Attachment 2 - PWS Ambient Scribe.docx

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Veterans Health Administration Digital Health Office

Ambient Scribe

PWS Version Number: 1

Contents

1.0 BACKGROUND

The mission of the Department of Veterans Affairs (VA) Veterans Health Administration (VHA) is to provide superior healthcare services to Veterans of the United States. As the largest integrated healthcare system in the country, VA is uniquely positioned to develop and provide advanced healthcare capabilities to over 9 million Veterans. One significant challenge facing the VA and its ability to deliver high quality and reliable patient care to our Nation’s Veterans is the increase in demand for veteran patients to be seen within the VA healthcare system. In the short window of time allocated for each patient appointment, providers have a multitude of clinical and administrative tasks to be completed. This causes risk of important information being omitted due to rushed interviews and contributes to provider burn out. The myriad of tasks expected of providers beyond caring for patients puts significant strain on them professionally. This strain has the potential to negatively impact patient care. It can also contribute to provider attrition, causing additional impact to Veterans and clinical staff.

The use of ambient scribe technology reduces the risk of omitting vital clinical information and mitigates the risk of impacting patient care. Artificial Intelligence (AI) ambient scribe utilizes the microphone on a secure device. The ambient AI scribe transcribes patient encounters and uses machine learning and natural-language processing to summarize the conversation's clinical content. It then produces a transcribed note documenting the visit. Such transcribed conversations between patients and providers automatically leverage AI technologies to create notes (generate clinical documentation) and summarize a patient’s visit. Automating these tasks increases accuracy of information, saves the providers time, and reduces their mental strain. Visit notes that include a patient’s care plan is a critical component of treatment and care delivery. The software functions as a medical and clinical system, equipment, device, or software (MCSEDS) as defined in VA Directive 6008.

Ambient scribe technology also enables other labor-saving capabilities to include but not limited to: coding support, order capture, after-visit summaries, drafting care plans and other capabilities.

The ambient scribing solution required is unique to the operational environment and specific challenges faced by the Veterans Health Administration (VHA). In January 2024, VHA undertook an AI Technical Sprint challenge to ensure that potential solutions were rigorously tested through a competitive and impartial evaluation process under H.R. 4521-Bioeconomy Research and Development Act Of 2021 [America COMPETES Act of 2022]. The goal of the competition was to pilot the top AI solutions identified through the VHA AI Tech Sprint Track 1: Ambient Dictation of Clinical Encounters. The Tech Sprint was executed as part of the strategic initiatives outlined under Executive Order (EO) 14110 for enhancing veterans’ healthcare and addressing provider burnout.

The advanced AI-enabled tools for ambient scribing focus on enhancing clinical documentation across primary care, mental health, and specialty care settings. The solution shall meet the following requirements:

· Transcription and Note Generation: Automatically extract transcripts and key details from ambient recordings of patient encounters, creating traceable, high-fidelity records.

· Interoperability and Integration: Seamlessly integrate with existing VA health system information technologies, particularly the Electronic Health Record (EHR) systems, to ensure smooth operational continuity and data consistency.

· Security Compliance: Adhere to stringent VA privacy and security standards for the protection of patient data.

· Advanced Functionalities: May include capabilities to populate diversified note templates, recommend diagnoses and referrals, and maintain high performance even in challenging clinical settings.

· Patient Communications: Generate patient-facing summaries (After Visit Summaries) that include educational materials, reminders, and follow-up recommendations which adhere to clinical documentation compliance standards.

Throughout the Technical Sprint, many solutions demonstrated superior technical maturity and clinical performance. Their development was closely aligned with the urgent needs of the VHA, specifically targeting enhancements in provider burnout and clinical documentation efficiencies. IT professionals and healthcare providers assessed these solutions for their maturity and practical applicability in real-world clinical settings, ensuring that they met the highest standards for operational readiness.

Moreover, the effectiveness and safety of these solutions were evaluated through a series of blind scoring assessments. Physicians compared the AI-generated outputs against those produced by human clinicians, establishing their accuracy and reliability without bias. Additionally, their usability and potential for seamless integration into the VHA’s existing EHR systems were critically assessed to determine their capability to enhance operational continuity and data consistency within the VA health care system. This approach ensured a thorough evaluation of potential Contractors in a manner that fostered broad competition and verified that the selected Contractors met legal, technical, and operational requirements. Evaluations concluded in May 2024.

VA personnel assigned to the Digital Health Office will coordinate with SimLEARN personnel to access the system and run a real-time test to verify outputs. The test will occur at VA’s SimLEARN facility and will be conducted by VA staff.

2.0 SCOPE OF WORK

The purpose of this contract is to provide a Commercial-Off-the-Shelf (COTS), cloud-based, ambient scribe solution to transcribe clinical encounters and generate notes utilizing a Software as a Service (SaaS) delivery model with AI techniques and technologies. This tool shall integrate with VA’s EHR systems and workflows so providers can initiate encounter recordings. This mitigates the need for manual entry of patient identifying information and enables automatic insertion of draft notes into EHR.

3.0 PERIOD OF PERFORMANCE

The Period of Performance (PoP) consists of an 18-month Base Period with four, 1-year option periods. The base period shall be utilized to complete the pilot. The Contractor shall adhere to the delivery schedule as outlined in the contract, incorporating the milestones for Authority to Operate (ATO) acquisition.

4.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements For Cryptographic Modules”

4. FIPS Pub 199. Standards for Security Categorization of Federal Information and Information Systems, February 2004

5. FIPS Pub 200, Minimum Security Requirements for Federal Information and Information Systems, March 2016

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013.

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. Carnegie Mellon Software Engineering Institute, Capability Maturity Model® Integration for Development (CMMI-DEV), Version 1.3 November 2010; and Carnegie Mellon Software Engineering Institute, Capability Maturity Model® Integration for Acquisition (CMMI-ACQ), Version 1.3 November 2010

9. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

10. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

11. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

12. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

13. VA Handbook 0710, Personnel Security and Suitability Program, May 2, 2016,https://www.va.gov/vapubs/index.cfm

14. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

15. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

16. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

17. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

18. NIST SP 800-66 Rev. 1, An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, October 2008.

19. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

20. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

21. VA Directive 6500, “VA Cybersecurity Program,” January 24, 2019

22. VA Handbook 6500, “Risk Management Framework for VA Information Systems – Tier 3:VA Information Security Program,” March 10, 2015

23. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI)”, July 28, 2016

24. VA Handbook 6500.3, “Assessment, Authorization, And Continuous Monitoring Of VA Information Systems,” February 3, 2014

25. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle”, March 22, 2010

26. VA Handbook 6500.6, “Contract Security,” March 12, 2010

27. VA Handbook 6500.8, “Information System Contingency Planning”, April 6, 2011

28. VA Handbook 6500.11, “VA Firewall Configuration”, August 22, 2017

29. OI&T Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

30. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

31. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

32. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

33. VA Handbook 6510, “VA Identity and Access Management”, January 15, 2016

34. VA Directive and Handbook 6513, “Secure External Connections”, October 12, 2017

35. VA Directive 6300, Records and Information Management, September 21, 2018

36. VA Handbook, 6300.1, Records Management Procedures, March 24, 2010

37. NIST SP 800-37 Rev 1, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy, December 2018.

38. NIST SP 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems and Organizations, January 22, 2015

39. OMB Memorandum, “Transition to IPv6”, September 28, 2010

40. VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, October 26, 2015

41. VA Handbook 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, March 24, 2014

42. OMB Memorandum M-06-18, Acquisition of Products and Services for Implementation of HSPD-12, June 30, 2000

43. OMB Memorandum 04-04, E-Authentication Guidance for Federal Agencies, December 16, 2003

44. OMB Memorandum 05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, August 5, 2005

45. OMB memorandum M-11-11, “Continued Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, February 3, 2011.

46. OMB Memorandum, Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation, May 23, 2008

47. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011.

48. NIST SP 800-116 Rev 1, Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access, June 2018.

49. OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007

50. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, Digital Identity Guidelines, December 2017

51. NIST SP 800-157, Guidelines for Derived PIV Credentials, December 2014

52. NIST SP 800-164, Guidelines on Hardware-Rooted Security in Mobile Devices (Draft), October 2012

53. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981 Mobile, PIV, and Authentication, March 2014

54. VA Memorandum, VAIQ #7100147, Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12), April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

55. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

56. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

57. Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.2, Federal Interagency Technical Reference Architectures, Department of Homeland Security, June 19, 2017, https://www.dhs.gov/sites/default/files/publications/TIC_Ref_Arch_v2.2_2017.pdf

58. OMB Memorandum M-08-05, “Implementation of Trusted Internet Connections (TIC),November 20, 2007.

59. OMB Memorandum M-08-23, Securing the Federal Government’s Domain Name System Infrastructure, August 22, 2008

60. VA Memorandum, VAIQ #7497987, Compliance – Electronic Product Environmental Assessment Tool (EPEAT) – IT Electronic Equipment, August 11, 2014 (reference Document Libraries, EPEAT/Green Purchasing Section, https://www.voa.va.gov/documentlistpublic.aspx?NodeID=552)

61. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

62. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

63. Executive Order 13834, “Efficient Federal Operations”, dated May 17, 2018

64. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

65. VA Directive 0058, “VA Green Purchasing Program”, July 19, 2013

66. VA Handbook 0058, “VA Green Purchasing Program”, July 19, 2013

67. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access”, January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

68. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

69. “Veteran Focused Integration Process (VIP) Guide 3.2”, December 2018, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

70. VA Memorandum “Proper Use of Email and Other Messaging Services”, January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

71. VA Directive 6066, “Protected Health Information (PHI) And Business Associate Agreements Management”, September 2, 2014

5.0 PLACE OF PERFORMANCE

The tasks under this Performance Work Statement (PWS) shall be performed at Contractor facilities and at VA facilities identified herein.

6.0 CONTRACT TYPE

This is intended to be a multiple award hybrid (firm-fixed price, labor hour, and cost reimbursement) IDIQ contract.

6.1 License Price Escalation Rates

Price increases to include optional tasks for licenses shall be capped at 6% per year for the duration of the contract.

7.0 TRAVEL

The Government anticipates travel under this effort to perform associated tasks and attend program-related meetings. All travel costs shall be included in the travel CLIN.

There will be a total of five (5) trips in support of the program to include related meetings. Locations include the sites specified below in section 8.3.1.3 SaaS Solution and shall not exceed two (2) days in duration each.

8.0 SPECIFIC TASKS AND DELIVERABLES

8.1 ADMINISTRATIVE

Tasks performed will be of a non-personal nature. VA organizations will not provide supervision of Contractor personnel. Contractor personnel shall at no time allow an employer-employee relationship to develop with VA organizations or their staff. VA organizations will refrain from any activities that create the appearance of such a relationship.

Contractor shall not perform inherently Governmental functions including: decision-making, supervision of Government employees, supervision of other Contractors on other contracts, and activities that create the appearance of performing such functions.

Contractor shall deliver all written artifacts using straightforward language. Technical and mathematical terms shall only be used when accompanied by a glossary. Deliverables shall be accepted based, in part, on satisfaction of Section 508 of the Rehabilitation Act of 1973. VA reserves the right to test for Section 508 Compliance before delivery. The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

Contractor shall submit final written deliverables in Microsoft Word, PowerPoint, or Excel format. Contractor shall provide files converted to Adobe PDF format upon request by the COR or Program Manager (PM).

The Contractor shall perform the tasks and complete the associated deliverables under this contract by the scheduled due dates within the overall period of performance. If the Contractor cannot deliver those deliverables specified by this contract by the required due date, then the Contractor shall provide a written explanation to the Contracting Officer (CO) within one (1) business day of the deliverable due date. This written transmittal shall include the reasons for the delay; when the Contractor knew or should have known a delay would incur; due diligence taken to mitigate the problems, the impact on the overall project; and a firm commitment of when the work is to be completed.

The Contractor shall perform the tasks and complete the associated deliverables under this contract by the scheduled due dates. If the Contractor is unable to meet the specified due date, the Contractor shall provide a written explanation to the Contracting Officer (CO) and the Contracting Officer’s Representative (COR). If the delay is foreseeable, the Contractor must provide notification at least two (2) business days prior to the due date. If the delay is unforeseen, the Contractor must provide notification within one (1) business day of the due date. This written notification shall include:

1. Justification for the delay.

2. Identification of when the Contractor knew or should have known a delay would incur.

3. Actions taken to mitigate the delay and impact on the overall project.

4. A firm commitment of when the work is to be completed.

The Government will have ten (10) business days to review each deliverable and provide feedback/comments. The Contractor shall have five (5) business days to incorporate feedback/comments and make appropriate revisions. The Contractor shall provide the revised version of each deliverable to the Contracting Officer Representative (COR). The COR will review and determine final acceptance by the Government. The COR will then notify the Contractor of final acceptance within five (5) business days.

8.2 REPORTING REQUIREMENTS

8.2.1 Project Management Plan

The Contractor shall deliver a Project Management Plan (PMP) that describes the product delivery schedule, milestones, and risks within the deadlines established by the Government in the tasks below. The Contractor shall deliver the initial PMP at the technical kickoff meeting. Work shall not commence until the VA PM approves the final PMP.

8.2.2 Monthly Progress Reports

The Contractor shall provide the COR with Monthly Progress Reports that include product delivery status, milestones achieved during the past month, activities planning in the coming month, and delivery risks to include recommended risk mitigations. The report shall identify problems and corrective actions. If problems have not been completely resolved, the Contractor shall provide an explanation, a description of planned course of action, and timeframe for resolving the issue. The Contractor shall monitor performance to ensure it complies with the previous report’s list of action items and report any deviations.

8.2.3 Post Award Kickoff

The Contractor shall hold a post-award kickoff meeting within 10 business days after contract award. The Contractor shall present the details of the intended approach, work plan, and project schedule for each effort for review and approval by the Government. The Contractor shall collaborate with the Government to coordinate post-award meeting dates, agenda topics, and meeting. The meeting shall be held virtually and the Contractor shall ensure the CO, Contract Specialist (CS), COR, and VA PM receive meeting invites.

Deliverables:

1. Agenda - The agenda shall be provided at least five (5) calendar days prior to the meeting.

2. Meeting Minutes - The meeting minutes shall be provided no later than three (3) calendar days after the meeting.

8.2.4 Monthly Usage Statistics Reports

The Contractors shall deliver monthly usage reports regardless of on-demand reporting capabilities. Usage reports shall include:

1. The number of times an end user utilizes the system over the reported time frame.

2. Reports of license holders who have not logged in organized by week.

3. All comments regarding quality submitted to the Contractor.

4. Transcripts of patient encounters.

5. Data identifying the number of edits as well as the duration of time dedicated to editing notes prior to their approval by the physician.

6. The total number of scribed patient encounters.

7. Issue logs.

8.2.5 Additional Integrations

At the end of each performance period and when requested by the COR, the Contractor shall present a list of additional integrations required to scale the project beyond the pilot. This may include but is not limited to additional data sets to connect to, software, and tools to be created.

Project Management Deliverables:

A. Project Management Plan B. Monthly Progress Reports C. Post Award Kickoff Meeting Minutes D. Monthly Usage Statistics Report E. Report on additional integrations needed for scalable use beyond pilot.

8.3 FUNCTIONAL AREAS

8.3.1 PLATFORM FUNCTIONAL REQUIREMENTS

The ambient dictation system shall run passively on Government equipment during clinical encounters and generate draft clinical documentation following the encounter in near real-time. The system should work in a variety of clinical settings, including those with poor wireless signals, poor cellular data, and in a variety of room sizes and setups. Providers shall have the opportunity to edit the note prior to signing it in the EHR. The tool shall be integrated with the EHR and workflows such that providers can initiate encounter recording without manual entry of patient identifying information, and draft notes can be automatically inserted into the EHR without copy and paste manual effort. The base period of performance will be focused on ambient scribing in a primary care setting, but the tool must be capable of expanding to specialty care modalities. The platform’s initial period of performance will be limited to use by physicians and primary care providers only.

Finally, the Contractor shall support VA efforts to measure the impact of the solution and collaborate with VA to identify which additional integrations are needed for scalable use beyond pilot.

8.3.1.1 FedRAMP

The Contractor shall provide a cloud-hosted, Commercial Off-the-Shelf (COTS) ambient dictation SaaS solution, on a Contractor-provided infrastructure that is complaint with the Federal Risk Authorization Management Program (FedRAMP). See Section 8.3.4 of this PWS for additional details regarding FedRAMP and VA Authority to Operate (ATO) requirements. Alternatively, the solution may be hosted on the VA Enterprise Cloud, contingent upon VA provision of an ATO, in which case the Contractor shall coordinate with VA to ensure compliance with all applicable security and operational directives. For specific platform functional requirements, the Contractor shall visit the FedRAMP website at www.fedramp.gov. For questions about FedRAMP, the Contractor shall email info@fedramp.gov.

8.3.1.2 Authority to Operate

The Contractor shall obtain an agency issued ATO from the VA. A Joint Authorization Board (JAB) ATO is not acceptable as a substitute. An approved ATO shall be provided for the remainder of the PoP.

8.3.1.3 SaaS Solution

The SaaS solution shall include a web-based app, a mobile app, or both which shall be a clinician facing component compatible with MS Windows and Apple iOS. During the base period of performance, the Contractor shall implement the SaaS solution to include training and operational support, at up to five (5) VA Medical Centers (VAMCs) located in the continental U.S. At the COR’s discretion, alternative sites may be identified as substitutes if the primary sites cannot participate in the pilot. The following sites are currently proposed and may undergo adjustments as necessary.

Potential Pilot Site Designations :

1. Eerie, PA

2. San Francisco, CA

3. Prescott, AZ

4. Ann Arbor, MI

5. Wilmington, DE

6. Tampa, FL

7. Kansas City, MO

8. Dallas, TX

9. Marion, IL

10. Loma Linda, CA

8.3.2 AMBIENT DICTATION IMPLEMENTATION

The Contractor shall implement the ambient dictation capability at the previously identified VAMCs. The ambient dictation capability shall be configured and ready for release within 30 calendar days of contract award. The Contractor shall provide a secure URL to enable access, set up, and configuring of the platform at each site. The platform shall be capable of being supported by the VA IT help desk, however during this pilot, the Contractor shall provide operational support and advice to medical center personnel on the use of the platform.

Deliverable:

A. SaaS Licenses

8.3.3 AMBIENT DICTATION PLATFORM TRAINING AND SUPPORT

The Contractor shall:

1. Provide remote (virtual) training sessions for a total of at least 100 VA clinicians. Training dates shall be coordinated with VA PM and individual site points of contact (POCs). In person or localized training shall be recorded for future reference. All recordings shall be provided to COR or their designee and considered VA intellectual property. The Training shall include an overview of the platform and detailed walkthrough of the capabilities. If a proprietary online training system is used for self-learning, this will not apply.

2. Provide training materials to VA five (5) days prior to training sessions. The Training Materials shall provide role-based training information and a user guide to address how to utilize the ambient dictation platform. Material shall include but not be limited to a detailed user manual and quick reference guide provided in digital formats.

3. Provide technical support (online and via phone) during normal duty hours: Monday thru Friday, 0700-1730 local time in accordance with the implanting facility’s respective time zone. Technical support shall troubleshoot and resolve technical, functional, and access issues. The Contractor shall respond to issues within three (3) business days.

Deliverables:

A. Remote (virtual) training session for up to 500 VA clinicians.

B. Training Materials.

C. Technical support (online and via phone).

8.3.4 ASSESSMENT, AUTHORIZATION, AND CONTINUOUS MONITORING

If the Contractor is using an externally hosted cloud solution, the Contractor shall ensure the ambient dictation SaaS solution has completed the FedRAMP ATO process as detailed below and received approval for the determined FedRAMP impact level prior to activating any software licenses for use. This shall include but is not limited to:

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA).

2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. Following guidance from the Federal CIO, VA will utilize existing JAB ATO or agency ATO issued by another agency as a starting point for FedRAMP requirements. If neither of those exist, VA will sponsor FedRAMP ATO. VA will be using the FedRAMP baselines as a starting point, since they are specifically tailored for cloud services.

4. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application.

5. The Contractor shall complete a FedRAMP System Security Plan (SSP) and supporting documentation within 30 days after contract award.

6. The Contractor shall complete a Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) within 75 days after contract award.

7. The Contractor shall complete a 3PAO Security Assessment Report (SAR) within 90 days after contract award.

8. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases as required by FedRAMP.

9. If new or unanticipated threats or hazards are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with the security addendum B.

10. The Contractor shall not release any data without the consent of VA in writing. All requests for release must be submitted in writing to the COR and CO.

11. In order for live VA data to be used in this system, a FedRAMP Authorization and Agency ATO will be required. For applications hosted on the VA Enterprise Cloud an Agency ATO will still be required.

12. Any software solution must be VA Technical Reference Model (TRM) compliant. More information can be found here: VA Technical Reference Model

Deliverables:

A. FedRAMP System Security Plan (SSP) and supporting documentation (If Applicable).

B. 3PAO Security Assessment Plan (SAP) C. 3PAO Security Assessment Report (SAR) D. VA ATO completion and supporting documentation.

8.4 TRUSTWORTHY ARTIFICIAL INTELLIGENCE

For purposes of this clause, AI is defined as set forth in Executive Order (EO) 13960 and Section 238(g) of the National Defense Authorization Act for Fiscal Year 2019 to include:

1. Any artificial system that performs tasks under varying and unpredictable circumstances without significant human oversight, or that can learn from experience and improve performance when exposed to data sets.

1. An artificial system developed in computer software, physical hardware, or other context that solves tasks requiring human-like perception, cognition, planning, learning, communication, or physical action.

1. An artificial system designed to think or act like a human, including cognitive architectures and neural networks.

1. A set of techniques, including machine learning (ML), that is designed to approximate a cognitive task.

1. An artificial system designed to act rationally, including an intelligent software agent or embodied robot that achieves goals using perception, planning, reasoning, learning, communicating, decision making, and acting.

The Contractor shall provide a list of recommended AI for potential inclusion in the contract. The list of recommended AI shall be provided directly to the COR at least annually but also at the following times: upon proposal submission, contract award, and the COR’s request. AI shall not be used in performance of the contract without the written approval and authorization of the CO. The Contractor shall also report all AI intended for use in contract performance to VA’s National Artificial Intelligence Institute (NAII). The Contractor shall actively engage in AI discovery, assessment, and compliance activities undertaken by VA.

Once the Contractor has obtained CO authorization to use specific AI in contract performance, the Contractor shall provide the COR a signed Statement of Attestation prior to AI implementation. All AI incorporated into the contract shall adhere to the VA Trustworthy AI Framework, available at https://department.va.gov/ai/trustworthy/. The Statement of Attestation shall include but is not limited to a description of all controls, processes, technologies, and mechanisms utilized to satisfy VA’s six (6) AI Principles; Purposeful, Effective and Safe, Secure and Private, Fair and Equitable, Transparent and Explainable, and Accountable and Monitored. The Statement of Attestation shall also certify that the Contractor owns or possesses all legally required rights, copyright, and licenses to use the specified AI. The Statement of Attestation shall clearly state that the use of the AI by VA personnel in performance of the contract:

1. Does not and will not infringe upon any intellectual property rights of any kind.

2. Does not violate any intellectual property rights of any kind.

3. Does not violate any other third-party rights of any kind.

The Statement of Attestation shall also affirm that there have not been any persisting or existing material errors, defects, failures, or interruptions in AI performance of its intended purpose. Additionally, the Statement of Attestation shall include the Contractor’s endorsement that the AI has materially performed in accordance with its specifications and intended purpose. Lastly, the Statement of Attestation shall be updated and resubmitted annually, prior to the exercise of contract option periods. The Statement of Attestation shall be deemed separate from, and in addition to, the Contractor’s reporting requirements relative to the use of AI. The Statement of Attestation is a material term of the contract; accordingly, failure to provide the Statement of Attestation to include all of the aforementioned requirements, may be deemed a breach of contract and thus, cause for termination.

The Contractor (or Subcontractor at any tier, including affiliates) shall not sell, monetize, or otherwise release or misuse any VA models, training data, testing data, patterns, documentation, implementation artifacts, runtime artifacts, or any other digital artifacts, partially or in whole, derived from AI or ML without the express written consent and approval from the CO.

The Contractor shall indemnify VA and its officers, employees, and agents against liability, including costs, for actual or alleged direct or contributory infringement of, or inducement to infringe, any United States or foreign patent, trademark, or copyright, arising out of VA use of any AI products and/or services under the contract.

The Contractor shall maintain commercially reasonable insurance coverage for claims or losses pertaining to the AI products or services being used in performance of the contract.

The Contractor shall maintain commercially reasonable and industry standard conforming security safeguards and controls, including proper access controls for the AI. The Contractor agrees the VA Contracting Officer has the unilateral right to require deactivation of any AI for any reason without notice.

Any development and/or creation of AI as a result of the performance of this contract is subject to applicable Intellectual Property and data rights clauses under the Federal Acquisition Regulation. The Contractor retains ownership of all AI technologies and methodologies developed without the use of VA resources and data assets.

In accordance with EO 13960 Sec. 9 (c), this clause applies to both existing and new uses of AI, both stand-alone AI and AI embedded within other systems or applications, AI developed both by the agency or by third parties on behalf of agencies for the fulfilment of specific agency missions, including relevant data inputs used to train AI and outputs used in support of decision making, and VA procurement of AI applications.

In accordance with EO 13960 Sec. 9 (d), this clause does not apply to AI embedded within common commercial products, such as word processors or map navigation systems. The Contractor shall inform the VA Contracting Officer in writing if it believes the AI it intends to use during contract performance is not covered by this clause. The burden to demonstrate the AI is a common commercial product shall rest solely with the Contractor.

Non-compliance with the terms above, or loss of sensitive VA medical records information resulting from AI use (whether accidental or intentional), may result in Contractor liability to VA for any and all rights and remedies provided by law, including but not limited to contract termination, liquidated damages, and referral to VA’s Suspension and Debarment Committee.

The Contractor shall include the substance of this clause in all subcontracts, including subContractors at any tier and affiliates.

8.5 SUPPORT TO EVALUATION

Essential to this effort is the VA’s evaluation of the system in use, therefore, the Contractor shall support the effort as required. Specifically, the Contractor shall, provide transcripts of all system uses to the VA PM. The COR reserves the right to delegate an alternative POC for transcripts to be provided to by the Contractor. During the kickoff meeting, the Contractor shall collaborate with the COR to determine an acceptable method of delivery. Also, training shall be executed in accordance with the evaluation plan. All data collected as part of the evaluation and the pilot shall be returned to the VA or managed in accordance with VA regulation. The Contractor shall compile the data described in the table below and deliver it with the monthly report.

8.6 OPTIONAL TASKS

8.6.1 Additional Site Configurations

VA reserves the right to execute optional tasks at any point during the contract period of performance. VAMCs may exercise optional tasks to implement at their individual facilities. The task should include support, training, configuration, and coordination to achieve successful site deployment.

8.6.2 Additional User Licenses

Individual VAMCs may fund additional licenses on a monthly or quarterly basis. License cost increases shall not exceed 6% year-over-year throughout the performance of the contract.

8.6.3 Additional Specialty Service Templates

Expansion of ambient scribe solution into specialty care services will be initiated under this contract through the DHO COR. VA will provide supplementary note templates and access to subject matter experts to ensure the ability to capture essential information for patient encounters.

8.6.4 Integration of Additional AI Enabled Capabilities

The Government is interested in aligning ambient scribing capability with additional integrated capabilities to maximize the value of this technology. Specific capabilities the Government would like to see integrated with this technology include:

· Coding Support

· Orders Capture

· After Visit Summaries

· Structured Care Plans

8.6.5 Additional Licenses Required for New Capabilities

If applicable, additional licensing for capabilities not integrated in the initial period of performance shall be made available under this task upon price agreement between VA and the Contractor.

8.6.6 Configuration for VHA integration with Cerner EHR

The platform shall be compatible with the Cerner EHR and (within 45 days of exercising the optional task) the Contractor shall facilitate configuration to activate the platform for VA sites that have adopted the Cerner EHR.

9.0 DELIVERY SCHEDULE

9.1 Base Period

See table below for itemized list of base period deliverables.

Training Materials Technical Support

*NOTE: Though the COR may take aspects of the proposed QASP into consideration, all aspects of the Final QASP to include evaluation methods will be determined by the COR.

9.2 Additional Contract of Deliverables

See table below for itemized list of additional contract deliverables.

· After Visit Summaries

· Care Plans

Prior to implementation, date agreed between COR and the Contractor

10.0 KEY PERSONNEL

Contractor Program Manager The contractor shall propose a program manager and provide their resume for review by the COR. The program manager should have at least 5 years of experience deploying technical solutions at the enterprise level for large healthcare systems.

Contract Project Manager The contractor shall propose a project manager and provide their resume for review by the COR. The project manager should have at least 3 years of experience deploying technical solutions at the enterprise level for lage healthcare systems.

11.0 OTHER DIRECT COSTS

None identified at this time.

12.0 GOVERNMENT- FURNISHED EQUIPMENT, FACILITIES, AND MATERIALS

The Government will provide office space, telephone service, and system access when authorized Contractor employees work at a VA facility to accomplish the tasks associated with this PWS. All procedural guides, reference materials, and program documentation shall be provided to the COR.

If the Contractor determines additional documentation to be pertinent to the successful performance of this contract, the Contractor shall contact the COR to request additional documentation. The Contractor shall consider the COR as the final source for needed Government documentation when the Contractor fails to secure the documents by other means. The Contractor is expected to use common knowledge and resourcefulness in securing all other reference materials, standard industry publications, and related materials that are pertinent to the work.

VA may provide remote access to VA specific systems/network in accordance with VA Handbook 6500, which requires the use of a VA approved method to connect external equipment/systems to VA’s network. Citrix Access Gateway (CAG) is the current and only VA approved method for remote access users when using or manipulating VA information for official VA Business. VA permits CAG remote access through approved Personally Owned Equipment (POE) and Other Equipment (OE) provided the equipment meets all applicable 6500 Handbook requirements for POE/OE. All the security controls required for Government Furnished Equipment (GFE) must be utilized on approved POE or OE. The Contractor shall provide proof to the COR for review and approval that their POE or OE meets the VA Handbook 6500 requirements and VA Handbook 6500.6 Appendix C, herein incorporated as Addendum B, before use.

CAG authorized users shall not be permitted to copy, print, or save any VA information accessed via CAG at any time. VA prohibits remote access to VA’s network from non-North Atlantic Treaty Organization (NATO) countries. The exception to this are countries where VA has approved operations established (e.g. Philippines and South Korea). Exceptions are determined by the COR in coordination with the Information Security Officer (ISO) and Privacy Officer (PO).

This remote access may provide access to VA specific software such as Veterans Health Information System and Technology Architecture (VistA), ClearQuest, PAL, Primavera, and Remedy, including appropriate seat management and user licenses, depending upon the level of access granted. The Contractor shall utilize Government-provided software development and test accounts, document and requirements repositories, etc. as required for the development, storage, maintenance, and delivery of products within the scope of this effort. The Contractor shall not transmit, store, or otherwise maintain sensitive data or products in Contractor systems (or media) within the VA firewall IAW VA Handbook 6500.6 dated March 12, 2010. All VA sensitive information shall be protected at all times, in accordance with VA Handbook 6500, local security field office System Security Plans (SSP’s) and Authority to Operate (ATO)’s for all systems/LAN’s accessed while performing the tasks detailed in this PWS. The Contractor shall ensure all work is performed in countries deemed not to pose a significant security risk. For detailed Security and Privacy Requirements (additional requirements of the contract consolidated into an addendum for easy reference) refer to ADDENDUM A – ADDITIONAL VA REQUIREMENT, CONSOLIDATED and ADDENDUM B - VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE.

13.0 QUALITY ASSURANCE SURVEILLANCE PLAN

The Government will utilize a Quality Assurance Surveillance Plan (QASP) throughout the life of the contract to ensure that the Contractor is performing the services required by this PWS in an acceptable manner. The Government reserves the right to alter or change the surveillance methods in the QASP at its own discretion. A Performance Based Service Assessment will be used by the COR in accordance with the QASP to assess Contractor performance. The Contractor shall develop and deliver the QASP at the time of the project kickoff and revise it in coordination with the Government. The QASP shall be aligned with the Contractor Performance Assessment Reporting System (CPARS) and be tailored to the specifics of this contract.

14.0 GENERAL REQUIREMENTS

14.1 ENTERPRISE AND IT FRAMEWORK

14.1.1 VA TECHNICAL…