Draft PWS SOPHROSYNE Chat Bot.docx

Chatbot/Interface VA-24-00065746

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Veterans Health Administration Office of Mental Health

Simulated Orator to Promote Help-seeking and Recovery, Orient Self-care, and Yield Native Engagement (SOPHROSYNE): A Chatbot/Interface to Support Motivational Interviewing and Care Navigation to Encourage Reduced Substance Use

Date: May 8, 2024

VA-24-00065746

PWS Version Number: 1.2

Contents

BACKGROUND

The Department of Veterans Affairs (VA), Veterans Health Administration, Office of Mental Health seeks a Simulated Orator to Promote Help-seeking and Recovery, Orient Self-care, and Yield Native Engagement (SOPHROSYNE): A Chatbot/Interface to Support Motivational Interviewing and Care Navigation to Encourage Reduced Substance Use.

Rates of substance use disorder and overdose mortality have been increasing rapidly in the United States, both in the general population and Veterans. The National Drug Control Strategy has outlined a cross-agency approach to reducing harms from substance use. Veterans Health Administration (VHA) has been assigned a large role in this strategy and improving substance use disorder identification, prevention and treatment is an agency priority. Towards this end, VHA is working to expand use of existing prevention and treatment programs and implement innovative new approaches to identification and treatment of patients at risk of developing or experiencing harm from substance use behaviors.

VHA’s efforts to address substance use disorder-related harm overlap with efforts to prevent suicide and overdose. Patients with substance use disorders have the highest rate of suicide amongst diagnosed patient populations in VHA, and rates of suicide are increasing in this subpopulation of Veterans. Substance use disorder is the largest cause of overdose, and rates of overdose due to use of illicit fentanyl have increased dramatically. In the domain of targeted intervention, VHA has successfully utilized predictive analytics-based computerized decision support systems to implement novel targeted prevention interventions to patients at risk of suicide or overdose. Specifically, VHA Office of Mental Health and Suicide Prevention (OMHSP) and the Office of Pain Management, Opioid Safety and Prescription Drug Monitoring Programs (PMOP) have implemented the Recovery Engagement And Coordination for Health – Veterans Enhanced Treatment (REACHVET) and Stratification Tool for Opioid Risk Mitigation (STORM) decision support systems with paired mandated clinical programming focused on targeted case review with treatment planning/outreach to address unmet care needs for patients estimated to be at highest risk of suicide or overdose based on predictive models. In addition to these predictive models, VHA OMHSP has developed novel case-finding tools which search VA’s electronic medical record data to identify signs and free-text mentions suggestive of substance use. These new case finding tools can identify patients with signs of substance use who either have not been fully assessed and/or diagnosed or who have been diagnosed but are not engaged in treatment. Together, these novel VHA innovations identify a large patient population likely to benefit from behavioral health interventions to reduce substance use or related risky health behaviors.

There are significant challenges to getting patients with substance use behaviors to seek treatment and support for behavior change. First, because drug use is often illegal and frequently stigmatized, patients may not be comfortable with or willing to honestly disclose substance use behaviors to their clinicians. For example, patients may fear that clinicians will treat them differently if they know about substance use behaviors, or simply worry about eliciting disapproval or other negative responses from their clinical providers. They may feel unable to reduce substance use and fear attempting to stop because they assume they will fail. Moreover, patient fears are not unfounded. Providers do have variable reactions to admission of substance use behaviors, and some may respond in ways that have been found to increase rather than decrease substance use and/or risk to patients (e.g., confrontational or accusatory language, abrupt discontinuation of controlled substance prescriptions or treatment relationships). Second, providers report insufficient training and lack of competence in assessing and addressing substance use behaviors at high rates, and report that competing priorities in health care visits (e.g., management of chronic conditions such as diabetes or hypertension, for which they have greater self-reported treatment competency) limit attention to substance use assessment and behavior change. Because of these barriers to reporting and effective clinical response, trials of universal drug screening by clinicians have not been found to improve treatment engagement or outcomes for patients.

Positively, however, patients have been found to report substance use behaviors more completely and honestly when reporting to an electronic device rather than a human clinician. Additionally, effective communication and therapeutic approaches to motivating patients to reflect on substance use behaviors and consequences, develop interest in behavior change and accept support or treatment have been developed and widely disseminated. With protocols defining fidelity to these approaches (e.g., Motivational Interviewing) and examples of appropriate communication with these methods, it becomes plausible to train a chatbot or develop an algorithm to navigate a patient through reflection on their substance use behavior and its consequences, and options for self-management, community supports, or formal VA treatment.

The primary aim of this project is to develop and optimize based on VA provider and patient feedback a chatbot or self-directed patient interface which would employ a Motivational Interviewing style and approach to allow a patient to:

(1) Report/reflect on their current substance use patterns.

(2) Get accurate and personalized information about harms, consequences, costs, and likelihood of benefits from use of specific substances.

(3) Get accurate and personalized information about the potential benefits of reducing use of specific substances.

(4) Reflect on ambivalence about substance use behaviors, towards strengthening desire to change.

(5) Learn about the symptoms of drug withdrawal and how and when they may be experienced.

(6) Consider long-term goals and values, and their alignment with substance use behaviors.

(7) Learn about types of support and treatment available for a specific substance use problem.

(8) Get information about how to access a specific support or treatment.

(9) Reduce isolation and promote self-expression and introspection.

(10) Reduce guilt, shame or embarrassment related to substance use behaviors and develop comfort in discussing them honestly.

(11) Share information about a substance use problem, personal goals, and treatment interest with their health care team.

(12) Learn about ways to increase engagement with natural rewards (e.g., social skills development, savoring, exercise, peer support, problem-solving skills, coping skills, etc.)

The tool would be built on a VA approved development platform utilizing Microsoft Copilot for Azure, allowing for national deployment within VHA once a system was fully tested and found to have benefit for patients.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21, 2018

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

SCOPE OF WORK

The Contractor shall develop a prototype of a tool to support brief self-guided interventions for drug use. This effort will cover iterative development and usability testing of a prototype, with the expectation that subsequent to this effort this prototype would be additionally pilot tested for use in a VA primary care setting with patients with medical record signs of drug use to determine clinical value.

The Contractor shall provide iterative development and usability/acceptability testing of a prototype interactive interface to support patient education and build motivation and goals for reducing drug use. The application must utilize a Motivational Interviewing-informed approach and VA approved educational content. Use of chatbot functionality is encouraged to increase accessibility and patient engagement. Design should be optimized to maximize patient acceptability and perceived usefulness, while maintaining accuracy of presented content. The prototype must be developed within VA environments that allow for national deployment if the prototype is found to have clinical benefit (e.g., the VA Microsoft Copilot for Azure environment, if chatbot functionality is utilized).

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The PoP shall be 15 months for this effort from contract award.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities for development and piloting. Contractor staff can request office workspace at the VA Menlo Park to facilitate collaboration with OMHSP staff, VA clinicians or Veteran volunteers.

The Contractor shall identify the Contractor’s place of performance in their Task Execution Plan submission. Temporary duty travel (TDY) to a government facility with the effort doesn’t change the Place of Performance to the Government Site.

TRAVEL

The Government does not anticipate travel under this effort to perform the tasks associated with the effort, as meetings and development can be conducted virtually.

SPECIFIC TASKS AND DELIVERABLES

During performance of this effort, focus on developing a system of value to the patient is the guiding principle. Agile project management is evolutionary (iterative and incremental) which regularly produces high quality results in a cost effective, timely, and highly collaborative manner via a value driven lifecycle. This requires open lines of communication among all participants contributing to a project which may include multiple stakeholders with different perspectives (e.g. providers and patients).

All project artifacts developed and delivered shall be VA Office of Information and Technology (OI&T) Process Asset Library compliant.

The project will utilize a schedule of incremental deliveries of useable capabilities every three months or less. Backlog grooming and prioritization are continued throughout the product life cycle and shall be managed throughout the period of performance. Based on the scope of work established in the Backlog, development builds shall be three months or less. The Contractor shall develop and deliver a Build Plan, in DevOps, in collaboration with the project team prior to beginning the build. The Build Plan is the scope of work which will be completed in the agreed upon build timeframe. Each build ends with a new prototype delivery.

A build will consist of a series of sprints (typically 1-4 weeks duration). The Contractor shall provide a Sprint Plan, prior to the beginning of each Sprint which defines the work to be completed during the Sprint. Once the Sprint Plan is approved by the Contracting Officers Representative (COR) /VA PM, the sprint(s) shall commence, and completion shall be based upon the COR/VA PM acceptance.

For delivery of all project artifacts, the Contractor shall utilize DevOps for managing project execution details and for the management and storage of artifacts using the VA OIT VIP and Process Asset Library compliant templates.

The Contractor shall perform the following:

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

REPORTING REQUIREMENTS

The Contractor shall provide the COR with Monthly Progress Reports in electronic form in Microsoft Word formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding Month.

The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Deliverable:

A. Monthly Progress Report

ADDITIONAL TASKS

TECHNICAL KICKOFF MEETING

The Contractor shall hold a technical kickoff meeting within 10 business days after award. The Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort. The Contractor shall specify dates and times, Technical Kickoff Meeting Agenda (which shall be provided to all attendees at least five calendar days prior to the meeting), and Technical Kickoff Meeting Minutes (which shall be provided to all attendees within three calendar days after the meeting).

The Contractor shall also provide Technical Kickoff Meeting Materials (PowerPoint presentations and any other handouts) at least five calendar days prior to the meeting. The meeting shall take place via teleconference. The Contractor shall invite the Contracting Officer, Contract Specialist (CS), COR, VA Subject Matter Experts (SMEs) and the VA Program Manager.

Deliverables:

A. Technical Kickoff Meeting Agenda B. Technical Kickoff Meeting Minutes C. Technical Kickoff Meeting Materials

5.2.2 PRIVACY & HIPAA TRAINING

The Contractor shall submit Talent Management System (TMS) training certificates of completion for VA Privacy and Information Security Awareness (TMS ID: 10176) and Rules of Behavior and Health Insurance Portability and Accountability Act (HIPAA) (TMS ID: 10203) training, and provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”.

The Contractor shall complete all the following VA TMS training courses and provide certificates of completion. Contractors who have completed these VA training courses within the past 12 months and have furnished certificates will not be required to re-take the training courses. The training referenced above is required to be renewed annually.

Deliverables:

A. VA Privacy and Information Security Awareness and Rules of Behavior Training Certificate B. VA HIPAA Certificate of Completion C. Signed Contractor Rules of Behavior

5.2.3 PLANNING

The contractor shall work with the PM to discern relevant stakeholders needed to accomplish the tasks and prototype testing.

5.2.4 BUILD AND DEVELOPMENT

The Contractor shall continuously support the iterative build and development methodology described herein to complete the expected tasks of the work statement.

5.2.5 DEVELOPMENT / IMPLEMENTATION

The Contractor shall develop and implement all necessary components of the chatbot/interface to develop a prototype tool to support a Motivational Interviewing approach to discussion and information sharing regarding substance use behaviors. The prototype will be developed in accordance with Project Specific Agile Requirements in Section 4.4 and all sub-paragraphs, and iterative design and development will be guided by feedback from VA clinician and patient volunteers.

5.2.6 PROJECT SPECIFIC REQUIREMENTS

The Contractor shall develop a user interface that enables a patient with suspected substance use or interest in learning more about the effects of substance use and treatment options to explore personalized information about substance use costs and consequences, interact with the interface utilizing a Motivational Interview approach, and learn about support and treatment available and how to access it.

The user interface shall use VA approved software (see One-VA Technical Reference Model (TRM)), and VA approved clinical content (e.g., patient education materials, links to community resources). Chatbot features must be developed in a VA provisioned development platform in Microsoft Copilot for Azure.

Specifically, the Contractor shall perform the following:

(1) Work with the COR/PM to obtain access to VA development environments, including the VA Microsoft Azure Cloud environment.

(2) Collaborate with the COR/PM and VA subject matter experts on data sources (e.g., example Motivational Interviewing transcripts) and included or developed clinical content.

(3) Develop prototypes of the SOPHROSYNE tool, test SOPHROSYNE for performance and accuracy, assess usability and acceptability and obtain feedback from the PM, SMEs, and volunteer VA clinician and patient volunteers, and iterate to optimize.

(4) Document all methods and code.

(5) Develop implementation and maintenance guides to enable VA staff to run and modify the prototype after the end of the contract period.

(6) Develop end-user guides and training materials for the final prototype.

5.2.7 SOPHROSYNE features

The Contractor will develop a prototype that includes features from the following list, with prioritization and focus based on feedback from the PM, SMEs, and volunteer clinicians and patients. Additional features may be added to or substitute for features on this list if prioritized and approved by the PM and SMEs.

(1) Ability to prompt for information about current drug use, using a standard reporting methodology (e.g., days in the past week, quantity/frequency).

(2) Provide accurate information about:

a. the risks of drug use, tailored toward patient interests and self-reported drug use;

b. the benefits of reducing drug use, tailored toward patient interests and self-reported drug use;

c. the cost of drug use, assuming stable or escalating use over time;

d. potential for and symptoms of withdrawal subsequent to regular use of a drug of interest;

e. the effects of drug use on the brain and decision-making processes;

f. evidence-based treatments for reducing use of a drug of interest;

g. how evidence-based treatments work for treating addiction;

h. evidence-based harm reduction strategies for reducing harm from use of a drug of interest;

i. mutual help groups, and ways to engage with them;

j. why engagement in natural rewards is important for addiction prevention and recovery;

k. strategies for increasing natural rewards in your life, including resources for social skills development, problem-solving training, coping skills training, mindfulness training, savoring exercises, relaxation skills, exercise.

(3) Use Motivational Interviewing strategies to reflect on ambivalence and strengthen desire to change behavior.

(4) Support reflection on and specification of values and goals.

(5) Utilize active listening approaches to encourage self-expression and introspection and reduce isolation.

(6) Ability to summarize and transmit information the patient wishes to share with their clinician.

(7) Ability to navigate to topics of interest to the patient.

(8) Ability to generate a collection of links, tools, and documents of interest to the patient and send it to the patient’s chosen email or phone number.

(9) Ability to summarize the information covered in the chatbot session and transmit the summary to the patient’s email or phone number.

(10) Ability to navigate patients to information on topics of interest.

(11) Engage the patient in discussion about drug use in a safe and comfortable manner to build comfort in discussing drug use and treatment.

Deliverables:

A. Prototype SOPHROSYNE tool at the end of each build cycle B. Documented code and methods description for the current prototype at the end of each build cycle

5.2.8 Usability and Acceptability Testing

The contractor will meet with the PM, SMEs, and volunteer providers and patients at the start of each build to plan and prioritize features and revisions to be included in the prototype for that build cycle. Before completion of the build cycle, the contractor will demo the prototype for the PM, SMEs, and volunteer providers and patients, ideally by allowing these users to interact with prototype. The Contractor will collect structured feedback from each test user regarding: (1) usability of the prototype, including ease of navigation, intuitiveness of the design, understandability of language, and ability to accurately interpret and respond to the user; (2) performance of the prototype, including response lags and wait times for content delivery; (3) accuracy and clinical appropriateness of the prototype, including both appropriateness of information provided, accuracy of content delivered, and appropriateness of language, tone and phrasing of content delivered; (4) utility and perceived benefit of the prototype to the user, (5) specific errors identified, and (6) suggestions for improvement. The Contractor shall also record end-user walk-throughs where end-users attempt to use the tool to get specific information (e.g., are given a task of learning about evidence-based treatments for opioid use disorder, or understanding how much money one is likely to spend on cannabis use in a year), while noting their thought process as they interact with the system.

The contractor will summarize findings from each round of feedback and share with the PM and SMEs at least 2 days before the planning session for the next build to inform prioritization of development tasks in the next build. An initial build for usability and acceptability testing is expected by month 6 with 3 month build and testing cycles thereafter (i.e., Build cycles in months 1-6, 7-9, and 9-12 with formal testing at the end of each cycle, including months 12-15 for final evaluation).

Deliverable:

A. Report on patient, provider, and SME feedback regarding features at the end of each build cycle.

5.2.9 Demonstration of SOPHROSYNE prototype to encourage substance use behavior change.

The Contractor shall hold a Prototype Demonstration Meeting at the end of each Development Build. This will be followed by user testing by the PM, SMEs and volunteer clinicians and patients. For the Prototype Demonstration Meeting the Contractor shall specify dates and times, Prototype Demonstration Meeting Agenda (shall be provided to all attendees at least 2 calendar days prior to the meeting), Prototype Demonstration Meeting Minutes (shall be provided to all attendees within three calendar days after the meeting), and provide any Prototype Demonstration Meeting Materials. The meetings shall take place via teleconference. The Contractor shall invite the CO,CS, COR, VA SMEs, and the VA PM.

Deliverables:

A. Prototype Evaluation Meeting Agenda B. Prototype Evaluation Meeting Minutes C. Prototype Evaluation Meeting Materials (PowerPoint presentations and any other handouts)

5.2.10 Technical and End-User documentation for SOPHROSYNE prototypes

The Contractor shall develop end-user guides and training materials to support use of the prototype by patients and provision of technical support to users by VA maintenance staff.

These guides should provide information on how to engage with the prototype to access key functionality of the system. The guides should also support troubleshooting of common problems or misunderstandings encountered with use of the system. The guides should be supported by a Frequently Asked Questions (FAQ) document, which should address concerns brought up during user testing as well as based on developer experience.

The Contractor shall also develop a maintenance guide. This guide will include:

(1) an organized directory of all static clinical content available via SOPHROSYNE (e.g., patient education materials, links to external websites or tools) to support on-going updating of clinical and educational content within the tool.

(2) English language summary of methodology and coding logic (e.g., pseudocode) to support interpretation of code by a moderately experience programmer.

(3) Instructions for trouble-shooting anticipatable maintenance issues and necessary updates.

The Contractor will provide trainings and a walk-through of code and anticipated maintenance to VA OMHSP programmers before the end of the contract.

Deliverables:

A. User guide, training materials and FAQs.

B. Maintenance guide, including description of methodology and logic, and maintenance instructions.

GENERAL REQUIREMENTS

ENTERPRISE AND IT FRAMEWORK

VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns, https://www.oit.va.gov/library/recurring/edp/index.cfm. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500 Appendix F, “VA System Security Controls”, and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-05-24, M-19-17, and NIST Federal Information Processing Standard (FIPS) 201-2. OMB Memoranda M-05-24 and M-19-17 can be found at: https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2005/m05-24.pdf, and https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf respectively. Contractor delivered applications and systems shall be on the FIPS 201-2 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Person Index (MPI) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable design pattern as outlined in VA Enterprise Design Patterns.

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion-based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

10. Role Based Access Control.

11. Auditing and reporting capabilities.

12. Compliance with VIEWS 00155984, PIV Logical Access Policy Clarification https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896.

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) shall support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and dual stack (IPv6 / IPv4) operations.

TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 “Secure External Connections”, and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the Cybersecurity & Infrastructure Security Agency (CISA) (https://www.cisa.gov/publication/tic-30-core-guidance-documents). Any deviations must be approved by the VA TIC 3.0 Working Group at vaoisesatic30team@va.gov.

STANDARD COMPUTER CONFIGURATION

The Contractor IT end user solution that is developed for use on standard VA computers shall be compatible with and be supported on the standard VA operating system, currently Windows 10 (64bit), Edge (Chromium based), and 365 Apps for enterprise. Applications delivered to VA and intended to be deployed to Windows 10 workstations shall be delivered as a signed .msi package with switches for silent and unattended installation and updates shall be delivered in signed .msp file formats for easy deployment using Microsoft Endpoint Configuration Manager (CM) VA’s current desktop application deployment tool. Signing of the software code shall be through a vendor provided certificate that is trusted by VA using a code signing authority such as Verizon/Cybertrust or Symantec/VeriSign. The Contractor shall also ensure and certify that their solution functions as expected when used from a standard VA computer, with non-admin, standard user rights that have been configured using the United States Government Configuration Baseline (USGCB) and Defense Information Systems Agency (DISA) Secure Technical Implementation Guide (STIG) specific to the particular client operating system being used.

VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT LINE MANAGEMENT (PLM)

The Contractor shall support VA efforts IAW the updated Veteran Focused Integration Process (VIP) and Product Line Management (PLM). The major focus of the new VIP is on Governance and Reporting and is less prescriptive, with a focus on outcomes and continuous delivery of value. Product Line Management (PLM) is a framework that focuses on delivering functional products that provide the highest priority work to customers while delivering simplified, reliable, and practical solutions to the business, medical staff, and our Veterans. The VIP Guide is a companion guide to the PLM Playbook and can be found at: https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 and the PLM Playbook can be found at https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946. The PLM Playbook pivots from project-centric to product-centric delivery and contains descriptive practices that focuses on outcomes. The PLM Playbook contains a set of “plays” that implement Development, Security, and Operations (DevSecOps) principles and processes such as automated development, continuous integration/continuous delivery, and release on demand. The PLM Playbook details how product lines implement Lean-Agile principles, methods, practices, and techniques through levels of maturity. VIP and PLM are the authoritative processes that IT projects must follow to ensure development and delivery of IT products.

PROCESS ASSET LIBRARY (PAL)

The Contractor shall perform their duties consistent with the processes defined in the OIT Process Asset Library (PAL). The PAL scope includes the full spectrum of OIT functions and activities, such as VIP project management, operations, service delivery, communications, acquisition, and resource management. PAL serves as an authoritative and informative repository of searchable processes, activities or tasks, roles, artifacts, tools and applicable standards and guides to assist the OIT workforce, Government and Contractor personnel. The Contractor shall follow the PAL processes to ensure compliance with policies and regulations and to meet VA quality standards. The PAL includes the contractor onboarding process consistent with Section 6.2.2 and can be found at https://www.va.gov/PROCESS/artifacts/maps/process_CONB_ext.pdf. The main PAL can be accessed at www.va.gov/process.

AUTHORITATIVE DATA SOURCES

The VA Enterprise Architecture Repository (VEAR) is one component within the overall EA that establishes the common framework for data taxonomy for describing the data architecture used to develop, operate, and maintain enterprise applications. The Contractor shall comply with the department’s Authoritative Data Source (ADS) requirement that VA systems, services, and processes throughout the enterprise shall access VA data solely through official VA ADSs where applicable, see below. The Information Classes which compose each ADS are located in the VEAR, in the Data & Information domain. The Contractor shall ensure that all delivered applications and system solutions support:

1. Interfacing with VA’s Master Person Index (MPI) (formerly the Master Veteran Index (MVI)) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

2. Interfacing with Capital Asset Inventory (CAI) to conduct real property record management actions, if the solution relies on real property records data. CAI is the authoritative source for VA real property record management data.

3. Interfacing with electronic Contract Management System (eCMS) for access to contract, contract line item, purchase requisition, offering vendor and vendor, and solicitation information above the micro-purchase threshold, if the solution relies on procurement data. ECMS is the authoritative source for VA procurement actions data.

4. Interfacing with HRSmart Human Resources Information System to conduct personnel action processing, on-boarding, benefits management, and compensation management, if the solution relies on personnel data. HRSmart is the authoritative source for VA personnel information data.

5. Interfacing with Vet360 to access personal contact information, if the solution relies on VA Veteran personal contact information data. Vet360 is the authoritative source for VA Veteran Personal Contact Data.

6. Interfacing with VA/Department of Defense (DoD) Identity Repository (VADIR) for determining eligibility for VA benefits under Title 38, if the solution relies on qualifying active-duty military service data. VADIR is the authoritative source for Qualifying active-duty military service in VA.

SOCIAL SECURITY NUMBER (SSN) REDUCTION

The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN with the ICN in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA Master Person Index (MPI) for identity traits to include the use of the ICN as the Primary Identifier. The Contractor solution may only use a Social Security Number to identify an individual in an information system if and only if the use of such number is required to obtain information VA requires from an information system that is not under the jurisdiction of VA.

SOFTWARE AND LICENSING REQUIREMENTS

The Contractor shall be responsible for the provision of all software licenses and any associated licensing maintenance required for any development, delivery, integration, operation, and/or maintenance associated with its proposed application(s), software products, software solution, and/or system including, but not limited to, any and all application(s), software and/or software products that comprise, are a part of, or integrate with the Contractor’s proposed application(s), software products, software solution, and/or system for the life of any resulting contract.

SECURITY AND PRIVACY REQUIREMENTS

It has been determined that protected health information may be disclosed or accessed and a signed Business Associate Agreement (BAA) shall be required. The Contractor shall adhere to the requirements set forth within the BAA, referenced in Section D of the contract, and shall comply with VA Directive 6066.

POSITION/TASK RISK DESIGNATION LEVEL(S)

In accordance with VA Handbook 0710, Personnel Security and Suitability…