RFI for Employee Health Record.pdf

U.S. Department of Justice

Request For Information for Employee Health Record Federal Bureau of Prisons

Request for Information (RFI) - Employee Occupational and Safety Health Record

Background and Scope

The Federal Bureau of Prisons (BOP) is an agency of the Department of Justice (DOJ). It consists of 97 institution sites throughout the United States, including Hawaii and Puerto Rico. The sites that would be included with this RFI are located in Alabama, Arkansas, Arizona, California, Colorado, Connecticut, Florida, Georgia, Hawaii, Illinois, Indiana, Kansas, Kentucky, Louisiana, Massachusetts, Maryland, Michigan, Minnesota, Missouri, Mississippi, North Carolina, New Hampshire, New Jersey, New York, Ohio, Oklahoma, Oregon, Pennsylvania, Puerto Rico, South Carolina, South Dakota, Tennessee, Texas, Virginia, Washington, Wisconsin and West Virginia.

The BOP is responsible for the custody and care of approximately 160,690 Federal offenders.

Approximately 81 percent of these inmates are confined in Bureau-operated facilities, while the balance is confined in secure privately managed or community-based facilities and local jails. More information about the agency can be found on the BOP’s public site, www.bop.gov.

The health care mission of the Bureau of Prisons is to deliver medically necessary health care to inmates effectively in accordance with proven standards of care without compromising public safety concerns inherent to the BOP's overall mission. The majority of primary health, mental health, and dental care are provided by BOP staff inside the facility. Most facilities contract specialty and tertiary care to providers in the local community. Seven BOP facilities provide specialty consultations and nursing beds inside the institution. The combined total number of dedicated nursing care beds at these facilities is approximately 460. Some of the specialty services provided include: oncology, psychiatry, orthopedics, hospice, dialysis, physical and occupational therapy, wound management, sub-acute and long-term care, ophthalmology, and respiratory care. There are approximately 245 primary care physicians at standard BOP facilities and 165 physicians practicing at the advanced care facilities.

PURPOSE

The BOP is seeking information on a total occupational health, safety, and productivity solution that can be configured to meet BOP’s Occupational Safety & Health Software (OSH) needs. The product should be a robust, scalable, and configurable enterprise-level electronic data management and reporting system.

The goal of this system is to enable the BOP to decrease injury rates and associated lost time while providing a proactive communication and reporting tool for management across the agency.

http://www.bop.gov/

PERFORMANCE REQUIREMENTS

The BOP is seeking information on any contractor capable of providing an online employee health records system (EHRS) that would provide the following functionalities at a minimum:

• Provides an easy workflow for automating and managing medical surveillance programs.

• Integrates with safety and case management.

• Offers the ability to create unlimited number of user-defined questionnaires.

• Maintains complete audit trail for any changes made to a record.

• Includes standard reports that demonstrate return on investment (ROI).

• Includes ability to produce user-defined letters to employees.

• Provides the ability to store external documents with employee records.

• Allows the user to produce a complete medical chart for an employee.

• Offers an easy to use notes system with template phrases to reduce repetitive keystrokes.

• Includes a user-defined “lock” on notes and medical records, so these cannot be edited.

• Offers additional modules to expand beyond the Medical group (i.e., Safety, Case Management, Industrial Hygiene)

• Offers integration application programming interfaces (API), which will allow information to be shared with other information systems and software tools.

• System features that promote user efficiency and reduce data redundancy, such as predicted text for data entry, and personalization options for each user.

• A dashboard that provides an instant view of key performance indicators (KPIs) and schedules upon login.

• A robust security component that can be easily managed and maintained by the BOP’s designated system administrators.

• Streamlined regulatory reporting/recordkeeping.

• Track regulatory compliance with applicable OSHA federal regulations and EPA federal and state regulations.

• The system should be able to adhere to data privacy requirements.

• Identify health and injury/illness trends.

• Support effective absence management.

• Provide tools for managing a hearing conservation program.

• Interface between audiometers and the contractor’s EHRS software for automatic download of testing results.

• Identify and modify the baseline audiogram, make age-based adjustments, and calculate STS.

There must be an OSHA required written opinion letter that is automatically populated with the test results.

• The contractor’s EHRS software shall be able to track the audiometry equipment and calibration information.

Contractor’s EHRS shall be an existing and developed system that is current and operational. The contractor’s EHRS software shall be easily configurable and shall have the ability to manage a medical surveillance program. The EHRS software shall be able to manage many exposure groups including medical surveillance, certification exams, and hazardous environments. The contractor’s EHRS software shall have medical surveillance tables that support exposure, certification, and health examinations. The EHRS software shall include a developed industrial hygiene capability.

The ability of the contractor’s EHRS software to complete required questionnaires by employees must meet security, confidentiality, and privacy requirements, e.g., Privacy Act, Health Insurance Portability and Accountability Act. The questionnaire data must automatically populate the appropriate fields in the software.

The software should provide integration with the organization’s Human Resource (HR) system as well as between OHS functional areas (medical, safety, etc.). Integration with the HR system allows for efficient, seamless transfer of employee data to OHS, while integration between functional areas allows Medical, Safety, and Industrial Health to communicate with one another, share information and report findings collaboratively, eliminating redundancies.

All data collected within the proposed system is the sole property of the Department of Justice/Federal Bureau of Prisons and will be provided by the contractor at the request of the agency in full at any time during the contract period.

Contractor’s Qualifications

The contractor shall be in compliance with OSHA, ADA, FMLA, HIPAA and DOT standards.

The contractor shall have a minimum of five years of proven, past experiences in this field to provide the services in accordance with the statement of work.

The program shall have an online help tool and technical support available 24 hours per day, 7 days per week.

The program shall provide compliance, competence indicators, and quality measures for documentation.

The program shall be optimized for use in a mobile electronic environment to meet evolving technological advances.

The program shall allow for the creation of customized care plans that have the ability to be integrated into an electronic medical record.

The Contractor must be registered in the System for Award Management (SAM). Contractors should go to www.sam.gov to find their information. Contractors shall maintain a current and accurate record in the SAM system annually. Registration in no way guarantees that a contract will be awarded.

Contractor/Contract Tasks

The contractor shall provide all labor, material, and equipment necessary to accomplish the following services:

1) Ensure installation of the software system to allow usage to best meet the needs of the BOP.

2) Recommend modifications or changes in equipment and operation procedures as needed.

3) Provide training and ongoing technical support for all BOP facilities, as requested upon approval of the agency or institutional contact.

1.0 BOP Information System Requirements

1.1 Operating Systems and Applications

1.1.1 Operating Systems

All systems should be developed to use BOP standard workstations, laptops, and servers with versions of operating systems that are supported by the operating systems manufacturer/developer, and will continue to be supported by the manufacturer/developer for the next three years. Any systems that rely on operating systems that are no longer supported, or will be approaching their end-of-life or the end of extended support date are prohibited from being installed unless a waiver is granted by the CIO.

All Windows servers must have Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) Category I, II and III settings applied. Workstations and laptops with Windows operating systems must have the DISA STIG settings applied for Windows 10, Chrome and/or Edge.

Servers, workstations, laptops, and other devices running non-Windows operating systems must be approved for use by the CIO prior to acquisition and must be the latest supported versions by the vendor. If a DISA STIG exists for any non-Windows operating system, the operating system must be configured in accordance with that DISA STIG.

All systems must support DISA STIGs if applicable for any software within the product.

All current DISA STIG policies can be found at: http://iase.disa.mil/stigs/Pages/index.aspx

1.1.2 Applications

All systems on an administrative network should be capable of using a BOP standard image for workstations. Systems should be developed to minimize the installation of new applications directly onto workstations. Systems that require a client application be installed on workstations are strongly discouraged.

Web-based applications should be installed on standard BOP servers running approved server operating systems and meet the following requirements:

i. Support TLS 1.2 or later;

ii. Be browser-agnostic;

iii. Do not require browser plug-ins, helper objects, specific ActiveX controls, or Java dependencies on the client.

http://iase.disa.mil/stigs/Pages/index.aspx

All applications must be able to operate with the latest version of any supporting applications or services required to run that application (i.e., Java, Apache, IIS, etc.)

1.1.3 Auditing/Logging

All operating systems and/or applications must be capable of auditing events and maintaining logs with sufficient information to be able to account for the actions of individual users and record system events and processes.

1.2 Identification, Authentication, and Authorization

All new information systems should use a centralized directory for identification, authentication, and authorization to control, provision, and de-provision access to those systems. To connect information systems to an administrative network, all information systems must be capable of supporting Lightweight Directory Access Protocol (LDAP v3 or successor) or Microsoft Active Directory.

Each system user must be uniquely identified. Access to information is controlled using a “Least Privilege” role- or assignment-based methodology that provides the user with only the information and access required to perform his/her duties and nothing more. Systems must be capable of tiered-role privileges that distinguish between users and administrators and their authorized functions.

1.4 Encryption

1.4.1 Data at Rest

All information systems that store data must have the capability to encrypt the drives on which the data is stored using FIPS 140-2 compliant encryption. If the system cannot support encryption of system drives, it must be approved for use by the CIO prior to acquisition and use.

1.4.2 Data in Motion

All information systems that transmit data over administrative networks must use protocols that encrypt data as it traverses the network. Information systems must support the most current version of secure protocols and encryption standards, and must be capable of being configured to prevent the use of insecure protocols.

1.5 Endpoint Security and Management and Vulnerability Management Computer workstations, laptops, tablets, servers, and other computing devices using an operating system must employ anti-virus software protection.

1.6 Network Standards and Protocols

Information systems must meet the following network standards to be deployed on an administrative network:

i. Supports IPv4/v6 Dual Stack and provides full and equal functionality when utilizing IPv6 as when using IPv4;

ii. Does not require or enable wireless of any type (WiFi, 4G, etc.)

iii. If the system requires internet access, it must be configured to use an explicit proxy and only utilize standard internet ports (80/443);

iv. Does not directly connect to other IP networks;

v. Does not use IPv4 Multicast

1.7 Cloud

Any system that will connect to or be hosted in a non-BOP cloud service must use a cloud service provider (CSP) that is FedRAMP-certified.

1.8 Medical Systems

Medical systems must comply with standards published by the Office of the National Coordinator for Health Information Technology (ONC) with regard to data access, storage and reporting.

2.0 Peripheral Requirements

2.1 Locally-Attached Peripherals

Peripherals that are locally-attached to standard BOP workstations must:

i. Not be shared on the network;

ii. Not require software to operate that requires access to the internet or other network resources;

iii. Not require software to operate that requires older versions of software to operate such as Java, Flash, etc;

iv. Not broadcast wireless signals (i.e. Bluetooth, WiFi, etc.);

v. Not require a change to the workstation local security policy to operate.

2.2 Networked-Attached Peripherals

Peripherals that must connect directly to an administrative network should be part of a larger system or sub-system authorized to operate on that network. Each system or sub-system must provide controls to the peripherals attached to the network that comply with the system standards detailed above or provide mitigating controls for peripherals that cannot meet a system standard.

NOTE: All proposed IT Hardware, Software and Systems will require a full security and technical review in compliance with the Federal Information Technology Acquisition Reform Act (FITARA).

QUESTIONS AND REVIEW

Please be advised that providing responses to this request will not automatically include responders in the acquisition process should the Bureau determine to continue to establish an acquisition plan.

Questions regarding this RFI must be submitted to Vanessa Jackson, by October 29, 2020.

Questions and answers will be posted as an amendment on beta.sam.gov on or about November 5, 2020. Answers will only be provided through beta.sam.gov and contractors should not anticipate a response from the contract officer. Responses to this RFI shall be emailed in PDF format, no later than 8:00 p.m. (EDT) on 30th day, November, 2020, to Vanessa Jackson, Contracting Officer, at vx5jackson@bop.gov. Calls will not be accepted.

This RFI will close on November 19, 2020 AT 8:00 P.M. EST.

This is a Request for Information, please see FAR 52.215-3.

mailto:vx5jackson@bop.gov