P02 RFI 36C10B24Q0635 Draft PWS.docx

Request for Information 36C10B24Q0635

DRAFT PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology National Center for Ethics in Health Care for

Cloud-Based Informed Consent Web for Clinical Treatments and Procedures Enterprise Solution

Date: July 15, 2024 PWS Version Number: 1.0 Contents

BACKGROUND

The mission of the Department of Veterans Affairs (VA), Office of Information and Technology (OIT) is to develop and maintain Information Technology (IT) products and systems that serve our Veterans by supporting the work of the Veterans Health Administration (VHA), Veterans Benefits Administration, and the National Cemetery Administration.

VHA is the largest integrated health care system in the United States, consisting of 150 medical centers and nearly 1,400 community-based outpatient clinics, community living centers, Vet Centers and Domiciliaries. Together, these health care facilities and the more than 53,000 independently licensed health care practitioners who work within them, provide comprehensive care to more than 8.3 million Veterans each year. VHA personnel practice all medical specialties and provide medical and rehabilitative treatment of all kinds, from acute to long term care to outpatient care.

Within VHA, the National Center for Ethics in Health Care (NCEHC) serves as the authoritative resource for addressing complex ethical issues relating to clinical ethics, organizational ethics, organizational policy, and research ethics. NCEHC works with OIT to provide technology to empower patients and promote shared decision making through use of a cloud-based solution application that helps clinicians manage the process, called informed consent, electronically.

VHA’s NCEHC is the business owner of the requirement for signature informed consent cloud-based solution that assists VA health care professionals in documenting patients’ signature and informed consent for over 2,000 treatments. The cloud-based solution also documents Veterans’ completion of VA Form 10-0137, “VA Advance Directive and Durable Power of Attorney for Health Care” (Advance Directive). All of these forms require the electronic capture and storage in the Electronic Health Record (EHR) with an associated progress note of the patient’s and provider’s handwritten signature on a specific VA form. These signed forms are stored as electronic images in VA’s Veterans Health Information Systems and Technology Architecture (VistA) Imaging system and the Oracle Health Electronic Health Record Modernization (Oracle Health EHRM) System. Functionality for electronic signature informed consent, and patient education documents for all medical specialties, stored in the VA electronic patient health record, with an authentication capability through the use of a Personal Identification Verification (PIV) card and/or a DoD Common Access Card (CAC).

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21, 2018

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,” June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

70. VHA Directive 1004.01, Informed Consent for Clinical Treatments and Procedures, dated December 12, 2023

71. VHA Directive 1004.03 Advance Care Planning.

72. 38 C.F.R. § 17.32, Informed Consent and Advance Directives.

73. VHA Directive 1907.01(1) .

74. SAFe 6.0: https://scaledagileframework.com/.

SCOPE OF WORK

The contractor shall provide and maintain an Informed Consent Web Solution capable of documenting signature informed consent for treatments and procedures, advance directives, and other VA Forms, for all clinical specialties at all of VHA’s 150 medical facilities located in all 50 states, Puerto Rico, Guam, and the Philippines. All references to “Informed Consent Web Solution” in this document are defined as a cloud-based, load balanced, signature informed consent web application in a clustered high availability database environment.

The contractor shall provide a cloud-based web application solution with high availability (as described in section 5.3 of this PWS) with a clustered database accessible enterprise-wide. The solution shall be compatible with the VA’s enterprise architecture. The contractor shall ensure the Informed Consent Web solution provides the capability to integrate with the VA’s authentication service using the PIV card and allow for use of a DoD CAC card at sites where DoD personnel access and document on patient treatments using the VA electronic health record.

The contractor shall provide Operations and Maintenance (O&M) support for the proposed Informed Consent Web solution. The contractor shall use an agile methodology and follow the Veteran Focused Integration Process (VIP) program management process outlined in Section 5.4 and 6.1.6 for delivery of enhancements and defect fixes.

The contractor shall use the VA Enterprise Cloud (VAEC) as the hosting environment for this Informed Consent Web solution in accordance with VA’s Cloud First Policy.

The contractor shall provide information assurance and cybersecurity subject matter expertise to ensure the solution is designed, developed, integrated, tested, implemented, and sustained in compliance with VA’s Enterprise Cloud and Enterprise Security compliance requirements and standards.

The contractor shall use cloud native approaches in accordance with VA’s Use of Cloud-Based Native Technologies and Approaches Policy.

The contractor shall provide computer-based training for the proposed Informed Consent Web solution for both user and administrative user roles.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The period of performance (POP) is 12 months from date of award, with four 12-month option periods and one 12-month Optional Task. The total duration of this contract, including the exercise of any options, shall not exceed 60 months.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall primarily be performed at the contractor’s facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

In the event that portions of this effort are performed at a Government facility (onsite), no more than four members of the Contractor’s staff per trip may be supported by the Government.

TRAVEL

The Government encourages the contractor to maximize its use of teleconferencing and video conferencing for meetings.

The Government anticipates travel to perform the tasks associated with the effort. Travel shall be in accordance with the Federal Travel Regulations and requires advanced concurrence by the Contracting Officer’s Representative (COR).

The following table is the Government’s estimated long-distance travel:

RESOURCES

The Contractor shall provide resources with a mix of specific skills and expertise in operating and refining the Scaled Agile Framework (SAFe) to meet stakeholder expectations in terms of continuous improvements in quality, responsiveness, and consistency of releases. The Contractor shall adhere to industry best practices and standards.

The contractor’s cross-functional team resources for the configuration and development of product enhancements, infrastructure support, and maintenance necessary for the end-to-end functionality of the delivered solution shall include SAFe team roles/responsibilities.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall include how the Contractor coordinates and executes planned, routine, and ad hoc data collection reporting requests as identified within this PWS. The Contractor shall gain the Government’s concurrence on the initial baseline CPMP. The CPMP is a living document and as such, the contractor shall update the CPMP as necessary based on environmental changes and obtain Government concurrence with the updated CPMP. The Contractor shall update and maintain the VA PM approved CPMP throughout the POP.

The contractor shall designate a contractor Project Manager (PjM) as its main point of contact (POC) between the VA Product Manager (PM) and the contractor’s organization. The PjM shall oversee and manage the schedule and all tasks associated with this PWS.

The contractor shall:

1. Provide a contractor staff roster in accordance with section 6.2.2 of this PWS. The staff roster shall also track staff training(s) status and all Government-furnished Equipment.

2. Contractor staff allocated to the Informed Consent Web solution shall be available on VA network, use VA’s Microsoft Teams, and use VA’s Microsoft Outlook email accounts for communication.

3. Develop and maintain deliverables and perform the tasks specified herein.

4. Identify, prioritize, set boundaries for, resource, and assess course of actions related to program risks. The contractor shall inform the VA PM of deliberations and contractor recommendations.

5. Identify project risks and recommend mitigation and resolution strategies as the risks are identified.

6. Create meeting minutes for all contractor-facilitated conference calls and meetings held.

7. The contractor shall notify the VA PM, COR, and CO, in writing, immediately if the contractor is aware of anything that may adversely impact the contractor’s ability to perform under this PWS.

8. The Contractor shall provide to the COR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each Contractor employee requiring VA system access no later than 14 calendar days after contract award and annually thereafter, as required. The contractor shall deliver the required onboarding documentation and trainings for staff on-boarded during performance to the COR prior to that Contractor staff starting work on the effort. This includes Privacy and Information Awareness training certificates, rules of behavior, and HIPAA certificate of completion, in accordance with PWS Section 6.0 and Addendum A and B.

Deliverables:

A. Contractor Project Management Plan.

B. Contractor Staff Roster.

C. Meeting Minutes.

D. Training Certificates for the mandatory training courses for VA-approved repositories and tools.

E. VA Privacy and Information Security Awareness and Rules of Behavior Training Certificates.

F. Signed Contractor Rules of Behavior.

G. VA HIPAA Certificates of Completion.

H. Role-based Training Certificates.

REPORTING REQUIREMENTS

The Contractor shall provide the COR with Monthly Progress Reports in Microsoft Word and/or Microsoft Project formats. The report shall include detailed instructions and explanations for each required data element to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding month.

The Monthly Progress Reports shall cover all work completed during the reporting period and all work planned for the subsequent reporting period. The Monthly Progress Report shall identify any problems that arose during the reporting period and describe how the issue(s) were resolved. If issues have not been completely resolved, the Contractor shall provide an explanation, including the Contractor’s plan and timeframe for resolving the issue(s). The Monthly Progress Report shall include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. The Monthly Progress Report shall include a project status summary, change request status (new, open, and closed since last report), issue/action item status (new, open, and closed since last report), risk items and their disposition. The Contractor shall keep in communication with VA accordingly so that issues that arise are transparent to both parties and minimize the need to prevent escalate outstanding issues.

Deliverable:

Monthly Progress Reports.

VA MANDATORY TRAINING

The Contractor and VA COR shall determine which team members require access to the VA network and VA approved toolset. All Contractors that require access shall complete all required VA Talent Management System (TMS) training courses within 14 days of the identification of the access need. The Contractor shall work with its respective point of contact to obtain access to TMS to complete the mandatory courses.

As an action under the Continuous Readiness in Information Security Program (CRISP), VA's Assistant Secretary for Information and Technology issued a memorandum requiring all VA Government and contract staff to complete information security awareness and applicable role-based training. The Contractor shall submit TMS Training Certificates of completion for VA Privacy and Information Security Awareness (PISA), Rules of Behavior (ROB), Health Insurance Portability and Accountability Act (HIPAA), and role-based trainings. The Contractor shall provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security.”

The Contractor shall complete the appropriate VA TMS role-based training courses for all Contractor staff, to include at a minimum:

1. TMS ID 3197: Information Security Role-Based Training for IT Specialist (Web Based Training [WBT])

2. TMS ID 3867205: Training for Elevated Privileges for System Access (WBT)

3. TMS ID 3867207: Information Security Role-Based Training for System Owners (WBT)

4. TMS ID 1016925: Information Security Role-Based Training for Software Developers (WBT)

5. TMS ID 1357076: Information Security and Privacy Role-Based Training for System Administrators (WBT)

6. TMS ID 1357084: Information Security Role-Based Training for Data Managers (WBT)

7. TMS ID 1357083: Information Security Role-Based Training for Network Administrators (WBT)

8. TMS ID 64899: Information Security Role-Based Training for IT Project Managers (WBT)

When determined necessary by the Government and as directed by the COR, the Contractor shall complete Agile training courses, and other PLM and SAFe courses, such as:

1. TMS ID 4533235: Product and Product Line Management: Creating and Managing the Product Back Log

2. TMS ID 4533231: Product and Product Line Management: Overview of Product Line Management

3. TMS ID 4551891: Introduction to Agile

4. TMS ID 4551982: Product Owner

The Contractor shall complete emerging training requirements for GitHub, Jira, or other VA-approved tools as appropriate or required.

Contractors who have completed these VA training courses within the past 12 or 24 months, depending on the training requirements, and have furnished training certificates to VA, will not be required to re-take the courses.

Deliverables:

A. TMS Training Certificates.

B. Signed Contractor Rules of Behavior.

ONBOARDING/INPROCESSING

The Contractor shall manage the onboarding of its staff. Onboarding includes steps to obtain a VA PIV card, network and email account, complete training, and submit to the COR the documentation necessary for the background investigations and gain physical and logical access. In addition, the Contractor shall identify individuals who may require elevated privileges to the necessary development and test environments for the various systems to be enhanced. After review between the Contractor and the VA COR, a decision will be made as to the necessity of obtaining Government Furnished Equipment (GFE) for the onboarding staff. If approved, the Contractor shall follow the appropriate steps to obtain the equipment.

The Contractor shall designate a single Contractor Onboarding point of contact (POC) to track the onboarding status of all Contractor personnel. The Contractor Onboarding POC shall be responsible to submit all required onboarding paperwork and required TMS certificates 48 hours from start date provided to the VA COR. The Contractor shall be responsible for tracking the status of all its staff onboarding activities to include the names of all personnel engaged on the task, their initial training date for VA Privacy and Information Security training, and their next required training date. The Contractor Onboarding POC and PM of the TO shall communicate any issues with in-processing/onboarding of an incoming Contractor and shall follow-up with the VA POC of the status as required. The Contractor Onboarding POC shall report the status at the staff level during onboarding status meetings. The Contractor shall provide a Weekly Onboarding Status Report for any staff with outstanding onboarding requests for review by the VA COR. The Weekly Onboarding Status Report shall include the certifications, education and other information that adequately establishes the employees’ credentials and Service Contract Act status (exempt or non-exempt).

To speed onboarding, VA may authorize the Contractor to use the Contractor’s tools for managing the work; however, at any point, VA can mandate that the Contractor move all the information housed in those tools to the approved VA toolset.

Deliverable:

Weekly Onboarding Status Report.

KICK-OFF MEETING

The contractor shall establish and hold a technical kick-off meeting no later than ten (10) days after contract award, via MS Teams or conference call. The contractor shall present the details of its intended approach, work plan, and project schedule. The contractor shall specify the date and provide all attendees with an electronic copy of the agenda at least five (5) calendar days before the meeting. The contractor shall invite the CO, Contract Specialist, COR, the VA PM, and the VA Business Owner. The contractor shall provide meeting minutes to all attendees within three (3) calendar days after the meeting.

Deliverable:

Kick-off meeting, agenda, slide-deck and meeting minutes.

SOFTWARE REQUIREMENT

The contractor shall provide a Commercial Off-The-Shelf (COTS) Informed Consent Web solution with high availability (as described in section 5.3 of this PWS) in a clustered enterprise database capable of up to 150,000 concurrent users producing approximately 13,000 consent forms a day. The Informed Consent Web solution shall support documentation of signature informed consent for all treatments and procedures conducted by VHA facilities that require signature informed consent per the prescribed criteria defined in VHA Directive 1004.01. The Informed Consent Web solution shall be in accordance with VHA Directive 1004.01, Informed Consent for Clinical Treatments and Procedures and VHA Directive 1004.03 Advance Care Planning. The Informed Consent Web solution shall electronically capture patient, patient surrogate, practitioner, and witness handwritten signatures as images on documents, with date and time stamps for each handwritten signature. The Informed Consent Web solution and content libraries shall allow VA professionals to accurately and consistently (i.e., each episode of care) document signature informed consent for all treatments/procedures requiring signature informed consent, as well as complete various VA Forms.

The contractor shall provide an Enterprise-wide application license for an unlimited number of VA users. For completed (electronically signed) artifacts, the Informed Consent Web solution shall use the VistA Imaging Image Exchange (VIX) Ingest Service with the appropriate VIX Ingest Service Text Integration Utility (TIU) workflow supporting TIU note proxied user signatures or Oracle Health FHIR services for Oracle Health implementation. VistA patient data calls shall use the VA Master Patient Index (MPI) being the VA authoritative source for patient data. VistA and Oracle Health provider data calls shall be obtained from services or sources that provide VistA data from file 200 being the VistA New Person file and Oracle Health data extract, respectively. Remote Procedure Broker calls (RPCs) shall not be used as the VA intends to utilize FHIR, Master Patient Index (MPI), Centralized VistA Imaging Exchange (CVIX) and Corporate Data Warehouse (CDW).

In addition, the Informed Consent Web solution shall include a real-time interface with the VistA and the Oracle Health Millennium Electronic Health Record (EHR). The VistA and Oracle Health interfaces for transfer of consent form data must be functional at the time of deployment.

The contractor shall provide an Informed Consent Web Solution developed and maintained to remain in compliance with VHA Directive 1004.01, and The contractor shall ensure the solution provides the following to comply with VA policies:

1. The contractor shall provide an Informed Consent Web Solution that manages patient context/patient selection in CPRS/VistA according to Clinical Context Object Workgroup (CCOW) context management, manages patient context in Oracle Health PowerChart, and integrates with the VA's authentication service to support PIV authentication. Patient selection shall be made by selecting the patient in CPRS or selecting an encounter and the patient in Oracle Health PowerChart and launching the application as an option from within either of VA’s EHRs.

2. The contractor shall provide an Informed Consent Web solution that is integrated with Oracle Health’s Powerchart and is able to execute within the Oracle Health Powerchart window with context sharing for patient and other in-context information such as encounter and facility.

3. The contractor shall provide an Informed Consent Web solution that allows Local VA Administrators at the sites to build unique and standardized consent forms, local administrative forms, and education documents for general and specific treatment, for use limited to the local level.

4. The contractor shall provide an automated Informed Consent Web solution that ensures consent forms include a process that allow logic for documenting a patient's decision on whether a "Do Not Resuscitate" order will remain in place during high-risk procedures or when an anesthesia provider will be present during the procedure.

5. The contractor shall provide an Informed Consent Web Solution with consent forms that are logic based and include a description of the specific treatment/procedure, its risks, benefits, alternatives, and a patient and practitioner attestation statement. The treatment/procedure specific information shall populate onto a standardized electronic presentation of a VA form and include demographic data needed to complete the form (e.g., VA Form 10-0431a, “Consent for Clinical Treatment/Procedure”, VA Form 10-0431b, “Consent for Transfusion of Blood Products”; VA Form 10-0431c, “Consent for Long-Term Opioid Therapy for Pain”).

The Informed Consent Web Solution requires, but is not limited to, the following forms:

· VHA Form 10-0431a, Consent for Clinical Treatment/Procedure

· VHA Form 10-0431b, Consent for Transfusion of Blood Products

· VHA Form 10-0431c, Consent for Long-Term Opioid Therapy for Pain

· VA FORM 27-2008 APPLICATION FOR UNITED STATES FLAG FOR BURIAL PURPOSES

VBA-27-2008-ARE.pdf (va.gov)

· VA Form 10-10118 Designee for Patient Personal Property https://vaww.va.gov/vaforms/download.asp?id=5374

· VA Form 10-2065 Funeral Arrangements https://vaww.va.gov/vaforms/download.asp?id=10787

· VA FORM 21-4142a GENERAL RELEASE FOR MEDICAL PROVIDER INFORMATION TO THE DEPARTMENT OF VETERANS AFFAIRS (VA) VBA-21-4142a-ARE.pdf (va.gov)

· VA Form 10-2649B Provider Certification & Patient Consent for Transfer https://vaww.va.gov/vaforms/download.asp?id=4624

· VA Form 10-2687 Inventory of Funds and Effects (Fillable) https://vaww.va.gov/vaforms/download.asp?id=427

· VA Form 10-3203 Consent for Production and use of Verbal or Written Statements, Photographs, Digital Images, and/or Video or Audio Recordings by VA https://vaww.va.gov/vaforms/download.asp?id=3038

· VA Form 10-3203a Informed Consent and Authorization for Third Parties to Produce or Record Statements, Photographs, Digital Images, or Video or Audio Recordings https://vaww.va.gov/vaforms/download.asp?id=5370

· VA Form 10-5345 Request for and Authorization to Release Health Information https://vaww.va.gov/vaforms/download.asp?id=10573

· VA Form 10-5345a Individuals' Request for a Copy of Their Own Health Information – fill https://vaww.va.gov/vaforms/download.asp?id=4427

· VA Form 10-252 AUTHORIZATION TO RELEASE PROTECTED HEALTH INFORMATION TO STATE/LOCAL PUBLIC HEALTH AUTHORITIES https://vaww.va.gov/vaforms/download.asp?id=10592

· VA Form 10-0137 VA Advance Directive: Durable Power of Attorney for Health Care and Living Will https://vaww.va.gov/vaforms/download.asp?id=3141

· VA Form 10-0137 (espanol) Directrices Anticipadas De Va Poder Legal Para La Designacion De Agente Para El Cuidado De Salud Y Testamento En Vida https://vaww.va.gov/vaforms/download.asp?id=6483

· VA Form 10-0137A What You Should Know About Advance Directives https://vaww.va.gov/vaforms/download.asp?id=4582

· SF-523 Medical Record - Authorization for Autopsy https://www.gsa.gov/reference/forms/medical-record-authorization-for-autopsy

6. The contractor shall provide an Informed Consent Web solution with processes that document patient decision-making capacity as part of consent form completion. Users are required to select whether the patient has Decision-Making Capacity (DMC). Depending on the answer, the Informed Consent Web solution shall offer options. If the patient has DMC, the consent documentation process begins. If the patient lacks DMC, the user is queried on the reason for this determination (e.g., clinical evaluation used to make determination, patient is a minor, or patient has been ruled incompetent by a court). The Informed Consent Web solution shall provide an option for surrogate designation/documentation that applies to all consent forms for treatments and procedures and applies to non-consent forms on a case-by-case basis. If the patient lacks DMC, the Informed Consent Web solution shall allow documentation of the patient's surrogate by name and relationship. Should the surrogate be physically available, signature fields and attestation statements shall allow for documenting that the signature was obtained from the surrogate. Should the surrogate not be physically available, the Informed Consent Web solution shall allow for documenting the informed consent process being conducted telephonically between the provider and the surrogate. Documentation that the surrogate’s consent was obtained telephonically shall require signature of the provider obtaining informed consent. The Informed Consent Web solution shall require the provider to annotate whether the required witness is co-located with the provider and can sign the form, as well as document in a progress note within the EHR witnessing the conversation. The witness shall be able to sign the document if co-located with the provider.

5. The contractor shall provide continuous sharing of knowledge throughout the duration of development, testing, acceptance, installation, and implementation sufficient to allow VA to provide support for the Informed Consent Web Solution system. The Contractor shall provide documentation of testing, install, and implementation plans. The Contractor shall provide release notes for any significant updates to the Informed Consent Web Solution.

6. The Informed Consent Web Solution shall be fully deployable with an approved Authority to Operate (ATO), all Test and Evaluation (T&E) complete [zero (0) unresolved Severity 1’s, 2’s, nor clusters of Severity 3’s] 30 days prior to National Production deployment. User acceptance shall be obtained and delivered to the VA production environment for use by users.

Deliverables:

A. PIV compliant Informed Consent Web software solution.

B. User Acceptance Testing Form.

C. Documentation of Testing, Install, Implementation Plans.

D. Release Notes.

INTEGRATE AND INTERFACE WITH VA’S ORACLE HEALTH EHR PLATFORM

The contractor shall integrate and interface the Informed Consent Web solution with VA’s Oracle Health PowerChart/Millennium EHR, VA’s Oracle Health Image and Artifact Repository, VA’s Oracle Health MPage for Patient Context Management solution, and the VA’s Oracle Health Authentication solution.

The Informed Consent Web solution shall differentiate between a user accessing the Informed Consent Web solution via the VA’s Oracle Health PowerChart/Millennium entry point from the VA’s CPRS entry point. The contractor shall support and maintain a unique workflow for the VA’s Oracle Health PowerChart/Millennium operation distinctly from the VA’s VistA/CPRS workflow.

The Informed Consent Web solution for the VA’s Oracle Health implementation shall integrate/interface with the VA’s Master Patient Index (MPI) for VA patient data and the VA’s Clinical Data Warehouse (CDW) for VA provider data.

The Informed Consent Web solution shall arrange for and receive VA provider data pushes from the CDW every 24 hours, caching the provider data locally in the Informed Consent Web solution for consent and document form fills.

The Informed Consent Web solution shall integrate/interface with the VA’s Oracle Health PowerChart/Millennium EHR using Oracle Health’s most current Substitutable Medical Applications, Reusable Technologies (SMART) Fast Healthcare Interoperability Resources (FHIR) specification for PDF artifacts associated with a Oracle Health Progress Note or Encounter. The completed Informed Consent Web solution artifacts shall be viewable for users via the Oracle Health PowerChart/Millennium EHR.

The Informed Consent Web solution shall be able to differentiate between VistA users and Oracle Health users and shall be able to support the proper application workflow for each type of user. Upon completion, the contractor shall update the Informed Consent Web VistA ATO for any and all Oracle Health changes to ensure the ATO is applicable for VA Oracle Health users as well as VA VistA users.

The Informed Consent Web solution shall continue to update the VA’s VistA/CPRS user access as needed per the needs of VHA, and workflow after a fixed time period once the VA users at the final VA VistA site have been successfully transitioned to the VA’s Oracle Health implementation.

INFORMED CONSENT WEB SOLUTION CLINICAL CONTENT LIBRARY

The contractor shall provide an Informed Consent Web solution that includes a library of consent forms for all treatments/procedures conducted by VHA for inpatient and outpatient care. The current list of specialties includes: Anesthesia, Pain Management, Cardiac Surgery, Cardiology, Dentistry, Dermatology, Emergency Medicine, Gastroenterology, General Surgery, Hematology/Oncology, Interventional Radiology, Mental Health, Nephrology, Neurology, Neurosurgery, Nuclear Medicine, Obstetrics/Gynecology, Ophthalmology, Orthopedic Surgery, Otolaryngology, Physical Medicine/ Rehabilitation, Plastic/Reconstructive Surgery, Podiatry, Pulmonary Medicine, Radiation Oncology, Radiology (Diagnostic), Research, Rheumatology, Thoracic Surgery, Urology, and Vascular Surgery for at least 2,400 different procedures.

The contractor shall provide an Informed Consent Web solution with a document library that will provide consent forms in English and Spanish, written to a 6th - 8th grade reading level. The content shall include a description of the specific treatment/procedure, its risks, benefits, alternatives, and a patient and practitioner attestation statement. The content library descriptions shall comply with the standards outlined in VHA Directive 1004.01.

The contractor shall deliver content based on the schedule outlined in the CPMP. The VA will review and approve all content prior to accepting the content for production use. The contractor shall update the content based on VA comments within 10 days after receipt.

The contractor shall provide a content library to comprehensively cover all the treatments and procedures performed in VA that require signature informed consent in accordance with VHA Directive 1004.01. The contractor shall ensure that all developed content is submitted in accordance with the process described below. Changes to content that is already in use in VA shall be forwarded to the VHA CMG for review and approval prior to release to the content library. Allow users to search for a document within the document library by any of the following criteria: document name, VA Form number, document content, or specific keywords (e.g., “opioids”).

INFORMED CONSENT WEB SOLUTION CLINICAL CONTENT LIBRARY MANAGEMENT

The contractor shall provide a method for VHA personnel to propose changes and additions to the content library.

The contractor shall forward any VHA proposed draft changes and draft additions to the content library to a designated VHA email address for processing by the VHA Content Management Group (CMG). The VHA CMG shall approve, disapprove, or edit the draft change and send them back to the contractor via email. The contractor shall update the content library database on a quarterly basis using approved content from the VHA CMG.

The VHA CMG will review, coordinate, and forward approved change requests to the contractor. Unless otherwise agreed to by VHA CMG in advance, the contractor shall deliver the draft electronic informed consent software with new or updated content to VHA CMG for review and approval no later than 90 days from the date the VHA CMG forwards the request. The contractor shall receive VHA CMG approval for all new or updated content prior to release.

The contractor shall reply to the VHA CMG Approved Change Request email with the following information:

1. Specific origin of the request and date of request;

2. VA Subject Matter Expert identified in original request;

3. The contractor shall add the following text: “Changes made as submitted below.” if the contractor is not able to make the changes as requested by the VHA CMG, the contractor shall respond to the VHA CMG with the variance from the requested change and request VHA CMG approval to move forward with the revised change.

If the contractor determines that revisions to existing content library documents are warranted based upon an update of current evidence-based information related to any identified procedure, the contractor shall submit a query seeking the approval of VHA CMG prior to making the suggested change. This query shall be accompanied by the evidence-based literature that supports the suggested change and the suggested change language (not the full revised consent). VHA CMG will respond to the request via email communication.

If the Contractor deems any VHA CMG requested change would result in the need to modify the content library beyond the changes anticipated herein, the Contractor shall notify the VHA CMG, VA COR, and VA contracting office prior to making the change. The contractor shall make all VHA CMG approved changes to the consent library. Only when content is approved by the VHA CMG and the Contractor agrees the change(s) fall within the changes anticipated and identified in this PWS, shall the contractor update the content library database.

The content library database shall be updated on a quarterly basis. The contractor shall provide a quarterly content change log that documents all change requests, including the date the request was received, who input the request, status, actions and coordination completed to date, and completion date.

Deliverables:

A. Content Library Management Methodology.

B. Quarterly Change Logs.

CLINICAL CONTENT LIBRARY – VA SPECIFIC CONTENT

VA Content Items include, but are not limited to, all healthcare data initially originated or generated by either VA Staff or the Contractor, and further , developed, modified, or upgraded by the Government or VA Staff, whether in draft or final form/document, in electronic, print, or other form and any and all working papers associated with any of the above developments, modifications or upgrades, relating in any way to the VA healthcare enterprise and VA implementation of the content under this contract. In accordance with Federal Acquisition Regulation 52.227-14, the contractor shall provide "unlimited rights" to any VA Content Items in the content library, that have been developed, modified, or upgraded due to request or input by VA staff or the VHA CMG. The contractor shall deliver any content/items developed, updated, upgraded, or modified during performance to include, but not limited to, the consents, forms, education documents, clinical content, description of the specific treatment and/or procedure, risks, benefits, alternatives, and a patient and practitioner attestation statement. The Contractor shall deliver the content items in American Standard Code (ASC) II, text, or protected document format. Further, the Contractor shall deliver any data or information in support of this content, to include source code. In accordance with FAR 52.227-14, the Government shall have unlimited rights to any content/items developed and delivered under this contract to include the rights to use disclose, reproduce, prepare derivative works, distribute copies to the public, and perform publicly and display publicly, in any manner and for any purpose, and to have or permit others to do.

Deliverables:

VA Content Items.

SIGNATURE CAPTURING CAPABILITY

The contractor shall provide an Informed Consent Web solution that incorporates processes to electronically capture full and partial, handwritten signatures (asynchronous consent/signatures), as allowed for by VA policy as stated in VHA Directive 1004.01. The Informed Consent Web solution shall fully support signature-capture on VA approved mobile and end user devices currently in use by VA. The application shall have the ability to present and print consent forms for signature and save those documents to a patient’s record within the EHR systems as an Adobe Portable Document Format (PDF) image, linked to a progress note in VistA CPRS EHR or Oracle Health EHR. Individual VHA medical facilities are not restricted in the purchase of signature devices. The Informed Consent Web solution shall support signature capture functionality on all devices currently in use at VA, which include, but are not limited to, the following devices:

T-LBK462-HSB-R

T-LBK462-BSB-R

T-L462-HSB-R

T-S460-HSB-R

T-S460-BSB-R

T-LBK460-HSB-R

T-LBK460-BSB-R

T-L460-HSB-R

MOBILE DEVICE SIGNATURE CAPABILITY

The contractor shall provide the capability for clinicians to use the Signature Informed Consent Web Solution to send a request for signature to a patient’s/surrogate’s mobile device for the patient/surrogate to sign with a handwritten or manually drawn, electronically captured signature. This process must allow the patient/surrogate to view and digitally sign the request from a personal device.