Provider Directory Tool Product Description 050725.docx

DRAFT

DEPARTMENT OF VETERANS AFFAIRS

VHA Office of Integrated Veteran Care Integrated External Networks (IEN)

PROVIDER DIRECTORY TOOL

Date: April 25, 2025 Version 1.0

Contents

VERSION HISTORY

BACKGROUND

The Department of Veterans Affairs (VA) Veterans Health Administration (VHA) Office of Integrated Veteran Care (IVC) requires a Provider Directory in support of the Veteran Community Care Program (VCCP), VA Medical Centers, National Dialysis Services, Department of Defense Sharing Agreements, Veteran Care Agreements, Local Contracts, and Family Member Program providers. The Provider Directory shall display a comprehensive listing of all providers (active and non-active) and accommodate scalability for future growth of the Community Care Network (CCN) Program and other related VA initiatives for Veteran care with data integrity. The Provider Directory will replace the current VA Provider Profile Management System (PPMS).

PPMS is a consolidated repository that stores provider data integrated with an engine tool allowing VA staff, Veterans, and Providers to view various provider information. PPMS provides a business capability of network provider information available to VA schedulers, network managers, and others with responsibilities that require searching and analyzing information on network providers. Securing a new provider directory will improve Veteran and VA staff access to accurate information and expansion of capabilities to accommodate new IVC programs and networks.

PRODUCT REQUIREMENTS

The Provider Directory shall have the capability to incorporate provider information for all applicable Veteran community care (e.g., CCN, Veteran Care Agreements (VCAs), Dialysis, Local Contracts, Department of Defense sharing agreements, etc.) and VA Medical Center (VAMC) providers. In addition, the directory shall also have the capability to incorporate Veteran Family Member Care (VFMP) providers to include Civilian Health and Medical Program of Veterans Affairs (CHAMPVA), Camp Lejeune, Children of Woman Vietnam Veterans, and Spina Bifida as identified on the VA Community Care site: https://www.va.gov/communitycare/.

The directory shall have the ability to provide analytics to identify and provide reporting/recommendations on provider data integrity issues, intake VA business rules on the use of high-performing providers and/or steerage models and allow VA the flexibility to modify the capability throughout the life of the contract using agile methodologies. By implementing this capability, IVC will have consolidated systems and processes, enhancing usability by VA staff and Veterans and allow for evolving technology to be incorporated throughout the contract lifecycle.

The Provider Directory shall meet all the salient characteristics identified in Section 2.1. In addition, the Contractor shall provide assessment, authorization, and continuous monitoring support as required in Section 2.

The Contractor shall also provide the Cloud Infrastructure with all requirements detailed in Section 2. The Contractor shall perform all configurations necessary to meet these requirements. Should the VA Enterprise cloud infrastructure change or be updated during the period of performance of this contract, the Contractor shall support integration with the new cloud infrastructure based on the integration requirements included in Section 2 or other technical requirements based on the specifics of the new cloud infrastructure. The Contractor shall ensure the Provider Directory Software as a Service (SaaS) tool is available and operational for users 24/7.

SALIENT CHARACTERISTICS

VA has developed Salient Characteristics to describe all performance attributes of the Provider Directory tool. These salient characteristics are categorized into the following taxonomies:

1. Data Management: Requirements related to data accuracy, integrity, input, processing, storage, and output. This includes data formats, data entry validation, and data retrieval processes.

2. Business Rules: Specific rules or conditions that the system must adhere to, often derived from organizational policies or industry standards. For example, a banking application might have rules for calculating interest.

3. Features and Capabilities: Detailed descriptions of the system's features and the tasks it must perform. For example, a functional requirement for an e-commerce website might be the ability to process payments.

4. System Interfaces: Descriptions of how the system will interact with other systems, software, or hardware. This includes APIs, data exchange formats, and communication protocols.

5. User Interactions: Specifications of how users will interact with the system, including user interfaces, input methods, and expected outputs. This might include forms, buttons, and navigation flows.

6. User Roles and Permissions: Definitions of different user roles and the permissions or access levels associated with each role. This ensures that users can only perform actions appropriate to their role.

7. Workflow and Process Requirements: Specifications of the sequence of operations or processes that the system must support, including task automation and process flows.

Salient characteristics are also grouped by whether the requirement is “Out of Box”, “Customizable”, or “Configurable”. VA defines “Out of Box” as the SaaS solution already has the capability available for use and will be present and functional by project completion, “Customizable” as a design or custom/ formatting change, and Configurable denotes a change in the SaaS capability to conform to the VA requirement.

The Contractor shall propose a SaaS Product that meets all the minimum features/capabilities detailed in the table below:

Out of Box

SOFTWARE-AS-A-SERVICE

The Provider Directory shall:

a. Be, or be able to achieve FEDRAMP MODERATE authorization and validation through FEDRAMP Marketplace with the ability to move to the HIGH impact level should the need arise. Shall be FIPS 140-2, NIST 800, HIPAA, and 508 compliant.

b. Run on a cloud infrastructure and accessible from various client devices through either a thin client interface, such as a web browser (e.g., web-based email) or a program update.

c. Not require download of software to VA computers.

d. Not require VA to manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or individual application capabilities.

e. Be vendor or third-party hosted and require no servers within VA. There is no interface required to be developed or customization to the vendor hosted solution being requested.

f. Be accessible to up to several hundred thousand multiple simultaneous VA users at any given time, independent of the volume.

g. Include data objects that shall be editable with the support of Data Authoring and Versioning (DAV) control. Versioning (DAV) control.

ADDITIONAL PROVIDER DIRECTORY SAAS TOOL LICENSES (OPTIONAL)

This optional task may be exercised at any time during the base and all option periods as described in Section 4.1. If exercised, the Contractor shall provide additional Provider Directory (SaaS) tool licenses in accordance with PD Section 2.0, inclusive of all subsections.

ASSESSMENT, AUTHORIZATION, AND CONTINUOUS MONITORING

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA) and have a current VA authorization.

2. The Contractor shall comply with FedRAMP requirements (see Section 2.4) as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The Contractor shall, where applicable, assist with the VA ATO Sustainment Process to help maintain health and quality of agency authorization of the cloud service or migrated application.

4. The Contractor shall provide access to FedRAMP authorized and VA authorized environment.

5. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases.

6. If new or unanticipated threats or hazards are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with the Security Addendum B.

7. The Contractor shall not release any data without the consent of VA in writing. All requests for release must be submitted in writing to the Contracting Officer’s Representative (COR)/Contracting Officer (CO).

8. In order for live VA data to be used in this system, access must be provided to the FedRAMP Authorized and Agency Authorized environment.

9. The Contractor shall participate in monthly Agency and FedRAMP Sustainment meetings.

10. The Contractor shall participate in monitoring and reoccurring security artifacts, including monthly Plan of Action and Milestones (POAM) Reports.

11. Following guidance from the Federal Chief Information Officer, VA will utilize existing joint authorization board Authority to Operate (ATO) or agency ATO issued by another Government agency as a starting point for FedRAMP requirements. If neither of those exist, VA will sponsor FedRAMP ATO. VA will be using the FedRAMP baselines as a starting point, since they are specifically tailored for cloud services.

12. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application.

Deliverables: (See Section 8, “SCHEDULE OF DELIVERABLES” for details.)

A. Monthly POAM Reports B. FedRAMP SSP

C. 3PAO SAP

D. 3PAO SAR

FedRAMP REQUIREMENTS The following four Sections (2.4.1, 2.4.2, 2.4.3, and 2.4.4) provide the requirements for Provider Directory based upon the status of FedRAMP for the proposed solution. The Contractor shall provide validation of appropriate status and propose against 2.4.1 OR 2.4.2 OR 2.4.3, AND 2.4.4.

IF THE SOLUTION is Not FedRAMP AUTHORIZED

a. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA).

b. The Contractor shall comply with FedRAMP requirements. The level of both FedRAMP and VA authorization will be determined after award, as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

c. The Contractor shall provide a SaaS product as defined by the following criteria: Software as a Service (SaaS) is an application delivery model in which the application is hosted on a cloud infrastructure outside the security boundary of VA and is provided to the Cloud Service Customer (CSC) over the internet. The CSC uses the SaaS offering via a thin-client interface, such as a web-browser or a program interface. The CSC subscribes to the SaaS offering and is only responsible for minor in-app customizations. The Cloud Service Provider (CSP) offering the application is responsible for management of the application, safeguarding of data stored or processed by the application, and all elements of the underlying infrastructure. Additionally, the CSP is responsible for all on-going compliance.

In order to qualify as SaaS for use at VA, and to align with Federal Risk and Authorization Management Program (FedRAMP) requirements, the hosting for the offering must conform to the NIST 800-145 definition of Cloud Computing and thus contain following key characteristics:

1. On-Demand Self-Service: The CSP fully automates the provisioning of both the customer interface and the underlying cloud components of the SaaS offering. In some cases, to the CSP may provision internal resources manually, while providing the CSC an automated interface to request and track the service.

1. Broad Network Access: The SaaS capabilities are available over the internet or over a network that is available from all access points the CSC requires. The SaaS offering is accessible through common platforms (e.g., mobile phones, tablets, laptops, and workstations).

1. Resource Pooling: The computing infrastructure supporting the SaaS offering is shared among more than one CSC using a multi-tenant model, and resources are dynamically assigned depending on customer demand.

1. Rapid Elasticity: Computing capabilities are automatically provisioned and released in a manner that scales with customer demand. In some cases, the scaling of resources may not be fully automated, but it should be fast enough to support the needs of the CSC, which the CSC would have to define.

1. Measured Service: Resource usage, such as storage, processing, bandwidth, and user activity are measured and reported on in a manner that is relevant to the SaaS offering.

d. Following guidance from the Federal CIO, VA will utilize existing joint authorization board (JAB) authority to operate (ATO) or agency ATO issued by another agency as a starting point for FedRAMP requirements. If neither of those exist, VA will sponsor The Cloud Service Provider for a FedRAMP Authorization. VA will be using the FedRAMP baselines as a starting point, since they are specifically tailored for cloud services.

e. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application at the impact level required by VA to utilize the product. For this solution the required impact level is determined after award.

f. The Contractor shall comply with FedRAMP requirements surrounding data location within the Continental United States. FedRAMP specifies data location requirements in the High Baseline as part of control SA-9 (5); however, FedRAMP does not provide or specify data location requirements for other baselines.

g. The Contractor shall complete a FedRAMP System Security Plan (SSP) and supporting documentation including required attachments within 75 calendar days after contract award. (If Data Security Categorization is High Impact, this will be due 94 calendar days after contract award.)

h. The Contractor shall work with a VA Subject Matter Expert to develop a specific system boundary diagram including any integration and connectivity components for VA use. This will be known as the VA Implementation Diagram (VAID) and will demonstrate the proposed implementation of this system at VA. The Contractor shall complete this deliverable with VA within 10 calendar days of contract award.

i. The Contractor shall complete a Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) within 90 calendar days after contract award. (If Data Security Categorization is High Impact, this will be due after 113 calendar days after contract award.)

j. The Contractor shall complete a 3PAO Security Assessment Report (SAR) within 90 calendar days after the SSP is accepted by VA. (If Data Security Categorization is High Impact, this will be due 113 calendar days after the SSP is accepted by VA.)

k. The Contractor shall work with VA Subject Matter Experts to test the validity of the Incident Response Plan (IRP) and ensure proper troubleshooting of issues that may arise. This should be completed within 30 calendar days of the SSP being delivered.

l. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases.

m. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with Addendum B, VA Information and Information System Security/Privacy Language.

n. The Contractor shall comply with data management requirements.

o. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

p. The Contractor shall participate in FedRAMP Continuous Monitoring activities as outlined by FedRAMP’s Continuous Monitoring Strategy Guide found on the FedRAMP website.

q. The Contractor shall participate in monthly Agency and FedRAMP Sustainment meetings following the granting of a VA ATO.

r. The Contractor shall provide continuous monitoring activities including, but not limited to scans, security artifacts, and monthly Plan of Action and Milestones (POAM) reports as outlined by VA and FedRAMP requirements.

Deliverables:

1. FedRAMP System Security Plan (SSP) and required Attachments

1. VA Implementation Diagram

1. 3PAO Security Assessment Plan (SAP)

1. 3PAO Security Assessment Report (SAR)

1. Plan of Action and Milestones Monthly Reports.

IF THE SOLUTION is FedRAMP AUTHORIZED BUT NOT VA AUTHORIZED

a. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA)

b. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement

c. The system must be FedRAMP Authorized at no less than the level at which the contractor’s software is FedRAMP authorized. The level of VA authorization will be determined after award.

d. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application.

e. The Contractor shall provide confirmation of their FedRAMP System Security Plan (SSP) and supporting documentation completion via their repository ID number and a link for VA to download the SSP and all required artifacts within 5 calendar days of contract award.

f. The Contractor shall work with a VA Subject Matter Expert to develop a specific system boundary diagram including any integration and connectivity components for VA use. This will be known as the VA Implementation Diagram (VAID) and will demonstrate the proposed implementation of this system at VA. The Contractor shall complete this deliverable with VA within 10 calendar days of contract award.

g. The Contractor shall provide the results of their most recent Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) within 10 calendar days of contract award.

h. The Contractor shall complete a 3PAO Security Assessment Report (SAR) within 10 calendar days after the SSP is accepted by VA.

i. The Contractor shall provide VA with the most recent monthly scans for the production environment within the authorization boundary and their scan upload schedule for FedRAMP within 30 calendar days of contract award.

j. The Contractor shall provide their availability to participate in monthly continuous monitoring meetings to be scheduled following successful VA ATO within 30 calendar days of contract award.

k. The Contractor shall work with VA Subject Matter Experts to test the validity of the Incident Response Plane (IRP) and ensure proper troubleshooting of issues that may arise. This should be completed within 30 calendar days of the SSP being delivered.

l. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with Addendum B, VA Information and Information System Security/Privacy Language

m. The Contractor shall comply with data management requirements.

n. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

o. The Contractor shall participate in FedRAMP Continuous Monitoring activities as outlined by FedRAMP’s Continuous Monitoring Strategy.

p. The Contractor shall participate in monthly Agency and FedRAMP Sustainment meetings following the granting of a VA ATO.

q. The Contractor shall provide continuous monitoring activities including, but not limited to scans, security artifacts, and monthly Plan of Action and Milestones (POAM) reports as outlined by VA and FedRAMP requirements.

Deliverables:

1. FedRAMP System Security Plan (SSP) and required Attachments

1. VA Implementation Diagram

1. 3PAO Security Assessment Plan (SAP)

1. 3PAO Security Assessment Report (SAR)

1. Plan of Action and Milestones Monthly Reports.

IF THE SOLUTION is FedRAMP AUTHORIZED AND VA AUTHORIZED:

a. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA) and have a current VA authorization.

b. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

c. The FedRAMP Authorization level and existing VA ATO should be no less than the level required for this use case which has been defined as the level at which the contractor’s software is FedRAMP and VA authorized.

d. The Contractor shall, where applicable, assist with the VA ATO Sustainment Process to help maintain health and quality of agency authorization of the cloud service or migrated application.

e. The Contractor shall exclusively provide licenses and/or accounts to FedRAMP authorized and VA authorized environments.

f. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases.

g. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with Addendum B, VA Information and Information System Security/Privacy Language

h. The Contractor shall comply with data management requirements.

i. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

j. The Contractor shall participate in FedRAMP Continuous Monitoring activities as outlined by FedRAMP’s Continuous Monitoring Strategy Guide found on the FedRAMP Website.

k. The Contractor shall participate in monthly Agency and FedRAMP Sustainment meetings following the granting of a VA ATO.

Deliverables:

A. 3PAO Security Assessment Report (SAR) B. Continuous Monitoring Monthly Scans C. Plan of Action and Milestones Monthly Reports.

CLOUD-SPECIFIC SECURITY AND PRIVACY ACQUISITION REQUIREMENTS

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA).

1. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement. The contractor shall create, maintain, and update the following documentation using FedRAMP requirements and templates, which are available at www.FedRAMP.gov. The FedRAMP ATO package is comprised of this documentation:

0. Privacy Impact Assessment (PIA)

0. FedRAMP Test Procedures and Results

0. Security Assessment Report (SAR)

0. System Security Plan (SSP)

0. IT System Contingency Plan (ITCP)

0. IT System Contingency Plan (CP) Test Results

0. Plan of Action and Milestones (POA&M)

0. Continuous Monitoring Plan (CMP)

0. FedRAMP Control Tailoring Workbook

0. Control Implementation Summary Table

0. Results of Penetration Testing

0. Software Code Review

0. Interconnection Agreements/Service Level Agreements/Memorandum of Agreements

1. The information system must be assessed by an accredited 3PAO to support initial authorization and whenever there is a significant change to the system’s security posture in accordance with the FedRAMP Continuous Monitoring Plan.

1. The Contractor shall apply the appropriate set of baseline controls in accordance with VA’s categorization of the system (as defined in FIPS 199), as required in the FedRAMP Security Requirements Baseline document to ensure compliance to security standards.

1. The Contractor shall, where applicable, assist with the VA Authority to Operate (ATO) Process to help achieve agency authorization of a cloud service or migrated application.

1. The Contractor shall maintain a security management continuous monitoring environment based upon the latest edition of FedRAMP Security Controls Baseline and FedRAMP Continuous Monitoring Strategy Plan.

1. To the extent required to carry out the FedRAMP assessment and authorization process and FedRAMP continuous monitoring, to safeguard against threats and hazards to the security, integrity, and confidentiality of any non-public VA data collected and stored by the Contractor, the Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s facilities, installations, technical capabilities, operations, documentation, records, and databases.

1. If new or unanticipated threats or hazards are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with the SLA and FedRAMP.

1. The Contractor shall comply with all VA and FedRAMP privacy requirements.

1. VA has the right to perform manual or automated audits, scans, reviews, or other inspections of the vendor’s IT environment being used to provide or facilitate services for VA.

1. Identified gaps between required FedRAMP Security Control Baselines and Continuous Monitoring controls and the contractor’s implementation as documented in the Security Assessment Report shall be tracked by the contractor for mitigation in a Plan of Action and Milestones (POA&M) document. Depending on the severity of the gaps, the Department may require any gaps remediated before a provisional authorization is issued.

1. No data shall be released by the Contractor without the consent of VA in writing. All requests for release must be submitted in writing to the VA Contracting Officer.

1. VA may choose to cancel the Contract and terminate any outstanding orders if the contractor has its ATO revoked, and the deficiencies are greater than VA risk tolerance thresholds.

1. VA reserves the right to perform Penetration Testing. If VA exercises this right, the contractor shall allow VA employees (or designated third parties) to conduct Security Assessment activities to include control reviews in accordance with FedRAMP requirements. This Security Assessment does not omit the FedRAMP requirement for a 3PAO assessment.

1. FedRAMP deliverables shall be labeled “CONTROLLED UNCLASSIFIED INFORMATION” (CUI) or contractor selected designation per document sensitivity. External transmission/dissemination of FOUO and CUI to or from a VA computer must be encrypted. Certified encryption modules must be used in accordance with FIPS PUB 140-2, “Security requirements for Cryptographic Modules.” 16. All VA systems must comply with the Binding Operational Directive 19-01. For SaaS systems that are using VA branding, a .gov URL must be used or a POA&M must be created.

Deliverables:

A. FedRAMP ATO Package (as described in paragraph b. above) FedRAMP References: https://www.fedramp.gov

REMOTE SYSTEM ADMINISTRATION AND CONTENT MANAGEMENT SUPPORT

The Contractor shall provide remote system administration and content management support services for the Provider Directory tool product. The Contractor shall provide remote system administration support for tool implementation and management including the following activities:

1. Providing basic system administration functions, such as system configuration and running system reports.

2. Resolving product issues, such as answering questions; troubleshooting functionality; entering and tracking trouble tickets; verifying and reporting product issues.

3. Provide User Manuals for platform functionality.

4. Support all necessary product configuration or maintenance, including reporting framework, infrastructure integration, and general product suite requirements.

5. The Contractor shall document all system administration and content management activities and provide if requested by the COR.

Deliverable: (See Section 8, “SCHEDULE OF DELIVERABLES” for details.)

A. User Manuals

DATA MANAGEMENT

The Contractor shall provide comprehensive data management, data analytics, and reporting support for operational and performance capabilities to the Provider Directory tool.

DATA INTEGRITY

The Contractor shall review and ensure compliance of data stored in the data repository and upon data specification.

VA reserves the right to identify data integrity issues with physical or logical properties. Any data integrity issues identified by VA must be corrected within 30 days of observation and notification of the Contractor by VA.

SCALABILITY

The Contractor shall provide flexibility in storage and manage an increasing volume of data and information in the Provider Directory tool without compromising performance.

The Contractor shall ensure the system can adjust without difficulty, whether user base is growing, or VA has extended its operations to include additional provider directory capabilities based on policy changes. The Contractor shall leverage at their discretion, distributed architectures for data management such as cloud computing, code optimization techniques, and other techniques are necessary to achieve scalability.

REPORTING AND ANALYTICS

The Contractor shall include a data analytics and reporting functionality. The Contractor shall provide or build a user-friendly search capability into its information system/data repository. The Contractor’s system shall, at a minimum, accommodate data queries/searches on a Regional, Foreign postal code and Standard geographic area (State, County, and ZIP Code) basis. The Contractor shall provide regular monthly, quarterly, and ad-hoc reporting capabilities to meet performance and operational program requirements. VA access to the Contractor’s data analytics application shall be mutually agreed upon by the Contractor and VA and shall be included as part of the implementation plan.

The Contractor shall satisfy user requirements to provide reporting of, at minimum:

· Data analysis including, but not limited to validation, analysis, adjusting for outliers as well as developing, running, updating, and debugging code to analyze data and the ability to prepare reports and analyses that follow industry best practices.

· Performing multiple quantitative analyses.

· Ensure that individual data are de-identified and do not contain any protected health information (PHI) or personally identifiable information (PII) prior to download/distribution.

Reporting capabilities include but are not limited to:

· Audit Reports

· Change Request Reports (the reason for the change, potential impact, and required actions, serving as a formal record for review and approval).

· Complaints Tracking Reports

· Compliance Reports

Deliverables: (See Section 8, “SCHEDULE OF DELIVERABLES,” for details.)

A. Reporting and analytic functionality to support monthly, quarterly, and ad-hoc reports listed in Section 8, “Schedule of Deliverables”

SERVICE LEVEL REQUIREMENTS

The Contractor shall incorporate reliability in system design, ensuring consistent performance and minimal failures. The Contractor shall develop a solution that can be trusted to work correctly, even under stress or in different conditions. A reliable system minimizes downtime, handles errors smoothly, and provides consistent performance to users.

Reliability is considered high if it has repeatedly performed its function with success and low if it has tended to fail in repeated trials. The reliability of a system is defined as the probability of performing the intended function over a given period under specified operating conditions. System availability is a maintenance metric that measures the percentage of time an asset can be used. The Contractor shall ensure system availability through strategies such as redundancy, regular maintenance, system monitoring, load balancing, and disaster recovery. It is imperative Provider Directory is reliable, available, and functional whenever needed.

The Contractor shall meet the Service Level Requirement for each Service Level set forth in the following table.

CONTINUITY OF OPERATIONS

The Contractor shall develop a COOP that demonstrates the process for the continuous operation of its IT systems, data availability, and organizational support of the provider network. The Contractor’s COOP shall be submitted to VA prior to go-live and annually thereafter and shall be incorporated into the contract upon VA approval. The COOP must address the following categories:

· Process for continuous operations

· System maintenance (scheduled and unscheduled)

· Hardware/software system failures (to include Incident Response Plan)

· Temporary system unavailability

· Availability performance

· Disaster recovery The COOP shall include information specific to all actions that shall be taken by the Contractor to continue operations should an actual disaster be declared. Refer to VA Handbook 6500.6, Information Technology Contingency Planning (ITCP), for VA guidelines on establishing operational requirements and departmental framework for the implementation of ITCP.

When unscheduled downtime occurs for more than 1 cumulative hour in any given 24-hour period, the Contractor shall conduct a Root Cause Analysis.