DRAFT_SOW_Medical_Calculators.docx

Statement of Work Department of Veterans Affairs Veterans Health Administration Office of Health Informatics Clinical Informatics & Data Management Office Knowledge Based Systems

Medical Calculators

1.0 Introduction:

The Veterans Health Administration (VHA) Clinical Informatics and Data Management (CIDMO), Health Informatics, Office of Knowledge Based Systems (KBS) provides subject matter expertise, policy guidance, and strategic recommendations regarding clinical decision support (CDS) standards implementation for VA’s Information Technology (IT) systems.

The mission of CIDMO is to improve lives of Veterans and staff through better data and tools for better decisions and workflows. CIDMO seeks to help VHA realize its goal to become an agile learning organization through user-centered standardization of health information, clinical processes, and technologies by building standardized best informatics practices for improved field informatics capacity along with robust clinical process modules with Health Information Technology (HIT) configurations.

The mission of KBS is to improve the ability of clinicians to provide care for patients while increasing quality, safety, and efficiency. As part of this mission, KBS seeks to implement CDS within electronic health records (EHRs) broadly, and within VA health information systems specifically (current VA EHR is the Computerized Patient Record System (CPRS)).

KBS requires a subscription to an online medical calculator service that uses standards (i.e., SMART on FHIR, FHIR R4) to gather VA patient-specific data and deliver medical calculations. The medical calculator service will provide clinicians with patient-specific information, calculations, risk scores and other knowledge to enhance health and health care. The calculator will be used directly by clinicians in its native interface. Data and results obtained from the vendor’s SMART application may also be reutilized algorithmically e.g., for computerized alerts and reminders, clinical guidelines, data reports and dashboards, documentation templates, and diagnostic support.

2.0 Scope of Work:

These requirements are intended to acquire a commercial product provided to the VA on a subscription basis as SaaS (Software as a Service) to perform medical calculations. The service will integrate into VA’s hybrid EHR environment using a standards-based SMART approach. The medical calculator SMART application must provide the following capabilities:

· The scope of provided calculations shall be extensive and will include calculations from high level categories such as but not limited to Acid-base; critical care; Na and H20; Body measurements; Nutrition; Pulmonary; Renal; Electrolytes and Endocrinology.

· The scope of provided risk assessments and other instruments shall be extensive in its support of specialties including Medicine, Surgery, Mental Health, OB-GYN, inpatient and outpatient care, and pathophysiologic state metrics states ranging from Apache score to the WHO-5 well-being index

· Provide risk scores and calculations that are computed dynamically based on patient-specific data inputs, e.g., patient problem list, labs, medications

· Suggest patient-specific calculations (e.g., risk scores) and instruments dynamically based on patient-specific data inputs e.g., patient problem list, encounter codes, labs or medications

· Ingest data for calculations using SMART on FHIR methods (e.g. FHIR)

· Provide results of calculations via a native web-based user interface with copy/paste functionality and via standards-based services (e.g., FHIR)

· Provide mapping of results to discrete data elements such as patient vitals, patient observations, lab result values, demographic data and medications. Mappings should be to national standards specified in United States Core Date for Interoperability version X or higher

3.0 Period of Performance: The period of performance consists of a 12-month base period and four possible one-year option periods.

5.0 Software as a Service Requirements

The Software-as-a-Service (SaaS) products that have connections or interfaces to VA systems or network must comply with comply with Federal Risk and Authorization Management Program (FedRAMP) requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement. Alternatively, the vendor may collaborate with VA Enterprise Cloud Solutions Office (ECSO) to install an instance of a cloud-based solution within the VA Enterprise Cloud or install and maintain an instance of their software using a microservices architecture and containerization technologies such as Docker, Kubernetes, or equivalent to package, deploy, and manage individual microservices and their dependencies.

For all software-as-a-service (SAAS) or alternative required information system solutions under this PWS the Contractor shall comply with the following:

a) The information system solution shall comply with the Federal Information Security Management Act (FISMA).

b) The Contractor shall comply with Federal Risk and Authorization Management Program (FedRAMP) requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

c) Following guidance from the Federal Chief Information Officer (CIO), VA will utilize existing Joint Authorization Board (JAB) Authority to Operate (ATO) or agency ATO issued by another agency as a starting point for FedRAMP requirements. If neither of those exist, VA will sponsor FedRAMP ATO. VA will be using the FedRAMP baselines as a starting point, since they are specifically tailored for cloud services.

d) The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application.

e) The Contractor shall complete a FedRAMP System Security Plan (SSP) and supporting documentation within 45 days after contract award. (If Data Security Categorization is High Impact, this will be due 85 days after contract award.)

f) The Contractor shall complete a Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) within 90 days after contract award. (If Data Security Categorization is High Impact, this will be due after 130 days after contract award.)

g) The Contractor shall complete a 3PAO Security Assessment Report (SAR) within 140 days after contract award. (If Data Security Categorization is High Impact, this will be due 180 days after contract award.)

h) The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases to the extent required to carry out the FedRAMP assessment and authorization process and FedRAMP continuous monitoring.

i) If new or unanticipated threats or hazards are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with the security Addendum B (VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE - VA Handbook 6500.6)

j) The Contractor shall not release any VA data without the consent of VA in writing. All requests for release must be submitted in writing to the COR/CO.

k) In order for live VA data to be used in this system, a FedRAMP Authorization and Agency ATO will be required.

Deliverables:

A. Direct and algorithmic access to the Software as a service to be used by VA federal and/or Contractor staff (need to include direct users) B. FedRAMP System Security Plan (SSP) and supporting documentation Vendors SMART Application standards-conformance documentation identifying how the application conforms to the “HL7 SMART App Launch 2.0.0 - Standard for Trial Use Implementation Guide” as well as any constraints or choices specific to the VA implementation.

C. 3PAO Security Assessment Plan (SAP) D. 3PAO Security Assessment Report (SAR)