S02 - ATTACHMENT 1 - PWS -DQ - v3.0 6.12.25.docx

DQ Technical Analysis and Functional Support

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Veteran’s Health Administration (VHA) Digital Health Office, Office of Health Informatics (OHI) Health Information Governance Data Quality Program

DQ Technical Analysis and Functional Support

Date: 6/12/2025

DHO ID# FY25-HIG-535

PWS Version Number: 3.0

CONTENTS

BACKGROUND

The mission of the Department of Veterans Affairs (VA), Digital Health Office (DHO), Office of Health Informatics (OHI), Health Information Governance (HIG) is to provide benefits and services to Veterans of the United States. As part of the HIG Program and in support of these goals, the OHI HIG Data Quality Program (DQP) is responsible for providing a framework to monitor and improve the quality of the healthcare and supporting data within Veterans Health Administration (VHA). These efforts encompass activities related to identity management for healthcare, business product management, data management, data governance, data stewardship, data analytics, and clinical data quality initiatives, as well as other areas related to data quality.

The Data Quality Program (DQP) consists of three distinct sub-programs – Health Care Identity Management (HC IdM), Clinical Data Quality (CDQ), and Analytics, Visualization and Support (AVS). Part of the responsibilities of the DQP is to ensure that business stakeholders’ data quality requirements, use cases, and business rules are identified and subsequently developed. As data quality requirements and business rules are developed and published, the DQP is responsible for ensuring that all internal and external stakeholders understand and adhere to the data quality requirements and business rules that are applicable to clinical, administrative, and identity management data quality. To ensure adherence to Data Quality Standards, the DQP evaluates, reviews, and tests products throughout the software development lifecycle.

DQP’s internal and external stakeholders (also known as mission partners) include:

A. Health Care Identity Management (HC IdM), Clinical Data Quality, Analytics, Visualization and Support (AVS) and other Data Quality Program staff;

B. Identity and Access Management Services (technical) staff (IAM);

C. Health Information Governance (HIG) Program Offices, including Health Information Management (HIM) and others;

D. Clinical Informatics and Chief Medical Info Program Offices, including Informatics Patient Safety and others;

E. Oracle Health Business and Technical Staff;

F. Chief Business Office, Community Care and Health Eligibility Center staff;

G. Federal HealthCare Center (FHCC) project staff;

H. Veteran Health Information Exchange (VHIE) project teams;

I. Office of Enterprise Integration (OEI) staff;

J. VA Office of Information Technology staff (VA OIT) K. Department of Defense (DoD) business and technical staff;

L. Veteran’s Lifetime Electronic Record (VLER) technical teams;

M. Veteran Relationship Management (VRM) and Veterans Experience Office (VEO) teams;

N. Social Security Administration (SSA) representatives;

O. Veteran Health Information Systems and Technology Architecture (VistA) business and technical teams;

P. Customer Data Integration (CDI) teams;

Q. VA and VHA committees, teams and councils;

R. Business and technical project teams representing new initiatives and applications.

S. Office of Performance Measurement T. Office of Quality and Patient Safety

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following applicable documents below. Contractor shall use the most current versions:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements For Cryptographic Modules”

4. FIPS Pub 199. Standards for Security Categorization of Federal Information and Information Systems, February 2004

5. FIPS Pub 200, Minimum Security Requirements for Federal Information and Information Systems, March 2006

6. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. Carnegie Mellon Software Engineering Institute, Capability Maturity Model® Version 3, April 2023

9. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

10. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

11. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

12. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, http://www.va.gov/vapubs/

13. VA Handbook 0710, “Personnel Security and Suitability Security Program,” May 2, 2016, http://www.va.gov/vapubs

14. VA Directive and Handbook 6102, “Internet and Intranet Services,” August 5, 2019, http://www.va.gov/vapubs

15. 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility Standards,” March 2018

16. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

17. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

18. Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide, February 2024

19. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

20. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

21. VA Directive 6500, “VA Cybersecurity Program”, February 24, 2021

22. VA Handbook 6500, “Risk Management Framework for VA Information Systems \ VA Information Security Program,” February 24, 2021

23. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI)”, June 30, 2023

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning”, March 25, 2025

26. OI&T Process Asset Library (PAL), https://www.va.gov/process/ ., including Reference Process Maps and Artifact templates

27. VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

28. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014 Privacy Impact Assessment Training Resources, https://dvagov.sharepoint.com/sites/OITPrivacyHub/SitePages/PIA-Training-Resources.aspx

29. VA Handbook 6510, “VA Identity and Access Management”, September 27, 2024

30. VA Directive 6300.4 Procedures for Processing Requests for Records Subject to the Privacy Act, August 19, 2023

31. VA Handbook, 6300.1, Records Management Procedures, March 24, 2010

32. NIST SP 800-37 Rev 1, Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach, June 2014

33. NIST SP 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems and Organizations, December 10, 2020

34. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6).

35. VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, October 26, 2015

36. VA Handbook 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, March 24, 2014

37. OMB Memorandum M-19-17, Enabling Mission Delivery through Improved Identity, Credential, and Access Management, May 21, 2019

38. OMB Memorandum 05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, August 5, 2005

39. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011

40. OMB Memorandum M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, January 3, 2017.

41. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, Digital Identity Guidelines, June 2017

42. NIST SP 800-157, Guidelines for Derived PIV Credentials, December 2014

43. NIST SP 800-164, Guidelines on Hardware-Rooted Security in Mobile Devices (Draft), October 2012

44. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981 Mobile, PIV, and Authentication, March 2014

45. VA Memorandum, VAIQ #7100147, Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12), April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

46. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

47. VA Memorandum “Mandate to meet PIV Requirements for New and Existing Systems” (VAIQ# 7712300), June 30, 2015,

48. Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.2, Federal Interagency Technical Reference Architectures, Department of Homeland Security, June 19, 2017, https://www.cisa.gov/sites/default/files/publications/TIC_Ref_Arch_v2.2_2017.pdf

49. OMB Memorandum M-08-05, “Implementation of Trusted Internet Connections (TIC), November 20, 2007

50. VA Memorandum, VAIQ #7497987, Compliance – Electronic Product Environmental Assessment Tool (EPEAT) – IT Electronic Equipment, August 11, 2014 (reference Document Libraries, EPEAT/Green Purchasing Section, https://www.voa.va.gov/documentlistpublic.aspx?NodeID=552)

51. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

52. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

53. Executive Order 13834, “Efficient Federal Operations”, dated May 17, 2018

54. Executive Order 13221, “Energy-Efficient Standby Power Devices,” July 31, 2001

55. VA Directive 0057, VA Environmental Management Program, dated October 25, 2022

56. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access”, January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

57. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

58. VA Memorandum, “Implementation of Federal Personal Identity Verification (PIV) Credentials for Federal and Contractor Access to VA IT Systems”, (VAIQ# 7614373) July 9, 2015,

59. VA Memorandum “Mandatory Use of PIV Multifactor Authentication to VA Information System” (VAIQ# 7613595), June 30, 2015,

60. VA Memorandum “Mandatory Use of PIV Multifactor Authentication for Users with Elevated Privileges” (VAIQ# 7613597), June 30, 2015;

61. “Veteran Focused Integration Process (VIP) Guide 3.2”, December 2018, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

62. “VIP Release Process Guide”, Version 1.4, May 2016, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4411

63. “POLARIS User Guide”, Version 1.9, March 2017, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4412

64. VA Memorandum “Proper Use of Email and Other Messaging Services” dated January 2, 2018, https://www.research.va.gov/programs/epros/education/webinars/acos-ao-education/Proper-Use-of-Email-Memo.pdf

65. VA Directive 6066, “Protected Health Information (PHI) And Business Associate Agreements Management”, September 2, 2014

66. VHA Directive 1906, “Data Quality Requirements for Health Care Identity Management and Master Person Index Functions”, dated April 10, 2020

67. DAMA International, DAMA Guide to the Data Management Body of Knowledge, or DAMA DMBOK®2 Revised Edition, July 1, 2017

68. ASTM E1714 -00 (2017) Standard Guide for Properties of a Universal Healthcare Identifier (UHID)

SCOPE OF WORK

The Contractor shall provide support services to the Data Quality Program that includes reviewing business and technical project documents for proper incorporation of defined requirements to implement clinical data quality and person identity management; developing, reviewing, and refining enterprise requirements, use cases, and business rules used to implement and support data quality; planning and executing plans for testing of software products and performance measure metrics; providing business and technical expertise in the areas of clinical data quality and person identity management; and performing data quality analysis and reporting in support of implementations, updates to technologies, research, and other organizational requirements.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The Period of Performance (PoP) shall be 11 months from date of award with four (4), twelve (12) month option periods.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their quote/proposal submission.

TRAVEL (Base and Optional travel) The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the POP. Travel costs will be included in the contract award as a separate, cost-reimbursable, “not to exceed” line item.

The contractor must obtain written approval from the Veterans Affairs (VA) Program Manager via the Contracting Officer Representative BEFORE any travel begins, utilizing the Travel Authorization Request form. Travel and per diem expenses will be reimbursed on an actual expenditure basis in accordance with Federal Travel Regulations (FTR) and FAR 31.205-46. Travel that occurs without written pre-approval will NOT be reimbursed.

In order to be reimbursed for travel, the contractor shall submit supporting documentation as required by Federal Travel Regulations with invoices. Federal Travel Regulations require for any temporary travel destination you must provide a receipt to substantiate your claimed travel expenses for lodging and a receipt for any authorized expenses costing over $75 (FTR 301-11.25). Expenses for subsistence and lodging will be reimbursed to the contractor only to the extent where an overnight stay is necessary and authorized by Federal Travel Regulations in effect at the time of the stay for the specific location. Contractor travel within the local commuting area will not be reimbursed. Total estimated number of trips in support of this effort is provided below:

Estimated Destinations (See Below) Approximate Number of trips per period of performance

(NTE)

Base Period:

Option Period 1

Option Period 2

Option Period 3

Option Period 4

Anticipated destinations include: Tampa (Franklin Templeton)/Bay Pines, Florida; Washington, D.C. (VACO), Salt Lake City, Utah; Madison, Wisconsin; Birmingham, Alabama; and St. Louis, Missouri.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

PROJECT MANAGEMENT

REPORTING REQUIREMENTS

The Contractor shall provide the Contracting Officer’s Representative (COR), VA Program Manager (PM), Contracting Officer (CO), and Contract Specialist (CS) (as applicable) with Monthly Progress Reports in electronic form in Microsoft Word, Project, or other similar formats. The report shall include detailed explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding Month.

The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Deliverable:

A. Monthly Progress Report

DATA QUALITY IDENTITY MANAGEMENT TECHNOLOGY CONFIGURATION, IMPLEMENTATION, AND ANALYSIS The VA has utilized the VA Master Person Index (VA MPI) as its enterprise Identity Management solution since 1998. With the evolution of the VA MPI, the matching algorithm used within the VA MPI for matching and duplicate detection was “modernized” to a commercial industry-standard probabilistic matching algorithm, which is maintained and configured by the Government, in conjunction with the algorithm vendor technical staff.

In support of this contract, the contractor shall perform analysis and reporting on identity and person matching data on Government-owned systems (e.g. VA Master Person Index (VA MPI) and other reporting databases, such as the Corporate Data Warehouse (CDW), Electronic Health Record (EHR) systems), to provide guidance and recommendations related to: configuration and implementation of the probabilistic matching algorithm, workflows, process mapping, architectural diagrams, and other technologies in support of Data Quality goals. No VHA data will be downloaded to vendor-owned systems. The contractor shall coordinate with internal and external business and technical staff to obtain access to existing data for analysis from the Government-owned systems. Analysis and reporting will be conducted for the purposes of providing information needed to configure and implement matching algorithm and other data quality and VA-supported software, EHR implementation, and for identity management issues identification and resolution functionality. The contractor shall perform and provide analysis, reporting and recommendations only; no changes to or development of software will be performed by contract staff. The analysis and reporting will be performed using standard analysis tools (e.g. Structured Query Language (SQL), Power BI, and Tools for Oracle Application Development (TOAD)). The contractor shall work with representatives and technical staff from the current probabilistic algorithm vendor and others (e.g. VA MPI Development staff) to coordinate access to data and tools, and to obtain configuration and implementation details in conjunction with Government staff. The contractor shall provide feedback, requirements, and requested information about the matching algorithm and other identity management technologies and software configuration and implementation, including all ancillary software modules, such as the “VA MPI Identity Management Toolkit”, “algorithm configuration workbench”, and supporting applications related to the implementation of the Electronic Health Record (EHR) as it relates to identity traits and management (e.g. Oracle Health connected systems). This information may include recommendations on adjustments to algorithm parameters to optimize matching, duplicate detection and error identification and resolution functionality, as well as changes to process, workflow, and other technologies. Information provided by contract staff will be used by others to make modifications, but no changes or development will be performed by contract staff. Analysis and reporting will support the delivery of requirements, research, data quality initiatives, metric definition, and other needs. The contractor shall provide coordination and communication between identity management vendors and Government staff, providing updates as to the progress of application and configuration updates and obtaining input and decisions related to configuration. In this role, the contractor will act as the facilitator but will not be performing those tasks themselves. The Government anticipates that one (1) new version of software will be configured and implemented by the probabilistic algorithm vendor for each contract period and the analysis of identity data in support of such upgrades would occur approximately twice per period of performance depending on the complexity of the upgrade. Other implementations, including initiatives such as the Joint Health Information Exchange (JHIE) and EHR Modernization, will require additional analysis and reporting approximately four (4) times within each period of performance, dependent on Department priorities and current implementations.

This work is performed in coordination with the VA Office of Information Technology (VA OIT) and as such is subject to all relevant OIT project plans and schedules.

Deliverables:

A. Provide guidance and recommendations on configuration parameters, threshold settings, and implementation details, including functionality to be included, and requirements for implementation. Projects may include periodic updates to the probabilistic matching algorithm utilized within the VA MPI and Health Care Identity Management (HC IdM) framework for Data Quality, and participation in requirements and implementation work in support of VHA’s EHR Modernization. Guidance and recommendation documentation shall be compiled and delivered to the Program Director or assigned Government contact. This deliverable will be in the form of written recommendations to Government staff and will be done in accordance with the OIT project schedules defined for the algorithm software implementation or other project timelines. Anticipated to include one (1) extensive effort of expert analysis and accompanying guidance and recommendations in relation to new requirements, New Service Requests, application specifications, or other artifacts.

B. Provide expertise and guidance on parameters and configuration details required for the on-going “fine-tuning” of probabilistic matching algorithm technologies, based on analysis and recommendations for enhanced performance of the matching and duplicate/error detection, including changes to matching thresholds and consideration of incorporation of additional data fields. This deliverable shall be in the form of written recommendations of changes to probabilistic algorithm parameters and/or configuration and will include analysis used to substantiate recommendations. The deliverable will be submitted in accordance with OIT project schedules for upgrades and initiatives that will result in changes to the matching algorithm. Anticipated to include two (2) extensive set of expert analysis and accompanying guidance in relation to new requirements, New Service Requests, or other artifacts.

C. Provide analysis and reporting of Identity Management data, in order to provide guidance and information necessary for configuration, implementation, error detection, enhancement and other decisions, related to the probabilistic matching algorithm and/or management of identity data. This analysis will be performed using standard tools, such as SQL and TOAD on Government-owned systems, using data from the VA MPI, CDW, Oracle Health Data Intelligence, and other reporting databases and systems. The results will be used to inform guidance, recommendations and expertise as noted in Deliverables A and B. Anticipated to be performed seven (7) times per period of performance, in preparation for annual matching algorithm software upgrade. In the event an annual upgrade is not planned by OIT, other analysis related to algorithm performance and optimization, resulting in expert guidance and recommendations for changes/enhancements/ updates to the algorithm will be completed.

BUSINESS AND TECHNICAL DOCUMENT DEVELOPMENT AND REVIEW

The contractor shall compose new documents and/or review and provide expert input into business and technical documents such as Business Requirement Documents (BRDs), Executive Decision Memos (EDMs), New Service Requests (NSRs), project charters, and guidance documents requested or submitted by internal and external DQ mission partners for software development projects and other initiatives, as requested by HIG DQ leadership. Documents will be reviewed for completeness, accuracy, and compliance with the VHA Enterprise Data Quality Requirements, Enterprise Data Catalog (EDC) guidelines, and all other relevant criteria, which will be made available to the contractor after contract award, but may include: 38 USC 1703C: Standards for quality, VHA Directive 1906 (Data Quality Requirements for Health Care Identity Management and Master Person Index Functions), 44 USC 3102, 38 USC 7301 (b) and other relevant DQ policies, business requirements documents and directives. The contractor shall:

A. Identify data quality issues within the content of the documents and assign a level of complexity for resolution of the issues, in accordance with VHA Enterprise Data Quality Requirements, Enterprise Data Catalog (EDC) guidelines, and all other relevant criteria related to identity management and data quality principles, with the intent of providing recommendations to HIG DQ Leadership;

B. Indicate the level of HIG Data Quality Program involvement necessary for the project based on criteria iterated above, such as whether or not identity management services will be used by the project and to what extent, if further analysis is needed to address gaps or requests within the documents, and if research into solutions or recommendations related to the subject matter of the document are required;

C. Verify that the technical documents contain required references to Clinical and Administrative Data Quality (DQ) Requirements and adhere to standards and requirements set forth by VA bodies, such as the VA Data Governance Council, for example as they relate to Authoritative Data Sources. References: 38 USC 1703C Standards for Quality, VHA Directive 1906 (Data Quality Requirements for Health Care Identity Management and Master Person Index Functions), 44 USC 3102, 38 USC 7301(b) and other relevant DQ policies, business requirements documents (BRDs), and directives;

D. Verify that all applicable DQ Requirements are included in the business documents such as BRDs, EDMs, NSRs, project charters, white papers, business flow diagrams, and guidance documents and that they adhere to standards and requirements set forth by VA bodies, such as the VA Data Governance Council, for example as they relate to Authoritative Data Sources;

E. Provide recommendations for revisions and corrections to business and technical documents such as BRDs, EDMs, NSRs, project charters, white papers, and guidance documents, to bring them in compliance with VA-defined requirements and DQ industry standards and best practices;

The contractor shall prepare a summary of findings that includes: the identified Data Quality Issues; assigned level of complexity; comment or anomaly logs and/or marked-up documents with identified deficiencies in meeting DQ requirements as set forth in the VA Enterprise Requirements Repository, Enterprise Data Catalog (EDC), within data quality requirements specifications (i.e. Identity and Access Management Business Requirements documents, draft VA Data Governance Council Data Stewardship Handbook, VA Handbook 0900.2, and any associated EDC specific documentation which outlines the responsibilities for the VA Under Secretaries and Assistant Secretaries to support the development and maintenance of VA Enterprise Information Models and the Enterprise Data Catalog (EDC)), use cases and business process flows, and final complexity evaluation of the project and level of DQ involvement required, or the development of any such documents. This summary shall be delivered to the Government via e-mail. Business document development, review and comments, as outlined above are estimated by the Government to be approximately at 20 per period of performance, based on the number of activities initiated and existing within the software development lifecycle.

In addition to BRDs, EDMs, and NSRs, the contractor shall participate in development and reviews of technical integration documentation associated with Enterprise Identity Management and other data quality requirements compliance. These documents include Integration Requirements Specification Documents (iRSD) and Integration System Design Documents (iSDD), as well as data flows, architectural diagrams and similar. Included in this effort are:

A. Attendance at meetings (generally via teleconference) in which the content for these documents is developed and discussed;

B. Review of all iRSDs, iSDDs, and other documents for compliance with Enterprise Identity Management and other Data Quality requirements;

C. Provision of written comments on the reviewed documents or the development of similar documents;

D. Participation in formal review meetings with business and technical stakeholders and management to resolve document comments, i.e. anomaly log reviews; meetings generally take place via teleconference.

Technical requirements document development, review, and comment as outlined above are estimated by the Government at approximately 29 per period of performance, based on the number of activities initiated and existing within the lifecycle.

Deliverables

A. BUSINESS DOCUMENT DEVELOPMENT AND REVIEW: Summary of findings for each document reviewed are due three (3) workdays after review is complete. For requests for the development of new business documents, the actual document will fulfill the deliverable. The need for this activity will be initiated from several different groups within VA and will be assigned as needed. The contractor shall have between 24 hours and 2 weeks to develop or review, based on deadlines provided by requesting groups within VA. The documents will range in length from approximately 2 to 50 pages. In addition to the summary of findings for reviewed documents, the written comments (i.e. identification of anomalies, edits for completeness and accuracy) will be provided to the requesting VA groups within deadlines defined. It is anticipated there will be 20 business documents either developed or reviewed per period of performance.

B. TECHNICAL DOCUMENT DEVELOPMENT AND REVIEW: Summary of findings for each document reviewed is due three (3) workdays after review is complete. For requests for the development of new technical documents, the actual document will fulfill the deliverable. The need for this activity will be initiated from several different groups within VA and will be assigned by DQ Management as needed. The contractor shall have between 24 hours and 2 weeks to develop or review, based on deadlines provided by requesting groups within VA. The documents will range in length from approximately 2 to 50 pages. In addition to the summary of findings for reviewed technical documents, the written comments (i.e. identification of anomalies, edits for completeness and accuracy) will be provided to the requesting VA groups within deadlines, defined and in the format requested (standard documents and spreadsheets). It is anticipated there will be 29 technical documents either developed or reviewed per period of performance.

SUPPORT OF DATA QUALITY, DATA GOVERNANCE AND DATA STEWARDSHIP

The Data Quality Program is responsible for supporting data quality, data governance and data stewardship activities in identity and clinical data areas within VA and VHA.

A. To support the improvement of data quality within the organization, the contractor shall participate in quality improvement activities including:

· Responding to identified data quality issues from internal and external customers, including the investigation, analysis, and submission of recommendations in response to data quality issue tickets, including those shared from the Performance Measurement Help Desk;

· Developing and submitting trouble tickets, change requests, and new service requests to OIT development staff for any identified defects or unresolved issues;

· Working with sites to identify and improve data quality metrics and measures;

· Supporting the creation of data quality metrics and Key Performance Indicators (KPIs) for internal and external stakeholders, to enhance the quality of organizational data;

· Performing analytical work in support of Program Offices, such as Lab Kidney Office, Health Information Management (HIM), and others within VA and VHA to examine and improve data quality and patient care reporting and outcomes. Analytics is the systematic computational analysis of data or statistics and includes applying data patters towards effective decision-making;

· Developing and supporting dashboards and metrics for monitoring of clinical data quality (i.e. NULL LOINC, LOINCS not in value set, Clinical Documentation Integrity (CDI), and review of Oracle Health unknown queues);

· Assisting sites in meeting accreditation requirements and goals, by assisting with the identification and resolution of anomalies related to reporting requirements, including missing or incorrect coding, poor data collection or other issues;

· Reviewing and modifying where necessary, data quality tools and monitors used to track and improve patient clinical and identity data quality;

· Performing data quality analytics and clinical record reviews related to electronic quality measures (eQM), algorithm development and metrics, including verifying standard codes used.

B. In support of data governance and data stewardship within VHA and VA, the contractor may be asked to participate in VA and VHA-level data governance and data stewardship activities, including attendance and support for meetings of councils, sub-councils, and inter-departmental data governance and data stewardship groups (i.e. VA/ Department of Defense Data Harmonization, Veterans Experience Office (VEO) Data Quality Council, Federal Electronic Health Record Modernization (FEHRM) Data Quality Committee, VHA Data Stewardship Sub Council) as a consultant and/or subject matter expert. The contractor may also be tasked with action items and follow up assignments from data governance and data stewardship working groups, including the development of documents and artifacts, such as clinical or identity data flows and input into the determination of authoritative data sources.

Deliverables A. The contractor shall provide a comprehensive list of resolved data quality issues or tickets from internal and external stakeholders that have been investigated, analyzed, and resolved. The list shall also include identified defects and unresolved issues.

B. Monthly status report (11 per Period of Performance) of any new or updated dashboards or other tools used to improve or monitor clinical or other quality measures.

C. Monthly status report (11 per Period of Performance) of conference calls and/or meetings attended with data quality, data stewardship, and data governance entities, in support of the incorporation of data quality, data governance, and data stewardship in VA processes and functions and resulting action items and follow up.

REQUIREMENTS AND BUSINESS RULES DEVELOPMENT, MODIFICATION, AND VALIDATION

The contractor shall develop new and modify existing business rules and requirements supporting Data Quality, Clinical Data Quality, Data Stewardship, and Healthcare Identity Management (HCIdM) to address program objectives, issues, errors, and service requests that are submitted by the Data Quality Program’s internal and external customers including technical development staff. These requirements and business rules could be in support of EHRM implementation, electronic quality measures (eQM), new service requests (NSR) support or other initiatives. As new business rules and requirements are developed, the contractor shall review and update existing DQ enterprise and internal requirements and business rules that are documented in internal document shares and/or on the enterprise requirements repository. The contractor shall post new and modified requirements and/or business rules to the DQ SharePoint site as well as update DQ documents that have references to the DQ SharePoint site. Within three (3) days of completing the updates, the contractor shall notify the VA PM via email and provide a brief description of what updates were completed. In support of new and existing software requirements and business rules the Contractor may participate in User Acceptance Testing (UAT), including creation and execution of test plans and cases, clinical record reviews, algorithm functionality testing, and other tasks, including the reporting of UAT results and submitting recommendations for remediation.

Deliverables:

A. Provide new and/or updated business rules and requirements in appropriate format (MS Word or current requirements documentation software). New and existing business rules and/or requirements updates are estimated by the Government to be approximately 23 per period of performance, depending on new external and internal project initiatives.

B. Submission of test plans and overview of testing completed including high level test cases, testing results, and record of any recommendations for remediation that were submitted in support of User Acceptance Testing (UAT) on software development at approximately 23 per period of performance.

DATA QUALITY ANALYTICS

The contractor shall provide Data Quality Analytics services such as data profiling, trending, statistical analysis, graphing, and data reporting in response to requests submitted by DQ internal and external mission partners (i.e. sub-Programs within the Data Quality Program and external stakeholders), however, will be mitigated and assigned by DQ staff. This analysis is used to determine and support decision-making, policy development, issue resolution, and other tasks related to Data Quality, including Identity Management, Clinical Data Quality, and Data Management. Analysis will be performed on Government-owned systems, including (but not limited to) the VA MPI, CDW, Oracle Health datastores, Palantir, and VA Profile using industry standard tools, such as SQL and TOAD, as well as Oracle Population Health Analytics and VA Identity Management Toolkit. The contractor shall provide the Government with results for both informal and formal DQ Analytics services, which are described in detail below.

A. Informal Data Quality Analytics (informational or “ad hoc”): The contractor shall provide informal DQ Analytics in response to requests submitted by the DQ Program’s internal and external mission partners. The DQ Analytics services performed in response to requests are considered informal due to the fact that the process for performing the DQ Analytics services and presenting results is not pre-defined. The contractor shall review the requests and use subject matter expertise to identify what type of DQ Analytics services shall be completed (data profiling, trending, statistical analysis, graphing, etc.) and how findings shall be presented, along with the customer. Data for analysis work shall be obtained from Government-owned systems and could take the form of SQL queries, delimited files exported to spreadsheets or other forms. Analysis performed will display knowledge of the data meaning and use and will fulfill the request for analysis. Examples may include analysis of the data quality of specific identity traits and suitability for use in Identity Management on a patient wristband, review of NULL LOINCS or LOINCs not in a value set within the EHR, and/or CDI efforts. Analysis results may take the form of a white paper, presentation, data report, graph, tables, or narrative within an email message.

B. Formal Data Quality Analytics: The contractor shall provide formal Data Quality Analytics for business process re-engineering or quality improvement activities. Examples of tools that may be used for analysis include Healthcare Failure Mode and Effect Analysis (HFMEA) and Root Cause Analysis (RCA). The DQ Analytics services performed in response to such requests are considered formal due to the fact that the data quality tools and concepts used for performing the DQ Analytics services and presenting subsequent results are established (i.e. HFMEA and RCA). Therefore, the contractor shall use the established industry-standard-processes for workflow, efficiency, error reduction and/or other quality improvement efforts. The analysis will be related to clinical data quality, data management or identity management topics, which will require extensive expertise in these subject areas. The requests for formal data quality analytics may be the result of participation in Performance Improvement efforts, Office of Inspector General (OIG) reporting, identified patient safety issues or other critical data quality incidents. Requests may also be initiated based on internally identified data quality improvement opportunities.

C. Creation of Data Quality Metrics and Monitoring: The contractor shall provide mechanisms to identify, create, and maintain metrics and Key Performance Indicators (KPIs) to reflect the quality of essential data used in identity management, clinical decisions, performance measurement, and other priority functions. Examples include dashboards use to monitor Oracle Health Message Center traffic, Oracle Health unknown queues, and identity traits not within defined ranges.

Deliverables:

A. Deliverables for informal analysis will take the form of a white paper, presentation, data report, dashboard, graph, table, or narrative within an email message. Deliverables are due by the pre-determined timeframe that is agreeable to the Government and will vary from 1 to 30 days. Requests for informal analysis are estimated by the Government to be approximately 45-50 per period of performance.

B. Reports and findings from DQ Analytics services performed in response to business process improvement or re-engineering requests will take the form of formal written reports, including tables, flow diagrams, dashboards, graphs, and presentations. Deliverables are due by the pre-determined timeframe that is agreeable to the Government and will vary from 1 to 3 months. It is estimated by the Government that approximately 20 formal analysis efforts/year will be performed.

C. Deliverables for creation of data quality metrics and monitoring would be: creation of new metrics, and monitoring of DQ metrics, determined based on frequency of data refreshes and could be monthly, quarterly, or annually, and recurring monitoring that would identify issues or anomalies that need to be addressed and plans for remediation or improvement totaling approximately 15-20 for the period of performance.

OPTIONAL - DATA QUALITY ANALYTICS

The contractor shall provide Data Quality Analytics services such as data profiling, trending, statistical analysis, graphing, and data reporting in response to requests submitted by DQ internal and external customers (i.e. sub-Programs within the Data Quality Program and external stakeholders), however, will be mitigated and assigned by DQ staff. This analysis is used to determine and support decision-making, policy development, issue resolution, and other tasks related to Data Quality, including Identity Management, Clinical Data Quality, and Data Management. Analysis will be performed on Government-owned systems, including (but not limited to) the VA MPI, CDW, Oracle Health datastores, Palantir, VA Profile, and other databases, using industry standard tools, such as SQL and TOAD, as well as Oracle Population Health Analytics and VA Identity Management Toolkit. The contractor shall provide the Government with results for both informal and formal DQ Analytics services, which are described in detail below.

A. Informal Data Quality Analytics (informational or “ad hoc”): The contractor shall provide informal DQ Analytics in response to requests submitted by the DQ Program’s internal and external mission partners. The DQ Analytics services performed in response to requests are considered informal due to the fact that the process for performing the DQ Analytics services and presenting results is not pre-defined. The contractor shall review the requests and use subject matter expertise to identify what type of DQ Analytics services shall be completed (data profiling, trending, statistical analysis, graphing, etc.) and how findings shall be presented, along with the mission partner. Data for analysis work shall be obtained from Government-owned systems and could take the form of SQL queries, delimited files exported to spreadsheets or other forms. Analysis performed will display knowledge of the data meaning and use and will fulfill the request for analysis. Examples may include analysis of the data quality of specific identity traits and suitability for use in Identity Management on a patient wristband, review of NULL LOINCS or LOINCs not in a value set within the EHR, CDI efforts. Analysis results may take the form of a white paper, presentation, data report, graph, tables, or narrative within an email message.

B. Formal Data Quality Analytics: The contractor shall provide formal Data Quality Analytics for business process re-engineering or quality improvement activities. Examples of tools that may be used for analysis include Healthcare Failure Mode and Effect Analysis (HFMEA) and Root Cause Analysis (RCA). The DQ Analytics services performed in response to such requests are considered formal due to the fact that the data quality process tools and concepts used for performing the DQ Analytics services and presenting subsequent results are is established (i.e. HFMEA and RCA). Therefore, the contractor shall use the established industry-standard-processes for business process re-engineering workflow, efficiency, error reduction and/ or other quality improvement efforts. The analysis will be related to clinical data quality, data management or identity management topics, which will require extensive expertise in these subject areas. The requests for formal data quality analytics may be the result of participation in Performance Improvement efforts, Office of Inspector General (OIG) reporting, identified patient safety issues or other critical data quality incidents. Requests may also be initiated based on internally identified data quality improvement opportunities.

C. Creation of Data Quality Metrics and Monitoring: The contractor shall provide mechanisms to identify, create, and maintain metrics and Key Performance Indicators (KPIs) to reflect the quality of essential data used in identity management, clinical decisions, performance measurement, and other priority functions. Examples include dashboards use to monitor Oracle Health Message Center traffic, Oracle Health unknown queues, and identity traits not within defined ranges.

Deliverables:

A. Deliverables for informal analysis shall take the form of a white paper, presentation, data report, dashboard, graph, table, or narrative within an email message. Deliverables are due by the pre-determined timeframe that is agreeable to the Government and will vary from 1 to 30 days. Requests for informal analysis are estimated by the Government to be approximately 20 per period of performance.

B. Reports and findings from DQ Analytics services performed in response to business process improvement or re-engineering requests shall take the form of formal written reports, including tables, flow diagrams, dashboards, graphs, and presentations. Deliverables are due by the pre-determined timeframe that is agreeable to the Government and will vary from 1 to 3 months. It is estimated by the Government that approximately 8 formal analysis efforts/year will be performed.

C. Deliverables for creation of data quality metrics and monitoring would be: creation of new metrics, and monitoring of DQ metrics, determined based on frequency of data refreshes and could be monthly, quarterly, or annually, and recurring monitoring that would identify issues or anomalies that need to be addressed and plans for remediation or improvement totaling approximately 7-8 for the period of performance.

OPTI…