PWS CCRA- final draft.docx

VA Community Care Referral, Authorization, Utilization Management and Care Coordination Systems

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Office of Community Care

VA Community Care Referral, Authorization, Utilization Management and Care Coordination Systems

Date: December 15, 2025

VA-26-00031811

PWS Version Number: 1.1

Contents

BACKGROUND

The mission of the VA Office of Information & Technology (OI&T), Product Delivery Service (PDS), is to provide benefits and services to U.S. Veterans. OI&T aims to deliver high-quality, effective, and efficient IT services to those providing care to Veterans at the point-of-care and throughout their healthcare journey. VA relies on Information Management/Information Technology (IM/IT) systems to achieve its mission goals.

The CCRA project currently uses the HealthShare Referral Manager (HSRM), a Section 508 compliant Commercial Off-The-Shelf (COTS) product, to expedite Veterans’ access to community care. HSRM enables VA, third-party administrators (TPAs), and community providers to manage community care referrals and authorizations more effectively. It reduces turnaround time for processing referrals, providing care, submitting claims, and receiving payments. HSRM integrates with various VA and non-VA healthcare systems and supports Emergency Care Reporting (ECR), the Veterans Affairs Patient Portal (VAPP), and other essential functionalities to maintain continuity of care for Veterans.

The Clinical Viewer (CV) module within HSRM allows VA staff and community providers to access a clinical summary of each Veteran's history, including diagnoses, procedures, medications, lab results, immunizations, and allergies. These details sync with any HSRM referral, ensuring information is readily available. CV provides a consolidated view of health information, aiding informed decisions and continuity of care. By integrating with the CCRA process, CV ensures that care provided by community providers is documented and accessible to VA providers, facilitating better coordination and follow-up.

The Emergency Care Reporting (ECR) system documents and reports instances when a Veteran receives emergency care from a community provider. The community provider or the Veteran must promptly notify the VA of the emergency care. This notification allows the VA to authorize the care retrospectively, ensuring that the Veteran's medical records are updated and follow-up care is coordinated. ECR integrates into the CCRA framework, ensuring that emergency care is recognized and authorized, maintaining continuity of care and proper documentation.

The Veterans Affairs Precertification Portal (VAPP) is a collaborative initiative between the Office of Integrated Veteran Care (IVC) and Veterans Health Administration (VHA) Revenue Operations (RevOps). It addresses deficiencies in identifying high-cost services by community providers that require precertification, enhancing budgetary projections and revenue collections for Veterans Affairs Medical Centers (VAMC). VAPP ensures high-quality care for Veterans by providing greater visibility and oversight of community care. It allows community providers to submit clinical documentation to support medical necessity, generating a precertification notification ID for claims adjudication. Additionally, VAPP includes an Administrative Module for managing RevOps worklists, reviewing submitted requests, and associated documentation, with features like secure login, search, sorting, filtering, and annotation capabilities.

Table 1: CCRA Solution Interfaces

Community Care Reimbursement System (CCRS)

Consolidated-Clinical Document Architecture (C‑CDA)

Enterprise Identity and Access Management (IAM) Single Sign-On Internal (SSOi)

Physician Authoritative Database

Healthcare Electronic Data Interchange (EDI) Clearing House

Community Care Provider Scheduling Solution

Veterans Data Integration and Federation (VDIF)

Emergency Care Reporting Tool (ECR)

Community Care Network (CCN)

Third Party Administrators (TPAs) via DAS

Cerner Millennium; Cerner CSS; Cerner Text Integration Utilities (TIU)

Primary Care Management Module (PCMM)

VA Online Scheduling (VAOS)

Consolidated Claims Processing

Master Patient Index (MPI)

Computerized Patient Record System (CPRS)

Consult Tool Box (CTB)

Corporate Data Warehouse (CDW)

APPLICABLE DOCUMENTS

The Contractor shall comply with the following documents, in addition to the documents in Paragraph 2.0 in the T4NG Basic Performance Work Statement (PWS), in the performance of this effort:

1. VA Enterprise Architecture https://www.ea.oit.va.gov/

2. VA Design, Engineering, and Architecture Compliance Criteria http://vaww.ea.oit.va.gov/design-engineering-architecture-dea-compliance/

3. Enterprise Design Patterns, available at: https://www.oit.va.gov/library/recurring/edp/index.cfm

4. Open Source Electronic Health Record Alliance (https://OSEHRA.org)

5. Server Virtualization First Policy: https://trm.oit.va.gov/files/Server_Virtualize_First_Policy.pdf

6. CCRA Requirements Backlog (Attachment A)

7. Privacy and Security Enterprise Design Pattern (Attachment B)

8. CCRA Interface Points (Attachment C)

9. No Attachment D

10. Enterprise SOA Design Pattern Data As A Service (DaaS) (Attachment E)

11. CCRA Solution Integration Architecture Plan (Attachment F)

12. Service Level Agreements for CCRA (Attachment G)

13. Department of Homeland Security Trusted Internet Connection (TIC) Reference Architecture (Attachment H)

14. No Attachment I

15. Enterprise SOA Design Pattern (Attachment J)

16. VA Directive 6517, Risk Management Framework for Cloud Computing Services (Attachment K)

17. Application Programming Interface (API) Specifications (Attachment L)

18. Assessment and Authorization Standard Operating Procedure (Attachment M)

19. Accreditation Requirements Guide Standard Operating Procedures (Attachment N)

20. Business Associates Agreement (Attachment O)

21. GSA NETWORX SLA: gsa.gov/networx

22. VA Direct Messaging security protocols Information: https://www.va.gov/VLER/vler-health-direct.asp

23. Veteran-Focused Integration Process (VIP) Guide 4.0, March 2021

24. EPMO Product Line Management Playbook, Version 2.0, May 2021

25. VA Product (Line) Accountability and Reporting System (VA PARS) Guide 3.0, December 2020

SCOPE OF WORK

The Contractor shall provide continued capability development and sustainment services for the HSRM Managed Service solution, inclusive of ECR and IPE. The HSRM solution is hosted at the AWS FedRAMP High Government Cloud with middleware HealthConnect systems hosted at VA Regional Data Centers. This support includes software maintenance, configuration, development, testing, integration, installation, implementation (product/service), training, customer support, optimization (technical/operational), cloud and network infrastructure sustainment, and adaptive, perfective, and corrective maintenance.

The Contractor shall adhere to VA policies and procedures to include, the Product Line Management Playbook, the Veteran-focused Integration Process (VIP) Guide or VA-approved Release Processes and adopt modern practices to continuously improve VA experiences through a combination of people, processes, and technology.

In addition, the Contractor shall provide operational expertise and support to VA users and non-VA users external to the VA network to ensure a successful implementation and continued sustainment of the HSRM solution. The Contractor shall create, operate, and maintain a customer support call center to provide end user support for all HSRM users outside VA. This expertise and support include communications with the workforce and external stakeholders, as well as organizational change management, training, and documentation.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The period of performance (PoP) shall be 12 months from date of award with four (4) 12-month Option Periods. Additionally, there are three (3) Optional Tasks that may be exercised in monthly increments for up to 12 months in alignment with the current PoP and one Optional Task for Transition Support. If all options are exercised, the overall TO PoP shall not exceed 62 months

PLACE OF PERFORMANCE

Efforts under this TO shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their Task Execution Plan submission. When travel is required, work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO) or the Contracting Officer’s Representative (COR).

TRAVEL

The Government encourages the Contractor to maximize its use of teleconferencing and video conferencing for meetings. The Government anticipates travel to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Travel and per diem shall be in accordance with the Federal Travel Regulations (FTR) and requires advanced concurrence by the COR. The Contractor shall provide cost estimates with each travel request. Each Contractor invoice shall include copies of all receipts that support the travel costs claimed in the invoice. The Government will not reimburse local travel within a 50-mile radius from the Contractor’s normal duty location. Travel performed for personal convenience and daily travel to and from work at the Contractor’s facility will not be reimbursed. Travel time for travel beyond a 50-mile radius of the Contractor’s facility may be authorized on a case-by-case basis and must be pre-approved by the COR.

SPECIFIC TASKS AND DELIVERABLES

CCRA is composed of the HSRM solution hosted in the AWS FedRAMP High Government Cloud with middleware HealthConnect systems hosted at VA Regional Datacenters and integrates with the VA Enterprise. The Contractor shall be responsible for the ongoing operation and maintenance and any development required for the IPE and ECR system. A sample snapshot of the business requirements backlog from Jira are provided as CCRA Requirements Backlog (Attachment A). The requirement backlog shall be maintained by the Contractor. New requirements and changes are provided, and prioritized by VA. The Contractor shall adhere to the work prioritized in collaboration with the VA COR, VA Program Manager (PM), and VA Business Stakeholders in addition to requirements and specifications defined elsewhere in this TO.

The Contractor shall perform the following.

1. Referrals and Authorizations

· The vendor shall demonstrate the ability to coordinate, manage and track referrals and authorizations

· The vendor shall show the ability to accept prior authorization and emergency care transactions and communicate confirmation

2. Utilization Management:

· The vendor shall demonstrate enhanced support for prospective outpatient, inpatient and retrospective utilization management, including the ability to evaluate and audit services for medical necessity at both micro and macro levels, with advanced analytic capabilities.

· The vendor shall demonstrate the ability to implement payer specific and clinical guidelines to support decision-making

3. Care Coordination:

· The vendor shall demonstrate the workflow management capabilities for case management of high-complexity patients, including the ability to track care status information.

· The vendor shall demonstrate incorporation of AI to optimize workflows related to the tracking and documentation of care coordination activities, supporting timely decision making and improved care delivery

· The vendor shall show the advanced analytics features that allow viewing claims data, medical documentation, care complexity, and risk factors.

· The vendor shall display how the system identifies completed and pending ancillary and supporting services.

· The vendor shall demonstrate the integration with direct care systems and other data capabilities/services to assist in transitioning care between direct and community settings.

4. Clinical Review Tool Integration for Clinical Appropriateness:

· The vendor shall show how the system supports clinical review and utilization management through close integration with clinical review tools (EHR agnostic) for both direct and community care or at least aligns with direct care clinical review processes.

· The system must support staff in determining clinical appropriateness, including but not limited to InterQual and Milliman Care Guidelines and VA-developed coverage policies.

5. Interoperability:

· The system must support seamless integration with VA and non-VA healthcare systems, ensuring efficient and secure bidirectional data exchange using industry standards such as HL7, FHIR, and DICOM.

· The system must connect with regional and national Health Information Exchanges

· The system must collect and analyze meta data related to process and contents and ensure standardized data exchange

· The system must ensure AI decisions are transparent and auditable for compliance

· The system must allow for flexibility of system to work alongside other AI solutions.

6. Medical Documentation:

· The system must accept structured (HL7, FHIR) and unstructured (PDF, scanned documents) documents from third party administrators and community care providers

· The system must connect with electronic health record systems such as a third-party administrator platform

· The vendor shall show capabilities for automated data capture to utilize solutions that extract relevant information from submitted documents

· The system must utilize AI with machine learning to analyze medical records and flag cases for review.

7. Reporting and Data Analytics:

· The vendor shall show capabilities for standard and custom-built reports that allow for scheduled and on-demand analytics

· The system shall support data warehouse integration with a central repository

To further elaborate on these requirements, the following refined requirements provide a detailed breakdown of the specific functionalities and capabilities that the VA seeks to evaluate during the vendor demonstrations. While the VA is particularly interested in demonstrations that address these requirements, vendors are not obligated to cover every individual requirement listed below.

1. Utilization Management:

· Automated Utilization Review Demonstrate automated utilization review capabilities, including the ability to apply clinical guidelines and criteria to determine the medical necessity of services.

· Authorization Management Show how the system manages authorizations, including initial requests, renewals, and modifications.

· Reporting and Analytics Provide examples of reporting and analytics capabilities, including utilization trends, compliance with guidelines, and performance metrics.

2. Care Coordination:

· Receive Consults/Referrals from EHRs Demonstrate methods of interoperability with EHRs, especially HL7, including support for different versions of HL7.

· Send Status Updates to EHRs Showcase the ability to send status updates such as appointment scheduling, cancellations, and clinical notes.

· Receive and Associate Medical Records Display the process of receiving medical records from EHRs and associating them with the corresponding consult/referral.

· Disseminate Consults and Medical Records Show various communication methods for disseminating consults and associated records, including portals, electronic transfer, text, fax, letters, secure messaging, and email.

· Automated Workflows and Business Rules Focus on automated workflows and automation based on business rules. Provide both manual and automated solutions with service-oriented architecture, flexible components, APIs, and configurable workflows.

· Manage Worklists and Display Referral Status Demonstrate the management of worklists, task assignments, filtering, sorting, and display of referral status and history.

· Dental Plan Information Include an initial dental referral plan view: tooth, area of mouth, ADA codes, and related treatment plan guidelines.

· Clinical View Show the receipt and display of care coordination plans, documents, notes, and a comprehensive view of the patient's care.

3. Clinical Review Tool:

· Clinical Decision Support Demonstrate the integration of clinical decision support tools to assist in the review and authorization process.

· Peer Review Process Show how the system supports peer review processes, including case assignment, review workflows, and documentation.

4. Interoperability:

· Standards-Based Integration Demonstrate the system's ability to integrate with other healthcare systems using standards such as HL7, FHIR, and DICOM.

· Data Exchange Show how the system supports bidirectional data exchange with VA and non-VA systems, including the ability to handle various data formats and protocols.

5. Identity and Access Management:

· User Authentication and Authorization Demonstrate robust user authentication and authorization mechanisms, including support for single sign-on (SSO) and multi-factor authentication (MFA).

· Role-Based Access Control Show how the system implements role-based access control (RBAC) to ensure users have appropriate access based on their roles and responsibilities.

· Multi-channel Communication for Real Time Engagement Veteran engagement features that support multi-channel communication for real time engagement.

6. Compliance, Security, and Maintenance:

· Compliance with VA's Technical Reference Model (TRM) and Section 508 Standards Ensure the solution is compliant with VA's TRM and Section 508 standards.

· Security and Privacy Demonstrate the capability to securely handle PII and PHI.

· System Maintenance Provide details on software maintenance, configuration, development, testing, implementation, training, along with sustaining the cloud and network infrastructure.

· Data Security Demonstrate how the system ensures the security of sensitive data, including PII and PHI, through encryption, access controls, and audit logging.

· Regulatory Compliance Show how the system complies with relevant regulations and standards, including HIPAA, VA's Technical Reference Model (TRM), and Section 508.

7. Support:

· Customer Support Describe the customer support services offered, including helpdesk support, training, and user documentation.

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

REPORTING REQUIREMENTS

The Contractor shall deliver Bi-Weekly (every two weeks) EPMO Status Reports detailing the status of all work efforts. These reports shall provide accurate, timely, and complete project information supporting EPMO reporting Requirements. The Bi-Weekly EPMO Status Report shall include the following data elements:

1. Project Name

2. Overview and description

3. Overall high-level assessment of progress

4. All work-in-progress and completed during the reporting period

5. Identification of any related issues uncovered during the reporting period and especially highlight those areas with a high probability of impacting schedule, cost or performance goals and their likely impact on schedule, cost, or performance goals

6. Explanations for any unresolved issues, including possible solutions and any actions required of the Government and/or Contractor to resolve or mitigate any identified issue, including a plan and timeframe for resolution

7. Status on previously identified issues, actions taken to mitigate the situation and/or progress made in rectifying the situation

8. Work planned for the subsequent four reporting periods, when applicable

9. Current TO Name schedule overlaid on original schedule showing any delays or advancement in the schedule

10. Workforce staffing data showing all Contractor personnel performing on the effort during the current reporting period. After the initial labor baseline is provided, each Bi-Weekly EPMO Status Report shall identify any changes in staffing identifying each person who was added to the TO or removed from the TO

11. Original schedule of deliverables and the corresponding deliverables made during the current reporting period

12. Identification of a single Contractor Onboarding POC, the names of all personnel engaged on the task, their initial training date for VA Privacy and Information Security training, and their next required training date

These reports shall not be the only means of communication between the Contractor, COR and the VA Program/Project Manager to advise of performance/schedule issues and to develop strategies for addressing the issues. The Contractor shall continuously monitor performance and report any deviation from the CPMP or previous Bi-Weekly EPMO Status Report to the COR and VA Program/Project Manager during routine, regular communications.

Deliverable:

A. Bi-Weekly EPMO Status Report

GENERAL REQUIREMENTS

ENTERPRISE AND IT FRAMEWORK

The Contractor shall develop and maintain interfaces required to integrate the HSRM solution with the VA enterprise, to include newly developed/modified/updated middleware, including Application Program Interfaces (API), and Vista patches. All APIs, middleware, and VistA patches shall be developed in accordance with the VIP/Agile SDLC tasks in PWS Section 5.5 and its subparagraphs. These development items will allow connectivity and data transfer between the HSRM solution and internal VA systems. A list of the systems the HSRM solution interfaces with currently and that are planned can be found in the CCRA Interface Points (Attachment C).

The Contractor shall support the business processes involved in the CCRA workflow, as the application consumes data from external as well as multiple internal VA legacy systems. As part of a transformative agenda, VA is making a deliberate shift towards becoming an API driven digital enterprise. All API development shall be in accordance with the specifications outlined in the API Specifications (Attachment L).

The Contractor shall be compliant with all VA enterprise architecture standards and shall develop middleware either using the VA Enterprise Messaging Infrastructure (eMI) or API. The Contractor shall:

1. Develop and provide all connections to interface the HSRM solution with the VA enterprise (some of which are defined in CCRA Interface Points (Attachment C) and others required that do not currently exist)

2. Develop all updates and upgrades to existing interfaces required to interface the HSRM solution with the VA enterprise

3. Use industry standard messaging in compliance with the VA TRM

4. Maintain all existing interfaces to the HSRM solution

VA TECHNICAL REFERENCE MODEL

The Contractor shall comply with the VA OIT Technical Reference Model (VA TRM). Compliance with the VA TRM is achieved by using only technologies and standards that are listed as approved for use in the VA TRM. The Contractor shall provide all necessary information requested by VA to ensure TRM approval is obtained prior to use on VA’s network.

ZERO TRUST – VA CRITICAL SECURITY CONTROLS

The Contractor shall provide A&A support required to achieve and maintain full A&A certification in compliance with VA Handbook 6500, VA Handbook 6500.6 (Section 3), and VA Handbook 6500.3. Further guidance is available in Accreditation Requirements Guide Standard Operating Procedures (Attachment N).

The Contractor shall support a Security Control Assessment (SCA) conducted by the VA Enterprise Risk Management (ERM) team.

The Contractor shall ensure all security assessments are completed using VA-provided tools to include but not be limited to Agiliance Risk Vision. The Contractor shall enable VA access to the system to conduct vulnerability scanning and prioritize corrective actions to mitigate identified weaknesses and vulnerabilities. The Contractor shall perform risk assessments and risk handling to include mitigating discovered vulnerabilities. The Contractor shall perform continuous monitoring per VA’s CRISP. The Contractor shall submit all required security document artifacts.

The Contractor shall ensure any findings produced because of the security assessments are remediated to support A&A. The Contractor shall ensure all other security requirements are met specific to the Federal Information Processing Standard (FIPS) 199 categorization documented because of the Risk Assessment and applicable VA policy. The Contractor shall ensure all requirements of the A&A Standard Operating Procedure (Attachment M) are met.

VA has established minimum mandatory security requirements and requires that any network connected software system or service must meet the VA Critical Security Controls as outlined in the VA Memorandum, “VA Security Controls”, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010. VA Critical Security Controls identify the minimum mandatory requirements that must be implemented across all VA enterprise infrastructure, cloud computing environments, information systems, networks, and specialized devices (medical devices/systems, special-purpose systems, and research scientific computing devices) that process, store, and/or transmit VA data. Effective July 1, 2025, the Contractor shall implement these VA Critical Security Controls, within any network connected software system or service prior to being authorized for use in the VA. This functional requirement is not negotiable, and Plan of Action & Milestones (POAM) will not be accepted in the event these controls cannot be implemented for new systems. Critical Security Controls are intended to increase VA’s security posture and provide security and privacy risk visibility into the VA network and is not a new requirement. The Contractor’s failure to maintain these VA Critical Controls after implementation will result in VA discontinuing the use of the system.

FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The Contractor shall follow all applicable organization policies and procedures governing information security, including compliance with VA mandated protection of PII and PHI. The Contractor shall ensure that RMF security controls in VA Handbook 6500 Appendix F (Access to Federal Information and Information Systems), SP 800-53 (Controls for Federal Information Systems), HIPAA Privacy Rule [45 CFR 164.502(b), 164.514(d)], as well as VA specific requirements, are implemented, such as VHA Directive 1605.01, Privacy and Release of Information. VA must also comply with the Privacy Act and all applicable privacy statutes, which 1605.01 outlines/includes.

The Contractor shall identify, mitigate, and resolve IA issues and concerns, including existing and newly identified information system vulnerabilities.

VA has a unified enterprise Identity and Access Management (IAM) program to coordinate the secure access to VA resources for both internal and external users. Office of Management and Budget (OMB) M 11- 11 mandates that agencies “require the use of PIV credentials as the common means of authentication for access to that agency’s facilities, networks, and information systems” for internal users and contractors. External users such as other Government agencies, private sector parties, and citizens, including veterans, require varying levels of access to interact with VA services. This Privacy and Security Enterprise Design Pattern (Attachment B) describes the “to-be” state for VA internal (PIV-enabled VA employees, contractors, and volunteers) and external (business partners, Veterans and others who access VA resources from outside the VA network) user identity authentication. In addition to describing the “static” rules for authentication, this document describes “adaptive” authentication tools that will be implemented and the need for authentication protocols that can support role-, attribute-, and risk-based access controls.

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Architecture (EA), and VA Identity and Access Management (IAM) approved Enterprise Technology Guidelines (ETG). The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in Executive Order 14028, VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program, CISA Binding Operational Directive 23-01, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500, and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the ETGs. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-05-24, M-19-17, M-22-09, and NIST Federal Information Processing Standard (FIPS) 201-3. Contractor delivered applications and systems shall be on the FIPS 201 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Person Index (MPI) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable Technology Guideline as outlined in VA ETG.

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion-based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

10. Role Based Access Control.

11. Auditing and reporting capabilities.

12. Compliance with VIEWS 00155984, PIV Logical Access Policy Clarification https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896.

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

INTERNET PROTOCOL VERSION 6 (IPv6)

The Contractor solution shall support IPv6-Only based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). Which defines IPv6-only as the state of an operational system or service when IPv4 protocol functions (addressing, packet forwarding) are not in use. The NIST USGv6 profile defines technical requirements for a product to be capable of operating in IPv6-Only environments. IPv6-Only technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices, applications, and systems shall support all applicable functionality on native IPv6-Only as well as dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g., web, email, DNS, ISP services, etc.) shall support native IPv6-Only and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall support using native IPv6-Only and dual stack (IPv6 / IPv4) for all functionality and operations.

TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 “Secure External Connections”, and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the Cybersecurity & Infrastructure Security Agency (CISA) (https://www.cisa.gov/publication/tic-30-core-guidance-documents).

STANDARD COMPUTER CONFIGURATION

The Contractor IT end user solution that is developed for use on standard VA computers shall be compatible with and be supported on the standard VA operating system, Windows 10 (64bit) and Windows 11, Edge (Chromium based), and 365 Apps for enterprise. Applications delivered to VA and intended to be deployed to Windows 10 and or Windows 11 workstations shall be delivered as a signed .msi package with switches for silent and unattended installation and updates shall be delivered in signed .msp file formats for easy deployment using Microsoft Endpoint Configuration Manager (CM) VA’s current desktop application deployment tool. Signing of the software code shall be through a vendor provided certificate that is trusted by VA using a code signing authority such as Verizon/Cybertrust or Symantec/VeriSign. The Contractor shall also ensure and certify that their solution functions as expected when used from a standard VA computer, with non-admin, standard user rights that have been configured using the Defense Information Systems Agency (DISA) Secure Technical Implementation Guide (STIG) specific to the particular client operating system being used.

VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT LINE MANAGEMENT (PLM)

The Contractor shall support VA efforts IAW the Veteran-Focused Integration Process (VIP) Guide and Product Line Management (PLM) Playbook. The major focus of VIP is on Enterprise Oversight, Governance, reporting, and establishing practices that focus on outcomes and continuously delivering sustainable IT capabilities to benefit the Veteran. PLM is a framework that focuses on delivering functional products that provide the highest priority work to customers while delivering simplified, reliable, and practical solutions to the business, medical staff, and our Veterans. The VIP Guide is a companion guide to the PLM Transformation Playbook and can be found at: https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 and the PLM Transformation Playbook can be found at https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946. VIP and PLM are the authoritative processes that IT projects must follow to ensure development and delivery of IT products.

The VIP Guide provides guidance for transitioning from project-centric to product-centric delivery. The VIP guide applies to all OIT Office of Management and Budget (OMB) reportable products that are required to collect and report costs, schedules, risks, and other valuable information in VA PARS (whether products are procured or developed by VA) and any VA Information Technology project effort in Software Product Management (SPM) and Infrastructure Operations (IO), or their successors, that touch the VA network regardless of IT organizational alignment (whether it spends government funding from VA's Congressional IT Appropriation or any other appropriation).

The PLM Transformation Playbook details how OIT leadership expects Product Lines (PLs) to implement PLM, DevOps, and Lean-Agile principles, methods, practices, and techniques through levels of maturity. The PLM Transformation Playbook applies to all Information Technology (IT) products aligned to PLs in the Software Product Management, Infrastructure Operations and Product Engineering organizations within the OIT organization.

Others outside the referenced groups or organizations may use the VIP Guide and PLM Transformation Playbook for situational awareness as needed.

PROCESS ASSET LIBRARY (PAL)

The Contractor shall perform their duties consistent with the processes defined in the OIT Process Asset Library (PAL). The PAL includes a spectrum of OIT functions and activities, such as project management, operations, service delivery, communications, acquisition, and resource management. PAL serves as an authoritative and informative repository of searchable processes, activities or tasks, roles, artifacts, tools and applicable standards and guides to assist the OIT workforce, Government and Contractor personnel. OIT utilizes PAL processes to ensure compliance with policies and regulations and to meet VA quality standards. The PAL includes the contractor onboarding process consistent with Section 6.2.2 and can be found at process_CONB_ext.docx (live.com). The main PAL can be accessed at www.va.gov/process.

AUTHORITATIVE DATA SOURCES

The VA Enterprise Architecture Repository (VEAR) is one component within the overall EA that establishes the common framework for data taxonomy for describing the data architecture used to develop, operate, and maintain enterprise applications. The Contractor shall comply with the department’s Authoritative Data Source (ADS) requirement that VA systems, services, and processes throughout the enterprise shall access VA data solely through official VA ADSs where applicable, see below. The Information Classes which compose each ADS are located in the VEAR, in the Data & Information domain. The Contractor shall ensure that all delivered applications and system solutions support:

1. Interfacing with VA’s Master Person Index (MPI) (formerly the Master Veteran Index (MVI)) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

2. Interfacing with Capital Asset Inventory (CAI) to conduct real property record management actions, if the solution relies on real property records data. CAI is the authoritative source for VA real property record management data.

3. Interfacing with electronic Contract Management System (eCMS) for access to contract, contract line item, purchase requisition, offering vendor, and solicitation information above the micro-purchase threshold, if the solution relies on procurement data. ECMS is the authoritative source for VA procurement actions data.

4. Interfacing with HRSmart Human Resources Information System to conduct personnel action processing, on-boarding, benefits management, and compensation management, if the solution relies on personnel data. HRSmart is the authoritative source for VA personnel information data.

5. Interfacing with VA Profile to access personal contact information, if the solution relies on VA Veteran personal contact information data. VA Profile is the authoritative source for VA Veteran Personal Contact Data.

6. Interfacing with VA/Department of Defense (DoD) Identity Repository (VADIR) for determining eligibility for VA benefits under Title 38, if the solution relies on qualifying active duty military service data. VADIR is the authoritative source for qualifying active duty military service in VA.

7. Interfacing with VA Systems Inventory (VASI) to access VA systems information, if the solution relies on VA system information. VASI is the authoritative source for VA Information Technology systems.

8. Interfacing with Enterprise Mission Assurance Support Service (eMASS) to access the Authority to Operate (ATO) status of all VA Information Systems. eMASS contains the official Authority to Operate (ATO) status of all VA Information Systems.

SOCIAL SECURITY NUMBER (SSN) REDUCTION

The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN with the ICN in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA MPI for identity traits to include the use of the ICN as the Primary Identifier. The Contractor solution may only use a Social Security Number to identify an individual in an information system if and only if the use of such number is required to obtain information VA requires from an information system that is not under the jurisdiction of VA.

SOFTWARE AND LICENSING REQUIREMENTS

(If this acquisition is a software product and/or solution acquired as subscription service within an XaaS (Anything as a Service) environment (not via licenses) or this acquisition does not involve any aspect of a software solution or software product at all, this paragraph and Section can be removed entirely from the PWS. Any questions regarding this language should be addressed to Brandon Storms, Office of Strategic Sourcing, at Brandon.Storms@va.gov or via the VA OSS CECM All Staff (GAL Distribution Group.)

The Contractor shall be responsible for the provision of all software licenses and any associated licensing maintenance required for any development, delivery, integration, operation, and/or maintenance associated with its proposed application(s), software products, software solution, and/or system including, but not limited to, any and all application(s), software and/or software products that comprise, are a part of, or integrate with the Contractor’s proposed application(s), software products, software solution, and/or system for the life of any resulting contract.

SECURITY AND PRIVACY REQUIREMENTS

The Contractor shall participate in security functions required to ensure the confidentiality, integrity and availability of computer systems including, security safeguard reviews, audits, reporting suspected security violations, acting to secure system environments, monitoring and responding to computer security alerts.

The Contractor shall support investigations related to Litigation Holds and the Office of Inspector General.

POSITION/TASK RISK DESIGNATION LEVEL(S)

a. A Contractor/Subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, Subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All Contractors, Subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for Contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates (e.g. Business Associate Agreement, Section 3G), the Contractor/Subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The Contractor or Subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the Contractor or Subcontractor’s employ. The Contracting Officer must also be notified immediately by the Contractor or Subcontractor prior to an unfriendly termination.

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Position Sensitivity and Background Investigation Requirements by Task

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

Contractor Responsibilities:

1. The Contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain the appropriate Background Investigation, and are able to read, write, speak, and understand the English language.

Within 3 business days after award, the Contractor shall provide a roster of Contractor and Subcontractor employees to the COR to begin their background investigations in accordance with the PAL template artifact.