RFI QUESTIONS.docx

This Sources Sought (SS) is issued solely for planning purposes. It does not constitute a solicitation or a promise to issue a solicitation in the future. Responses to this SS are strictly for market research purposes and will be used by the U.S. Government to make appropriate acquisition decisions. This SS does not commit the U.S. Government to contract for any supply or service whatsoever. Further, the U.S. Government is not at this time seeking a solicitation response and will not accept unsolicited responses in the form of a quote, proposal, or bid.

Interested parties are advised that the U.S. Government will not pay for any costs incurred in response to this SS. All costs associated with responding to this SS will be solely at the interested party’s expense. Submittals will not be returned. Not responding to this SS does not preclude participation in any future solicitation, if any is issued. All questions and responses to this SS shall be e-mailed to the individuals identified in the announcement. No phone calls will be accepted.

Business Details:

Name of the business, point of contact, phone number, email address, UEI number, and business type/size.

Provide a brief statement of core business competencies and why your organization is suitable to meet the requirements outlined in the DRAFT Performance Work Statement.

What NAICS or PSC code would you recommend if different than the announcement, and why?

Describe your experience in successfully performing requirements of a similar size, scope, and complexity relative to the DRAFT Performance Work Statement.

Do you have a General Services Administration Federal Supply Schedule that falls within the scope of the DRAFT Performance Work Statement, or any other ordering vehicle the VA could use?

Provide any relevant information to help determine if the requirement is commercially available, including any existing pricing information, basis for the pricing information (e.g., market pricing, catalog pricing, historical pricing, etc.), delivery schedules, customary terms and conditions, warranties, etc.

Product or Solution Type

1. Is your credentialing/database solution a Software-as-a-Service (SaaS) offering, or is it delivered through another model (e.g., on-premise, hybrid, custom-built/proprietary platform)? Please describe your solution's delivery and hosting model, including whether it is a multi-tenant SaaS platform, a dedicated/single-tenant instance, or a custom solution developed specifically for government credentialing use cases.

2. Does your solution currently hold a FedRAMP Authorization? If so, please identify the impact level (Low, Moderate, High)?

3. If FedRAMP Moderate authorization is required under the resulting contract, what impact would this have on your proposed pricing? Please identify any FedRAMP-related costs as a distinct, separately identifiable cost element rather than bundling them into general implementation or database licensing costs.

4. If your solution does not currently hold a FedRAMP Authorization, would your organization be able to pursue and obtain a FedRAMP Moderate Authorization within a defined post-award timeframe (e.g., 6, 12, or 18 months)? Please describe your organization's prior experience, if any, achieving FedRAMP authorization for a cloud service offering, and your estimated timeline and cost to do so if not already authorized.

System and Technical Capability

1. Can your database provide real-time dashboards and queue views showing credentialing status by provider/facility, including a dedicated returned-provider dashboard with filterable fields (provider name, NPI, date of return, reason for return, number of contact attempts, resubmission status)?

2. Can your system support bulk upload (e.g., ingesting multiple applications from Excel)? Can your system bulk export providers by risk category with sortable fields intact?

3. What audit-ready reporting features exist (e.g., MEC-approved dates, thread capture, NPDB-CQ documentation, committee minutes)?

4. How do you ensure national coverage — including all U.S. territories — with no IP-based access failures across states/territories?

5. Can your system allow VA users to request provider deactivation or application edits directly inside the platform?

6. Is it technically feasible within your system's user provisioning capabilities to restrict or customize user access so that only designated users may request or initiate provider data changes or updates?

7. Does your system have the capability to ingest and process bulk provider data? If so, what formats are acceptable?

8. How do you document CMO or delegated reviews of off-cycle NPDB or monitoring events?

9. Is your solution capable of providing a real‑time status dashboard with a queue view that displays each provider/facility’s current credentialing stage and a consolidated timeline of all credentialing actions and communication attempts—without requiring staff to open and review each NPI individually?

10. Please describe the key data fields your system collects and maintains for credentialing applications.

11. Can your system meet a 99% monthly database availability standard, with full-functionality restoration within 4 hours during core business hours and 8 hours outside core business hours following an unplanned outage? Please describe your historical uptime performance and incident response process.

12. Can your organization meet a 24-hour Recovery Time Objective (RTO) and 4-hour Recovery Point Objective (RPO) for disaster recovery, including geographically separate, encrypted backup storage? Please describe your backup architecture and disaster recovery testing cadence.

13. Does your system support the technical capability to designate an individual provider's direct professional email address as a mandatory, distinct field — separate from any administrative/group contact — and to route all correspondence (including denials and adverse determinations) to that individual directly?

14. How long, in calendar days, do you estimate it will take for you to be fully implemented and operational once the contract is awarded, including the 30-day database/portal access configuration phase?

Credentialing & Verification Process

1. What are your standard PSV timeframes, and what is your average turnaround? Can your organization commit to the following stage-specific timeframes: initial contact within 1 business day, PSV completion within 30 business days, and a completed credentialing package within 32 business days of provider attestation?

2. How do you handle provider non-response beyond the required five attempts?

3. How is your communication matrix structured, and what enhancements do you recommend for VA?

4. Can you monitor CMS star ratings for community nursing homes and incorporate them into risk scoring?

5. How do you ensure the 10-year lookback is accurate, complete, and uniformly applied?

6. What is your approach to handling providers outside NCQA/URAC standards (e.g., home health, unskilled labor)?

7. Does your organization have experience conducting primary source verification for providers licensed in U.S. territories (Puerto Rico, Guam, U.S. Virgin Islands, American Samoa, Northern Mariana Islands)? Please describe any challenges with territorial licensing board responsiveness or data availability, and typical turnaround times for territory-based verifications.

8. What translation or language accessibility services can your organization make available to providers upon request, and what is your typical timeframe to arrange such services once a language barrier is identified?

9. What emerging technologies (e.g., AI, machine learning, intelligent automation, advanced analytics) does your organization currently use — or plan to use — in PSV, risk assessment, provider outreach, or reporting? Please describe any measurable efficiency, accuracy, or timeliness gains from these tools.

Review Board & Appeals

1. What are your qualifications and standards for peer-level review board members?

2. How do you ensure consistency of enhanced review recommendations across specialties?

3. Can you support VA participation in your credentialing committees (as observers or voting members)?

4. What is your workflow for appeal processing and timelines? Can your organization commit to completing appeal reviews and submitting written assessments/recommendations within 5 business days of receiving a complete appeal package?

Monitoring (NPDB-CQ and Beyond)

1. How do you prevent NPDB-CQ renewal lapses, and how is tracking automated?

2. Can you integrate other monitoring (LEIE, SAM, Medicare opt-out, state actions) into a single workflow?

3. How do you notify VA and document monitoring hits in a standardized, exportable format?

4. Does your organization have experience operating as a delegate under a Government-authorized NPDB administrative account? Please describe any challenges anticipated in establishing this delegation relationship.

Pricing & CLIN Structure

1. What contract type do you believe is best suited for this requirement? (Note: VA currently anticipates a Firm-Fixed Price contract structure.)

2. The current draft PWS proposes a tiered sub-CLIN pricing structure based on monthly provider submission volume (Tier 1: 1–150 providers; Tier 2: 151–300; Tier 3: 301–450), with per-provider unit pricing that decreases as volume increases. Is this tiering approach and volume banding realistic based on your operational cost structure? Would you recommend different tier breakpoints?

3. The draft PWS proposes a milestone-based payment structure: Milestone 1 (10%) upon completion of 5 documented contact attempts; Milestone 2 (90%) upon completed, VA-accepted credentialing package (for providers who required 5+ contact attempts); or Milestone 3 (100%) upon a completed, VA-accepted credentialing package for providers who responded before reaching the 5-attempt threshold. Does this structure create any cash-flow, risk, or operational concerns for your organization? Do you have alternative milestone structures to recommend?

4. Does your organization have a recommended pricing approach for the optional Systems Integration task (e.g., EDI 274 integration with VA systems such as Provider Directory or PPMS)? If possible, please provide illustrative pricing for a representative integration scenario (e.g., unidirectional data push vs. bidirectional integration).

5. What is your Rough Order of Magnitude (ROM) estimate for the base requirement, assuming an average of approximately 195 provider submissions per month?

6. What is included in your cost for monitoring beyond NPDB-CQ?

PWS Feedback Do you have any input regarding the DRAFT Performance Work Statement? Please provide any comments using the Microsoft Word Comment tool with your response. VA is particularly interested in feedback on:

· The feasibility of the database uptime/Business Continuity & Disaster Recovery standards (Section 7.3.1–7.3.2)

· The feasibility of the credentialing process stage timeframes (Section 7.5.5.1)

· The tiered pricing and milestone payment structure (Sections 7.5.1 and 7.5.10)

· Any of the Acceptable Performance Levels (APLs) in the QASP (Section 12.3) that you view as unrealistic or would want to negotiate

Teaming Identify whether your business is interested in competing for this requirement as a prime contractor or not. Identify existing subcontracting, joint ventures, or teaming arrangements that would be included.

1. If you anticipate using a subcontractor to perform any portion of PSV or CVO Credentialing Committee functions, please confirm whether that subcontractor's work would be covered under your organization's own accreditation, or whether the subcontractor independently holds NCQA/URAC accreditation for those functions.

2. If credentialing services are delegated, will the VA be able to have direct access to credentialing files?

Do you currently use subcontractors or delegated entities to perform PSV, credentialing verification, or peer-level committee review functions in your existing commercial or government contracts? If so, approximately what percentage of your total credentialing volume is typically performed by delegated/subcontracted entities versus your own staff?

3. If you use delegated subcontractors for credentialing functions, what compliance rate threshold do you currently hold delegates to (e.g., a minimum percentage of files meeting accreditation standards), and how is that threshold determined?

4. What audit practices do you currently apply to delegated subcontractors performing credentialing functions (e.g., audit frequency, sampling methodology, corrective action plan if a delegate falls below your compliance threshold)?

5. Can your database technically distinguish and flag which provider files were processed in whole or in part by a subcontractor versus your own staff, and can VA be given the same level of access, filtering, and audit visibility into subcontractor-processed files as into files processed directly by your organization?