ATTACHMENT 1 - PWS _DQ Technical Functional_02272025.docx

DQ Technical Analysis and Functional Support

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Veteran’s Health Administration (VHA) Digital Health Office, Office of Health Informatics (OHI) Health Information Governance Data Quality Program

DQ Technical Analysis and Functional Support

Date: 02/25/25

DHO ID# FY25-HIG-535

PWS Version Number: 2.0

CONTENTS

BACKGROUND

The mission of the Department of Veterans Affairs (VA), Digital Health Office (DHO), Office of Health Informatics (OHI), Health Information and Governance (HIG) is to provide benefits and services to Veterans of the United States. As part of the HIG Program and in support of these goals, the OHI HIG Data Quality Program (DQP) is responsible for providing a framework to monitor and improve the quality of the healthcare and supporting data within Veterans Health Administration (VHA). These efforts encompass activities related to identity management for healthcare, business product management, data management, data governance, data stewardship, data analytics, and clinical data quality initiatives, as well as other areas related to data quality.

The Data Quality Program (DQP) consists of three distinct sub-programs – Health Care Identity Management (HC IdM), Clinical Data Quality (CDQ), and Analytics, Visualization and Support (AVS). Part of the responsibilities of the DQP is to ensure that business stakeholders’ data quality requirements, use cases, and business rules are identified and subsequently developed. As data quality requirements and business rules are developed and published, the DQP is responsible for ensuring that all internal and external stakeholders understand and adhere to the data quality requirements and business rules that are applicable to clinical, administrative, and identity management data quality. To ensure adherence to Data Quality Standards, the DQP evaluates, reviews, and tests products throughout the software development lifecycle.

DQP’s internal and external stakeholders (also known as customers) include:

A. Health Care Identity Management (HC IdM), Clinical Data Quality, Analytics, Visualization and Support (AVS) and other Data Quality Program staff;

B. Identity and Access Management Services (technical) staff (IAM);

C. Health Information Governance (HIG) Program Offices, including Health Information Management (HIM) and others;

D. Clinical Informatics and Chief Medical Info Program Offices, including Informatics Patient Safety and others;

E. Oracle Health Business and Technical Staff;

F. Chief Business Office, Community Care and Health Eligibility Center staff;

G. Federal HealthCare Center (FHCC) project staff;

H. Veteran Health Information Exchange (VHIE) project teams;

I. Office of Enterprise Integration (OEI) staff;

J. VA Office of Information Technology staff (VA OIT) K. Department of Defense (DoD) business and technical staff;

L. Veteran’s Lifetime Electronic Record (VLER) technical teams;

M. Veteran Relationship Management (VRM) and Veterans Experience Office (VEO) teams;

N. Social Security Administration (SSA) representatives;

O. Veteran Health Information Systems and Technology Architecture (VistA) business and technical teams;

P. Customer Data Integration (CDI) teams;

Q. VA and VHA committees, teams and councils;

R. Business and technical project teams representing new initiatives and applications.

S. Office of Performance Measurement T. Office of Quality and Patient Safety

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements For Cryptographic Modules”

4. FIPS Pub 199. Standards for Security Categorization of Federal Information and Information Systems, February 2004

5. FIPS Pub 200, Minimum Security Requirements for Federal Information and Information Systems, March 2016

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. Carnegie Mellon Software Engineering Institute, Capability Maturity Model® Integration for Development (CMMI-DEV), Version 1.3 November 2010; and Carnegie Mellon Software Engineering Institute, Capability Maturity Model® Integration for Acquisition (CMMI-ACQ), Version 1.3 November 2010

9. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

10. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

11. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

12. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, http://www.va.gov/vapubs/

13. VA Handbook 0710, Personnel Security and Suitability Security Program, May 2, 2016, http://www.va.gov/vapubs

14. VA Directive and Handbook 6102, “Internet/Intranet Services,” July 15, 2008

15. 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility Standards,” July 1, 2003

16. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

17. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

18. An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, October 2008

19. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

20. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

21. VA Directive 6500, “Managing Information Security Risk: VA Information Security Program,” September 20, 2012

22. VA Handbook 6500, “Risk Management Framework for VA Information Systems – Tier 3: VA Information Security Program,” March 10, 2015

23. VA Handbook 6500.1, “Electronic Media Sanitization,” November 03, 2008

24. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI)”, July 28, 2016

25. VA Handbook 6500.3, “Assessment, Authorization, And Continuous Monitoring Of VA Information Systems,” February 3, 2014

26. VA Handbook 6500.5, “Incorporating Security and Privacy in System Development Lifecycle”, March 22, 2010

27. VA Handbook 6500.6, “Contract Security,” April 22, 2024

28. VA Handbook 6500.8, “Information System Contingency Planning”, April 6, 2011

29. OI&T Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

30. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

31. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

32. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

33. VA Handbook 6510, “VA Identity and Access Management”, January 15, 2016

34. VA Directive 6300, Records and Information Management, February 26, 2009

35. VA Handbook, 6300.1, Records Management Procedures, March 24, 2010

36. NIST SP 800-37 Rev 1, Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach, June 5, 2014

37. NIST SP 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems and Organizations, January 22, 2015

38. OMB Memorandum, “Transition to IPv6”, September 28, 2010

39. VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, October 26, 2015

40. VA Handbook 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, March 24, 2014

41. OMB Memorandum M-06-18, Acquisition of Products and Services for Implementation of HSPD-12, June 30, 2006

42. OMB Memorandum 04-04, E-Authentication Guidance for Federal Agencies, December 16, 2003

43. OMB Memorandum 05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, August 5, 2005

44. OMB memorandum M-11-11, “Continued Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, February 3, 2011

45. OMB Memorandum, Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation, May 23, 2008

46. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011

47. NIST SP 800-116 Rev 1, Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access, June 2018

48. OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007

49. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, Digital Identity Guidelines, June 2017

50. NIST SP 800-157, Guidelines for Derived PIV Credentials, December 2014

51. NIST SP 800-164, Guidelines on Hardware-Rooted Security in Mobile Devices (Draft), October 2012

52. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981 Mobile, PIV, and Authentication, March 2014

53. VA Memorandum, VAIQ #7100147, Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12), April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

54. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

55. VA Memorandum “Mandate to meet PIV Requirements for New and Existing Systems” (VAIQ# 7712300), June 30, 2015, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4846

56. Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.2, Federal Interagency Technical Reference Architectures, Department of Homeland Security, June 19, 2017, https://www.dhs.gov/sites/default/files/publications/TIC_Ref_Arch_v2.2_2017.pdf

57. OMB Memorandum M-08-05, “Implementation of Trusted Internet Connections (TIC), November 20, 2007

58. OMB Memorandum M-08-23, Securing the Federal Government’s Domain Name System Infrastructure, August 22, 2008

59. VA Memorandum, VAIQ #7497987, Compliance – Electronic Product Environmental Assessment Tool (EPEAT) – IT Electronic Equipment, August 11, 2014 (reference Document Libraries, EPEAT/Green Purchasing Section, https://www.voa.va.gov/documentlistpublic.aspx?NodeID=552)

60. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

61. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

62. Executive Order 13834, “Efficient Federal Operations”, dated May 17, 2018

63. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

64. VA Directive 0058, “VA Green Purchasing Program”, July 19, 2013

65. VA Handbook 0058, “VA Green Purchasing Program”, July 19, 2013

66. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access”, January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

67. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

68. VA Memorandum, “Implementation of Federal Personal Identity Verification (PIV) Credentials for Federal and Contractor Access to VA IT Systems”, (VAIQ# 7614373) July 9, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

69. VA Memorandum “Mandatory Use of PIV Multifactor Authentication to VA Information System” (VAIQ# 7613595), June 30, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

70. VA Memorandum “Mandatory Use of PIV Multifactor Authentication for Users with Elevated Privileges” (VAIQ# 7613597), June 30, 2015; https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

71. “Veteran Focused Integration Process (VIP) Guide 3.2”, December 2018, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

72. “VIP Release Process Guide”, Version 1.4, May 2016, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4411

73. “POLARIS User Guide”, Version 1.9, March 2017, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4412

74. VA Memorandum “Use of Personal Email (VAIQ #7581492)”, April 24, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

75. VA Directive 6066, “Protected Health Information (PHI) And Business Associate Agreements Management”, September 2, 2014

76. VA Directive 1906, “Data Quality Requirements for Health Care Identity Management and Master Person Index Functions”,

77. DAMA International, DAMA Guide to the Data Management Body of Knowledge, or DAMA DMBOK®,

78. ASTM E1714 - 07(2013), Standard Guide for Properties of a Universal Healthcare Identifier (UHID)

SCOPE OF WORK

The Contractor shall provide support services to the Data Quality Program that includes reviewing business and technical project documents for proper incorporation of defined requirements to implement clinical data quality and person identity management; developing, reviewing, and refining enterprise requirements, use cases, and business rules used to implement and support data quality; planning and executing plans for testing of software products and performance measure metrics; providing business and technical expertise in the areas of clinical data quality and person identity management; and performing data quality analysis and reporting in support of implementations, updates to technologies, research, and other organizational requirements.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The Period of Performance (PoP) shall be 11 months from date of award with four (4), twelve (12) month option periods.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their Task Execution Plan submission.

TRAVEL (Base and Optional travel) The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Travel costs will be included in the contract award as a separate, cost-reimbursable, “not to exceed” line item.

The contractor must obtain written approval from the Veterans Affairs (VA) Program Manager via the Contracting Officer Representative BEFORE any travel begins, utilizing the Travel Authorization Request form. Travel and per diem expenses will be reimbursed on an actual expenditure basis in accordance with Federal Travel Regulations (FTR) and FAR 31.205-46. Travel that occurs without written pre-approval will NOT be reimbursed.

In order to be reimbursed for travel, the contractor shall submit supporting documentation as required by Federal Travel Regulations with invoices. Federal Travel Regulations require for any temporary travel destination you must provide a receipt to substantiate your claimed travel expenses for lodging and a receipt for any authorized expenses costing over $75 (FTR 301-11.25). Expenses for subsistence and lodging will be reimbursed to the contractor only to the extent where an overnight stay is necessary and authorized by Federal Travel Regulations in effect at the time of the stay for the specific location. Contractor travel within the local commuting area will not be reimbursed. Total estimated number of trips in support of this effort is provided below:

Estimated Destinations (See Below)

Base Period:

Option Period 1

Option Period 2

Option Period 3

Option Period 4

Anticipated destinations include: Tampa (Franklin Templeton)/Bay Pines, Florida; Washington, D.C. (VACO), Salt Lake City, Utah; Madison, Wisconsin; Birmingham, Alabama; and St. Louis, Missouri.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

PROJECT MANAGEMENT

REPORTING REQUIREMENTS

The Contractor shall provide the Contracting Officer’s Representative (COR), VA Program Manager (PM), Contracting Officer (CO), and Contract Specialist (CS) (as applicable) with Monthly Progress Reports in electronic form in Microsoft Word, Project, or other similar formats. The report shall include detailed explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding Month.

The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Deliverable:

A. Monthly Progress Report DATA QUALITY IDENTITY MANAGEMENT TECHNOLOGY CONFIGURATION, IMPLEMENTATION, AND ANALYSIS The VA has utilized the VA Master Person Index (VA MPI) as its enterprise Identity Management solution since 1998. With the evolution of the VA MPI, the matching algorithm used within the VA MPI for matching and duplicate detection was “modernized” to a commercial industry-standard probabilistic matching algorithm, which is maintained and configured by the Government, in conjunction with the algorithm vendor technical staff.

In support of this contract, the contractor shall perform analysis and reporting on identity and person matching data, on the existing Government-owned systems, in order to provide guidance and recommendations related to: configuration and implementation of the probabilistic matching algorithm, workflows, process mapping, architectural diagrams, and other technologies in support of Data Quality goals. The contractor shall coordinate with internal and external business and technical staff, in order to obtain access to or extracts of existing data for analysis from Government-owned systems, including the VA Master Person Index (VA MPI) and other reporting databases, such as the Corporate Data Warehouse (CDW), Electronic Health Record (EHR) systems and others. Analysis and reporting will be conducted for the purposes of providing information needed to configure and implement matching algorithm and other data quality and VA-supported software, EHR implementation, and for identity management issues identification and resolution functionality. The contractor shall perform and provide analysis, reporting and recommendations only; no changes to or development of software will be performed by contract staff. The analysis and reporting will be performed using standard analysis tools, such as Structured Query Language (SQL), Power BI, and Tools for Oracle Application Development (TOAD). The contractor shall work with representatives and technical staff from the current probabilistic algorithm vendor and others to coordinate access to data and tools, and to obtain configuration and implementation details in conjunction with Government staff. The contractor shall provide feedback, requirements, and requested information about the matching algorithm and other identity management technologies and software configuration and implementation, including all ancillary software modules, such as the “VA MPI Identity Management Toolkit”, “algorithm configuration workbench”, and relevant applications related to the implementation of the Electronic Health Record (EHR) as it relates to identity traits and management. This information may include recommendations on adjustments to algorithm parameters to optimize matching, duplicate detection and error identification and resolution functionality, as well as changes to process, workflow, and other technologies. Information provided by contract staff will be used by others to make modifications, but no changes or development will be performed by contract staff. Analysis and reporting will support the delivery of requirements, research, data quality initiatives, metric definition, and other needs. The contractor shall provide coordination and communication between identity management vendors and Government staff, providing updates as to the progress of application and configuration updates and obtaining input and decisions related to configuration. In this role, the contractor will act as the facilitator, but will not be performing those tasks themselves. The Government anticipates that one (1) new version of software will be configured and implemented by the probabilistic algorithm vendor for each contract period and the analysis of identity data in support of such upgrades would occur approximately twice per year, depending on the complexity of the upgrade. Other implementations, including initiatives such as the Joint Health Information Exchange (JHIE) and EHR Modernization, will require additional analysis and reporting several times within each performance period.

This work is performed in coordination with the VA Office of Information Technology (VA OIT) and as such is subject to all relevant OIT project plans and schedules.

Deliverables:

A. Provide guidance and recommendations on configuration parameters, threshold settings, and implementation details, including functionality to be included, and requirements for implementation. Projects may include periodic updates to the probabilistic matching algorithm utilized within the VA MPI and Health Care Identity Management (HC IdM) framework for Data Quality, and participation in requirements and implementation work in support of VHA’s EHR Modernization. Guidance and recommendation documentation shall be compiled and delivered to the Program Director or assigned Government contact. This deliverable will be in the form of written recommendations to Government staff and will be done in accordance with the OIT project schedules defined for the algorithm software implementation or other project timelines.

B. Provide expertise and guidance on parameters and configuration details required for the on-going “fine-tuning” of probabilistic matching algorithm technologies, based on analysis and recommendations for enhanced performance of the matching and duplicate/error detection, including changes to matching thresholds and consideration of incorporation of additional data fields. This deliverable shall be in the form of written recommendations of changes to probabilistic algorithm parameters and/or configuration and will include analysis used to substantiate recommendations. The deliverable will be submitted in accordance with OIT project schedules for upgrades and initiatives that will result in changes to the matching algorithm.

C. Provide analysis and reporting of Identity Management data, in order to provide guidance and information necessary for configuration, implementation, error detection, enhancement and other decisions, related to the probabilistic matching algorithm and/or management of identity data. This analysis will be performed using standard tools, such as SQL and TOAD on Government-owned systems, using data from the VA MPI, CDW, Oracle Health Data Intelligence, and other reporting databases and systems. The results will be used to inform guidance, recommendations and expertise as noted in Deliverables A and B.

BUSINESS AND TECHNICAL DOCUMENT DEVELOPMENT AND REVIEW

The contractor shall review and provide expert input into business and technical documents such as Business Requirement Documents (BRDs), Executive Decision Memos (EDMs), New Service Requests (NSRs), project charters, and guidance documents that are submitted by internal and external DQ customers for software development projects, as directed by HIG DQ leadership. Documents will be reviewed for completeness, accuracy, and compliance with the VHA Enterprise Data Quality Requirements, Enterprise Data Catalog (EDC) guidelines, and all other relevant criteria, which will be made available to the contractor after contract award. The contractor shall:

A. Identify data quality issues within the documents and assign a level of complexity for resolution of the issues, in accordance with industry standard identity management and data quality principles;

B. Indicate the level of Data Quality involvement necessary for the project based on criteria iterated above, such as whether or not identity management services will be used by the project and to what extent;

C. Verify that the business and technical documents contain required references to Clinical and Administrative Data Quality (DQ) Requirements;

D. Verify that all applicable DQ Requirements are included in the business documents such as BRDs, EDMs, NSRs, project charters, white papers, business flow diagrams, and guidance documents;

E. Provide recommendations for revisions and corrections to business and technical documents such as BRDs, EDMs, NSRs, project charters, white papers, and guidance documents, to bring them in compliance with VA-defined requirements and DQ industry standards and best practices;

The contractor shall prepare a summary of findings that includes: the identified Data Quality Issues; assigned level of complexity; comment or anomaly logs and/or marked-up documents with identified deficiencies in meeting DQ requirements as set forth in the VA Enterprise Requirements Repository, Enterprise Data Catalog (EDC) and within data quality requirements specifications use cases and business process flows, and final complexity evaluation of the project and level of DQ involvement required. This summary shall be delivered to the Government via e-mail. Business document review and comment as outlined above are estimated by the Government to be approximately at 20 per year, based on the number of activities initiated and existing within the software development lifecycle.

In addition to BRDs, EDMs, and NSRs, the contractor shall participate in reviews of technical integration documentation associated with Enterprise Identity Management and other data quality requirements compliance. These documents include Integration Requirements Specification Documents (iRSD) and Integration System Design Documents (iSDD). Included in this effort are:

A. Attendance at meetings (generally via teleconference) in which the content for these documents is developed;

B. Review of all iRSDs, iSDDs, and other documents for compliance with Enterprise Identity Management and other Data Quality requirements;

C. Provision of written comments on the reviewed documents;

D. Participation in formal review meetings with business and technical stakeholders and management to resolve document comments, i.e. anomaly log reviews; meetings generally take place via teleconference.

Technical requirements document review and comment as outlined above are estimated by the Government at approximately 30 per year, based on the number of activities initiated and existing within the lifecycle.

Deliverables

A. BUSINESS DOCUMENT REVIEW: Summary of findings for each document reviewed are due three (3) workdays after review is complete. The need for this activity will be initiated from several different groups within VA and will be assigned as needed. The contractor shall have between 24 hours and 2 weeks to review, based on deadlines provided by requesting groups within VA. The documents will range in length from approximately 2 to 50 pages. In addition to the summary of findings, the written comments (i.e. identification of anomalies, edits for completeness and accuracy) will be provided to the requesting VA groups within deadlines defined.

B. TECHNICAL DOCUMENT REVIEW: Summary of findings for each document reviewed is due three (3) workdays after review is complete. The need for this activity will be initiated from several different groups within VA and will be assigned by DQ Management as needed. The contractor shall have between 24 hours and 2 weeks to review, based on deadlines provided by requesting groups within VA. The documents will range in length from approximately 2 to 50 pages. In addition to the summary of findings, the written comments (i.e. identification of anomalies, edits for completeness and accuracy) will be provided to the requesting VA groups within deadlines, defined and in the format requested (standard documents and spreadsheets).

SUPPORT OF DATA QUALITY, DATA GOVERNANCE AND DATA STEWARDSHIP

The Data Quality Program is responsible for supporting data quality, data governance and data stewardship activities in identity and clinical data areas within VA and VHA.

A. To support the improvement of data quality within the organization, the contractor shall participate in quality improvement activities including:

· Responding to identified data quality issues from internal and external customers, including the investigation, analysis, and submission of recommendations in response to data quality issue tickets, including those shared from the Performance Measurement Help Desk;

· Developing and submitting trouble tickets, change requests, and new service requests to OIT development staff for any identified defects or unresolved issues;

· Working with sites to identify and improve data quality metrics and measures;

· Supporting the creation of data quality metrics and Key Performance Indicators (KPIs) for internal and external stakeholders, to enhance the quality of organizational data;

· Performing analytical work in support of Program Offices, such as Lab Kidney Office, Health Information Management (HIM), and others within VA and VHA.

· Developing and supporting dashboards and metrics for monitoring of clinical data quality (i.e. NULL LOINC, LOINCS not in value set, Clinical Documentation Integrity (CDI), and review of Oracle Health unknown queues);

· Assisting sites in meeting accreditation requirements and goals;

· Reviewing and modifying where necessary, data quality tools and monitors used to track and improve patient identity data quality;

· Performing data quality analytics and clinical record reviews related to electronic quality measures (eQM), algorithm development and metrics, including verifying standard codes used.

B. In support of data governance and data stewardship within VHA and VA, the contractor may be asked to participate in VA and VHA-level data governance and data stewardship activities, including attendance and support for meetings of councils, sub-councils, and inter-departmental data governance and data stewardship groups (i.e. VA/ Department of Defense Data Harmonization, Veterans Experience Office (VEO) Data Quality Council, Federal Electronic Health Record Modernization (FEHRM) Data Quality Committee, VHA Data Stewardship Sub Council) as a consultant and/or subject matter expert. The contractor may also be tasked with action items and follow up assignments from data governance and data stewardship working groups.

Deliverables A. The number of specific data quality issues including tickets from internal and external stakeholders investigated, analyzed, and resolved, as well as trouble tickets, change requests, and new service requests submitted to OIT development staff for any identified defects or unresolved issues. (36 per Period of Performance) B. Monthly status report of any new or updated dashboards or other tools used to improve or monitor clinical or other quality measures.

C. Monthly status report of conference calls and/or meetings attended with data quality, data stewardship, and data governance entities, in support of the incorporation of data quality, data governance, and data stewardship in VA processes and functions and resulting action items and follow up.

REQUIREMENTS AND BUSINESS RULES DEVELOPMENT, MODIFICATION, AND VALIDATION

The contractor shall develop new and modify existing business rules and requirements supporting Data Quality, Clinical Data Quality, Data Stewardship, and Healthcare Identity Management (HCIdM) to address program objectives, issues, errors, and service requests that are submitted by the Data Quality Program’s internal and external customers including technical development staff. These requirements and business rules could be in support of EHRM implementation, electronic quality measures (eQM), new service requests support or other initiatives. As new business rules and requirements are developed, the contractor shall review and update existing DQ enterprise and internal requirements and business rules that are documented in internal document shares and/or on the enterprise requirements repository. The contractor shall post new and modified requirements and/or business rules to the DQ SharePoint site as well as update DQ documents that have references to the DQ SharePoint site. Within five (5) days of completing the updates, the contractor shall notify the VA PM via email and provide a brief description of what updates were completed. In support of new and existing software requirements and business rules the Contractor may participate in User Acceptance Testing (UAT), including creation and execution of test plans, clinical record reviews, algorithm functionality testing, and other tasks.

Deliverables:

A. New and/or updated business rules and requirements in appropriate format (MS Word or current requirements documentation software). New and existing business rules and/or requirements updates are estimated by the Government to be approximately 23 per year, depending on new external and internal project initiatives.

B. Submission of test plans and overview of testing completed including high level test cases in support of User Acceptance Testing (UAT) on software development at approximately 23 per period of performance.

DATA QUALITY ANALYTICS

The contractor shall provide Data Quality Analytics services such as data profiling, trending, statistical analysis, graphing, and data reporting in response to requests submitted by DQ internal and external customers (i.e. sub-Programs within the Data Quality Program and external stakeholders), however, will be mitigated and assigned by DQ staff. This analysis is used to determine and support decision-making, policy development, issue resolution, and other tasks related to Data Quality, including Identity Management, Clinical Data Quality, and Data Management. Analysis will be performed on Government-owned systems, including the VA MPI, CDW, and other databases, using industry standard tools, such as SQL and TOAD. The contractor shall provide the Government with results for both informal and formal DQ Analytics services, which are described in detail below.

A. Informal Data Quality Analytics (informational or “ad hoc”): The contractor shall provide informal DQ Analytics in response to requests submitted by the DQ Program’s internal and external customers. The DQ Analytics services performed in response to requests are considered informal due to the fact that the process for performing the DQ Analytics services and presenting results is not pre-defined. The contractor shall review the requests and use subject matter expertise to identify what type of DQ Analytics services shall be completed (data profiling, trending, statistical analysis, graphing, etc.) and how findings shall be presented, along with the customer. Data for analysis work shall be obtained from Government-owned systems and could take the form of SQL queries, delimited files exported to spreadsheets or other forms. Analysis performed will display knowledge of the data meaning and use and will fulfill the request for analysis. Examples may include analysis of the data quality of specific identity traits and suitability for use in Identity Management on a patient wristband, review of NULL LOINCS or LOINCs not in a value set within the EHR, and/or CDI efforts. Analysis results may take the form of a white paper, presentation, data report, graph, tables, or narrative within an email message.

B. Formal Data Quality Analytics: The contractor shall provide formal Data Quality Analytics for business process re-engineering or quality improvement activities. Examples of tools that may be used for analysis include Healthcare Failure Mode and Effect Analysis (HFMEA) and Root Cause Analysis (RCA). The DQ Analytics services performed in response to such requests are considered formal due to the fact that the data quality tools and concepts used for performing the DQ Analytics services and presenting subsequent results are established (i.e. HFMEA and RCA). Therefore, the contractor shall use the established industry-standard-processes for workflow, efficiency, error reduction and/or other quality improvement efforts. The analysis will be related to clinical data quality, data management or identity management topics, which will require extensive expertise in these subject areas. The requests for formal data quality analytics may be the result of participation in Performance Improvement efforts, Office of Inspector General (OIG) reporting, identified patient safety issues or other critical data quality incidents. Requests may also be initiated based on internally identified data quality improvement opportunities.

C. Creation of Data Quality Metrics and Monitoring: The contractor shall provide mechanisms to identify, create, and maintain metrics to reflect the quality of essential data used in identity management, clinical decisions, performance measurement other priority functions. Examples include dashboards use to monitor Oracle Health Message Center traffic, Oracle Health unknown queues, and identity traits not within defined ranges.

Deliverables:

A. Deliverables for informal analysis will take the form of a white paper, presentation, data report, dashboard, graph, table, or narrative within an email message. Deliverables are due by the pre-determined timeframe that is agreeable to the Government and will vary from 1 to 30 days. Requests for informal analysis are estimated by the Government to be approximately 45-50 per year. Comment by Bodzenta, Bernadette (VHACLE): Since these both say “approximately” shall I leave “A” at 45 and “B” at 20 and “C” at 20? Comment by Zibura, Denise: See updated IGCE

B. Reports and findings from DQ Analytics services performed in response to business process improvement or re-engineering requests will take the form of formal written reports, including tables, flow diagrams, dashboards, graphs, and presentations. Deliverables are due by the pre-determined timeframe that is agreeable to the Government and will vary from 1 to 3 months. It is estimated by the Government that approximately 20 formal analysis efforts/year will be performed.

C. Deliverables for creation of data quality metrics and monitoring would be: creation of new metrics, and monitoring of DQ metrics will be determined based on frequency of data refreshes and could be monthly, quarterly, or annually, totaling approximately 15-20 for the period of performance. List of current or new metrics developed during the reporting period including any links to dashboards, metrics, or other monitoring created. The results of routine and recurring monitoring that would identify issues or anomalies that need to be addressed.

OPTIONAL - DATA QUALITY ANALYTICS

The contractor shall provide Data Quality Analytics services such as data profiling, trending, statistical analysis, graphing, and data reporting in response to requests submitted by DQ internal and external customers (i.e. sub-Programs within the Data Quality Program and external stakeholders), however, will be mitigated and assigned by DQ staff. This analysis is used to determine and support decision-making, policy development, issue resolution, and other tasks related to Data Quality, including Identity Management, Clinical Data Quality, and Data Management. Analysis shall be performed on Government-owned systems, including the VA MPI, CDW, and other databases, using industry standard tools, such as SQL and TOAD. The contractor shall provide the Government with results for both informal and formal DQ Analytics services, which are described in detail below.

A. Informal Data Quality Analytics (informational or “ad hoc”): The contractor shall provide informal DQ Analytics in response to requests submitted by the DQ Program’s internal and external customers. The DQ Analytics services performed in response to requests are considered informal due to the fact that the process for performing the DQ Analytics services and presenting results is not pre-defined. The contractor shall review the requests and use subject matter expertise to identify what type of DQ Analytics services shall be completed (data profiling, trending, statistical analysis, graphing, etc.) and how findings shall be presented, along with the customer. Data for analysis work shall be obtained from Government-owned systems and could take the form of SQL queries, delimited files exported to spreadsheets or other forms. Analysis performed will display knowledge of the data meaning and use and will fulfill the request for analysis. Examples may include analysis of the data quality of specific identity traits and suitability for use in Identity Management on a patient wristband, review of NULL LOINCS or LOINCs not in a value set within the EHR, CDI efforts. Analysis results may take the form of a white paper, presentation, data report, graph, tables, or narrative within an email message.

B. Formal Data Quality Analytics: The contractor shall provide formal Data Quality Analytics for business process re-engineering or quality improvement activities. Examples of tools that may be used for analysis include Healthcare Failure Mode and Effect Analysis (HFMEA) and Root Cause Analysis (RCA). The DQ Analytics services performed in response to such requests are considered formal due to the fact that the data quality process tools and concepts used for performing the DQ Analytics services and presenting subsequent results are is established (i.e. HFMEA and RCA). Therefore, the contractor shall use the established industry-standard-processes for business process re-engineering workflow, efficiency, error reduction and/ or other quality improvement efforts. The analysis will be related to clinical data quality, data management or identity management topics, which will require extensive expertise in these subject areas. The requests for formal data quality analytics may be the result of participation in Performance Improvement efforts, Office of Inspector General (OIG) reporting, identified patient safety issues or other critical data quality incidents. Requests may also be initiated based on internally identified data quality improvement opportunities.

C. Creation of Data Quality Metrics and Monitoring: The contractor shall provide mechanisms to identify, create, and maintain metrics to reflect the quality of essential data used in identity management, clinical decision support, performance measurement other priority functions. Examples include dashboards use to monitor Oracle Health Message Center traffic, Oracle Health unknown queues, identity traits not within defined ranges.

Deliverables:

A. Deliverables for informal analysis shall take the form of a white paper, presentation, data report, dashboard, graph, table, or narrative within an email message. Deliverables are due by the pre-determined timeframe that is agreeable to the Government and will vary from 1 to 30 days. Requests for informal analysis are estimated by the Government to be approximately 20 per year. Comment by Bodzenta, Bernadette (VHACLE): Keep at 20? Comment by Zibura, Denise: See updated IGCE

B. Reports and findings from DQ Analytics services performed in response to business process improvement or re-engineering requests shall take the form of formal written reports, including tables, flow diagrams, dashboards, graphs, and presentations. Deliverables are due by the pre-determined timeframe that is agreeable to the Government and will vary from 1 to 3 months. It is estimated by the Government that approximately 8 formal analysis efforts/year will be performed. Comment by Bodzenta, Bernadette (VHACLE): Would this be decreased to 7 ? Comment by Zibura, Denise: See updated IGCE

C. Deliverables for creation of data quality metrics and monitoring would be: a) creation of new metrics anticipated at 2-3 per period of performance, and b) monitoring of DQ metrics will be determined based on frequency of data refreshes and could be monthly, quarterly, or annually, totaling approximately 7-8 for the period of performance. List of current or new metrics developed during the reporting period including any links to dashboards, metrics, or other monitoring created. The results of routine and recurring monitoring that would identify issues or anomalies that need to be addressed. Comment by Bodzenta, Bernadette (VHACLE): Quantity? Comment by Zibura, Denise: See updated IGCE

OPTIONAL - BUSINESS AND TECHNICAL DOCUMENT DEVELOPMENT AND REVIEW Comment by Bodzenta, Bernadette (VHACLE): Please weigh in the estimated for Optional CLINS Comment by Zibura, Denise: They should stay the same The contractor shall review and provide expert input into business and technical documents such as Business Requirement Documents (BRDs), Executive Decision Memos (EDMs), New Service Requests (NSRs), project charters, and guidance documents that are submitted by internal and external DQ customers for software development projects, as directed by HIG DQ leadership. Documents will be reviewed for completeness, accuracy, and compliance with the VHA Enterprise Data Quality Requirements, Enterprise Data Catalog (EDC) guidelines, and all other relevant criteria, which will be made available to the contractor after contract award. The contractor shall:

A. Identify data quality issues within the documents and assign a level of complexity for resolution of the issues, in accordance with industry standard identity management and data quality principles;

B. Indicate the level of Data Quality involvement necessary for the project based on criteria iterated above, such as whether or not identity management services will be used by the project and to what extent;

C. Verify that the business and technical documents contain required references to Clinical and Administrative Data Quality (DQ) Requirements;

D. Verify that all applicable DQ Requirements are included in the business documents such as BRDs, EDMs, NSRs, project charters, white papers, business flow diagrams, and guidance documents;

E. Provide recommendations for revisions and corrections to business and technical documents such as BRDs, EDMs, NSRs, project charters, white papers, and guidance documents, to bring them in compliance with VA-defined requirements and DQ industry standards;

The contractor shall prepare a summary of findings that includes: the identified Data Quality Issues; assigned level of complexity; comment or anomaly logs and/or marked-up documents with identified deficiencies in meeting DQ requirements as set forth in the VA Enterprise Requirements Repository, Enterprise Data Catalog (EDC) and within data quality requirements specifications use cases and business process flows, and final complexity evaluation of the project and level of DQ involvement required. This summary shall be delivered to the Government via e-mail.