Statement of Work Hand Hygiene Compliance Monitoring Final.docx

VA NEW ENGLAND HEALTHCARE SYSTEM

Performance Work Statement Hand Hygiene Compliance Monitoring System

January 2022 Veterans Integrated Service Network (VISN) 1 VA New England HealthCare System Planning UID:

PWS Version 1.0

Contents

Background The mission of the Department of Veterans Affairs (VA), Veterans Health Administration (VHA) is to provide benefits and services to Veterans of the United States. In meeting these goals, VA strives to provide high quality, effective, and efficient services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner.

Veterans Integrated Services Network (VISN) 1 is responsible for providing health care to Veterans in the New England area. The eight (8) Health Care Systems within VISN 1 are comprised of 11 different medical campuses and Community Based Outreach Clinics (CBOCs) that work together to provide efficient, accessible health care to Veterans in their areas.

Like all health care facilities, VISN 1 faces numerous clinical and business challenges, including monitoring hand hygiene compliance, to make sure all healthcare staff are doing their part to stop the spread of infectious diseases. Currently, staff are using manual reminders for when hand hygiene is needed and often underestimate the importance, which can lead to a lack of compliance. An electronic hand hygiene monitoring solution that could continuously monitor and proactively record compliance for reporting out to infection prevention or other regulatory bodies and provide reminders to healthcare staff when hand hygiene is needed would increase hand hygiene compliance. It removes the burden from staff and departments from having to perform the manual recording, provides the electronic data capture of monitoring logs for reporting, and decreases the risk of infectious diseases spreading.

Objective This document highlights the requirements, technical specifications, and services being requested by the Department of Veterans Affairs (VA) medical centers listed below for consideration towards purchase of a hand hygiene compliance monitoring solution. The hand hygiene compliance monitoring system will replace, supplement, or add areas for hand hygiene compliance monitoring at the medical centers listed below. Offerors under this proposal shall provide all labor, material, parts, tools, software, project management, services, and equipment necessary to furnish, install and test a fully functional hand hygiene compliance monitoring solution in each of the following medical centers to operate on the VA IT Network using the existing Centrak RTLS platform already in place at each facility. The contractor shall also provide system user and technical training.

· VA Maine Healthcare System (1 VA Center Augusta, ME 04330)

· White River Junction VA Medical Center (215 North Main Street White River Junction, VT 05009)

· Bedford VA Medical Center (200 Springs Road Bedford, MA 01730)

· VA Boston Healthcare System

· Jamaica Plain Campus (150 South Huntington Ave Jamaica Plain, MA 01230)

· West Roxbury Campus (1400 VFW Parkway West Roxbury, MA 02132)

· Brockton Campus (940 Belmont Street Brockton, MA 02301)

· Manchester VA Medical Center (718 Smyth Road Manchester, NH 03104)

· Providence VA Medical Center (830 Chalkstone Ave Providence, RI 02908)

· VA Connecticut Healthcare System

· West Haven Campus (950 Campbell Ave West Haven, CT 06516)

· Newington Campus (555 Willard Ave Newington, CT 06111)

· VA Central Western Massachusetts (421 North Main Street Leeds, MA 01053)

Applicable documents In the performance of the tasks associated with this Statement of Work, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements For Cryptographic Modules”

4. FIPS Pub 199. Standards for Security Categorization of Federal Information and Information Systems, February 2004

5. FIPS Pub 200, Minimum Security Requirements for Federal Information and Information Systems, March 2016

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, http://www.va.gov/vapubs/

12. VA Handbook 0710, Personnel Security and Suitability Security Program, May 2, 2016, http://www.va.gov/vapubs

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” July 15, 2008

14. 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility Standards,” July 1, 2003

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “Managing Information Security Risk: VA Information Security Program,” September 20, 2012

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems – Tier 3: VA Information Security Program,” March 10, 2015

22. VA Handbook 6500.1, “Electronic Media Sanitization,” November 03, 2008

23. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI)”, July 28, 2016

24. VA Handbook 6500.3, “Assessment, Authorization, And Continuous Monitoring Of VA Information Systems,” February 3, 2014

25. VA Handbook 6500.5, “Incorporating Security and Privacy in System Development Lifecycle”, March 22, 2010

26. VA Handbook 6500.6, “Contract Security,” March 12, 2010

27. VA Handbook 6500.8, “Information System Contingency Planning”, April 6, 2011

28. OI&T Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management”, January 15, 2016

33. VA Directive 6300, Records and Information Management, February 26, 2009

34. VA Handbook, 6300.1, Records Management Procedures, March 24, 2010

35. NIST SP 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach, June 10, 2014

36. NIST SP 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems and Organizations, January 22, 2015

37. OMB Memorandum, “Transition to IPv6”, September 28, 2010

38. VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, October 26, 2015

39. VA Handbook 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, March 24, 2014

40. OMB Memorandum M-06-18, Acquisition of Products and Services for Implementation of HSPD-12, June 30, 2006

41. OMB Memorandum 04-04, E-Authentication Guidance for Federal Agencies, December 16, 2003

42. OMB Memorandum 05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, August 5, 2005

43. OMB memorandum M-11-11, “Continued Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, February 3, 2011

44. OMB Memorandum, Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation, May 23, 2008

45. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011

46. NIST SP 800-116, A Recommendation for the Use of Personal Identity Verification (PIV) Credentials in Physical Access Control Systems, November 20, 2008

47. OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007

48. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, Digital Identity Guidelines, June 2017

49. NIST SP 800-157, Guidelines for Derived PIV Credentials, December 2014

50. NIST SP 800-164, Guidelines on Hardware-Rooted Security in Mobile Devices (Draft), October 2012

51. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981 Mobile, PIV, and Authentication, March 2014

52. VA Memorandum, VAIQ #7100147, Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12), April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

53. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

54. VA Memorandum “Mandate to meet PIV Requirements for New and Existing Systems” (VAIQ# 7712300), June 30, 2015, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4846

55. Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.0, Federal Interagency Technical Reference Architectures, Department of Homeland Security, October 1, 2013, https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/482/2015/04/TIC_Ref_Arch_v2-0_2013.pdf

56. OMB Memorandum M-08-05, “Implementation of Trusted Internet Connections (TIC), November 20, 2007

57. OMB Memorandum M-08-23, Securing the Federal Government’s Domain Name System Infrastructure, August 22, 2008

58. VA Memorandum, VAIQ #7497987, Compliance – Electronic Product Environmental Assessment Tool (EPEAT) – IT Electronic Equipment, August 11, 2014 (reference Document Libraries, EPEAT/Green Purchasing Section, https://www.voa.va.gov/documentlistpublic.aspx?NodeID=552)

59. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

60. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

61. Executive Order 13693, “Planning for Federal Sustainability in the Next Decade”, dated March 19, 2015

62. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

63. VA Directive 0058, “VA Green Purchasing Program”, July 19, 2013

64. VA Handbook 0058, “VA Green Purchasing Program”, July 19, 2013

65. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access”, January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

66. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

67. VA Memorandum, “Implementation of Federal Personal Identity Verification (PIV) Credentials for Federal and Contractor Access to VA IT Systems”, (VAIQ# 7614373) July 9, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

68. VA Memorandum “Mandatory Use of PIV Multifactor Authentication to VA Information System” (VAIQ# 7613595), June 30, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

69. VA Memorandum “Mandatory Use of PIV Multifactor Authentication for Users with Elevated Privileges” (VAIQ# 7613597), June 30, 2015; https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

70. “Veteran Focused Integration Process (VIP) Guide 2.0”, May 2017, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

71. “VIP Release Process Guide”, Version 1.4, May 2016, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4411

72. “POLARIS User Guide”, Version 1.2, February 2016, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4412

73. VA Memorandum “Use of Personal Email (VAIQ #7581492)”, April 24, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

74. VA Memorandum “Updated VA Information Security Rules of Behavior (VAIQ #7823189)”, September, 15, 2017, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

75. National Fire Protection Association (NFPA) 70 – National Electric Code

76. National Fire Protection Association (NFPA) 99 – Standard for Healthcare Facilities

77. VA Handbook 6550, “Pre-procurement Assessment for Medical Devices “, (https://www1.va.gov/vapubs/index.cfm)

78. National Institute Standards and Technology (NIST) Special Publications

79. An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, March 2005

80. VA Handbook 7002, Logistics Management Procedures, July 10, 2009 (https://www1.va.gov/vapubs/index.cfm)

81. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998

82. Veterans Health Administration Records control Schedule (RCS 10-1). Nov 2017 (https://www.va.gov/vhapublications/rcs10/rcs10-1.pdf)

83. Veterans Health Administration Directive 1116 – Sterile Processing Services. https://www.va.gov/vhapublications/publications.cfm?Pub=1

84. College of American Pathologists Accreditation Program.

https://www.cap.org/laboratory-improvement/accreditation

85. Attachment A. VA DIRECTIVE 6550 PRE_PROCURMENT ASSESSMENT

86. Attachment B. Estimated Order Quantities

87. Attachment C. Facility Access Point Design Report

Performance Details Performance Period The Period of Performance (PoP) for this contract is 12 months + four option years.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Place of Performance Tasks under this Statement of Work shall be performed in VA facilities located in:

· VA Maine Healthcare System (1 VA Center Augusta, ME 04330)

· White River Junction VA Medical Center (215 North Main Street White River Junction, VT 05009)

· Bedford VA Medical Center (200 Springs Road Bedford, MA 01730)

· VA Boston Healthcare System

· Jamaica Plain Campus (150 South Huntington Ave Jamaica Plain, MA 01230)

· West Roxbury Campus (1400 VFW Parkway West Roxbury, MA 02132)

· Brockton Campus (940 Belmont Street Brockton, MA 02301)

· Manchester VA Medical Center (718 Smyth Road Manchester, NH 03104)

· Providence VA Medical Center (830 Chalkstone Ave Providence, RI 02908)

· VA Connecticut Healthcare System

· West Haven Campus (950 Campbell Ave West Haven, CT 06516)

· Newington Campus (555 Willard Ave Newington, CT 06111)

· VA Central Western Massachusetts (421 North Main Street Leeds, MA 01053) Travel The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Include all estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government.

The total estimated number of trips in support of the tasks associated for this effort is 4 for each of the 11 medical centers. Anticipated locations and durations include the following:

Scope of Work The Contractor shall provide, install, configure, and test a Hand Hygiene Compliance Monitoring System. The Contractor shall provide hardware and software components compatible with the current Cetnrak RTLS infrastructure and deliver training services. In addition, the Contractor shall conduct site assessments, develop design documentation, and provide end-of-contract transition support. The Contractor shall provide a single point of contact (Implementation Manager) to oversee the overall Hand Hygiene Compliance Monitoring System implementation for the VISN.

Specific Tasks and Deliverables The Contractor shall perform the following:

Project Administration The Contractor shall provide a single point of contact (Implementation Manager) to oversee the overall Hand Hygiene Compliance Monitoring System implementation for VISN 1. The Contractor Implementation Manager shall be responsible for:

· Effectively communicating the project progress to VHA and Contractor team members

· Ensuring proper documentation is delivered to VHA

· Coordinating, escalating, and resolving Contractor-related project issues

· Representing the Contractor in status meetings and providing timely status reports Contractor Project Management Plan The Contractor shall produce a Contractor Project Management Plan (CPMP) which includes the approach, timeline and tools to be used in execution of the contract. The CPMP shall be updated and amended as outlined in the deliverables table. The Contractor shall update and maintain the COR-approved CPMP throughout the period of performance. The CPMP shall contain:

A comprehensive Project Schedule including milestones and deliverable dates for the deployment of each Application at each VISN Facility. The Project Schedule shall be broken out by facility and application

A. Deliverable: Contractor Project Management Plan

Kick Off Meeting The Contractor shall conduct a project kick-off meeting within 15 days after award to introduce the Government team to the Contractor’s overall operating plans and approach to this requirement. The Contractor shall present its draft Contractor Project Management Plan (CPMP) for review with the Government. The Contractor shall update the CPMP based on the outcomes of the kick-off meeting. This meeting shall be virtual or held on-site at one site listed in section 4.2.

On-going Progress Meetings The Contractor shall conduct on-going progress meetings on a weekly basis utilizing the updated CPMP to update the VA on Contractor project status, schedule, risks, risk mitigation, issues and issue resolution plans. This meeting shall be virtual.

Reporting Requirements Monthly, the Contractor shall submit a Monthly Progress Report to include:

· Completed activities for the reporting period

· Planned activities for the next reporting period

· Tracking of current issues and risks

A. Deliverable: Monthly Progress Report General Hand hygiene compliance Monitoring Requirements Networking Technology Requirements

· The system must utilize existing Centrak RTLS Infrastructure at each facility as the core communication between badges and sensors.

· As part of the Preliminary Hardware Deployment Design Document, the Contractor shall provide draft documentation of the Server configuration and architecture that will be configured and optimized to meet the needs of VISN 1 and its Facilities. This draft documentation shall include:

· A diagram that lays out the server requirements at each location along with:

a. Expected bandwidth utilization for the WAN links

b. Expected application latency requirements

c. Server specification (including power, BTUs, and network connections)

d. Provide the specification for the number of sensors that can be supported per server

· All servers provided must operate using a fully supported operating system. For example, if the server is Microsoft Windows-based, the operating system must be Microsoft Windows Server 2012 or newer.

· The solution shall be capable of running in a virtual server environment.

· Contractor shall provide a server build document that details all software installed, Operating System, Computer Name, IP Address. The document shall be detailed so that a System Administrator can re-install all necessary applications and software to stand up a new server in the event of a disaster.

· The Offeror is required to submit the following documentation along with their proposal.

· A complete VA Directive 6550 Pre-Procurement Assessment form. See attachment A in Section 2 Applicable Documents.

Data Backup Solution Data must be stored in accordance with the Veterans Health Administration Records Control Schedule (See Applicable Documents, #83: RCS 10-1), for up to five years. The Contractor shall provide a backup solution to include:

· Daily Differential backup

· Weekly full backup of operating system and application, configuration files, and data.

· Back up of Virtual Machine image

System shall have ability to backup and archive data for each facility listed.

System Administration The Contractor shall provide Database and System Administration services during the implementation and warranty period. The System Administration Services shall include:

a. Perform daily system health checks on servers and databases, including monitoring application logs.

b. Security compliance and remediation of application related vulnerabilities

c. Apply Monthly OS security patches provided by OIT.

d. Troubleshoot connectivity issues.

e. Troubleshoot startup/shutdown server and application issues.

f. Implement Software Upgrades.

Hand hygiene compliance Monitoring Application Requirements Hand Hygiene Sensors

1. Sensors must be able to be anonymous, meaning names “Nurse A” or “Physician B” rather than linked to a specific staff member,

2. Data collection must continue during network / power outages. 24-hour memory is required on sensors.

3. VA prefers that programmable sensors shall be capable of being programmed remotely over the air. For example, when applicable, the active tag beacon rate shall be programmable over the air and the beacon rate shall be able to be set to multiple time intervals (minimum 2 seconds). The sensors’ beacon rate shall be adjustable based on configuration Installation The Contractor shall complete the Hand Hygiene Monitoring installation in accordance with the approved preliminary hardware design document (Section 7.5).

· The Contractor shall install supporting hardware and components to blend in (or not be visible at all), with the general surface treatments of the facility. The COR shall approve all final design of hardware placement prior to installation.

· The installation plan shall support the addition of future applications and the expansion to additional areas (e.g., zones, floors, new buildings, etc.)

· The Contractor shall install components to have minimal impact on the business operations of the facility and meet applicable infection control and health and safety requirements such as Joint Commission and Infection Control Risk Assessment (ICRA) findings and standards.

· The Contractor shall install hardware during normal business hours and coordinated with on-site VA personnel so as not to disrupt patient care.

Hand Hygiene compliance monitoring Application The Hand Hygiene Compliance Monitoring solution shall provide a visual monitoring display that provides graphical and tabular data of current trends for every tag in the system. The system shall have the capability of recording discrete “real time” data, tracking, trending, and logging of significant events, adherence by staff member, role, or unit. As well as providing contact tracing. Data collection events (frequency of record) shall be set by the user for each sensor with the collected data updated in the RTLS database at user-defined times. Data will be required to be able to be maintained and accessed for a period not less than five (5) calendar years.

The application must comply with VA PIV and SSO requirements.

Reporting and Alerts

· The system shall create reports for the end user to verify compliance for individual sensors or units/areas within the healthcare facility.

· The system shall communicate with the end user if the device being monitored goes out of range. This communication should have the capability to be done via text, pager, phone, or email.

· The System shall report on battery status at pre-defined thresholds.

Hardware Design Document The Contractor shall perform post-award Site Assessments of each VISN Facility deploying Hand Hygiene Compliance Monitoring to collect the information necessary for successful implementation.

Following the Site Assessment, the Contractor shall develop a Hardware Deployment Design Document for each VISN Facility prior to beginning the hardware installation process or delivery of any items to the sites. The Preliminary Hardware Deployment Design Document shall illustrate how the Contractor will design the layout of hardware for the system. This document should be completed based off on-site visits by the Contractor at each facility listed in this document. The Preliminary Hardware Deployment Design Document shall be broken out by area and follow the VA review process. The contractor will be permitted 5 business days to address any comments provided by the VA.

The Contractor shall submit the Preliminary Hardware Design Documents in the form of Facility Drawings and excel spreadsheet that include markups noting location, type and quantity of all equipment that need to be installed (and how it ties back to the system). The Contractor shall clearly indicate how coverage is achieved in each required area for the purposes of understanding the design and architecture for troubleshooting purposes.

The Contractor shall install the Hand Hygiene Application in accordance with the approved Preliminary Hardware Deployment Design Document. The Contractor shall report on installation progress, including delays, risks, and future tasks during Weekly Meetings with the COR and in the Monthly Status Reports.

A. Deliverable: Facility Preliminary Hardware Deployment Design Document B. Deliverable: Final Hardware Deployment Design Document Hand Hygiene System Sensor Rollout Plan The contractor shall provide a sensor rollout plan

· Guidance and instructions on sensor placement

· Method for taking corrective actions on misplaced sensors, defective sensors, incorrect information in the database, and other errors that can occur during the rollout and commissioning process

· A schedule (not to interrupt business operations) to rollout and commission all hardware

· The Contractor shall also update the CPMP schedule based on any findings from the Site Surveys.

A. Deliverable: Facility Hand Hygiene Sensor Rollout Plan Hand Hygiene Compliance Monitoring System Testing Test Plan The Contractor shall create a VISN Acceptance Test Plan to define testing methodology, test scripts, and test metrics for Product Validation Testing (PVT). Product Validation Testing should occur after installation is complete and prior to training.

A. Deliverable: Hand Hygiene Compliance Monitoring Test Plan Test Report At the completion of each Facility Acceptance Testing, a Facility Test Report should be provided to the COR within 5 days. The COR shall have 10 days to review

A. Deliverable: Facility Hand Hygiene Compliance Monitoring Test Report Hand Hygiene Compliance Monitoring System Training Plan and Schedule The Contractor shall provide onsite training at each Facility following the completion of acceptance testing. It is anticipated that staff from Nursing, Physicians, Nutrition, Facilities and Management, and Clinical Engineering will attend the training sessions conducted at the VA facility. The Contractor shall schedule and complete training events in accordance with the Facility Training Plan.

Training shall run for 8 hours per day for 1 week at each facility and shall be spent either in a small classroom setting or with individuals at workstations. This training is for employees on all different shifts and shall cover User, Super User, and Technical training topics.

To improve system adoption and use, system user training shall also include a train the trainer approach as well as training tip sheets to distribute to staff.

The Contractor shall submit a Training Plan for each VISN Facility for review and approval by the COR. The Training Plan shall include, at a minimum:

· Training locations, training dates, and training times

· Format, method and / or delivery of training (e.g. onsite, web based)

· Training audience (e.g. technical repair, system user, system administrator)

· Instructor profile and content information

A. Deliverable: Facility Training Plan B. Deliverable: Training Materials and Facility Schedule

· Once training is completed, the Contractor shall include in the Monthly Progress report the following:

· Facility-specific list of the attendees for each training session Receiving Report The Contractor shall order and have all the necessary hardware and software components delivered to the specific VISN facility locations. The Contractor shall ensure that a copy of the signed Receiving Report is furnished to the COR once components are delivered. The Contractor shall submit a copy of the final signed Receiving Reports for each Facility and a consolidated VISN summary Receiving Report to include:

· Confirmation of the order and delivery of the components

· Reconciliation (if any) of what was planned to be delivered versus what was delivered

· Details of where items were delivered, what time they were delivered, and who from the Government received them

A. Deliverable: Facility Receiving Report Service Warranty Service The Contractor shall provide Warranty services for one year on all hardware and software following the completion of acceptance testing at each facility. A Facility Warranty Status Report will be delivered in accordance with the start of each warranty period.

A. Deliverable: Warranty Status Report

The Contractor shall provide Database and System Administration services during the warranty period as described in section 6.3.3.

It is anticipated that VA staff members will handle initial trouble calls from end users. Issues, which cannot be resolved by VA staff, will be referred to the contractor by VA technical support staff. Methods for requesting technical support from the contractor shall include telephone and e-mail. The Help Desk shall be staffed from 6am to 8pm. The help desk shall respond to calls within 2 hours after receiving the initial call. The Contractor shall arrive on-site in response to a service call within 12 hours.

Service and Operator Manuals

The vendor shall provide the following documentation for the proposed system:

A. Deliverables:

· Two (2) copies of operator's instruction manuals per facility

· Two (2) copies of complete technical service manuals including detailed troubleshooting guides, necessary diagnostic software, service keys, schematic diagrams, and parts lists per facility

The Contractor should indicate the service requirements for the system. Long term these services should be able to be offered by the Contractor to support the system.

The Contractor shall provide Technical Documentation such as Catalog Cut sheets, Technical specifications on all hardware and parts provided.

General Requirements Enterprise and IT Framework One-VA Technical Reference Model The Contractor shall support the VA enterprise management framework. In a PIV citation with the framework, the Contractor shall comply with OI&T Technical Reference Model (One-VA TRM). One-VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. One-VA TRM includes the Standards Profile and Product List that collectively serves as a VA technology roadmap. Architecture, Strategy, and Design (ASD) has overall responsibility for the One-VA TRM.

Federal Identity, Credential, and Access Management (FICAM) The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), http://www.ea.oit.va.gov/VA_EA/VAEA_TechnicalArchitecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns, http://www.techstrategies.oit.va.gov/enterprise_dp.asp. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in the VA Handbook 6510 and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500 Appendix F, “VA System Security Controls”, and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-04-04, M-05-24, M-11-11, and NIST Federal Information Processing Standard (FIPS) 201-2. OMB Memoranda M-04-04, M-05-24, and M-11-11 can be found at: https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy04/m04-04.pdf, https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-24.pdf, and https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2011/m11-11.pdf respectively. Contractor delivered applications and systems shall be on the FIPS 201-2 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Veteran Index (MVI) to provision identity attributes, if the solution relies on VA user identities. MVI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable design pattern as outlined in VA Enterprise Design Patterns.

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

10. Role Based Access Control.

11. Auditing and reporting capabilities.

12. Compliance with VAIQ# 7712300 Mandate to meet PIV requirements for new and existing systems. https://www.voa.va.gov/DocumentView.aspx?DocumentID=4846

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

Internet Protocol Version 6 (IPV6) The Contractor solution shall support the latest Internet Protocol Version 6 (IPv6) based upon the directives issued by the Office of Management and Budget (OMB) on August 2, 2005 (https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-22.pdf) and September 28, 2010 (https://cio.gov/wp-content/uploads/downloads/2012/09/Transition-to-IPv6.pdf). IPv6 technology, in accordance with the USGv6 Profile, NIST Special Publication (SP) 500-267 (https://www.nist.gov/programs-projects/usgv6-technical-basis-next-generation-internet), the Technical Infrastructure for USGv6 Adoption (http://www-x.antd.nist.gov/usgv6/index.html), and the NIST SP 800 series applicable compliance (http://csrc.nist.gov/publications/PubsSPs.html) shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and/or dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) shall support native IPv6 and/or dual stack (IPv6/ IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and/or dual stack (IPv6/ IPv4) operations. Guidance and support of improved methodologies which ensure interoperability with legacy protocol and services in dual stack solutions, in addition to OMB/VA memoranda, can be found at: https://www.voa.va.gov/documentlistpublic.aspx?NodeID=282.

Trusted Internet Connection (TIC) The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M08-05 mandating Trusted Internet Connections (TIC) (https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2008/m08-05.pdf), M08-23 mandating Domain Name System Security (NSSEC) (https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2008/m08-23.pdf), and shall comply with the Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.0 https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/482/2015/04/TIC_Ref_Arch_v2-0_2013.pdf.

Standard Computer Configuration The Contractor IT end user solution that is developed for use on standard VA computers shall be compatible with and be supported on the standard VA operating system, currently Windows 7 (64bit), Internet Explorer 11 and Microsoft Office 2010. In preparation for the future VA standard configuration update, end user solutions shall also be compatible with Office 365 ProPlus and Windows 10. However, Office 365 ProPlus and Windows 10 are not the VA standard yet and are currently approved for limited use during their rollout, we are in-process of this rollout and making them the standard by OI&T. Upon the release approval of Office 365 ProPlus and Windows 10 individually as the VA standard, Office 365 ProPlus and Windows 10 will supersede Office 2010 and Windows 7 respectively. Applications delivered to the VA and intended to be deployed to Windows 7 workstations shall be delivered as a signed .msi package with switches for silent and unattended installation and updates shall be delivered in signed .msp file formats for easy deployment using System Center Configuration Manager (SCCM) VA’s current desktop application deployment tool. Signing of the software code shall be through a vendor provided certificate that is trusted by the VA using a code signing authority such as Verizon/Cybertrust or Symantec/VeriSign. The Contractor shall also ensure and certify that their solution functions as expected when used from a standard VA computer, with non-admin, standard user rights that have been configured using the United States Government Configuration Baseline (USGCB) and Defense Information Systems Agency (DISA) Secure Technical Implementation Guide (STIG) specific to the particular client operating system being used.

Security and Privacy Requirements

Position/Task Risk Designation Level(s)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity, and the level of background investigation commensurate with the required level of access for the following tasks within the SOW are:

Position Sensitivity and Background Investigation Requirements by Task

The Tasks identified above, and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

Contractor Personnel Security Requirements

Contractor Responsibilities:

1. The Contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain the appropriate Background Investigation, and are able to read, write, speak, and understand the English language.

Within 3 business days after award, the Contractor shall provide a roster of Contractor and Subcontractor employees to the COR to begin their background investigations. The Contractor Staff Roster shall contain the Contractor’s Full Name, Date of Birth, Place of Birth, individual background investigation level requirement. The Contractor shall submit full Social Security Numbers either within the Contractor Staff Roster or under separate cover to the COR. The Contractor Staff Roster shall be updated and provided to VA within 1 day of any changes in employee status, training certification completion status, Background Investigation level status, additions/removal of employees, etc. throughout the Period of Performance. The Contractor Staff Roster shall remain a historical document indicating all past information and the Contractor shall indicate in the Comment field, employees no longer supporting this contract. The preferred method to send the Contractor Staff Roster or Social Security Number is by encrypted e-mail. If unable to send encrypted e-mail, other methods which comply with FIPS 140-2 are to encrypt the file, use a secure fax, or use a traceable mail service.

1. The Contractor should coordinate with the location of the nearest VA fingerprinting office through the COR. Only electronic fingerprints are authorized. The Contractor shall bring their completed Security and Investigations Center (SIC) Fingerprint request form with them (see paragraph d.4. below) when getting fingerprints taken.

b. The Contractor shall ensure the following required forms are submitted to the COR within 5 days after contract award:

1) Optional Form 306

2) Self-Certification of Continuous Service

3) VA Form 0710

4) Completed SIC Fingerprint Request Form

The Contractor personnel shall submit all required information related to their background investigations (completion of the investigation documents (SF85, SF85P, or SF 86) utilizing the Office of Personnel Management’s (OPM) Electronic Questionnaire for Investigations Processing (e-QIP) after receiving an email notification from the Security and Investigation Center (SIC).

The Contractor employee shall certify and release the e-QIP document, print and sign the signature pages, and send them encrypted to the COR for electronic submission to the SIC. These documents shall be submitted to the COR within 3 business days of receipt of the e-QIP notification email. (Note: OPM is moving towards a “click to sign” process. If click to sign is used, the Contractor employee should notify the COR within 3 business days that documents were signed via e-QIP).

1. The Contractor shall be responsible for the actions of all personnel provided to work for VA under this contract. In the event that damages arise from work performed by Contractor provided personnel, under the auspices of this contract, the Contractor shall be responsible for all resources necessary to remedy the incident.

1. A Contractor may be granted unescorted access to VA facilities and/or access to VA Information Technology resources (network and/or protected data) with a favorably adjudicated Special Agreement Check (SAC), completed training delineated in VA Handbook 6500.6 (Appendix C, Section 9), signed “Contractor Rules of Behavior”, and with a valid, operational PIV credential for PIV-only logical access to VA’s network. A PIV card credential can be issued once your SAC has been favorably adjudicated and your background investigation has been scheduled by OPM. However, the Contractor will be responsible for the actions of the Contractor personnel they provide to perform work for VA. The investigative history for Contractor personnel working under this contract must be maintained in the database of OPM.

1. The Contractor shall follow all Government rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations, and shall adhere to all VA Privacy & Security, the Privacy Act and HIPAA requirements.

1. The Contractor, when notified of an unfavorably adjudicated background investigation on a Contractor employee as determined by the Government, shall withdraw the employee from consideration in working under the contract.

Failure to comply with the Contractor personnel security investigative requirements may result in loss of physical and/or logical access to VA facilities and systems by Contractor and Subcontractor employees and/or termination of the contract for default.

Identity Credential Holders must follow all HSPD-12 policies and procedures as well as use and protect their assigned identity credentials in accordance with VA policies and procedures, always displaying their badges, and returning the identity credentials upon termination of their relationship with VA.

A. Deliverable: Contractor Staff Roster

Method and Distribution…