Electronic Health Record COTS PWS 22 June 2010.docx

ELECTRONIC HEALTH RECORD COMMERICAL OFF-THE-SHELF

IMPLEMENTATION SUPPORT SERVICES FOR THE

UNITED STATES COAST GUARD

PERFORMANCE WORK STATEMENT

1.0 GENERAL.

1.1 SCOPE.

The purpose of this solicitation is to obtain services, materials and equipment to support the implementation of an ambulatory Electronic Heath Record (EHR). The solution will consist of a commercial off-the-shelf (COTS) product operating within the United States Coast Guard (U.S. Coast Guard) Medical Information System (MIS) environment.

1.2 BACKGROUND.

For over two centuries the U.S. Coast Guard has safeguarded the Nation’s maritime interests in the heartland, in the ports, at sea, and around the globe, protecting the maritime economy and the environment, defending the maritime borders, and saving those in peril. The U.S. Coast Guard is one of the five armed forces of the United States and the only military organization within the Department of Homeland Security.

The mission of the Coast Guard Health Services Program is to provide quality, cost effective healthcare to its 42,000 active duty men and women in order to maintain their medical and dental readiness for worldwide deployment. In addition, the Coast Guard provides care to its active duty family members, retirees and reservists as space is available in its clinics. In support of its mission, the Coast Guard operates 43 ambulatory clinics across 6 time zones. Additionally, the Coast Guard operates remote Sickbays on land and afloat staffed by Independent Duty Corpsman. All land based clinics and sickbays are connected to the Coast Guard Digital Network (CGDN) by which they access the Medical Information Systems (MIS) using Citrix Client architecture. Sickbays afloat have intermittent or no connectivity to the CGDN and therefore rely on stand-alone or store-and-forward systems.

The staff resources manning the Coast Guard clinics and cutters are as follows:

· Physicians (100)

· Physician assistants or Nurse Practioner (50)

· Dentists (70)

· Dental Hygienists (50)

· Dental Assistants (100)

· Pharmacists (20)

· Physical Therapists (12)

· Optometrists (15)

· Psychiatrists/Psychologist (8)

· Nurses (20)

· Health Service Technicians (650)

· Independent Duty Health Service Technicians (80)

· Front Desk Staff (50)

At any time, there are approximately 500 concurrent users requiring access to the centralized medical support systems. It is expected that an additional 50 providers external to the U.S. Coast Guard will also require access to the system during any given month. The Coast Guard clinics complete approximately 200,000 medical and 100,000 Dental encounters annually. It is not expected that either the number of annual encounters or the medical staff supporting the clinics and cutters will significantly change over the next five (5) years.

The Coast Guard Office of Health is committed to developing & maintaining a medical information system which promotes the highest quality of healthcare delivery in an efficient manner that maximizes our beneficiaries’ health and Coast Guard Readiness. The medical information system must promote a continuous quality improvement process and provide transparency to both the beneficiaries and the organization. Current EHR systems do not meet current Federal requirements for an interoperable electronic medical record[footnoteRef:1]. They are not consistent with the February 2009 DHS directive to “…develop strategies to reduce costs, streamline processes, eliminate duplication and improve transparency and customer service.” The current systems have outdated architecture and interfaces, and lack basic EHR features such as clinical decision support, billing, scheduling patient portals, and population health functionality. Finally, the current environment is inefficient, experiences poor user satisfaction, and has no wireless user interfaces. [1: The National Defense Authorization Act (NDAA) of 2008, a Presidential Executive Order from 22 August 2006, and President Obama’s 9 April 2009, announcement of the Joint Virtual Lifetime Electronic Record, requires the DoD and the Department of Veteran Affairs (VA) to adopt interoperable EMR systems so that service members have one electronic health record from initial entry into service through retirement.]

In order to deliver to the above, the Coast Guard will leverage the latest commercial off-the-shelf technology and partner with other government and private healthcare organizations to achieve its MIS goals as identified in table 1.

1.3 OBJECTIVE.

The objective of this solicitation is to support the U.S. Coast Guard MIS environment through implementation and maintenance of an EHR COTS product solution.

Table 1. EHR COTS Capabilities in Support of Medical Information System Strategic Goals

Ensure a Quality Healthcare Experience

Integrated Health Record - combining Medical, Dental, Laboratory, Pharmacy, & Radiology and Patient Portal Patient Centered – enhanced patient involvement in care through patient portal which will allow access to their medical record 24/7 Medical Home Concepts – supported and monitored throughout the system Virtual Lifetime Electronic Record (VLER) – with the Department of Defense and Department of Veterans Affairs Meaningful Use Exchange – demonstrating meaningful use of data and exchange using industrial and National Health Information Network (NHIN) exchange standards Transparency in healthcare delivery to beneficiaries Security Standards – utilize the latest health IT security and patient privacy standards

Maximize Population Health

Documentation – ease of document & consistent quality notes Disease Surveillance – through automated tracking and reporting within the EHR Healthcare Effectiveness Data and Information Set (HEDIS) – measurements and reporting organic to the EHR Clinical Decision Support – software that incorporates current treatment guidelines

Maximize Efficiencies in Healthcare Delivery

Cost Savings – leverage existing market-proven COTS products with significantly lower sustainment costs through the use of commodity Quality and Process Improvement – use integrated systems to continuously monitor and improve quality and efficiency Point of Care Efficiencies – Single Sign-On, Context management, and Wireless Provider Tablets Reimbursement – improved collections with built in billing function Partner & Promote Innovation and Technology – sharing with the MHS, VA, and the Private sector

Ensure Readiness

Readiness – improved through enhanced documentation, tracking and reporting systems Transparency – of the health status of the organization

The Key Performance Parameters[footnoteRef:2] for this project are: [2: A Key Performance Parameter (KPP) is a system capability or characteristic considered essential for successful mission accomplishment. ]

· The system shall integrate medical, dental, laboratory, pharmacy, radiology and patient portal modules for a consistent quality healthcare experience.

· The system shall allow NHIN compliant data exchange, the productive use of health information exchange (HIE) standards, C32 and CCR to maximize the use and availability of population health data. This supports the requirements for a virtual lifetime electronic record (VLER) and longitudinal patient records.

· The system shall use clinical decision support tools, clinical content templates and automated system alerts to provide patients with a consistent quality healthcare experience for both the providers and patients.

· The system shall use computerized provider order entry (CPOE), charting/drawing tools, problem lists, and work lists to achieve efficiencies in healthcare delivery.

· The system shall allow access to patient information for a variety of healthcare providers across numerous locations to achieve mission readiness and transparency.

· The system shall contain clearly defined user roles and single sign on functionality to achieve appropriate security standards.

1.3 CONTRACTOR PERSONNEL.

1.3.1 Project Manager. The Contractor shall provide a Project Manager who shall be responsible for all Contractor work performed under this task order. The Project Manager is further designated as Key by the Government (see PWS 1.4).

1.3.1.1 The Project Manager shall be a single point of contact for the Contracting Officer and the Contracting Officer’s Technical Representative. It is anticipated that the Project Manager shall be one of the senior level employees provided by the Contractor for this work effort. The name of Project Manager, and the name(s) of any alternate(s) who shall act for the Contractor in the absence of the Project Manager, shall be provided to the Government as part of the Contractor's proposal. During any absence of the Project Manager, only one alternate shall have full authority to act for the Contractor on all matters relating to work performed under this task order. The Project Manager and all designated alternates shall be able to read, write, speak and understand English. Additionally, the Contractor shall not replace the Project Manager without prior acknowledgement from the Contracting Officer.

1.3.1.2 The Project Manager shall be available to the COTR via telephone between the hours of 0700 and 1700 EST, Monday through Friday, and shall respond to a request for discussion or resolution of technical problems within two (2) hours of notification.

1.3.1.3 Implementation Manager. The Contractor shall provide an Implementation Manager who shall be responsible for all implementation activities for the U.S. Coast Guard. The Implementation Manager is further designated as Key by the Government (see PWS 1.4).

1.3.2 Specific Personnel Requirements. All key personnel shall possess the following experience:

1.3.2.1 Previous technical support experience with the EHR COTS product solution being proposed.

1.3.3.2 Previous experience with development, business process design, training and implementation services associated with the EHR COTS product solution being proposed.

1.3.3 Employee Identification. Contractor employees visiting Government facilities shall wear an identification badge that, at minimum, displays the Contractor name, the employee’s photo, name, clearance-level and badge expiration date. Visiting Contractor employees shall comply with all Government escort rules and requirements. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent and display all identification and visitor badges in plain view above the waist at all times.

1.3.3.1 For all Contractors working for the USCG, the Contractor shall utilize the Department of Defense (DoD) Contractor Verification System (CVS) to apply for a Common Access Card (CAC) for their employees that require access to a USCG or other Federally-controlled computer information system.

1.3.4 Employee Conduct. Contractor’s employees shall comply with all applicable Government regulations, policies and procedures (e.g., fire, safety, sanitation, environmental protection, security, “off limits” areas, wearing of parts of military uniforms, and possession of weapons) when visiting or working at Government facilities. The Contractor shall ensure contractor employees present a professional appearance at all times and that their conduct shall not reflect discredit on the United States, the Department of Homeland Security or the U.S. Coast Guard.

1.3.5 Removing Employees for Misconduct or Security Reasons. The Government may, at its sole discretion, direct the Contractor to remove any Contractor employee from U.S. Coast Guard facilities for misconduct or security reasons. Removal does not relieve the Contractor of the responsibility to continue providing the services required under any task order awarded. The Contracting Officer will provide the Contractor with a written explanation to support any request to remove an employee.

1.3.6 Conflict of Interest. The Contractor shall not employ any person who is an employee of the United States Government if that employment would, or would appear to cause a conflict of interest.

1.4 KEY PERSONNEL.

Before replacing any individual designated as Key by the Government, the Contractor shall notify the Contracting Officer no less than 15 business days in advance, submit written justification for replacement, and provide the name and qualifications of any proposed substitute(s). All proposed substitutes shall possess qualifications equal to or superior to those of the Key person being replaced. The Contractor shall not replace Key Contractor personnel without acknowledgment from the Contracting Officer. The Government may designate additional Contractor personnel as Key at the time of award.

1.5 SECURITY.

Contractor access to unclassified, but Security Sensitive Information may be required under this contract. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination in accordance with HSAR 3052.204-70 and HSAR 3052.204-71 (see Appendix A). All hardware, software, and services provided must be compliant in accordance with 140-01 Information Technology Systems Security and the DHS Sensitive Systems Handbooks 4300A for SBU Systems and 4300B for classified systems.

1.5.1 Security Requirements:

Each individual employed under the contract shall be a citizen of the United States of America, or an alien who has been lawfully admitted for permanent residence as evidenced by a Permanent Resident Card (USCIS I-551). Any exceptions must be approved by the Department’s Chief Security Officer or designee.

Contractors shall identify in their proposals, the names and citizenship of all non-U.S. citizens proposed to work under contract. Any additions or deletions of non-U.S. citizens after contract award shall also be reported to the Contracting Officer.

All personnel requiring access to classified spaces on Coast Guard units as applicable to the task shall require a current security clearance with a minimum level of secret. Contractor’s request for authorization will be submitted in accordance with DOD 5220.22M (Industrial Security Manual for Safeguarding Classified Information) no later than (1) week before each unit visit. Request will be forwarded via HSWLSUPACT, Norfolk, VA, and ATTN: Security Officer, for certification of need to know by the specified COTR.

A DD-Form-254, Department of Defense Contract Security Classification Specification shall be used. The Contractor shall submit a list to the COTR showing the name and address of each employee under this task order prior to the start of the period of performance and within three (3) business days anytime information on that list changes.

Contractor employees working on-site at Government facilities shall wear a valid Contractor’s identification card. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent and display the Government issued badge in plain view above the waist at all times.

All Contractor personnel requiring routine access to a Coast Guard Computer Information System or requiring Public Key Infrastructure (PKI) authentication to perform their required duties under this task shall require a Common Access Card (CAC).

1.5.2 Access to Unclassified Facilities, Information Technology Resources, and Sensitive Information:

The assurance of the security of unclassified facilities, Information Technology (IT) resources, and sensitive information during the acquisition process and contract performance are essential to the DHS mission. DHS Management Directive (MD) 11042.1 Safeguarding Sensitive but Unclassified (For Official Use Only) Information, describes how contractors must handle sensitive but unclassified information. DHS MD 4300.1 Information Technology Systems Security and the DHS Sensitive Systems Handbook prescribe policies and procedures on security for IT resources. Contractors shall comply with these policies and procedures, any replacement publications, or any other current or future DHS policies and procedures covering contractors specifically for all Task Orders that require access to DHS facilities, IT resources or sensitive information. Contractors shall not use or redistribute any DHS information processed, stored, or transmitted by the contractor except as specified in the task order.

1.5.3 Security Review:

The Government may elect to conduct periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The Contractor shall afford DHS, including the organization of the DHS Office of the Chief Information Officer, the Office of the Inspector General, authorized Contracting Officer’s Technical Representative (COTR), and other government oversight organizations, access to the Contractor’s facilities, installations, operations, documentation, databases and personnel used in the performance of this contract. The Contractor will contact the DHS Chief Information Security Officer to coordinate and participate in the review and inspection activity of government oversight organizations external to the DHS. Access shall be provided to the extent necessary for the government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability and confidentiality of DHS data or the function of computer systems operated on behalf of DHS, and to preserve evidence of computer crime.

1.5.4 Interconnection Security Agreements:

Interconnections between DHS and non-DHS IT systems shall be established only through controlled interfaces and via approved service providers. The controlled interfaces shall be accredited at the highest security level of information on the network. Connections with other Federal agencies shall be documented based on interagency agreements; memoranda of understanding, service level agreements or interconnect service agreements.

FIPS 140-2 and FIPS 197 Advanced Encryption Standard (AES) 256 encryption compliance:

All hardware and software interfaces shall meet FIPS 140-2 and FIPS 197 Advanced Encryption Standard (AES) 256 encryption compliance.

1.6 PERIOD OF PERFORMANCE.

The period of performance for this task order is one year from the date of award with four (4) one year options.

1.7 PLACE OF PERFORMANCE.

The primary place of performance will be the Contractor’s facilities with frequent visits to the U.S. Coast Guard Headquarters Building at 2100 2nd Street, SW, Washington, DC 20593.

1.8 HOURS OF OPERATION.

Contractor employees requiring access to U.S. Coast Guard resources shall generally perform all work between the hours of 0800 and 1600, Monday through Friday (except Federal holidays). However, there may be occasions when Contractor employees shall be required to work other than normal business hours, including weekends and holidays, to fulfill requirements under this task order.

It is at the Contractor’s discretion regarding the hours that their employee’s perform the work under this contract. However, the Contractor shall ensure that the work performed is scheduled in such a manner to minimize or eliminate any scheduled down-time in the system. This may require work to be done on other than normal business hours, including weekends and holidays, to fulfill requirements under this contract.

1.9 TRAVEL.

The Contractor will be required to travel to U.S. Coast Guard Headquarters in Washington, DC for requirements and program planning meetings. Additionally, the Contractor may be required to travel to the U.S. Coast Guard Headquarters, Washington, DC, OSC, Martinsburg, WV, and other U.S. Coast Guard locations across the country for activities such as meetings, implementation assistance, and training activities.

1.9.1 Travel Locations or Limitations.

Travel costs for the base period of performance are estimated at $150,000. Travel costs for each option period are estimates at $25,000.

1.10 KICK-OFF MEETING.

The Contractor shall attend a Kick-Off Meeting with the Contracting Officer and the COTR NLT five (5) business days after the date of award. The purpose of the Kick-Off Meeting, which will be chaired by the Contracting Officer, is to discuss technical and contracting objectives of this task order and review the Contractor's project plan. The Kick-Off Meeting will be held at the Government’s facility.

1.11 PROJECT PLAN.

The Contractor shall provide a draft Project Plan as part of the Contractor’s proposal. The Contractor shall provide a final Project Plan to the COTR not later than thirty (30) business days after the Kick-Off Meeting.

1.12 STATUS REPORTS.

The Project Manager shall provide a monthly progress report to the Contracting Officer and COTR via electronic mail. This report shall include a summary of all Contractor work performed, including a breakdown of labor hours by labor category, all direct costs by line item for all Time and Material activities, an assessment of technical progress, schedule status, any travel conducted and any Contractor concerns or recommendations for the previous monthly period.

1.13 STATUS MEETINGS.

The Project Manager shall be responsible for keeping the Contracting Officer and COTR informed about Contractor progress throughout the performance period of this task order, and ensure Contractor activities are aligned with Coast Guard objectives.

1.14 GENERAL REPORT REQUIREMENTS.

The Contractor shall provide all written reports in electronic format with read/write capability using applications that are compatible with Coast Guard Standard Workstation (Windows Server XP and Microsoft Office Applications).

1.15 PERFORMANCE REQUIREMENTS SUMMARY.

This task order includes a Performance Requirements Summary (PRS). In general, the PRS sets forth the expected outcomes (objectives) of the task order, the service(s) required of the Contractor to achieve the objectives, a performance standard per outcome, and a plan for a reduction in payment in the event the Contractor does not meet the performance standard. The PRS is not an exclusive remedy and inclusion of the PRS does not preclude the Government from using any other remedy available by law or contract terms, including reductions in payment in accordance with any clause for inspection of services.

1.16 DATA RIGHTS.

1.16.1 INTELLECTUAL PROPERTY.

All Contractor developed processes and procedures and other forms of intellectual property first developed under this contract shall be considered Government property.

1.16.2 HEALTH INFORMATION DATA.

All EHR data shall be the property of U.S. Coast Guard. Upon completion or termination of the contract the data will be provided by the vendor to the Program Office in a current industry standard format, as deemed acceptable by the COTR.

1.17 PROTECTION OF INFORMATION.

Contractor access to information protected under the Privacy Act and other federal statues is required under this contract. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination in accordance with the law and Government policy and regulation.

1.17.1 The Contractor is also responsible for safeguarding sensitive information against destruction, damage, and attack in accordance with U.S. Coast Guard Commandant Instruction M5500.13, Automated Information System (AIS) Security Manual, Department of Homeland Security requirements, Federal E-Gov standards and all current and future Federal information system security requirements.

1.17.2 This contract is part of the Coast Guard Health System Quality Assurance program. Therefore, all information or matters observed, experienced, or learned and all documents or reports generated as a result of or in connection with the performance of this contract are considered Quality Assurance documents and are protected under the provisions of title 14 U.S.C., Section 645.

1.17.3 The Contractor shall only conduct business with designated government personnel listed as points of contact (POCs). Names of authorized personnel shall be provided to the Contractor by the government, in writing, and updated as necessary throughout the contract period.

1.17.4 HIPAA Training: The Contractor shall comply with all provisions of the Privacy Act of 1974 (Public Law 93-579) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The Contractor shall provide the names of its entire contract staff that come into contact with U.S. Coast Guard Personal or Health Information to the COTR and ensure that each staff member completes the U.S. Coast Guard HIPAA web-based training before work commences and annually.

1.18 SECTION 508 COMPLIANCE.

1.18.1 Accessibility Requirements

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use electronic and information technology (EIT), they must ensure that it is accessible to people with disabilities. Federal employees and members of the public who have disabilities must have equal access to and use of information and data that is comparable to that enjoyed by non-disabled Federal employees and members of the public.

All EIT deliverables within this work statement shall comply with the applicable technical and functional performance criteria of Section 508 unless exempt. Specifically, the following applicable EIT accessibility standards have been identified:

1.18.2 Applicable EIT Accessibility Standards

36 CFR 1194.21 Software Applications and Operating Systems, applies to all EIT software applications and operating systems procured or developed under this work statement including but not limited to GOTS and COTS software. In addition, this standard is to be applied to Web-based applications when needed to fulfill the functional performance criteria. This standard also applies to some Web based applications as described within 36 CFR 1194.22.

36 CFR 1194.22 Web-based Intranet and Internet Information and Applications, applies to all Web-based deliverables, including documentation and reports procured or developed under this work statement. When any Web application uses a dynamic (non-static) interface, embeds custom user control(s), embeds video or multimedia, uses proprietary or technical approaches such as, but not limited to, Flash or Asynchronous Javascript and XML (AJAX) then 1194.21 Software standards also apply to fulfill functional performance criteria.

36 CFR 1194.26 Desktop and Portable Computers, applies to all desktop and portable computers, including but not limited to laptops and personal data assistants (PDA) that are procured or developed under this work statement.

36 CFR 1194.31 Functional Performance Criteria, applies to all EIT deliverables regardless of delivery method. All EIT deliverable shall use technical standards, regardless of technology, to fulfill the functional performance criteria.

36 CFR 1194.41 Information Documentation and Support applies to all documents, reports, as well as help and support services. To ensure that documents and reports fulfill the required 1194.31 Functional Performance Criteria, they shall comply with the technical standard associated with Web-based Intranet and Internet Information and Applications at a minimum. In addition, any help or support provided in this work statement that offer telephone support, such as, but not limited to, a help desk shall have the ability to transmit and receive messages using TTY.

When a specific product is being acquired, a selection process is required to evaluate compliance with Section 508, compare to other products that have been identified as meeting business needs, and to ultimately select the "most compliant" product.

All tasks for testing of functional and/or technical requirements must include specific testing for Section 508 compliance, and must use DHS Office of Accessible Systems and Technology approved testing methods and tools. For information about approved testing methods and tools send an email to accessibility@dhs.gov

36 CFR 1194.24 Video and Multimedia Products, applies to all video and multimedia products that are procured or developed under this work statement. Any video or multimedia presentation shall also comply with the software standards (1194.21) when the presentation is through the use of a Web or Software application interface having user controls available.

1.18.3 Applicable Exceptions

Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the COTR and determination will be made in accordance with DHS MD 4010.2. DHS has identified the following exceptions that may apply: 36 CFR 1194.3(b) Incidental to Contract, all EIT that is exclusively owned and used by the contractor to fulfill this work statement does not require compliance with Section 508. This exception does not apply to any EIT deliverable, service or item that will be used by any Federal employee(s) or member(s) of the public. This exception only applies to those contractors assigned to fulfill the obligations of this work statement and for the purposes of this requirement, are not considered members of the public.

1.18.4 Compliance Requirements

36 CFR 1194.2(b) (COTS/GOTS products), When procuring a product, each agency shall procure products which comply with the provisions in this part when such products are available in the commercial marketplace or when such products are developed in response to a Government solicitation. Agencies cannot claim a product as a whole is not commercially available because no product in the marketplace meets all the standards. If products are commercially available that meet some but not all of the standards, the agency must procure the product that best meets the standards. When applying this standard, all procurements of EIT shall have documentation of market research that identify a list of products or services that first meet the agency business needs, and from that list of products or services, an analysis that the selected product met more of the accessibility requirements than the non-selected products as required by FAR 39.2. Any selection of a product or service that meets less accessibility standards due to a significant difficulty or expense shall only be permitted under an undue burden claim and requires authorization from the DHS Office of Accessible Systems and Technology (OAST) in accordance with DHS MD 4010.2.

1.19 DHS ENTERPRISE ARCHITECTURE COMPLIANCE.

All solutions and services shall meet DHS and USCG Enterprise Architecture policies, standards, and procedures. Specifically, the contractor shall comply with the following Homeland Security Enterprise Architecture (HLS EA) and Coast Guard Enterprise Architecture (CGEA) requirements:

1.19.1 All developed solutions and requirements shall be compliant with the HLS EA and CGEA.

1.19.2 All IT hardware or software shall be compliant with the HLS EA Technical Reference Model (TRM) Standards and Products Profile.

1.19.3 Description information for all data assets, information exchanges and data standards, whether adopted or developed, shall be submitted to the DHS Enterprise Data Management Office (EDMO) for review and insertion into the DHS Data Reference Model and Enterprise Architecture Information Repository.

1.19.4 In compliance with Office of Management and Budget (OMB) mandates, all network hardware shall be IPv6 compatible without modification, upgrade, or replacement.

1.19.5 All Information Technology assets being developed, procured, or acquired shall be IPv6 capable.

2.0 GOVERNMENT TERMS & DEFINITIONS.

3.0 GOVERNMENT FURNISHED RESOURCES.

The Government will install the application on currently approved DHS/USCG hardware, pending confirmation of Awardee’s specifications. The Government will provide the hardware and information technology infrastructure required to support the EHR COTS implementation, including the server hardware to be installed at the OSC, and the end-user workstation hardware. The Government will provide the support services required for operational support, with the exception of the Tier 3 help desk support as identified in Section 5.3.4.

4.0 CONTRACTOR FURNISHED PROPERTY.

The Contractor shall furnish all facilities, materials, equipment and services necessary to fulfill the requirements of this task order, except for the Government Furnished Resources specified in the PWS 3.0 of this work statement.

5.0 REQUIREMENTS.

The objective of this contract is to provide an ambulatory EHR COTS solution for use throughout the U.S. Coast Guard (including ambulatory clinics on land and on U.S. Coast Guard cutters). The solution will be installed at the OSC, a government-owned, contractor-operated facility providing full life-cycle support for U.S. Coast Guard Automated Information Systems, and will be accessible to remote sites using the CITRIX environment, or in stand-alone mode for cutters. Support services will be required for implementing the EHR COTS solution within the U.S. Coast Guard environment, including product configuration specific to the U.S. Coast Guard and training. Additional support will be required through-out the life of the contract, including tier 3 help desk support, and other support specific to the EHR COTS solution as identified to support U.S. Coast Guard ambulatory EHR needs.

5.1 CONTRACT MANAGEMENT.

5.2 EHR COTS PRODUCT SOLUTION.

5.3 INSTALLATION/ IMPLEMENTATION.

5.3.1 The EHR COTS software shall be installed at the OSC, ultimately replacing the currently installed software suite (CHCS and PGUI) using a phased deployment. The system will be beta tested at two to three selected clinics throughout the enterprise with USCG Office of Health Services (CG-112) oversight. Once the system is determined to be reliable by CG-112, C4IT, and OSC it will be deployed throughout the enterprise. The current and new system will run in parallel until the EHR product has been tested and completely operational for 60 days, upon which time CHCS/PGUI will be deposed per DHS guidelines and data archived.

5.3.2 The Contractor shall implement the product solution within the USCG environment. The Contractor shall provide an Implementation Plan that identifies the methodology, tools and activities associated with the implementation of the proposed EHR COTS product solution within the U.S. Coast Guard environment. It is the U.S. Coast Guard’s intent to implement the system within the first year of award with beta sites implemented within the first six months of award.

5.4 EHR COTS SUPPORT SERVICES.

5.4.5 The Contractor shall provide support specific to the EHR COTS product solution (e.g., data conversion support; testing support; U.S. Coast Guard specific reports; U.S. Coast Guard specific data extracts; security certification and accreditation support[footnoteRef:4]). [4: Certification and accreditation will be performed by an entity outside of this contract; Contractor support may be required for information or configuration changes specific to the EHR project solution.]

6.0 REFERENCES.

REF: Bidder Library

7.0 DELIVERABLES.

The Contractor shall consider items in BOLD as having mandatory due dates. Items noted as “COTR Checkpoints” are deliverables or events that must be reviewed and approved by the COTR prior to proceeding to next deliverable or event in this PWS.

5.1.3

Monthly Progress Reports NLT 10th of each month.

5.2.2;

5.2.3;

5.2.4

5.4.3

5.4.3

8.0 PERFORMANCE REQUIREMENTS SUMMARY (PRS).

The PRS table below reflects the deliverables considered by the Coast Guard to be most important for the successful performance of this task order. This includes the expected standards of performance and positive or negative incentives.

ELECTRONIC HEALTH RECORD COMMERICAL OFF-THE-SHELF

IMPLEMENTATION SUPPORT SERVICES FOR THE

UNITED STATES COAST GUARD

Quality, on-time deliverables (PWS 5.1)

Stays on budget (PWS 5.1)

Quality management of issues and risks (PWS 5.1) No complaints unresolved within 3 business days (resolution may be development of a plan acceptable to the U.S. Coast Guard for closure that requires additional time)

Notifies COTR immediately of any budget issues; No cost overruns

No “surprises” (unaware, learned about it afterwards) of issues or risks Exercise of option years 1-4

Successful past performance recommendation

Interoperability of EHR modules (PWS 5.2)

Quality manuals and on-line documentation (PWS 5.2)

Delivery of EHR COTS solution providing all functionality identified in Contractor’s proposal

No integration issues between EHR modules

Documentation (paper and on-line) complete, up-to-date, and indexed for easy searches Exercise of option years 1-4

Successful past performance recommendation

Successful implementation at U.S. Coast Guard OSC so the application can be accessed from U.S. Coast Guard sites

(PWS 5.3.2, 5.3.3)

Timely response to U.S. Coast Guard needs (PWS 5.3.4, 5.3.5) Training materials and services specific to EHR COTS product solution implemented within the U.S. Coast Guard; Goals identified and met for each training session

Successful configuration of EHR COTS product solution to U.S. Coast Guard environment

Respond to USCG within 2 hours of contact; Resolution within 48 hours (resolution may be development of a plan acceptable to the U.S. Coast Guard for closure that requires additional time)

Developed plan for meeting U.S. Coast Guard needs for time and materials support; Timely execution of plan within identified budget;

Delivery of quality products Exercise of option years 1-4

Successful past performance recommendation

APPENDIX A. SECURITY CLAUSES

HSAR 3052.204-70 Security Requirements for Unclassified Information Technology Resources Clause

SECURITY REQUIREMENTS FOR UNCLASSIFIED INFORMATION TECHNOLOGY RESOURCES (JUN 2006)

(a) The Contractor shall be responsible for Information Technology (IT) security for all systems connected to a DHS network or operated by the Contractor for DHS, regardless of location. This clause applies to all or any part of the contract that includes information technology resources or services for which the Contractor must have physical or electronic access to sensitive information contained in DHS unclassified systems that directly support the agency's mission.

(b) The Contractor shall provide, implement, and maintain an IT Security Plan. This plan shall describe the processes and procedures that will be followed to ensure appropriate security of IT resources that are developed, processed, or used under this contract.

(1) Within 30 days after contract award, the contractor shall submit for approval its IT Security Plan, which shall be consistent with and further detail the approach contained in the offer or’s proposal. The plan, as approved by the Contracting Officer, shall be incorporated into the contract as a compliance document.

(2) The Contractor's IT Security Plan shall comply with Federal laws that include, but are not limited to, the Computer Security Act of 1987 (40 U.S.C. 1441 et seq.); the Government Information Security Reform Act of 2000; and the Federal Information Security Management Act of 2002; and with Federal policies and procedures that include, but are not limited to, OMB Circular A-130.

(3) The security plan shall specifically include instructions regarding handling and protecting sensitive information at the Contractor's site (including any information stored, processed, or transmitted using the Contractor's computer systems), and the secure management, operation, maintenance, programming, and system administration of computer systems, networks, and telecommunications systems.

(c) Examples of tasks that require security provisions include--

(1) Acquisition, transmission or analysis of data owned by DHS with significant replacement cost should the contractor's copy be corrupted; and

(2) Access to DHS networks or computers at a level beyond that granted the general public (e.g., such as bypassing a firewall).

(d) At the expiration of the contract, the contractor shall return all sensitive DHS information and IT resources provided to the contractor during the contract, and certify that all non-public DHS information has been purged from any contractor-owned system. Components shall conduct reviews to ensure that the security requirements in the contract are implemented and enforced.

(e) Within 6 months after contract award, the contractor shall submit written proof of IT Security accreditation to DHS for approval by the DHS Contracting Officer. Accreditation will proceed according to the criteria of the DHS Sensitive System Policy Publication, 4300A (Version 5.5, September 30, 2007) or any replacement publication, which the Contracting Officer will provide upon request. This accreditation will include a final security plan, risk assessment, security test and evaluation, and disaster recovery plan/continuity of operations plan. This accreditation, when accepted by the Contracting Officer, shall be incorporated into the contract as a compliance document. The contractor shall comply with the approved accreditation documentation.

HSAR 3052.204-71 Contractor Employee Access Clause

CONTRACTOR EMPLOYEE ACCESS (JUN 2006)

(a) Sensitive Information, as used in this Chapter, means any information, the loss, misuse, disclosure, or unauthorized access to or modification of which could adversely affect the national or homeland security interest, or the conduct of Federal programs, or the privacy to which individuals are entitled under section 552a of title 5, United States Code (the Privacy Act), but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense, homeland security or foreign policy. This definition includes the following categories of information:

(1) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (Title II, Subtitle B, of the Homeland Security Act, Public Law 107-296, 196 Stat. 2135), as amended, the implementing regulations thereto (Title 6, Code of Federal Regulations, Part 29) as amended, the applicable PCII Procedures Manual, as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the PCII Program Manager or his/her designee);

(2) Sensitive Security Information (SSI), as defined in Title 49, Code of Federal Regulations, Part 1520, as amended, “Policies and Procedures of Safeguarding and Control of SSI,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or his/her designee);

(3) Information designated as “For Official Use Only,” which is unclassified information of a sensitive nature and the unauthorized disclosure of which could adversely impact a person’s…