PDMP PWS RFI.docx

VA Prescription Drug Monitoring Program (PDMP)

VA-26-00013141

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Enterprise Portfolio Management Division, Health Portfolio, Clinical Services

VA Prescription Drug Monitoring Program (PDMP) Sustainment Support Services

Date: 12/16/2025

VA-26-00013141

Task Order PWS Version Number: 1.1

Contents

BACKGROUND

The mission of the Department of Veterans Affairs (VA), Office of Information & Technology (OI&T), Enterprise Program Management Office is to provide benefits and services to Veterans of the United States. In meeting these goals, OI&T strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

VA OI&T EPMO, Enterprise Portfolio Management Division (EPMD), Health Portfolio delivers world-class, Veteran-centric capabilities that provide secure, seamless delivery of services to Veterans and their families. The Health Portfolio consists of a variety of products, programs, and projects that deliver Veteran-centric technology solutions that are available, adaptable, secure, and cost-effective.

The Maintaining Internal Systems and Strengthening Integrated Outside Networks (MISSION) Act Section 134 focuses on the VA Participation in National Network of State-Based Prescription Drug-Monitoring Programs (PDMP). The mission requires VA to enter into an agreement with a national network, state, or regional PDMP, to allow licensed VA health care providers to query controlled substance prescriptions written in participating states or regions. It also requires VA health care providers practicing in states that do not have a PDMP to join the nearest state or regional PDMP. In 2019, a task order was awarded for a PDMP Integration Solution, which connected Veterans Health Information Systems and Technology Architecture (VistA) to the Prescription Monitoring Program (PMP) Gateway Software as a Service (SaaS) product. As a result, VA is seeking to maintain the PMP Gateway SaaS connection provided by Bamboo Health to VistA.

This effort includes existing Intersystems Healthshare, PMP Gateway, and the PDMP Transaction Dashboard.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

3. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

4. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022

6. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and Information Technology Act of 2006, as amended, Title IX, Information Security Matters

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

10. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

11. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

12. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

13. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended

14. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

15. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”, as amended

16. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

17. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

24. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

25. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

26. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

27. OIT Process Asset Library (PAL), OIT Process Asset Library.

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

30. VA Directive 6510, “VA Identity, Credential and Access Management,” September 3, 2024

31. VA Handbook 6510, “VA Identity, Credential and Access Management,” September 27, 2024

32. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

33. VA Directive 6300, “Records and Information Management,” September 21, 2018

34. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

44. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

47. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

49. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

50. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

51. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

52. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L. 110–140), December 19, 2007

53. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005

54. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

55. VA Directive 0057, “VA Environmental Management Program,” October 25, 2022

56. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

57. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

58. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

59. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

60. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

61. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

62. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

63. Social Security Number (SSN) Fraud Prevention Act of 2017

64. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

65. C.F.R Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”, as amended

66. Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

67. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

68. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

69. OMB M-22-18, “Enhancing the Security of the Software Supply Chain through Secure Software Development Practices,” September 14, 2022

70. OMB M-23-16, “Update to Memorandum M-22-18,” June 9, 2023

71. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27, 2021

72. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December 2014

73. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02: Vulnerability Remediation Requirements for Internet-Accessible Systems | CISA

74. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

75. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

76. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019

77. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

78. H.R. 5674: VA MISSION Act of 2018, Sec. 134 “Department of Veterans Affairs participation in national network of State-based prescription drug monitoring program.”

79. VHA Directive 1306 “Querying State Prescription Drug Monitoring Programs (PDMP),” October 2016

80. VHA Directive 1306 (1) “Querying State Prescription Drug Monitoring Programs (PDMP),” October 2019

81. “FedRAMP Continuous Monitoring Strategy Guide” version 3.2, April 4, 2018, https://www.fedramp.gov/assets/resources/documents/CSP_Continuous_Monitoring_Strategy_Guide.pdf

SCOPE OF WORK

The Contractor shall maintain the existing PDMP solution which connects to the existing PDMP clearinghouse from VistA. This includes existing Intersystems Healthshare, PMP Gateway, and the PDMP Transaction Dashboard. The Contractor shall maintain the existing PMP Gateway SaaS solution which automatically connects to the existing PDMP clearinghouse from VistA. As part of this solution, the Contractor shall provide analysis, management, planning, modification (software support and development), and testing of VA PDMP solution. The Contractor shall support Project Management, Requirements Elaboration, Configuration, System Engineering, Unit Testing, Functional Testing, System Testing, Acceptance Testing, Performance & Regression Testing, System and Software Documentation, Risk and Defect Management, System and Performance Metrics Capture, and Release. The Contractor shall also provide Warranty support for the features developed in this PWS within the period of performance (PoP).

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The PoP shall be 12 months from date of award, with three (3) 12-month option period and two (2) Optional Tasks.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Efforts under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their Task Execution Plan submission.

TRAVEL

The Government does not anticipate any travel to perform the tasks associated with the effort, throughout the PoP.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following tasks and provide the specific deliverables described below within the performance period stated in Section 4.1 of this PWS.

Agile project management is evolutionary (iterative & incremental) which regularly produces high quality results in a cost effective, timely, and highly collaborative manner. This requires open lines of communication among all participants contributing to a project/program/portfolio that includes multiple consumers within the contracts and with other VA offices/activities.

Backlog grooming and prioritization are continued throughout the product lifecycle and shall be managed throughout the PoP.

The foundational structure for VA Agile development and project management can be found in the VIP Guide. The Contractor shall utilize VA-approved tools and Enterprise Program Management Office (EPMO) website templates for delivering project artifacts, managing project execution details, and managing artifact storage.

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline and tools to be used in execution of this PWS effort. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of this Contract. The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

REPORTING REQUIREMENTS

The Contractor shall use the VA’s implementation of the JIRA/GitHub Toolset to provide a single Agile project/product lifecycle management tool to track execution details. The JIRA/GitHub Project/Product Data and Artifact Repository will be used to provide a single authoritative project for product data and artifact repository. All OI&T project data and artifacts will be required to be managed in this data and artifact repository daily. All checked out artifacts and data shall be checked back daily. JIRA/GitHub synchronizes all changed information immediately for all team members to access work proficiently without the concern of working on aged information.

The Contractor shall use VA JIRA/GitHub to:

1. Input and manage scheduled project/product sprints and backlog

2. Input and manage project/product Agile requirements

3. Input and manage project/product risks and issues

4. Input and manage project/product configurations and changes

5. Input and manage project/product test plans and execution

6. Input and manage project/product planning and engineering documentation

7. Input and manage linkages to correlate requirements to change orders, configurable items, risks, impediments, and issues to test cases and test results to show full traceability.

The Contractor shall log each issue or incident that they receive and work into the PDMP SharePoint incident tracker. The Contractor shall provide technical support for major incidents - including reporting/tracking of issues responded to, root cause analysis of major issues, with planned mitigations to avoid recurrence, reporting. The Contractor shall provide notification on software releases and updates. The Contractor shall provide data validation for any enhancements or major fixes.

The Contractor shall show all Agile requirements, changes, tests performed and test results in JIRA/GitHub to show evidence of code coverage and test coverage of all the requirements specified. This expectation will allow VA to have high confidence in a fully documented, requirements traceability matrix, as evidenced by data in the tools.

The Contractor shall deliver Biweekly (every two weeks) Status Reports detailing the status of all work efforts. These reports shall provide accurate, timely, and complete project information supporting reporting requirements. The Biweekly Status Report shall include the following data elements:

1. Project Name and Contract/TO Name

2. Overview and description of the Contract/TO Name

3. Overall high-level assessment of the Contract/TO Name progress

4. All work in-progress and completed during the reporting period

5. Identification of any Contract/TO Name related issues uncovered during the reporting period and especially highlight those areas with a high probability of impacting schedule, cost or performance goals and their likely impact on schedule, cost, or performance goals

6. Explanations for any unresolved issues, including possible solutions and any actions required of the Government and/or Contractor to resolve or mitigate any identified issue, including a plan and timeframe for resolution

7. Status on previously identified issues, actions taken to mitigate the situation and/or progress made in rectifying the situation.

8. Work planned for the subsequent four reporting periods, when applicable

9. Current Contract/TO Name schedule overlaid on original Contract/TO Name schedule showing any delays or advancement in schedule

10. Current definition the of user requirements / function points overlaid over the original function points and the last reported function points to specifically identify changes in the function points to be delivered since the previous report.

11. Workforce staffing data showing all Contractor personnel performing the effort during the current reporting period. After the initial labor baseline is provided, each Biweekly Status Report shall identify any changes in staffing identifying each person who was added to the contract or removed from the contract.

12. Original schedule of deliverables and the corresponding deliverables made during the current reporting period.

13. Identification of a single Contractor Onboarding POC, the names of all personnel engaged on the task, their initial training date for VA Privacy and Information Security training, and their next required training date.

These reports shall not be the only means of communication between the Contractor, Contracting Officer Representative (COR) and the VA Program/Project Manager to advise of performance/schedule issues and to develop strategies for addressing the issues. The Contractor shall continuously monitor performance and report any deviation from the CPMP or previous Biweekly Status Report to the COR and VA Program/Project Manager during routine, regular communications.

Deliverable:

A. Biweekly Status Report B. After Incident Report

TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after Contract award. The Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five (5) calendar days prior to the meeting. Upon Government approval of the final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the Prescription Drug Monitoring Program (PDMP). The Contractor shall submit the final updated presentation to the CO for review and signature within three (3) calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR and all attendees within three (3) calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

VA MANDATORY TRAINING

The Contractor and VA Project Manager (PM) shall determine which team members require access to the VA network and JIRA/GitHub. All Contractors that require access shall complete all the required VA Talent Management System (TMS) training courses within fourteen (14) days of the identification of the access need. The Contractor shall work with its respective point of contact, to obtain access to TMS to complete the mandatory training courses.

As an action under the Continuous Readiness in Information Security Program (CRISP), VA's Assistant Secretary for Information and Technology issued a memorandum requiring all VA government and contract staff to complete information security awareness and applicable role-based training. The Contractor shall submit TMS Training Certificates of completion for VA Privacy and Information Security Awareness (PISA), Rules of Behavior (ROB), Health Insurance Portability and Accountability Act (HIPAA), and Role-Based trainings. The Contractor shall provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”.

The Contractor shall complete the required VA TMS courses for all contractors with required access to JIRA/GitHub as required by VA OIT.

Contractors who have completed the required VA training courses within the past twelve (12) or twenty-four (24) months, depending on the training requirements, and have furnished training certificates to VA, will not be required to re-take the training courses.

Deliverables:

C. TMS Training Certificates D. Signed Contractor Rules of Behavior

ONBOARDING

The Contractor shall manage the onboarding of its staff. Onboarding includes steps to obtain a VA PIV card, network and email account, complete training, initiate background investigations, and gain physical and logical access. In addition, the Contractor shall identify individuals which may require elevated privileges to the necessary development and test environments for the various systems to be enhanced. After reviewing between the Contractor and VA COR, a decision will be made by the VA COR as to the necessity of obtaining GFE for the onboarding staff. If approved by the VA COR, Contractor shall follow the appropriate steps to obtain the equipment.

A. A single Contractor Onboarding Point of Contact (POC) shall be designated by the Contractor that tracks the onboarding status of all Contractor personnel. The Contractor Onboarding POC shall be responsible for accurate and timely submission of all required VA onboarding paperwork to the VA COR. The Contractor shall be responsible for tracking the status of all its staff’s onboarding activities to include the names of all personnel engaged on the task, their initial training date for VA Privacy and Information Security training, and their next required training date. The Contractor shall provide a Resource Summary Report whenever there are changes with onboarding and offboarding. The Contractor Onboarding POC shall also report the status at the staff level during onboarding status meetings. The Contractor shall provide an Onboarding Status Report weekly for any staff with outstanding onboarding requests for review by the COR, VA PM and PM.

Deliverable:

B. Onboarding Status Report C. Resource Summary Report

SCHEDULE MANAGEMENT

The Contractor shall create and maintain an Integrated Master Schedule (IMS) for all activities and full scope described in the PWS. The Contractor shall provide the IMS, using a COR approved tool with input from the VA PM. The IMS Work Breakdown Structure (WBS) shall reflect the Agile lifecycle and include tasks to capture effort driven activities and key incremental milestones (e.g. sprints, feature freeze, deployment of code to SQA and UAT, completion of PWS documentation, etc.). The IMS shall include internal interface milestones (outside the Contractor team but within the OIT project team) and external interface milestones (independent partner organizations or systems) in order to communicate the various multi-team activities that are critical to project success. The tasks should, at a minimum, be of enough detail to communicate the plan and steps required to execute the PWS, have logical relationships, and reflect the project schedule critical path. Long lead activities (e.g. environment access) and at- risk tasks should be captured in the IMS and highlighted as part of routine reporting.

The Contractor IMS shall align with overall project milestones as required and covered in this PWS. The Contractor shall consider external partner timelines and their impact on project success, as well as support any scheduling and planning discussions and as is appropriate, with dependent partners.

The Contractor shall provide biweekly schedule updates demonstrating progress completion by task and highlighting any key shifts in duration, milestones or project schedule critical path to previously agreed IMS. The Contractor shall ensure alignment and collaboration with the overall Project IMS dates and progress.

The Contract shall provide ad-hoc updates and critical path updates as they arise and are beneficial to protect committed delivery timeline.

A. Integrated Master Schedule

CONFIGURATION MANAGEMENT

The Contractor shall :

1. Deliver a Recommended List of Configuration Items, which is input into the Configuration Management (CM) Plan, to be placed under configuration and change control. The Contractor shall identify types of configuration items pertaining to each product to be placed under configuration management. Based on EPMO requirements, and the unique needs or nature of each project, the Contractor shall determine the components within each project that must be under configuration control.

2. Use JIRA/GitHub as the VA approved tool and repository for all software source code and electronic artifact configuration and version management. The Contractor shall use JIRA/GitHub tool to manage change, activity, issue, action, risk, and other project data as prescribed by VA standards and processes. If assigned a project using tools that are being deprecated, the Contractor shall assist the VA Tools Team in migrating projects using other Change and/or Configuration Management tools to the JIRA/GitHub.

3. Ensure that all project software and non-software artifacts are versioned correctly according to VA standards and follow a build/release promotion versioning approach which identifies all major, minor, and update changes to the components.

4. Create Project and Product Artifacts baselined and versioned in the CM repository to allow the tool to show active and past histories of the check-ins and check-outs of all software components, data, and software project engineering documents. Maintain all baselines of software, software builds, and electronic artifacts in the repository, labeling updates and versions according to CM procedures.

5. Develop, verify and submit with all project build deliveries, a Version Description Document (VDD) that addresses the manifest of the contents of all software builds created for project releases outside the development environment.

6. Update the Production Operations Manual (POM) and the Deployment and Installation Guide if impacted by any releases.

7. Establish and maintain status reporting on change and configuration management activity and ensure JIRA/GitHub data records and artifacts are filed and updated daily.

8. Assist with setup of all the environments needed in the middleware as required to complete required build development and testing. Coordinate with VA to ensure alignment with all development and test environments.

9. Support any security accreditation requirements to obtain/maintain approval, as required. Required artifacts must be obtained prior to build release and approval timelines, including all necessary security scanning and remediations, must be considered in build planning activities.

10. Ensure automated build tools are in compliance with the approved list from the One-VA TRM and code shall be demonstrable and stable enough to be promoted to another environment without issue by evidence of the status of tests and results in JIRA/GitHub.

Deliverable:

A. Version Description Document

PDMP SOLUTION SUSTAINMENT

The Contractor shall maintain the existing VA PDMP Solution to include existing Intersystems Healthshare, PMP Gateway, and the PDMP Transaction Dashboard that enables Veterans Health Administration (VHA) users to query from Computerized Patient Records System (CPRS) all available state PDMPs through a clearinghouse both in real-time and with the ability to accommodate batch processing.

A. PMP Gateway license

MIDDLEWARE REQUIREMENTS FOR PARTICIPATING AND NEW ONBOARDING STATES

The Contractor shall use InterSystems HealthShare, which is deployed within VA, to communicate between all VistA instances and the PDMP clearinghouse. The Contractor shall be a certified InterSystems HealthShare Implementation Partner.

The Contractor shall make any necessary modifications and support implementation in order for the middleware to:

1. Receive PDMP query requests from each of the instances of VistA.

2. Send PDMP query requests to the clearinghouse.

3. Return error responses to VistA if the clearinghouse is unavailable.

4. Receive PDMP query responses from the clearinghouse.

5. Write PDMP query response data to instances of VistA.

6. Maintain system logging in VistA for every transaction passed through the middleware as part of the PDMP Solution.

CLEARINGHOUSE REQUIREMENTS

The connection to the PDMP clearinghouse, in the form of the PMP Gateway, shall continue to be hosted in an external cloud environment. The SaaS must maintain FedRAMP Authorization by adhering to the FedRAMP Continuous Monitoring Guide, which also complies with the Federal Information Security Management Act (FISMA). The PDMP clearinghouse shall have an available test environment, and should continue to have the following capabilities:

1. Is connected to all existing State PDMPs to include Puerto Rico, Guam, the District of Columbia, and Federal (DoD), and will be updated to connect to any new operational State PDMPs. One of the final two states left to join VA’s PDMP Integration, California has been connected and shall require fixes for this Task Order. Nebraska, the remaining state, will be connected during this task order and the gateway and interfaces shall be configured to interoperate between PDMP and the Nebraska system.

2. Is connected to the VA middleware, in order to connect to all of the VistA instances.

3. Use industry standard Application Programming Interfaces (APIs) to receive and return PDMP query requests/responses from the VA middleware.

4. Provide an audit record for every query processed for any authorized user regardless of the outcome of the query.

5. Query all existing states for every PDMP query originating from VA, in compliance with Federal MISSION Act Section 134, which supersedes existing state sharing regulations.

6. Return all available data with identifiers that match the patient from the query.

7. In the case of potentially matching data, the returned response will include a message notifying data that may match the queried patient.

8. Return descriptive error messages for failed queries.

9. Return descriptive messages for queries that succeeded but retrieved no PDMP data for the queried patient.

The Contractor shall provide resources to work with VHA and states to address access/sharing restrictions and provide regular reports and end of year summary report of accomplishments. The Contractor shall provide and maintain in real-time a data matrix and visual tool that captures and displays state-by-state participation, sharing, and access/role restrictions.

The Contractor shall perform end-to-end data validation for the integration of any new states.

Deliverable:

A. State Sharing Report/Tool B. Quarterly and End-of-Year Summary Report

NON-FUNCTIONAL REQUIREMENTS

The PDMP Solution shall continue to comply with non-functional requirements that assure performance, reliability, and security to include Intersystems Healthshare, PMP Gateway, and the PDMP Transaction Dashboard. Compliance requires that the solution provides capacity for all registered VA users including providers with Drug Enforcement Administration (DEA) registration, their delegates, and pharmacists with National Provider Identifier (NPI) numbers, estimated up to 100,000 nonconcurrent users. Returns requested data within 15 seconds. Supports the return of responses with large amounts of data. Functions according to stated business requirements 99.9% of the time outside of scheduled maintenance windows.

1. Notifies the VHA clinician, delegate, or administrative personnel in instances when and why the query has failed.

2. Captures the specifications of the clearinghouse availability/uptime and response time and maintenance windows within the Service Level Agreement (SLA) of the clearinghouse.

3. Provides system logging, to include storage of the duration and frequency of times system is not available along with the specific reasoning/error codes.

PDMP SOLUTION ENHANCEMENTS

The Contractor shall provide enhancements for functional and non-functional PDMP Solution capabilities to include Intersystems Healthshare, PMP Gateway, and the PDMP Transaction Dashboard. These enhancements are documented in the PDMP backlog for future work in JIRA/GitHub. Some of these non-functional enhancements include adaptive/preventative maintenance activities. Examples include, but are not limited to, regulatory changes, Congressional actions, VA mandates, and changes required to maintain interoperability with key systems such as Identity and Access Management (IAM), VA Enterprise Cloud and Corporate Data Warehouse (CDW) (or equivalent), scheduled maintenance, activities to retain or restore the solution (such as testing, measurements, replacements, and adjustments), and other routine work required to maintain and/or enhance the solution.

PLANNING

The Contractor shall participate in project planning with VA stakeholders, to include requirements assessment, design, development, and testing. This shall include Intersystems Healthshare, PMP Gateway, and the PDMP Transaction Dashboard. The Contractor shall collect, draft, coordinate, enter, and update project planning data in JIRA.

The Contractor shall continuously support the installation and configuration to complete the epics and user stories used to complete any agile development.

The Contractor shall participate in sessions with the VA team to properly understand and elaborate business agile requirements. The outcome of these sessions shall be a review of, and agreement to, the user stories, including user stories added as a result of backlog grooming by decomposing epics, business requirements, business rules, requirements visualizations and user story elaborations.

The Contractor shall:

1. Assist in assuring that all epics, including Mandatory OI&T Compliance Epics, are identified, included, prioritized, and sized as appropriate within the overall product backlog grooming effort.

2. Coordinate with VA during planning sessions identifying all features the team considers relevant to building the solution.

3. Work with application subject matter experts and facilitate any stakeholder briefings, meetings and elicitation sessions.

4. Execute their assigned requirements reviews with stakeholders and record results and update requirements data as a result of the reviews.

5. Identify the development and test environment access that is needed 30 days prior to the build start.

6. Assist in assuring that all epics, stakeholder needs, visualizations, stories, and other sources of requirement information for functional and non-functional requirements are input and maintained in JIRA. All requirement data is under change control and is fully linked to work items that show traceability to design changes, configurable items, test cases, and test results.

TESTING .

The Contractor shall adopt Agile best practices for integration testing. This shall include Intersystems Healthshare, PMP Gateway, and the PDMP Transaction Dashboard.The Contractor shall provide input to the Master Test Plan, in VA’s implementation of JIRA tool, within 15 days after the Technical Kickoff Meeting. The Contractor shall conduct test phases (e.g. unit, system, reliability, interoperability, security, performance) throughout the Software Lifecycle (SLC) (e.g. user story, sprint, build, release) using industry best practices of continuous integration methods and automated regression testing utilities using VA TRM approved tools. The Contractor shall record all planned tests in the JIRA. The Contractor shall conduct testing related to non-functional requirements (e.g. load, performance, installation, back-out, and rollback).

The Contractor shall provide Test Data and Test Cases in the JIRA following the templates and data requirements associated with each test objective in each phase of the SLC.

The Contractor shall support other required tests and Test Readiness, to include Integration, End-to-End (PDMP clearinghouse to targeted system) testing, technical standards, architectural compliance, user acceptance testing, audits, and reviews. The Contractor shall test the request and response APIs, and modify if necessary.

The Contractor shall ensure that results of all assessments of the project performed by the Contractor or by VA offices are consolidated into JIRA for planning and status reporting.

The Contractor shall develop and manage test data that shall be used for testing. Test data files shall include all the information that will be submitted to VA and accessed by business processes. The Contractor shall clarify the business requirements associated with the test data. The Contractor shall ensure that the test data size and information contained is adequate to conduct performance type testing in addition to negative and positive tests. The Contractor shall assist with the development of data needed during the defined test phases.

The Contractor shall ensure the identified VA approved version control tool data is up-to-date daily so that VA stakeholders can access the information in an accurate and timely status. The Contractor shall log all identified defects during testing with the associated severity level and current disposition in identified VA approved version control tool. The Contractor shall facilitate test status and defect review meetings.

Deliverables:

A. Test Data B. Test Cases C. Test Results

ENHANCEMENT WARRANTY

Upon completion of the product build release, for a period of 90 days each, the Contractor shall provide defect management support and coordination. The Contractor shall provide defect repair support to VA as the software is released into production. Defect correction can be planned for a patch to the existing production version or will be placed in the product backlogs for sustainment. Defects may be identified by the Government Project Manager, users, Help Desk, or Business/Product Owners as communicated through the COR. For each defect identified, the Contractor shall triage the defect in accordance with the table below, identify a resolution for the defect, and provide a plan for resolution, including timeline and impacts to the code and updates to JIRA. The Contractor shall deliver a Monthly Post Deployment Support Report and Monthly Defect Resolution Plan and follow escalation procedures as necessary with the COR. Following COR approval of the Defect Resolution Plan, the Contractor shall execute the approved plan.

RESPONSE TIMES FOR TIER 2 AND TIER 3

minutes minutes

2 – Serious

3 – Moderate

Deliverables:

A. Monthly Post Deployment Support Report B. Monthly Defect Resolution Plan

ASSESSMENT, AUTHORIZATION AND CONTINUOUS MONITORING

The Contractor shall provide support, applicable documentation, and coordination to ensure consistency with security accreditation requirements. The Contractor shall ensure that the solution continues to meet VA information security policies and standards.

The Contractor shall adhere to the following assessment, authorization and continuous monitoring plan:

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA) and have a current VA authorization.

2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The FedRAMP Authorization level and existing VA ATO should be no less than the level required for this use case which has been defined as moderate.

4. The Contractor shall, where applicable, assist with the VA ATO Sustainment Process to help maintain health and quality of agency authorization of the cloud service or migrated application.

5. The Contractor shall exclusively provide licenses and/or accounts to FedRAMP authorized and VA authorized environments.

6. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases.

7. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with Addendum B, VA Information and Information System Security/Privacy Language.

8. The Contractor shall comply with data management requirements.

9. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

10. The Contractor shall participate in monthly Agency and FedRAMP Sustainment meetings following the granting of a VA ATO.

11. The Contractor shall provide continuous monitoring activities including scans, security artifacts, and monthly Plan of Action and Milestones (POAM) reports as outlined by FedRAMP requirements.

SECURITY INCIDENT INVESTIGATION

The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The Contractor/Subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the Contractor/Subcontractor has access.

To the extent known by the Contractor/Subcontractor, the Contractor/Subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the Contractor/Subcontractor considers relevant.

With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

In instances of theft or break-in or other criminal activity, the Contractor/Subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement.