolved at the time of the call as defined by internal IHS policies and procedures based on specific definitions.

7.3.1.11 The Contractor shall adhere to the IHS ITSM operating procedures and existing service level agreements.

7.3.1.12 The Contractor shall review and escalate any negative Customer complaints to the COR with full ticketing information and tracking of all e-mails associated with the ticket.

7.3.1.13 The Contractor shall be prepared to adjust workloads when new products, applications, system configuration changes, and security enhancements that are approved and released. The contactor shall attend project meetings and training sessions when new products and applications are rolled out.

7.3.1.14 The Contractor shall provide monthly service level metrics reporting for all areas of support and as agreed upon by the Configurations System Management Team Lead.

7.3.1.15 The Contractor shall analyze, document and monitor the status of all Tier 3 incidents and provide reports within 15 minutes of the identification of an active incident to the

Federal Manager. Timeframes and escalation to other SMEs is to be documented within the incident reports.

7.4 COMPUTE SERVICES

The Contractor shall provide support for Infrastructure compute services for the Health

Information Technology Investment Systems. Contract staff must be available during standard support hours (6am to 6pm, Mountain Time, M-F) as well as irregular (on-call) support for critical alerts and monitoring. This includes availability for urgent support after hours for all

Federal Holidays & weekends. Support is to include the sustainment and management of existing and future compute resources required to support critical services.

7.4.1 Infrastructure Compute Support Requirements

7.4.1.1 The Contractor shall perform all system maintenance including:

a. Firmware updates (maintain firmware according to Original Equipment

Manufacturers (OEM) recommendations/most current stable release.

b. Monthly critical OS Patch Management of all supported Operating Systems using an IHS provided patching solution. This should include testing procedures, deployment schedules, customer communications and any required support needed for system troubleshooting.

c. Planned OS and Healthshare Version level upgrades.

7.4.1.2 The Contractor shall provide support for alerts management, event monitoring of critical processes and incident reporting for systems in support of IHS mission.

a. The Contractor shall implement and support all routine monitoring of the HITS infrastructure and critical services using standard approved tools.

b. The Contractor shall follow established SLAs for service level monitoring and reporting.

c. The Contractor shall provide notifications to the Federal Manager, COR and data center Customers for all critical service impacts and outages that impact SLAs according to the IHS HQ HITS Communication Plan. Monthly reports on service availability and uptime will be required for the pre-determined critical system and services.

7.4.1.3 The Contractor shall perform and insure data and system backups occur according to established customer support schedule. Backup recovery test plans and testing procedures for restorations are to be performed on a monthly basis with required documentation for auditing purposes per NIST SP800-34. Documentation of all testing should be maintained in approved change management database. The Contractor shall establish a method to monitor decentralized RPMS platforms to ensure that backups are occurring and documented restoration procedures are current.

7.4.2 Virtual Server Infrastructure O&M

7.4.2.1 The Contractor shall document the baseline architecture, all procedures, manage and update all end user support documentation, processes/workflows and metrics reporting for the Virtual infrastructure.

7.4.2.2 The Contractor shall provide Tier 3 consultative support for urgent issues and outages related to the virtualization infrastructure (both VMware and Hyper-V) at locations within the IHS network.

7.5 APPLICATION SERVICES

The Contractor shall provide Health Information Technology Systems Application support such as Microsoft Visual Studio Team Service, Healthshare Ensemble, Serena Business Management and support license tracking for Intersystem Ensemble applications under the purview of the

Health Information Technology Investment that are in use by the entire Agency. Support staff can be located at the Contractor’s discretion. Support hours are to be from 6 am to 6pm MST, M-F and includes availability for urgent irregular (on-call) support after hours for all Federal holidays and weekends for critical access issues, outages and any required corrective actions.

7.5.1 HITS Software License Management

The Contractor shall manage and monitor usage of the IHS HITS software licenses to include the

Healthshare (Intersystem Ensemble) and others as identified by the COR. This requires thorough knowledge of vendor license models and ensures alignment and compliance with the ELAs as part of the IHS utilization of the software.

7.5.1.1 The Contractor shall provide support for the following:

a. Managing the IHS Agency data calls, auditing and associated reporting for activities supporting Ensemble licensing.

b. Acting as the IHS point of contact for all Ensemble license coordination efforts, data collection and reporting.

c. Management of the vendor License management portals and coordination with each vendor point of contact.

d. Providing license guidance to IHS on licensing regulations, product benefits and changes in vendor support and End User Agreements.

e. Providing coordination with each IHS Area regarding license true ups, new purchasing needs, compliance reporting and completing the required reporting documents for IHS Area and Headquarters Finance and Accounting offices for the purposes of submitting the internal chargebacks.

7.5.1.2 The Contractor shall provide assistance and support for coordination with each IHS

Area Office, collecting license utilization and new requirements and submitting the

Interagency Agreement (IAA) documents from all IHS Areas for funding approvals and processing. Once purchases are completed, the Offeror is to provide for the coordination with license validation and documentation that all purchased licenses are received.

7.5.2 Business Systems Analyst Support

The Contractor shall provide Business Analyst support to include the following functions:

7.5.2.1 Develop test plans and execute test scripts based on business and functional requirements in coordination with the systems administrator and business partners.

7.5.2.2 Document process workflows and assess against current security guidelines for compliance with policies and roles and responsibilities.

7.5.2.3 Assist with the integration with external data sources and the data validation process requirements.

7.5.2.4 The Contractor shall conduct the yearly Operational Analysis for up to three critical steady state services per year that are supported out of CSMT. This includes performance measures such as Customer Satisfaction, alignment with strategic and business results, financial performance and innovation. This support includes the following:

a. The contractor shall complete an annual Operational Analysis on steady state of

HITS infrastructure critical systems identified by the Indian Health Service (IHS)

Business Sponsor and Investment Manager.

b. The contractor shall develop interview questions and conduct interviews of the IT system owners, financial managers, contracting officer representatives, Enterprise

Architect, end users and other identified IT system support staff to ensure as complete of understanding of the IT system’s current condition.

c. The contractor shall develop a report of the Operational Analysis and submit the final findings to the Business Sponsor and Investment Manager.

7.5.3 Enterprise Application Management

The Contractor shall provide application systems administration support for the operations and maintenance of existing infrastructure. Additionally, support shall be provided for new non-infrastructure, Health IT applications and support services.

7.5.3.1 The Contractor shall have the skills, experience and knowledge of complex application implementation and integration with other critical services and system maintenance.

7.5.3.2 The Contractor shall assist with application installation in coordination with the vendor and all application maintenance on Windows and AIX servers and be familiar with workflow and process requirements for complex systems.

7.5.3.3 The Contractor shall provide application’s interdependency management, monitoring of alerts, maintenance, performance tuning, and secure user management. Additionally, provide the documentation of system configurations, workflows and configuration of notifications.

7.5.3.4 The Contractor shall coordinate with the application owners on issues related to functionality, performance or security and assist with identifying and implementing corrective actions. This includes the responsibility to oversee problem management activities and root cause analysis.

7.5.3.5 The Contractor shall provide for Tier 3 technical and end user support for IHS staff with limited end user training. This may also include access requests, user troubleshooting and technical recommendations. Support may also involve project meetings and technical guidance and recommendations to application owners as the subject matter expert.

7.5.3.6 The Contractor shall maintain SLAs, system availability, security, capacity management and application performance in collaboration with other technical support teams.

7.5.3.7 The Contractor shall assist with enhancement requests in coordination with the vendor and assess, test and implement upgrades and patches for the applications.

7.5.3.8 The Contractor shall provide support for designated individual databases (EHR, SQL) associated with these Health applications and services to include managing the data tables, the configuration management database and imports.

7.5.3.9 The Contractor shall provide support for Ensemble management reporting and performance analytics reports.

7.6 NETWORK SERVICES

The Contractor shall provide support for network logical connectivity in coordination with the

IHS Network Support Team and work with other OIT support teams and contractors to troubleshoot connectivity and performance issues.

7.7 SECURITY & COMPLIANCE SERVICES

The Contractor shall provide experienced, knowledgeable security support for all services supported within this PWS. Support staff can be located at the contractor’s discretion. Support hours are to be from 6 am to 6pm MST, M-F. The Contractor shall adhere to all IHS security policies in alignment with NIST 800-53r4. The Contractor shall collaborate with IHS Division of

Security (DIS), IHS Division of Information Technology Operations for guidance on systems operational security.

7.7.1 Cybersecurity Tools O&M Support

The Contractor shall provide technical support for a security related operational program to comply with all FISMA, NIST, and HIPAA regulations as part of the IHS Continuous

Diagnostics and Monitoring (CDM) Program. This would include the identification of improved processes and methods to enhance the IHS Cybersecurity posture, modernize the Federal IT enterprise and improve the security compliance of critical IHS services. Specifically, this support includes the following:

7.7.1.1 The Contractor shall provide Vulnerability Remediation support for the HITS supporting Operating systems and DIT supported applications in collaboration with DIS in order to reduce the risks to critical IHS services.

7.7.1.2 The Contractor shall provide Tier 3 consultative support for operational security improvements for those systems supported under the Health Information Technology domain.

7.7.1.3 The Contractor shall possess experience in cybersecurity documentation and system authorization artifacts in support of the System Security Plan, lifecycle documentation, continuous monitoring plan, Security Assessment Plan, Security Assessment Report, Risk Assessment, etc. This includes the review and completion of all associated documentation in support of Continuous Authorization and the Risk Management

Framework.

7.7.1.4 The Contractor shall provide Audit and Compliance support to include technical reviews, data collection, reporting and responding to the HHS, to the OIG or the DIS

Audit and Compliance Team requests which occurs throughout each fiscal year.

8 CONTRACT ADMINISTRATION

8.1 AUTHORITIES OF GOVERNMENT PERSONNEL

The administration of this contract will require maximum coordination between the Government and the Contractor. The Government may, upon contract award or thereafter, name representatives with titles such as Project Officer, Contracting Officer's Representative(s) and other Federal Managers named in writing by the Contracting Officer. The letter of appointment will indicate the individuals, titles, and stipulate the rights, responsibilities, and limitations of their appointment.

8.2 TECHNICAL MONITORING, INSPECTION AND ACCEPTANCE

The COR, as a duly authorized representative of the…