Performance Work Statement Venous Care Pathway DRAFT 02.docx

Venous Care Pathway

VA-25-00104851

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Veterans Health Administration (VHA) National Center for Collaborative Healthcare Innovation (NCCHI)

Venous Care Pathway

Date: 10/28/2025

VA-25-00104851

PWS Version Number: 2.0

Contents

BACKGROUND

The Department of Veterans Affairs (VA), Veterans Health Administration (VHA), National Center for Collaborative Healthcare Innovation (NCCHI) is dedicated to advancing healthcare outcomes for Veterans through innovative technologies and practices. By fostering collaboration among healthcare professionals, researchers, technologists, and key stakeholders, the NCCHI aims to implement cutting-edge solutions to address Veterans' unique healthcare challenges.

To support this mission, NCCHI seeks to enhance the management of complex diseases among Veterans through a digital platform. Venous diseases, such as Post-Thrombotic Syndrome (PTS), Pelvic Congestion Syndrome (PCS), Superficial Venous Insufficiency (SVI), Chronic Venous Disease (CVD), Pulmonary Embolism (PE) and Venous Leg Ulcers (VLU), pose significant global health challenges. Veterans with these conditions often experience a reduced quality of life, difficulties navigating the healthcare system, and an increased risk of social isolation, substance abuse, and suicide.

The current management pathways for venous diseases are inadequate, fragmented, and contribute to substantial healthcare costs, estimated at approximately $15 billion annually in the United States for VLU alone. A lack of focused training on venous disease in medical education leads to inconsistent diagnosis, variable referrals to specialists, and diverse treatment approaches that fail to address the root cause of the disease or consider long-term care implications. There is a deficiency in practical evidence-based guidance available for clinicians to inform proper management and treatment strategies. This gap underscores the necessity for improved educational resources and enhanced evidence-based protocols in the care of patients with venous disorders.

This effort aims to standardize care protocols for vascular ulcers, and implement a digital platform for Veterans, care providers, and hospital executives. The platform will provide improved protocols, evidence-based guidance, and enhanced educational resources to ensure effective management and treatment of lower extremity vascular ulcers.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

3. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

4. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022

6. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and Information Technology Act of 2006, as amended, Title IX, Information Security Matters

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

10. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

11. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

12. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

13. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended

14. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

15. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”, as amended

16. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

17. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

24. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

25. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

26. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

27. OIT Process Asset Library (PAL), OIT Process Asset Library.

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

30. VA Directive 6510, “VA Identity, Credential and Access Management,” September 3, 2024

31. VA Handbook 6510, “VA Identity, Credential and Access Management,” September 27, 2024

32. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

33. VA Directive 6300, “Records and Information Management,” September 21, 2018

34. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

44. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

47. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

49. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

50. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

51. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

52. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L. 110–140), December 19, 2007

53. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005

54. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

55. VA Directive 0057, “VA Environmental Management Program,” October 25, 2022

56. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

57. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

58. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

59. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

60. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

61. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

62. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

63. Social Security Number (SSN) Fraud Prevention Act of 2017

64. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

65. C.F.R Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”, as amended

66. Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

67. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

68. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

69. OMB M-22-18, “Enhancing the Security of the Software Supply Chain through Secure Software Development Practices,” September 14, 2022

70. OMB M-23-16, “Update to Memorandum M-22-18,” June 9, 2023

71. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27, 2021

72. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December 2014

73. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02: Vulnerability Remediation Requirements for Internet-Accessible Systems | CISA

74. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

75. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

76. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019

77. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

SCOPE OF WORK

The Contractor shall provide a digital health system that fully supports VA NCCHI needs to enhance protocols for diagnosis, stratification, referrals, treatment, and post-treatment care of venous disease and comply with Federal Law and VA requirements capable of supporting up to 2000 patients in the VA Palo Alto Healthcare System (VAPAHCS) and Minneapolis VA Health Care System (MVAHCS).

The Contractor shall fully implement the system in both VAPAHCS and MVAHCS, including software installation, data migration, testing, deployment and technical support. The Contractor shall also provide training to the VA staff, system maintenance and technical support.

The Venous Care Digital Platform shall provide the following functions and capabilities:

• Standardized care protocols for selected venous diseases and lower extremity ulcers

· Software as a Service (SaaS) solution

· Authorized at the Federal Risk and Authorization Management Program (FedRAMP) authorized

· Meet Federal Information Security Management Act (FISMA) requirements

· Fully configurable to meet Health Care Systems needs

· Deployed and fully operational at both VAPAHCS and MVAHCS within 60 days of award

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The Period of Performance (PoP) shall be 12 months from date of award.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

Work may be performed at remote locations with prior approval of the Program Manager (PM). The Contractor shall maintain onsite presence during normal Monday through Friday business hours. After-business-hours, emergency, and pre-approved scheduled work may be performed at remote locations with prior approval of the VA PM as stated in this PWS.

TRAVEL

The Government does not anticipate travel under this effort to perform the tasks associated with the effort.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

REPORTING REQUIREMENTS

The Contractor shall provide the Contracting Officer's Representative (COR) with Monthly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding Month.

The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Deliverable:

A. Monthly Progress Report

PRIVACY & HIPAA TRAINING

The Contractor shall submit Talent Management System (TMS) training certificates of completion for VA Privacy and Information Security Awareness and Rules of Behavior Training and Health Insurance Portability and Accountability Act (HIPAA) training and provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”.

Deliverables:

A. VA Privacy and Information Security Awareness and Rules of Behavior Training Certificate B. VA HIPAA certificate of completion

TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after award. The Contractor shall coordinate the date and time of a virtual meeting with the Contracting Officer (CO), the VA PM, the Contract Specialist, and the Contracting Officer Representative (COR). The Contractor shall provide a draft agenda to the CO and VA PM at least five (5) calendar days prior to the meeting. Upon Government approval of the final agenda, the Contractor shall distribute to all meeting attendees. The Contractor shall prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR, and all attendees within three (3) calendar days after the meeting. The Contractor shall obtain concurrence from the COR on the content of the meeting minutes prior to distribution of the document.

VENOUS CARE DIGITAL HEALTH SYSTEM

The Contractor shall provide and implement a Digital Health System capable of supporting up to 2000 patients in VAPAHCS and MVAHCS with the ability to scale on a national level. The system will support the in-hospital implemented care pathway protocol by connecting Veterans to their care teams, providing disease education materials, tracking health outcomes, integrating longitudinal clinical and economic data, and displaying outcomes of the venous care pathway compared to a retrospective standard of care control group. This Platform shall provide Veterans, healthcare practitioners, hospital executives and system administrators with tools that provide the ability to track clinical outcomes, view longitudinal venous care progress, communicate remotely, manage care tasks for Veterans, access educational resources for both Veterans and VA Clinical Staff, prioritize Veterans based on status updates, collect research-grade clinical and economic data, and provide analytics of clinical and economic benefit of improved VHA venous pathways compared to historical standard of care in VHA health systems. The Platform shall include a dashboard that demonstrates the Veteran population with venous diseases, population-level clinical outcome progress, recruitment statistics and facility economics. It shall also include a patient-facing mobile application and web-based applications for healthcare practitioners, hospital executives and system administrators. These users include Veteran (patient) users, VA healthcare professional (practitioner) users, and VA leadership users. The typical users include Veteran patients with one or more included venous diseases (DVT, PE, PTS, and VLU). The practitioner and leadership users will include members of the care team that provide healthcare services to Veterans with venous disease and VA leadership that oversee the venous disease populations. The initial clinical application for the platform during this project timeframe will be vascular ulcers.

The system shall support the in-hospital implemented care pathway protocol by connecting Veterans to their care teams, providing disease education materials, tracking health outcomes, integrating longitudinal clinical and economic data, and displaying outcomes of the venous care pathway compared to a retrospective standard of care control group. The digital health system and all Veteran Personal Health Information (PHI) will be hosted on the VHA GovCloud servers.

The data utilized in the system shall be composed of patient demographic information (e.g., name, address, email, phone number, gender, date of birth, etc.) for patient identification and user system settings. Additionally, health information (e.g., medical history, health visit details, diagnostic and procedure history, clinical outcomes, images, treatment adherence reporting) shall be collected to provide users with a longitudinal view of health encounters, care decisions made, and resulting patient outcomes. All information will be generated from the system itself through user data input. The Contractor shall manage the entire process of data Extraction, Transformation, and Loading (ETL) to facilitate the integration of patient data into the new Venous Care Digital Platform. The Contractor shall extract patient data from the VA Enterprise Cloud (VAEC) Azure Clinical Data Warehouse (CDW) data lake. Ensure all necessary data elements are captured accurately, including but not limited to patient history, diagnostic records, treatment plans, and post-treatment outcomes. Transform the extracted data into custom tables suitable for the Venous Care Digital Platform. Apply de-identification techniques to reporting data to ensure that no Personally Identifiable Information (PII) or PHI is included in the de-identified datasets used for platform analytics. Load the transformed data into a Simple Storage Service (S3) bucket hosted on the VAEC Amazon Web Services (AWS) production server within the VA cloud infrastructure. Ensure that the data transfer process complies with all relevant security and privacy requirements, including FISMA and FedRAMP. Ensure that all data transfers are encrypted and that no PHI/PII leaves the VA infrastructure. Maintain compliance with VA policies and federal laws governing data security and patient privacy.

System Requirements

1. Core Platform

a. Patient management modules

b. Tools for tracking clinical outcomes and viewing longitudinal care progress

c. Communication modules for remote interaction between Veterans and providers

d. Care task management and prioritization features based on status updates

e. Educational resource access

f. Data collection modules for clinical and economic data

g. Analytics engines for reporting clinical and economic benefits

h. Hosted within the VA Enterprise Cloud

i. Data in transit and at rest will be encrypted. Secure Sockets Layer (SSL) / Transport Layer Security (TLS) protocol version to use is TLS 1.2.

2. Mobile application – Veteran Patients

a. An iPhone Operating System (iOS) and Android supported application allows Veterans/patients to access a mobile-based app to view health tasks, log clinical metrics, track treatment compliance, view previous encounters, access educational content, contact their practitioners, and more.

b. The mobile app stores encrypted data in a secure AWS GovCloud environment hosted by the VA.

c. Connections: Web Service

d. Designed to Material Design user interface standards

e. Requires data connection and all transmission encrypted

f. HIPAA compliant

g. No data stored locally on device

3. Web-based applications - Administrator

a. Administrators shall have the ability to assign roles to users created within the system and are responsible for managing organizational settings including user access.

b. Connections: Web Service

c. Supported on recent versions of Chrome, Firefox, Safari, and Edge standard web browsers

d. Designed to Material Design user interface standards

e. Requires data connection and all transmission encrypted

f. HIPAA compliant

g. No data stored locally on device

4. Web-based applications - Practitioner

a. Practitioner users will have access to web-based dashboards that allow them to oversee their patient populations with venous disease, providing information related to population and individual health status, progression along the care pathway, and prompts for next steps to maximize patient outcomes.

b. The practitioner app stores encrypted data in a secure AWS GovCloud environment hosted by the VA.

c. Connections: Web Service

d. Supported on recent versions of Chrome, Firefox, Safari, and Edge standard web browsers

e. Designed to Material Design user interface standards

f. Requires data connection and all transmission encrypted

g. HIPAA compliant

h. No data stored locally on device

5. Web-based applications – VA Leadership

a. VA leadership users will have access to web-based dashboards that summaries of patient populations with venous disease and compare outcomes to historical quality benchmark. The VA leadership web application stores encrypted data om a secure AWS GovCloud environment.

b. The leadership app stores encrypted data in a secure AWS GovCloud environment hosted by the VA.

c. Connections: Web Service

d. Supported on recent versions of Chrome, Firefox, Safari, and Edge standard web browsers

e. Designed to Material Design user interface standards

f. Requires data connection and all transmission encrypted

g. HIPAA compliant

h. No data stored locally on device

INITIAL ASSESSMENT AND PLANNING

The Contractor shall conduct a detailed needs assessment to understand the current status of care protocols for vascular ulcers within both VAPAHCS and MVAHCS to include the review of currently in use care protocols and treatment guidelines used in various VHA facilities. Evaluate the feasibility and scalability of the platform, considering the need to support up to 2000 patients initially with potential for national scale, ensure that the architecture of the digital platform is scalable, secure, and capable of integrating with existing VHA systems and that the platform complies with HIPAA and other relevant standards to protect patient data and maintain privacy. This assessment shall identify gaps between current protocols and best practices to determine areas requiring standardization.

The Contractor shall also identify and engage key stakeholders, including VHA clinical staff, administration, and possibly patient representatives to support the development of clear goals and objectives for the standardization process. This process shall emphasize improvements in patient outcomes and care efficiency.

The Contractor shall develop and provide draft versions of Standardized Care Protocols for the selected disease, vascular ulcers, integrating best practices and evidence-based guidelines to customize the digital solution. The Contractors shall also facilitate internal reviews by VHA clinical experts and other stakeholders to ensure the draft protocols meet clinical needs and organizational standards.

The Contractor shall provide a Care Pathway Assessment Report for the selected diseases during this period, vascular ulcers. This report shall include the full results of the assessment including stakeholders, platform compliance, recommendations for standardized protocols, a system security review, a detailed integration plan to ensure seamless data flow between the Venous Care Digital Platform and the hospital’s existing Electronic Health Record (EHR) and other clinical systems and a detailed plan to launch the Pilot Venous Care Pathway Platform as well as criteria to evaluate the pilot. The Assessment shall also include a patient population model, the current patient care pathway and the baseline care pathway health economic model.

Deliverables:

A. Standardized Care Protocols B. Venous Care Pathway Assessment Report

IMPLEMENTATION

During the implementation, the Contractor shall complete requirements sessions with the VA business customer, users, and the VA Team to properly understand and refine business requirements for implementation. The outcome shall be a detailed understanding of VA business customer needs which shall be documented in Requirements Session Meeting Notes. This session shall also include presentation and delivery of the Improved Patient Care Pathway and the Protocol for the Improved Patient Care Pathway.

Deliverables:

A. Requirements Session Meeting Notes B. Improved Patient Care Pathway C. Protocol for Improved Patient Care Pathway

DESIGN

The Contractor shall ensure that the product design includes software configurations, interface specifications, screen and report designs, and security control specifications. The design document shall reflect the physical, functional, and operational architecture of the Contractor’s solution including constraints to functionality and any gaps. The system/software information shall be captured in the System/Software Design Document (SDD).

The SDD shall at a minimum address the following:

1. Establish the system architecture to include key interfaces between the cloud application and VA systems.

2. Include design considerations for security and audit procedures, archival of historical data, data migration and data handling criteria, scheduling, disaster recovery, and quality assurance factors.

3. Identify, define, and design capacity and performance requirements and any associated limitations. Specifically, coordinate with the Government to identify limitations and considerations during the design phase.

4. Apply VA standards complying with security requirements, enterprise architecture, data standardization, format, transmission, and storage in adherence with VA standards identified in the One-VA Technical Reference Model (TRM).

Deliverables:

A. System Design Document

CONFIGURATION AND IMPLEMENTATION

The Contractor shall provide Venous Care Pathway application configuration services that are consistent with standard implementation and deployment methodology. The Contractor shall configure the application to meet all VA’s requirements as stipulated in this PWS. The Contractor shall provide guidance on alternative approaches to minimize future customizations of the application. The Contractor shall perform all configuration of the systems prior to deployment. The Contractor shall prepare a Change and Configuration Management Plan in accordance with all applicable regulatory policy and guidance. The Change and Configuration Management Plan shall contain all information relevant to defining and modifying the application from the initial baseline configuration and subsequent re-baselining activities.

Deliverables:

A. Change and Configuration Management Plan

PROVIDE NETWORK CONNECTIVITY

The Contractor’s hosted cloud environment shall have established and approved direct access to the VA Trusted Internet Connection (TIC) 2.0 Gateway Connection. Connectivity between the Cloud Service Provider (CSP) and the VA TIC shall comply with TIC Reference Architecture Document Version 2.0. The Contractor shall not send or receive data to the VA network without an approved Authority To Operate (ATO) from VA. Any deployment outside of the VA firewall is subject to VA TIC 2.0 Gateway Connection requirements for communication with other VA systems within the VA Firewall.

The Contractor shall provide network solutions for connectivity between the primary and secondary site, subject to Federal Information Processing Standard (FIPS)-140-2 certification of equipment and configurations and the criteria set forth by the System Security Plan (SSP).

The Contractor shall deliver the following network functionality:

1. Provide network connectivity that complies with FIPS 140-2, Section 1, Table 1, up to and including Security Level 3.

2. The Contractor solution shall support Internet Protocol Version 6 (IPv6) in accordance with the directive issued by the Office of Management and Budget (OMB) on September 28, 2010, IPv6 technology, in accordance with the USGv6: “Technical Infrastructure for IPv6 Adoption” and the National Institute of Standards and Technology Special Publication (NIST SP) 800 series applicable compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support dual stack connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g., web, email, DNS, ISP services, etc.) shall support native IPv6 users, and all internal infrastructure and applications shall communicate using native IPv6 operations.

3. All user connectivity to the cloud hosting environment shall be through the Trusted Internet Connection (TIC) gateway. Users shall not be capable of accessing the Case Management System or background investigation data through an internet connection direct to the cloud that bypasses the TIC gateway.

4. The Contractor shall provide a Service Level Agreement (SLA) document identifying the expected availability of the application. Availability of 99.9 percent is required, with a maximum amount of unplanned downtime per year not to exceed 8 hours.

Deliverable:

A. Service Level Agreement

TEST & EVALUATION (T&E)

The Contractor shall support the testing by the VA (e.g., unit, functional, accessibility, system, reliability, usability, interoperability, regression, security, performance) throughout the implementation cycle using industry best practices. The Contractor shall correct or mitigate any deficiencies discovered during such testing, at no additional cost.

TRAINING

Training shall be available throughout the duration of the PoP. Training shall be role-based for staff (user, admin, etc..) and patients. The Contractor shall provide training as follows:

1. Provide Train-the-Trainer support.

2. Provide pre-recorded training for on-going VA staff training.

3. Provide training for new and updated software modules as released.

The Contractor shall deliver or provide links to Training Materials to include training plans, manuals and other training documentation or training aids. Electronic training tools such as video teleconferencing and computer-based training shall be employed to enhance the effectiveness of training materials and courses.

Deliverables:

A. Training Materials

SUPPORT AND MAINTENANCE

The Contractor shall provide operations support and systems maintenance support of the application for the life of the contract as follows:

1. The Contractor shall ensure the application is maintained to the most recent approved baseline.

2. The Contractor shall perform software maintenance activities that may include version and release upgrades, security updates or patches, performance enhancements, data cleansing/archiving, and application modifications. The Contractor shall provide notifications or access to release documentation.

3. The Contractor shall provide proactive operation health monitoring of the application. The Contractor shall provide either notification or access to information about the application availability.

The Contractor shall provide 24 hours a day, 7 days a week (24/7) toll-free monitored Help Desk number to provide application support services for users of the application. Any telephone support provided by the Contractor shall be at no additional cost. Unresolved support issues will be elevated to the VA Enterprise Service Desk for submission of a service ticket. The Contractor shall provide input and technical support to VA help/service desks on all layers until resolution.

PILOT RESULTS

The Contractor shall evaluate the effectiveness and results of the pilot launch of the Venous Care Pathway SaaS for the life of it’s operation within the VAPAHCS and MVAHCS. The Contractor shall provide enrollment and patient monitoring based on patients diagnosed with veinous disease and leg ulcers for at least 3-4 years, Patient Care Pathway Improvement Project Results Report and Patient Care Pathway Comparative Economic Model. The Patient Care Pathway Improvement Project Results Report shall include a description of the baseline data, specifics on the implemented improvements and the changes in the data from baseline as a result of this improvement with detailed explanations as well as clinical and economic outcomes. The Patient Care Pathway Comparative Economic Model shall include a comparison of the economic metrics before and after the implementation of the improved care pathway.

Deliverables:

A. Patient Care Pathway Improvement Project Results Report B. Patient Care Pathway Comparative Economic Model

ASSESSMENT, AUTHORIZATION AND CONTINUOUS MONITORING

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA).

2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application.

4. The Contractor shall provide an Incident Response Plan (IRP) scenario within 14 days of award and complete Table-Top exercise within 21 days of award unless current VA IRP can be provided.

5. The Contractor shall provide a System Boundary Diagram that demonstrates implementation and any proposed VA interconnections including required ports and protocols at the time award.

6. The Contractor shall complete a FedRAMP System Security Plan (SSP) and supporting documentation at the time of award.

7. The Contractor shall complete a Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) at the time of award.

8. The Contractor shall complete a 3PAO Security Assessment Report (SAR) at the time of award.

9. To the extent required to carry out the FedRAMP assessment and authorization process and FedRAMP continuous monitoring, to safeguard against threats and hazards to the security, integrity, and confidentiality of any non-public VA data collected and stored by the Contractor, the Contractor shall provide the VA access to the Contractor’s and Cloud Service Provider’s facilities, installations, technical capabilities, operations, documentation, records, and databases.

10. If new or unanticipated threats or hazards are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with the security addendum B.

11. The Contractor shall not release any data without the written consent of VA. All requests for release must be submitted in writing to the COR/CO.

12. In order for live VA data to be used in this system, a FedRAMP Authorization and VA ATO will be required.

13. Identified gaps between required FedRAMP Security Control Baselines and Continuous Monitoring controls and the contractor’s implementation as documented in the Security Assessment Report shall be tracked by the Contractor for mitigation in a Plan of Action and Milestones (POA&M) document. Depending on the severity of the gaps, VA may require them to be remediated before a provisional or agency authorization is issued.

14. The Contractor shall maintain a security management continuous monitoring environment based upon the latest edition of the VA Cloud Computing Continuous Monitoring Process, FedRAMP Security Controls Baseline and FedRAMP Continuous Monitoring Strategy Plan.

15. The Contractor shall comply with all VA and FedRAMP privacy requirements.

16. VA may choose to cancel the Contract and terminate any outstanding orders if the Contractor has its ATO revoked and the deficiencies are greater than VA risk tolerance thresholds.

Deliverables:

A. System Boundary Diagram B. FedRAMP System Security Plan (SSP) and supporting documentation C. 3PAO Security Assessment Plan (SAP) B. 3PAO Security Assessment Report (SAR)

GENERAL REQUIREMENTS

ENTERPRISE AND IT FRAMEWORK

VA TECHNICAL REFERENCE MODEL

The Contractor shall comply with the VA OIT Technical Reference Model (VA TRM). Compliance with the VA TRM is achieved by using only technologies and standards that are listed as approved for use in the VA TRM. The Contractor shall provide all necessary information requested by VA to ensure TRM approval is obtained prior to use on VA’s network.

ZERO TRUST – VA CRITICAL SECURITY CONTROLS

VA has established minimum mandatory security requirements and requires that any network connected software system or service must meet the VA Critical Security Controls as outlined in the VA Memorandum, “VA Security Controls”, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010. VA Critical Security Controls identify the minimum mandatory requirements that must be implemented across all VA enterprise infrastructure, cloud computing environments, information systems, networks, and specialized devices (medical devices/systems, special-purpose systems, and research scientific computing devices) that process, store, and/or transmit VA data. Effective July 1, 2025, the Contractor shall implement these VA Critical Security Controls, within any network connected software system or service prior to being authorized for use in the VA. This functional requirement is not negotiable, and Plan of Action & Milestones (POAM) will not be accepted in the event these controls cannot be implemented for new systems. Critical Security Controls are intended to increase VA’s security posture and provide security and privacy risk visibility into the VA network and is not a new requirement. The Contractor’s failure to maintain these VA Critical Controls after implementation will result in VA discontinuing the use of the system.

FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Architecture (EA), and VA Identity and Access Management (IAM) approved Enterprise Technology Guidelines (ETG). The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in Executive Order 14028, VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program, CISA Binding Operational Directive 23-01, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500, and VA IAM enterprise requirements for direct, assertion-based authentication, and/or trust-based authentication, as determined by the ETGs. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-05-24, M-19-17, M-22-09, and NIST Federal Information Processing Standard (FIPS) 201-3. Contractor delivered applications and systems shall be on the FIPS 201 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Person Index (MPI) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable Technology Guideline as outlined in VA ETG.

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion-based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

10. Role Based Access Control.

11. Auditing and reporting capabilities.

12. Compliance with VIEWS 00155984, PIV Logical Access Policy Clarification https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896.

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

INTERNET PROTOCOL VERSION 6 (IPv6)

The Contractor solution shall support IPv6-Only based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). Which defines IPv6-only as the state of an operational system or service when IPv4 protocol functions (addressing, packet forwarding) are not in use. The NIST USGv6 profile defines technical requirements for a product to be capable of operating in IPv6-Only environments. IPv6-Only technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices, applications, and systems shall support all applicable functionality on native IPv6-Only as well as dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g., web, email, DNS, ISP services, etc.) shall support native IPv6-Only and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall support using native IPv6-Only and dual stack (IPv6 / IPv4) for all functionality and operations.

TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 “Secure External Connections”, and…