RFP-CMS-2009-8A-INFRA-02 2-3-2009.doc

Request for Proposal (RFP) No.: RFP-CMS-2009-8A-INFRA-02

Title: Healthcare Quality Information Systems (HCQIS) Infrastructure Support

Dated 2/3/2009

7Section B - Supplies or Services/Prices

7B.1

BRIEF DESCRIPTION OF SERVICES

7B.2

TYPE OF CONTRACT

7B.3

WITHHOLDING OF CONTRACT PAYMENTS

7B.4

ESTIMATED COST-PLUS-AWARD FEE (CPAF)

8B.5

FIXED FEE PAYMENT SCHEDULE (IF APPLICABLE)

9Section C - Description/Specifications

9C.1 Introduction

10C.1.1 Background

13C.1.2 Purpose

13C.2 Project Specific Tasks

14C.2.1 Network

14C.2.1.1 Network Operations and Maintenance

14C.2.1.2 Network Engineering

15C.2.2 Microsoft Server Environment

15C.2.2.1 Microsoft Server Operations and Maintenance

15C.2.2.2 Microsoft Server Engineering

15C.2.3 UNIX Environment

16C.2.3.1 UNIX Operations and Maintenance

16C.2.3.2 UNIX Engineering

16C.2.4 Enterprise-wide Engineering Tasks

17C.2.5 Security

17C.2.6 Testing

18C.2.7 Configuration Management

18C.2.8 Project Management

19C.2.9 SAN Administration

19C.2.10 VTC Administration

19C.2.10.1 Complex Videoconferencing Support

20C.2.10.2 Regional Office Videoconferencing Support

20C.2.11 Data Center

21C.2.12 DBA Support

21C.2.13 Windows Active Directory Server Environment

21C.2.14 General Support

22C.2.15 Network Operations Center

22C.2.16 Joint Application Development

22C.2.17 QualityNet Help Desk

23C.2.18 Production

24C.2.19 Procurement

25C.2.19.1 Additional Reporting Requirements

25C.2.20 QIO and ESRD System Administration

25C.2.21 QualityNet Conference Support

26C.2.22 Operations and Maintenance

26C.2.23 System Development Life Cycle (SDLC)

26C.2.24 Transition Plan

26C.3 General Requirements

26C.3.1 System Development Life Cycle (SDLC)

26C.3.1.1 Business Requirements

27C.3.1.2 Development

27C.3.1.3 Testing (QA, Validation, Stress-Testing, Pre-Production)

27C.3.1.3.1Quality Assurance

27C.3.1.3.1.1Test Plans

27C.3.1.3.1.2Test Cases

27C.3.1.3.2 Validation Testing

28C.3.1.3.3 Stress Testing

28C.3.2 Section 508

29C.3.3 Earned Value Management

30C.3.3.1 Financial Report

30C.3.3.2 Variance Report

30C.3.3.3 Management Review

30C.3.4 Cost Reimbursement

31C.3.5 Contractor Limitation

31C.3.6 QIO Data

31C.4 Staffing, Organizational Structure, and Key Personnel

33C.5 End of Contract Transition

33C.5.1 Transition Plan

34C.5.2 Contract Phase-Out Services

34C.5.3 Technical Documentation

34C.6 Points of Contact

35Section D - Packaging and Marking

36Section E - Inspection and Acceptance

36E. 1

FAR 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

36E. 2

INSPECTION AND ACCEPTANCE

36E. 3

APPROVALS BY THE PROJECT OFFICER/GOVERNMENT TASK LEADER

37Section F - Deliveries or Performance

37F. 1

FAR 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

37F. 2

PERIOD OF PERFORMANCE

37F. 3

REPORT(S)/DELIVERABLES AND DELIVERY SCHEDULE

37F. 4

MONTHLY PROGRESS REPORT

37F. 5

FINANCIAL MANAGEMENT GRAPH

38F.6

TIME AND PLACE OF DELIVERIES

38F.7

NOTIFICATION OF LATE DELIVERIES

38F.8

SCHEDULE OF DELIVERABLES

44F.9

RECIPIENT ADDRESSES:

45Section G - Contract Administration Data

45G. 1

DETERMINATION OF AWARD FEE

45G. 2

AWARD FEE PLAN

47G. 3

AWARD FEE PLAN SCHEDULE

47G. 4

FINAL INDIRECT COST RATE PROPOSAL

48G. 5

PROVISIONAL INDIRECT COST RATES

49G. 6

TECHNICAL MONITORING

50G. 7

GOVERNMENT POINTS OF CONTACT

50G. 8

DESIGNATION OF PROJECT OFFICER

50G. 9

PROJECT DIRECTOR

50G. 10

MODIFICATION AUTHORITY

51G. 11 SECURITY CLAUSE - BACKGROUND INVESTIGATIONS FOR CONTRACTOR PERSONNEL FOR NEW CONTRACTS

54G.12

SUBCONTRACT CONSENTS

54G. 13

CONSULTANT SERVICES APPROVAL/SUBCONTRACT CONSENTS

55G. 14

DESIGNATION OF PROPERTY ADMINISTRATOR

55G. 15

GOVERNMENT-FURNISHED PROPERTY

55G. 16

PAYMENT DOCUMENTATION AND PROCESS

59G. 17

METHOD OF PAYMENT

60G. 18

INDIRECT COST RATES

61Section H - Special Contract Requirements

61H. 2

HHSAR 352.270-5 KEY PERSONNEL. (JAN 2006)

61H. 3

HIPAA BUSINESS ASSOCIATE CLAUSE (2006)

64H. 4

ORGANIZATIONAL CONFLICTS OF INTEREST (SERVICES)

65H. 5

INFORMATION SECURITY (APR 2006)

66H. 6

RESTRICTIONS AGAINST DISCLOSURE

66H. 7

FAR 52.234-4 EARNED VALUE MANAGEMENT SYSTEM (JULY 2006)

67H. 8 FAR 52.234-3 Notice of Earned Value Management System - Post Award IBR (JULY 2006)

68H. 9

CORRESPONDENCE PROCEDURES

68H. 10

MONITORING

68H.11

CMS INFORMATION SECURITY (APRIL 2008)

70H.12

POST AWARD EVALUATION OF CONTRACTOR PERFORMANCE

71H.13

CODE OF CONDUCT

71H.14

APPROVAL OF CONTRACT ACQUIRED INFORMATION TECHNOLOGY (IT)

71H.15

SECTION 508 – ACCESSIBILITY OF ELECTRONIC AND INFORMATION TECHNOLOGY

72H.16

REHABILITATION ACT, SECTION 508, ACCESSIBILITY STANDARDS

72H.17

PRIVACY ACT SYSTEMS OF RECORDS

73H.18

RESTRICTIONS ON THE USE OF INFORMATION

74Section I - Contract Clauses

74I.1

FAR 52.252-2 CLAUSES INCORPORATED BY REFERENCE. (FEB 1998)

76I.2

DEPARTMENT OF HEALTH AND HUMAN SERVICES ACQUISITION REGULATIONS (HHSAR)

76I.3 HHSAR 352.202-1, Definitions (Jan. 2001)

76I.4

FAR 52.204-1 APPROVAL OF CONTRACT (DEC 1989)

78I.6

FAR 52.215-19 NOTIFICATION OF OWNERSHIP CHANGES (OCT 1997)

80I.11

FAR 52.244-6 SUBCONTRACTS FOR COMMERCIAL ITEMS (MAR 2007)

82Section J - List of Documents, Exhibits and Other Attachments

83Section K - Representations, Certifications, and Other Statements of Bidders

83K.3

FAR 52.204-8 ANNUAL REPRESENTATIONS AND CERTIFICATIONS. (JAN 2006)

84K.4

FAR 52.209-5 CERTIFICATION REGARDING RESPONSIBILITY MATTERS. (MAY 2008)

86K.5

FAR 52.230-2 COST ACCOUNTING STANDARDS (OCT 2008)

87K. 6

ORGANIZATIONAL CONFLICT OF INTEREST REPRESENTATION (SERVICES)

88K.7 HHSAR INTERIM GUIDANCE - CERTIFICATION OF FILING AND PAYMENT OF FEDERAL TAXES FISCAL YEAR 2008 HHS APPROPRIATIONS ACT - SECTION 523

89Section L - Instructions, Conditions, and Notices to Bidders

89L.1 FAR 52.252-1 Solicitation Provisions incorporated by Reference (FEB 1998)

89L.2 FAR 52.215-20 Requirements for Cost or Pricing Data or Information Other Than Cost or Pricing Data (OCT 1997)

90L.3 FAR 52.216-1 Type of Contract (APR 1984)

90L.4 FAR 52.233-2 Service of Protest (SEP 2006)

90L.5 Section 508 Accessibility of Electronic and Information Technology (EIT) Compliance

91L.6 Instructions to Offerors – Central Contractor Registration (CCR)

91L.7 Submission of Representations and Certifications

91L.8 Representations and Certifications

91L.9 Communication Prior to Contract Award

91L.10 Work Within the United States

92L.11 Questions

92L.12 NAICS Code and Small Business Size Standard

93L.13 Requirement for Technical Data

93L.14 General Instructions

93L.15 Facsimile, Electronic, Written Proposals

93L.16 Proposal Organization

94L.17 Proposal Delivery

95L.18 Business Proposal Instructions

98L.19 Technical Proposal Instructions

100Section M - Evaluation Factors for Award

100M. 2

BASIS FOR AWARD BASED ON BEST VALUE

100M. 3

BASIS FOR AWARD BASED ON BEST VALUE (ALTERNATE I)

100M. 4

INDIRECT COST CEILINGS

100M. 5

EVALUATION FACTORS FOR AWARD (SERVICES)

Section B - Supplies or Services/Prices

B.1

BRIEF DESCRIPTION OF SERVICES

The purpose of this solicitation is to obtain infrastructure services to support Standard Data Processing System (SDPS), Value Based Purchasing (VBP), Consolidated Renal Operations in a Web-Enabled Network (CROWNWeb), and Quality Improvement and Evaluation System (QIES) application groups; Help Desk, Quality Improvement Organization (QIO) System Administration, and production support control for the SDPS group; production support control for the VBP application group; and file/print and desktop services for both End Stage Renal Disease (ESRD) and QIO facilities.

B.2

TYPE OF CONTRACT

The Government contemplates award of a Cost-Plus-Award-Fee contract resulting from this solication.

B.3

WITHHOLDING OF CONTRACT PAYMENTS

Notwithstanding any other payment provisions of this contract, failure of the Contractor to submit required reports when due or failure to perform or deliver required work, supplies, or services, will result in the withholding of payments under this contract unless such failure arises out of causes beyond the control, and without the fault or negligence of the Contractor as defined by the clause entitled "Excusable Delays" or "Default", as applicable. The Government shall promptly notify the Contractor of its intention to withhold payment of any invoice or voucher submitted.

B.4

ESTIMATED COST-PLUS-AWARD FEE (CPAF)

A. ESTIMATED COST AND AWARD FEE

The total amount of this CPAF contract is $_______TBD__________, which includes a total estimated cost of $________TBD______________, a base fee of $____TBD___________, and a maximum award fee of $______TBD___________. The base fee, if any, together with reimbursement of allowable cost, shall constitute complete compensation for the work performed under this contract, except to the extent that payment of award fee may be allowed as provided in paragraph B. which follows.

B. PERFORMANCE AWARD FEE

1. The performance award fee available to be earned by the Contractor ranges from $________TBD________ to $_____TBD__________, which is hereby established as the maximum amount of such award fee that the Contractor may earn during the period of performance of this contract. Determinations will be made every twelve (12) months with the first evaluation period beginning on _________TBD____________. The Government's determination of the award fee amount and the award fee determination methodology are unilateral decisions made solely at the discretion of the Government. The amount of any award fee which may be awarded is subject to the limitation of the Government's obligation in the clauses of this contract entitled, `Limitation of Funds' or `Limitations of Cost,' whichever is applicable.

2. The award fee shall be based on the Contractor's Infrastructure Support Deliverable due dates in accordance with the attached Award Fee Plan found in Section G.2. The amount of the award fee to be paid is determined by the Government's judgmental evaluation of the contractor's performance in terms of the criteria stated in the contract. This determination and the methodology for determining the award fee are unilateral decisions made solely at the discretion of the Government. The evaluation criteria and the requirements they represent in the Award Fee Plan may be revised from time to time at the sole discretion of the Contracting Officer; provided that the Contractor has been notified in writing of such revisions at least thirty (30) days in advance of the beginning of the period for which the Contractor's performance will be evaluated using the revised criteria. The award fee pool is the total of the available award fee dollars for each evaluation period for the life of the contract.

3. Since the available award fee during the evaluation period must be earned, the contractor begins each evaluation period with 0% of the available award fee and works up to the evaluated fee for each evaluation period. Contractors do not begin with 100% of the available award fee and have deductions withdrawn to arrive at the evaluated fee for each evaluation period. In addition, contractors should not receive award fee (above the base fee) for simply meeting contract requirements. Earning of award fee should be in accordance with the award fee plan, and should be directly commensurate with the level of performance under the contract. A contractor will not receive the maximum amount of award fee under a contract without a demonstrated superior level of performance, as provided for in the award fee plan. Maximum contract fee is the sum of all fees (not just the award fee) and incentives payable under the contract, including performance and subcontracting incentives.

C. BASE FEE

1. The base fee, which may be $0, is a fixed amount that the contractor will receive for satisfactory contract performance. Base fee is not earned and is, therefore, paid on a regular basis upon the contractor submitting their voucher or invoice. The Contracting Officer may withhold payment of the base fee until a reserve is set aside in an amount that the Contracting Officer considers necessary to protect the Government's interest. This reserve shall not exceed 15 percent of the applicable base fee or $100,000, whichever is less.

2. The Contracting Officer shall release 75 percent of all base fee withheld under this contract after receipt of the certified final indirect cost rate proposal covering the year of physical completion of this contract, provided the Contractor has satisfied all other contract terms and conditions, including the submission of the final patent and royalty reports, and is not delinquent in submitting final vouchers on prior years' settlements. The Contracting Officer may release up to 90 percent of the base fee withheld under this contract based on the Contractor's past performance related to the submission and settlement of final indirect cost rate proposals.

B.5

FIXED FEE PAYMENT SCHEDULE (IF APPLICABLE)

The contractor shall voucher for payment in accordance with the instructions provided in Section G of this contract. The Contractor shall include fee on a monthly basis based on the following fee schedule, which will be completed at time of award:

Month

Payment/Month

Total

1-11

TBD*

Withholding

Total

*Note: To be determined at time of award.

Section C - Description/Specifications

Independently and not as an agent of the Government, the Contractor shall be required to furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government, as needed to perform the Statement of Work below:

C.1 Introduction

CMS maintains the QualityNet General Support System (GSS), an environment that makes use of shared database servers and Wide Area Network (WAN) resources to monitor and improve utilization and quality of care for Medicare and Medicaid beneficiaries. QualityNet resources are geographically dispersed; Complex 1 located at the CMS Central Office Data Center in Baltimore, MD and Complex 2 which is located at the HCQIS Infrastructure contractor; a national network of 53 Quality Improvement Organization (QIO) sites responsible for each US state, territory, and the District of Columbia; one Clinical Data Abstraction Center (CDAC) located in York, PA; 18 End Stage Renal Disease (ESRD) networks; and two Contractor support locations.

Each of these organizations maintain a staff of highly qualified, multidisciplinary experts in medicine, quality improvement, health information management, health informatics, IT systems security, statistical analysis, computer programming and operations, communications, public relations, and clerical support. Their mission is to ensure the quality, effectiveness, efficiency, security, and economy of health care services provided to Medicare and Medicaid beneficiaries.

CMS organizational business processes that are supported by QualityNet include:

· The capability for collection and management of clinical, survey, and project data from Medicare and Medicaid providers.

· The management and analysis of that clinical, survey, and project data by the Quality Improvement Organization (QIO).

· The collection of data by ESRD Network Organizations to administer the national Medicare ESRD program.

· The management and provision of Medicare and Medicaid information to providers that include but are not limited to Hospitals, physician or family practice clinics, dialysis clinics, Skilled Nursing Facilities, Home Health Agencies, Nursing Homes, and various specialized clinics.

The HealthCare Quality Information System (HCQIS) is a major application environment that uses application groups, shared servers, and WAN to monitor and improve utilization and quality of care for Medicare and Medicaid beneficiaries. HCQIS is composed of 5 application groups:

· Standard Data Processing System (SDPS) for Quality Improvement Organizations (QIOs), including the Clinical Data Abstraction Center (CDAC);

· Value Based Purchasing (VBP) IT Infrastructure for Physician Quality Reporting Initiative (PQRI) and Hospital Outpatient;

· Consolidated Renal Operations in a Web-Enabled Network (CROWNWeb);

· Quality Improvement and Evaluation System (QIES) for states and CMS;

· Quality Improvement Initiatives (QII) This statement of work is for:

1. Infrastructure support for SDPS, VBP, CROWNWeb, and QIES application groups and

2. Help Desk, QIO System Administration, and production support control for the SDPS group.

3. Production support control for the VBP application group.

4. File/Print and desktop services for both ESRD and QIO facilities.

This statement of work is phase 2, of a 4-phase process. The other phases will/have been be/or issued as separate solicitations with their specific SOW, requirements, evaluation criteria, etc. The Government estimates that it will issue these separate solicitations during 2008-2009. This information is being provided as informational only and it does not obligate the Government to issue a solicitation or award a contract. The four Phases that currently being developed are:

Phase 1 – Program Management and Business Requirement Contract

Phase 2 – Infrastructure Contract (Current Solicitation) Phase 3 – Reports and Analytics Contract

Phase 4 – Development Contract CMS will utilize several contracts to develop and support the SDPS and VBP application groups.

Award Provisions:

· The Prime and Sub-contractor(s) awarded Phase (I) Business Requirements and Program Management, both will be excluded from eligibility on Phase (IV) Development.

· The Prime contractor awarded Phase (I) Business Requirements and Program Management, will be excluded from eligibility on Phase (II) Infrastructure.

· The Prime contractor awarded Phase (II) Infrastructure, will be excluded from eligibility on Phase (I) Business Requirements and Program Management and Phase (IV) Development.

· Any Sub-contractor(s) of Phase (I) Business Requirements and Program will be excluded from eligibility of Phase (IV) Development.

· Any Sub-contractor(s) awarded Phase (I) Business Requirements and Program Management, may be eligibility to bid on Phase (II) Infrastructure C.1.1 BackgroundError! Bookmark not defined.xe "Background xe "Background"

The Standard Data Processing System (SDPS)xe "Standard Data Processing System (SDPS)" \b \i, implemented in 1997, supports the Quality Improvement Organization (QIOxe "Quality Improvement Organization (QIO") program and Centers for Medicare & Medicaid Services (CMS) community. Prior to SDPS, each QIO was responsible for developing solutions to meet the management and reporting requirements of the Statement of Work (SOW). Besides the obvious inefficiencies of redundant systems and costs, each QIO had different competencies during that period. Since the inception of SDPS, the functions of SDPS have encompassed support, standardization and development of data, software and standards for the QIO community. SDPS continues to rapidly evolve with innovative technology to meet the challenges of supporting and interfacing directly with the QIO community and surrounding healthcare industry.

Quality Improvement Organizations (QIO) are under contract by the Centers for Medicare and Medicaid Services (CMS) to

· Improve quality of care for beneficiaries;

· Protect the integrity of the Medicare Trust Fund by ensuring that Medicare pays only for services and goods that are reasonable and medically necessary and that are provided in the most appropriate setting; and

· Protect beneficiaries by expeditiously addressing individual complaints, notices, and appeals, such as beneficiary complaints; provider-issued notices of non-coverage (Hospital-Issued Notice of Non-Coverage [HINN], Notice of Discharge and Medicare Appeal Rights [NODMAR], and Medicare Advantage appeal); Emergency Medical Treatment and Labor Act (EMTALA) violations; and other related statutory QIO responsibilities.

The statutory authority for the QIO Statement of Work is found in Part B of Title XI of the Social SecurityError! Bookmark not defined.xe "Security xe "Security" Act (hereinafter referred to as the Act), as amended by the Peer Review Improvement Act of 1982. The Act established the Utilization and Quality Control Peer Review Organization Program, now known as the Quality Improvement Organization (QIOxe "Quality Improvement Organization (QIO") Program.

The statutory mission of the Program, as set forth in Section 1862(g) of the Act, is to improve the effectiveness, efficiency, economy, and quality of services delivered to Medicare beneficiaries.

In support of the QIO program, CMS authorized the design and implementation of a SDPS for the User Community. SDPS is an information system solution that provides a common platform for users to share applications and data to promote efficiency and increase productivity. SDPS is the QIO Information Technology and data support infrastructure.

The SDPS User Community, for purposes of this contract, refers to the QIOs, the State Agencies, CMS Central and Regional Offices, the Clinical Data Abstraction Center (CDAC), and other organizations/partners that may be incorporated in support of CMS initiatives. This system services the daily, ongoing support that the SDPS User Community needs to fulfill their contractual requirements in a manner supportive of an ongoing quality improvement program.

The VBP application group utilizes SDPS applications and warehouses in addition to other VBP specific products. These applications and warehouse support two provisions of the Tax Relief and Health Care Act of 2006 (TRHCA) Division B, Title 1:

1. Section 101, Physician Payment and Quality Improvement, includes the Physician Quality Reporting Initiative (PQRI). This law authorizes a financial incentive for eligible professionals to participate in a voluntary quality reporting program. Eligible professionals, who chose to participate and successfully report on a designated set of quality measures for services paid under the Medicare Physician Fee Schedule and provided between July 1 and December 31, 2007 to Medicare beneficiaries under the traditional fee-for-service program, may earn a bonus payment of 1.5% of their charges during that period, subject to a cap.

On December 29, 2007, the President signed Public Law 110-173, the Medicare, Medicaid, and SCHIP Extension Act of 2007 (MMSEA), which authorized the continuation of the Physician Quality Reporting Initiative (PQRI) for 2008. The 2008 PQRI reporting period is January 1-December 31, 2008.

The Extension Act also provides new authorities for enhancing PQRI that CMS will be implementing during 2008. MMSEA requires CMS to establish alternative reporting periods and alternative criteria for satisfactorily reporting groups of measures via claims for 2008. It also requires CMS to establish alternative reporting periods and alternative criteria for satisfactorily reporting measures via registries to enable professionals to earn the 1.5% incentive for participation in PQRI based on data submitted via these mechanisms.

2. Section 109, requires the development of measures for the evaluation of the quality of care of services provided by hospitals in outpatient settings. An Outpatient Prospective Payment System (OPPS) Reporting Hospital Quality Data for Annual Payment Update (RHQDAPU) program modeled after the current Inpatient Prospective Payment System (IPPS) RHQDAPU program will be established.

Section 109, which applies to hospitals as defined under section 1886(d)(1(B) of the Act, also requires that hospital outpatient departments (HOPD) that fail to report data required for the quality measures selected by the Secretary will incur a reduction in their annual OPD fee schedule increase factor by 2.0 percentage points. OPPS payments beginning in CY 2009 will be based on hospital reporting of OPD data beginning in CY 2008.

Maintenance of information on the End Stage Renal Disease (ESRD) population by CMS is mandated by legislation and regulation. (See Public Law 95-292, Section (c)(1)(A); 42 CFR, Chapter IV, Part 476; and Public Law 92-603, Section 299I). In support of the CMS ESRD community, CMS created the Program Management and Medical Information System (PMMIS). The PMMIS is the system of records for the CMS ESRD data, and is maintained by way of the CROWN suite of systems. CROWN refers to any and all components of the DESCM suite of ESRD systems – the Renal Management Information System (REMIS), the Standard Information Management System (SIMS), CROWNWeb, Cognos Reporting Tool, QualityNet Identity Provisioning System (QIPS), and all related databases and architecture.

The Centers for Medicare & Medicaid Services (CMS) authorized the design and implementation of the Consolidated Renal Operations in a Web-Enabled Network (CROWN) for support of the ESRD User Community. CMS is continuing to expand on its initiative to integrate the End Stage Renal Disease (ESRD) systems under CROWN. CMS and the ESRD Networks have been working together to build CROWN to provide for the collection and validation of information about the Medicare ESRD program, its beneficiaries, and the services provided to them. It is vitally important that CMS continues progress made in support of new ESRD Conditions for Coverage and towards the support of the CROWNWeb system that will support the ESRD Conditions for Coverage. The Contractor will cooperate closely with the appropriate SDPS application and QualityNet infrastructure support contractors in supporting all CROWN applications. During the course of this contract, the Contractor must depend on useable business requirements and data dictionary products for their production of accurate functional specifications, design, and ultimately a properly coded application.

The Quality Improvement and Evaluation System (QIES) is CMS’s key tracking, analysis, and data repository system for Medicare, Medicaid, and CLIA provider quality of care. QIES collects and validates data on provider and beneficiary specific outcomes of care and performance across a multitude of delivery sites (including nursing homes, home health agencies, inpatient rehabilitation facilities, and swing bed hospitals) for use in improving the quality and cost effectiveness of services provided by the Medicare/Medicaid/CLIA programs. QIES is considered to be a Medicare Modernization Act (of 1999) (MMA) critical CMS system integral to many key CMS’s quality of care activities including: the Survey and Certification program; the Administrator’s quality indicators for Nursing Homes (NH) and Home Health Agencies (HHA); complaints and enforcement monitoring; accreditation processes; consumer information initiatives (such as Nursing Home and Home Health Compare); as well as, data validation and survey process enhancement initiatives.

QIES is also crucial to CMS’ payment systems for Skilled Nursing Facilities and Inpatient Rehabilitation Facilities. The system collects and validates patient assessment data directly linked to claims for payment and correlates utilization groupings to actual patient clinical and functional status.

QIES directly supports and implements provisions of OBRA 1987, HIPAA 1996, BBA 1997, and the MMA, and numerous implementing regulations. QIES also fulfills CMS action items pursuant to GAO and OIG reports and Congressional committee corrective action plans on the Nursing Home enforcement and complaints processes.

QIES has been under development since 1998 and is now at a critical system development life cycle (SDLC) juncture in a multi-year effort to convert of our most complex providers (CLIA laboratories and hospitals) from the legacy Online Survey, Certification, and Reporting System (OSCAR) to QIES. Adding to the urgency and complexity of current work are implementation of the legislative mandates of Section 723 of the MMA and National Provider Identifier for HIPAA; and two regulations pursuant to BBA97 making significant changes to the PPS assessment specifications for both NHs and HHAs. The continued, uninterrupted conversion of QIES is critical to CMS’s payment and quality of care improvement processes, and to implementation and support of statutory mandates and major CMS and DHHS initiatives.

C.1.2 PurposeError! Bookmark not defined.xe "Purpose" xe "Purpose

The purpose of this Statement of Work (SOW) is to obtain contractor support for the technical infrastructure components of the QualityNet environment. This infrastructure support is wide-ranging, covering areas such as:

· Hosting a data center

· Network management

· UNIX and Microsoft servers management

· Configuration management

· Validation Testing

· Stress Testing

· Project management

· Security

· Help Desk

· Procurement

· Production Support

· QIO System Administration

· ESRD System Administration

· File and Print Services

· E-mail services

· Desktop support

The contractor shall proactively manage the evolutionary growth and expansion of the QualityNet technical infrastructure. The contractor shall also manage the evolution of engineering and development processes, including configuration management and testing.

This contract is for one base year and four option years. All efforts shall be performed in accordance with Centers for Medicare & Medicaid Services (CMS) requirements and shall meet the objectives of increasing efficiency and effectiveness of operations and timely implementation of statutory and regulatory requirements.

C.2 Project Specific Tasks

The contractor’s responsibilities are described in the following sections. These areas of responsibility are considered baseline responsibilities. QualityNet is a dynamic and growing environment and CMS intends to issue Technical Direction Letters for significant changes to the baseline responsibilities.

In general, the technical scope is the technical infrastructure of the QualityNet environment. This includes, but is not limited to:

· The QualityNet network, including all network devices (e.g., routers, switches), external interfaces, email, Internet access, and videoconferencing.

· The QualityNet Wide Area Network (WAN) management and monitoring, to include all circuits and links.

· All QualityNet systems and networks in the CMS data center. The systems are primarily UNIX, NetWare, and Microsoft servers.

· All QualityNet systems and networks in the HCQIS Infrastructure contractor complex. The systems are primarily UNIX, NetWare, Cisco, and Microsoft servers.

· Remote support of the networks in the HCQIS Development Contractor.

· Remote support and coordination of systems and networks located at QIO’s and ESRD networks throughout the regional United States. The systems are primarily Microsoft servers/workstations leveraging an Active Directory model.

· Expertise, but not limited too, in Sun Solaris, BEA technologies, Active Directory, Apache web technologies

· The QualityNet Storage Area Networks (SAN) and their associated devices, primarily EMC.

C.2.1 Network

The contractor shall provide O&M and Engineering support for the QualityNet network infrastructure, to include all external interfaces and relevant vendor relationships.

C.2.1.1 Network Operations and Maintenance

The contractor shall provide support for the QualityNet network infrastructure, which includes the Local Area Network (LAN), Wide Area Network (WAN), Internet connectivity, Internet security, GroupWise email, Exchange email, VPN remote access, videoconferencing, and network management, maintenance, monitoring and training. Activities include operation, administration, documentation and maintenance of all network-related systems (e.g., firewalls, VPN, network management system) and network components (e.g., switches, routers). This would include the Wide Area Network (WAN) as this is not a managed solution through the current provider MCI.

C.2.1.2 Network Engineering

The contractor shall research, plan for, and, with CMS approval, engineer changes to the QualityNet network infrastructure using appropriate life cycle processes, following established CMS and Federal security frameworks, artifacts, and change management forums. Sample near-term network engineering tasks include:

· Enhanced network management (e.g., CiscoWorks implementation)

· Videoconferencing over IP phased implementation

· Upgrade to Microsoft Outlook\Exchange

· Active Directory

· External/Internet DNS servers

· Collaboration technologies

· Network Redesign Plan for Three Tier

· Auditing and Monitoring

· Integration and changes associated with partner networks/touch points such as the CMS Office of Information Services (OIS), ESRD Dialysis facilities and other business partners as they arise.

Additional network engineering tasks (e.g., new or evolving external interfaces) are anticipated in the base year of the contract. Significant changes shall be authorized by CMS on a task order basis.

C.2.2 Microsoft Server Environment

The contractor shall provide O&M and Engineering support for the QualityNet Microsoft servers including the Exchange Email servers.

C.2.2.1 Microsoft Server Operations and Maintenance

The contractor shall provide support for the relevant QualityNet Microsoft servers, which are currently running NT 4.0, Windows 2003 and Windows 2000 with Active Directory Services. The contractor will also provide support for the relevant QualityNet Exchange Email servers. Activities include establishing baseline configurations following NIST hardening standards and minimal services practices in the server builds, creating “GOLD” disk standards and build documentation from which each server is configured as well as, operation, administration, and routine software maintenance of all locations and QualityNet Complexes Microsoft servers.

C.2.2.2 Microsoft Server Engineering

The contractor shall research, plan for, and, with CMS approval, engineer changes to the QualityNet Microsoft server environment using appropriate life cycle processes, following established CMS and Federal security frameworks, artifacts, and change management forums. Sample near-term Microsoft server engineering tasks include:

· Coordinate with ISSO – following NIST checklist(s), i.e., how the boxes are built

· Update Disaster Recovery plan (DR) and Business Continuity plan (BCP)

· Operating system upgrade to Windows XP or VISTA

· Modifications due to FDCC changes/requirments

· Consolidation and increased robustness of Microsoft environment

· Expansion of QualityNet Exchange Email environment and new projects added to that environment

· Enabling Active Directory Services.

· Continual design and support of the QualityNet Active Directory environment

· Support and maintenance of the Exchange E-mail Servers

· Maintaining server build documentation

· Ensuring a “GOLD” standard is re-established after each new configuration baseline is approved

Additional Microsoft server engineering tasks (e.g., numerous new projects and servers) are anticipated in the base year of the contract. Significant changes shall be authorized by CMS on a task order basis.

C.2.3 UNIX Environment

The contractor shall provide O&M and Engineering support for the QualityNet UNIX platforms at the HCQIS Infrastructure Contractor complex. Items such as enterprise storage, enterprise backup, and the evolution of the QualityNet Management Information System (QMIS) are within scope of this area of responsibility. The contractor will follow appropriate life cycle processes, following established CMS and Federal security frameworks, artifacts, and change management forums. Activities include establishing baseline configurations following NIST hardening standards and minimal services practices in the server builds, creating “GOLD” disk standards and build documentation from which each server is configured as well as, operation, administration, and routine software maintenance of UNIX environments. Sample near-term UNIX server engineering tasks include:

· Coordinate with ISSO – following NIST checklist(s), i.e. how the boxes are built

· Update Disaster Recovery plan (DR) and Business Continuity plan (BCP)

· Net Backup

· Patch management: Solaris patch and upgrade

· Maintaining server build documentation

· Ensuring a “GOLD” standard is re-established after each new configuration baseline is approved.

C.2.3.1 UNIX Operations and Maintenance

The contractor shall provide support for all QualityNet UNIX servers. This currently includes standalone servers, Sun 5000 systems, Enterprise Backup Systems, and an EMC storage solution. Activities include security optimization, operation, administration, and routine software maintenance of these components.

C.2.3.2 UNIX Engineering

The contractor shall research, plan for, and, with CMS approval, engineer changes to the QualityNet UNIX server environment using appropriate life cycle processes, following established CMS and Federal security frameworks, artifacts, and change management forums. At CMS’ direction, the contractor shall have the technical lead for changes in the UNIX environment at Complex in Central Office and the HCQIS Infrastructure Complex. Sample near-term UNIX engineering tasks include:

· Hardware and software upgrades and expansion to accommodate new project requirements

· UNIX integration into an LDAP-compliant database environment

· Server consolidation efforts across complexes.

Additional UNIX engineering tasks (e.g., numerous new projects and servers) are anticipated in the base year of the contract. Significant changes shall be authorized by CMS on a task order basis.

C.2.4 Enterprise-wide Engineering Tasks

Engineering shall include the entire engineering life cycle (i.e., requirements definition, design, development, testing, and implementation) for introducing changes to the current QualityNet environment. The contractor shall have primary responsibility for engineering infrastructure changes in the CMS Baltimore and HCQIS Infrastructure Contractor Complexes. The contractor shall use and follow CMS-approved QualityNet life cycle processes, artifacts, and forums (e.g., System Security Plans, Change Control Board).

The following sample engineering tasks cross technical and functional boundaries and may be performed during the base year on a task order basis, after coordinating with other QualityNet contractors as appropriate:

· Disaster Recovery/Business Continuity plan and implementation

· Update/Maintain Enterprise-level Continuation of Operations Plans

· Responsibility for coordinating the development of Application-level COOP

· Design framework for dissemination of COOP template and instructions

· Enterprise directory services

· Enterprise Security Improvements

· Maintain security staff experienced with industry-standard security practices, following all CMS and Federal security mandates and standards

· Coordinate security-related activities with the CMS ISSO staff in order to implement security policies mandated by legislation, including intrusion detection and deficiency mitigation

· Virus scanning, URL filtering, email filtering

· Host- and network-based intrusion detection

· Email encryption

· IPsec implementation

· Tighten security on all platforms (e.g., TCP wrappers, secure shell)

· Secure Large File Transfers

· Security Monitoring and Testing

C.2.5 Security

Security tasks shall include security planning and management (i.e., Risk Assessments [RA’s], System Security Plans [SSP’s], Security Testing [a.k.a. Security Testing & Evaluation {ST&E}], Security Monitoring, Corrective Action Plans [CAPS], Project of Action and Milestones [POA&M], CMS Information Security Suite [CISS] or equivalent tool for CAPS/POA&M data entry and tracking. Security documentation; policies, standards, procedures, guidelines, etc. and any CMS required documentation in order to meet CMS and Federal security mandates) for the QualityNet infrastructure and all QualityNet major applications. This also includes all measures deemed necessary to ensure the appropriate safeguarding of the QualityNet technical infrastructure. Such measures may include network and system monitoring/tracking and reviewing audit and security logs. The goal is to provide support to the CMS ISSO’s in the overall management of the CMS QualityNet Security Program.

The contractor shall perform security planning (i.e., Risk Assessments and System Security Plans) for the QualityNet infrastructure and all QualityNet major applications in accordance with CMS and Federal standards. With CMS approval, the contractor shall perform all measures deemed necessary to ensure the appropriate safeguarding of the QualityNet technical infrastructure. Such measures may include:

· Establishing training packages for the implementation of the CMS Information Security (IS) Acceptable Risks and Safeguards (ARS) standards across the CMS QualityNet enterprise

· Network and system monitoring/tracing

· System audits

· Security and penetration testing as warranted

· Incident Response coordination

· Reviewing audit and security logs

· Developing security recommendations

· Implementing security policy, standards, procedures, guidelines and technical improvements.

· CAPS/POA&M/CISS Management

· All supporting documentation.

C.2.6 Testing

The contractor shall test and validate application code, security scripts, Section 508 compliance, installation procedures, and infrastructure changes as directed by CMS before deployment onto production systems.

The contractor shall test and validate application code in a timely manner as directed by CMS before deployment onto production systems. This testing shall include validation of all software installation instructions created before being sent to the field for installation. A QualityNet standard testing process and artifacts (e.g., test plan, cases, security scripts and results) shall be developed.

The CMS System Security Plan Development Methodology increases the requirements for formal testing of all components, including significant changes to the QualityNet infrastructure. The contractor shall ensure all such requirements are fulfilled in order that infrastructure changes are approved and proven to be ready for deployment and production use.

The contractor shall provide the following services and support the required infrastructure and backend processes as directed by CMS:

· Services supporting the validation and verification of selected QualityNet applications

· Services supporting the isolated testing of contemplated QualityNet enterprise software and technologies

· Services supporting the isolated stress testing of selected QualityNet applications to verify bandwidth and performance requirements

· Services supporting system testing in a logically isolated Pre-Production environment of selected QualityNet applications and processes to verify complete system and integration functionality

· Services supporting any processes identified in the QualityNet Software Development Life Cycle

· Specific security requirements unique to the applications that are verifiable by security scripts

· Section 508 compliance and security test for all QA/Validation testing and products/applications

· Use CMS approved standard 508 compliancy or government approved vendor to validate all products during QA/Validation prior to production

· Overall general security of the application; WatchFire AppsScan for web based applications, application vulnerability assessments, following industry “best practices” to avoid known security attack scenarios (See NIST: http://nvd.nist.gov/home.cfm ).

The contractor shall produce a Results ReportsError! Bookmark not defined.xe "Results Reports xe "Results Reports" from stress testing that offers details of information which came out of the testing procedure, including but not limited to the following: a record of what testing was done, an assessment of how well the testing was performed, an assessment of the quality of the system and any incidents that occurred. This documentation is used to determine if the system being tested is viable enough to proceed to the next stage of development.

CMS will provide the HP Mercury Tool Suite for most testing purposes.

C.2.7 Configuration Management

The Contractor shall help CMS identify the QualityNet hardware, software, and documentation baselines to put under Configuration Management (CM) control and to support the ongoing implementation of the QualityNet standard PVCS Dimensions and Remedy CM tool.

CMSO/OCSQ has purchased PVCS Dimensions, an enterprise level configuration management (CM) tool and installed it on a Solaris node on the QualityNet. Several Government-off-the-shelf (GOTS) systems run on the QualityNet and it is CMS’ intention to bring these systems under formal configuration management.

QualityNet is also in the process of moving its infrastructure CM and Asset management processes from PVCS Dimensions into a unified Remedy CM tool.

At CMS’ direction, the contractor shall support the installation, maintenance, and use of change management practices and processes. The contractor shall have primary responsibility for the implementation and use of the QualityNet standard CM tools, PVCS Dimensions and Remedy. Sample activities during the base year include:

· Ongoing implementation, customization, and use of PVCS Dimensions and Remedy for QualityNet projects and the QualityNet infrastructure components

· Administration of PVCS Dimensions and Remedy

· Implementation of enhancements and upgrades to PVCS Dimensions and Remedy

· Continuing development and refinement of change management practices, processes, and forums (e.g., Change Control Board).

· Inventory and Asset tracking within PVCS Dimensions and Remedy

C.2.8 Project Management

The contractor shall provide ongoing management of all contractor activities, to include:

· Guidance to and management of the contractor team

· Enhancement of project processes

· Review of significant deliverables and artifacts

· Maintenance of project and task schedules as directed by CMS

· Submittal of monthly status reports

· Project financial and contract management.

· Coordination and alignment activities with participating system owners.

Weekly master project plans of all contractor tasks and activities shall be provided to CMS in conjunction with an integrated Master Project Plan.

C.2.9 SAN Administration

The contractor shall provide the following services and support that require SAN administration and management in all complexes as directed by CMS ( Currently 7 EMC SAN units):

· Services supporting the administration of Storage Area Network to include:

· Device allocation

· Microcode updates

· Space management

· Auditing and Monitoring

· Storage reporting

· Performance monitoring

· Services supporting volume and metadata management

· UNIX system and database integration services

· Backup and restore services

· Research, documentation and development

· SAN security

· OS and patch management for any management servers supporting the SAN environment

· Patch management: The patches should be compatible (same patch level) with EMC certified software and Solaris (Unix)

· Update Disaster Recovery plan (DR) and Business Continuity plan (BCP)

· Upgrade and migration support services

C.2.10 VTC Administration

Videoconferencing capability exists at all Complexes, every QIO, ESRD and 10 Regional Offices along with several contractor offices. The contractor shall provide the following services and support that require VTC administration and management as directed by CMS:

· Scheduling and administration of VTC meetings for complex sites

· Maintenance and support of VTC equipment (IP and ISDN) for all sites

· Research and development of future VTC technology

C.2.10.1 Complex Videoconferencing Support

The Contractor shall (1) support the Complexes videoconferencing system, including, but not limited to:

· system administration of the videoconferencing equipment;

· Scheduling and administration of VTC meetings for complex sites

· advising users on video/audio technology;

· facilitating video conferences as required;

· operating video, audio and teleconferencing equipment

· Coordinating with the Government on problems and issues on videoconferencing.

· Maintenance and support of VTC equipment (IP and ISDN) for all sites

· Research and development of future VTC technology

C.2.10.2 Regional Office Videoconferencing Support

The Contractor shall (1) support videoconferencing systems at the Regional, QIO, ESRD and Contractors Offices, including, but not limited to:

· system administration of the videoconferencing equipment; and

· Coordinating with the Government on problems and issues on videoconferencing.

· Maintenance and support of VTC equipment (IP and ISDN) for all sites

C.2.11 Data Center

The contractor shall provide a physical Data center and host the HCQIS complex that contains production, development, testing, and validation environments.

Enterprise IT activities encompasses critical systems infrastructure that supports ongoing operations for QualityNet The QualityNet Infrastructure contract provides the day-to-day operations and maintenance of QualityNet’s enterprise-wide infrastructure which includes managing the network, servers, storage area network, voice and data communications, as well as backing up the mission critical applications and managing QualityNet’s hardware and software. Additional activities included under this section include:

· the BNS MPLS, the secure telecommunications network that supports transaction processing and file transmission;

· the Global Crossing Internet Circuit, the QualityNet Internet circuit

· hardware maintenance and software licensing;

· manage data center and any future data centers

· management, update, maintenance & troubleshooting of all infrastructure systems

· work with 3rd party vendors, outsourcing vendors to restore services/operations in a timely & secured manner when there is a system outage or degradation in system performance and/or functionalities due to an incident(s) and/or problem arising from the system

· mange 24x7 operations, including physical security of the Data Center and/or Server rooms in Complex 3 or as identified by CMS

· ensure smooth running of all IT production systems operations on a day-to-day basis & when operational incident/problems arise

· manage and plan floor space capacity and data center environment systems

· meet FISMA requirements

· manage the required power and UPS capacity to support the QualityNet environment within Complex 3

· ensure generators and backup power can maintain the Complex 3 Data Center during power outages indefinitely outside of destruction of building

· For Future Reference: (ensure that the redundant WAN circuits are…