CVO DRAFT PWS 2.docx

B.3 PERFORMANCE WORK STATEMENT DRAFT

Title: Credentialing Verification Organization Services

1. BACKGROUND

The U.S. Department of Veterans Affairs (VA), Veterans Health Administration (VHA), Office of Integrated Veteran Care (IVC), requires services to credential and monitor community care providers that furnish hospital care, medical services, or extended care services to Veterans under VA's Veteran Community Care Program (VCCP). VCCP encompasses different programs including the Community Care Network (CCN) and Veterans Care Agreements (VCA).

A primary goal of VA's community care program is patient safety for all Veterans served by VA. To achieve this goal, VA must ensure community care providers are medically qualified and competent to provide care prior to referring Veterans for community care from such providers. The credentials verification and monitoring services identified in this Performance Work Statement (PWS) directly support and facilitate VA's efforts to assess and monitor the medical qualifications and competence of community care providers who furnish hospital care, medical services, or extended care services to Veterans pursuant to Veterans Care Agreements (VCA) entered into by VA under the authority set forth by 38 U.S.C. § 1703A and 38 CFR § 18.4100-4135 or other contracts or agreements entered into and administered by VA. These providers are referred to in the PWS as "community care providers."

This contract shall provide comprehensive credentialing support by obtaining required Primary Source Verification (PSV), conducting peer-level reviews of credentialing information and provider appeals, and continuously monitoring credentialed community care providers – including those located in or licensed in U.S. territories - to ensure they maintain all qualifications needed to furnish care to Veterans under VA's VCCP.

2. SCOPE OF WORK

The Credentials Verification Organization (CVO) shall provide comprehensive credentialing support services for Non-CCN Providers, including end-to-end program management, oversight, and reporting to ensure effective governance, operational transparency, and regulatory compliance. Services include maintaining and operating a secure online database of provider demographic, professional, and credentialing information; performing complete Credentials Verification Organization (CVO) activities such as application intake, primary source verification, credential file preparation, and re-credentialing; and supporting the operation of the Credentialing Committee through case preparation, meeting facilitation, and documentation of decisions. The CVO shall conduct ongoing monitoring of provider licensure, certifications, sanctions, and other risk indicators, ensuring timely identification and escalation of adverse findings. Additionally, the CVO shall deliver training and communications to providers, staff, and stakeholders to promote process understanding, system use, and compliance with credentialing requirements. All services shall be performed in accordance with applicable regulatory, accreditation, and organizational standards. VA reserves the right to issue additional specifications to the VA-determined criteria based on policy, legislative, or regulatory changes without a modification to the contract. Based on historical data, VA anticipates submitting an average of approximately 195 providers per month to the Contractor for credentialing services; however, this figure is an estimate only.

The credentialing services required under this contract apply to providers furnishing healthcare services to Veterans under VA’s community care programs, as directed by VA. This includes, but is not limited to, providers seeking a Veterans Care Agreement (VCA) with VA under the authority of 38 U.S.C. § 1703A. This contract does not include credentialing of community care providers on behalf of the Community Care Network (CCN) contract Third Party Administrators (TPAs), and the Contractor is not authorized to perform credentialing services under this contract for providers solely on the basis of their participation in the CCN. Some providers submitted by VA for credentialing under this contract may also be enrolled with the Community Care Network for other services; however, such dual enrollment does not affect the scope of services required under this contract, and the Contractor's obligations under this PWS extend only to the credentialing of those providers as directed in writing by the COR or CO.

The prime Contractor shall independently hold active accreditation from a nationally recognized certifying or accrediting organization — specifically the National Committee for Quality Assurance (NCQA) or the Utilization Review Accreditation Commission (URAC) — for its credentials verification services. This accreditation must be held in the prime Contractor's own name and may not be satisfied through the accreditation of a subcontractor, affiliate, or third-party performing credentialing functions on the prime Contractor's behalf. The prime Contractor's independent accreditation is a foundational requirement of this contract and must be maintained throughout the full Period of Performance. Detailed accreditation requirements, documentation obligations, and notification requirements are set forth in Section 7.2.

The solution shall comply with the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline, VA Handbook 6500, VA Handbook 6517, and VA Directive 6513. The Contractor shall provide documentation demonstrating compliance with FedRAMP Moderate and VA-specific security directives at the time of the proposal.

2.1 Emerging Technology Utilization

2.1.1 VA Expectation

VA expects the Contractor to leverage emerging technology to the fullest extent practicable in the performance of credentialing services under this contract. This includes, but is not limited to, the application of artificial intelligence, machine learning, intelligent automation, advanced data analytics, and other innovative tools and platforms that have the potential to improve the efficiency, accuracy, timeliness, and quality of credentialing verification activities. VA's expectation applies across all aspects of contract performance, including primary source verification, provider outreach and communications, database management, risk assessment, reporting, and continuous monitoring.

This section does not establish a contractual requirement to adopt any specific technology or platform, nor does it obligate the Contractor to implement emerging technology solutions beyond those described in the Contractor's approved proposal and program management framework. Rather, this section reflects VA's strong preference for a performance approach that embraces technological innovation as a means of delivering credentialing services that are efficient, scalable, and aligned with the evolving landscape of healthcare credentialing practice.

2.1.2 Data Security and Compliance

Any emerging technology solution employed by the Contractor in the performance of this contract shall comply with all applicable security, privacy, and data protection requirements established in Section 14.0 of this PWS, including NIST FIPS 140-2 (or successor, e.g., 140-3) validated encryption requirements for data in transit and at rest. The Contractor shall ensure that any third-party technology platforms or tools used in contract performance that involve the processing, storage, or transmission of sensitive provider information or Government Furnished Information meet the same security and compliance standards applicable to the Contractor's own systems. The introduction of any new technology platform or tool that materially affects the processing of provider data shall be reported to the COR in advance, consistent with the notification requirements applicable to material changes in program operations under Section 7.1.2.

2.1.3 Evaluation Consideration

VA recognizes that the thoughtful application of emerging technology may offer meaningful efficiencies in the delivery of credentialing services, including reductions in processing time, improvements in data accuracy, and enhanced reporting capabilities. Accordingly, offerors are encouraged to describe in their proposals the specific emerging technologies, tools, or innovative approaches they intend to employ in the performance of this contract, and to articulate how those technologies will enhance the quality and efficiency of credentialing services delivered to VA. The extent to which an offeror's technical approach demonstrates innovative and effective use of emerging technology to meet the requirements of this PWS may be considered as part of VA's evaluation of proposals, in accordance with the evaluation criteria established in the solicitation.

2.1.4 Technology Evolution During Performance

VA acknowledges that the technology landscape will continue to evolve during the Period of Performance. The Contractor is encouraged to identify and propose the adoption of new or improved technologies that become available after contract award and that have the potential to further enhance contract performance. Any proposed technology change that would materially affect the Contractor's performance approach, data security posture, or deliverable processes shall be submitted to the COR for review prior to implementation, consistent with the program management requirements of Section 7.1.2. VA reserves the right to accept or decline proposed technology changes that fall outside the scope of the approved program management framework.

3. CONTRACT TYPE

This is a firm fixed price contract.

4. PERIOD OF PERFORMANCE

The Period of Performance (PoP) shall consist of a 12-month base period, with four (4) 12-month option periods. The overall PoP shall not exceed 60 months. The period of performance is as follows:

· Base Period: [INSERT START DATE] – [INSERT END DATE]

· Option Period 1: [INSERT START DATE] – [INSERT END DATE]

· Option Period 2: [INSERT START DATE] – [INSERT END DATE]

· Option Period 3: [INSERT START DATE] – [INSERT END DATE]

· Option Period 4: [INSERT START DATE] – [INSERT END DATE]

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

5. PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor's place of performance in their proposal submission.

6. TRAVEL

Travel is not required or reimbursable for performance of the PWS.

7. SPECIFIC TASKS AND DELIVERABLES

The work performed under this PWS is for the purposes of completing credentialing only; this contract is not for consultation or program management and is not specific to the contracts for which VA has agreements with the providers being credentialed. The work performed under this PWS is guided by the VA, and services are specific to the tasks assigned by VA. Services are aligned with the process of obtaining information, completion of PSV, and assessment of the CVO Review Board to allow VA to make a full assessment of a provider's credentials.

The Contractor shall perform the following:7.1 PROGRAM MANAGEMENT

7.1.1 Overview

The Contractor shall establish and maintain a comprehensive program management framework to ensure effective governance, operational transparency, and consistent delivery of all credentialing services required under this contract. The Contractor shall designate a Program Manager as the single point of contact responsible for overseeing all aspects of contract performance, coordinating with the Contracting Officer's Representative (COR) and Contracting Officer (CO), and ensuring that all tasks, deliverables, and performance standards are met throughout the Period of Performance. The Program Manager shall be available to VA during normal business hours and shall respond to inquiries from the COR or CO within one (1) business day.

The program management framework shall encompass the full lifecycle of contract performance, including contract startup and implementation, ongoing operational oversight, deliverable management, risk identification and mitigation, and transition-out. The Contractor shall ensure that program management activities are fully integrated with and supportive of all tasks and deliverables established elsewhere in this PWS, including accreditation maintenance (Section 7.2), online database operations (Section 7.3), credentialing verification services (Section 7.5), CVO Credentialing Committee operations (Section 7.6), training and communications (Section 7.8), and transition-out planning and execution (Section 7.9).

7.1.2 Contractor Program Management Plan

Within 30 calendar days of contract award, the Contractor shall develop and submit a Contractor Program Management Plan (PMP) to the COR for review and approval. The PMP shall describe the Contractor's approach to managing all aspects of contract performance and shall serve as the governing document for program operations throughout the Period of Performance. The Contractor shall update and resubmit the PMP to the COR for approval no later than 30 calendar days prior to the start of each option period, and at any time a material change to program operations, staffing, or methodology occurs. VA reserves the right to request an updated PMP at any time during the Period of Performance.

The PMP shall address, at minimum, the following elements:

a. Program Organization and Staffing The Contractor shall describe the program organizational structure, including the roles, responsibilities, and lines of authority for all key personnel and functional teams supporting contract performance. The PMP shall identify the designated Program Manager by name and shall include a staffing plan that demonstrates the Contractor's ability to maintain sufficient qualified staff to meet all performance standards and deliverable timelines, including during the transition-out period described in Section 7.9.

b. Implementation and Startup Plan The Contractor shall describe the approach to contract startup activities, including the 30-day implementation phase for CVO portal access configuration referenced in Section 7.3, the initial submission of accreditation documentation required under Section 7.2, and the development and submission of all initial deliverables due within 30 days of award as identified in the Delivery Schedule (Section 8.0). The startup plan shall include a milestone schedule identifying the planned completion date for each initial deliverable and the responsible personnel.

c. Deliverable Management The Contractor shall describe the internal processes for developing, reviewing, and submitting all contract deliverables in accordance with the Delivery Schedule (Section 8.0). The PMP shall specifically address the Contractor's approach to managing recurring deliverables, including the Monthly Status Report (Section 7.4), the Monthly CVO Credentialing Committee Report (Section 7.6.3), and the Monthly Provider Payment Milestone Status Report (Section 7.5.10), as well as event-driven deliverables such as delay notifications (Section 7.6.2), VA withdrawal notifications and associated database updates (Section 7.5.10(f)), disaster event notifications (Section 7.3.2), breach notifications (Section 14.3.4.1), and transition-out deliverables (Section 7.9). The PMP shall describe the quality control review process the Contractor will apply to all deliverables prior to submission to VA. Failure to submit deliverables within the timeframes established in the Delivery Schedule (Section 8.0) may constitute a performance deficiency subject to the Corrective Action Plan process established in Section 12.5.

d. Accreditation Maintenance The Contractor shall describe the approach to maintaining active accreditation status with a nationally recognized certifying or accrediting organization (e.g., NCQA or URAC) throughout the Period of Performance, as required under Section 7.2. The PMP shall identify the accrediting body, the current accreditation expiration date, and the internal processes for monitoring accreditation status, completing renewal activities, and promptly notifying VA of any change in accreditation status, including probation, suspension, or revocation.

e. Online Database Operations and Access Management The Contractor shall describe the approach to maintaining and operating the online database required under Section 7.3, including the process for managing VA personnel access and resolving access and password issues within the timeframes specified in Section 7.3. The PMP shall address the Contractor's approach to database uptime monitoring, outage identification, and outage reporting consistent with the Monthly Status Report requirements in Section 7.4, and shall describe the Contractor's approach to meeting the database availability standard established in Section 7.3.1, including internal monitoring tools and processes, scheduled maintenance planning, and the escalation process for identifying and responding to unplanned outages within the timeframes required. The PMP shall additionally describe the Contractor's approach to business continuity and disaster recovery consistent with the requirements of Section 7.3.2, including backup frequency, geographic redundancy of backup storage, recovery procedures, RTO and RPO compliance monitoring, and annual BC/DRP testing. The PMP shall additionally describe the Contractor's approach to identifying language barriers and making translation services available to non-English-proficient providers in accordance with Section 7.8.5, including the internal process for arranging translation services promptly upon provider request, the process for ensuring translation quality consistent with Section 7.8.5(e), and the approach to documenting and reporting language barrier incidents to the COR within the timeframes required.

f. Training and Communications Management The Contractor shall describe the approach to developing, maintaining, and updating all training materials and communications required under Section 7.8, including training videos (Section 7.8.1), user guides (Section 7.8.2), the standardized communications plan (Section 7.8.3), and communications templates (Section 7.8.4). The PMP shall describe the internal process for monitoring software or process changes that trigger the five (5) business day update requirement and for obtaining VA approval of updated materials prior to use or distribution.

g. CVO Credentialing Committee Governance The Contractor shall describe the approach to establishing, operating, and maintaining the CVO Credentialing Committee required under Section 7.6, including the Committee's charter, membership qualifications, meeting cadence, and case review processes. The PMP shall address the internal escalation process for referring providers to the Committee, the process for documenting and reporting Committee recommendations to VA, and the notification process for significant changes to Committee structure or membership as required by Section 7.6.

h. Transition-Out Readiness The Contractor shall describe the approach to maintaining ongoing transition-out readiness throughout the Period of Performance, consistent with the requirements of Section 7.9. The PMP shall identify the key personnel responsible for transition-out planning and execution, describe how the Contractor will maintain current and accurate provider file status inventories and NPDB-CQ enrollment records to support an efficient transition-out, and confirm the planned submission schedule for the initial and updated transition-out plans required under Section 7.9.1.

Deliverables:

· Contractor Program Management Plan (initial, within 30 calendar days of award)

· Updated Contractor Program Management Plan (prior to each option period, or upon material change)

7.1.3 Risk Management Plan

· As part of the PMP submission required under Section 7.1.2, the Contractor shall develop and submit a Risk Management Plan (RMP) to the COR for review and approval. The RMP shall describe the Contractor's systematic approach to identifying, assessing, monitoring, and mitigating risks that could adversely affect contract performance, service continuity, data security, or the timely delivery of credentialing services to VA. The Contractor shall update the RMP and resubmit it to the COR whenever a new significant risk is identified, a risk status materially changes, or VA requests a revision. The RMP shall be maintained as a living document throughout the Period of Performance.

· The RMP shall address, at minimum, the following elements:

· a. Risk Identification and Register The Contractor shall maintain a risk register that documents all identified risks to contract performance. At a minimum, the risk register shall address risks in the following categories:

· Operational risks, including risks to credentialing throughput, re-credentialing cycle management, returned provider volumes, and language barriers impeding provider completion of the credentialing application or response to Contractor outreach, including risks associated with delays in arranging translation services pursuant to Section 7.8.5

· Staffing risks, including key personnel turnover, insufficient qualified staff, and subcontractor performance issues

· Technology and database risks, including online database outages and failure to meet the availability threshold or incident restoration timeframes established in Section 7.3.1, failure to achieve the RTO or RPO standards established in Section 7.3.2, data loss, cybersecurity incidents, and access management failures

· Accreditation risks, including risks to the Contractor's active accreditation status with NCQA or URAC as required under Section 7.2

· Data security and privacy risks, including unauthorized disclosure of sensitive provider information, breaches of FIPS FIPS 140-2 (or successor, e.g., 140-3) validated encryption requirements for data in transit and data at rest as required under Sections 14.3.3(g) and 14.3.3(a)(i), failure to notify VA of a breach within the 72-hour timeframe required under Section 14.3.4.1, failure to maintain or activate the Incident Response Plan required under Section 14.3.4.2, and failures of data destruction protocols required under Section 7.9.2(e)

· Compliance risks, including risks of non-compliance with PSV standards, NPDB-CQ enrollment and renewal requirements under Section 7.7.2, applicable regulatory or accreditation standards, and invoice documentation and record-keeping obligations required to support invoice dispute resolution pursuant to Section 7.5.10(e)(v)

· Transition risks, including risks to continuity of operations and data integrity during the transition-out period required under Section 7.9

· b. Risk Assessment For each risk identified in the register, the Contractor shall assess and document the likelihood of occurrence and the potential impact on contract performance using a defined rating scale (e.g., High/Medium/Low or a numeric scale). The RMP shall describe the methodology used to assess and prioritize risks.

· c. Mitigation Strategies For each identified risk, the Contractor shall document specific mitigation strategies designed to reduce the likelihood or impact of the risk. Mitigation strategies shall be actionable, assigned to responsible personnel, and include target completion or implementation dates where applicable.

· d. Contingency plans shall address, at minimum, scenarios involving: routine database outages governed by Section 7.3.1; disaster events requiring BC/DRP activation pursuant to Section 7.3.2, including full database recovery from backup; data breaches or security incidents, for which the Incident Response Plan required under Section 14.3.4.2 shall serve as the governing contingency document and shall be referenced accordingly; loss of accreditation status; and key personnel departures.

· e. Risk Monitoring and Reporting The Contractor shall describe the internal process for monitoring the risk register throughout the Period of Performance, including the frequency of review, the personnel responsible for risk monitoring, and the criteria for escalating risks to VA. The Contractor shall include a brief risk status summary in each Monthly Status Report (Section 7.4) identifying any new risks identified during the reporting period, any changes in risk status for previously identified risks, and the current mitigation or contingency actions in progress. Any risk that the Contractor determines poses an imminent threat to contract performance or service continuity shall be reported to the COR in writing within one (1) business day of identification. Where an approved Corrective Action Plan is active pursuant to Section 12.5, the Contractor shall additionally include a CAP implementation status update in each Monthly Status Report in accordance with Section 12.5.5.

· Deliverables:

· Risk Management Plan (submitted with initial PMP, within 30 calendar days of award)

· Updated Risk Management Plan (upon identification of new significant risks, material change in risk status, or VA request)

· Risk Status Summary (included in each Monthly Status Report per Section 7.4)

7.1.4 Kickoff Meeting

Within ten (10) calendar days of contract award, the Contractor shall participate in a kickoff meeting with the COR, CO, and other VA-designated stakeholders. The purpose of the kickoff meeting is to review contract requirements, confirm points of contact, establish communication protocols, align on the implementation schedule, and address any questions regarding the PWS or initial deliverable requirements. The Contractor shall prepare and distribute a kickoff meeting agenda to the COR at least two (2) business days prior to the meeting. Following the meeting, the Contractor shall prepare and submit meeting minutes to the COR within five (5) business days, documenting attendees, topics discussed, action items, and responsible parties. The kickoff meeting shall be conducted virtually through a VA approved tool such as Microsoft Teams.

Deliverables:

· Kickoff Meeting Agenda

· Kickoff Meeting Minutes

7.2 Accreditation

At the time of submission of the solicitation response and throughout the life of the contract, the Contractor shall be accredited for its credential's verification services by a nationally recognized certifying or accrediting organization (e.g., the National Committee for Quality Assurance (NCQA) or the Utilization Review Accreditation Commission (URAC)) and shall maintain active accreditation status throughout the life of the contract. At the time of submission of the solicitation response, the Contractor shall submit to the Government all accreditation credentials for verification. VA reserves the right to perform random reviews of the accreditation, certification, credentialing, privileging/competency measures, and licensing files for the accredited programs and providers.

The Contractor shall:

· Maintain documentation of all accreditation(s), certification(s), credentialing, and licensing for its accredited components or programs and providers performing services under this contract.

· Provide a copy of its accreditation documentation in accordance with the Schedule of Deliverables.

· Notify VA if its accreditation is put on probation, suspended, or revoked within three (3) business days, along with a corrective action plan (CAP).

The Contractor shall follow applicable accreditation standards (NCQA and/or URAC) as the base requirement for PSV processes. Entities/providers without credentialing standards or accreditation requirements (such as home health providers) are required to provide the following minimum documentation:

a) Proof of identity by obtaining a U.S. or U.S. State government-issued photo identification or I-9 documentation

b) Proof of completion of required and relevant education and training (e.g., transcripts, certificates, etc.), as applicable (unskilled home health is excluded)

c) An active, unrestricted license in the State(s) or U.S. territories in which the service is performed, if applicable

d) Current National Provider Identifier (NPI) number

e) Tax identification number (TIN)

f) Active professional liability insurance in an amount in accordance with the laws of the State or U.S. territory in which the care is provided

g) Relevant work history related to their scope of practice (minimum of last 10 years)

h) Criminal background disclosure

i) Minimum of three (3) professional references

j) Confirmation that the network provider does not have a history indicating that they violated the requirements of a medical license that resulted in the loss or voluntary surrender in lieu of such medical license in any State

Deliverables:

· Documentation of accreditation due at time of proposal

· Annual attestation of accreditation

7.3 Online Database

The Contractor shall maintain an online, profile-based database that enables providers to self-report demographic and professional information and supports VA credentialing activities. The database shall be compliant with nationally recognized accreditation standards (e.g., NCQA, URAC), shall allow VA personnel and VA-identified providers to access and update information as needed, and shall ensure all user access and password issues are resolved within five (5) business days. Issues outside the Contractor's control shall be documented and reported to VA within three (3) business days of determining whether the issue is outside the Contractor's control. The database shall include a dedicated returned provider dashboard or queue that allows VA personnel to view, filter, and export returned provider data at any time. The dashboard shall include, at minimum, filterable fields for provider name, NPI, date of return, reason for return, number of contact attempts, and resubmission status. VA personnel shall be able to export returned provider data into Excel format with sortable fields preserved.

The database shall have the following capabilities:

a. Self-reporting capability that allows providers to enter required demographic and credentials data, and allows VA to obtain provider information from the database.

b. Database licenses for up to 50 VA personnel.

c. All provider demographic and credentials data shall be exportable in PSV and Excel file formats, with the functionality to export multiple providers simultaneously in the same file. d. Ability to ingest and process data from IP addresses associated with all States and U.S. territories. IP-based access controls, firewalls, or security configurations shall be implemented in a manner that does not prevent the completion of credentialing, re-credentialing, and NPDB enrollment activities.

e. Ability for VA personnel to view provider data, request provider data changes (such as deactivations), and track the status of a provider's credentialing process.

f. A filterable Minimum Experience Criteria (MEC) queue with search capabilities, allowing users to filter and search by provider name, National Provider Indicator (NPI), facility, risk level, risk score, date submitted, and keywords within files (such as "malpractice," "sanction," or "appeal"), and to bulk export providers by risk category into Excel with sortable fields preserved.

The Government anticipates an initial 30-day implementation phase for CVO portal access configuration and tasks related to this section.

7.3.1 Database Uptime and System Performance Standards

The Contractor shall maintain the online database required under Section 7.3 at a minimum availability rate of 99% during each calendar month of the Period of Performance, measured across all hours of each calendar month (i.e., 24 hours per day, 7 days per week). At the 99% threshold, the maximum allowable unplanned downtime in any given calendar month shall not exceed 7.2 hours in aggregate. Availability shall be calculated as follows:

Monthly Availability % = ((Total Hours in Month − Unplanned Downtime Hours) / Total Hours in Month) × 100

For purposes of this section, "unplanned downtime" means any period during which the database is unavailable to VA personnel or providers for reasons other than scheduled maintenance conducted in accordance with subsection (b) below.

a. Incident Response and Restoration Timeframes Upon identification of an unplanned database outage or system performance degradation, the Contractor shall:

· Notify the COR in writing (email) within two (2) hours of identifying any outage or material system performance degradation that affects VA personnel or provider access to the database

· Initiate restoration activities immediately upon identification of the outage

· Restore full database functionality within four (4) hours of outage identification for outages occurring during VA core business hours (Monday through Friday, 8:00 a.m. – 5:00 p.m. local time, excluding Federal holidays)

· Restore full database functionality within eight (8) hours of outage identification for outages occurring outside of VA core business hours.

The outage notification to the COR shall include, at minimum, the date and time the outage was identified, the nature and known or suspected cause of the outage, the estimated time to restoration, and the scope of impact to VA personnel and provider access.

b. Scheduled Maintenance The Contractor may perform scheduled maintenance activities that require planned database downtime, provided that all such maintenance is conducted outside of VA core business hours — specifically, overnight (between 8:00 p.m. and 6:00 a.m. local time on weekdays) or during weekends (Saturday and Sunday), excluding Federal holidays. The Contractor shall provide the COR with written notice of any scheduled maintenance at least five (5) business days in advance, identifying the planned maintenance window, the anticipated duration of downtime, and the nature of the maintenance activity. Planned maintenance outages conducted in accordance with these requirements shall be excluded from the monthly availability calculation and shall not count against the 99% uptime threshold. Planned maintenance that exceeds its scheduled duration and extends into VA core business hours shall be treated as unplanned downtime for purposes of calculating monthly availability for the hours that exceed the approved maintenance window.

c. Outage Documentation and Reporting The Contractor shall maintain a complete log of all database outages — both planned and unplanned — throughout the Period of Performance. For each outage, the log shall document the date and time the outage began, the date and time full functionality was restored, the total duration of the outage, the cause of the outage, and the corrective actions taken. The Contractor shall include a summary of all outages occurring during the preceding calendar month in the Monthly Status Report submitted pursuant to Section 7.4, including the total cumulative unplanned downtime for the month and the resulting monthly availability percentage. If no outages occurred during a reporting period, the Contractor shall affirmatively state this in the Monthly Status Report.

d. Remedies for Failure to Meet Uptime or Restoration Standards Failure to meet the 99% monthly availability threshold or the incident response and restoration timeframes established in subsection (a) above shall constitute a performance deficiency subject to the following:

· The CO shall document the performance deficiency in the Contractor's performance record in the Contractor Performance Assessment Reporting System (CPARS) in accordance with FAR Subpart 42.15

· The Contractor shall submit a written Corrective Action Plan (CAP) to the COR within five (5) business days of the deficiency being identified, describing the root cause of the failure, the specific corrective actions the Contractor will implement to prevent recurrence, and the timeline for implementation

· The CO reserves the right to pursue further remedies available under the contract and applicable provisions of the FAR, including but not limited to FAR Subpart 49.4 (Termination for Default) and FAR 52.246-4 (Inspection of Services), as appropriate to the nature and severity of the deficiency.

The CAP submitted under this subsection is in addition to, and does not replace, the delay notification and action plan requirements established in Section 7.6.2. Repeated failures to meet the uptime standard — defined as two (2) or more calendar months within any rolling six (6) month period in which the Contractor fails to achieve 99% availability — shall be treated as a pattern of performance deficiency and may result in additional remedies as determined by the CO.

7.3.2 Business Continuity and Disaster Recovery

In addition to the routine outage response requirements established in Section 7.3.1, the Contractor shall maintain a Business Continuity and Disaster Recovery Plan (BC/DRP) that ensures the Contractor's ability to restore full database functionality and resume credentialing operations following a catastrophic system failure, data loss event, or other disaster scenario that cannot be resolved through routine restoration procedures. The BC/DRP shall be submitted to the COR for review and approval within 30 calendar days of contract award and shall be updated and resubmitted to the COR within ten (10) business days of any material change to the Contractor's database infrastructure, backup systems, or recovery procedures. VA reserves the right to request an updated BC/DRP at any time during the Period of Performance.

a. Recovery Time Objective (RTO) The Contractor shall restore full database functionality within 24 hours of declaring a disaster event that requires full database recovery from backup. For purposes of this section, a "disaster event" is defined as any incident that results in the complete loss of database functionality that cannot be restored through the routine restoration procedures described in Section 7.3.1 within the timeframes established therein. The 24-hour RTO begins at the time the Contractor declares a disaster event and notifies the COR in writing that full recovery procedures have been initiated.

b. Recovery Point Objective (RPO) The Contractor shall maintain database backup procedures sufficient to ensure that, in the event of a disaster requiring full database recovery, the restored database reflects a state no older than four (4) hours prior to the disaster event. To meet this RPO, the Contractor shall perform automated database backups at intervals of no greater than four (4) hours throughout each calendar day. Backups shall be stored in a geographically separate location from the primary database environment and shall be encrypted using NIST FIPS FIPS 140-2 (or successor, e.g., 140-3) validated encryption consistent with the requirements of Section 13.0.

c. BC/DRP Content Requirements The BC/DRP shall address, at minimum, the following elements:

· A description of the Contractor's backup architecture, including backup frequency, storage locations, and encryption methods

· The procedures the Contractor will follow to declare a disaster event and initiate full recovery, including the criteria that distinguish a disaster event from a routine outage

· The roles and responsibilities of Contractor personnel during disaster recovery operations, including identification of the personnel responsible for executing recovery procedures and communicating with VA

· The procedures for notifying the COR within two (2) hours of declaring a disaster event, consistent with the notification requirements of Section 7.3.1(a)

· The procedures for restoring all provider credentialing files, contact attempt logs, returned provider tracking data, NPDB-CQ enrollment records, and all other data required for continuity of credentialing operations

· The procedures for verifying data integrity following recovery and confirming to the COR in writing that all data has been successfully restored and is accessible to VA personnel

· The Contractor's procedures for continuing to meet credentialing intake, contact attempt, and reporting obligations to the extent practicable during a disaster recovery period, including any interim manual processes that will be employed

d. Annual BC/DRP Testing The Contractor shall conduct and document an annual test of the BC/DRP, including a full or partial restoration exercise using backup data, and shall provide the COR with a written summary of the test within 30 calendar days of completion, identifying the scope of the test, the results, any recovery gaps identified, and the corrective actions taken or planned to address those gaps.

e. Disaster Event Reporting Upon declaring a disaster event, the Contractor shall notify the COR in writing within two (2) hours, identifying the nature and suspected cause of the disaster, the estimated scope of data or system impact, the recovery procedures being initiated, and the estimated time to full restoration consistent with the RTO established in subsection (a). The Contractor shall provide the COR with written status updates at intervals of no greater than four (4) hours throughout the recovery period until full functionality is restored. Upon completing recovery, the Contractor shall provide the COR with a written post-recovery report within five (5) business days, summarizing the cause of the disaster, the recovery actions taken, the actual recovery time achieved, any data loss that occurred relative to the RPO, and any changes to the BC/DRP or backup procedures implemented as a result.

Deliverables:

· Business Continuity and Disaster Recovery Plan (within 30 calendar days of contract award)

· Updated BC/DRP (within 10 business days of material change, or upon VA request)

· Annual BC/DRP Test Summary (within 30 calendar days of completing annual test)

· Disaster Event Notification (within 2 hours of declaring a disaster event)

· Post-Recovery Report (within 5 business days of completing recovery)

7.4 Monthly Status Report

The Contractor shall provide monthly reporting from the previous calendar month (excluding the initial 30-day implementation phase) to the Contracting Officer's Representative (COR) by the 10th of each month (or the next business day, if the 10th falls on a weekend or holiday) along with the corresponding invoice. The initial 30-day implementation phase shall be deemed to commence on the date of contract award and shall conclude 30 calendar days thereafter. The first Monthly Status Report shall cover all reportable activity occurring from the day immediately following the conclusion of the implementation phase through the last day of that same calendar month, and shall be due by the 10th of the following calendar month. All subsequent Monthly Status Reports shall cover the full preceding calendar month. The Contractor shall submit invoices for triggered payment milestones in accordance with Section 7.5.10. A summary of all invoiced milestones during the reporting period shall be included in the Monthly Status Report consistent with Section 7.5.10(e) The Contractor shall use the VA-approved reporting template (see Attachment B) for the monthly reporting, which shall include the following topics:

Database Operations

· Database availability summary for the preceding month, including the total cumulative unplanned downtime in hours, the resulting monthly availability percentage calculated in accordance with Section 7.3.1, and an affirmative statement if no outages occurred during the reporting period

· An itemized log of all unplanned database outages during the preceding month, including the date and time each outage began, the date and time full functionality was restored, the total duration of each outage, the cause of each outage, and the corrective actions taken, consistent with the outage documentation requirements of Section 7.3.1(c)

· A summary of any scheduled maintenance windows conducted during the preceding month, including the date, duration, and nature of maintenance performed Provider Submissions and Credentialing Activity

· Itemized list of new providers submitted by VA during the preceding month, with the date of submission by VA and the date of initial contact attempt by the Contractor, consistent with the 1 business day initial contact requirement established in Section 7.5.5.1

· Itemized list and total number of providers for which the Contractor performed credentials verification services during the preceding month, their graded risk assessment results (e.g., A–F or 1–5), with annotation of whether the credentialing services were for initial credentialing or re-credentialing

· Of the providers reported in the preceding bullet, an itemized identification of any providers located in or licensed in U.S. territories, including the territory in which the provider is located or licensed, the applicable territorial licensing authority, and any territory-specific factors that affected the credentialing process or timeline during the reporting period. If no territory-based providers were processed during the reporting period, the Contractor shall affirmatively state this.

· Credentialing process stage milestone summary, identifying the average time to complete each stage defined in Section 7.5.5.1 across all providers processed during the reporting period, and an itemized list of any providers for whom a stage timeframe was not met with an explanation of the cause of each delay

· Itemized list of providers whose re-credentialing will be required within the next one hundred and twenty (120) days from the first of the month being reported, including information regarding whether the provider has engaged in the re-credentialing process in the past 30 calendar days from the time of the report

· Itemized list of providers flagged as re-credentialing overdue as of the reporting period — meaning providers whose re-credentialing due date has passed without a formal re-credentialing submission from VA — identified by name, NPI, and re-credentialing due date, consistent with the flagging requirements of Section 7.5.9.1(c)

· Itemized list of providers whose PSV documentation will expire within the next one hundred and twenty (120) days from the first of the month being reported, including information regarding whether the provider has furnished updated or renewed documentation Returned and Withdrawn Providers

· Itemized list of returned providers with documented contact attempts, including dates and modalities for each contact attempt, consistent with the returned provider tracking requirements of Section 7.5.5

· Itemized list of providers withdrawn by VA during the preceding month, identifying each withdrawn provider by name and NPI, the date of withdrawal, the stage of credentialing at the time of withdrawal, and the Milestone 1 payment status for each withdrawn provider, consistent with the reporting requirements of Section 7.5.10(g)(v). Withdrawn providers shall be tracked and reported separately from returned providers

· Of the returned and withdrawn providers reported in this subsection, an itemized identification of any providers located in or licensed in U.S. territories, consistent with the territory tracking requirement established in the Provider Submissions and Credentialing Activity subsection above.

Sanctions and Monitoring

· Summary of efforts monitoring all providers for sanctions and disciplinary actions during the preceding month, with an itemized listing of all providers flagged and the specific reason(s) for being flagged

· Summary of NPDB-CQ enrollment and renewal activity during the preceding month, identifying each provider newly enrolled in NPDB-CQ and each provider whose NPDB-CQ enrollment was renewed, with clear identification of the type of enrollment (new or renewal) for each, consistent with the reporting requirements of Section 7.7.2. If no new enrollments or renewals occurred during the reporting period, the Contractor shall affirmatively state this

· Itemized listing of any NPDB-CQ renewal failures that occurred during the preceding month, including the provider's identifying information and the reason for the renewal failure, consistent with the requirements of Section 7.7.2 CVO Credentialing Committee

· CVO Credentialing Committee recommendation for approval or denial for each provider reviewed during the preceding month

· Final Medical Executive Committee (MEC) recommendation for approval or denial for each provider reviewed, including notes or documentation from the MEC review

· Summary of appeal reviews completed during the preceding month, including the number of appeals reviewed, the Committee's recommendation for each appeal, the average time to complete each appeal review, and identification of any appeals for which the five (5) business day review timeframe established in Section 7.6.2.1 was not met with an explanation of the cause of each delay, consistent with the reporting requirements of Section 7.6.3 Tiered Submission Summary

· Total number of providers submitted by VA during the reporting period

· The tier applicable to the reporting period and the corresponding sub-CLIN, consistent with the tier reporting requirements of Section 7.5.1(e)

· The per-provider unit price in effect for the applicable tier

· Total number of providers invoiced at Milestone 1, Milestone 2, and Milestone 3 during the reporting period, organized by tier