Statement of Work.pdf

Statement of Work VISN 19, Laurel Bridge, HTM Compass Routers Support

1. Contract Title: VISN 19, Laurel Bridge, HTM Compass Routers Support

2. Background: The VA Rocky Mountain Network, Veterans Integrated Service Network (VISN) 19, is responsible for providing health care to Veterans in the states of Colorado, Montana, Oklahoma, Utah, and Wyoming.

Like all VA health care facilities, VISN 19 is moving from the legacy VistA EMR and moving to an Enterprise Oracle Cerner EMR. This move will require legacy systems to have their existing medical and laboratory devices interfaced and configured to communicate with Cerner.

This procurement is for one base year and four one-year option periods of software maintenance and support for VISN19 Compass routers. Compass routers are interface software “tools” that help standardize and translate data from medical devices (e.g., imaging systems) and other disparate systems from multiple OEMs, into data that can be properly interpreted by the Cerner EHR and other patient data repositories. Compass routers are used to translate patient identification information and other HL7 and DICOM data.

VISN 19 recognizes that other VHA facilities may encounter the same challenges and need for support from Laurel Bridge for their Compass routers. Therefore, the Laurel Bridge support agreement procured by VISN 19 may be implemented as an option at other VHA facilities.

3. Applicable Documents. In performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

3.1. 44 U.S.C. § 3541, “Federal Information Security Management Act (FISMA) of 2002”

3.2. FIPS Pub 201, “Personal Identity Verification of Federal Employees and Contractors,” March

3.3. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

3.4. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

3.5. VA Directive 0710, “Personnel Suitability and Security Program,” September 10, 2004

3.6. VA Directive 6102, “Internet/Intranet Services,” July 15, 2008

3.7. 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility Standards,” July 1,

3.8. Office of Management & Budget (OMB) Circular A-130, “Management of Federal Information

Resources,” November 28, 2000

3.9. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services

(CHAMPUS)”

3.10. An Introductory Resource Guide for Implementing the Health Insurance Portability and

Accountability Act (HIPAA) Security Rule, October 2008

3.11. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the

Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998

3.12. Homeland Security Presidential Directive (12) (HSPD-12)

3.13. VA Directive 6500, “Information Security Program,” August 4, 2006

3.14. VA Handbook 6500.6, “Contract Security,” March 12, 2010

3.15. Program Management Accountability System (PMAS) portal (reference PWS References – Technical Library at https://www.voa.va.gov/)

4. Scope. The contracted vendor shall provide software maintenance and support remotely for all

VISN 19 Compass routers to include software application and security updates, and other routine support as needed for the operation and maintenance of Compass routers and its connections to imaging devices, VistA and Oracle Cerner for the sites listed in Table 1.

4.1.1. Compass Professional DICOM Router annual software maintenance and support include the following:

4.1.1.1. Active routers: Compass Standard & Compass Direct (store & forward plus direct routing);

4.1.1.1.1. Includes: Compass HL7 routing: For pass-thru HL7 routing; no custom features to manipulate contents of HL7 message(s). 321030-H

4.1.1.1.2. Includes: Custom Filter/Feature: To convert SSN to EDIPI 321030-F1

4.1.1.1.3. Includes: Custom Filter/Feature: To convert EDIPI to SSN 321030-F2

4.1.1.1.4. Includes: Custom Filter/Feature: To insert Application Entity (AE) Title of source to DICOM header Station ID tag out-bound to Cerner. 321030-F3

4.1.1.2. Stand-by/Passive routers: Compass Standard & Compass Direct (store & forward plus direct routing);

4.1.1.2.1. Includes: Compass HL7 routing: For pass-thru HL7 routing; no custom features to manipulate contents of HL7 message(s). 321030-H-S

4.1.1.2.2. Includes: Custom Filter/Feature: To convert SSN to EDIPI 321030-F1-S

4.1.1.2.3. Includes: Custom Filter/Feature: To convert EDIPI to SSN 321030-F2-S

4.1.1.2.4. Includes: Custom Filter/Feature: To insert Application Entity (AE) Title of source to DICOM header Station ID tag out-bound to Cerner. 321030-F3-S

4.1.1.3. Test/Development routers: Compass Standard & Compass Direct (store & forward plus direct routing);

4.1.1.3.1. Includes: Compass HL7 routing: For pass-thru HL7 routing; no custom features to manipulate contents of HL7 message(s). 321030-H-D

4.1.1.3.2. Includes: Custom Filter/Feature: To convert SSN to EDIPI 321030-F1-D

4.1.1.3.3. Includes: Custom Filter/Feature: To convert EDIPI to SSN 321030-F2-D

4.1.1.3.4. Includes: Custom Filter/Feature: To insert Application Entity (AE) Title of source to DICOM header Station ID tag out-bound to Cerner. 321030-F3-D

4.1.1.4. PowerTools Suite of Standalone DICOM & HL7 Utilities: Annual Software

Maintenance

4.1.2. Maintenance & Support Plan also includes:

4.1.2.1. One (1) incident of Priority Support per renewal term per site and begins from the go-live date at each site thru period of performance.

4.1.2.2. Software release upgrades and normal business hour (M-F; 8am-5pm ET; except Laurel Bridge holidays) production support as defined in the LBS Maintenance & Support Plan.

4.1.2.3. Maintenance period begins at the installation of software thru period of performance.

4.1.3. Maintenance & Support Plan - Extended Package

4.1.3.1. Extended Support Package is valid during the one-year renewal term (period of performance).

4.1.3.2. Includes an additional 0 priority support incidents for the period of performance.

Total of 8 incidents for VISN19.

4.1.3.3. Incidents can be used at any of the VISN19 sites at the discretion of VISN19 authorized personnel.

4.1.3.4. Priority Support is defined in the LBS Maintenance & Support Plan.

Table 1: VISN 19 Sites VISN Station Address

19 Eastern Oklahoma VA Healthcare System

(EOVAHCS)

1011 Honor Heights Drive Muskogee, OK 74401

19 Oklahoma City VA Health Care System 921 Northeast 13th Street Oklahoma City, OK 73104

19 Rocky Mountain Regional VA Medical Center 1700 North Wheeling Street Aurora, CO 80045

19 Sheridan VA Medical Center 1898 Fort Road Sheridan, WY 82801

19 Fort Harrison VA Medical Center 3687 Veterans Drive Fort Harrison, MT 59636

19 Grand Junction VA Medical Center 2121 North Avenue Grand Junction, CO 81501

19 Cheyenne VA Medical Center 2360 East Pershing Boulevard Cheyenne, WY 82001

19 Salt Lake Medical Center

500 Foothill Boulevard Salt Lake City, UT 84144

5. Performance Period. The period of performance shall be one (1) twelve (12) month base period plus, four (4) additional twelve (12) month option periods as stated below:

Base Year Option Year One (1) Option Year Two (2) Option Year Three (3) Option Year Four (4)

6. Place of Performance. Contract performance shall take place at the contractor’s location(s) and at the locations in Table 1.

7. Travel for Installation, Implementation and Training. The Government anticipates no Contractor travel under this contract. All travel shall be incorporated into the price schedule for the contract.

No travel costs will be reimbursed by VA

7.1. The Government acknowledges the use of remote access for installation and implementation purposes, within the constraints of all applicable VA Information Security Requirements

8. Government Furnished Equipment/Information. The Contractor shall be allowed access to Government equipment including servers and network infrastructure. Information on Government equipment and systems shall be provided as necessary. No Government-owned property will be transferred into the Contractor’s control. Additional software products may be provided by the Government as identified to facilitate Contractor access, e.g. Microsoft Terminal Services.

9. Invoicing. Invoices shall be submitted electronically via the Financial Services Center Mandatory

Electronic Invoice System, on a monthly basis. Invoices must include, at a minimum, the following information: Contractor name, purchase order number, period of service the billing covers, and a list of equipment items covered during the stated period of performance.

This requirement is in accordance with VARR Clause 852.232-72 Electronic Submission of Payment Requests: http://www.fsc.va.gov/einvoice.asp. Electronic payments are net 30 days.

10. Security Requirements. All contractor employees are subject to the same level of investigation as

VA employees who have access to VA sensitive information or access to VA facilities. The background investigation includes the following requirements: 1) Completed documentation 2) Fingerprints 3) Completion of OPM’s e-QIP Questionnaire. The Contractor is required to fulfill all the security requirements. The Contractor, upon completion of fingerprinting, and an initial suitability determination, may be authorized tentative access to start the performance period of the contract, but only on condition of completion of all security requirements. This requirement is applicable to all subcontractor personnel requiring the same access.

11. Hours of Coverage & Federal Holidays. Maintenance Service will be provided during regular coverage hours of 8:30am to 5:30pm, Monday through Friday, excluding federal holidays. The contractor shall contact the POC or his/her designee prior to commencing any work on the premises.

Federal Holidays are:

New Years' Day Martin Luther King Day Presidents' Day Memorial Day Independence Day Labor Day Columbus Day Veterans' Day Thanksgiving Day Christmas Day Juneteenth

INFORMATION SECURITY/PRIVACY REQUIREMENTS

VA Maintenance/Installation Contracts

1. VA INFORMATION CUSTODIAL LANGUAGE

Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data

- General, FAR 52.227-14(d) (1).

2. SECURITY INCIDENT INVESTIGATION

The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

3. LIQUIDATED DAMAGES FOR DATA BREACH

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

b. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $42.00 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification;

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

(3) Data breach analysis;

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

(5) One year of identity theft insurance with $20,00.00 coverage at $0 deductible; and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

4. TRAINING

a. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Department of Veterans Affairs (VA) Information Security Rules of Behavior (ROB) for Organizational Users, Appendix A relating to access to VA information and information systems;

(2) Successfully complete the VA Privacy and Information Security Awareness and Rules of Behavior training and annually complete required privacy and security training; and

(3) Successfully complete any additional information security or privacy training, as required for VA personnel with equivalent information system access.

b. The contractor shall provide to the contracting officer and/or the COTR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.