P03- PWS electronic lab reporting.docx

ELR Requirements for COVID-19

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Veterans Health Administration

Office of Analytics and Performance Integration (API)

Electronic Lab Reporting (ELR) Requirements for COVID-19

Date: 5/15/2025 Draft

VA-FY26-_______

PWS Version Number: 1

Contents

BACKGROUND

This is a non-personal services contract to support the routing of Coronavirus Disease 2019 (COVID-19) electronic lab reports to a centralized intake service for further distribution to the appropriate State Department of Health and Federal Agencies concerned with aggregating COVID-19 testing efforts and results for epidemiological processing.

On March 13, 2020, the COVID-19 pandemic was declared an emergency by the President of the United States. Subsequent to this declaration, Health and Human Services (HHS) issued a memo entitled "COVID-19 Pandemic Response, Laboratory Data Reporting: Coronavirus Aid, Relief, and Economic Security (CARES) Act Section 18115" dated June 4, 2020 that set a deadline of 1 August 2020 for all laboratories conducting COVID-19 testing to report daily testing activity to State or local public health departments within 24 hours of the results being known. In April 2020, COVID-19 was also named as a Nationally Notifiable Disease, and reporting to individual State Departments of Health (DOHs) was required. Although the public health emergency expired in May 2023, and COVID is no longer a Nationally Notifiable Disease as of 2025, 38 states and Washington, DC still mandate reporting of COVID tests to DOHs (Reference Attachment A). Given the volume of testing performed by VA, there is a compelling need to maintain the existing service that automates COVID-19 laboratory testing activity reporting to state public health agencies.

The Associate of Public Health Laboratories’ AIMS platform has been the only service identified by DHHS that provides an acceptable option for single intake point to reach all the State jurisdictions in which VHA operates. AIMS has existing connections to all 50 state public health departments, the CDC, and several local public health organizations. Because VHA has facilities throughout the United States, the AIMS platform is the most cost-efficient approach in that a single interface to this repository provides information to all states as opposed to individual interfaces for each state. Having a single point of intake reduces the administration, configuration, and maintenance level of effort required to report the required COVID-19 tests to each State DOH.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. FIPS Pub 200, Minimum Security Requirements for Federal Information and Information Systems, March 2016

4. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

5. VA Handbook 0710, Personnel Security and Suitability Program, May 2, 2016, https://www.va.gov/vapubs/index.cfm

6. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

7. NIST SP 800-66 Rev. 1, An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, October 2008

8. VA Directive 6500, “VA Cybersecurity Program,” January 24, 2019

9. VA Handbook 6500, “Risk Management Framework for VA Information Systems – Tier 3: VA Information Security Program,” March 10, 2015

10. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI)”, July 28, 2016

11. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle”, March 22, 2010

12. VA Handbook 6500.6, “Contract Security,” March 12, 2010

13. VA Handbook 6500.8, “Information System Contingency Planning”, April 6, 2011

14. VA Handbook 6500.11, “VA Firewall Configuration”, August 22, 2017

15. VA Handbook 6510, “VA Identity and Access Management”, January 15, 2016

16. VA Directive and Handbook 6513, “Secure External Connections”, October 12, 2017

17. VA Handbook, 6300.1, Records Management Procedures, March 24, 2010

18. NIST SP 800-37 Rev 1, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy, December 2018

19. OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007

20. Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.2, Federal Interagency Technical Reference Architectures, Department of Homeland Security, June 19, 2017, https://www.dhs.gov/sites/default/files/publications/TIC_Ref_Arch_v2.2_2017.pdf

21. OMB Memorandum M-08-05, “Implementation of Trusted Internet Connections (TIC), November 20, 2007

22. COVID-19 Pandemic Response, Laboratory Data Reporting: Coronavirus Aid, Relief, and Economic Security (CARES) Act Section 18115, June 4, 2020

SCOPE OF WORK

The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to onboard VHA via Amazon S3 or agreed upon data transport system to a centralized platform that accepts Health Level 7 (HL7) formatted messages or flat files that contain data which will then be routed to the appropriate state and local authorities and routed to CDC after removal of elements to achieve de-identification according to applicable rules and regulations detailed in the CARES Act Section 18115.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The Period of Performance shall be 12 months from date of award, with 2 twelve-month option periods. The overall Period of Performance shall not exceed 36 months.

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. All contract personnel may perform work at duty stations determined by the Contractor.

TRAVEL

The Government does not anticipate travel under this effort to perform the tasks associated with the effort.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall provide services that allow submission of laboratory testing data to state and local public health departments through a centralized platform (such as the Association of Public Health Laboratories’ AIMS platform) where such data will then be routed to the appropriate state and local authorities and routed to CDC after removal of elements to achieve de-identification according to applicable rules and regulations detailed in the CARES Act Section 18115. The primary objectives of this PWS are to:

1. Provide a single intake portal whereby electronic laboratory reporting (ELR) COVID-19 transmissions can be received from VHA to account for the various VHA facilities conducting COVID-19 testing. VHA will submit centrally for all facilities. The transport protocol shall be SFTP based.

2. Assistance with the onboarding process required to setup the message feed and maintenance thereof.

3. Route transmissions within 24 hours to the appropriate State/Local department of health systems based on a jurisdictional indicator and/or on the demographic information contained in the message. Reference Attachment A for list of state reporting requirements.

4. Provide documentation to show that mandated reporting is occurring daily within 24 hours of testing to satisfy requirements of Public Law 116-136, § 18115(a), the Coronavirus Aid, Relief, and Economic Security (CARES) Act.

5. Provide notification within 24 hours of system outages and information on recovery procedures Notification shall be sent via email to the VA COR, VA PM and the VHA Biosurveillance Antimicrobial Stewardship, and Infection Control (BASIC) Program. Point of contact Makoto Jones (Makoto.Jones@va.gov).

6. Conduct the processing in a manner that meets regulatory requirements and industry best practices for security and privacy considerations as referenced in Public Law 116-136, § 18115(a).

Deliverable:

A. Automated Weekly Documentation to show that mandated reporting is occurring daily within 24 hours of testing.

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The Contractor shall update and maintain the VA PM approved CPMP throughout the contract.

Deliverable:

B. Contractor Project Management Plan

REPORTING REQUIREMENTS

The Contractor shall provide the COR with Monthly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding Month.

The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Deliverable:

C. Monthly Progress Report

GENERAL REQUIREMENTS

SECURITY AND PRIVACY REQUIREMENTS

POSITION/TASK RISK DESIGNATION LEVEL(S)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Position Sensitivity and Background Investigation Requirements by Task

The Tasks identified above, and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

Contractor Responsibilities:

1. The Contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain the appropriate Background Investigation, and are able to read, write, speak and understand the English language.

Within 3 business days after award, the Contractor shall provide a roster of Contractor and Subcontractor employees to the COR to begin their background investigations in accordance with the PAL template artifact. The Contractor Staff Roster shall contain the Contractor’s Full Name, Date of Birth, Place of Birth, individual background investigation level requirement etc. The Contractor shall submit full Social Security Numbers either within the Contractor Staff Roster or under separate cover to the COR. The Contractor Staff Roster shall be updated and provided to VA within 1 day of any changes in employee status, training certification completion status, Background Investigation level status, additions/removal of employees, etc. throughout the Period of Performance. The Contractor Staff Roster shall remain a historical document indicating all past information and the Contractor shall indicate in the Comment field, employees no longer supporting this contract. The preferred method to send the Contractor Staff Roster or Social Security Number is by encrypted e-mail. If unable to send encrypted e-mail, other methods which comply with FIPS 140-2 are to encrypt the file, use a secure fax, or use a traceable mail service.

1. The Contractor should coordinate with the location of the nearest VA fingerprinting office through the COR. Only electronic fingerprints are authorized. The Contractor shall bring their completed Security and Investigations Center (SIC) Fingerprint request form with them (see paragraph d.4. below) when getting fingerprints taken.

b. The Contractor shall ensure the following required forms are submitted to the COR within 5 days after contract award:

1) Optional Form 306

2) Self-Certification of Continuous Service

3) VA Form 0710

4) Completed SIC Fingerprint Request Form The Contractor personnel shall submit all required information related to their background investigations (completion of the investigation documents (SF85, SF85P, or SF 86) utilizing the Office of Personnel Management’s (OPM) Electronic Questionnaire for Investigations Processing (e-QIP) after receiving an email notification from the Security and Investigation Center (SIC).

The Contractor employee shall certify and release the e-QIP document, print and sign the signature pages, and send them encrypted to the COR for electronic submission to the SIC. These documents shall be submitted to the COR within 3 business days of receipt of the e-QIP notification email. (Note: OPM is moving towards a “click to sign” process. If click to sign is used, the Contractor employee should notify the COR within 3 business days that documents were signed via e-QIP).

1. The Contractor shall be responsible for the actions of all personnel provided to work for VA under this contract. In the event that damages arise from work performed by Contractor provided personnel, under the auspices of this contract, the Contractor shall be responsible for all resources necessary to remedy the incident.

1. A Contractor may be granted unescorted access to VA facilities and/or access to VA Information Technology resources (network and/or protected data) with a favorably adjudicated Special Agreement Check (SAC), completed training delineated in VA Handbook 6500.6 (Appendix C, Section 9), signed “Contractor Rules of Behavior”, and with a valid, operational PIV credential for PIV-only logical access to VA’s network. A PIV card credential can be issued once your SAC has been favorably adjudicated and your background investigation has been scheduled by OPM. However, the Contractor will be responsible for the actions of the Contractor personnel they provide to perform work for VA. The investigative history for Contractor personnel working under this contract must be maintained in the database of OPM.

1. The Contractor, when notified of an unfavorably adjudicated background investigation on a Contractor employee as determined by the Government, shall withdraw the employee from consideration in working under the contract.

Failure to comply with the Contractor personnel security investigative requirements may result in loss of physical and/or logical access to VA facilities and systems by Contractor and Subcontractor employees and/or termination of the contract for default.

Identity Credential Holders must follow all HSPD-12 policies and procedures as well as use and protect their assigned identity credentials in accordance with VA policies and procedures, displaying their badges at all times, and returning the identity credentials upon termination of their relationship with VA.

Deliverable:

D. Contractor Staff Roster

METHOD AND DISTRIBUTION OF DELIVERABLES

The Contractor shall deliver documentation in electronic format, unless otherwise directed in Section B of the solicitation/contract. Acceptable electronic media include: MS Word 2000/2003/2007/2010, MS Excel 2000/2003/2007/2010, MS PowerPoint 2000/2003/2007/2010, MS Project 2000/2003/2007/2010, MS Access 2000/2003/2007/2010, MS Visio 2000/2002/2003/2007/2010, AutoCAD 2002/2004/2007/2010, and Adobe Postscript Data Format (PDF).

PERFORMANCE METRICS

Contractor Responsibilities:

Quality Control: The contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality control program is the means by which work is assured to comply with the requirements of the contract. A comprehensive written Quality Control Plan (QCP) shall be submitted to the Contracting Officer and COR within 5 working days of the start date of the contract and subsequently within five days of a change to the plan thereafter. After acceptance of the QCP the contractor shall receive the contracting officer’s acceptance in writing of any proposed change to the contractor’s QC system. The approach to Quality Control should map to the contractor’s selected development methodology. However, it must also address support for QASP reporting requirements.

Quality Assurance: The government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines the performance standards, how the performance standards will be applied, and the frequency of surveillance.

Deliverable:

E. Contractor Quality Control Plan

FACILITY/RESOURCE PROVISIONS

N/A Government Facility/Resources will not be provided.

GOVERNMENT FURNISHED PROPERTY

Government Furnished Property will not be provided image1.jpeg