ATTACHMENT 3 - CDS_IDIQ_TO2_PWS.docx

CDS IDIQ Task Order 2 – Conversion of Clinical Content to FHIR Artifacts

CDS Indefinite Delivery, Indefinite Quantity (IDIQ) Task Order Performance Work Statement (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Knowledge Based Systems (KBS), Clinical Decision Support (CDS) Team

Task Order 2 – Conversion of Clinical Content to FHIR Artifacts

Date: June 29, 2020 PWS Version Number: 1.0

Contents

BACKGROUND

The Veterans Health Administration (VHA) Clinical Informatics and Data Management (CIDMO), Health Informatics, Office of Knowledge Based Systems (KBS) provides subject matter expertise, policy guidance, and strategic recommendations regarding clinical decision support (CDS) standards implementation for VA’s Information Technology (IT) systems.

The mission of CIDMO is to improve lives of Veterans and staff through better data and tools for better decisions and workflows. CIDMO seeks to help VHA realize its goal to become an agile learning organization through user-centered standardization of health information, clinical processes, and technologies by building standardized best informatics practices for improved field informatics capacity along with robust clinical process modules with Health Information Technology (HIT) configurations.

The mission of KBS is to improve the ability of clinicians to provide care for patients while increasing quality, safety, and efficiency. As part of this mission, KBS seeks to implement CDS within electronic health records (EHRs) broadly, and within VA health information systems specifically (current VA EHR is the Computerized Patient Record System (CPRS)). CDS provides clinicians, staff, patients or other individuals with knowledge and person-specific information, intelligently filtered or presented at appropriate times, to enhance health and health care.[footnoteRef:1] It encompasses a variety of tools and interventions, such as computerized alerts and reminders, clinical guidelines, order sets, patient data reports and dashboards, documentation templates, diagnostic support, and clinical workflow tools. [1: Clinical Decision Support (CDS), “What is Clinical Decision Support (CDS)?” HealthIT.gov website, https://www.healthit.gov/policy-researchers-implementers/clinical-decision-support-cds (Accessed 2016-12-02).]

KBS is organized into four separate components, as discussed below. While the Contractor will primarily support the CDS component, the Government anticipates that the Contractor will need to interact with Federal and/or Contractor staff from any or all of the other KBS components shown below.

· Clinical Decision Support: Provides subject matter expertise on CDS to internal and external collaborators and supports modeling and implementation of VHA’s current and future CDS strategy by identifying and exploring CDS capabilities needed to optimally support patient care.

· Terminology: Provides expert clinical terminology consultation, terminology creation, matching, and modeling to support semantic interoperability and reasoning capabilities in health records.

· Informatics Architecture: Defines VA strategy and architecture as it relates to representation of patient-specific clinical data and knowledge within VA health information systems and with the technical methodologies used to process data for patient care, quality assurance, and secondary uses. The Contractor shall not be responsible for creating VA’s overall strategy and architecture for informatics.

· Standards and Interoperability: Provides expert health standards analysis, creation, engagement and consultation, contributing to a common framework for functional and semantic interoperability by sharing VA requirements and supporting solutions to achieve intelligent health information exchange that extends to enhanced patient care. The Contractor shall not be responsible for creating VA’s overall strategy with respect to Standards and Interoperability.

The CDS Team seeks to evolve and curate its existing clinical decision support Knowledge Artifact (KNART) Clinical Content (e.g., Women’s Health, Suicide Assessment, Endocrinology and Opioid Management) and convert them to the HL7 Fast Healthcare Interoperability Resources (FHIR) Clinical Content as outlined below. Government seeks to convert its existing repository on an incremental basis as outlined in Section 5 below.

APPLICABLE DOCUMENTS

All applicable doucments of Section 3.0 of the Basic IDIQ PWS apply to this effort.

SCOPE OF WORK

The Government seeks to have its previously vetted clinical content, collected in the form of Clinical Content Whitepapers (CCWPs):

A. Reviewed and where appropriate, updated to reflect the most recent clinical knowledge relevant to the content of the CCWP; & B. Reformulated as an HL7 Fast Healthcare Interoperability Resources (FHIR) Questionnaire using that portion of the CCWP previously vetted to produce a HL7 CDS Knowledge Artifact Specification (KAS) Documentation Template.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The PoP shall be twelve (12) months from Date of Award. Overall Period of Performance if any or all Optional Tasks are ordered by the Government shall not exceed twenty-four (24) months from Date of Award.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO). (If required, the CO may designate the Contractor to work during holidays and weekends)

There are ten (10) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

TRAVEL

The Government does not envision any travel on this Task Order.

SPECIFIC TASKS AND DELIVERABLES

Pursuant to CDS IDIQ PWS Sections 5.1 and 6.6.4 and associated CLINS from Section B of the CDS IDIQ, the Government seeks to have the following Clinical Content Whitepapers (CCWPs) reviewed, updated where appropriate, with the most recent clinical content, and then represented as a FHIR Questionnaire:

BASE PERIOD CCWPs FOR REVIEW

Mental Health Opioids and Chronic Noncancer Pain Clinical Content White Paper

Mental Health Suicidality Clinical Content White Paper

OPTIONAL PERIOD CCWPs FOR REVIEW

Neurology TBI Screening Clinical Content White Paper

Eye Care Clinical Content White Paper

Gastroenterology Hepatitis C Clinical Content White Paper

Gastroenterology (Colonoscopy) Colorectal Cancer Risk Clinical Content White Paper

Mental Health Consult for Depression Clinical Content White Paper

Mental Health Homelessness Clinical Content White Paper

Mental Health Post-Deployment Clinical Content White Paper

Cardiology: Chest Pain (CP) / Coronary Artery Disease (CAD) Clinical Content White Paper

Cardiology Pre-op Risk Assessment Clinical Content White Paper

Cardiology Electrophysiology (EP) Implanted Cardiac Device Clinical Content White Paper

Cardiology EP Arrhythmias Devices Clinical Content White Paper

Cardiology VTE Clinical White Paper

Cardiology Inpatient Heparin Anticoagulation Protocol Clinical Content White Paper

Cardiology Admission Orders: Heart Failure Clinical Content White Paper

Cardiology Catheterization Clinical Content White Paper

Endocrinology Hypoglycemia Clinical Content White Paper

Neurosurgery Cervical Radiculopathy Clinical White Paper

Neurosurgery Lumbar/Thoracic Radiculopathy Clinical White Paper

Primary Care Anaphylaxis Clinical Content White Paper

Primary Care Abnormal and Panic Lab Values Clinical Content White Paper

Primary Care General e-Consult Clinical Content White Paper

Primary Care - Family Health History Clinical Content White Paper

Failed Visits and Failed or Delayed Consults Clinical Content White Paper

Primary Care Immunizations Clinical Content White Paper

Primary Care: Tobacco Assessment and Cessation Counseling Clinical Content White Paper

Primary Care General Clinical Note Clinical Content White Paper

Rheumatology Rheumatoid Arthritis Clinical Content White Paper

Rheumatology Psoriatic Arthritis Clinical Content White Paper

Women's Health Reproductive Health Clinical Content White Paper

Women’s Health Well-Woman Visit Clinical Content White Paper

Women’s Health Cervical Cancer Screening Clinical Content White Paper

Women's Health Osteo age more than 65

Women's Health Osteo Age Less Than 65

Women’s Health Follow-Up Abnormal DXA

Women's Health Diagnostic Breast Imaging Clinical Content White Paper

Women's Health: Breast Cancer Screening Clinical Content White Paper

SARS-MERS COVID19

As the first phase of work under this Task Order, the Contractor shall review each of the CCWPs listed in the base period section of the table above to ensure that the clinical content therein is consistent with the most recent and medically accepted clinical content, for the particular clinical domain. Examples of sources to consult for currently accepted clinical content include but are not limited to: VA Clinical Subject Matter Experts; the VA DOD Clinical Practice Guidelines website https://www.healthquality.va.gov/ ; the U.S. Preventive Services Task Force website https://www.uspreventiveservicestaskforce.org/uspstf/; and clinical practice guidelines and articles published by leading clinical professional societies and medical academic institutions. Where the Contractor finds that the content of CCWP has been superseded by more recent content, the Contractor shall edit the CCWP to reflect the change in clinical knowledge, and document said change(s) in a whitepaper. NOTE: The CCWPs may contain any one or more of the following artifacts: documentation template, order set, event condition action (ECA) rule, consult request. The Contractor shall perform review of, and where appropriate update to, all of the artifacts contained in a CCWP. For additional historical reference, the Government is providing, in addition to the CCWPs, additional attachments (see Attachments 14 - 30) relative to the "Mental Health - Suicidality" and "Mental Health - Opioids and Chronic Noncancer Pain" clinical content, from work completed by VA in 2018 with respect to Terminological representation and XML renderings consistent with the HL7 CDS Knowledge Artifact Specification Release 1.3.

The Contractor shall prepare a whitepaper (in MS Word) that: (a) details the scope of the review the Contractor conducted; (b) identifies what differences, if any, were found between the clinical content in the CCWP versus the most recent clinical knowledge; and (c) documents what changes the Contractor made in the CCWP to update its contents to reflect the most recent clinical knowledge. The Contractor shall attach to the whitepaper a fully revised and updated version of the CCWP (as an MS Word file), as appropriate, that reflects all identified changes in clinical knowledge.

Once the review, analysis, and where appropriate, updating of a CCWP is completed, the Contractor shall proceed with the next phase of work under this task order. Under phase two, the Contractor shall only use that content of each CCWP related to a Documentation Template to generate an appropriate HL7 FHIR Questionnaire, as outlined at - https://www.hl7.org/fhir/questionnaire.html – which utilizes the FHIR response resource. As part of this effort, the contractor shall evaluate the suitability of the Questionnaire and QuestionnaireResponse resources for the types of questions necessary to acquire the data necessary for implementation of event-condition-action rules as defined in the CCWPs, and shall propose extensions to the Questionnaire and QuestionnaireResponse resources, and may, in addition to the extensions, also outline other potentially viable approaches to address the identified issues with the Questionnaire and QuestionnaireResponse resources. NOTE, for clarity, the Contractor is not tasked with creation of an appropriate FHIR artifact for event-condition-action rules for this task order.

As an example, to interpret a blood pressure, a clinician may need to know the location (right brachial artery), method (palpation), and preconditions (sitting) associated with a particular measurement (130 mm Hg). What is the best way of obtaining this type of information using the Questionnaire and QuestionnaireResponse resources. Are the “enable when” capabilities of the Questionnaire resource sufficient, or should the resource be extended via a profile to enable new capabilities? How do the questionnaire capabilities compare to other options? The contractor will propose any necessary extensions to the government for review and approval and will use those extensions to encode the clinical content related to documentation templates for each CCWP. An evaluation of the suitability of these FHIR resources, and of any necessary extensions will be part of the project report.

Contractor shall ensure that all question and answer responses that may be generated from each created FHIR Questionnaire are assigned a normalization pattern, which describes how the responses will be normalized as an FHIR Observation Resource using the Analysis Normal Form (ANF). Examples of these patterns are currently in use, and described for the Covid-19 workflow project.[footnoteRef:2],[footnoteRef:3] Contractor shall work with staff from the KBS CDS team and Informatics Architecture team and the contractor supporting Informatics Architecture team, to ensure said result. At the direction of the Government, the Contractor shall also collaborate with staff from the KBS Terminology Team and their supporting contractor team(s) as needed when normalizing a FHIR Observation Resource using ANF. At the direction of the Government, the Contractor shall collaborate as needed with other contractor team(s) executing work under other task order(s) issued pursuant to the overarching CDS IDIQ. [2: https://logica.atlassian.net/wiki/spaces/SOLOR/pages/1011679235/Transformation+Patterns] [3: https://logica.atlassian.net/wiki/spaces/SOLOR/pages/1012367686/Does+patient+have+a+history+of+Diabetes]

The Contractor shall not create FHIR artifacts for any Order Sets, or ECA rules or Consult Requests included in the CCWP. The Contractor shall deliver to Government a FHIR Questionnaire for each Documentation Template outlined in each CCWP in the a zipfile containing the Questionnaire artifacts in XML.

The Government reserves the right, at its discretion, to exercise the option to have one or more of the optional CCWPs listed in the table above processed by Contractor in the same fashion as the Base period set of CCWPs if additional funds are available during the period of performance of this task order.

Deliverables:

A. Analysis whitepaper detailing the Contractor’s review, analysis, and where appropriate include updates to the CCWP with attached updated CCWP artifact B. An analysis whitepaper of fit for purpose of the FHIR Questionnaire and QuestionnaireResponse resources, any proposed extensions, and other alternatives.

C. FHIR Questionnaire Artifact for each Documentation Template described within each updated CCWP

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

REPORTING REQUIREMENTS

The Contractor shall provide the COR with Weekly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding Week.

The Weekly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

In addition, Contractor shall hold bi-monthly teleconference progress meetings with the VA Program Manager and COR, take minutes capturing issues and action items and submit same to the Government within two business days of the meeting.

Deliverable:

A. Weekly Progress Report B. Bimonthly Progress Teleconference with Minutes

GENERAL REQUIREMENTS

All requirements of Section 6.0 of the basic IDIQ PWS apply to this effort. This Task Order shall be addressed in the Contractor’s Progress, Status and Management Report as set forth in the Basic IDIQ contract.

SECURITY AND PRIVACY REQUIREMENTS

It has been determined that protected health information may be disclosed or accessed and a signed Business Associate Agreement (BAA) shall be required. The Contractor shall adhere to the requirements set forth within the BAA, referenced in Section D of the contract, and shall comply with VA Directive 6066.

POSITION/TASK RISK DESIGNATION LEVEL(S)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Position Sensitivity and Background Investigation Requirements by Task

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

Contractor Responsibilities:

1. The Contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain the appropriate Background Investigation, and are able to read, write, speak and understand the English language.

Within 3 business days after award, the Contractor shall provide a roster of Contractor and Subcontractor employees to the COR to begin their background investigations in accordance with the PAL template artifact. The Contractor Staff Roster shall contain the Contractor’s Full Name, Date of Birth, Place of Birth, individual background investigation level requirement (based upon Section 6.2 Tasks), etc. The Contractor shall submit full Social Security Numbers either within the Contractor Staff Roster or under separate cover to the COR. The Contractor Staff Roster shall be updated and provided to VA within 1 day of any changes in employee status, training certification completion status, Background Investigation level status, additions/removal of employees, etc. throughout the Period of Performance. The Contractor Staff Roster shall remain a historical document indicating all past information and the Contractor shall indicate in the Comment field, employees no longer supporting this contract. The preferred method to send the Contractor Staff Roster or Social Security Number is by encrypted e-mail. If unable to send encrypted e-mail, other methods which comply with FIPS 140-2 are to encrypt the file, use a secure fax, or use a traceable mail service.

1. The Contractor should coordinate with the location of the nearest VA fingerprinting office through the COR. Only electronic fingerprints are authorized. The Contractor shall bring their completed Security and Investigations Center (SIC) Fingerprint request form with them (see paragraph d.4. below) when getting fingerprints taken.

b. The Contractor shall ensure the following required forms are submitted to the COR within 5 days after contract award:

1) Optional Form 306

2) Self-Certification of Continuous Service

3) VA Form 0710

4) Completed SIC Fingerprint Request Form The Contractor personnel shall submit all required information related to their background investigations (completion of the investigation documents (SF85, SF85P, or SF 86) utilizing the Office of Personnel Management’s (OPM) Electronic Questionnaire for Investigations Processing (e-QIP) after receiving an email notification from the Security and Investigation Center (SIC).

The Contractor employee shall certify and release the e-QIP document, print and sign the signature pages, and send them encrypted to the COR for electronic submission to the SIC. These documents shall be submitted to the COR within 3 business days of receipt of the e-QIP notification email. (Note: OPM is moving towards a “click to sign” process. If click to sign is used, the Contractor employee should notify the COR within 3 business days that documents were signed via e-QIP).

1. The Contractor shall be responsible for the actions of all personnel provided to work for VA under this contract. In the event that damages arise from work performed by Contractor provided personnel, under the auspices of this contract, the Contractor shall be responsible for all resources necessary to remedy the incident.

1. A Contractor may be granted unescorted access to VA facilities and/or access to VA Information Technology resources (network and/or protected data) with a favorably adjudicated Special Agreement Check (SAC), completed training delineated in VA Handbook 6500.6 (Appendix C, Section 9), signed “Contractor Rules of Behavior”, and with a valid, operational PIV credential for PIV-only logical access to VA’s network. A PIV card credential can be issued once your SAC has been favorably adjudicated and your background investigation has been scheduled by OPM. However, the Contractor will be responsible for the actions of the Contractor personnel they provide to perform work for VA. The investigative history for Contractor personnel working under this contract must be maintained in the database of OPM.

1. The Contractor, when notified of an unfavorably adjudicated background investigation on a Contractor employee as determined by the Government, shall withdraw the employee from consideration in working under the contract.

Failure to comply with the Contractor personnel security investigative requirements may result in loss of physical and/or logical access to VA facilities and systems by Contractor and Subcontractor employees and/or termination of the contract for default.

Identity Credential Holders must follow all HSPD-12 policies and procedures as well as use and protect their assigned identity credentials in accordance with VA policies and procedures, displaying their badges at all times, and returning the identity credentials upon termination of their relationship with VA.

Deliverable:

A. Contractor Staff Roster

METHOD AND DISTRIBUTION OF DELIVERABLES

The Contractor shall deliver documentation in electronic format, unless otherwise directed in Section B of the solicitation/contract. Acceptable electronic media include: MS Word 2000/2003/2007/2010, MS Excel 2000/2003/2007/2010, MS PowerPoint 2000/2003/2007/2010, MS Project 2000/2003/2007/2010, MS Access 2000/2003/2007/2010, MS Visio 2000/2002/2003/2007/2010, AutoCAD 2002/2004/2007/2010, and Adobe Postscript Data Format (PDF).

PERFORMANCE METRICS

The table below defines the Performance Standards and Acceptable Levels of Performance associated with this effort.

2. Efficient and effective in meeting requirements

3. Meets technical needs and mission requirements

4. Provides quality services/products

5. The terminology encoding of questionnaires is reproducible and is specifically measured with statistically valid set of independent duplicate work, as well as overreads.

Satisfactory or higher

2. Products completed, reviewed, delivered in accordance with the established schedule

3. Notifies customer in advance of potential problems Satisfactory or higher

2. Personnel possess necessary knowledge, skills and abilities to perform tasks Satisfactory or higher

The COR will utilize a Quality Assurance Surveillance Plan (QASP) throughout the life of the contract to ensure that the Contractor is performing the services required by this PWS in an acceptable level of performance. The Government reserves the right to alter or change the surveillance methods in the QASP at its own discretion.

FACILITY/RESOURCE PROVISIONS

All requirements of Section 9.10 of the Basic IDIQ PWS apply to this effort

GOVERNMENT FURNISHED PROPERTY

Not Applicable. Contractor shall be provided access to the VA Network via the remote access solution commonly known as Citrix Access Gateway (CAG).

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

Cyber and Information Security Requirements for VA IT Services The Contractor shall ensure adequate LAN/Internet, data, information, and system security in accordance with VA standard operating procedures and standard PWS language, conditions, laws, and regulations. The Contractor’s firewall and web server shall meet or exceed VA minimum requirements for security. All VA data shall be protected behind an approved firewall. Any security violations or attempted violations shall be reported to the VA Program Manager and VA Information Security Officer as soon as possible. The Contractor shall follow all applicable VA policies and procedures governing information security, especially those that pertain to certification and accreditation.

Contractor supplied equipment, PCs of all types, equipment with hard drives, etc. for contract services must meet all security requirements that apply to Government Furnished Equipment (GFE) and Government Owned Equipment (GOE). Security Requirements include: a) VA Approved Encryption Software must be installed on all laptops or mobile devices before placed into operation, b) Bluetooth equipped devices are prohibited within VA; Bluetooth must be permanently disabled or removed from the device, unless the connection uses FIPS 140-2 (or its successor) validated encryption, c) VA approved anti-virus and firewall software, d) Equipment must meet all VA sanitization requirements and procedures before disposal. The COR, CO, the PM, and the Information Security Officer (ISO) must be notified and verify all security requirements have been adhered to.

Each documented initiative under this contract incorporates VA Handbook 6500.6, “Contract Security,” March 12, 2010 by reference as though fully set forth therein. The VA Handbook 6500.6, “Contract Security” shall also be included in every related agreement, contract or order. The VA Handbook 6500.6, Appendix C, is included in this document as Addendum B.

Training requirements: The Contractor shall complete all mandatory training courses on the current VA training site, the VA Talent Management System (TMS) 2.0, and will be tracked therein. The TMS 2.0 may be accessed at https://www.tms.va.gov/SecureAuth35/ . If you do not have a TMS 2.0 profile, go to https://www.tms.va.gov/SecureAuth35/ and click on the “Create New User” link on the TMS 2.0 to gain access.

Contractor employees shall complete a VA Systems Access Agreement if they are provided access privileges as an authorized user of the computer system of VA.

VA Enterprise Architecture Compliance

The applications, supplies, and services furnished under this contract must comply with VA Enterprise Architecture (EA), available at http://www.ea.oit.va.gov/index.asp in force at the time of issuance of this contract, including the Program Management Plan and VA's rules, standards, and guidelines in the Technical Reference Model/Standards Profile (TRMSP). VA reserves the right to assess contract deliverables for EA compliance prior to acceptance.

VA Internet and Intranet Standards

The Contractor shall adhere to and comply with VA Directive 6102 and VA Handbook 6102, Internet/Intranet Services, including applicable amendments and changes, if the Contractor’s work includes managing, maintaining, establishing and presenting information on VA’s Internet/Intranet Service Sites. This pertains, but is not limited to: creating announcements; collecting information; databases to be accessed, graphics and links to external sites.

Internet/Intranet Services Directive 6102 is posted at (copy and paste the following URL to browser): https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=1056&FType=2

Internet/Intranet Services Handbook 6102 is posted at (copy and paste following URL to browser): https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=1055&FType=2

Notice of the Federal Accessibility Law Affecting All Information and Communication Technology (ICT) Procurements (Section 508)

On January 18, 2017, the Architectural and Transportation Barriers Compliance Board (Access Board) revised and updated, in a single rulemaking, standards for electronic and information technology developed, procured, maintained, or used by Federal agencies covered by Section 508 of the Rehabilitation Act of 1973, as well as our guidelines for telecommunications equipment and customer premises equipment covered by Section 255 of the Communications Act of 1934. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.

Section 508 – Information and Communication Technology (ICT) Standards

The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT. These standards are found in their entirety at: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines. A printed copy of the standards will be supplied upon request.

Federal agencies must comply with the updated Section 508 Standards beginning on January 18, 2018. The Final Rule as published in the Federal Register is available from the Access Board: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule.

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

Compatibility with Assistive Technology

The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

Acceptance and Acceptance Testing

Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery. The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

Physical Security & Safety Requirements:

The Contractor and their personnel shall follow all VA policies, standard operating procedures, applicable laws and regulations while on VA property. Violations of VA regulations and policies may result in citation and disciplinary measures for persons violating the law.

1. The Contractor and their personnel shall wear visible identification at all times while they are on the premises.

2. VA does not provide parking spaces at the work site; the Contractor must obtain parking at the work site if needed. It is the responsibility of the Contractor to park in the appropriate designated parking areas. VA will not invalidate or make reimbursement for parking violations of the Contractor under any conditions.

3. Smoking is prohibited inside/outside any building other than the designated smoking areas.

4. Possession of weapons is prohibited.

5. The Contractor shall obtain all necessary licenses and/or permits required to perform the work, with the exception of software licenses that need to be procured from a Contractor or vendor in accordance with the requirements document. The Contractor shall take all reasonable precautions necessary to protect persons and property from injury or damage during the performance of this contract.

Confidentiality and Non-Disclosure

The Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations.

The Contractor may have access to Protected Health Information (PHI) and Electronic Protected Health Information (EPHI) that is subject to protection under the regulations issued by the Department of Health and Human Services, as mandated by the Health Insurance Portability and Accountability Act of 1996 (HIPAA); 45 CFR Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 CFR Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”). Pursuant to the Privacy and Security Rules, the Contractor must agree in writing to certain mandatory provisions regarding the use and disclosure of PHI and EPHI.

1. The Contractor will have access to some privileged and confidential materials of VA. These printed and electronic documents are for internal use only, are not to be copied or released without permission, and remain the sole property of VA. Some of these materials are protected by the Privacy Act of 1974 (revised by PL 93-5791) and Title 38. Unauthorized disclosure of Privacy Act or Title 38 covered materials is a criminal offense.

2. The VA CO will be the sole authorized official to release in writing, any data, draft deliverables, final deliverables, or any other written or printed materials pertaining to this contract. The Contractor shall release no information. Any request for information relating to this contract presented to the Contractor shall be submitted to the VA CO for response.

3. Contractor personnel recognize that in the performance of this effort, Contractor personnel may receive or have access to sensitive information, including information provided on a proprietary basis by carriers, equipment manufacturers and other private or public entities. Contractor personnel agree to safeguard such information and use the information exclusively in the performance of this contract. Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations as enumerated in this section and elsewhere in this Contract and its subparts and appendices.

4. Contractor shall limit access to the minimum number of personnel necessary for contract performance for all information considered sensitive or proprietary in nature. If the Contractor is uncertain of the sensitivity of any information obtained during the performance this contract, the Contractor has a responsibility to ask the VA CO.

5. Contractor shall train all of their employees involved in the performance of this contract on their roles and responsibilities for proper handling and nondisclosure of sensitive VA or proprietary information. Contractor personnel shall not engage in any other action, venture or employment wherein sensitive information shall be used for the profit of any party other than those furnishing the information. The sensitive information transferred, generated, transmitted, or stored herein is for VA benefit and ownership alone.

6. Contractor shall maintain physical security at all facilities housing the activities performed under this contract, including any Contractor facilities according to VA-approved guidelines and directives. The Contractor shall ensure that security procedures are defined and enforced to ensure all personnel who are provided access to patient data must comply with published procedures to protect the privacy and confidentiality of such information as required by VA.

7. Contractor must adhere to the following:

a. The use of “thumb drives” or any other medium for transport of information is expressly prohibited.

b. Controlled access to system and security software and documentation.

c. Recording, monitoring, and control of passwords and privileges.

d. All terminated personnel are denied physical and electronic access to all data, program listings, data processing equipment and systems.

e. VA, as well as any Contractor (or Subcontractor) systems used to support development, provide the capability to cancel immediately all access privileges and authorizations upon employee termination.

f. Contractor PM and VA PM are informed within twenty-four (24) hours of any employee termination.

g. Acquisition sensitive information shall be marked "Acquisition Sensitive" and shall be handled as "For Official Use Only (FOUO)".

h. Contractor does not require access to classified data.

8. Regulatory standard of conduct governs all personnel directly and indirectly involved in procurements. All personnel engaged in procurement and related activities shall conduct business in a manner above reproach and, except as authorized by statute or regulation, with complete impartiality and with preferential treatment for none. The general rule is to strictly avoid any conflict of interest or even the appearance of a conflict of interest in VA/Contractor relationships.

9. VA Form 0752 shall be completed by all Contractor employees working on this contract, and shall be provided to the CO before any work is performed. In the case that Contractor personnel are replaced in the future, their replacements shall complete VA Form 0752 prior to beginning work.

INFORMATION TECHNOLOGY USING ENERGY-EFFICIENT PRODUCTS

The Contractor shall comply with Sections 524 and Sections 525 of the Energy Independence and Security Act of 2007; Section 104 of the Energy Policy Act of 2005; Executive Order 13834, “Efficient Federal Operations”, dated May 17, 2018; Executive Order 13221, “Energy-Efficient Standby Power Devices,” dated August 2, 2001; and the Federal Acquisition Regulation (FAR) to provide ENERGY STAR®, Federal Energy Management Program (FEMP) designated, low standby power, and Electronic Product Environmental Assessment Tool (EPEAT) registered products in providing information technology products and/or services.

The Contractor shall ensure that information technology products are procured and/or services are performed with products that meet and/or exceed ENERGY STAR, FEMP designated, low standby power, and EPEAT guidelines. The Contractor shall provide/use products that earn the ENERGY STAR label and meet the ENERGY STAR specifications for energy efficiency. Specifically, the Contractor shall:

1. Provide/use ENERGY STAR products, as specified at www.energystar.gov/products (contains complete product specifications and updated lists of qualifying products).

2. Provide/use the purchasing specifications listed for FEMP designated products at https://www4.eere.energy.gov/femp/requirements/laws_and_requirements/energy_star_and_femp_designated_products_procurement_requirements . The Contractor shall use the low standby power products specified at http://energy.gov/eere/femp/low-standby-power-products.

3. Provide/use EPEAT registered products as specified at www.epeat.net. At a minimum, the Contractor shall acquire EPEAT® Bronze registered products. EPEAT registered products are required to meet the technical specifications of ENERGY STAR, but are not automatically on the ENERGY STAR qualified product lists. The Contractor shall ensure that applicable products are on both the EPEAT Registry and ENERGY STAR Qualified Product Lists. The acquisition of Silver or Gold EPEAT registered products is encouraged over Bronze EPEAT registered products.

4. The Contractor shall use these products to the maximum extent possible without jeopardizing the intended end use or detracting from the overall quality delivered to the end user.

The following is a list of information technology products for which ENERGY STAR, FEMP designated, low standby power, and EPEAT registered products are available:

1. Computer Desktops, Laptops, Notebooks, Displays, Monitors, Integrated Desktop Computers, Workstation Desktops, Thin Clients, Disk Drives

2. Imaging Equipment (Printers, Copiers, Multi-Function Devices, Scanners, Fax Machines, Digital Duplicators, Mailing Machines)

3. Televisions, Multimedia Projectors

This list is continually evolving, and as a result is not all-inclusive.

ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE

GENERAL

Contractors, Contractor personnel, Subcontractors, and Subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A Contractor/Subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, Subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All Contractors, Subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for Contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates (e.g. Business Associate Agreement, Section 3G), the Contractor/Subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The Contractor or Subcontractor must notify the CO immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the Contractor or Subcontractor’s employ. The CO must also be notified immediately by the Contractor or Subcontractor prior to an unfriendly termination.

VA INFORMATION CUSTODIAL LANGUAGE

1. Information made available to the Contractor or Subcontractor by VA for the performance or administration of this contract or information developed by the Contractor/Subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of VA. This clause expressly limits the Contractor/Subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

2. VA information should not be co-mingled, if possible, with any other data on the Contractors/Subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the Contractor must ensure that VA information is returned to VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on site inspections of Contractor and Subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

3. Prior to termination or completion of this contract, Contractor/Subcontractor must not destroy information received from VA, or gathered/created by the Contractor in the course of performing this contract without prior written approval by VA. Any data destruction done on behalf of VA by a Contractor/Subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the Contractor that the data destruction requirements above have been met must be sent to the VA CO within 30 days of termination of the contract.

4. The Contractor/Subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

5. The Contractor/Subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on Contractor/Subcontractor electronic storage media for restoration in case any electronic equipment or data used by the Contractor/Subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

6. If VA determines that the Contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient…