Copy of Soldiers Homes EMR RFR Attachment B RFR Technical Requirements.xlsx
XLSX spreadsheet 49 KB Posted
- Solicitation number
- BD-22-1039-EHS01-EHS02-65930
- Issued by
- Suffolk County, Massachusetts
About this file
This document is a Request for Response (RFR) issued by the Executive Office of Health and Human Services (EOHHS) on behalf of the Department of Veterans' Services for a comprehensive electronic medical records (EMR) system for the Soldiers' Home in Chelsea and the Soldiers' Home in Holyoke. The EMR system will fully replace the existing electronic records systems and the largely paper-based medical records system. The RFR outlines detailed technical and performance requirements for the system, including security, system administration, accessibility, software integrity controls, operations support, integration and interoperability, mobile device functionality, authentication and identity management, account creation and access, authorization and access control, and system hosting.
The RFR requires bidders to respond to all requirements, and responses will become part of the final awarded contract. The RFR also includes service level agreement (SLA) requirements around application availability, support response times, performance, data processing, disaster recovery, and audit reporting. Additionally, the RFR specifies required system attributes such as flexibility, extensibility, reusability, maintainability, scalability, throughput, and manageability. Bidders must provide pricing information and comply with all state and local requirements for the jurisdictions of Hampden County, Suffolk County, and Chelsea City in Massachusetts.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Copy of Soldiers Homes EMR RFR Attachment A RFR Functional Requirements.xlsx | XLSX spreadsheet | |
| Soldiers Homes EMR RFR Attachment C RFR Business Requirements Narrative.docx | DOCX document | |
| IntentToPost EMR RFR WTO Notice KB.doc | DOC document | |
| Soldiers Homes EMR RFR Attachment F Model SOW.docx | DOCX document | |
| StandardContractForm 07212021.docx | DOCX document | |
| Massachusetts Substitute W9 Form Mar 2020~1.pdf | ||
| Contractor Authorized Signatory Listing~35.doc | DOC document | |
| Soldiers Homes EMR RFR_.docx | DOCX document | |
| Soldiers Homes EMR RFR QUESTIONS AND ANSWERS.docx | DOCX document | |
| Copy of Supplier Diversity Program SDP Plan Form.xlsx | XLSX spreadsheet | |
| Soldiers Homes EMR RFR Attachment E Mandatory Response Forms Checklist and Acknowledgements.docx | DOCX document | |
| Copy of Soldiers Homes EMR RFR Attachment D RFR Cost Workbook.xlsx | XLSX spreadsheet | |
| Prompt Payment Form.doc | DOC document |
Show all 13
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Table of Contents
| Soldiers’ Home Electronic Medical Record (EMR) |
| Request for Response |
| Table of Contents |
| Technical and Performance Requirements Sections |
| A. Technical Requirements |
| A1 Security |
| A2 System Administrator (SA) |
| A3 Accessibility |
| A4 Software Integrity Controls |
| A5 Operations Support |
| A6 Integration and Interoperability |
| A7 HIway Service Suite – HIE Service Offerings for EMR\EHR Interoperability |
| A8 Mobile Device Functionality |
| A9 Authentication and Identity Management |
| A10 Account Creation and Access |
| A11 Authorization and Access Control |
| A12 System Hosting |
| A13 Data Analytics |
| B. Performance Standards |
| B1 SLA Performance Standards |
| B2 Other Performance Standards |
IntroKey
| Soldiers’ Home Electronic Medical Record (EMR) | |
| Request for Response | |
| Introduction/Key | |
| Bidders must respond to all requirements in each of the tabs in the workbook. Responses will become part of the final awarded contract. Column "F" will require a response from the drop down list from the Bidder Response that indicates the Bidder's proposed system's ability to meet the requirement, followed by an explanation if needed. | |
| Bidder Response | Bidder Response Definition |
| Existing | The bidder’s solution meets the functional requirement "out of the box" as an existing component of its standard product, which is in operation at a minimum of one client site. The function exists without any modification to the front end coding or database structure and is set primarily through table building and parameter settings within the applications. This response indicates that no customization is required to meet the requirement. |
| Configuration | The bidder’s solution does not meet the functional requirement "out of the box," but the system will meet the functional requirement with existing configuration tools, modifiable templates, or similar methods and no programmatic changes are necessary to underlying front end coding or database structure. A highly trained system administrator is capable of making these kinds of changes to the system. |
| Customization | The bidder’s solution does not meet the functional requirement without modification to the existing code base and/or database structure. The bidder is warranting that it will meet this functional requirement by customizing the software. A developer from the bidder is required to make these kinds of modifications. Indicate in the comments if this customization is included in the base system cost or is detailed separately in the cost worksheet, including the Ref # in the cost worksheet |
| Planned | The bidder’s solution does not presently meet the functional requirement, but an upgrade to the proposed product is planned and will meet this requirement within the next 12 months. This response indicates that no configuration or customization will be required to meet the requirement and that the upgrade will be included as part of standard support. |
| Not Available | The bidder's solution will not address this functional requirement. There are no plans to add the functionality. |
| Bidder Comment | Additional Comments/Narrative are helpful in clarifying responses. Please enter explanatory text into the Comment section for any particular requirement that would benefit from additional information. Some requirements include a statement that begins with "Describe" - Bidders must insert the description in the comments line for that requirement. |
Important Reminder - Enter the company name and date submitted at the top of each page & follow the following spreadsheet naming convention: (Bidder Name) Requirements Response (Date Submitted)
Section A - Technical
| Bidder Name: | Soldiers’ Home Electronic Medical Record (EMR) | |||
| Submission Date: | Request for Response | |||
| Section A - Technical Requirements | ||||
| Requirement # | Requirement Description | Bidder Response | Bidder Comment/Description | |
| Section A - Technical Requirements | Select Response from drop down menu for all requirements | |||
| A1 | Security | REPLACEMENTS | ||
| NIST Security | Security | |||
| A1.1 | The EMR system must be HIPAA compliant. The Bidder will be responsible for obtaining an independent HIPAA compliance certification. | |||
| A1.2 | The system will align with best practices in security standards, and will meet or exceed standards defined within the Executive Office of Technology Services & Security (EOTSS) architecture requirements and the Secretariat Application Reference Manual (SARM), version 3.3 (Please see Attachement G Appendix A). The response must detail the security of the proposed solution and must include the most recent independent audit report. Soldiers' Home expects that the Bidder shall comply with the current NIST SP800-53 Moderate risk security control baseline. If the Bidder is not currently in compliance with the NIST SP800-53 Moderate risk security control baseline the Bidder must provide a gap analysis and a Plan of Actions and Milestones (POAM), at the time of the bid. | |||
| Commonwealth Data | ||||
| A1.3 | The response must detail the safeguards necessary to prevent unauthorized access to Commonwealth Data from any public or private network. |
A1.4 The Bidder must prevent unauthorized physical access to any information technology resources involved in the project.
| A1.5 | The Bidder must prevent interception and manipulation of Commonwealth Data during transmission to and from any servers. | |
| A1.6 | All Bidder employees and contractors associated with this project will be required to sign appropriate confidentiality agreements setting forth their responsibilities for maintaining confidentiality of data and related information as well as their responsibilities to be diligent with regards to security and the consequences for major and minor breaches. | |
| Commonwealth Personal Data | ||
| A1.7 | The response must detail the safeguards necessary to ensure the security, confidentiality and integrity of electronic personal data and personal information. | |
| A1.8 | The Bidder must prevent unauthorized access to electronic personal data or personal information or any other Commonwealth Data from any public or private network. | |
| A1.9 | The Bidder must notify Soldiers' Home immediately if any breach of such system or of the security, confidentiality, or integrity of electronic personal data or personal information occurs. | |
| Data Masking | ||
| A1.10 | PI, PHI, and other privacy laws require that certain personal data are to be protected from viewing or other processing by unauthorized parties. The Bidder must mask data that is used in test environment or outside of the protected production zone. | |
| A1.11 | The Bidder must mask data whenever exporting data from production databases to QA, Systems Test, and/or Development environments or for transmission to outside organizations that do not have approval to access production data. | |
| Auditing and Logging | ||
| A1.12 | Applications within the EOHHS environment must create audit logs. | |
| A1.13 | Audit log should be generated and kept for all authentication and authorization events. | |
| A1.14 | Audit logs should contain sufficient information to establish the what, when, source of, and cause of the events that have occurred. The following items are some of the information that will make the record useful for forensic or problem triage tasks: | |
| • | Date and Time | |
| • | Triggering Process | |
| • | Process Owner | |
| • | Process / Function Description | |
| • | End Status (success/failure) | |
| • | Logging in, Logging out, failed login attempts, and password resets | |
| • | Resources being authorized | |
| • | Requesting User | |
| • | IP address of the computer from which authentication attempt was made | |
| • | Audit log all administration activities | |
| • | Audit log the deletion of any data | |
| A1.15 | Audit records of each electronic file transfer execution must be maintained in accordance with records retention schedules or other State and Federal requirements. | |
| A1.16 | Systems must be configured to allocate sufficient audit log storage capacity to record all necessary auditable events. | |
| A1.17 | All job execution audit logs should be platform specific and independent of each other. | |
| A1.18 | Audit information and audit tools must be protected from unauthorized access, modification, and deletion. | |
| A1.19 | Periodic review of audit records must be conducted, looking for indications of unusual or suspicious activities or suspected violations. Responsibilities include reporting any findings to appropriate officials. | |
| Security of Data at Rest and in Transit | ||
| A1.20 | The Bidder must ensure that data at rest (in various states of rest) and motion is protected. | |
| A2 | System Administrator (SA) | |
| A2.1 | The system must provide an extensive array of administrative functions. Please explain administrative functions available. | |
| A2.2 | The system must allow the SA to have the ability to configure HIPAA compliant user access roles and permissions. | |
| A2.3 | The SA must have the ability to configure HIPAA compliant role-based dashboards. | |
| A2.4 | The SA must be able to configure and run auditing reports. Audit reports can include (but are not limited to): all user activity (event) reports, including information about the browser and IP, any change made in the system (including changes made by a SA), any data or documents that are loaded into the system by end users including start and end times and information of records that fail to load. | |
| A2.5 | The SA must have the ability to create, inactivate, and update the system business rules and reports, access client and service data, manually link or unlink clients in the system across all settings. | |
| A2.6 | The SA must have the ability to create, inactivate, and update fiscal business rules and reports, access claims, payments and invoices in the system across all programs, and download data for additional reporting purposes. | |
| A2.7 | The SA must be able to download the data in the same format and structure as how the data is stored by the system. | |
| A2.8 | The SA must have the ability to import and/or export any system required data. | |
| A2.9 | The SA shall have the ability to configure hyperlinks to other functionality within the system. | |
| A2.10 | The system must track SA activities using an appropriate log management system or toolset that routinely removes the log messages to a separate, protected collection server. | |
| A2.11 | The Bidder must establish and adhere to policies dictating data center responsibilities and permissions to prevent any single administrator from taking control of all systems and networks. | |
| A3 | Accessibility | |
| A3.1 | The system must be in compliance with WCAG 2.0 ADA requirements and must be Chapter 508 compliant. | |
| A3.2 | The system must be a browser-based application that can be accessed via an internet connection. Minimally, the system shall function fully on the following browsers: | |
| • | Microsoft Internet Explorer 11 | |
| • | Microsoft Edge (latest release) | |
| • | Mozilla Firefox (latest release) | |
| • | Google Chrome (latest release, all platforms) | |
| • | Apple Safari 7.0+ (latest release) |
| A4 | Software Integrity Controls |
| A4.1 | The Bidder must configure at least three software environments, including a development, quality assurance (QA) environment and a production environment. |
| A4.2 | The Bidder must implement a change management procedure to ensure that activities in the development/QA environment remain separate and distinct from the production environment. The change management procedure must segregate duties between development and testing of software changes and migration of changes to the production environment. |
| A4.3 | The change management procedure must implement security controls to restrict individuals who have development or testing responsibilities from migrating changes to the production environment. |
| A4.4 | The change management procedure must include a process to log and review all source control activities. |
| A4.5 | The Bidder must implement a source control tool to ensure that all changes made to the production system are authorized, tested, and approved before migration to the production environment. |
| A4.6 | The Bidder must not make any development or code changes in a production environment. |
| A4.7 | The Bidder must implement additional internal controls as further agreed by the Bidder and Soldiers' Home. |
| A4.8 | The Bidder must segregate duties between development and testing of software changes and migration of changes to the production environment. |
| A5 | Operations Support |
| A5.1 | The Bidder must provide live technical support 365 x 24 x 7. |
| A5.2 | The Bidder must be able to prioritize issues based on criticality of need with defined levels of service and a clear escalation path. | |
| A5.3 | The Bidder must provide a ticketing system that: | |
| a. | Is secure and available via an internet browser | |
| b. | Tracks open and closed tickets | |
| c. | Reports statistics by engineer for ticket open time vs. time closed | |
| d. | Offers management dashboard access and reporting to track availability and key performance indicators | |
| e. | Allows for automatic scheduled progress reports. | |
| f. | System Health Monitoring | |
| g. | Automatic detection and alert notification of any run-time issues | |
| A6 | Integration and Interoperability | |
| A6.1 | All modules of the proposed system must be fully integrated, i.e. the data must be centralized and accessible by all service and administrative modules. The system should have an open architecture allowing it to be integrated (IOT) with other software systems, tools, medical and non-medical devices systems. | |
| A6.2 | The system must provide support for integration with the Commonwealth's Human Resource Management System (HRMS). Please describe how the system supports the Payroll Based Journal (PBJ). |
| A6.3 | The system must support interoperability with outside entities such as ACO, and other community health partners. |
| A6.4 | Describe how the system supports ADT messaging - encounter notifications. |
| A6.5 | Describe how the system supports query based exchange. |
| A6.6 | Describe how is the system leveraging FHIR. |
| A6.7 | Describe how is the system supporting the Patient Mediated Exchange. |
| A6.8 | Describe how is the system supporting the integration with Caregiver Direct from Elder Affairs. |
| A6.9 | Describe how is the system supporting the Mass HIway integration. |
| A6.10 | Describe how is the system supporting the integration with the current VA system (VistA), VHA HIT and future VA system (Cerner). |
| A6.11 | Describe how is the system supporting the integration with the Prescription Drug Monitoring Program (PDMP). |
| A7 | HIway Service Suite – HIE Service Offerings for EMR\EHR Interoperability |
| A7.1 | Bidders must adhere to following HIE service(s) offering (but not limited to): Direct services, XDR services, Translator/Transformation services and other services as needed |
| A8 | Mobile Device Functionality |
| A8.1 | The system must support mobile and tablet web browsers. Please describe the solution’s mobile browser compatibility. |
A8.2 The Bidder shall provide a mobile version of the application.
| A9 | Authentication and Identity Management | |
| A9.1 | The Bidder solution must define and enforce rules for strong username/password, password expiration, and account lock-out. | |
| A9.2 | The system must provide functionality to provision the user to the system. | |
| A9.3 | The system must use User name and Password-based user credentials. | |
| A9.4 | The system must store the user credentials securely (encrypted). | |
| A9.5 | The system must implement secure login page for user to login prior to accessing the application. | |
| A9.6 | The system must provide functionality to validate the user’s identity. | |
| A9.7 | The system must support role-based authorization. | |
| A9.8 | The system must support attributes based on roles. | |
| A9.9 | The system must support secure user profile management via the web (this includes tasks such as setting up security questions, password management, managing email addresses). | |
| A9.10 | The system must adhere to industry development standards about user self-service management and lost password (the preferred method is an email link). | |
| A9.11 | The system must implement self-password reset functionality. | |
| A9.12 | All logins, logouts, failed login attempts, and password reset requests should be logged. | |
| A10 | Account Creation and Access | |
| A10.1 | The system must support an initial and ongoing upload of authorized users and roles. | |
| A10.2 | The system must provide an account creation process for approved end users. | |
| A10.3 | The system must provide an account deletion process for approved end users. | |
| A10.4 | The system must resolve concurrent access issues (e.g., two users modifying the same record at the same time). Please describe how your system supports this requirement. | |
| A11 | Authorization and Access Control | |
| A11.1 | The system must support role-based authorization. | |
| A11.2 | The system must support attributes based on roles. | |
| A11.3 | The system must display configurable Acknowledgements and Disclaimers notifications (to be updateable by the SA). These must display at every user log-in. | |
| A11.4 | The system must support a role based authorization using a least privilege model. | |
| A11.5 | The system must prevent attempted unauthorized accesses. | |
| A11.6 | The system must ensure that data is not cached when the user handles sensitive data. | |
| A12 | System Hosting | |
| A12.1 | All Bidders offering a SaaS solution are required to discuss service levels in their responses. Areas of focus must include: | |
| a. | Infrastructure Availability | |
| b. | Performance and Capacity Planning | |
| c. | Provisioning and Change Management | |
| d. | Disaster Recovery Planning | |
| e. | Security of Data in Transit and At Rest (To include backup media) | |
| f. | Data Encryption and Encryption/Decryption Key Management | |
| g. | Authentication and Identity Management Solution | |
| h. | Ability to integrate with EHS or external vendor provided Authentication and Identity Management Solution for Single-Sign On | |
| i. | Data isolation in a multi-tenant SAAS model | |
| A12.2 | The Bidder must establish and adhere to policies dictating data center responsibilities and permissions to prevent any single administrator from taking control of all systems and networks. | |
| A12.3 | The Bidder must track system and system administrator activities as captured in system logs using an appropriate log management system or toolset that routinely removes the log messages to a separate, protected collection server. | |
| A12.4 | The Bidder must maintain a detailed written data security plan, which includes reasonable and appropriate technical, organizational and security measures against the destruction, loss, unauthorized access or alteration of data in the possession of Bidder or any of its subcontractors and which will (i) in addition to any requirements of the RFR, be in compliance with NIST special publication 800-53, as applicable and (ii) shall be updated as necessary to meet any future security best practices. | |
| A12.5 | All Bidder employees associated with this program will be required to sign appropriate confidentiality agreements setting forth their responsibilities for maintaining confidentiality of data and related information as well as their responsibilities to be diligent with regards to security and the consequences for major and minor breaches. | |
| A12.6 | The Bidder must maintain industry accepted and documented practices and procedures designed to safeguard the data and the data processing capability within the Data Center throughout the Hosting Term and during any transition. Bidder must provide documentation supporting these practices and procedures. | |
| A12.7 | The Bidder must provide 24x7x365 availability of Managed Infrastructure, excluding maintenance windows in accordance with the SLA. | |
| A12.8 | The Bidder must notify Soldier's Home of maintenance that may result in unavailability of components of the computing environment in accordance with the SLA. | |
| A12.9 | The resulting data centers must be housed in a secure facility utilizing best practices for physical access control. | |
| A12.10 | The Bidder must provide industry standard infrastructure, including but not limited to CPU cores, memory, operating system, storage array, network switches, firewall, backup and recovery and system monitoring tools to meet the Project requirements. | |
| A12.11 | The Bidder must provide a central user authentication management system for managing server access. Dual factor authentication is required for roles with elevated rights to environment. | |
| A12.12 | The Bidder must document and implement network protection capabilities to detect and eliminate malicious software and/or unauthorized external connection attempts on network monitoring devices, servers, peripheral devices, and desktop workstations. | |
| A12.13 | The Bidder must apply critical security patches through planned maintenance. Soldiers' Home must pre-approve these maintenance activities. | |
| A12.14 | The Bidder must perform periodic technical vulnerability scans and assessments quarterly. The Bidder must also provide for continuous monitoring, intrusion detection and action plans for corrective measures. | |
| A12.15 | The Bidder must manage the environment such that Soldiers' Home data is secure and isolated from threat of intrusion or destruction whether the Hosting is multi-tenant or private cloud. The Bidder must propose a periodic testing process to insure data is physically or virtually isolated, private and secure. This should include conducting tests; publish reports for review by Soldiers' Home and corrective action plans for addressing security gaps. | |
| A12.16 | The Bidder must maintain high levels of web site security and protection at all times. This includes, but is not limited to: | |
| • | The deployment of best in class IPS/IDS technology | |
| • | Support encryption of data both at rest and in motion | |
| • | Deployment of, and/or compliance with, the tools and measures specified in Commonwealth policies and standards | |
| A12.17 | The Bidder must prepare a business continuity/disaster recovery plan which will be reviewed and approved by EOHHS including periodic planned DR testing activities at least once a year. | |
| A12.18 | The data center and any Disaster Recovery Hot Standby datacenter must be located within the United States. It may be located anywhere in the United States. | |
| A12.19 | The Bidder must automate all backup processes to the extent feasible and maintain backup logs to document that backups occurred as planned. | |
| A12.20 | Upon discovery or notification of a breach or potential breach of security relating to Data in the possession or control of Bidder or its subcontractors, including but not limited to, break-in to the data center, un-authorized access or vandalism to the equipment, access to decrypted confidential information, etc., in accordance with the RFR, immediately Bidder must (i) notify Soldiers' Home on the escalation list provided, of such breach or potential breach, (ii) investigate (with Soldiers' Home participation if so desired by Soldiers' Home), and (iii) promptly perform a root cause analysis and prepare a corrective action plan. The Bidder shall provide ongoing progress updates in accordance with the incident management procedures while the root cause analysis is conducted and will provide written reports of its findings and proposed actions to Soldiers' Home for review and approval within 24 hours of the root cause determination, Bidder shall remediate such breach or potential breach of security and take commercially reasonable actions to prevent its recurrence and fulfill any further requirements, including those required by federal or state law, as specified under the RFR. | |
| A13 | Data Analytics | |
| A13.1 | The system must provide a comprehensive cost modeling, forecasting, self-service analytics and reporting tool that will reduce IT support or intervention for critical and timely client reporting. |
Section B - Standards
| Bidder Name: | Soldiers’ Home Electronic Medical Record (EMR) | ||
| Submission Date: | Request for Response | ||
| Section B - Performance Standards | |||
| Requirement # | Requirement Description | Bidder Response | Bidder Comment/Description |
| Section B - Performance Standards | Select Response from drop down menu for all requirements | ||
| B1 | SLA Performance Standards | ||
| Application Availability | |||
| B1.1 | Bidder shall provide 99.99% application uptime in a calendar month, as measured by the number of actual hours available (excluding agreed upon or excused downtime) as a percentage of total hours. |
The system shall be available on a 24x7x365 basis with the exception of routine, scheduled downtime for patch management and maintenance. Please describe how often do you perform patch management. To minimize user inconvenience, the downtime must be no more than 2 hours a week during a consistent, scheduled time period that takes place during periods least likely to impact shift schedule and activities.
| Requests for Support | |
| B1.2 | Bidder shall provide support to all end users. Support shall be provided on a 24 hours, 7 days a week, 365 days a year basis. Support may be requested by users via email or phone. Bidder will target to respond to each request for support based on the priority level assigned to the matter. Please provide Bidder’s tiered support model, pricing structure, and escalation policy. |
| Performance/Application Response Time | |
| B1.3 | Bidder shall maintain a target response time of an average of a sub-second for 95% of all web application and web server requests. Bidder shall provide regular system performance reports to Soldiers' Home via email on response time and system performance. |
| Data Collection and Processing Time | |
| B1.4 | Bidder shall ensure that data submitted by partner systems are processed within 24 hours of submission. |
| B1.5 | Bidder shall ensure data validation is performed on 100% of the records and data is successfully stored for further processing. |
| B1.6 | Bidder shall track and notify transaction errors or transactions in non-compliance, directly to partner systems within 24 hours. |
| B1.7 | Bidder shall upload the successful records into the Soldiers’ Home EMR system database within 24 hours. |
| Subcontracted Services | |
| B1.8 | Bidder shall ensure that all subcontracted services shall adhere to the minimum SLA standards. |
| Incident Response Time | |
| B1.9 | In the event of any breach of the Service’s security or failure to meet time standards that adversely affects system or data, Bidder shall immediately (and in no event more than 3 hours after discovering such breach) notify Soldiers’ Home. Unless otherwise agreed upon, the Bidder shall provide a root cause analysis of any incident within 96 hours of the incident. |
| Disaster Recovery | |
| B1.10 | Bidder shall maintain and follow a disaster recovery plan designed to maintain Soldiers’ Home access to the EMR system, and to prevent the unintended destruction or loss of data. Bidder shall review and test the disaster recovery plan regularly, at minimum annually to validate the disaster recovery plan. |
| Backup/ Restore | |
| B1.11 | Bidder shall ensure that all database backups are automated. Bidder shall ensure that static servers are replicated across data centers with daily snapshots preserved at both locations for 1 week. Bidder shall ensure that replication and snapshot logs are monitored. Bidder shall ensure that full static server backups are performed quarterly or on as needed basis when significant modifications occur. |
| Audit Report | |
| B1.12 | Bidder shall conduct periodic independent third party assessment of the security and privacy as required by state and federal standards and will provide audit reports, certification to Soldiers' Home for review in timely manner: Security & Vulnerability Testing: Quarterly |
HIPAA/HITECH Audit Report: Every 12 months FedRAMP Certification: Every 12 months NIST 800-53 & NIST 800-144 Compliance Report: Every 12 months
| List of Services Covered/Not Covered | |
| B1.13 | Please state what ongoing services are included and excluded with this SLA. |
| B1.14 | Please provide SLA and/or service level manual documentation. |
| B2 | Other Performance Standards |
| Flexibility | |
| B2.1 | To the extent possible, the system shall be easily customizable to collect new types of data without much technical knowledge or long lead times. The processes, forms and data collection requirements of the Soldiers’ Home EMR system will evolve over time, so the system must have the ability to easily and quickly adapt to these business process changes. |
| B2.2 | The system shall provide a centralized data repository that allows multiple participants to access the system at the same time. |
| B2.3 | The system’s design shall reflect the frequent need to configure import/export content. |
| B2.4 | To the extent possible, the system’s design shall be independent of OS platforms, hardware, and database solutions. |
| B2.5 | The system’s design shall reflect the frequent need to configure due to federal and state regulatory changes . |
| Extensibility | |
| B2.6 | The system shall adopt domain frameworks so that new features can be added by using new components with no changes to existing code. |
| B2.7 | The system shall be able to support Soldiers’ Home specific configurations and future enhancements. |
| B2.8 | The system shall be able to change as needed to reflect updated or new technology developments. |
| Reusability | |
| B2.9 | The system shall use a services-oriented architecture approach that enables the reuse of functionality as services. |
| B2.10 | The system shall be able to identify and reuse available enterprise architecture components, such as single sign-on and messaging, as they become available. |
| B2.11 | The system shall expose components of re-useable functionality as shared services when possible. |
| Maintainability | |
| B2.12 | The system shall require minimal maintenance. |
| B2.13 | Depending on the solution, the Bidder shall train Soldiers’ Home staff to assume the responsibility for maintaining and updating the system for future enhancements. |
| Scalability | |
| B2.14 | The Bidder shall be using workload models based on various factors to scale systems in order to meet present and anticipated QoS requirements. The system shall support a potential expansion of the Veteran population over the next 10 years (predicted system lifespan). |
| B2.15 | As part of quality assurance, the system shall be tested for scalability with load tests and stress tests. For SaaS/Cloud based solution, the system has to provide performance test results and performance metrics from production environment. |
| Throughput | |
| B2.16 | When all phases are completed, the system shall be able to accommodate a minimum of 500 unique users concurrently. |
| B2.17 | The system shall not have impact on performance of any other Soldiers’ Home/EOHHS module/system. E.g. a slowdown in Chelsea shall not cause a slowdown in Holyoke. |
| Manageability/Problem Resolution | |
| B2.18 | Please explain Bidder incident and defect tracking and resolution process. |
| Security/Data Privacy | |
| B2.19 | The system shall ensure HIPAA compliant security for data entry, integration and distribution. |
| B2.20 | The system shall encrypt data transmitted to the client browser using at least industry standard 256-bit encryption. |
File details come from the government source that posted it. Updated .