Product Description_TheraDoc.docx

Maintenance and Support of TheraDoc VA-26-00005007

PRODUCT DESCRIPTION (PD) TEMPLATE

DEPARTMENT OF VETERANS AFFAIRS

Veterans Health Administration

Maintenance and Support of TheraDoc

Date: July 10, 2025

VA-26-00005007

PD Version Number: 1.0

Contents

PRODUCT REQUIREMENTS

The Department of Veterans Affairs (VA) requires maintenance support of the existing TheraDoc solution, and as-needed installation/ implementation services and user training. The Contractor shall provide annual TheraDoc solution or equal and associated maintenance. The solution shall interface with the VA’s Veterans Health Information Systems and Technology Architecture (VistA) Systems to send ADT, Lab/Microbiology, Inpatient pharmacy, BCMA, Radiology, Surgery, Vital signs, Line days, Problem list and Outpatient pharmacy data to the TheraDoc software’s dedicated database, for real-time surveillance capabilities. Theradoc must integrate with additional software used in VA medical centers (i.e. PICIS, CliniComp, etc.). VISN 6 currently uses Theradoc at our 7 Medical Centers and associated sites of care. The required TheraDoc software is owned by Document Storage Systems, Inc (DSS). The period of performance is a 12-month base period with four 12-month option periods.

TheraDoc is a provider of electronic clinical surveillance to all seven VISN 6 healthcare organizations. It delivers advanced informatics to help protect patients and maximize the performance of healthcare teams. The system is adaptable, modifiable, and scalable. TheraDoc's suite of software applications brings together disparate data from a hospital's source systems, helps alert clinicians to potential risks, and empowers them with knowledge to improve clinical outcomes, lower costs, and strengthen regulatory compliance. TheraDoc is currently in use at over 50 other sites and allows for standardization among VISN 6 VA healthcare systems and assist with outbreak response. Work at the government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

The Contractor shall provide all software, licenses and maintenance as identified in the Price Schedule. The VA will ensure all hardware (virtual or physical) will have specifications required to have the TheraDoc or equal software operate efficiently and effectively. The Contractor shall coordinate with designated VA representatives for the initial installation and configuration of the TheraDoc or equal software solution. This shall include regular, recurring conference calls with designated site representatives and user groups.

The TheraDoc or equal software solution provides the following benefits:

· Identification of patients who may require intervention, based on data indicating patient’s current clinical condition. Clinicians may specify the data relevant to their area of practice, which saves them from having to manually comb through reports from disparate systems.

· Patients can be protected from drug interactions and adverse events and offered appropriate treatment sooner to impact patient length of stay.

· A rounding tool which displays a patient’s up to date, current medications, vital signs, labs and other clinically relevant data in a succinct format, to allow a clinician to more appropriately treat the patient.

· Pre-built and user customizable alerts for expeditiously addressing patient safety issues, therapeutic antibiotic monitoring (TAM) capable, auto populated antibiogram, customizable patient lists based on multiple of data stratified across the 9 separate interfaces.

· Interprets data and alerts clinicians as events occur in real time, presenting opportunities for improved outcomes, which results in better and faster clinical intervention. Better, quicker clinical treatment decisions alter the healthcare experience and outcome for each patient, while reducing costs.

· Ability to immediately respond as soon as patient infections are identified by the lab, to prevent spread to other patients and allow clinicians to prescribe the appropriate treatment the first time.

· Ability to connect to the CDC’s National Healthcare Safety Network System for automatic reporting of Healthcare-Associated Infections and Antibiotic Utilization and Resistance data.

· An interdepartmental communication tool, for shift handoff, which allows coordinating care with all clinicians in a given department.

· The ability to meet anticoagulation national patient safety goals, VHA antimicrobial stewardship directives, as well as MRSA and other MDRO screening requirements and best practices.

The contractor shall provide the specific deliverables described below:

Annual license, which includes:

· Interfaces with VA Vista System to provide real-time data, 24x7x365. As referred to throughout functional requirements, real time’ is defined as data appearing in the DST application and being reported in VistA within seconds of events occurring without user access of the application.

· Installation and updating the TheraDoc software as required.

· Maintenance and Support Services:

· Work directly with users to address their issues with the TheraDoc Product. Respond to issues reported to them in accordance with this document within the response times defined in this document.

· Help VHA Office of Information and Technology (OI&T) and/or Biomed staff configure setup of necessary licensed DSS Products to meet VHA’s and/or end-users needs.

· Advise VHA OI&T and/or Biomed staff as a Subject Matter Expert (SME) as it relates to licensed DSS Products and their configuration in internal meetings, new installations of licensed DSS Products, and end-user activities.

· Help VHA OI&T and/or Biomed staff on issues involving licensed DSS product infrastructure requirements, including hardware, bandwidth, and best practices.

· Keep the Veterans Administration Medical Center (VAMC) Points of Contact (POC) aware of issues that may impact their usage of licensed DSS products.

· Make reports by request available to VHA OI&T and/or BioMed staff, including:

· Summary of tickets opened for licensed DSS products for the last 30 or 7 days.

· Summary of tickets currently open and those closed in the past 7 days for licensed DSS products.

· Summary of known issues impacting the site along with their status and expected release date and workaround if available.

· Clinician training which will take place as needed using the most efficient and cost-effective means for the government. As TheraDoc is currently in use at all seven VISN 6 HCS and associated outpatient sites of care, there is no need for a data validation and Go-Live in person visit.

· Needed periodic updating will include:

· Enable admin functionalities for identified super users.

· Super user training on advanced functionality

· Work with key user clinician groups (Pharmacy, Infectious Disease & Infection Control, Antimicrobial Stewardship, Quality Management) to incorporate their current departmental requirements into a workflow facilitated by TheraDoc.

· Make adjustments to any setup, views, or other workflow items as needed.

· Share best practices in use at other VA’s using TheraDoc.

VA Responsibilities

To meet the requirements of VA Directive 19-0201 (Patient Safety Notifications), it is necessary that VA provide the qualified DSS, Inc. staff with system access, which includes specified keys/menus for VistA and/or local server administrative privileges. In order to enable the qualified DSS, Inc. staff to support the product, CAG access must be provided, and if that is not enough to allow for quality support of the product, GFE laptops will be provided. The DSS, Inc. software application is used in real time for managing patient care. If the necessary access is not provided to DSS, Inc. staff limited support will be provided based on access received.

VA to provide 3 Virtual Servers:

TheraDoc Stage Server:

· Widows 2016 Server

· Drive C: 80 GB

· Drive D: 300 GB (NOTE: Free Data Drive Due to DB on stage server)

· Processors: 4

RAM: 24 GB

TheraDoc Production Server:

· Widows 2016 Server

· Drive C: 100 GB

· Drive D: 150 GB (Free Data Drive)

· Processors: 4

RAM: 12 GB

TheraDoc Production Oracle DB:

· Widows 2016 Server

· Drive C: 100 GB

· Drive D: 800 GB Free Data Drive

· Processors: 12

· RAM: 32 GB Ram Price Schedule:

BASE PERIOD

The period of performance is November 1, 2025 through October 31, 2026.

Contract Line Item Number

(CLIN)

OPTION PERIOD 1

Option Period may be exercised in accordance with FAR 52.217-9, “Option to Extend the Term of the Contract.” Work shall not commence until, and unless, a formal modification is issued by the Contracting Officer. The period of performance is November 1, 2026 through October 31, 2027.

OPTION PERIOD 2

Option Period may be exercised in accordance with FAR 52.217-9, “Option to Extend the Term of the Contract.” Work shall not commence until, and unless, a formal modification is issued by the Contracting Officer. The period of performance is November 1, 2027 through October 31, 2028.

SUMMARY:

TOTAL BASE PERIOD:

TOTAL OPTION PERIOD ONE:

TOTAL OPTION PERIOD TWO:

TOTAL CONTRACT PRICE:

ITEM 1 SALIENT CHARACTERISTIC(S)

· Capable of multiple queries across a variety of medical departments, providing views defined by location, patient characteristics, surgery status, microbiology results, pharmacy, and other parameters

· Built-in alerts for high priority patient safety issues, including MDR organisms and Notifiable Diseases identified by the lab

· Therapeutic Antibiotic Monitoring or TAM capable, providing effective treatment options.

· Multi-function surveillance and patient search tool

· Auto-populated antibiogram capable

· Patient ID summary: providing a snapshot of infectious disease treatments, including relevant medications, lab reports, radiology, etc.

· Provides customizable patient lists

· Antimicrobial stewardship for both inpatient and outpatient populations including prospective antimicrobial stewardship and Infection Control Surveillance to include:

· Drug-bug mismatches based on isolated organism species and susceptibilities.

· Positive and negative diagnostic tests for infectious organisms or condition stratified by specimen source, location or patient population (especially blood Cultures for rapid diagnostics).

· Ability to cross-reference antibiotic allergies with active anti-infective orders and create related alerts and reports.

· Intravenous to oral conversions for highly bioavailable antimicrobials.

· Query for patients on specific drugs and/or laboratory parameters.

· Flag for a customizable duration of cumulative and specific antibiotics.

· Preferred that pre-admission antibiotic use be included.

· Flag for patients on redundant antimicrobial therapy (e.g., redundant anaerobic, beta-lactam, and anti-staphylococcal therapy).

· Automatically flag patients for isolation, or precautions such as airborne or contact precautions.

· Ability to send specified users an alert for positive blood cultures.

· Ability to send specified users an alert when patient is prescribed a user designated antibiotic.

· Outpatient anticoagulation clinic management, including tracking all events in clinic such as missed appointments, warfarin, Direct oral anticoagulants Conversions (DOAC) conversions, adverse drug events, etc.

· A single-page display Patient Summary Page for Clinical Data Preview to include, at a minimum, the following:

· Clinical rounding panel(s) that satisfy Bates’s Commandments for Clinical decision support.

· Real time display of current admission and preadmission data (i.e., Emergency Department).

· Antimicrobial orders throughout admission encounter (antibiotics, antivirals, antifungals, and antiparasitic agents).

· Medication administration record.

· Vitals (temperature, respiratory rate, heart rate, SaO2, blood pressure).

· Diagnostic lab orders and results (CBC and creatinine).

· Therapeutic drug monitoring.

· Radiology results.

· Microbiology

· Pathology.

· Miscellaneous infection-related medications (ex. antipyretics, immunosuppressants, etc.).

· Prefer that the system identify current dialysis patients and former community living center (CLC) residents.

· Track antimicrobial stewardship operational efficiency and interventions to include, at a minimum, the following:

· Intervention documentation for transparency/communication among licensed users.

· Calculate estimated cost savings per intervention type.

· Operationalize follow-up for licensed users (i.e., pending, complete, accepted, rejected).

· Antimicrobial Stewardship reporting functionality to include, at a minimum, the following:

· Clinical intervention reports during specified time ranges by user for intervention acceptance rates.

· CLSI-concordant antibiograms for Gram-positive, Gram-negative, and antifungal agents from 2019 and carried forward.

· DST provides automatically populated antibiogram. Antibiogram should be filterable and modifiable by user designated time period, institution, organism, antimicrobial, and specimen source. Each bug/drug combination must be able to show from where the data originated (ie. number of isolates, location, specimen, patient).

· National Health and Safety Network calculations and reporting of days of therapy per 1000 days present (or admissions for nursing home residents).

· Selected hospital-associated infection rates (e.g., MRSA, C. difficile, influenza, Legionella).

· Provide, at a minimum, the following configurability:

· Ability to create ad hoc alerts for clinical surveillance without vendor intervention.

· Provide warning notification to users when a notifiable disease has been identified and provide the ability to use the custom reportable reports to generate communicable disease reports for all mandatory reportable diseases to the State-specific Department of Health Mandatory Reportable Diseases List and Instructions, VHA, and CDC.

· Generate hospital acquired infection (HAI) surveillance worksheets that follow the National Healthcare Safety Network (NHSN) definitions for reporting facility infections.

· Create custom medication reports for viewing among licensed users (ex. patients on specific drugs during a specified time range).

· Create custom infection reports for viewing among licensed users (ex. patients with specific diseases during a specified time range).

· Create custom intervention types for ad hoc tracking.

· Provide users real time clinical surveillance/decision making with the ability to build from scratch their own customizable reports and views without relying or waiting on contractor customer support assistance that allows immediate and simultaneous reporting of communicable diseases such as coronavirus, anthrax, smallpox, Mpox, mumps, & HIV to state health officials.

· Provide real time clinical surveillance/decision making with customizable reports with the ability to:

· identify/sort patients by hospital location or provider;

· select which alerts to review from pre-existing alerts in software database;

· create new alerts;

· change time frame of alerts to review;

· identify patients by admission diagnosis and/or problem list diagnoses.

· create inpatient/hospitalists checkout/handoff report.

· Create targeted patients lists by either medication, class, or lab values with ability to customize data fields displayed.

· Query for number of patients that received a given antibiotic within a user-configurable time period.

· From a single application window, provide the ability to link multiple results to a given infection and apply the status (e.g., NHSN definition, POA, not an infection, etc.) to all related results. Infection groupings are available in a line list.

· Provide a platform for inpatient anticoagulation monitoring.

· Must recognize both inpatient and outpatient orders.

· Ability to generate individualized rosters to facilitate workflow to include creation of a customized lists for Medical Teams.

· Allow documentation within the system to communicate with other users.

· Users should have the ability to create infection control, antibiotic stewardship and other workflows and be able to create and configure these workflows without the vendor’s assistance, in a user-friendly interface. Workflows should include the ability to define criteria to generate alerts, track follow up actions to those alerts, and document action taken.

· Provide surgical site infection surveillance for all types of site infection wound cultures, and procedures performed based off NHSN procedure codes with the ability to compare and correlate by procedure code for mandatory reporting into the Inpatient Evaluation Center (IPEC).

· Ability to auto-generate communicable disease reports to ensure checks and balance within the national healthcare safety network (a national standard).

· Provide VISN-wide customizable reporting functionality in which report formats can be defined and created easily by users without vendor intervention including graphing capabilities. Ability for users to create and share Infectious Disease/Infection Control, Pharmacy, Antimicrobial Stewardship, etc. reports in print, graph and summary form (to include patient lists as needed).

· At a minimum, reports must be able to show interventions completed, the type of intervention and the status of the intervention (accepted, rejected, unknown). Reports must be able to include multiple individual users as well as a single user option and must include flexible date ranges.

· User modifiable permissions such that trainees can be granted access to a limited scope for a limited duration.

· Preferred that system allows resolution by POA.

· Alert for preliminary cultures (i.e. GPCs in blood) not just when pathogen identified.

· Biofire integration preferred.

· Provide regional access for all VISN 6 site users to include:

· Access to the same views, alerts and reports simultaneously by multiple users at any one or all four (7) of the VISN 6 Medical Centers; views, alerts and reports created at one site in the VISN can be shared by any of the sites in the VISN.

· Users can create customized reports, views, alerts without the vendor assistance that can include all sites in VISN 6 in aggregate, or selectively include one or more of the sites.

· Provide views in the DST defined by location (e.g., specific unit or clinic), patient characteristics, surgery status, microbiology results, medications, and lab within a certain range, or having a change +/- by a certain percentage, and other parameters defined by the end user.

· Ability to link infections to all relevant patient data while performing HAI surveillance, including NHSN compliant infection criteria, patient movement, devices, lab/micro results, radiology, surgery and vital signs.

· Provide, at a minimum, the following specialty workflows:

· Customizable capture of Interventions, outcomes and workload for Antimicrobial Stewardship team, Pharmacy Team and Specialty clinics.

· Real-time and retrospective dashboard of culture results for outpatient clinics (such as Emergency Room and Spinal Cord Injury) to ensure appropriate follow-up. Be able to customize dashboard based on source or result and track completion of appropriate follow-up.

· Identify patients with Systemic Antibiotics with Diabetes on Problem list and Amputation or Debridement in previous year. Identify C.Diff cases and send email to an individual or entire group in real time. Both examples of real-time needs for clinical trial enrollment.

· Provide an Outpatient Anticoagulation Dashboard with all warfarin patients by next scheduled INR date that auto-populates with new results to review. Track all HGB, HCT, SCr ordered by the clinic so all results are assessed and addressed by a clinician.

· Ability to see Low Dose Computed Tomography interpretations for a patient and create Alerts for Lung Cancer Screening and classification, searching specifically for Lungrad scores 0,1,2,3,4A,4B,4X.

· Provide a Lung Cancer Screening Dashboard to track follow up based on Consult, DX Eval, Imaging, Onboarding (waiting for 1st scan), and Lungrad scores.

· Provide lung cancer screening eligibility reports that indicate patients who have quit smoking 15+ years, patients who are nearing or are 81 years old, patients who have expired, and patients who have had interval CT or CTA imaging completed between annual screenings.

· Ability to query in real time surgery data to perform surveillance for surgical site infections and link these surgery records to infection documents within the application.

· Customized alerts to looks for criteria that would indicate an NV HAP infection. These alerts identify in real-time when a patient meets one or more criteria for NV HAP.

· Customized dashboard that groups intervention alerts and/or results by clinical specialty (i.e. inpatient pharmacy users that round on given specialty).

· Inpatient clinical pharmacy team communication and clinical activity tracking/reporting (for example, at Shift handoff, creating automated rounding templates, identifying Pending tasks still requiring completion).

· Monitor, interpret data, provide reports, and alert clinicians as events occur in real time.

· Data from all interfaces populate the DST in real time, without the DST being in use by any user; critical alerts selected by the user can send an email notification to the user as soon as the alert criteria is met without the user being logged into the DST

· Customizable email notification tied to any alert without the DST in use; email notifications can be setup and defined by the user without vendor intervention.

· Users can see pending orders prior to being processed by a pharmacist.

· Any new lab or micro tests, or medications added in VistA will be automatically mapped and available immediately in the DST, without intervention or custom work from the vendor.

· Medical Device Interface to track and monitor device insertions and removals, associate device presence with HAIs, and calculate device days for reporting to Inpatient Evaluation Center (IPEC) with full integration to the VA’s standardized devices note templates.

· The VA’s National Device-related nursing notes (VA Approved Enterprise Standard or VAAES Templates) are passively capturing device insertion and removals, as nurses complete their daily note. (Computerized Patient Record System or CPRS notes are created as usual).

· Local device templates can be integrated to passively capture device insertion and removals. For example, If ICU systems such as Clinicomp, which stand apart from VistA/CPRS, have their device-related nursing notes written back to CPRS and signed by nursing there, this data can be passively captured by TheraDoc.

· Device data is sent to TheraDoc in real time upon note signing, eliminating any manual entry or device recording on Excel spreadsheets per unit.

· Device data can be automatically linked to infections, for CAUTI, CLABSI and VAE.

· Aggregate dashboards allow clinicians to track all patients and device type per unit, showing length of device presence, to encourage prompt removal when appropriate.

· Monthly reports are automatically tabulated including Patient Day denominators and Device Days for easy reporting to IPEC.

· Reports can be exported to Microsoft Excel.

· CLC/long term care med surveillance and utilization (Medication/Psychiatric Medication use in CLCs/Long Term Care)

NOTICE OF THE FEDERAL ACCESSIBILITY LAW AFFECTING ALL INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) PROCUREMENTS (SECTION 508)

On January 18, 2017, the Access Board issued a final rule that updated accessibility requirements covered by Section 508 and refreshed guidelines for telecommunications equipment subject to Section 255 of the Communications Act. The final rule went into effect on January 18, 2018. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.

SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) STANDARDS

The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT. These standards are found in their entirety at: Revised 508 Standards and 255 Guidelines (access-board.gov). A single PDF file version of the Revised Section 508 Standards and 255 Guidelines will be supplied upon request, or can be obtained from the Access Board website. Federal agencies must comply with the Rehabilitation Act of 1973, as amended.

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

COMPATABILITY WITH ASSISTIVE TECHNOLOGY

The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

ACCEPTANCE AND ACCEPTANCE TESTING

Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery. The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

INFORMATION TECHNOLOGY USING SUSTAINABLE PRODUCTS AND SERVICES

The Contractor shall comply with Sections 524 and Sections 525 of the Energy Independence and Security Act of 2007; Section 104 of the Energy Policy Act of 2005; Executive Order 13221, “Energy-Efficient Standby Power Devices,” dated August 2, 2001; and the Federal Acquisition Regulation (FAR) to provide ENERGY STAR®, Federal Energy Management Program (FEMP) designated, and products and services that meet EPA Recommendations of Specifications, Standards, and Ecolabels in effect as of October 2023 (e.g. Electronic Product Environmental Assessment Tool (EPEAT) registered products) in providing information technology products and/or services. The Green Procurement Compilation (GPC) website available at Green Procurement Compilation - GSA Sustainable Facilities Tool (sftool.gov) provides a comprehensive list of sustainable products and services and sustainable acquisition guidance.

The Contractor shall provide products that meet the definition of sustainable products and services if the products are delivered to the Government; furnished by the Contractor for use by the Government, incorporated into the construction of a public building or public work, or acquired by the Contractor for use in performing services under a Government contract where the cost of the products is a direct cost to a Government contract (versus costs which are normally applied to a contractor's general and administrative expenses or indirect costs).

Specifically, the Contractor shall provide sustainable products under this contract in accordance with FAR 52.223-23. The applicable products with their associated certification, designation, and/or ecolabel (e.g. Energy Star, FEMP, and/or EPEAT) are identified within the product specifications in this PD. The Contractor shall ensure proposed products meet the certification(s) / designation(s) / ecolabel(s) specified at the time of submission of proposals and at the time of award.

SHIPMENT OF HARDWARE OR EQUIPMENT

Inspection: Destination Acceptance: Destination Free on Board (FOB): Destination

Ship To and Mark For:

Primary

Alternate

Name:

Name:

Address:

Address:

Voice:

Voice:

Email:

Email:

SPECIAL SHIPPING INSTRUCTIONS

Prior to shipping, Contractor shall notify Site POCs, by phone followed by email, of all incoming deliveries including line-by-line details for review of requirements. The Contractor shall not make any changes to the delivery schedule at the request of Site POC.

Contractors shall coordinate deliveries with Site POCs before shipment of <hardware> hardware to ensure sites have adequate storage space.

All shipments, either single or multiple container deliveries, shall bear the VA IFCAP Purchase Order number (if applicable) on external shipping labels and associated manifests or packing lists. In the case of multiple container deliveries, a statement readable near the VA IFCAP PO or Contract number shall indicate total number of containers for the complete shipment (e.g. “Package 1 of 2”), clearly readable on manifests and external shipping labels.

Packing Slips/Labels and Lists shall also include the following:

IFCAP PO # or Contract No.: ____________ (e.g., 166-E11234 (the IFCAP PO number is located in block #20 of the SF 1449)) Project Description: (e.g. Tier I Lifecycle Refresh)

Total number of Containers: Package ___ of ___. (e.g., Package 1 of 3)

NATIONAL ACQUISITIONS

(If this requirement is for a National acquisition, replace paragraphs 5.0 and 5.1 above with the below information, change the text to black and convert the text to “No Spacing” style. (Please note this Master Delivery Schedule may be used for non-National Acquisitions, but must be used for National Acquisitions). In accordance with the IT Asset Management (ITAM) PAL Process ITAM-02.01.01 Notify Logistics of Pending Shipment, for National Acquisitions, the “Master Delivery Schedule” must be completed by the VA PM (the Government portion as indicated within the Master Delivery Schedule Instructions) as it will become an attachment within the PD.

The PM must also add the contract deliverables specified in the below text to the Schedule for Deliverables table in the “Notes to the Contractor” section below. This Master Delivery Schedule will be updated by the Contractor and provided at delivery. See the Master Delivery Schedule Template within the PAL ITAM Process at http://vaww.oed.wss.va.gov/process/Library/master_delivery_schedule_template.xlsx.

All questions related to these instructions and the Master Delivery Schedule template/process shall be directed to the VA ITAAG and VA ITAAG RILOS distribution list in the Global Address List (GAL). For all equipment buys, ensure that this group is consulted to ensure proper cataloging of equipment early on in the planning stages of the procurement.)

The Contractor shall complete the Master Delivery Schedule in accordance with the Instructions, and shall coordinate with the COR for specifics. The Master Delivery Schedule shall be provided after award and updated prior to and after each delivery timeframe.

Shipment/Delivery Kick-off Meeting

The Contractor shall conduct a Shipment/Delivery Kick-off Meeting with the VA Program Manager (PM), COR, Delivery Date Coordinator, Implementation Manager, and Facility CIOs (or designee) to discuss delivery schedule requirements and facilitate delivery of equipment. This meeting may be held in conjunction with the post award conference or identified technical kickoff meeting, if applicable. The Contractor shall also present the Shipment/Delivery Weekly Progress Report format for review and approval by the Government. This meeting, if held independently, shall be conducted telephonically within ten days after award and shall incorporate any delivery schedule changes to the draft Delivery Schedule identified by the Government.

Shipment/Delivery Weekly Progress Report

The Contractor shall provide a Shipment/Delivery Weekly Progress Report which shall identify the items shipped, the serial number associated with each piece of equipment; the date of each shipment; the status of each shipment, tracking information, and information relative to Government-receipt of the equipment items at each delivery site. In addition, the Shipment/Delivery Weekly Progress Report shall identify any problems and provide a description of how the problems were resolved/addressed. If problems have not been completely resolved, the Contractor shall provide an explanation and status of resolution. Shipment/Delivery Weekly Progress Reports shall be submitted in Microsoft Excel Format and shall clearly identify each serial number of the equipment being delivered with one (1) serial number per cell.

Inspection: Destination Acceptance: Destination Free on Board (FOB): Destination

Packing Slips/Labels and Lists shall also include the following:

IFCAP PO #: ____________ (e.g., 166-E11234 (the IFCAP PO number is located in block #20 of the SF 1449)) Project Description: (e.g. Tier 1 Lifecycle Refresh)

Total number of Containers: Package ___ of ___. (e.g., Package 1 of 3)

Deliverables:

A. Master Delivery Schedule B. Shipment/Delivery Weekly Progress Report

GENERAL REQUIREMENTS

VA TECHNICAL REFERENCE MODEL

The Contractor shall comply with the VA OIT Technical Reference Model (VA TRM). Compliance with the VA TRM is achieved by using only technologies and standards that are listed as approved for use in the VA TRM. The Contractor shall provide all necessary information requested by VA to ensure TRM approval is obtained prior to use on VA’s network.

ZERO TRUST – VA CRITICAL SECURITY CONTROLS

VA has established minimum mandatory security requirements and requires that any network connected software system or service must meet the VA Critical Security Controls as outlined in the VA Memorandum, “VA Security Controls”, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010. VA Critical Security Controls identify the minimum mandatory requirements that must be implemented across all VA enterprise infrastructure, cloud computing environments, information systems, networks, and specialized devices (medical devices/systems, special-purpose systems, and research scientific computing devices) that process, store, and/or transmit VA data. Effective July 1, 2025, the Contractor shall implement these VA Critical Security Controls, within any network connected software system or service prior to being authorized for use in the VA. This functional requirement is not negotiable, and Plan of Action & Milestones (POAM) will not be accepted in the event these controls cannot be implemented for new systems. Critical Security Controls are intended to increase VA’s security posture and provide security and privacy risk visibility into the VA network and is not a new requirement. The Contractor’s failure to maintain these VA Critical Controls after implementation will result in VA discontinuing the use of the system.

SOCIAL SECURITY NUMBER (SSN) REDUCTION

The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN with the Integrated Control Number (ICN) in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA Master Person Index (MPI) for identity traits to include the use of the ICN as the Primary Identifier. The Contractor solution may only use a Social Security Number to identify an individual in an information system if and only if the use of such number is required to obtain information VA requires from an information system that is not under the jurisdiction of VA.

INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support IPv6-Only based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). Which defines IPv6-only as the state of an operational system or service when IPv4 protocol functions (addressing, packet forwarding) are not in use. The NIST USGv6 profile defines technical requirements for a product to be capable of operating in IPv6-Only environments. IPv6-Only technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices, applications, and systems shall support all applicable functionality on native IPv6-Only as well as dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g., web, email, DNS, ISP services, etc.) shall support native IPv6-Only and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall support using native IPv6-Only and dual stack (IPv6 / IPv4) for all functionality and operations.

SOFTWARE AND LICENSING REQUIREMENTS

The Contractor shall be responsible for the provision of all software licenses and any associated licensing maintenance required for any development, delivery, integration, operation, and/or maintenance associated with its proposed application(s), software products, software solution, and/or system including, but not limited to, any and all application(s), software and/or software products that comprise, are a part of, or integrate with the Contractor’s proposed application(s), software products, software solution, and/or system for the life of any resulting contract.

TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 “Secure External Connections”, and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the Cybersecurity & Infrastructure Security Agency (CISA) (https://www.cisa.gov/publication/tic-30-core-guidance-documents.)

POSITION/TASK RISK DESIGNATION LEVEL(S)

(For procurements which include continuous/full-time/on-site technical support being acquired with the hardware/software, additional security requirements may apply. Refer to the Security Checklist, Appendix A in the 6500.6 Handbook, especially response to question 4 to determine if risk designation determinations are required. If not, this section may be deleted.)

(All positions subject to investigation must be designated with a risk and sensitivity level based on the documented duties and responsibilities in accordance with VA Handbook 0710. Using the results of the Position Designation Automated Tool (PDT) (also known as PDAT) performed for each applicable service being procured, complete the table below. This “Service Task” Position Risk Designation correlates to individual Contractor personnel background investigation levels, depending upon which particular service task the contractor individual is working.

The PDT Tool is located at the following US Office of Personnel Management Website: Position Designation Tool (opm.gov))

(If it is determined that position risk designations are required, include the below information, change the text to black and convert the text to “No Spacing” style.)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

(List PD Item Numbers which contain the service(s) for this effort in the first column. Click on the selection box in the appropriate Position Risk Designation column to mark an x to indicate the proper Risk Designation associated with each task based upon the PDT tool results.)

Position Sensitivity and Background Investigation Requirements by Service Task/Item Number Service Task / Item Number

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

(Maintenance/installation (warranty) contracts that may involve a contractor’s access or exposure to VA sensitive information, in particular to sensitive personal information while implementing their contract services, requires the inclusion of the requirements of Sections B1 through B5 in Addendum B accordingly)

(For procurements which include continuous/full-time/on-site technical support being acquired with the hardware/software, additional information security requirements may apply. All Sections in this Addendum B must be reviewed to determine applicability to the requirements of the effort within the PD. Any Sections (B1 through B14) which DO NOT apply should be removed from this Addendum B. Requiring Activities should see the inclusion instructions prior to each Section and remove any full Sections that DO NOT apply (indicating “N/A” underneath the Section Heading(s)). The language within these Sections MUST NOT be modified.)

(For PD’s that do not require these additional security requirements, Addendum B may be deleted.)

ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM SECURITY/ PRIVACY LANGUAGE

NOTE: In the event of a conflict, VAAR Security Clauses take precedence over the language in this Addendum B.

APPLICABLE SECTIONS FROM: VA NOTICE 24-12, APRIL 22, 2024, UPDATE TO VA HANDBOOK 6500.6, CONTRACT SECURITY, APPENDIX C VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE, FOR INCLUSION INTO CONTRACTS, AS APPROPRIATE

(All Sections in this Addendum B must be reviewed to determine applicability to the requirements of the effort within the PWS. Any Sections (B1 through B14) which DO NOT apply should be removed from this Addendum B. Requiring Activities should see the inclusion instructions prior to each Section and remove any full Sections that DO NOT apply (indicating “N/A” underneath the Section Heading(s)). The language within these Sections MUST NOT be modified, except for the removal of instructional text provided prior to each Section)

GENERAL

This entire section applies to all acquisitions requiring any Information Security and Privacy language. Contractors, contractor personnel, Subcontractors and subcontractor personnel will be subject to the same federal laws, regulations, standards, VA directives and handbooks, as VA personnel regarding information and information system security and privacy.

VA INFORMATION CUSTODIAL LANGUAGE

a. The Government shall receive unlimited rights to data/intellectual property first produced and delivered in the performance of this contract or order (hereinafter “contract”) unless expressly stated otherwise in this contract. This includes all rights to source code and all documentation created in support thereof. The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General. The primary clause used to define computer software license (not data/intellectual property first produced under this Contractor or order) is FAR 52.227-19, Commercial Computer Software License.

b. Information made available to the Contractor by VA for the performance or administration of this contract will be used only for the purposes specified in the service agreement, SOW, PWS, PD, and/or contract. The Contractor shall not use VA information in any other manner without prior written approval from a VA Contracting Officer (CO). The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General.

c. VA information will not be co-mingled with any other data on the Contractor’s information systems or media storage systems. The Contractor shall ensure compliance with Federal and VA requirements related to data protection, data encryption, physical data segregation, logical data segregation, classification requirements and media sanitization.

d. VA reserves the right to conduct scheduled or unscheduled audits, assessments, or investigations of Contractor Information Technology (IT) resources to ensure information security is compliant with Federal and VA requirements. The Contractor shall provide all necessary access to records (including electronic and documentary materials related to the contracts and subcontracts) and support (including access to Contractor and Subcontractor staff associated with the contract) to VA, VA's Office Inspector General (OIG), and/or Government Accountability Office (GAO) staff during periodic…