Performance Work Statement VA-24-00016627 Draft VA Audio Response SaaS.docx

VA Audio Response SaaS Solution

VA-24-00016627

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Integrated Veteran Care (IVC)

VA Audio Response Software as a Service (SaaS) Solution

Date: October 19, 2023

VA-24-00016627

PWS Version Number: 1.4

Contents

BACKGROUND

The Department of Veterans Affairs (VA) Office of Integrated Veteran Care (IVC) and the Office of Information & Technology (OIT), strive to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of their health care in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

It is essential that Veterans get the same information about their care no matter which digital touchpoint they interact with. VHA is seeking a commercial turnkey healthcare Interactive Voice Response (IVR) technology solution delivered in a Software as a Service (SaaS) application model which includes software license manager technology such as FlexLM or FlexNet. The AudioCARE product is currently in use at 140 VA Medical Centers (VAMCs) throughout the United States, Puerto Rico, and the Philippines. There are 155 instances to include preproduction and test environments.

The Enterprise solution will cover all VA Medical Centers across the enterprise. The VA Audio Response IVR technology is needed to support the following Business Functions:

· Provides VA Medication Services,

· Provides Reminders for Preventative Care,

· Monitors and Follows-up on Patients Health Status and Outcomes, and

· Provides Patient Care Education.

SaaS is an application delivery model in which the application is hosted on a cloud infrastructure outside the security boundary of VA and is provided to the Cloud Service Customer (CSC) over the internet (Software hosted in VA Enterprise Cloud (VAEC) does not meet this definition of SaaS). The CSC uses the SaaS offering via a thin-client interface, such as a web-browser or a program interface. The CSC subscribes to the SaaS offering and is only responsible for limited application configuration settings. The Cloud Service Provider (CSP) offering the application is responsible for management of the application, safeguarding of data stored or processed by the application, and all elements of the underlying infrastructure.

In order to qualify as SaaS for use at VA, and to align with FedRAMP requirements, the hosting for the offering must conform to the National Institute of Standards and Technology (NIST) 800-145 definition of Cloud Computing and thus contain following key characteristics:

· On-Demand Self-Service: The CSP fully automates the provisioning of both the customer interface and the underlying cloud components of the SaaS offering. In some cases, the CSP may provision internal resources manually, while providing the CSC an automated interface to request and track the service.

· Broad Network Access: The SaaS capabilities are available over the internet or over a network that is available from all access points the CSC requires. The SaaS offering is accessible through common platforms (e.g., mobile phones, tablets, laptops, and workstations).

· Resource Pooling: The computing infrastructure supporting the SaaS offering is shared among more than one CSC using a multi-tenant model, and resources are dynamically assigned depending on customer demand.

· Rapid Elasticity: Computing capabilities are automatically provisioned and released in a manner that scales with customer demand. In some cases, the scaling of resources may not be fully automated, but it should be fast enough to support the needs of the CSC, which the CSC would have to define.

· Measured Service: Resource usage, such as storage, processing, bandwidth, and user activity are measured and reported on in a manner that is relevant to the SaaS offering.

The SaaS offering must be hosted within the United States and data stored/processed/transmitted within the offering must remain within the United States.

CSPs should be aware of FedRAMP and ready to partner with VA through the SaaS FedRAMP Authorization process. For additional FedRAMP, Authorization and Continuous Monitoring requirement refer to Section 5.2.4. More information can be found here:

· https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-145.pdf

· https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.500-322.pdf

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21, 2018

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

SCOPE OF WORK

The Contractor shall provide commercial, turnkey healthcare Interactive Voice Response (IVR) technologies known as VA Audio Response moving forward to users across the VHA enterprise delivered in a Software as a Service (SaaS) application model, FedRAMP authorized at a high impact level and hosted in the Contractor’s cloud environment . .

The Contractor shall provide implementation and integration support, software licenses, software license manager technology (i.e., FlexLM,FlexNet) , software maintenance which includes periodic updates, enhancements, and corrections, technical support, Tier 3 independent help desk support, utilization reporting, virtual staff user training and outgoing transition support for the VA Audio Response solution.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The PoP shall be twenty-four (24) months for the base period with five (5) twelve (12) month option periods and three (3) Optional Tasks.

The Annual Enterprise SaaS License Subscription Optional Task shall have a PoP of 365 calendar days or 1 year from date of option exercise and may only be exercised once during the period of performance in either the base or any option year. Performance of the Annual Enterprise SaaS License Subscription Optional Task and may extend beyond the period of performance in which the optional task was exercised in.

The Annual Maintenance and Support Subscription Optional Task shall have a PoP of 365 calendar days or 1 year from date of option exercise and may only be exercised once during the period of performance in either the base or any option year. Performance of the Annual Maintenance and Support Subscription Optional Task and may extend beyond the period of performance in which the optional task was exercised in.

The Outgoing Transition Optional Task shall have a PoP of 120 calendar days from date of option exercise and may only be exercised once during the period of performance in either the base or any option year. Performance of the Outgoing Transition Optional Task and may extend beyond the period of performance in which the optional task was exercised in.

The overall Period of Performance shall not exceed eighty-four (84) months.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed primarily at Contractor facilities but may include Government sites within the continental United States (CONUS) (e.g., to the five (5) Regional OI&T sites). The Contractor shall identify the Contractor’s place of performance in their proposal submission.

TRAVEL

The Government encourages the Contractor to maximize its use of teleconferencing and video conferencing for meetings.

The Government anticipates the need for some travel under this effort to perform the tasks associated with the effort throughout the PoP as well as to attend program-related meetings or conferences. Travel costs will be directly reimbursed by the Government.

The total estimated number of trips in support of implementation for this effort is one (1) to five (5) trips at five (5) days in duration each.

Travel shall be in accordance with the Federal Travel Regulations (FTR) and requires advanced concurrence by the COR. Contractor travel within the local commuting area will not be reimbursed.

SPECIFIC TASKS AND DELIVERABLES

The Government shall review each deliverable within five (5) business days of receipt and shall provide comments. The Contractor shall have three (3) business days to incorporate the Government ‘s comments and make appropriate revisions.

The Contractor shall perform the following:

PROJECT MANAGEMENT

The Contractor shall perform the following tasks and shall perform all the support services and deliverables listed in the sections below.

For delivery of all project artifacts, the Contract shall utilize approved Process Asset Library (PAL) templates (refer to Section 2.0). When no PAL template exists, the Contractor shall design and develop a template that shall be reviewed and approved by the VA COR and/or VA PM or designee prior to delivery of the associated artifact.

All documents shall be created using Microsoft Word, Microsoft Excel, Microsoft PowerPoint, and/or Microsoft Project. All draft documents shall be delivered in one of these formats. All final documents shall be delivered in one of these formats as well as PDF. Additionally, all shared documents shall also be in one of the above formats. The VA will have ten (10) business days to review and provide feedback and/or approval to the Contractor regarding all deliverables set forth in this contract. The Contractor shall have five (5) business days from receipt of the Government’s comments to provide the final deliverable.

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach (implementation plan), timeline (project schedule), and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

The Contractors Project Management Plan shall specifically address the initial security planning, completion of the SSP, obtaining of Authority to Operate (ATO), each phase of installation, configuration, and implementation of the enterprise-wide VA Audio Response.

Deliverable:

A. Contractor Project Management Plan (CPMP)

TECHNICAL KICK OFF MEETING

A technical kickoff meeting shall be held within ten (10) business days after award. The Contractor shall coordinate the date, time, and location (can be virtual) with the CO, Contract Specialist (CS), VA COR, and the VA IVC Project Manager (PM) or their assigned designee(s). The Contractor shall provide a draft agenda to the CO and VA COR at least five (5) business days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan and project schedule via a Microsoft Office PowerPoint Presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements or disagreements discussed during the kickoff meeting to be distributed with the meeting minutes. The Contractor shall prepare and distribute meeting minutes of kickoff meeting to the CO, VA COR, and all attendees within three (3) business days after the meeting. The Contractor shall obtain concurrence from the CS/CO on the content of the meeting minutes prior to distribution of the document.

Deliverables:

A. Technical Kickoff Meeting Agenda B. Technical Kickoff Meeting PowerPoint Presentation C. Technical Kickoff Meeting Minutes

REPORTING REQUIREMENTS

The Contractor shall provide the VA COR and VA Project Manager (PM) or their designee(s) with the Monthly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall also include:

1. Previous month’s work completed including tickets and change orders

2. Detailed information specifying the issues and resolutions for those issues

3. Detail on planned activities for the upcoming month

4. Testing (testing preproduction system):

a. State current testing initiatives including site location of that testing

b. Results of previous months testing

c. Upcoming testing that is planned

d. Testing Plans These reports shall reflect data as of the last day of the preceding month.

The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly, so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

The Contractor shall provide a Contractor Security Control Assessment (CSCA) and Privacy Impact Assessment (PIA) on a six-month basis as part of the contract and submit to the Information Security Officer (ISO) and Privacy Officer (PO) for review and approval. The Contractor shall coordinate these deliveries with the VA PM or their designee(s) to ensure approvals are obtained.

The Contractor shall keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

The Contractor shall meet with the VA PM and/or their designee(s) weekly to discuss the progress status of the work accomplished and day-to-day operations. The Contractor shall provide Weekly Status Meeting Minutes. During this call the Contractor shall brief the VA PM, and/or their designee(s) on known problems (e.g., issues, risks) and provide an explanation including their plan and timeframe for resolving the problems based upon an agreed upon meeting schedule.

The Contractor shall notify the VA PM and/or their assigned designee(s) and VA COR, in writing, immediately if problems arise adversely impacting the performance of the PWS.

Deliverables:

A. Monthly Progress Report B. Contractor Security Control Assessment (CSCA) C. Privacy Impact Assessment (PIA) D. Weekly Status Meeting Minutes

CONTRACTOR STAFF ONBOARDING OFFBOARDING

The Contractor shall manage the onboarding and offboarding of its staff. Onboarding includes steps to obtain a Personal Identity Verification (PIV) card, network and email account, complete training, initiate background investigations, and gain physical and logical access. A single Contractor Onboarding Offboarding Point of Contact (POC) shall be designated by the Contractor that tracks the onboarding status of all Contractor personnel in an Onboarding Offboarding Status Report. The Contractor Onboarding Offboarding POC shall be responsible for accurate and timely submission of all required VA Onboarding and Offboarding paperwork to the VA COR.

The Contractor shall track the names of all personnel engaged, their initial training date for VA Privacy and Information Security training, and their next required training date. Any resource that does not complete VA mandated training shall not be permitted to perform under this effort.

The Contractor shall submit status of all VA mandatory training requirements in a Training Summary Report that includes VA Privacy and Information Security Awareness and Rules of Behavior VA 10176; and Privacy and Health Insurance Portability and Accountability Act (HIPPA) Training VA 10203 for all individuals engaged on the contract. The status reporting shall identify: a single Contractor Security POC, the names of all personnel engaged on the contract, their initial training date for training, and their next required training date as well as copies of their certificates of completion. Contractors who have completed these training courses within the past twelve (12) or twenty-four (24) months, depending on the training requirements, and have furnished training certificates to VA, will not be required to re-take the training courses.

The Contractor shall comply with the Contractor personnel security requirements as defined in Section 6.2.2.

The Contractor shall also submit completed Non-Disclosure Agreement (VA Form 0752) and completed annual Contractor Rules of Behavior forms for all personnel engaged on this contract.

The Contractor shall submit VA Privacy and Information Security training certificates in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security.”

The Contractor shall ensure that all personnel have completed any and all required elevated permissions training prior to giving any elevated permissions to production or pre-production environments as deemed by the VA’s Security regulations. The Contractor shall provide Elevated Permissions Training Documentation.

Deliverables:

A. Onboarding Offboarding Status Report B. Training Summary Report C. VA Talent Management System (TMS) Training Certificates of Completion D. Signed Contractor Rules of Behavior Contractor Staff- Contractors Rules of Behaviors: VA Handbook 6500.6 Appendix D E. Signed Contractor Non-Disclosure Agreements: VA Form 0752 F. Elevated Permissions Training Documentation

VA AUDIO RESPONSE IMPLEMENTATION AND INTEGRATION

The Contractor shall provide services, resources, and tools to support successful implementation and maintenance of the VA Audio Response solution as a subscription service with floating license(s) utilizing a Flexible License Manager or FLEXLM system for a single region, the VA Enterprise. The Enterprise solution shall consist of an estimated 171 licenses per module (e.g., pharmacy, scheduling, clinical, financial, etc.)

The VA Audio Response solution shall leverage existing VA solutions on the back end when applicable.

VA AUDIO RESPONSE INTERFACE AND INTEGRATION REQUIREMENTS

The Contractor shall configure and maintain the VA Audio Response solution to ensure full compatibility with any Electronic Health Record (EHR) in use by the Department of Veterans Affairs (VA) during each period of performance.

The Contractor shall provide a functional and bidirectional interface between the VA Audio Response solution and the EHR with capabilities for inbound and outbound automated communications (via Interactive Voice Response IVR) to Veterans through telephone, webservices, and Short Message Service (SMS) text messages.

The Contractor shall provide all Middleware software and cloud services needed for implementation of the VA Audio Response solution.

The Contractor shall provide all VA system and VA sub-systems interfaces and integrations (e.g., VistA/Computerized Patient Record System (CPRS)/Cerner, My HealtheVet (MHV), HealtheIntent/HealtheLife – Cerner, VA Notify/Telephony, VA Notify/VEText, VA Unified Communications Integrators (UCI) telephony systems, Consolidated Mail Outpatient Pharmacy (CMOP), web portal, mobile applications, VA.gov flagship mobile app, and chat bot/health chat) required for VA Audio Response system implementation.

The Contractor shall work with the appropriate system partners named above to ensure that for any Veteran-facing IVR product, the audio information provided by the VA Audio System is consistent with the audio information being provided to Veterans or VA approved Caregivers via other Veteran-facing products.

The Contractor shall reuse existing Application Programming Interfaces (APIs) where applicable, (e.g., pharmacy and scheduling domains).

The Contractor shall ensure successful interface and integration with any EHR in use by VA allowing for configurable bidirectional interface for collecting, processing, and transmitting of Personally Identifiable Information (PII) and Personal Health Information (PHI) required for VA Audio Response solution implementation.

The Contractor shall collaborate with Cerner/ Electronic Health Record Modernization (EHRM) and VA OI&T personnel to accomplish the configuration work for the integration and interfaces with Oracle Health Millennium Platform and VistA.

The VA PM and/or their designee(s) shall be responsible for the coordination of all activities related to the interfaces and integrations.

The Contractor shall work with EHRM Integration Office (IO), and VA OI&T obtain proper access to the required testing and production environments.

The Contractor shall conduct integration validation testing to ensure data is flowing properly from VA Audio Response to any ERH System in use by VA.

The Contractor shall:

a) Conduct hands-on validation testing with users,

b) Evaluate integration testing results to determine readiness, and

c) Adjust integration functionality as required for acceptance to ensure technical requirements are complete, accurate and functional. The Contractor shall document the integration testing execution and provide the results in an Integration Test Results Report.

The Contractor shall deliver the Functional Design Document, a Contractor’s IP Test Analysis Summary Report, a Release Plan, the Validation Test Plans, and a VA Acceptance Memo.

The VA Audio Response system shall be delivered without critical or major defects. A critical defect indicates complete shut-down of the process, nothing can proceed further. And a major is a highly severe defect and collapses the system. However, certain parts of the system remain functional.

Upon Government acceptance of the fully configured VA Audio Response solution, the Contractor shall document and deliver an Interface Design Document (IDD).

Deliverables:

A. Interface Design Document B. Integration Test Report C. Validation Test Plans D. Project Roadmap and Project Schedule E. Functional Design Document F. Contractor IP Test Analysis Summary Report G. Release Plan H. VA Acceptance Memo

VA AUDIO RESPONSE SYSTEM AND SOFTWARE REQUIREMENTS

The solution shall include software license manager technology such as FlexLM or FlexNet: and an annual maintenance and support subscription for the IVR technologies. VA Audio Response shall be a vendor cloud hosted offering and FedRAMP certified at a high impact level. The Contractor shall provide software licenses, software license manager technology, software maintenance which includes periodic updates, enhancements, and corrections; technical support and Tier 3 independent help desk support; utilization reporting; and virtual staff user training.

The Contractor shall provide a VA Audio Response solution that meets the standard across the commercial and Government markets for Service Level Agreement (SLA) 99.9% uptime for moderate level systems. Uptime is the measure of system reliability, expressed as the percentage of time the system has been working minus downtime associated with scheduled maintenance.

The Contractor shall coordinate with Government key stakeholders in the performance of this contract.

The VA Audio Response solution shall accommodate individuals (e.g., Veterans or a VA approved Caregiver; and VA staff users) with vision impairments (e.g., audio navigation/audio mode, font size configuration, characters shall contrast with their background with either light characters on a dark background or dark characters on a light background). The VA Audio Response solution shall meet the standards of the Social Security Administration’s (SSA) definition of legal/statutory blindness (See 20 C.F.R. Part 404, Subpart P, App. 1, Section 2.00 (Special Senses and Speech)). The VA Audio Response solution shall be complaint with 508 requirements as stated in http//www.section508.gov.

The VA Audio Response software shall have 2-factor authentication that does not require the use of Social Security Number (SSN) or Protected Health Information (PHI).

The software license provided to the Government shall be a nonexclusive license to use the software. The Government requires delivery of computer software that does not contain any code that will, upon occurrence or the nonoccurrence of any event, disable the software. The computer software shall be complaint with Privacy Act, Health Insurance Portability and Accountability Act of 1996 (HIPAA); Federal Information Security Modernization Act (FISMA), National Institute of Standards and Technology (NIST), Federal Information Processing Standards (FIPS), and VA security and privacy directives and handbooks.

The VA Audio Response solution shall be hosted in the Contractor’s cloud environment. VA requires a VA Audio Response solution that is FedRAMP certified at a high impact level at time of award. The Contractor shall ensure compliance with the Federal Risk and Authorization Management Program (FedRAMP). (As described in Section 5.2.4)

The Contractor shall provide an VA ATO Approval Plan specific to receiving an Authority to Operate (ATO) within VA. The Contractor shall coordinate with applicable Veterans Affairs stakeholders for an Authority to Operate to interface the hosted environments to the Veterans Affairs Network. The Contractor shall work with the VA PM or their designee(s) on obtaining and maintaining a VA ATO. (As described Section 5.2.5)

For the duration of the contract, the Contractor shall deliver, and update all required artifacts necessary to maintain both the FedRAMP Authorization at a high impact level and the VA ATO.

A Veteran or a VA approved Caregiver shall be able to use the VA Audio Response solution.

The Contractor shall provide a VA Audio Response solution that supports at a minimum the following out of the box features, capabilities, and functionalities-

Pharmacy

1. Shall allow Veterans or a VA approved Caregiver to request a prescription fill/refill and/or renewal via touch tone telephone

2. Shall provide the ability for the automated process to take the following actions: Inform Veteran or a VA approved Caregiver of pick-up time; Verify Veteran’s mailing address when requesting prescription refill by mail order; send Veteran prescription pick-up reminder(s) via touch tone telephone.

3. Shall support status inquiries for each fill/refill and/or renewal request and prescription status (e.g., the number of refills remaining, prescription status (including prescriptions that have yet to be dispensed)

4. Shall allow each site to set a time after which the system will tell Veterans or a VA approved Caregiver when to pick up their prescriptions are ready for pickup (e.g., RxReady).

5. Shall allow the Veterans or a VA approved Caregiver to be informed of the dispensing location when a medication is ready for pickup.

6. Shall be able to identify all medications that are available for mail order.

7. Shall provide the capability for Veterans or a VA approved Caregiver to request prescription fill/refill and/or renewal when the interface with the Pharmacy system is unavailable.

8. Shall verify the Veteran’s mailing address when requesting a medication fill/refill and/or renewal via mail order.

9. Shall provide a capability to notify Veteran or a VA approved Caregiver of medication refills.

10. Shall provide Web Rx Information to include quantity ready, prefills (notification of when prescription is running low), tracking of refills, refills remaining, discontinuation (e.g., alert/inform provider that the previous prescription was discontinued), prescription reminders (e.g., refill reminders, expiring prescription reminders) and medication information consistent with all modalities used.

11. Shall provide the ability for Call Center staff/VA employee to enter the fill/refill and/or renewal request on behalf of the Veteran or a VA approved Caregiver

12. When the drug is a Schedule II medication, there shall be a prompt to advise the caller that their request is being sent to their PACT team and/or the healthcare team that is managing the Schedule II medication(s) (e.g., Mental Health) for review.

13. Shall notify the Veteran or a VA approved Caregiver about instructions/information specific to their visit to the VA that day including as a minimum “come to Window A upon entering the building; “proceed to drive through prescription pickup”; or “park in lot C” and “when your Release of Information (ROI) document is ready for pickup you will be provided a room number for pickup”; as well as accommodate specific site updates for hours of operation, new area codes or telephone exchanges, and operation procedures or promotions. .

14. For Prefill (notification of when prescription is running low), shall provide the ability for Veterans or a VA approved Caregiver to request a renewal for a prescription that is out of refills or expired via an automated number.

15. Shall provide a Veteran or a VA approved Caregiver the ability to be notified of the result of the fill/refill/renewal requests (e.g., “refill request submitted on ‘MM/DD/YYYY’ was processed and is scheduled to arrive on ‘MM/DD/YYYY’ without having to call/message to their pharmacy/provider or login to their automated voice/web/mobile application

16. Shall provide a Veteran or a VA approved Caregiver the ability to receive updates to prescription statuses without having to call/message to their pharmacy/provider or login to their automated voice/web/mobile application

17. Shall provide a Veteran or a VA approved Caregiver the ability to receive updates to prescription shipments/shipment delays from the pharmacy automation system (mail order or local VA Pharmacy) without having to call/message to their pharmacy/provider or login to their automated voice/web/mobile application

18. Shall utilize the phone number on the prescription label.

Scheduling

1. Shall provide the capability for patient-initiated appointment inquiries, scheduling/rescheduling, and cancellations via touch tone telephone.

2. Shall provide a Veteran appointment reminder system via touch tone telephone.

3. Shall provide the capability for Veterans or a VA approved Caregiver to cancel their appointments and receive a confirmation of the cancelation via touch tone telephone. WHEN CANCELING, allow the Veteran to indicate if he/she wants to be contacted about rescheduling.

4. Shall provide the capability for the Clinic to inform the Veterans or a VA approved Caregiver of an appointment/referral cancellation via touch-tone phone.

5. Shall combine all appointments reminders into one call if a Veteran has more than one appointment for a particular day.

6. Shall only send one completed call (e.g., person answers phone, reminder sent to voicemail, etc.) to a household per 24-hour period (calling cycle).

7. Shall attempt to contact the Veteran or a Veteran approved Caregiver multiple times within each communication configuration (e.g., appointment reminders, referral reminders, etc.) as defined by the site configurations if the telephone call is not completed within the specified time (e.g., no one answers the call, no voice mail, etc.).

8. Shall recognize the alternate Address in the Electronic Health Record (EHR), using a defined date to determine if it is current, if applicable.

9. Reminders provided shall indicate which divisions within the facility and/or which facilities. Vendor shall provide specific locations within the organization and divisions.

10. The messages and reminders shall meet the current PII/PHI/HIPPA/Privacy policy for voicemail.

11. Generate reminder notifications to send to patients to schedule a new appointment.

12. Auto-populate appropriate fields from patient demographics and appointment data for the notification process.

13. Automatically use Veteran information when processing notifications.

14. Ability to remove a patient from automatic reminder calls, for either ALL reminders and/or specific clinics.

15. Be able to block a single phone number from receiving calls, even if you don’t know which patient it’s coming from.

16. Provide the ability to Change/Cancel an entire clinic if needed and notify Veterans or a VA approved Caregiver appropriately about their specific clinic.

Clinical

1. Shall provide the capability for preventive health messages via touch tone phone

2. Shall provide the capability for clinical screening reminders via touch tone phone

3. Shall provide secure physician to patient communications, such as lab results, via telephone in accordance with HIPAA.

4. Shall provide the ability for Veterans or a VA approved Caregiver to obtain clinical information such as lab results, disease management information & medication recalls via Inbound and Outbound Audio Notes

Emergency Preparedness

1. Shall provide emergency notification to Veterans, VA approved Caregiver and VA staff via touch tone phone (e.g., Robocalls)., such as biological, chemical, environmental, weather-related, or other emergency situations.

2. Shall provide notification to all patients being seen at a division on a specific date to notify that the building is closed/open.

Financial

1. Shall provide Veteran Account Balance(s), and the ability to make payments, and receive payment reminders

Surveys

1. Shall provide the ability to configure and implement a script(s) for the Veteran or VA approved Caregiver IVR experience satisfaction surveys

Demographics

1. Shall include features to allow Veterans or a VA approved Caregiver to periodically review and update their demographic information.

2. Shall provide the capability for Veterans or a VA approved Caregiver or to “opt out” of the reminder call service by method of reminder. The Veterans or a VA approved Caregiver who “opt out” of the service will no longer receive communications with the exception of patient safety issues (e.g., medication recalls).

Customization

1. Shall provide Custom Site Parameter Preferences (e.g., pharmacy pickup times, hours of operations, transferring prescriptions and pharmacy locations) to VHA staff.

2. VAMCs and CBOCs shall not have the ability to turn on/off by feature, modality, etc.

3. Customization functionality shall be permission structured for VHA staff

4. Shall be able to customize messaging using vendor provided professional voice recordings with local override availability as needed to include at a minimum English and Spanish language modules

5. Shall have the capability to place a current or a new medication order into a “Parked” status, as well as to enable patients to order a fill for a prescription in a “Parked” status, to support the following functional requirements:

6. Shall ensure the system activities performed for an active prescription are also performed for a parked prescription

7. Shall provide coding changes for the EHR receipt of requests from the system so that a patient can request/receive the initial (original) fill of a prescription.

8. Shall provide coding changes for the EHR receipt of requests from the system so that when a patient requests the original fill or refill for a prescription that has been associated with a newer prescription for the same dispensed drug that is in the parked state, the fill is processed as if the newer prescription was requested.

9. Shall provide the capability to communicate with Veterans or a VA approved Caregivers via touch tone telephone for medication recall, appointment/referral reminders, prescription fill status, and immunization reminders.

10. Shall provide the ability to capture from the authoritative source the Veteran’s Notification Preference (e.g., e-mail, text, phone (mobile or land line), letter/postcard)

11. Shall provide VHA staff with the ability to manage, store and access standard telephone notification templates (e.g., voice scripts) used for secure phone communications/messaging.

12. Shall provide the ability to create patient notification templates.

13. Shall provide the ability to publish patient notification templates.

14. Shall provide the ability to share patient notification templates.

15. Shall provide the ability to modify notification templates according to business rules to accommodate facility and service requirements (i.e., directions, parking instructions, number of days prior to appointment the notification is sent, etc.).

16. Shall provide the ability to activate notification templates, one at a time a group or based on rules.

17. Shall provide the ability to deactivate notification templates, one at a time, as a group or based on rules of templates.

18. Shall provide the ability to set up notifications to be distributed automatically according to specified criteria/business rules, e.g., a configurable schedule

19. Shall provide the ability to store individual patient notification preferences

20. Existing and new clinic location demographics (Internal Entry Number (IEN), name, division, etc.) shall automatically pull over into the Solution. The only manual entry to set up the automated reminders on a new clinic should be to disable automated reminders or change the default facility parameters (increase the number of days to auto-remind, for example). The default shall be for the new clinic to automatically send reminders according to the default facilities parameters.

Calling Features

1. Shall provide one completed call to a household per 24-hour period (calling cycle) if appointments for a Veteran are combined.

2. Shall be able to leave a message on answering machines and voice mail systems (e.g., “Please call VA”).

3. Shall provide optional Veteran identification prompts to ensure the person receiving the call is the correct Veteran (e.g., multi factor authentication feature)

4. Shall provide the ability to allow a caller in the self-service system to be connected to a live person within the facility’s call centers (scheduling or pharmacy). For example, a message could prompt the caller to fill another refill, change appointment, or talk to someone from Scheduling or Pharmacy. Caller would be added into the existing call queues for either scheduling or pharmacy or daytime nurse triage. Ability for this feature to be configurable at the facility level.

Reporting

1. Shall include auditing and reporting systems to ensure the integrity and reliability of the data (e.g., system redundancy feature)

2. Shall include standardized reports via network or local printer, on screen, export to Microsoft excel, or e-mail reports to any specified recipient. (e.g., number of refills processed, outbound calls made, number of reminders sent, phone line utilization)

3. Shall provide an audit log to track patient contact history (to include date, time, and purpose about a contact to the Veteran).

4. Shall provide the ability to report on the successful methods of notification, i.e., those that result in a completed encounter.

5. Need to be able to set up VA email groups for managers to auto receive reports on the bad phone numbers the system found in its attempts to call, the patients the system was unable to reach, and the patient actions that need our attentions (cancellations, etc.).

6. Need to be able to ask the system for the notification history for a specific Veteran, phone number or email

Compliance

1. Shall be complaint with Privacy requirements in accordance with Directive 6508, VA Privacy Impact Assessment

2. Shall be…