SSN26-IHS-1522969-SOW.pdf

SSN26-IHS-1522969: STATEMENT OF WORK (SOW): CEDA DATABASE MODERNIZATION

1.0 Introduction and Background

The Indian Health Service (IHS) Clinical Support Center (CSC) seeks a continuing education (CE) for health professionals web-based software solution to automate the Continuing Education program process from initiation to completion. The selected solution must be installed by the vendor and hosted on a FedRAMP-authorized secure server external to IHS. In compliance with federal security mandates, external hosting providers must hold FedRAMP authorization. The software will be hosted at the secure, FedRAMP-approved vendor site to facilitate user access from outside the IHS firewall. Additionally, the solution must comply with federal Section 508 and Accessibility Requirements.

IHS clinical professionals must be well-versed in the latest medical advances in order to make sound, evidence-based decisions aligned with public health interests. Our Continuing Education program provides a way to tailor IHS training to address the specific knowledge and skills and culturally-specific content needed by internal staff while at the same time allowing them to earn the credit hours necessary to maintain their licensure. The CSC provides and supports educational activities in a variety of formats, including lectures, workshops, webinars, seminars, grand rounds, and regularly scheduled learning series for IHS, Tribal, and Urban (I/T/U) healthcare teams.

The continuing education activities of the CSC directly support the IHS Strategic Goals and Objectives, specifically:

• IHS Strategic Goal 1: To ensure that comprehensive, culturally appropriate personal and public health services are available and accessible to American Indian and Alaska Native people.

o Objective 1.1: Recruit, develop, and retain a dedicated, competent, and caring workforce.

o Objective 1.3: Increase access to quality health care services.

• IHS Strategic Goal 2: To promote excellence and quality through innovation of the Indian health system into an optimally performing organization.

o Objective 2.1: Create quality improvement capability at all levels of the organization. [Quality Data, Improvement and Standards of Care] o Objective 2.2: Provide care to better meet the health care needs of American Indian and Alaska Native communities. [Culturally Appropriate Care and Sharing Best Practices]

• IHS Strategic Goal 3: To strengthen IHS program management and operations.

o Objective 3.2: Secure and effectively manage the assets and resources.

o Objective 3.3: Modernize information technology and information systems to support data-driven decisions.

Offering continuing education credits to health care professionals outside the IHS gives them a strong incentive to stay abreast of the latest medical advances and discoveries, since they also earn the credits necessary to maintain their licensure. Additionally, providing online CE learning will allow IHS to share its scientific expertise with many more professionals than face-to-face classroom sessions would allow. This software will not only increase IHS’s capacity to educate and communicate with health care professionals and stakeholders, but it will also help promote the timely dissemination of accurate information to health care professionals on public health and emerging health issues with culturally-specific reliability. Currently, all CSC CE courses are provided at no cost to participants.

The CSC administers the CE program for the entire Agency as well as all I/T/U partners. Since our current system is only partially automated (and obsolete from a programming perspective), much of the work must be manually organized and calculated, which is inefficient, slow, and limits our capacity.

The CSC needs a Commercial Off-The-Shelf (COTS) solution that can automate the CE process from start to finish (the application process, speaker management, attendance record, certificates, transcripts, and data reporting). This will allow the CE program to meet its program goals, which are:

• To expand our accreditation services for as many interprofessional disciplines and to as many sites in Indian country.

• To ensure I/T/U healthcare professionals maintain their respective licensure with current education and CEs to ensure comprehensive, culturally appropriate health care services are available and accessible to American Indian and Alaska Native people.

• To promote excellence and quality through innovation of the Indian health system into an optimally performing organization.

The CSC currently utilizes a workflow/document management solution for the CE application process, but it does not have the capability to automate the entire CE process, and its functions are very limited in regard to meeting the needs of the CE program. Replacing this workflow software with a more comprehensive continuing education solution will enhance the quality, availability, and delivery of information and services related to CSC and the CE program – allowing us to reach a much broader audience and further IHS’s mission and goals.

Glossary of Terms

Academic record A cumulative record of all courses taken, all grades received, all honors received and degrees conferred to a student from the first day of school to the current school year.

Central repository A central repository is a collection of stored data merged into one so that it may be shared, analyzed or updated throughout an organization. A central repository of data or a data warehouse is essentially created by integrating the data from all available sources.

Continuing Education for Health Professionals Continuing Education (CE) for health professionals includes educational activities designed to maintain, enhance, and expand the knowledge, skills, professional performance, and relationships essential to providing high-quality services to patients, the public, and the profession. These activities are developed to meet the specific standards and criteria established by professional continuing education accrediting organizations and recognized by each profession’s licensing body.

Key data requirements typically include collecting biographical and disclosure information from faculty and planning committee members, documenting participant attendance, gathering completed evaluation forms, and storing training materials such as presentation slides.

Additionally, CE programs must support end-of-activity reporting as well as comprehensive year-end reporting.

Custom reports A custom report is a report that the user creates. The user picks the dimensions (date and activity name, for example) and metrics (application status, for example) and decides how they should be displayed.

Data Facts and statistics collected together for reference or analysis

Document management system A system (based on computer programs in the case of the management of digital documents) used to track, manage and store documents and reduce paper. Most are capable of keeping a record of the various versions created and modified by different users (history tracking).

Educational activity For CSC purposes, an activity is defined as an educational event that qualifies for continuing education credit. Eligible activities may take various forms, including, but not limited to: Live Activities; Live Recurring Programs (in which the same content is delivered multiple times within a 36-month period); Regularly Scheduled Series (daily, weekly, monthly, or quarterly CE activities primarily planned by and presented to healthcare teams); Journal Clubs; and Web-based Enduring Materials. During CY2024, CSC awarded credit to 518 activities with a total credit hour awarded, 23,336.5.

Event trigger A trigger event is an explicit set of conditions that initiates the transfer of information between system components

FedRAMP The Federal Risk and Authorization Management Program (FedRAMP®) provides a standardized, reusable approach to security assessment and authorization for cloud service offerings.

Grade/Score a test A number or letter that indicates how a student performed in a class, on a test, or on an assessment.

Implementation In the information technology context, software or hardware implementation encompasses all the post-sale processes involved in something operating properly in its environment, including analyzing requirements, installation, configuration, customization, running, testing, systems integrations, user training, delivery, and making necessary changes. The word "deployment" is sometimes used to mean the same thing.

Pre- and post-activity assessment Tests are administered upon an agreed-upon “entry point” and “exit point.” These tests can be standardized or locally developed and test for broad general education learning or within a specific discipline or course. These might also be performance-based.

Post-activity evaluation Analysis of the efficiency and efficacy of an educational activity using a range of empirical methods.

Reports Some of the reports CSC regularly runs include but are not limited to: Annual Program Evaluation report, Semi-Annual Reports, Evaluation responses, Final Activity Report for The Joint Accreditation Program and Activity Reporting System (JA-PARS), Calendar of Activities, Activity-specific reports, Activity Reports by Service Unit, Area, and Organization.

Security settings Permissions that control who has access to what functions within the software

Statements of Credit Issuance of a certificate or continuing education units for the purpose of documenting attendance at a designated educational activity.

Template A sample document that already has some details in place; those can be adapted (that is, added/completed, removed, or changed, differently from a fill-in-the-blank approach as in a form, either by hand or through an automated iterative process. Once the template is completed, the user can edit, save, and manage the result as an ordinary word processing document. Word processing templates enable the ability to bypass the initial setup and configuration time necessary to create standardized documents. They also enable the automatic configuration of the user interface of the word processing software, with features such as auto completion, toolbars, thesaurus, and spelling options.

User profile A visual display of personal data associated with a specific user, which will have their personally identifiable information, including but not limited to name, title, email address, role – see section

2.1.4 for examples.

1.2 Project Objectives

The contractor shall provide technical, engineering, and continuing education for health professionals, expert knowledge of automating the CE processes using a COTS automated system, and the technical and engineering expertise to install the system. This system is expected to:

• Reduce errors and improve accuracy through the use of fillable forms through which participants can complete and submit data online, as well as an online document management system that can track, manage, and store this data.

• Increase efficiency by automating processes that are currently performed manually including the creation of end-of-activity and year-end reports as required by the accrediting organizations (Joint Accreditation to meet Accreditation Council for Continuing Medical Education ( ACCME), Accreditation Council for Pharmacy Education (ACPE), American Nurses Credentialing Center (ANCC), American Academy of Physician Associates (AAPA), Association of Social Work Boards (SWB), American Psychological Association (APA), and Commission on Dietetic Registration (CDR) criteria) as well as the ability to store previously entered information and use it to complete fillable forms where there is the need for double entry.

• Improve communication and increase transparency with the ability to email participants and faculty (see 2.1.4 for a list of user roles and definitions), automatic notifications of upcoming activities and reminders of tasks to be completed, and, additionally, provide participants a space to create their own online user profile where participants can view and print their academic record and statements of credit.

2.0 Description of Work

The Contractor shall provide, install, test, train, maintain 24/7 uptime and provide helpdesk support on a COTS solution that is packaged, designed, and configured to meet the specific needs (collection of biographical and disclosure documents from faculty and planning committee members, documentation of attendance, completion of evaluation form, storage of training materials such as slides, end-of-activity reporting and year-end reporting) of a continuing health care professionals medical education program in alignment with reporting requirements of the following accrediting organizations through Joint Accreditation: Accreditation Council for Medical Education (ACCME), Accreditation Council for Pharmacy Education (ACPE), American Nurses Credential Center (ANCC), American Academy of Physician Associates (AAPA), Association of Social Work Boards (SWB), American Psychological Association (APA), and Commission on Dietetic Registration (CDR) criteria) and can support a user community sized for 12,000 users at start-up, anticipated to potentially grow to 20,000 users over a 4-year period.

2.1 Software Functionality

2.1.1 Administrator Level Functions

The contractor shall ensure that the software allows the CSC CE administrators the ability to modify and maintain system-level functionality of the COTS solution. These include:

• Set up, enter, modify, and maintain user profiles to include name, credentials, title, address, phone number, and email address.

• Set up and maintain default security settings that control access to COTS software and to system functions at varying privilege levels.

• Set up and maintain default event triggers to include dates that tasks are due, timelines

• Set up and maintain hyperlinks

• Default email account maintenance to include automatic notifications, external addressees

• Complete online forms and data

• Upload documents to include .doc,. dox, .xls, .pdf, Adobe, audio files, and JPEG images

• Check the educational activity’s status and timelines

• Create custom reports as needed to include the fields and application status

The contractor shall ensure that the software allows CSC team members with appropriate permissions to enter, modify, and approve data throughout the CE workflow process and for the lifecycle as outlined below. Workflow includes:

• Submission/review of supporting data regarding how the need for the training was identified, the purpose/goal, a brief description, and learning objectives

• Customizable workflow process for different types of educational activities with web-based forms that capture relevant data to include:

• Built-in timelines – notification of tasks and deadlines

• Assign roles (See Section 2.1.3 for list of roles)

• Track the current status of an educational activity

• Upload and manage supporting documents (electronically-fillable forms or documents such as a course syllabus or presenter slides)

• Create an audit trail to document the receipt of educational activity-specific documentation (electronically fillable forms) and the completion/approval of educational activity-specific tasks

• Create peer review groups to review, edit, and accept or decline documents throughout the application process

• Automatically create/generate reports

• Two-level post-activity evaluation entry, integration, and reporting

1. Activity level participant evaluation

2. Administrative Overall Evaluation Summary of activity

2.1.2 Registration/Attendance Management

The contractor shall ensure that the software allows users with permissions to search the calendar of educational activities and to register to attend. The contractor shall ensure that registered users receive confirmation of their registration and reminders/notifications.

The contractor shall ensure that the software allows attendance to be captured through electronic sign-in and will automatically create/generate an attendance report that includes attendees’ demographic data, including their discipline/credentials (e.g., physician, pharmacist, nurse, physician assistant, social worker, psychologist, dietitian, and all other allied health).

2.1.3 Faculty/Planners/Subject Matter Expert Management

The contractor shall ensure that the software:

• Has a built-in email platform that allows for internal email communication Has the ability to identify roles – Software users will be assigned one or more of the following roles (software should allow users to be assigned multiple roles under one login):

• Faculty: submit bio and disclosure forms, training materials to include syllabus, handouts, and presentations

• Planning Committee Members: submit bio and disclosure forms and review training materials

• Subject Matter Expert (SME): submit bio and disclosure forms, training materials to include syllabus, handouts, and presentations

• CE Coordinator/Planner: submits documents for review, adds speakers and planning committee members into the system

• CSC Team Member(s): review and revise documents submitted by faculty, planning committee members, SMEs, and CE Coordinators, generate reports

• Participant: register, attend activity, complete pre- and post-activity tests, complete course evaluation, view and print certificates/statements of credit and transcripts, manually enter credits earned elsewhere into a central repository of all their continuing education credits

2.1.4 Continuing Education (CE) for Health Professionals

The contractor shall ensure that the software:

• Provides an online portal for participants to log in, claim certificates/statements of credit online, and view/print and receive via email Certificates/Statements of Credit, certificates of completion, and transcripts

• Allows participants to enter and track external educational activities they attended into a central repository

• Automatically generates/sends participants pre- and post-activity assessments, post-activity evaluations (immediate and follow-up) to complete based upon timelines set up in the workflow. The evaluation function should have conditional forking question capabilities.

• Automatically grades/scores pre- and post-activity assessments

• Generates post-activity evaluation reports with the capability to filter data (by discipline, i.e., pharmacy data; by type of CE (ACCME, ACPE, ANCC, AAPA, ASWB, APA, CDR), etc.)

• Automatically creates/generates and submits the Program and Activity Report (JAPARS) for

Joint Accreditation (see https://www.jointaccreditation.org for more info on these reports)

• Houses educational activity content online and/or integrates with sites that house content elsewhere to include static files or videos, and provides access to multimedia, including enduring materials (24/7 on-demand educational activity materials)

2.1.5 Reports

https://www.jointaccreditation.org/

The contractor shall ensure that the software will have the functionality to:

• Automate reporting as determined by the event triggers scheduled by the end user

• Collect data for required reports to accrediting organizations (i.e., ACCME, ANCC, ACPE, APA, AAPA, ASWB, CDR ) or collectively for Joint Accreditation (JAPARS), and send to each accrediting organization by ways to include but not limited to email or direct upload after review by appropriate IHS team members in time to meet corresponding deadlines as set up in the workflow.

• Collect data reports for agency needs (i.e., by IHS Area, by Service Unit/Facilities, by IHS/Tribal/Urban health settings, by disciplines, by credit types)

• Automated reporting to external systems, including CPE Monitor

• Collect participant tracking data for completion of specified courses

• Build and customize reports and save as templates to be reused as scheduled by the end-user.

2.1.6 General Features

The contractor shall ensure that the software:

• Contains a library of evaluation templates that IHS can customize and control

• Retains all data for 6 years (searchable database for activities and forms), with the requirement that IHS will be provided all data on an external hard drive in the event the contract is ended by either party

• Has the ability to update and maintain accreditation criteria

• Has the ability to brand with logos, images, and manage fonts

• Provides quick and easy log-in without multiple entries

• Provides a custom domain name

• Provides a customizable user dashboard/homepage

• Provides responsive design technology (responds to a mobile device’s screen size and interface capabilities)

• Has the ability to integrate other platforms (i.e., Zoom, WebEx, Adobe, GoToWebinars, YouTube, Microsoft Teams)

• Has the ability to provide an online FAQ and tutorials as a guide for CE coordinators

• Has the ability to automatically track expiration dates and provide reminders

• Allows an unlimited number of educational activities and participants

• Has the ability to migrate data from other databases or learning management systems

• Create downloadable CE program announcements with accreditation-compliant information

2.2 Related Services

2.2.1 Implementation Planning

The contractor shall develop a project plan with resources and times to accomplish the activities of the software implementation, to include integration of currently unrepresented data. The contractor shall support IHS staff to integrate data derived from other sources for centralized integration.

The Contractor shall host a contract kick-off meeting either virtually or at the IHS Clinical Support Center, Phoenix Area Office in Phoenix, AZ. Attendees shall include key contractor personnel, OIT, and CSC personnel. The Contractor shall be prepared to discuss the following:

• Timelines

• Risks

• Training

The Contractor shall prepare and send the agenda for the kick-off meeting five business days in advance of the meeting and provide copies of meeting minutes via email to the COR within three business days of the meeting.

The Contractor shall develop a project plan for COR approval within 15 days of award to discuss software installation, set-up configuration, process mapping, process discovery, and testing.

The Project Plan shall also include the following content:

• Project Schedule

• Quality Management

• Communications Management

• Requirements Management

• Security Management

• Records Management

2.2.2 Training

Initial Use of Software Training - The Contractor shall provide a minimum of four-day in-person training for up to 10 IHS users. The training shall be at the IHS Clinical Support Center Office located in, Phoenix Area Office, Phoenix, AZ. The contractor shall ensure that the content of the training session(s) allows users to master the application’s administrative and end-user functionality. This will be a one-time training with continuous support tech and user support.

User Manuals/Online Tutorial - The Contractor shall provide user manuals or provide online tutorials for users who are not able to attend the initial training session.

2.2.3 Helpdesk Support

The Contractor shall provide unlimited help desk support, including troubleshooting and answers to questions from end users. The contractor shall ensure that help desk inquiries can be made via email and telephone. The Contractor shall provide live phone support Monday–Friday from 8:00am-5:00pm Eastern Standard Time. The Contractor shall respond to emails, phone calls, and voicemails received during business hours within one business day. Voicemails and emails received after hours, on holidays, or on weekends shall be responded to the next business day.

The Contractor shall maintain a log of help desk inquiries with dates and resolutions and provide the log to the COR upon request.

2.2.4 Maintenance

The contractor shall provide all software and license maintenance to include version upgrades, patches, and new releases as well as accrediting body criteria and regulatory updates.

2.2.5 Program Management and Administrative Support

The Contractor shall provide an assigned Program Manager (PM) for the duration of the contract. The PM shall serve as the primary point of contact for all contract activities and shall provide administrative, coordination, and oversight support as needed to ensure successful implementation and ongoing use of the software. Responsibilities shall include, but are not limited to:

• Coordinating training logistics, schedules, and materials

• Supporting administrative documentation and communications with IHS

• Tracking deliverables, timelines, and reporting requirements

• Facilitating updates, regulatory changes, and accreditation-related modifications

• Serving as liaison between the Contractor’s technical team and IHS stakeholders

• The assigned PM shall be available during business hours and shall respond to IHS inquiries within one business day unless otherwise agreed upon.

2.3 Requirements

2.3.1 Section 508 and Accessibility

This product must conform to the Revised Section 508 (https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines) and WCAG 2.0 Level AA standards as outlined below.

Solicitations for supplies and services shall require the submission of a Section 508 Product Assessment Template. The template can be found at https://www.itic.org/policy/accessibility/vpat.

Electronic and Information Technology Accessibility Notice (December 18, 2015)

• (a) Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998 and the Architectural and Transportation Barriers Compliance Board Electronic and Information (EIT) Accessibility Standards (36 CFR part 1194), require that when Federal agencies develop, procure, maintain, or use electronic and information technology, Federal employees with disabilities have access to and use of information and data that is comparable to the access and use by Federal employees who are not individuals with disabilities, unless an undue burden would be imposed on the agency. Section 508 also requires that individuals with disabilities, who are members of the public seeking information or services from a Federal agency, have access to and use of information and data that is comparable to that provided to the public who are not individuals with disabilities, unless an undue burden would be imposed on the agency.

(b) Accordingly, any offeror responding to this solicitation must comply with established HHS EIT accessibility standards. Information about Section 508 is available at https://urldefense.us/v3/__https:/www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines__;!!Og_tST9LxTiQE1I!sMGA4WqwG0kqU8u8mMP9fY1oPjrn0KeUJbEnJzVO0G7VfxJgfj0rbYrOFxCSVdb1cswMAz308Fa84rv6QHiwMHy_ApqT48Oc$ https://urldefense.us/v3/__https:/www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines__;!!Og_tST9LxTiQE1I!sMGA4WqwG0kqU8u8mMP9fY1oPjrn0KeUJbEnJzVO0G7VfxJgfj0rbYrOFxCSVdb1cswMAz308Fa84rv6QHiwMHy_ApqT48Oc$ https://urldefense.us/v3/__https:/www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines__;!!Og_tST9LxTiQE1I!sMGA4WqwG0kqU8u8mMP9fY1oPjrn0KeUJbEnJzVO0G7VfxJgfj0rbYrOFxCSVdb1cswMAz308Fa84rv6QHiwMHy_ApqT48Oc$ https://urldefense.us/v3/__https:/www.itic.org/policy/accessibility/vpat__;!!Og_tST9LxTiQE1I!sMGA4WqwG0kqU8u8mMP9fY1oPjrn0KeUJbEnJzVO0G7VfxJgfj0rbYrOFxCSVdb1cswMAz308Fa84rv6QHiwMHy_AkhI4KvL$ http://www.hhs.gov/web/508. The complete text of the Section 508 Final Provisions can be accessed at http://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-section-508-standards.

(c) The Section 508 accessibility standards applicable to this solicitation are stated in the clause at 352.239-74, Electronic and Information Technology Accessibility.

In order to facilitate the Government’s determination whether proposed EIT supplies meet applicable Section 508 accessibility standards, offerors must submit an HHS Section 508 Product Assessment Template, in accordance with its completion instructions. The purpose of the template is to assist HHS acquisition and program officials in determining whether proposed EIT supplies conform to applicable Section 508 accessibility standards. The template allows offerors or developers to self-evaluate their supplies and document—in detail—whether they conform to a specific Section 508 accessibility standard, and any underway remediation efforts addressing conformance issues. Instructions for preparing the HHS Section 508 Evaluation Template are available under Section 508 policy on the HHS website http://www.hhs.gov/web/508.

In order to facilitate the Government’s determination whether proposed EIT services meet applicable Section 508 accessibility standards, offerors must provide enough information to assist the Government in determining that the EIT services conform to Section 508 accessibility standards, including any underway remediation efforts addressing conformance issues.

(d) Respondents to this solicitation must identify any exception to Section 508 requirements. If a offeror claims its supplies or services meet applicable Section 508 accessibility standards, and it is later determined by the Government, i.e., after award of a contract or order, that supplies or services delivered do not conform to the described accessibility standards, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its expense.

Standards

• The included standards that must be met for this contract are taken from the following two resources. Compliance with these standards is mandatory for Federal agencies subject to Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. 794d).

• Section 508 Standards and Guidelines: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines

• Web Content Accessibility Guidelines (WCAG) 2.0: https://www.w3.org/TR/WCAG20/

• Electronic content must be accessible to HHS acceptance criteria

• Checklist for various formats are available at http://508.hhs.gov, or from the IHS Section

508 Coordinator listed at https://www.hhs.gov/web/section-508/additional-resources/section-508-contacts/index.html, (email: IHSSection508@ihs.gov). Materials that are final items for delivery should be accompanied by the appropriate checklist, except upon approval of the Contracting Officer or Representative.

• Electronic Content Accessibility - Web Based

• 602 Support Documentation https://urldefense.us/v3/__http:/www.hhs.gov/web/508__;!!Og_tST9LxTiQE1I!sMGA4WqwG0kqU8u8mMP9fY1oPjrn0KeUJbEnJzVO0G7VfxJgfj0rbYrOFxCSVdb1cswMAz308Fa84rv6QHiwMHy_AiWk8ibq$ https://urldefense.us/v3/__http:/www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-section-508-standards__;!!Og_tST9LxTiQE1I!sMGA4WqwG0kqU8u8mMP9fY1oPjrn0KeUJbEnJzVO0G7VfxJgfj0rbYrOFxCSVdb1cswMAz308Fa84rv6QHiwMHy_AkrQqL0V$ https://urldefense.us/v3/__http:/www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-section-508-standards__;!!Og_tST9LxTiQE1I!sMGA4WqwG0kqU8u8mMP9fY1oPjrn0KeUJbEnJzVO0G7VfxJgfj0rbYrOFxCSVdb1cswMAz308Fa84rv6QHiwMHy_AkrQqL0V$ https://urldefense.us/v3/__http:/www.hhs.gov/web/508__;!!Og_tST9LxTiQE1I!sMGA4WqwG0kqU8u8mMP9fY1oPjrn0KeUJbEnJzVO0G7VfxJgfj0rbYrOFxCSVdb1cswMAz308Fa84rv6QHiwMHy_AiWk8ibq$ https://urldefense.us/v3/__https:/www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines__;!!Og_tST9LxTiQE1I!sMGA4WqwG0kqU8u8mMP9fY1oPjrn0KeUJbEnJzVO0G7VfxJgfj0rbYrOFxCSVdb1cswMAz308Fa84rv6QHiwMHy_ApqT48Oc$ https://urldefense.us/v3/__https:/www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines__;!!Og_tST9LxTiQE1I!sMGA4WqwG0kqU8u8mMP9fY1oPjrn0KeUJbEnJzVO0G7VfxJgfj0rbYrOFxCSVdb1cswMAz308Fa84rv6QHiwMHy_ApqT48Oc$ https://urldefense.us/v3/__https:/www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines__;!!Og_tST9LxTiQE1I!sMGA4WqwG0kqU8u8mMP9fY1oPjrn0KeUJbEnJzVO0G7VfxJgfj0rbYrOFxCSVdb1cswMAz308Fa84rv6QHiwMHy_ApqT48Oc$ https://urldefense.us/v3/__https:/www.w3.org/TR/WCAG20/__;!!Og_tST9LxTiQE1I!sMGA4WqwG0kqU8u8mMP9fY1oPjrn0KeUJbEnJzVO0G7VfxJgfj0rbYrOFxCSVdb1cswMAz308Fa84rv6QHiwMHy_Aq4vPeLK$ https://urldefense.us/v3/__http:/508.hhs.gov/__;!!Og_tST9LxTiQE1I!sMGA4WqwG0kqU8u8mMP9fY1oPjrn0KeUJbEnJzVO0G7VfxJgfj0rbYrOFxCSVdb1cswMAz308Fa84rv6QHiwMHy_AuY2HbBc$ https://urldefense.us/v3/__https:/www.hhs.gov/web/section-508/additional-resources/section-508-contacts/index.html__;!!Og_tST9LxTiQE1I!sMGA4WqwG0kqU8u8mMP9fY1oPjrn0KeUJbEnJzVO0G7VfxJgfj0rbYrOFxCSVdb1cswMAz308Fa84rv6QHiwMHy_AjKGX7_y$ https://urldefense.us/v3/__https:/www.hhs.gov/web/section-508/additional-resources/section-508-contacts/index.html__;!!Og_tST9LxTiQE1I!sMGA4WqwG0kqU8u8mMP9fY1oPjrn0KeUJbEnJzVO0G7VfxJgfj0rbYrOFxCSVdb1cswMAz308Fa84rv6QHiwMHy_AjKGX7_y$ mailto:IHSSection508@ihs.gov

• 603 Support Services

• All WCAG A & AA Success Criteria

• Electronic Content Accessibility - Non-Web Based

• 602 Support Documentation

• 603 Support Services

• All WCAG A & AA Success Criteria apply except:

o 2.4.1 Bypass Blocks o 2.4.5 Multiple Ways o 3.2.3 Consistent Navigation o 3.2.4 Consistent Identification

• Software Accessibility - Web Based

• All WCAG A & AA Success Criteria

• 502 Interoperability with Assistive Technology

• 503 Application

• 602 Support Documentation

• 603 Support Services

• 302 All Functional Performance Criteria - Note: Applies when Chapter 5 does not address one or more functions of ICT (E204), or when an agency invokes "equivalent facilitation" (E101.2)

• For Software that is an authoring tool include

• 504 Authoring Tools

• Support Documentation Accessibility

• E602.1 General - Documentation that supports the use of ICT shall conform to 602.

• E602.2 Accessibility and Compatibility Features - Documentation shall list and explain how to use the accessibility and compatibility features required by Chapters 4 and 5.

Documentation shall include accessibility features that are built-in and accessibility features that provide compatibility with assistive technology.

• E602.3 Electronic Support Documentation - Documentation in electronic format, including Web-based self-service support, shall conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0 (incorporated by reference, see 702.10.1).

• E602.4 Alternate Formats for Non-Electronic Support Documentation - Where support documentation is only provided in non-electronic formats, alternate formats usable by individuals with disabilities shall be provided upon request.

• E602.3 Electronic Support Documentation - Documentation in electronic format, including Web-based self-service support, shall conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0 (incorporated by reference, see 702.10.1).

• E602.4 Alternate Formats for Non-Electronic Support Documentation - Where support documentation is only provided in non-electronic formats, alternate formats usable by individuals with disabilities shall be provided upon request.

• E603.1 General - ICT support services including, but not limited to, help desks, call centers, training services, and automated self-service technical support, shall conform to 603.

• E603.2 Information on Accessibility and Compatibility Features - ICT support services shall include information on the accessibility and compatibility features required by 602.2.

• E603.3 Accommodation of Communication Needs - Support services shall be provided directly to the user or through a referral to a point of contact. Such ICT support services shall accommodate the communication needs of individuals with disabilities.

• WCAG – All WCAG 2.0 A & AA Success Criteria

EXCEPTION:

o Non-Web documents shall not be required to conform to the following four WCAG 2.0 Success Criteria: 2.4.1 Bypass Blocks, 2.4.5 Multiple Ways, 3.2.3 Consistent Navigation, and 3.2.4 Consistent Identification.

o E205.4.1 Word Substitution when Applying WCAG to Non-Web Documents. For non-Web documents, wherever the term "Web page" or "page" appears in WCAG

2.0 Level A and AA Success Criteria and Conformance Requirements, the term "document" shall be substituted for the terms "Web page" and "page". In addition, in Success Criterion in 1.4.2, the phrase "in a document" shall be substituted for the phrase "on a Web page".

• Appendix A – Section 508 of the Rehabilitation Act: Application and Scoping Requirements o E208 Support Documentation and Services

• Appendix C – Functional Performance Criteria and Technical Requirements o 302 - Functional Performance Criteria o 602 – Support Documentation o 603 – Support Services

• Functional Performance Criteria

• 301.1 Scope - The requirements of Chapter 3 shall apply to ICT where required by 508

Chapter 2 (Scoping Requirements), 255 Chapter 2 (Scoping Requirements), and where otherwise referenced in any other chapter of the Revised 508 Standards or Revised 255 Guidelines.

• 302.1 Without Vision - Where a visual mode of operation is provided, ICT shall provide at least one mode of operation that does not require user vision.

• 302.2 With Limited Vision - Where a visual mode of operation is provided, ICT shall provide at least one mode of operation that enables users to make use of limited vision.

• 302.3 Without Perception of Color - Where a visual mode of operation is provided, ICT shall provide at least one visual mode of operation that does not require user perception of color.

• 302.4 Without Hearing - Where an audible mode of operation is provided, ICT shall provide at least one mode of operation that does not require user hearing.

• 302.5 With Limited Hearing - Where an audible mode of operation is provided, ICT shall provide at least one mode of operation that enables users to make use of limited hearing.

• 302.6 Without Speech - Where speech is used for input, control, or operation, ICT shall provide at least one mode of operation that does not require user speech.

• 302.7 With Limited Manipulation - Where a manual mode of operation is provided, ICT shall provide at least one mode of operation that does not require fine motor control or simultaneous manual operations.

• 302.8 With Limited Reach and Strength - Where a manual mode of operation is provided, ICT shall provide at least one mode of operation that is operable with limited reach and limited strength.

• 302.9 With Limited Language, Cognitive, and Learning Abilities - ICT shall provide features making its use by individuals with limited cognitive, language, and learning abilities simpler and easier.

2.3.2 Privacy

• Privacy Act (December 18, 2015)

This contract requires the Contractor to perform one or more of the following:

(a) design; (b) develop; or (c) operate a federal agency system of records to accomplish an agency function in accordance with the

Privacy Act of 1974 (Act) (5 U.S.C. 552a(m)(1)) and applicable agency regulations.

The term system of records means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual. Violations of the Act by the Contractor and/or its employees may result in the imposition of criminal penalties (5 U.S.C. 552a(i)).

The Contractor shall ensure that each of its employees knows the prescribed rules of conduct in 45 CFR part 5b and that each employee is aware that he/she is subject to criminal penalties for violation of the Act to the same extent as Department of Health and Human Services employees. These provisions also apply to all subcontracts the Contractor awards under this contract which require the design, development or operation of the designated system(s) of records (5 U.S.C. 552a(m)(1)). The contract work statement:

(a) Identifies the system(s) of records and the design, development, or operation work the

Contractor is to perform; and

(b) Specifies the disposition to be made of such records upon completion of contract performance.

• Confidential Information (December 18, 2015)

(a) Confidential Information, as used in this clause, means information or data of a personal nature about an individual, or proprietary information or data submitted by or pertaining to an institution or organization.

(b) Specific information or categories of information that the Government will furnish to the Contractor, or that the Contractor is expected to generate, which are confidential may be identified elsewhere in this contract. The Contracting Officer may modify this contract to identify Confidential Information from time to time during performance.

(c) Confidential Information or records shall not be disclosed by the Contractor until:

(1) Written advance notice of at least 45 days shall be provided to the Contracting

Officer of the Contractor's intent to release findings of studies or research, to which an agency response may be appropriate to protect the public interest or that of the agency.

(2) For information provided by or on behalf of the government,

(i) The publication or dissemination of the following types of information are restricted under this contract: Personally Identifiable Information, Protected Health Information

(ii) The reason(s) for restricting the types of information identified in subparagraph (i) is/are: It is protected under the Privacy Act and HIPAA rules

(iii) Written advance notice of at least 45 days shall be provided to the Contracting Officer of the Contractor's intent to disseminate or publish information identified in subparagraph (2)(i). The contractor shall not disseminate or publish such information without the written consent of the Contracting Officer.

(d) Whenever the Contractor is uncertain with regard to the confidentiality of or a property interest in information under this contract, the Contractor should consult with the Contracting Officer prior to any release, disclosure, dissemination, or publication.

2.3.3 Security

The IHS (Indian Health Service) must comply with the Federal Risk and Authorization Management Program (FedRAMP) requirements, a government-wide program for security assessment, authorization, and continuous monitoring of cloud products and services, when using cloud solutions. The process involves several stages, including preparation, assessment, and authorization, with the goal of ensuring secure and compliant cloud environments.

The vender must provide the following:

• NIST Security Controls: Implement the security controls specified in NIST Special

Publication 800-53, based on the system’s impact level (Low, Moderate, or High) o https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final

• Descriptions of the application/service including deployment model, application/system boundary and all “component types” included in-boundary.

• Descriptions of how selected FedRAMP Tailored LI-SaaS baseline minimum security control requirements are implemented by the service provider.

• Descriptions of how the implementation of the required security controls will be validated by the independent assessor.

• Results of the validation/assessment of the security control implementations.

• Descriptions of remediation and/or mitigation of risks identified in the validation/ assessment results

2.4 Task Deliverables

The contractor shall provide the following deliverables to the COR: All deliverables shall be submitted to the COR, as indicated below. At a minimum, the contractor will be required to provide the following:

Deliverables: Due Date:

Kick-Off Meeting Within 10 days of award

Project Plan Within 15 days after award https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final

User Manuals Within 10 weeks after award

On-site training for up to 10 users Within 2 Weeks before end of award

Deploy web-based software application Within 16 weeks after award

IHS EPLC Documentation

Within 4 weeks after award

Master Test Plan Within 4 weeks after award

System Authority to Operate (ATO) and Completion of EPLC Documents

Within 2 Weeks before end of award

2.5 Installation of Software/EPLC Documentation

The Contractor shall work directly with the COR or other identified IHS technical personnel on the installation of the software.

2.5.1 IHS Enterprise Performance Life Cycle (EPLC) Documentation The contractor shall provide additional IHS EPLC documents which may be required, combined, or even waived after further assessment:

• Project Process Agreement

• Project Management Plan

• Project Schedule

• System Requirement Specifications (if done separately)

• Requirements Traceability Matrix (tracing Business Requirements to Tests)

• System Design Document

• Release Test Plan

• Test Cases Specifications

• Version Description Document (VDD) (release installation package)

• Test Reports

• Project Implementation Plan

• Training Materials

• User Manual

• Operations & Maintenance (O&M) Manual

2.5.2 Master Test Plan

The Contractor shall develop a Master Test Plan for COR approval which will define the types of tests (e.g. unit, function, integration, system, security, performance (load and stress), regression, user acceptance, and/or independent verification and validation) to be carried out for installation of the software. The Master Test Plan shall describe the acceptance criteria for those tests, roles and responsibilities of individuals involved in the testing process, traceability matrix, resources required (hardware and software environments), and other elements relevant to test planning and installation and fully functional use of the software. The Master Test Plan shall include sections for the following series of tests:

• Performance Testing and User Acceptance Testing The Contractor shall ensure that a well-designed integration and test approach focuses on all areas, especially those areas that are high risk or most likely to lead to incompatibilities. If the COTS components are being integrated with multiple systems, the Contractor shall ensure that all components are operating simultaneously to ensure proper functionality, even if they are functioning in a limited capacity with respect to their intended feature set.

3.0 Period of Performance

The anticipated Performance Period is: base Period (3 years) from date of award, plus 2 (12-month) option periods.

Period of Performance Base Period

Installation, set-up and configuration, training, maintenance, and help desk support

Option Period 1 training (updates only), maintenance (section 2.2.4, and help desk support (section 2.2.4)

Option Period 2 training (updates only), maintenance (section 2.2.4), and help desk support (section 2.2.4)

4.0 Place of Performance

The work shall be performed at the Contractor’s site. The Kick Off meeting (optional) and Training at the IHS CSC offices in Phoenix, AZ, as requested by the COR.

2.4 Task Deliverables