PWS - ISTAR Posting.pdf

Performance Work Statement

ISTAR Adverse Events Reporting System Recompetition

Office of Quality

9/27/2024

1. General: This is a non-personnel services contract to provide software for an incident reporting and management system. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn, is responsible to the Government.

1.1. Description of Services/Introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform the Adverse Events Reporting System as defined in this

Performance Work Statement except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract.

1.2. Background: The Indian Health Service (IHS), an agency within the Department of Health and

Human Services, is responsible for providing federal health services to American Indians and

Alaska Natives (AI/AN). The mission of IHS is to raise the physical, mental, social, and spiritual health of AI/AN to the highest level and assure that comprehensive, culturally acceptable personal and public health services are available and accessible to members of the 574 federally recognized Tribes across the United States.

The Agency provides essential, personal health services for approximately 2.8 million American

Indians and Alaska Natives. The IHS provides medical and surgical inpatient care, routine and emergency ambulatory care, and medical support services including laboratory, pharmacy, nutrition, diagnostic imaging, medical records, and physical therapy. The IHS and tribes primarily serve small, rural populations with primary medical care and community health services, relying on the private sector for much of the secondary and most of the tertiary medical care needs. Some IHS and tribal hospitals provide secondary medical services such as ophthalmology, orthopedics, infectious disease, emergency medicine, radiology, general and gynecological surgery, and anesthesia.

The IHS system of care is unique in that personal health care services are integrated with community health services. The program includes public/community health programs targeting health conditions disproportionately affecting AI/AN populations such as diabetes, maternal and child health, and communicable diseases including influenza, human immunodeficiency virus/acquired immune deficiency syndrome (HIV/AIDS), syphilis, and viral hepatitis. Tribal governments or tribal organizations design and manage the delivery of individual and community health services through 22 hospitals, 330 health centers, 559 ambulatory clinics, 76 health stations, 146 Alaska village clinics, and 7 school health centers. The remainder of the

Agency’s program is managed by direct federal programs that provide health care at the Service

Unit and community level. The federal system consists of 21 hospitals, 53 health centers, 25 health stations, and 12 school health centers.

Ensuring that quality care is provided to the Agency’s patients is essential. As part of this commitment, IHS has worked with oversight organizations to review its care and identify improvements.

In 2017, the U.S. Government Accountability Office (GAO) found that there were oversight issues1:

“Officials from all nine area offices told us that their oversight of the quality of care includes monitoring adverse events that occur at IHS facilities, such as medication errors or patient falls, and taking steps to prevent future adverse events. While all IHS facilities have the means to report and monitor adverse events through an IHS-wide web-based reporting tool—WebCident— officials told us reporting adverse events through WebCident has been inconsistent.

Officials from one area office stated that adverse events are not always reported through WebCident, and therefore the appropriate staff are often not notified when adverse events occur, including those resulting in patient harm. These officials stated that this creates a lost opportunity to address the deficiency and improve, as well as to hold individuals accountable. Officials from IHS headquarters reported that they plan to enhance this reporting system to encourage consistent use by facility staff, or replace it with a new system after

January 2017.”

In 2020, the Office of the Inspector General, Dept. of Health of Human Services issued a report:

“Incidence of Adverse Events in Indian Health Service Hospitals”2. OEI-06-17-00530

(https://oig.hhs.gov/oei/reports/OEI-06-17-00530.pdf )

“…IHS operates an incident reporting system, called WebCident, to monitor adverse events and other patient safety issues.72 Physicians, nurses, and other hospital staff report patient safety-related events into WebCident. Patients and their family members may also report events. Reports typically include first-person accounts and other descriptive information about the events. In addition to logging events into WebCident, IHS hospitals may keep their own incident report files that capture similar information. Prior OIG work found that hospitals nationwide use incident reporting systems as the primary tool to track and analyze patient harm events.

Although IHS hospitals operate incident reporting systems, it is likely that not all adverse events are recorded in these systems. A GAO study found that IHS providers did not consistently use WebCident to report adverse events in

2017.74 IHS officials stated that the lack of reporting resulted in a lost opportunity to address deficiencies. Furthermore, OIG learned from interviews with IHS in December 2019 that the WebCident system is no longer supported

1Indian Health Service: Actions Needed to Improve Oversight of Quality of Care, GAO-17-181 https://www.gao.gov/assets/gao-17-181.pdf 2 Incidence of Adverse Events in Indian Health Service Hospitals, OEI-06-17-00530 https://oig.hhs.gov/oei/reports/OEI-06-17-00530.pdf https://oig.hhs.gov/oei/reports/OEI-06-17-00530.pdf https://www.gao.gov/assets/gao-17-181.pdf and lacks the capability to categorize reports, query data, and send automatic notifications when a report is entered into the system.”

In 2018, IHS began contracting for a replacement system to WebCident and contracted with RL

Datix to provide the software and support necessary for the follow-on system, IHS Safety

Tracking and Response System, or I-STAR. This system was implemented in August 2020. It supports patient, medication, visitor, facility, proper, security, and employee adverse event and good catch (near miss) reporting in compliance with federal requirements. These efforts support leadership’s oversight and monitoring of IHS activities to ensure our systems continue to promote quality and safety within the IHS.

1.3. Objectives: This is a request for a Commercially Available Off-the-Shelf (COTS) incident reporting and investigation system and database that is FedRAMP certified or able to operate inside the IHS network that will support facility and field operations IHS-system-wide. The

COTS product should address patient-safety-related and non-patient-safety-related safety incidents. The COTS product will be modified as described in section 5.5. The system will be available for all federal, Tribal, and Urban Indian Health Programs IHS employees, be available

24 hours a day, 7 days a week to report incidents, and will be utilized at the national, regional, and local levels by approximately 800 patient-care related safety account holders and 400 non-patient-care related safety account holders to investigate incidents. The contractor should have technical experience or competency in the fields of patient safety, medication errors, occupational safety, physical security, and risk management.

1.4. Scope: Services include providing software necessary to implement the incident reporting system and providing technical support as required. The contractor shall support granular user access controls and tooling for Account Holders to perform investigation, analysis and aggregation, and reporting of reported events at the local, regional, and national levels. User access control should include by organization or tenancy, organizational scope and hiearchy, and by types of events. The contractor shall accomplish system availability of at least 99 percent, meet Federal IT/Security/Accessibility requirements, and a help desk that shall have a toll-free number, email address, and instant chat; and be available 8 am to 8 pm Eastern Time, Monday through Friday.

1.5. Period of Performance: The period of performance shall be for one (1) Base Year of 12 months and four (4) 12-month option years.

1.6. General Information

1.6.1. Quality Assurance: The government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the contractor has performed following the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.6.2. Recognized Holidays: The contractor shall not be responsible for maintaining the helpdesk and other technical support functions during federally recognized holidays, as defined in 5

U.S. Code § 6103. The current holidays are listed below:

• New Year's Day (January 1).

• Birthday of Martin Luther King, Jr. (Third Monday in January).

• Washington's Birthday (Third Monday in February).

• Memorial Day (Last Monday in May).

• Juneteenth National Independence Day (June 19)

• Independence Day (July 4).

• Labor Day (First Monday in September).

• Columbus Day (Second Monday in October).

• Veterans Day (November 11).

• Thanksgiving Day (Fourth Thursday in November).

• Christmas Day (December 25).

1.6.3. Hours of Operation: The contractor is responsible for conducting business, between the hours of 8 am to 8 pm Eastern Time, Monday through Friday except on Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The contractor will not be reimbursed when the government facility is closed for the above reasons. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

1.6.4. Place of Performance: The work to be performed under this contract will be performed virtually. Any meetings required under the terms of this contract will be held in person or virtually, as determined by the COR.

1.6.5. Type of Contract: The government will award a firm-fixed-price contract.

1.6.6. Post-Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post-award conference convened by the contracting activity or contract administration office per Federal Acquisition Regulation Subpart 42.5. The contracting officer, Contracting

Officers Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the contracting officer will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues.

These meetings shall be at no additional cost to the government.

1.6.7. Contracting Officer Representative (COR): The (COR) will be identified by a separate letter. The COR monitors all technical aspects of the contract and assists in contract administration The COR is authorized to perform the following functions: assure that the

Contractor performs the technical requirements of the contract: perform inspections necessary in connection with contract performance: maintain written and oral communications with the Contractor concerning technical aspects of the contract: issue written interpretations of technical requirements, including Government drawings, designs, specifications: monitor Contractor's performance and notifies both the Contracting Officer and Contractor of any deficiencies; coordinate availability of government furnished property, and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially concerning changes in cost or price, estimates, or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.6.8. Key Personnel: The following personnel are considered key personnel by the government:

the Contract Manager. The contractor shall provide a contract manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the contracting officer. The contract manager or alternate shall have full authority to act for the contractor on all contract matters relating to the daily operation of this contract. The contract manager or alternate shall be available between 8:00 a.m. to 4:30 p.m. EST, Monday through Friday except on Federal holidays or when the government facility is closed for administrative reasons.

1.6.9. Identification of Contractor Employees: All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed.

1.6.10. Data Rights: The Government has unlimited rights to all documents/material produced under this contract. All documents and materials, including the source codes of any software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor without written permission from the Contracting Officer. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

1.6.11. Information Security:

1.6.11.1. Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-

16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution. See the Updated Departmental Standard for the Definition of

Sensitive Information, dated May 18, 2009, for additional information on defining and protecting sensitive information.

https://intranet.hhs.gov/it/cybersecurity/docs/policies_guides/HM/dept_standard_for_ def_of_sens_info-051809.pdf

1.6.12. Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of

HHS shall be used only to carry out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary for the performance of the contract. The Contractor assumes responsibility for the protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each

Contractor officer or employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such officer or employee can be used only for that purpose and to the extent authorized herein.

1.6.13. The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and IHS policies. Unauthorized disclosure of information will be subject to the HHS/IHS sanction policies and/or governed by the following laws and regulations:

1.6.13.1. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

1.6.13.2. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

1.6.13.3. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

1.6.13.4. Internet Protocol Version 6 (IPv6). All acquisitions using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol

Version 6 (IPv6).

1.6.14. Standard for Encryption. The Contractor (and/or any subcontractor) shall:

1.6.14.1. Comply with the HHS Standard for Encryption of Computing Devices and

Information to prevent unauthorized access to government information.

1.6.14.2. Encrypt all sensitive federal data and information (e.g., Personally Identifiable

Information (PII), Protected Health Information (PHI), proprietary information), in-transit (e.g., email, network connections), and at-rest (e.g., servers, storage devices, mobile devices, backup media) with FIPS 140-2 validated encryption solution.

1.6.14.3. Secure all devices (e.g., desktops, laptops, mobile devices) that store and process government information and ensure devices meet HHS and IHS-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII/PHI).

https://intranet.hhs.gov/it/cybersecurity/docs/policies_guides/HM/dept_standard_for_def_of_sens_info-051809.pdf https://intranet.hhs.gov/it/cybersecurity/docs/policies_guides/HM/dept_standard_for_def_of_sens_info-051809.pdf

1.6.14.4. Verify that the encryption solutions in use have been validated under the

Cryptographic Module Validation Program to confirm compliance with FIPS 140-2.

The Contractor shall provide a written copy of the validation documentation to the CO and/or COR within 30 days after the contract award and annually thereafter.

1.6.15. Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the IHS Non-Disclosure Agreement. A copy of each signed and witnessed NDA shall be submitted before performing any work under this acquisition.

1.6.16. Records Management and Retention: The Contractor (and/or any subcontractor) shall maintain all information in accordance with Executive Order 13556 -- Controlled

Unclassified Information, National Archives and Records Administration (NARA) records retention policies and schedules, and HHS/IHS policies and shall not dispose of any records unless authorized by HHS/IHS.

1.6.17. In the event that a contractor (and/or any subcontractor) accidentally disposes of or destroys a record without proper authorization, it shall be documented and reported as an incident in accordance with HHS/IHS policies.

1.6.18. Organizational Conflict of Interest: Contractor and subcontractor personnel performing work under this contract may receive, have access to, or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests

(OCI) as defined in FAR Subpart 9.5. The Contractor shall notify the Contracting Officer immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the Contracting Officer to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the Contracting Officer and in the event the

Contracting Officer unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting Officer may effect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

1.6.19. Contractor Performance Evaluation Report: During the life of this contract, Contractor performance will be evaluated on an interim and final basis pursuant to FAR Subpart 42.15.

This evaluation shall become a part of the contract file and shall be used as past performance information in evaluating the Contractor’s, and any significant subcontractors’ or affiliates, past performance on future contracts. Contractor Performance Assessment

Report System (CPARS) is an online reporting system http://www.cpars.csd.disa.mil/cparsmain.htm. The Contractor Performance Report is completed by the Project Officer electronically and sent to the Contractor for review and approval at the end of each performance period as an interim report and at the end of the contract performance as a final report. After review by the Contracting Officer, the report becomes a permanent record of the Contractor’s past performance.

http://www.cpars.csd.disa.mil/cparsmain.htm

1.6.20. Combating Trafficking in Persons: The United States Government has adopted a zero-tolerance policy regarding trafficking in persons. Contractors and contractor employees shall not engage in severe forms of trafficking in persons during the period of performance of the contract; procure commercial sex acts during the period of performance of the contract; or use forced labor in the performance of the contract. The Contractor shall notify its employees of the United States Government’s zero-tolerance policy and the actions that will be taken against employees for violations of this policy. The contractor shall take appropriate action, up to and including termination, against employees or subcontractors that violate the US Government policy as described in FAR 22.17.

1.6.21. Indemnification, Liability, Statute of Limitations: Any provisions in the Terms of Service

(TOS) related to indemnification and filing deadlines are hereby waived, and shall not apply except to the extent expressly authorized by law. Liability for any breach of the TOS as modified by this Amendment, or any claim arising from the TOS as modified by this

Amendment, shall be determined under the Federal Tort Claims Act, or other governing federal authority. Federal Statute of Limitations provisions shall apply to any breach or claim.

1.6.22. Governing law: Any arbitration, mediation or similar dispute resolution provision in the

TOS is hereby deleted. The TOS and this Amendment shall be governed by and interpreted and enforced in accordance with the laws of the United States of America without reference to conflict of laws. To the extent permitted by federal law, the laws of the State of the

Vendor will apply in the absence of applicable federal law.

2. Definitions And Acronyms

2.1. Definitions

2.1.1. Contractor: A supplier or vendor awarded a contract to provide specific supplies or services to the government. The term used in this contract refers to the prime.

2.1.2. Contracting Officer (CO): A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

2.1.3. Contracting Officer Representative (COR): An employee of the U.S. Government designated by the CO to monitor contractor performance. Such appointment will be in writing and will state the scope of authority and limitations. This individual has the authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications.

This individual does NOT have the authority to change the terms and conditions of the contract.

2.1.4. Defective Service: A service output that does not meet the standard of performance associated with the PWS.

2.1.5. Deliverable: Anything that can be physically delivered and includes non-manufactured things such as meeting minutes or reports.

2.1.6. Key Personnel: Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the PWS. When key personnel are used as an evaluation factor in best-value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.7. Physical Security: Actions that prevent the loss or damage of Government property.

2.1.8. Quality Assurance: The government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.1.9. Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

2.1.10. Quality Control: All necessary measures taken by the Contractor to ensure that the quality of an end product or service shall meet contract requirements.

2.1.11. Subcontractor: One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

2.2. Acronyms

AAAHC Accreditation Association for Ambulatory Health Care

ABMS American Board of Medical Specialties

AI/AN American Indians and Alaska Natives

AMA American Medical Association

AOA American Osteopathic Association

ATO Authority to Operate

BI Background Investigation

CASB IHS Cloud Access Security Broker

CISO Chief Information Security Officer

CM Contract Manager

CME Continued Medical Education

CO Contracting Officer

COOP Continuity of Operations Planning

COR Contracting Officer Representative

CoP CMS Conditions of Participation

COTS Commercial Off The Shelf

CFP/M/E Contractor Furnished Property, Materials, and Equipment

CFR Code of Federal Regulations

CPARS Contractor Performance Assessment Report System

CSIRC Computer Security Incident Response Center

CUI Controlled Unclassified Information

CY Calendar Year

DEA US Drug Enforcement Agency

DOB Date of Birth

DFO IHS Division of Financial Operations

DITO IHS Division of Information Technology Operations

EA Enterprise Architecture

EO Executive Order

EPLC Enterprise Performance Life Cycle

FAR Federal Acquisition Regulation

FBI US Federal Bureau of Investigation

FedRAMP Federal Risk and Authorization Management Program

FIPS Federal Information Processing Standards Publication

FISMA Federal Information Security Management Act

FY Fiscal Year

GAO U.S. Government Accountability Office

GFP/M/E/S Government Furnished Property, Material, Equipment and Services

GSA US General Services Administration

HHS US Department of Health and Human Services

HIPAA Health Insurance Portability and Accountability Act

HSPD Homeland Security Presidential Directive

HSTS HTTP Strict Transport Security

HTTPS Hypertext Transfer Protocol Secure

IA Information Assurance

IAM Identity and Access Management

IOC Indicators of Compromise

IHS Indian Health Service

IPv6 Internet Protocol Version 6

IRT Incident Response Team

IS Information System(s)

IS2P HHS Information Security and Privacy Policy

ISSO Information System Security Officer

IT Information Technology

JTR Joint Travel Regulation

LP Licensed Practitioners

MCAS Microsoft Cloud App Security

MS Microsoft

NACI National Agency Check and Inquiries

NARA National Archives and Records Administration

NDA Non-Disclosure Agreement

NIST US National Institute of Standards and Technology

NLT No Later Than

OCI Organizational Conflict of Interests

OCIO US HHS Office of the Chief Information Officer

OFA IHS Office of Finance and Accounting

OIG US HHS Office of the Inspector General

OMB US Office of Management and Budget

OPM US Office of Personnel Management

P-ATO Provisional Authority to Operate

PHI Protected Health Information

PIA Privacy Impact Assessment

PII Personally Identifiable Information

PIPO Phase In/Phase Out

PIV Personal Identification Verification

P.L. Public Law

POC Point of Contact

PoP Period of Performance

PRS Performance Requirements Summary

PTA Privacy Threshold Analysis

PWS Performance Work Statement

QA Quality Assurance

QASP Quality Assurance Surveillance Plan

QC Quality Control

QCP Quality Control Plan

ROB IHS Rules of Behavior

SAM General Services Administration System for Award Management

SAML Security Assertion Markup Language

SBU Sensitive but Unclassified

SDLC System Development Lifecycle

Section 508 Section 508 of the Rehabilitation Act of 1973

SIEM Security Information and Event Management

SSN Social Security Number

SORN System of Record Notification

SOP Standard Operating Procedure

SP Special Publication

SQL Structured Query Language

TE Technical Exhibit

TIC Trusted Internet Connections

TJC The Joint Commission

TLS Transport Layer Security

US-CERT United States Computer Emergency Readiness Team

USGCB United States Government Configuration Baseline

WCAG Web Content Accessibility Guidelines

3. Government Furnished Property, Equipment, And Services (GFP/M/E/S): The Government will provide the property, material, equipment, and/or services listed below solely for the purpose of performance under this contract:

3.1. Property: The provision of Government provided property is conditional on the mode of service delivery proposed in the contract:

3.1.1. If the contractor proposes a FedRAMP-certified cloud implementation, no government-furnished property shall be provided.

3.1.2. If the contractor proposes a COTS software system operating on the IHS network, the

Government will furnish the necessary workspace for the contractor to perform services outlined in this PWS including desk space, telephones, computers, and other items necessary to maintain an office environment and access the IHS network for operations.

The contractor will maintain an inventory control and documentation process for any property provided to it for the purposes of this contract and furnish documentation to the

COR upon request and at the close of each contract period. The contractor shall be responsible for the loss of government property, including PIV cards, and reimburse the government for its replacement cost.

3.2. Materials: No Government-furnished materials are part of this contract.

3.3. Equipment: The provision of Government provided equipment is conditional on the mode of service delivery proposed in the contract:

3.3.1. If the contractor proposes a FedRAMP-certified cloud implementation, no government-furnished property shall be provided.

3.3.2. If the contractor proposes a COTS software system operating on the IHS network, the

Government will furnish the necessary equipment for the contractor to perform the services outlined in this PWS. The contractor will maintain an inventory control and documentation process for any equipment provided to it for the purposes of this contract and furnish documentation to the COR upon request and at the close of each contract period. The contractor shall be responsible for the loss of government equipment and reimburse the government for its replacement cost.

3.4. Services: The provision of Government provided services is conditional on the mode of service delivery proposed in the contract:

3.4.1. If the contractor proposes a FedRAMP-certified cloud implementation, no government-furnished services shall be provided.

3.4.2. If the contractor proposes a COTS software system operating on the IHS network, the

Government will furnish the necessary services for the contractor to perform services outlined in this PWS, including a secure network environment sufficient for the COTS software system to operate as specified in this PWS.

3.5. Utilities: All utilities in the facility will be available for the contractor’s use in the performance of this contract. The contractor shall instruct employees in utilities conservation practices. The contractor shall operate under conditions that preclude the waste of utilities, which include turning off the water faucets or valves after using the required amount.

4. Contractor Furnished Property, Materials, and Equipment (CFP/M/E):

4.1. General: Except for those items specifically stated to be Government-Furnished in Paragraph

3.0, the contractor shall furnish everything required to perform these services as required in this

PWS.

5. Specific Tasks

5.1. Solution Requirements: The contractor’s proposed solution shall be provided in one of two modes:

5.1.1. IHS-operated servers within the IHS network, the COTS product will be hosted in the

Albuquerque Data Center, in Albuquerque, NM, and must comply with all IHS and federal

IT requirements to be hosted on the IHS network. The platform will contain Controlled

Unclassified Information including Sensitive but Unclassified (SBU) and PII along with

Personal Health Information. No classified information will be contained in these systems.

Federal Information Processing Standard (FIPS) 199 classification is High for Availability, High for Integrity, and High for confidentiality.

5.1.2. A FedRAMP-certified cloud implementation, in which the vendor shall provide all necessary support for the application, the selected product must meet Federal Risk and

Authorization Management Program (FedRAMP) requirements or must be able to obtain

FedRAMP compliance within 90 days. A compliant FedRAMP solution will consist of both a FedRAMP-approved cloud solution and a FedRAMP-approved application.

FedRAMP approval solely for a cloud hosting solution is insufficient for the purposes of this contract. This shall include:

5.1.2.1. Managing and maintaining web applications and web environments, as appropriate to the proposed technical solution.

5.1.2.2. Managing and maintaining application database, maintaining security and integrity controls, overseeing the scheduling of database projects, database and transaction log backups, notifications, and database replication, and maintaining and improving all Disaster Recovery plans to include backups, recovery, replication, design, configuration, performance tuning, testing and documentation yearly; as well as any other required activities to ensure database operations and integrity.

5.1.2.3. Implementing and supporting all routine monitoring of the web server infrastructure, critical services, and website issues; drafting and following established

Service Level Agreements within the service standards for service-level monitoring and other related alerts; and providing notifications to the Federal Manager and COR for all critical service impacts and outages.

5.1.2.4. Shall provide documentary evidence that shows FedRAMP approval shall occur within 90 days of contract award.

5.1.2.5. Complying with further FedRAMP requirements listed in Appendix 1.

5.2. System Requirements:

5.2.1. Provide an application with a consistent style for navigation and presentation features for any participating federal, Tribal, or Urban Indian Health Programs IHS employee (User), to report an incident on a 24/7 basis. The acceptable availability shall be at least 99 percent.

5.2.2. Provide a common start page for all user types listed in section 5.4 of this performance work statement.

5.2.3. Provide electronic incident reporting capability using a mobile-friendly, web browser-based application compatible with the IHS-specified and most major web browsers that meet the following system specifications & capabilities:

5.2.3.1. At a minimum, the COTS solution shall provide individual and inter-related electronic incident reporting ability for each sub-type of patient-care related and non-patient-care related safety incident;

5.2.3.2. Customizable capability for Users to report different types of patient-care-related safety incidents and non-patient-care-related safety incidents with different reporting requirements. Examples include:

5.2.3.3. Patient injury incidents shall allow a reporter to choose to remain anonymous;

5.2.3.4. Provide functionality that allows for “enter once and populate forward” data entry;

5.2.3.5. Simple, intuitive user interface allowing the user to navigate and submit the minimally-required elements of patient-care-related safety incidents within 2-4 minutes;

5.2.3.6. Maximized mineable discrete data fields balanced with optional free text fields;

5.2.3.7. Provide functionality that allows users to initiate, enter data, save data and exit, and at a later time return to complete, amend, or update report;

5.2.3.8. Utilize intelligent pathways to minimize fields not applicable to user-defined incident characteristics;

5.2.3.9. Provide mouse-over tips and definitions, along with page-specific help, to assist users with the reporting process and to improve data accuracy for critical elements;

5.2.3.10. Occupational injury/illness reporting shall include at least the minimum data elements required for and allow management of reports in compliance with

Occupational Safety and Health Administration (OSHA) recordkeeping requirements and consistent with the OSHA Incident Report sample forms 1 & 2, and the Bureau of

Labor Statistics Survey of Occupational Injuries and Illnesses - Injury and Illness

Case form. Occupational injury/illness reporting shall be consistent with the data elements listed on form HHS 841;

5.2.3.11. Occupational injury reporting shall capture all required elements to comply with the OSHA Bloodborne Pathogen Standard and Needlestick Prevention Standard consistent with the Model Plans and Programs for the OSHA Bloodborne Pathogens and Hazard Communications Standards;

5.2.3.12. Occupational injury reporting will capture at least the defined standard data elements utilized by, and provide an export format compatible with, the National

Institute for Occupational Safety and Health (NIOSH) Occupational Health Safety

Network (OHSN);

5.2.3.13. Property damage entries shall capture data elements consistent with GSA Form

3620 and SF 91;

5.2.3.14. Hazardous condition reporting shall capture at least the data elements consistent with DHHS form 834 - Report of an Unsafe Unhealthy Work Condition, Practice, or

Hazard;

5.2.3.15. User and Account Holders shall be allowed to attach pictures, PDFs, and other common electronic files to any incident report;

5.2.3.16. Incident report forms shall be allowed to be printed in the same general layout as presented in the web browser-based application;

5.2.3.17. For OSHA recordable incidents, at the time of report submission, provide users a crosswalk of reported data and a link to use in completing separate reports within the

Department of Labor Electronic Compensation Operations and Management Portal;

5.2.3.18. Patient safety incident reporting shall include at least the minimum data elements required for AHRQ Patient Safety Indicator PSI dashboard compliance; and

5.2.3.19. Incorporate AHRQ Common Formats, a standardized taxonomy (no-cost, publicly available taxonomy), and a systematic method for reporting adverse events, near misses, unsafe conditions, and harm from all causes.

5.2.3.20. Data elements for Individual Case Safety Reports to the FDA Adverse Events

Reporting System and Forms FDA 3500, 3500A, and 3419 for Medical Device

Reporting.

5.2.3.21. Provide interoperability with Oracle Cerner EHR, such as through FHIR or other

API.

5.2.3.22. Require that OSHA recordkeeping data elements must be completed before the incident investigation process is complete;

5.2.4. Provide user permission levels based on location, organization, span of control, I/T/U designation, and role as either Account Holder or Account Manager. All accounts will adhere to IHS/HHS user account security and maintenance standards. The account settings shall meet the requirements below:

5.2.4.1. Provide Account Managers the ability to review the names and account permissions of Account Holders and Account Managers for facilities for which they have permissions;

5.2.4.2. Notify users upon report submission regarding Account Holder(s) with permissions to review and investigate the report;

5.2.4.3. Notify individual incident reporting users upon completion of incident investigation, and provide feedback on results of investigation;

5.2.4.4. Generate email notifications regarding initial incident report submissions to

Account Holders and Account Managers based on permissions and choice of notifications;

5.2.4.5. Allow Account Managers to modify email notification choices for themselves and the Account Holders in their region.

5.2.4.6. Provide an online account request process for new accounts or modifications, and generate automatic emails to account holders specifying changes to their account permissions;

5.2.4.7. Allow Account Holders with appropriate permissions to access incidents, verify or amend incident reports, and include investigation information;

5.2.4.8. Provide Account Holders the ability to search for individual incident reports;

5.2.4.9. Allow Account Holders to select, monitor, trend, and report data by date range and/or facility/regional location(s);

5.2.4.10. Provide Account Holders a tracking system for all reported incidents and their status in real-time; and

5.2.4.11. Provide comprehensive data export functionality with parameters defined by the

Account Holder and using plain language terminology.

5.3. System Performance Requirements

5.3.1. The system shall meet Federal IT/Security/Accessibility requirements.

5.3.2. It will be FedRAMP-certified or available to operate within the IHS network.

5.3.3. Data redundancy and backup shall include the capabilities listed below:

5.3.3.1. A unique identification number shall be generated for each incident;

5.3.3.2. Provide means to store and retrieve incident reports for a minimum of 30 years from the date of the incident.

5.3.4. Provide feedback submission capability for process improvement and change requests.

5.3.5. Performance level:

5.3.5.1. Page-to-page changes: 3 to 8 seconds; and

5.3.5.2. Pre-defined basic table/chart reports: 3 to 30 seconds.

5.3.6. To the maximum extent possible system software components are developed as self-contained modules that facilitate change or replacement.

5.3.7. Allow the maximum number of non-login users to enter incidents without degradation to system operation.

5.3.8. Allow the maximum number of login users to perform review and analysis on submitted incidents, produce reports, and/or create exports without system degradation.

5.4. Requirements for User Types for Patient-Care and Non-Patient-Care-Related Incidents:

5.4.1. Patient-Care-Related Incident and User Types

5.4.1.1. A patient-care-related incident shall be defined as one of the below and followed by the Agency for Healthcare Research and Quality (AHRQ) Common Formats in a layered scheme:

5.4.1.1.1. Errors or adverse events that have had or are expected to have a clinical effect on the patient. The effect is perceptible to either the patient or the healthcare team;

5.4.1.1.2. Errors or adverse events that necessitate a change in the patient’s care;

5.4.1.1.3. Errors or adverse events that cause temporary harm to the patient;

5.4.1.1.4. Errors or adverse events with a known risk of serious future health consequences, even if the likelihood of that risk is extremely small;

5.4.1.1.5. Errors or adverse events that require providing treatment or procedure without the patient’s consent;

5.4.1.1.6. Errors or adverse events that may have contributed to or resulted in permanent harm to the patient;

5.4.1.1.7. Errors or adverse events that required intervention to sustain life;

5.4.1.1.8. Errors or adverse events that may have contributed to or resulted in the patient’s death; and

5.4.1.1.9. Near misses in which an error or adverse event nearly reaches the patient but is identified and mitigated before reaching the patient.

5.4.1.2. System use will occur on five levels - users, account holders, regional account holders, regional account managers, and system account managers. The system access will be authenticated to each user type as prescribed below:

5.4.1.2.1. Users will be able to access the reporting functions without the need for a user account;

5.4.1.2.2. Account Holders, for a facility or subset of facilities, will be able to review, edit, and insert investigation data for incident reports as well as trend, analyze & export incident report data;

5.4.1.2.3. Regional Account Holders, for facilities within their region, will have the same capabilities as Account Holders;

5.4.1.2.4. Regional Account Managers will have the same capabilities as Regional

Account Holders, and will be able to add/edit/delete Account Holders or

Account Holder permissions for facilities that fall within their region; and

5.4.1.2.5. System Account Managers will have the same capabilities as Regional

Account Managers and will be able to add/edit/delete Account Holders, Regional Account Holders/Managers, and establishments within their region(s).

5.4.1.3. Medication-related safety incident

5.4.1.3.1. A medication-related safety incident shall be defined as any preventable event that may cause or lead to inappropriate medication use or patient harm while the medication is in the control of the health care professional, patient, or consumer.

5.4.1.3.2. Medication error entry shall pull drug information from a database

(accessible for modification by an IHS system account manager) that contains a complete list of available drugs, dosage forms, route of administration, dosage strength, generic name, trade name, therapeutic class, and container type.

5.4.1.3.3. The system shall classify medication errors based on the NCC MERP index for categorizing medication error algorithms. System users will have the ability to record a dissent of the auto-classification and justification of the dissent.

5.4.1.3.4. The system shall identify where in the process the error occurred including ordering/prescribing, transcribing and verifying, dispensing and delivering, administering, monitoring, and reporting.

5.4.1.3.5. The system shall allow querying/reporting medication errors by generic name, trade name, therapeutic class, medication error category, and process where an error occurred; or data shall be reported in a tabular format that allows data to be filtered and sorted based on those categories.

5.4.2. Non-Patient-Care Related Safety Incident and User Types

5.4.2.1. A non-patient-care-related safety incident shall be defined as one or more of the following:

5.4.2.1.1. Hazardous condition;

5.4.2.1.2. Physical security breach;

5.4.2.1.3. Near miss event (non-medical in nature);

5.4.2.1.4. Damage to property;

5.4.2.1.5. Exposure to hazard (biological, chemical, environmental, ergonomic, physical, and/or psychosocial) resulting in illness or injury to:

5.4.2.1.5.1. Employees, contractors, students, and volunteers;

5.4.2.1.5.2. Visitors; and

5.4.2.1.5.3. Patients- not related to patient care.

5.4.2.2. System use will occur on five levels - Users, Account Holders, Regional Account

Holders, Regional Account Managers, and System Account Managers. The system access will be authenticated to each user type as prescribed below:

5.4.2.2.1. Users will be able to access the reporting functions without the need for a user account;

5.4.2.2.2. Account Holders, for a facility or subset of facilities, will be able to review, edit, and insert investigation data for incident reports as well as trend, analyze & export incident report data;

5.4.2.2.3. Regional Account Holders, for facilities within their region, will have the same capabilities as Account Holders;

5.4.2.2.4. Regional Account Managers will be able to add/edit/delete Account

Holders or Account Holder permissions for facilities that fall within their region;

and

5.4.2.2.5. System Account Managers will be able to add/edit/delete Account

Holders, Regional Account Holders/Managers, and establishments within their region(s).

5.5. Required customization, within the COTS product:

5.5.1. Importation to the maximum extent possible of all existing IHS Safety Tracking and

Response (I-STAR) system data related to the incident types listed in Section 5.4 of this

PWS.

5.5.2. Provide updates to required data elements based on revisions to relevant OSHA, DOL, DHHS, and GSA requirements as provided by IHS.

5.5.3. Establishments shall be identified using codes from the IHS coding system for Area, Service Unit, Tribe, Reservation, and Community (ASUFAC). The IHS Standard Code

Book may be viewed at http://www.ihs.gov/scb/index.cfm?module=disp_tablesSCB&newquery=1. Other IHS codes may be required and will be provided by IHS.

5.5.4. The Vendor will provide a defined process for managing Change Control Board (CCB) activities including the methodologies that will be used when executing and implementing approved changes. The Vendor will be responsible for:

5.5.4.1. Organizing and maintaining accurate records of change requests and CCB decisions;

5.5.4.2. Organizing and conducting CCB meetings;

5.5.4.3. Notifying the IHS stakeholders, contracting representatives, and software sponsor of meetings; and

5.5.4.4. Providing IHS with detailed cost and time estimates for CCB-approved Change

Requests.

5.6. Required system reporting capabilities:

http://www.ihs.gov/scb/index.cfm?module=disp_tablesSCB&newquery=1

5.6.1. OSHA 300 Log of Work-Related Injuries and Illnesses.

5.6.2. OSHA 300a Summary of Work-Related Injuries and Illnesses (complete with establishment information).

5.6.3. Sharps Injury Log.

5.6.4. AHRQ Patient Safety Indicators (PSI) dashboard.

5.6.5. Pre-defined…