Attachment A - Performance Work Statement.pdf

PERFORMANCE WORK STATEMENT

Interoperability Pledge Program Support

1. INTRODUCTION

At the “2023 HealthDataPalooza”, the Undersecretary of Health from the US Department of Veterans Affairs (VA), Dr. Shereef Elnahal, announced the creation of a Veteran Interoperability Pledge initiative to facilitate the seamless care experience and immediate access to Veteran patients’ medical history as part of making timely and accurate treatment decisions. With aspirations to help advance treatment and reduce negative outcomes for patients in suicidal crisis, recognizing new and enhanced benefits available to Veterans based upon legislation related to toxic exposures, this pledge will help enhance access to key data between VA and community providers.

This initiative is driven in part by recent legislative actions in the form of the Sergeant First Class Heath Robinson Honoring our Promise to Address Comprehensive Toxics (PACT) Act and the Veterans Comprehensive Prevention, Access to Care, and Treatment (COMPACT) Act addressing Veterans in suicidal crisis. This initiative aims to advance awareness and use of those benefits to the advantage of the Veteran population we serve.

A group of thirteen (13) health systems were initial signatories to the Pledge, committing to developing and providing capabilities that support the objectives of the Pledge: (1) accurately identifying Veterans when seeking care from providers in the community; (2) connecting Veterans with VA and community resources that promote health and healthcare, especially those services that lower out-of-pocket expenses for Veterans; and (3) responsively and reliably coordinating care of shared patients including exchange of information about care requested and provided. All signatories to the Pledge will assist VA in identifying and addressing issues adversely affecting Veteran care, with initial focus on improving the identification of patients that are Veterans, in clarifying and improving eligibility determination for programs under which they may qualify, and to advance health data sharing across institutions in support of their care. Signatories recognize that the work focuses on Veterans but will also have collateral benefit to other vulnerable communities and the public at large. Details about the pledge and the program can be found at the VA website at https://www.va.gov/health/veteran-interoperability-pledge.asp. It is intended for the number of Pledge signatories to increase significantly over time.

A neutral convener will establish an open Community of Practice composed of participants in the information ecosystem with voluntary participation in supporting Veteran care. The convener will provide professional facilitation and management to the Community that will advance technical solutions, business practices, community standards, and regulatory frameworks that advance shared priorities by allowing individual Community members to provide information and viewpoints gathered in the course of their operations. Neutrality is essential to the convening function to ensure all voices are heard and to provide the Community confidence that segments will not be disadvantaged. It will allow VA to better understand challenges and approaches that were productive or unsuccessful. The contractor must be neutral and must be aware this work may cause an organizational conflict of interest, which will be governed by the Federal Acquisition Regulation (FAR) and clauses set forth in the solicitation and contract.

https://www.va.gov/health/veteran-interoperability-pledge.asp

2. SCOPE OR PURPOSE

This effort will establish a neutral home for this Community of Practice, managed by professional facilitators under an organization supporting a growing membership dedicated to supporting the Pledge. This approach will allow the broader ecosystem involved in supporting both Veteran care and providing for similar communities to come together to provide information regarding solution approaches to take on the biggest challenges they face. A forum to provide comments and insight on existing laws, regulations, and constraints affect the Community.

Perhaps most importantly, engaging a Convenor provides a longevity and sustainability component to these efforts inherent in broadening the consideration beyond an initial set of use cases to consider the holistic set of Veteran needs and how they align to other disadvantaged groups, providing long-term benefit to participating organizations and the beneficiaries they serve.

3. TASKS

3.1. TASK STATEMENT

3.1.1. Contractor’s Progress Reports and Project Management Plan The Project Manager (PM) shall provide a monthly progress report to the Contracting Officer’s Representative (COR) via electronic mail. This report shall include: (1) a summary of all project milestones and their anticipated completion dates, (2) data on cumulative funding and expenditure rates and status, (3) invoicing data, (4) an assessment of current month and future month activities, (5) a discussion of any issues related to contract performance or administration, and (6) data on participants and potential advisory activity to support government oversight activities that ensure compliance with the Federal Advisory Committee Act. The Contractor shall provide a draft Program Management Plan (PMP) three (3) business days prior for review and discussion at the kick-off meeting. The COR shall inform the CO of any contractual issues raised during the kickoff meeting for CO resolution.

Task One Deliverable: The Contractor shall deliver:

1.1 Project Management Plan and Monthly Updates

3.1.2. Kickoff Meeting

The Contractor shall conduct a technical kick-off meeting with the Government including the PM, COR, and Contracting Office. A technical kickoff meeting is required within ten

(10) calendar days after contract award. The technical kick-off meeting shall occur along with the post award conference. The kick-off meeting shall set expectations for Contractor Performance.

Task Two Deliverable: The Contractor shall deliver:

2.1 Kick-off meeting

3.1.3. Staffing Roster

The Contractor shall provide a roster of all staff supporting the contract with relevant demographic information to include location, phone number, and time zone on the fifth business day of the month.

Task Three Deliverable: The Contractor shall deliver:

3.1 Staffing Roster monthly

3.2 Notice of change in personnel (ad hoc)

4. Establish a Community of Practice The objective is to provide the initial signatories, and subsequent signatories to the Pledge, an opportunity to share their experiences in an open Community of Practice (the “Community”), managed by the convenor, and for the convenor to conduct outreach to attract and grow this Community to involve other participants contributing to or impacted by this objective. The starting-point of this Community would be focused on sharing information related to current VA priorities as supported in the Pledge (suicide prevention, toxic exposures, etc.), with the intent to grow the Community and scope of information shared by Community members to include full-spectrum community and cross-community care issues and concerns (scheduling, registration, eligibility, payment, record sharing, problem list sharing, etc.). Moreover, while a key goal is to improve Veteran care and outcomes through Community sharing of pertinent information, it is also intended to promote discussion of possible improvements to care for much broader cohorts, including, but not limited to Veterans. Specific sub-objectives for this area include:

• Inviting and transitioning existing signatories to the new Community.

• Identifying non-participating organizations and outreach to spur their participation.

• Determining initial goals and objectives appropriate to gathering a broad spectrum of insights from a broad and changing spectrum of organizations.

4.1. Developing the Community of Practice

The Contractor shall support establishment of a Community of Practice by leveraging existing industry participants, relationships, and bodies within the Digital Health communities who engage in standards-based exchange. Industry community refers to participants within the following areas and illustrative examples (the list is not intended to be exhaustive):

• Providers

• Payers

• Digital Health Vendors o Digital Health Industry and Standards Development Organizations

• Trusted Exchange Framework and Common Agreement (TEFCA) entities, including

Recognized Coordinating Entity (RCE) and Qualified Health Information Networks (QHINs), and established health information exchanges, such as eHealth Exchange

• Federal entities such as:

o Office of National Coordinator o Centers of Medicare and Medicaid Services

Task Four Deliverables: The Contractor shall deliver:

4.1 Community of Practice charter with identified representative members from Pledge signatory organizations

4.2 Work Plan with key objectives to support industry stakeholder engagement and participation.

4.3 Prospective list of future signatories with points of contact and timelines of engagement.

4.4 Progress report on list of future signatories list, additional members, and status of new participants.

5. Administrating the Community of Practice The Contractor shall provide support through an approach that fosters and encourages problem solving and leverages the collective intelligence of the group. This includes, but is not limited to, establishing a regular cadence of meetings, developing agendas, determining shared priorities, tracking actions, and advancing the group toward a collective knowledge base on items of import. The Contractor shall demonstrate neutrality, assuring open, active participation and egalitarian opportunity to contribute and benefit from the work, which is critical to this component. Dissenting voices should be heard, and concerns noted, with a goal toward fostering a culture of collaboration.

The Contractor shall provide the following community support management of the Community of Practice through strategic engagement and management by providing the enabling capabilities and management oversight to optimize the efficacy and utility of the Community:

The Contractor’s Community of Practice support shall include:

• Community member and participant management supported by virtual and in-person meeting facilitation, agendas, note taking, and timely minutes distribution.

• Project management support (calendar management, meeting management, etc.).

• Facilitation of effective communication channels.

• Collaboration Support (providing tools to enable virtual collaboration [both synchronous and asynchronous], document sharing, decision-making, etc.) that is accessible to all Community members. Finalized artifacts, once reviewed, approved, and accepted by VA, shall be accessible to the general public.

The Contractor shall enhance the overall functioning and effectiveness of the Community of Practice by facilitation of workgroups. Workgroups serve several important purposes, such as: focused collaboration on specific topics or issues; execution of specific tasks or projects; enhanced engagement by members with specific expertise; and the availability of a smaller setting to experiment with new ideas and approaches. The Contractor’s workgroup support shall include:

• Coordination of four (4) simultaneously-run, independent workgroups.

• Each workgroup shall represent a topic, project, or issue, as prioritized by the Community.

• Workgroups shall be established with a defined beginning and ending date, set by the Community, and intended to allow a reasonable amount of time to achieve the goals of the workgroup. Workgroup end dates may be extended if desired by the Community. Once a workgroup has achieved its goals and ended successfully, the Community and convener shall establish another workgroup.

• Workgroup members shall be recruited from the Community of Practice

• The Contractor shall help identify and support members in the Community to act as leaders who can guide the workgroups.

Task Five Deliverables: The Contractor shall deliver:

5.1 Monthly progress reports of members, areas of focus and development, and timelines of market development.

5.2 Facilitation of at least one (1), two (2)-hour virtual meeting per month gathering the entire Community.

5.3 Development and timely distribution of agendas and meeting minutes for all Community meetings.

5.4 Facilitation of at least one (1), two (2)-hour meeting every other week for each workgroup.

5.5 Development and timely distribution of agendas and meeting minutes for all workgroup meetings.

plan.

5.6 Development and distribution of presentations/briefings, papers, etc. on behalf of the Community.

5.7 Collaboration and knowledge management repository to house and make available to all members any artifacts developed by Community or its workgroups, or developed by the Contractor to facilitate knowledge management and collaboration.

6. Community of Practice Strategic Documents

The Contractor shall create and update a Strategic Analysis and Action Plan that provides high-level guidance for the Community. This plan has several components to include:

• The vision of success from the perspectives of Veterans and members.

• One (1)-year and three (3)-year objectives and key results.

• Analysis of the current state and trends of external factors to include federal and state policy, and community standards (a summary and adaptation of the Standards Update and Recommendations Report as defined in section 7), and government or industry initiatives that are constraints, opportunities, barriers, or facilitators for Community objectives.

• Factors promoting or impeding effective operations of the Community.

• Analysis of how the Action Plan will address the preceding factors.

• Major accomplishments of the Community.

The Contractor shall create and publish on a public-facing website a paper on one (1) topic discussed in the open Community that indicates success and failures identified by the Community.

Task Six Deliverables: The Contractor shall deliver:

6.1 Semi-annual Updated Community of Practice Strategic Analysis and Action Plan.

6.2 Semi-annual one (1)-hour executive briefing PowerPoint presentation for members to report on progress of the Community and its workgroups.

6.3 Development and dissemination of one (1) “talking points” document and one

(1) position paper for the work of the Community broadly and for each workgroup, intended to facilitate communication by Community members with external audiences.

7. Office of the National Coordinator, United States Core Data for Interoperability (USCDI) and National Standards Alignment

The Contractor shall leverage existing expertise and infrastructure to provide robust management of health IT interoperability standards in support of Community priorities, and in alignment with the national priorities and guidance of federal agencies, e.g. Office of the National Coordinator for Health IT.

The Contractor shall provide the Community situational awareness of and recommendations to engage in National Standards Development work that could impede or facilitate the work of the Community in the form of a quarterly Standards Update and Recommendations Report. At a minimum, the Contractor shall analyze the work such as HL7 FHIR (most recent published and emerging releases), CDA, BPM+ Health Community, HL7 Gravity and HL7 DaVinci, X.12.

The Contractor shall develop and maintain on behalf of the Community a strategic roadmap for global standards development and implementation work that analyzes and reflects Community priorities. At a minimum, the roadmap shall:

• Identify priority areas in need of additional standards development and implementation to support the interoperable use of health IT.

• Provide recommendations for updating standards and implementation guidance.

• Measure or collate measurements from other activities the adoption, implementation, and use of health IT standards and implementation specifications.

Task Seven Deliverables: The Contractor shall deliver:

7.1 Standard Coordination Plan

7.2 Quarterly Standards Update and Recommendations Report

7.3 Quarterly Roadmap for Standards Development and Implementation

8. Lead the development and publication of a new version of an implementation guide or standard (Repeatable Optional Task)

The Community is likely to identify, through the course of its work, the need for an implementation guide or standard where existing versions of standards have not been developed. Therefore, the Contractor shall lead the development of new versions of a standard or implementation guide. The Contractor shall recommend and/or make updates to the content of the standards and/or implementation guidance, including written guidance, resources, profiles, extensions, and terminologies as appropriate. The Contractor shall base recommendations on the appropriate processes relevant in standards development organization (SDO) working groups.

The Contractor shall facilitate testing of the standards and implementation guidance by identifying pilot implementations, organizing “Hackathons/Connectathons”, and soliciting feedback from the health IT standards and implementation community. The Contractor shall update the standards and implementation guidance as appropriate based on testing.

The Contractor shall ballot and publish the standards and implementation guidance according to organizational policies and procedures of the governing standards development organization.

Task Eight Deliverables: The Contractor shall deliver:

8.1 Written recommendations and/or proposed language for updates to relevant standards and/or implementation guide(s).

8.2 Written proposal for conducting pilot tests of updated versions of the standard or implementation guide.

8.3 Written plan for “Hackathon/Connectathon” tracks to test updated versions of the standard or implementation guide.

9. SCHEDULE

Base Period Deliverables

TASKS TASK DELIVERABLES QUANTITY DELIVERY

DATE

1.1 Project Management Plan

12 Within the first ten (10) business days of Kickoff Meeting

2.1 Kickoff Meeting

1 Within the first ten (10) calendar days of contract award

3.1 Staffing Roster

1 Within the first days of contract award

3.2 Notice of change in personnel 40 Within five (5)

calendar days of any changes

4.1 Community of Practice Charter 1 Within twenty

(20) business days of contract award

4.2 Work Plan with key objectives

to support industry stakeholder engagement and participation.

1 Within ten (10) business days of contract award

4.3 Prospective list of future

signatories list with points of contacts and timelines of engagement

Within thirty (30) business days of contract award

4.4 Progress reports on list of future

signatories list, additional members, and status of new participants

6 Bi-monthly every first Monday starting on the 61st day from contract award

5.1 Progress reports of members, areas of focus and development, and timelines of market development.

12 5th business day of the month

5.2 Facilitation of at least one (1), two (2)-hour virtual meeting per month gathering the entire Community

12 Within the first five business days of the month

5.3 Development and timely

distribution of agendas and meeting minutes for all

12 Within three (3) business days of

TASKS TASK DELIVERABLES QUANTITY DELIVERY

Community meetings each Community meeting

5.4 Facilitation of at least one (1), two (2)-hour meeting every other week for each workgroup

26 x 4 Biweekly

5.5 Development and timely

distribution of agendas and meeting minutes for all workgroup meetings

26 x 4 Within three (3) business days of each workgroup meeting

5.6 Development and distribution of

presentations/briefings, papers, etc. on behalf of the Community

6 As requested, approximately bimonthly, within ten (10) calendar days of request

5.7 Collaboration and knowledge

management repository to house and make available to all members any artifacts developed by Community or its workgroups, or developed by the Contractor to facilitate knowledge management and collaboration

1 Within thirty (30) calendar days of Contract award

6.1 Semi-Annual Updated

Community of Practice Analysis and Action plan

1 Six (6) months from Kickoff Meeting

6.2 Semi-annual one (1)-hour

executive briefing PowerPoint presentation for members to report on progress of the Community and its workgroups.

1 As requested, approximately 6 months of contract award, within ten (10) calendar days of request

6.3 Development and dissemination

of one (1) “talking points” document and one (1) position paper for the work of the Community broadly and for each workgroup, intended to facilitate communication by Community members with external audiences.

2 As requested, approximately, within ten (10) calendar days of request

TASKS TASK DELIVERABLES QUANTITY DELIVERY

7.1 Standard Coordination Plan 1 As requested, approximately, within ten (10) calendar days of request

7.2 Quarterly Standards Update

and Recommendations Report

4 As requested, within ten (10) calendar days of request

7.3 Quarterly Roadmap for

Standards Development and Implementation

4 As requested, approximately, within ten (10) calendar days of request

8.1 (optional)

Written recommendations and/or proposed language for updates to relevant standards and/or implementation guide(s).

6 As requested, approximately, within ten (10) calendar days of request

8.2 (optional)

Written proposal for conducting pilot tests of updated versions of the standard or implementation guide.

6 As requested, approximately, within ten (10) calendar days of request

8.3 (optional)

Written plan for “Hackathon/Connectathon” tracks to test updated versions of the standard or implementation guide.

6 As requested, within ten (10)

9.1 Option Period One (1) Deliverables

TASKS TASK DELIVERABLES QUANTITY DELIVERY DATE

3.2 Notice of change in personnel 40 Within five (5)

calendar days of any changes

4.4 Progress reports on list of future

signatories list, additional members, and status of new participants

6 Bi-monthly every first Monday starting on the 61st day from contract award

5.1 Progress reports of members, areas of focus and development, and timelines of market development.

12 5th business day of the month

5.2 Facilitation of at least one (1), two

(2)-hour virtual meeting per month gathering the entire Community

12 Within the first five business days of the month

5.3 Development and timely

distribution of agendas and meeting minutes for all Community meetings

12 Within three (3) business days of each Community meeting

5.4 Facilitation of at least one (1), two

(2)-hour meeting every other week for each workgroup

26 x 4 Biweekly

5.5 Development and timely

distribution of agendas and meeting minutes for all workgroup meetings

26 x 4 Within three (3) business days of each workgroup meeting

5.6 Development and distribution of

presentations/briefings, papers, etc. on behalf of the Community

6 As requested, approximately bimonthly, within ten

(10) calendar days of

5.7 Collaboration and knowledge

management repository to house and make available to all members any artifacts developed by Community or its workgroups, or developed by the Contractor to facilitate knowledge management and collaboration

1 Within thirty (30) calendar days of the exercised Option Period.

6.1 Semi-Annual Updated

Community of Practice Analysis and Action plan

1 Six (6) months from the exercised Option Period.

6.2 Semi-annual one (1)-hour

executive briefing PowerPoint presentation for members to report on progress of the Community and its workgroups.

1 As requested, approximately 6 months of the exercised Option Period, within ten

(10) calendar days of request

6.3 Development and dissemination

of one (1) “talking points” document and one (1) position paper for the work of the Community broadly and for each workgroup, intended to facilitate communication by Community members with external audiences.

2 As requested, approximately, within ten (10) calendar days of request

7.1 Standard Coordination Plan 1 As requested, approximately, within ten (10) calendar days of request

7.2 Quarterly Standards Update and

Recommendations Report

4 As requested, days of request

7.3 Quarterly Roadmap for

Standards Development and Implementation

4 As requested, approximately, within ten (10) calendar days of request

8.1 (optional)

Written recommendations and/or proposed language for updates to relevant standards and/or implementation guide(s).

6 As requested, approximately, within ten (10) calendar days of request

8.2 (optional)

Written proposal for conducting pilot tests of updated versions of the standard or implementation guide.

6 As requested, approximately, within ten (10) calendar days of request

8.3 (optional)

Written plan for “Hackathon/Connectathon” tracks to test updated versions of the standard or implementation guide.

6 As requested, days of request

9.2. Option Period Deliverables (Option Periods Two (2) – Four (4) Same as Option Period One (1)

10. Period of Performance

The period of performance for this contract is a base period of twelve months with four (4), twelve

(12) month option periods. The Government’s decision not to exercise an option shall not be considered a termination.

11. Type of Contract The contract shall be Firm-Fixed Price. Travel will be a Not to Exceed (NTE) amount per Period of Performance (POP).

12 Place of Performance Efforts under this contract shall be performed at Contractor facilities or by teleworking. The Contractor shall work to be scheduled in all time zones from Eastern to Pacific.

13. Travel

The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the period of performance. VA will make every reasonable attempt to notify the Contractor of upcoming travel requests to include trip expectations, date(s) of travel, duration of trip, and the number of travelers necessary. Travel costs will be included in the requirement award as a separate, cost-reimbursable, “not to exceed” line item. Travel shall be in accordance with the Federal Travel Regulations (FTR) and requires advanced concurrence by the Contracting Officer’s Representative (COR). Contractor travel within the local commuting area will not be reimbursed.

The Contractor must obtain written approval from the Veterans Affairs (VA) Program Manager via the Contracting Officer Representative BEFORE any travel begins, utilizing the Travel Authorization Request form. Travel and per diem expenses will be reimbursed on an actual expenditure’s basis in accordance with Federal Travel Regulations and FAR 31.205-46. Travel that occurs without written pre-approval will NOT be reimbursed.

In order to be reimbursed for travel, the Contractor shall submit supporting documentation as required by Federal Travel Regulations with invoices. Federal Travel Regulations require for any temporary travel destination you must provide a receipt to substantiate your claimed travel expenses for lodging and a receipt for any authorized expenses costing over $75 (FTR 301- 11.25). Expenses for subsistence and lodging will be reimbursed to the Contractor only to the extent where an overnight stay is necessary and authorized by Federal Travel Regulations in effect at the time of the stay for the specific location.

For all travel under this contract, the Contractor shall produce a summary trip report and submit it to the Government programmatic leadership. The total estimated number of trips; anticipated locations; and estimated duration are identified below:

Estimated Destinations

Approximate Number of trips

Approximate Number of Contractor Personnel required per trip

Approximate Number of days per trip

Convenor Base Travel

TO BE DETERMINED 5 5 4

Meeting Registration fees only, including virtual

5 5 4

14. Government-Furnished Information, Equipment, and Facilities

The VA Digital Health Office (DHO) office shall provide full administrator access to the tools listed below to assist with IT needs to fulfill the contract. If the mandated toolset changes throughout the POP, then the Government shall provide access to the new toolset.

VPN access to the VA network (RESCUE) Citrix Access Gateway (CAG) Microsoft Office 365

16. Changes to the Performance Work Statement

Any changes to this Performance Work Statement (PWS) shall be authorized and approved only through a signed modification to the contract from the CO. A copy of each modification shall be kept in a project folder along with all other products of the project.

17. Key Personnel Contractor staff shall be fully qualified and have the level of experience necessary to accomplish the requirements of this PWS. In addition, Contractor personnel shall be acceptable to the Government in terms of personal and professional conduct, and in technical knowledge.

Furthermore, Contractor personnel shall be proficient using office automation equipment and software, and have sufficient written and verbal communication skills to support VA. The work accomplished in this Contract shall not use offshore labor unless specifically agreed to by the contracting office. Should any Contractor personnel be determined unacceptable in terms of technical competency or unacceptable personal conduct while on-site or while working on contract activities, the Contractor shall immediately remove and replace the unacceptable on-site personnel at no additional cost to the Government. Contractor personnel are to serve in a support role; final decisions regarding VA business will always be made by Government personnel.

Certain skilled experience professional and/or technical personnel are essential for accomplishing the work to be performed. These individuals are defined as “Key Personnel” whose experience biographies shall be submitted and marked by the Contractor as “Key Personnel”. Substitutions shall only be accepted if in compliance with the “Substitution of Key Personnel” provision identified below.

The following are defined as Key Personnel and, except in cases where individuals commit criminal conduct or violations of company policy, shall not be removed, diverted, or replaced from work without notifying the CO and COR:

1. Engineer

2. Informatic Specialist/Bioinformatician

3. Project Director

4. Risk Management Analyst

5. Program Manager

6. Project Manager

7. Program Analyst, Informatics Mid-Level

8. Health IT Informatics Analyst I

Any personnel that the Contractor offers as substitutes shall have the ability and qualifications equal to or better than the key personnel who are being replaced. The Contractor shall submit a complete resume for the proposed substitute and any other information requested by the CO needed to approve or disapprove the proposed substitution. The CO will evaluate such requests and promptly notify the Contractor of approval or disapproval thereof in writing.

ROLE SKILL SET

DEFINITION

MINIMUM

EDUCATION

LEVEL

MINIMUM

EXPERIENCE

Engineer

The Engineer has considerable experience in providing highly specialized applications and operational analysis.

Experience in planning and supporting network and computing

Bachelor's Degree 5 years infrastructure. Has knowledge in networking technologies. Is cognizant, knowledgeable and contributes to all phases of software development with emphasis on the planning, analysis, modeling, simulation, testing, integration, documentation, and presentation phases.

Informatic Specialist/Bioinformatician

An Informatic Specialist/Bioinformatician provides high level expertise in the application of technology to areas of interest to government health organizations including Medical Informatics or Public Health Informatics;

statistics, bio-statistics, mathematics; specific tools and data resources relevant to the federal health mission including SAS, Epi Info, etc.;

applying sound quantitative data and methods to support deployment of resources for massive public health surveillance, prevention and intervention campaigns and related health activities. Provide expertise across a wide variety of IT areas as applied to public health, including information retrieval technology, decision science, web technology, data mining, expert systems, networking, public health science, and education.

Provide expertise in the integration of a variety of heterogeneous public health information systems and databases

Bachelor's Degree the sharing and dissemination of public health information; in the interaction of information security technology and the requirements for privacy and confidentiality of public health data; in the application of the HIPAA regulations to the use of information technology in public health; in new areas of interest to public health including the information available from managed care organizations; with national and/or international standards development activities such as HL7, X12, W3C;

and in the application of advanced scientific visualization technology to public health science and practice.

Project Director

A Project Director must have experience with diverse IT projects both large and small. Must be well versed in full systems development life cycle, enterprise wide network engineering, strategic information planning, business process reengineering, structure, and management practices. Must be able to identify and mitigate risks to the program. Must be able to manage to cost, schedule and performance.

Bachelor's Degree 15 years

Risk Management Analyst

A Risk Management Analyst must have experience in the review of risk management data to identify discrete area and overall program/project risk in terms of cost, schedule, and performance.

Coordinate with program team members to gather and validate data. Identify risk areas and create narrative, graphic, and oral status reports.

Bachelor's Degree 5 years

Program Manager

A Program Manager must have experience with diverse IT projects both large and small. Must be able to manage a portfolio of projects. Must be well versed in full systems development life cycle, enterprise wide network engineering, strategic information planning, business process reengineering, structure, and management practices. Must be able to identify and mitigate risks to the program. Must be able to manage to cost, schedule and performance. Have experience with and demonstrate understanding of SAFe’s Lean Agile principles and practices to drive value and sustain organizational change and operational excellence through the empowering of high-performing Agile teams.

Master's Degree 15 years

Project Manager

A Project Manager must have experience managing Information Technology related projects. Must be well versed in life cycle and project management methodologies. Must have experience in tracking costs, schedule, and performance progress. Must be able to identify and mitigate risks.

Have experience with and demonstrate understanding of SAFe’s Lean Agile principles and practices to drive value and sustain organizational change and operational excellence through the empowering of high-performing Agile teams.

Bachelor's Degree 10 years

Program Analyst, Informatics Mid-Level

A Mid-Level Program Analyst must have knowledge in how to plan, analyze and evaluate the effectiveness of operating programs. Must be able to use source data to evaluate the effectiveness of programs and business processes. Must be able to use qualitative and quantitative analytical skills to assess the effectiveness of the operations. Senior PA must be able to effectively manipulate data to present program status and make recommendations on improving business processes. Requires relevant clinical informatics experience in a Veterans Administration healthcare setting.

Bachelor's Degree 5 years

Health IT Informatics Analyst I

Conducts requirements gathering and analysis, information modeling, process documentation, and liaison tasks required to support the development of clinical informatics software or other clinical informatics project activities. Works independently or under only general direction.

Bachelor’s Degree minimum of 4 years of experience, of which three must be specialized. Specialized skills include experience with requirements elicitation, requirements analysis, user acceptance testing, and artifact development / documentation of systems used in the capture or standardization of health information, clinical information, or other data related to therapeutic discovery, medical research, or life sciences. A Bachelor's degree is required, or 6 additional years of specialized experience can substitute for the Bachelor's degree for candidates with work experience but not college training.

18. Quality Assurance Surveillance Plan (QASP)

The Contractor’s performance will be evaluated based on the following metrics:

REQUIRED

SERVICES

PERFORMANCE

STANDARDS

ACCEPTABLE

QUALITY

LEVELS

SURVIELLANCE

OF METHOD

INCENTIVE

Project Delivery Schedule

Deliverables should be delivered by the date either specified in the PWS, at the kick-off Meeting, as specified in the project management plan for this contract, or as specified by the

COR.

Notifies customer within seven (7)

95% Inspection of the Project Schedule

Positive Past Performance Rating problems with meeting the deliverable due date.

Contractor Personnel Skills

Personnel shall demonstrate proficiency in skills necessary to perform tasks.

Knowledge of Access, Excel spreadsheets, macros, effective written and oral communication, presentation and facilitation skills at an executive level.

Knowledge of SharePoint Online, Office 365, Power Apps, Power Automate and Power BI at an expert level.

Demonstrated proficiency in the skills required to execute the defined deliverables independently and at high quality.

95%

Analysis of Contractor’s Deliverables

Positive Past

Complaints

No more than three

(3) complaints per quarter on, but not limited to, resource availability, professionalism, engagement during collaboration, response time, effective communication, project deliverable quality.

100%

Validated User/Customer Complaints

Positive Past

CONTRACT SECURITY REQUIREMENTS

A1. GENERAL

Contractors, Contractor personnel, Subcontractors, and Subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

A2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. Contractor/Subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, Subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All Contractors, Subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for Contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS).

Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates (e.g. Business Associate Agreement, Section 3G), the Contractor/Subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth.

Location within the U.S. may be an evaluation factor.

e. The Contractor or Subcontractor must notify the CO immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the Contractor or Subcontractor’s employ. The CO must also be notified immediately by the Contractor or Subcontractor prior to an unfriendly termination.

A3. VA INFORMATION CUSTODIAL LANGUAGE

1. Information made available to the Contractor or Subcontractor by VA for the performance or administration of this contract or information developed by the Contractor/Subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of VA. This clause expressly limits the Contractor/Subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

2. A information should not be co-mingled, if possible, with any other data on the Contractors/Subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the Contractor must ensure that VA information is returned to VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on-site inspections of Contractor and Subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

3. Prior to termination or completion of this contract, Contractor/Subcontractor must not destroy information received from VA, or gathered/created by the Contractor in the course of performing this contract without prior written approval by VA. Any data destruction done on behalf of VA by a Contractor/Subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the Contractor that the data destruction requirements above have been met must be sent to the VA CO within 30 days of termination of the contract.

4. The Contractor/Subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations, and policies. If Federal or VA information confidentiality and security laws, regulations, and policies of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations, and policies in this contract.

5. The Contractor/Subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on Contractor/Subcontractor electronic storage media for restoration in case any electronic equipment or data used by the Contractor/Subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

6. If VA determines that the Contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the Contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

7. If a VHA contract is terminated for cause, the associated Business Associate Agreement

(BAA) must also be terminated and appropriate actions taken in accordance with VHA Directive 1605.05, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

8. The Contractor/Subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

9. The Contractor/Subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA minimum requirements. VA Configuration Guidelines are available upon request.

10. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the Contractor/Subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA prior written approval. The Contractor/Subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA CO for response.

11. Notwithstanding the provision above, the Contractor/Subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the Contractor/Subcontractor is in receipt of above-mentioned information, that Contractor/Subcontractor shall immediately refer such court orders or other requests to the VA CO for response.

12. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require Assessment and Authorization (A&A) or a Memorandum of Understanding-Interconnection Security Agreement (MOU-ISA) for system interconnection, the Contractor/Subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

A4. INFORMATION SYSTEM DESIGN AND DEVELOPMENT

Not Applicable.

A5. INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE, OR USE

Not Applicable.

A6. SECURITY INCIDENT INVESTIGATION

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The Contractor/Subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the Contractor/Subcontractor has access.

b. To the extent known by the Contractor/Subcontractor, the Contractor/Subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the Contractor/Subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the Contractor/Subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including employees, and its Subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The Contractor/Subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

A7. LIQUIDATED DAMAGES FOR DATA BREACH

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the Contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the Contractor/Subcontractor processes or maintains under this contract. However, it is the policy of VA to forgo collection of liquidated damages in the event the Contractor provides payment of actual damages in an amount determined to be adequate by the agency.

b. The Contractor/Subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis.