DRAFT_SOW_TEFCA.pdf

Section 4: Requirements Descriptions

Statement of Work (SOW)

4.1 - Governing Documents and Caucus Facilitation

Scope: Develops drafts of Trusted Exchange Framework and Common Agreement (TEFCA) related governance documents, facilitates discussions, and administers caucus (the QHIN Caucus and the Participant/Subparticipant Caucus) feedback to produce final deliverables pending final votes from caucuses. The Contractor shall also administer a process to receive and incorporate public feedback to inform the updates. Documents include all Standard Operating Procedures, Common Agreement, and Qualified Health Information Network Technical Framework (QTF) as described in greater detail in each of the subsections below. The Contractor shall provide the appropriate subject matter expertise to support the development of all documents, as applicable.

Revise and Maintain the TEFCA Common Agreement

The Contractor shall maintain the Common Agreement (CA). This includes compiling a list of potential changes to the Common Agreement, which can include new requirements by law, priorities from the Qualified Health Information Network (QHIN) Caucus and

Participant/Subparticipant Caucus, or items from the Contracting Officer’s Representative

(COR) to address when the CA is next amended. The list will be used by the COR and the

Contractor to plan for any amendments to the CA that will be considered. Any amendments to the CA must be approved by the COR and in accordance with the processes outlined by the

Common Agreement and related documents, including processes outlined by the TEFCA

Governance Standard Operating Procedure (SOP). The Contractor shall also receive and incorporate public feedback to inform the updates required to maintain the Common Agreement.

Such updates/revisions may be related to new or existing regulations and subregulatory guidance, new Office of the National Coordinator for Health Information Technology (ONC) policies, technological advancements, or for any other reason within the scope of the contract

Section 4: Requirements Descriptions

Statement of Work (SOW)

4.1 - Governing Documents and Caucus Facilitation

Scope: Develops drafts of Trusted Exchange Framework and Common Agreement (TEFCA) related governance documents, facilitates discussions, and administers caucus (the QHIN Caucus and the Participant/Subparticipant Caucus) feedback to produce final deliverables pending final votes from caucuses. The Contractor shall also administer a process to receive and incorporate public feedback to inform the updates. Documents include all Standard Operating Procedures, Common Agreement, and Qualified Health Information Network Technical Framework (QTF) as described in greater detail in each of the subsections below. The Contractor shall provide the appropriate subject matter expertise to support the development of all documents, as applicable.

Revise and Maintain the TEFCA Common Agreement

The Contractor shall maintain the Common Agreement (CA). This includes compiling a list of potential changes to the Common Agreement, which can include new requirements by law, priorities from the Qualified Health Information Network (QHIN) Caucus and

Participant/Subparticipant Caucus, or items from the Contracting Officer’s Representative

(COR) to address when the CA is next amended. The list will be used by the COR and the

Contractor to plan for any amendments to the CA that will be considered. Any amendments to the CA must be approved by the COR and in accordance with the processes outlined by the

Common Agreement and related documents, including processes outlined by the TEFCA

Governance Standard Operating Procedure (SOP). The Contractor shall also receive and incorporate public feedback to inform the updates required to maintain the Common Agreement.

Such updates/revisions may be related to new or existing regulations and subregulatory guidance, new Office of the National Coordinator for Health Information Technology (ONC) policies, technological advancements, or for any other reason within the scope of the contract and authorized by the Contracting Officer. The Contractor shall provide the COR with final versions which could include 508 Compliance, of the Common Agreement which will be housed solely on ONC’s website unless otherwise agreed to by the COR and the Contractor.

Develop, Revise and Maintain Standard Operating Procedures (SOPs)

The Contractor shall develop, revise, and maintain all TEFCA SOPs. The Contractor shall develop the SOPs utilizing relevant materials and facilitate discussions (i.e., meetings and workgroups) and iterative draft revisions of SOP documents to ultimately present to the voting caucus(es) for a vote. The Contractor shall also make revisions to SOPs subject to the applicable processes outlined by the Common Agreement and SOPs. The Contractor shall provide the COR with final versions, in a format that include 508 Compliance, of SOPs which will be housed solely on ONC’s website unless otherwise agreed to by the COR and the Contractor.

and authorized by the Contracting Officer. The Contractor shall provide the COR with final versions of the Common Agreement that meet applicable Section 508 accessibility requirements, unless a documented exception or exemption applies. The Common Agreement will be housed solely on ONC’s website unless otherwise agreed to by the COR and the Contractor.

Develop, Revise and Maintain TEFCA Technical Documents

The Contractor shall develop technical documents and submit to the COR for approval. In collaboration with the COR, the Contractor shall develop technical documents utilizing relevant resources identified by the COR including the processes outlined in the Common Agreement and

SOPs. The Contractor shall maintain the TEFCA technical documents by proposing revisions to the COR for review and approval and by implementing all COR-approved changes in accordance with the processes outlined by the Common Agreement and related documents, including the processes outlined in the TEFCA Governance SOP. Example technical documents include:

• The QHIN Technical Framework (QTF)

• Technical Trust Requirements

• TEFCA Technical Roadmap

• QHIN Cybersecurity Certification

Develop, Revise and Maintain TEFCA Technical Documents

The Contractor shall develop technical documents and submit to the COR for approval. In collaboration with the COR, the Contractor shall develop technical documents utilizing relevant resources identified by the COR including the processes outlined in the Common Agreement and

SOPs. The Contractor shall maintain the TEFCA technical documents by proposing revisions to the COR for review and approval and by implementing all COR-approved changes in accordance with the processes outlined by the Common Agreement and related documents, including the processes outlined in the TEFCA Governance SOP. Example technical documents include:

• The QHIN Technical Framework (QTF)

• Technical Trust Requirements

• TEFCA Technical Roadmap

• QHIN Cybersecurity Certification

The Contractor shall provide the COR with final versions which could include 508 Compliance of technical documents which will be housed solely on ONC’s website unless otherwise agreed to by the COR and the Contractor.

Change Management Processes and Caucus Administration

The Contractor shall coordinate changes to the Common Agreement, the QTF, and the SOPs in conjunction with ONC. The Contractor shall work with ONC to facilitate regularly occurring discussions among the QHIN and Participant/Subparticipant Caucuses to discuss network enhancements and ongoing changes to governance documents.

The Contractor shall host a webpage to provide transparency into amendments to the Framework

Agreements, technical requirements, and SOPs in the change management process.

4.2 - Onboarding, Operations, and Implementation

Scope: Serve as Trusted Exchange Framework and Common Agreement™ (TEFCA®) network administrator. This includes being the co-signer to the Common Agreement (CA) and having a direct relationship with Qualified Health Information Networks® (QHINs™). The network administrator manages the network during stable state (including enabling technical infrastructure (e.g., directory), network transitions to new capabilities and requirements, and service interruptions and outages. The Contractor shall be responsible for QHIN onboarding activities, managing cybersecurity, and responses to any identified network operations issues.

Additionally, the Contractor shall implement processes for QHIN monitoring and compliance.

The Contractor shall provide the COR with final versions of technical documents that meet applicable Section 508 accessibility requirements, unless a documented exception or exemption applies. These documents will be housed solely on ONC’s website unless otherwise agreed to by the COR and the Contractor.

Signatory to Common Agreement as the Recognized Coordinating Entity® (RCE®)

The Contractor shall be designated as the Recognized Coordinating Entity (RCE) and shall sign as a party to the Common Agreement alongside the Designated QHINs. The Contractor shall be legally bound to the agreement as outlined in the document and related artifacts.

Review Applications, Conduct QHIN Onboarding Activities, and Make QHIN Designation

Determinations

The Contractor shall review QHIN applications, conduct activities related to Onboarding, and provide a designation determination to the COR and the applicant, all in accordance with the

Common Agreement, relevant Standard Operating Procedures (SOPs), ONC regulations and subregulatory guidance, and applicable law. The Contractor shall support ONC’s appeals process for designation determinations, including providing additional information and maintaining documentation that supports the Contractor’s designation determination and providing such information and documentation. The Contractor shall provide to the COR a monthly report on the status of all items. The Contractor shall host a webpage with information on how to apply, the process, and the requirements as well as an online application that can be completed by applicants.

QHIN Compliance and Network Monitoring

Compliance: The Contractor shall monitor QHINs for compliance with requirements of the

Common Agreement, the QTF, SOPs, and all other attachments, exhibits, and artifacts incorporated by reference as agreed upon by the Contractor and the COR. Examples include but are not limited to: network operations, metrics monthly reporting by QHINs, readiness to meet effective dates, security incident reporting, implementation of policies, and evaluation and execution of remediation plans.

Network Interruptions/Outages: The Contractor shall monitor the network for potential issues and report and resolve any outages to ONC and TEFCA entities as required by the applicable

SOPs, including ongoing communications regarding the status of an outage, resolutions, responses and compliance consequences (if needed), and providing a report of the outage which would include but is not limited to timeline, causes, steps for resolution, and changes needed to prevent the issue in the future.

The Contractor shall follow the applicable SOP(s) to determine whether the QHINs comply with the processes established in the Common Agreement, the QTF, SOPs, and all other attachments, exhibits, and artifacts incorporated by reference. The Contractor shall support implementation of consequences for QHIN non-compliance in accordance with applicable SOP(s), including suspending or terminating a QHIN upon ONC’s prior approval.

The Contractor shall support any disputes or investigations as well as ONC’s appeals process for suspension and termination determinations, including providing additional information and maintaining documentation that supports the Contractor’s suspension or termination determination following ONC’s prior approval.

Vetting Accuracy Compliance

The Contractor shall support a vetting process that is used by QHINs to determine if Participants and Subparticipants meet the requirements for inclusion in the directory. This may include cross-collaboration with other ONC contractors.

Cybersecurity

The Contractor shall be responsible for monitoring and maintaining the overall security posture of activities conducted under TEFCA and making recommendations to all QHINs regarding changes to baseline security practices required to address changes to the threat landscape. The

Contractor shall have expert knowledge, skills, and experience in cybersecurity. The Contractor shall designate a person to serve as the Chief Information Security Officer (CISO) for leading these security activities. This may be either an employee or independent contractor.

The Contractor shall maintain and publish a list of currently approved certifications and certifying bodies which meet the TEFCA’s security certification requirements as outlined in the

SOP.

The Contractor shall facilitate a Cybersecurity Council to enhance cybersecurity commensurate with the risks of the activities conducted under the Framework Agreements as set forth in an

SOP. The Contractor shall facilitate at least monthly meetings, or otherwise as agreed upon by the Contractor and the COR, of the Cybersecurity Council including, but not limited to, preparation for and implementation of decisions made during such meetings.

The Contractor shall manage the TEFCA Security Incident Reporting process as outlined in the

SOP. Upon receipt of a TEFCA Security Incident Report, the Contractor’s TEFCA Cybersecurity

Incident Response Team shall convene and facilitate appropriate actions, including activities to help communicate threats to the broader TEFCA community. Activities may include the RCE convening the full Cybersecurity Council, or an executive session of a subset of the

Cybersecurity Council and/or representatives from affected QHINs and/or Participants and/or

Subparticipants to protect Confidential Information.

Other activities, which may be conducted by the Contractor, include supporting timely development and implementation of response and mitigation efforts across QHINs, reviewing and sharing Health Sector Cybersecurity Coordination Center (HC3) Threat Briefs and other sector alerts for any specific guidance or mitigation recommendations, and taking action it deems necessary to minimize the potential for further harm in response to a threat condition.

QHIN/Participant/Subparticipant Network Implementation Activities

The Contractor shall engage QHINs, Participants, Subparticipants, and other stakeholders, as applicable, to plan for and sequence network implementation changes. The work involved may include managing and executing relevant time limited workgroups to support implementation activities.

Technical Infrastructure

The Contractor shall develop, maintain, operate, and upgrade key TEFCA infrastructure which may include:

• Developing and maintaining resources for QHINs, Participants and Subparticipants, including regular updates to any required technical specifications necessary to support

TEFCA infrastructure and maintain alignment with ONC standards requirements.

• Operating, maintaining, and upgrading/updating an endpoint directory, including an implementation guide for directory use.

• Operating, maintaining, and upgrading/updating a system to enable QHINs to propose endpoints for vetting, including all necessary documentation.

• Developing the Directory Service Implementation Guide and related Guidance: FHIR R4

Directory IG outlining the structure and content of information necessary for technical connectivity between QHINs, and for Participants/Subparticipants in Facilitated

FHIR. This guide shall be updated as needed in alignment with Common Agreement, QHIN Technical Framework, or Standard Operating Procedures (SOPs) updates and based on feedback from candidate and Designated QHINs, along with alignment to other industry efforts around standardized directories. In addition, there may be a companion document defining data integrity requirements.

• Developing, operating, maintaining, and upgrading/updating the TEFCA infrastructure required to establish and support technically enforceable trust among participants, including the digital certificates as part of TEFCA’s public key infrastructure. The details of this are spelled out in the Technical Trust Requirements document.

• Supporting and maintaining an Interoperability testing platform used during QHIN onboarding, testing new capabilities, retesting due to technical changes to confirm compliance with applicable technical requirements; related technical support and assistance; and, development, operating, maintenance and updating the testing implementation guide.

• Facilitating a change control process for changes to the directory.

• Conducting cybersecurity activities for the TEFCA infrastructure including annual vulnerability assessments, PEN testing, related testing for changes to the Directory.

• Routinely assess key TEFCA infrastructure, document findings, and identify maintenance and upgrade needs.

Testing

The Contractor shall operate a testing platform that verifies that a QHIN’s or Applicant QHIN’s system both complies with all specifications and requirements of the QTF and has the ability to interoperate with other QHINs. It will support the following:

• Applicant QHINs during the Onboarding process

• Designated QHINs who wish to test new technology or need to retest as a condition of continued participation in the TEFCA

• Vendors who wish to have their product(s) validated as QHIN compliant prior to a QHIN

Application

• QHIN implementations will be tested using a set of software tools, test data, and procedures managed by the Contractor. Test cases, test data, and the tooling may be updated as issues are identified over time

4.3 - Investigations and Dispute Resolution

Scope: Interpret Trusted Exchange Framework and Common Agreement™ (TEFCA®) governance documents to resolve inquiries for investigations and disputes regarding the application of TEFCA requirements, and provide consistent interpretations of the Common

Agreement, Standard Operating Procedures, and related Framework Agreements. The Contractor shall review specific situations involving QHINs, Participants, and Subparticipants and determine whether actions are consistent with TEFCA requirements and issue recommendations and interpretations. The Contractor shall support a system to receive and track all inquiries, investigations, and disputes. Upon completion of each submission the Contractor shall provide a memo inclusive of the issue, sources to support all recommendations, and the final recommendation. Additionally, the Contractor shall provide a quarterly report of activities to the

Contracting Officer’s Representative (COR). The Contractors shall have expertise in the operational and technical policies of TEFCA.

Investigations: The Contractor shall conduct investigations as identified by Qualified Health

Information Networks® (QHINs™), Participants, Subparticipants in order to determine potential

QHIN noncompliance with the Common Agreement, the QHIN Technical Framework, and

Standard Operating Procedures (SOPs). This may include reviewing QHIN materials and/or

Directory entries, presenting findings, and recommending remediation plans.

Disputes: The Contractor shall support and facilitate the Dispute Resolution Process as identified in the SOP. This includes managing the formal dispute process including providing technical, policy, legal, and staff support for the Dispute Resolution Board and Governing Council as needed.