Final Statement of Work .pdf

1. Statement of Work

Tennessee Valley VA Medical Center requires a suicide prevention support tool (SPM) used for real-time surveillance, alerting, documentation and reporting that is already approved for use within the VA Network. SPM

1. Data visualization, standardized workflows.

2. Analytical utilities that monitor processes, performances, and outcomes in real-time.

3. monitors patient activities and engagement in care (appointment scheduling, no shows and cancellations, no show follow up outreach, hospital admissions / discharges, etc.)

4. Computer “web based” solution to eliminate paper forms

5. Integrated with VISTA and CPRS

6. Displays and updates consult information in real time

2. Applicable Conditions

a. Product must have HL-7 communication interfaces with the VA VISTA system and

Computer Patient Record System (CPRS) that are already approved by VA OI&T (development or “new” interfaces are not acceptable).

b. The product must be listed as authorized for use on VA computer and network systems as identified in the Technical Reference Model (TRM) Technology/Standard List – startup, new development and or products currently under review WILL NOT be considered.

c. Per the May 5th, 2015 memorandum from the VA Chief Information Security Officer

(CISO) FPS 140-2 Validate Full Disk Encryption (FOE) for Data at Rest in Database Management Systems (DBMS) and in accordance with Federal requirements and VA policy, database management must use Federal Information Processing Standards (FIPS) 140-2 compliant encryption to protect the confidentiality and integrity of VA information at rest at the application level. If FIPS 140-2 encryption at the application level is not technically possible, FIPS 140-2 compliant full disk encryption (FOE) must be implemented on the hard drive where the DBMS resides. Appropriate access enforcement and physical security control must also be implemented. All instances of deployment using this technology should be reviewed to ensure compliance with VA Handbook 6500 and

d. The product MUST allow tracking (at a minimum):

• Current inpatient admission

• Clinic appointment in specific clinic https://vaww.portal2.va.gov/sites/infosecurity/ca/Policy%20Home%20Documents/DAS%20OIS%20Memos/OIS%20DAS%20Memo%20-%20FIPS%20140%202%20Validated%20Encrytion%20for%20Data%20at%20Rest%20in%20Database%20Management%20Systems,%20Signed%20by%20S.%20Lowe%2005-05-2015.pdf https://vaww.portal2.va.gov/sites/infosecurity/ca/Policy%20Home%20Documents/DAS%20OIS%20Memos/OIS%20DAS%20Memo%20-%20FIPS%20140%202%20Validated%20Encrytion%20for%20Data%20at%20Rest%20in%20Database%20Management%20Systems,%20Signed%20by%20S.%20Lowe%2005-05-2015.pdf http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=56 http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=56

• Presence in particular hospital locations (i.e. in a particular wards or lodger/DOM locations)

• Patients being tracked by individual or team providers via CPRS provider or team lists

• Patient Record Flag Placement (i.e. High Risk for Suicide)

• Health care utilization patterns (i.e. recent discharge with specific diagnoses during hospital stay, number of appointments in specific clinics within specific windows of time, cancellations by specific patient types in specific clinics)

• Clinic patient panel membership [PACTs, BHIP teams]

• Problem list or encounter specific diagnoses

• Medication lists (i.e. classification of or national drug code of specific medications prescribed)

• Quantity of dispensed drugs (provided Veteran utilized the VA as their pharmacy)

• Specific provider orders (i.e. specific consultation orders [i.e. non-VA care / MISSION Act] or procedure orders)

• Specific note titles / templates in the medical record (i.e. consult responses, REACH-VET outreach note, etc.)

e. Capability or Performance

DSS Iconic Data Suicide Prevention Manager (SPM) is a technology that assists suicide prevention stakeholders in providing care to patients at high risk for suicide. The technology features data visualization, standardized workflows, and analytical utilities that work together to monitor processes, performance, and outcomes (i.e. performance on suicide prevention related SAIL measures – HRF, PDE, etc.) in real time. SPM also monitors patient activities and engagement in care (appointment scheduling, no shows and cancellations, no show follow up outreach, hospital admissions / discharges, etc.)

such that case managers, suicide prevention coordinators, and Recovery Engagement and Coordination for Health Veterans Enhanced Treatment (REACH VET) coordinators have real-time situational awareness about each high risk patient’s care, including when they may be at risk or when their care deviates from that required by suicide prevention clinical and administrative standard operating procedures.

DSS Iconic Data Patient Case Manager Suite (PCM) is a real-time census management, patient flow optimization, and care coordination platform used by physicians, nurses, discharge planners, social workers, bed managers, service line leadership, facility administrators and others in the inpatient and outpatient settings. The PCM platform is focused on key clinical and facility operational workflows. Its focus is enabling better facility patient throughput (improve Veteran access to care), patient safety (safer care transitions), and virtual interdisciplinary care coordination and collaboration. PCM provides facilities with functionality which helps improves their SAIL metric performance

– ACSC admissions, readmissions, length of stay, boarding of patients in the ED, acute mortality rates which are impacted by boarding of ED patients, veteran satisfaction (HCAHPS), etc.

f. Delivery or Performance-period Requirements

The contractor shall provide the specific deliverables described below within the performance period.

CONTRACTOR Support Services provides product support directly to the customer for most issues, whether user or server related. Support Services will:

Work directly with users to address their issues with the SPM Product. Respond to issues reported to them in accordance with this document within the response times defined in this document.

Help VHA Office of Information and Technology (OI&T) and/or Biomed staff configure setup of necessary licensed CONTRACTOR Products to meet VHA’s and/or end-users needs.

Advise VHA OI&T and/or Biomed staff as a Subject Matter Expert (SME) as it relates to licensed CONTRACTOR Products and their configuration in internal meetings, new installations of licensed CONTRACTOR Products, and end-user activities.

Help VHA OI&T and/or Biomed staff on issues involving licensed CONTRACTOR product infrastructure requirements, including hardware, bandwidth, and best practices.

Keep the Veterans Administration Medical Center (VAMC) Points of Contact (POC) aware of issues that may impact their usage of licensed CONTRACTOR products.

g. Risks - Low: product has been successfully deployed and tested at Eire and other VA facilities.

PART B: Plan of Action

1. Acquisition Considerations

a. Firm/Fixed Price

b. Information Technology

The applications, supplies, and services furnished under this SOW must comply with One- VA Enterprise Architecture (EA), available at http://www.ea.oit.va.gov/index.asp and more specifically the Technical Reference Model (One-VA TRM) in force at the time of issuance of each SOW. VA reserves the right to assess SOW deliverables for EA compliance prior to acceptance.

http://www.ea.oit.va.gov/index.asp

The contractor shall ensure adequate LAN/Internet, data, information, and system security in accordance with VA standard operating procedures and standard contract language, conditions laws, and regulations. The contractor’s firewall and web server shall meet or exceed the government minimum requirements for security. All government data shall be protected behind an approved firewall. Any security violations or attempted violations shall be reported to the VA project manager and the VBA Headquarters Information Security Officer as soon as possible. The contractor shall follow all applicable VA policies and procedures governing information security, especially those that pertain to certification accreditation.

All contractor employees who require access to the Department of Veterans Affairs' computer systems shall be the subject of a background investigation and must receive a favorable adjudication from the VA Security and Investigations Center (07C). The level of background security investigation will be in accordance with VA Directive 0710 dated September 10, 2004 and is available at:

http://www.va.gov/pubs/asp/edsdirec.asp (VA Handbook 0710, Appendix A, Tables 1 - 3).

Appropriate Background Investigation (BI) forms will be provided upon contract (or task order) award, and are to be completed and returned to the VA Security and Investigations Center (07C) within 30 days for processing. Contractors will be notified by 07C when the BI has been completed and adjudicated. These requirements are applicable to all subcontractor personnel requiring the same access. If the security clearance investigation is not completed prior to the start date of the contract, the employee may work on the contract while the security clearance is being processed, but the contractor will be responsible for the actions of those individuals they provide to perform work for the VA. If damage arises from work performed by contractor personnel, under the auspices of the contract, the contractor will be responsible for resources necessary to remedy the incident.

The investigative history for contractor personnel working under this contract must be maintained in the databases of either the Office of Personnel Management (OPM) or the Defense Industrial Security Clearance Organization (DISCO). Should the contractor use a vendor other than OPM or Defense Security Service (DSS) to conduct investigations, the investigative company must be certified by OPM/DSS to conduct contractor investigations.

The position sensitivity impact for this effort has been designated as [LOW,] Risk and the level of background investigation is [BI].

2. Contractor Responsibilities

a. The contractor shall bear the expense of obtaining background investigations. If the investigation is conducted by the Office of Personnel Management (OPM) through the VA, the contractor shall reimburse the VA within 30 days.

b. Background investigations from investigating agencies other than OPM are permitted if the agencies possess an OPM and Defense Security Service certification. The Vendor Cage Code number must be provided to the Security and Investigations Center (07C), which will verify the information and advise the contracting officer whether access to the computer systems can be authorized.

c. The contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain a U.S. citizenship and are able to read, write, speak and understand the English language.

d. After contract award and prior to contract performance, the contractor shall provide the following information, using Attachment B, to the CO:

(1) List of names of contractor personnel.

(2) Social Security Number of contractor personnel.

(3) Home address of contractor personnel or the contractor's address.

e. The contractor, when notified of an unfavorable determination by the Government, shall withdraw the employee from consideration from working under the contract.

f. Failure to comply with the contractor personnel security requirements may result in termination of the contract for default.

g. Further, the contractor will be responsible for the actions of all individuals provided to work for the VA under this contract. If damages arise from work performed by contractor provided personnel, under the auspices of this contract, the contractor will be responsible for all resources necessary to remedy the incident.”

3. Government Responsibilities

a. The VA Security and Investigations Center (07C) will provide the necessary forms to the contractor or to the contractor's employees after receiving a list of names and addresses.

b. Upon receipt, the VA Security and Investigations Center (07C) will review the completed forms for accuracy and forward the forms to OPM to conduct the background investigation.

d. The VA facility will pay for investigations conducted by the OPM in advance. In these instances, the contractor will reimburse the VA facility within 30 days.

e. The VA Security and Investigations Center (07C) will notify the contracting officer and contractor after adjudicating the results of the background investigations received from OPM.

e. The contracting officer will ensure that the contractor provides evidence that investigations have been completed or are in the process of being requested.

4. Electronic and Information Technology Standards

a. INTERNET/INTRANET

The contractor shall comply with Department of Veterans Affairs (VA) Directive 6102 and VA Handbook 6102 (Internet/Intranet Services).

VA Directive 6102 sets forth policies and responsibilities for the planning, design, maintenance support, and any other functions related to the administration of a VA Internet/Intranet Service Site or related service (hereinafter referred to as Internet). This directive applies to all organizational elements in the Department. This policy applies to all individuals designing and/or maintaining VA Internet Service Sites; including but not limited to full time and part time employees, contractors, interns, and volunteers. This policy applies to all VA Internet/Intranet domains and servers that utilize VA resources.

This includes but is not limited to va.gov and other extensions such as, “.com, .edu, .mil, .net, .org,” and personal Internet service pages managed from individual workstations.

VA Handbook 6102 establishes Department-wide procedures for managing, maintaining, establishing, and presenting VA Internet/Intranet Service Sites or related services (hereafter referred to as “Internet”). The handbook implements the policies contained in VA Directive 6102, Internet/Intranet Services. This includes, but is not limited to, File Transfer Protocol (FTP), Hypertext Markup Language (HTML), Simple Mail Transfer Protocol (SMTP), Web pages, Active Server Pages (ASP), e-mail forums, and list servers.

In addition, any technologies that enable a Network Delivered Application (NDA) to access or modify resources of the local machine that are outside of the browser's "sand box" are strictly prohibited. Specifically, this prohibition includes signed-applets or any ActiveX controls delivered through a browser's session. ActiveX is expressly forbidden within the VA while .NET is allowed only when granted a waiver by the VA CIO *PRIOR* to use.

JavaScript is the preferred language standard for developing relatively simple interactions (i.e., forms validation, interactive menus, etc.) and Applets (J2SE APIs and Java Language) for complex network delivered applications.

b. SECTION 508

The contractor shall comply with Section 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998.

In December 2000, the Architectural and Transportation Barriers Compliance Board (Access Board), pursuant to Section 508(2)(A) of the Rehabilitation Act Amendments of 1998, established Information Technology accessibility standards for the Federal Government. Section 508(a)(1) requires that when Federal departments or agencies develop, procure, maintain, or use Electronic and Information Technology (EIT), they shall ensure that the EIT allows Federal employees with disabilities to have access to and use of information and data that is comparable to the access to and use of information and data by other Federal employees. The Section 508 requirement also applies to members of the public seeking information or services from a Federal department or agency.

5. Product or service descriptions

DSS Iconic Data Suicide Prevention Manager (SPM) is a technology that assists suicide prevention stakeholders in providing care to patients at high risk for suicide. The technology features data visualization, standardized workflows, and analytical utilities that work together to monitor processes, performance, and outcomes (i.e. performance on suicide prevention related SAIL measures – HRF, PDE, etc.) in real time. SPM also monitors patient activities and engagement in care (appointment scheduling, no shows and cancellations, no show follow up outreach, hospital admissions / discharges, etc.) such that case managers, suicide prevention coordinators, and Recovery Engagement and Coordination for Health Veterans Enhanced Treatment (REACH VET) coordinators have real-time situational awareness about each high risk patient’s care, including when they may be at risk or when their care deviates from that required by suicide prevention clinical and administrative standard operating procedures.

6. Logistics Considerations

a. Delivery location for all hardware will be to Tennessee Valley VA Medical Center, Nashville, Tennessee.