RFI 36C10X24Q0095 - Medical Calculators.doc

Request for Information

Medical Calculators RFI Number: 36C10X24Q0095

1. Introduction

This Request for Information (RFI) is for planning purposes only and shall not be considered an Invitation for Bid, Request for Task Execution Plan, Request for Quotation or a Request for Proposal. Additionally, there is no obligation on the part of the Government to acquire any products or services described in this RFI. Your response to this RFI will be treated only as information for the Government to consider. You will not be entitled to payment for direct or indirect costs that you incur in responding to this RFI. This request does not constitute a solicitation for proposals or the authority to enter into negotiations to award a contract. No funds have been authorized, appropriated or received for this effort. Interested parties are responsible for adequately marking proprietary, restricted or competition sensitive information contained in their response. The Government does not intend to pay for the information submitted in response to this RFI.

The North American Industry Classification System (NAICS) for this requirement is 518210.

Be advised that set-aside decisions may be made based on the information provided in response to this RFI. Responses should be as complete and informative as possible.

2. Submittal Information:

All responsible sources may submit a response in accordance with the below information.

The page limitation for RFI responses is 30 pages. The Government will not review any other information or attachments included, that are in excess of the 30-page limit. NO MARKETING MATERIALS ARE ALLOWED AS PART OF THIS RFI. Your response must address, in detail, how you can provide the government with the capabilities specific to the services required in the attached PWS. The responses should include, but are not limited to, the following:

a. Company Information:

Name of Company

Address

Point of Contact

Phone Number

Fax Number

Email address

Company Business Size and Status

For VOSB and SDVOSBs, proof of verification in VetCert.

NAICS code(s)

Socioeconomic data

SAM UEI Number

Existing Contractual Vehicles (GWAC, FSS, or MAC)

b. Provide a detailed summary of your capability to meet all of the requirements contained within the draft PWS, and for the following areas:

1. Detail your company’s capabilities and experience supporting federal agencies in providing a Software as a Service (SaaS) product, and how your SaaS product can satisfy the requirements listed in the PWS. Include examples of federal experience implementing your SaaS product (specific examples or references provided must include the agency, point of contact, dollar value, and contract number).

2. Detail your company’s SaaS product cloud infrastructure and accessibility from various client devices through either a thin client interface, such as a web browser (e.g., web-based email) or a program interface. The system shall not require download of software to VA computers. The VA shall not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage or individual application capabilities. The system shall be vendor or third-party hosted and require no servers within VA. Please validate that your proposed SaaS product is SaaS in accordance with the NIST 800-145 definition and describe its hosting environment.

3. Please detail any interfacing or custom development that your SaaS product requires ahead of go-live. Can your company’s proposed SaaS product meet all PWS requirements without developing an interface or performing any kind of custom development?

4. Please describe your company’s willingness and ability to adopt and incorporate customer feedback in the product roadmap of your proposed SaaS product.

5. As one alternative approach, please describe your company’s willingness and ability to implement its offering as a managed service installed within VA datacenters but managed by your company including routine maintenance, patches, updates, and other upgrades developed for your product throughout the period of performance.

6. As another alternative approach, please describe your company’s willingness and ability to implement its offering using a microservices architecture that is able have its software components be decomposed components into independently deployable and scalable services that communicate through well-defined APIs. The system's design, development, and deployment must adhere to the principles of Microservices architecture. Furthermore, please describe the way(s) in which your company utilizes containerization as the primary means to implement the Microservices architectural paradigm. Containerization technologies such as Docker, Kubernetes, or equivalent are to be used to package, deploy, and manage individual microservices and their dependencies. Please include details on how your company ensures that the Microservices architecture and containerization practices meet industry standards and best practices while also demonstrating the ability to scale and optimize microservices within containers to meet the evolving needs of the VA. Scalability should be achieved without compromising the system's stability, responsiveness, or security.

7. Please describe your pricing model to include the threshold for named user subscriptions vs. an enterprise/site subscription. Is your pricing model driven by total users, concurrent users, transaction-based, number of records, etc? Are any additional services needed outside of the subscription model (e.g., configuration to meet functional requirements, data storage, data migration, additional features)? If so, please provide the items and proposed price for these additional services.

8. Please provide separate Rough Orders of Magnitude (ROMs) for the SaaS product in accordance with PWS Paragraph PWS Paragraphs 2.0 and 5.0.

9. For the SaaS portion of this effort, VA intends on providing limited payment until the SaaS product has achieved a FedRAMP Authorization and a VA Authority to Operate (ATO). Once approved by the VA Authorizing Official, VA intends on setting up a subscription payment for the duration of the base period and option periods, if exercised. Do you concur or propose different payment terms?

10. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement. Is your company’s SaaS product FedRAMP Authorized? If not, are you willing and ready to begin the processes and documentation required to become FedRAMP Authorized within 30 days of award?

11. Following guidance from the Federal CIO, VA will utilize existing JAB ATO or agency ATO issued by another agency as a starting point for FedRAMP requirements. If neither of those exist, VA will sponsor FedRAMP ATO. VA will be using the FedRAMP baselines as a starting point, since they are specifically tailored for cloud services. Does your company’s SaaS product have an ATO from any federal agency?

12. Detail your company’s support Service Level Agreements (SLAs) for all tiers of service.

13. What was your uptime rate during the past 12 months?

14. Describe your standard release and patch cycle.

15. Has the draft PWS provided sufficient detail to describe the technical/functional requirements that encompass the software development and production operations support services to be performed under this effort.

______ YES _______ NO (if No, answer the next question)

16. If “NO”, please provide your technical comments/recommendations on elements of the draft PWS that may contribute to a more accurate proposal submission and efficient, cost effective effort.

Responses are due no later than 10:00AM ET January 31, 2024, via email to William.Rush@va.gov and Caitlin.Ruc@va.gov , Please note “Medical Calculators

RFI Number: 36C10X24Q0095” in the subject line of your response. Mark your response as “Proprietary Information” if the information is considered business sensitive. The email file size shall not exceed 5 MB.

Attachment: DRAFT STATEMENT OF WORK

Statement of Work Department of Veterans Affairs Veterans Health Administration

Office of Health Informatics

Clinical Informatics & Data Management Office

Knowledge Based Systems

Medical Calculators

1.0 Introduction:

The Veterans Health Administration (VHA) Clinical Informatics and Data Management (CIDMO), Health Informatics, Office of Knowledge Based Systems (KBS) provides subject matter expertise, policy guidance, and strategic recommendations regarding clinical decision support (CDS) standards implementation for VA’s Information Technology (IT) systems.

The mission of CIDMO is to improve lives of Veterans and staff through better data and tools for better decisions and workflows. CIDMO seeks to help VHA realize its goal to become an agile learning organization through user-centered standardization of health information, clinical processes, and technologies by building standardized best informatics practices for improved field informatics capacity along with robust clinical process modules with Health Information Technology (HIT) configurations.

The mission of KBS is to improve the ability of clinicians to provide care for patients while increasing quality, safety, and efficiency. As part of this mission, KBS seeks to implement CDS within electronic health records (EHRs) broadly, and within VA health information systems specifically (current VA EHR is the Computerized Patient Record System (CPRS)).

KBS requires a subscription to an online medical calculator service that uses standards (i.e., SMART on FHIR, FHIR R4) to gather VA patient-specific data and deliver medical calculations. The medical calculator service will provide clinicians with patient-specific information, calculations, risk scores and other knowledge to enhance health and health care. The calculator will be used directly by clinicians in its native interface. Data and results obtained from the vendor’s SMART application may also be reutilized algorithmically e.g., for computerized alerts and reminders, clinical guidelines, data reports and dashboards, documentation templates, and diagnostic support.

2.0 Scope of Work:

These requirements are intended to acquire a commercial product provided to the VA on a subscription basis as SaaS (Software as a Service) to perform medical calculations. The service will integrate into VA’s hybrid EHR environment using a standards-based SMART approach. The medical calculator SMART application must provide the following capabilities:

· The scope of provided calculations shall be extensive and will include calculations from high level categories such as but not limited to Acid-base; critical care; Na and H20; Body measurements; Nutrition; Pulmonary; Renal; Electrolytes and Endocrinology.

· The scope of provided risk assessments and other instruments shall be extensive in its support of specialties including Medicine, Surgery, Mental Health, OB-GYN, inpatient and outpatient care, and pathophysiologic state metrics states ranging from Apache score to the WHO-5 well-being index

· Provide risk scores and calculations that are computed dynamically based on patient-specific data inputs, e.g., patient problem list, labs, medications

· Suggest patient-specific calculations (e.g., risk scores) and instruments dynamically based on patient-specific data inputs e.g., patient problem list, encounter codes, labs or medications

· Ingest data for calculations using SMART on FHIR methods (e.g. FHIR)

· Provide results of calculations via a native web-based user interface with copy/paste functionality and via standards-based services (e.g., FHIR)

· Provide mapping of results to discrete data elements such as patient vitals, patient observations, lab result values, demographic data and medications. Mappings should be to national standards specified in United States Core Date for Interoperability version X or higher

3.0 Period of Performance: The period of performance consists of a 12-month base period and four possible one-year option periods.

5.0 Software as a Service Requirements

The Software-as-a-Service (SaaS) products that have connections or interfaces to VA systems or network must comply with comply with Federal Risk and Authorization Management Program (FedRAMP) requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement. Alternatively, the vendor may collaborate with VA Enterprise Cloud Solutions Office (ECSO) to install an instance of a cloud-based solution within the VA Enterprise Cloud or install and maintain an instance of their software using a microservices architecture and containerization technologies such as Docker, Kubernetes, or equivalent to package, deploy, and manage individual microservices and their dependencies.

For all software-as-a-service (SAAS) or alternative required information system solutions under this PWS the Contractor shall comply with the following:

a) The information system solution shall comply with the Federal Information Security Management Act (FISMA).

b) The Contractor shall comply with Federal Risk and Authorization Management Program (FedRAMP) requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

c) Following guidance from the Federal Chief Information Officer (CIO), VA will utilize existing Joint Authorization Board (JAB) Authority to Operate (ATO) or agency ATO issued by another agency as a starting point for FedRAMP requirements. If neither of those exist, VA will sponsor FedRAMP ATO. VA will be using the FedRAMP baselines as a starting point, since they are specifically tailored for cloud services.

d) The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application.

e) The Contractor shall complete a FedRAMP System Security Plan (SSP) and supporting documentation within 45 days after contract award. (If Data Security Categorization is High Impact, this will be due 85 days after contract award.)

f) The Contractor shall complete a Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) within 90 days after contract award. (If Data Security Categorization is High Impact, this will be due after 130 days after contract award.)

g) The Contractor shall complete a 3PAO Security Assessment Report (SAR) within 140 days after contract award. (If Data Security Categorization is High Impact, this will be due 180 days after contract award.)

h) The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases to the extent required to carry out the FedRAMP assessment and authorization process and FedRAMP continuous monitoring.

i) If new or unanticipated threats or hazards are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with the security Addendum B (VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE - VA Handbook 6500.6)

j) The Contractor shall not release any VA data without the consent of VA in writing. All requests for release must be submitted in writing to the COR/CO.

k) In order for live VA data to be used in this system, a FedRAMP Authorization and Agency ATO will be required.

Deliverables:

A. Direct and algorithmic access to the Software as a service to be used by VA federal and/or Contractor staff (need to include direct users)

B. FedRAMP System Security Plan (SSP) and supporting documentation Vendors SMART Application standards-conformance documentation identifying how the application conforms to the “HL7 SMART App Launch 2.0.0 - Standard for Trial Use Implementation Guide” as well as any constraints or choices specific to the VA implementation.

C. 3PAO Security Assessment Plan (SAP)

D. 3PAO Security Assessment Report (SAR)