Supplemental_Questionnaire.pdf

Service

A. Implementation

1. Describe the implementation strategy and conversion approach for the proposed solution(s).

2. Describe the Integration Engines proposed solution(s).

3. Provide the expected length of an implementation for the proposed solution(s).

4. Describe the location of your Cloud based SAAS data center and corresponding certifications.

(HITRUST Certified/SOC)

5. Describe the resources required from the customer and your company during the implementation. Indicate roles and skills required.

6. List any approved or recommended consulting organizations that can assist with implementation services.

7. Describe procedures for acceptance testing.

8. What types of operations and support services do you provide once the system is accepted by the customer and in use?

9. Detail any reliance on 3rd party products or services.

10. Are you able to begin implementation within 30 days of the contract being approved by the

County?

11. If your product/solution is offered as a subscription service, how many years in advance do you have funding for? Example – We are fully funded for the next 5 years to offer our solution. Can you provide verification?

12. If your product/solution is based on another company’s technology/solution, list the version you are currently deployed on and where you are on the future upgrade path.

B. Training/Documentation

1. Describe the training needed by the customer to be successful during the implementation. Indicate the length and location of the training and whether it is targeted for the implementation team or end users.

2. Describe the post implementation education services available from your company. Include a discussion of the types of media offered (e.g., classroom, CBT, webinars, Online training).

C. Support Services

1. Provide the Service Level Agreement for support services, including your method for prioritization of incidents as well response time and resolution time key performance indicators.

2. Describe the ongoing support services offered to your customers.

3. Describe the procedure customers follow to report problems. Include a discussion of methods of contacting the support center, the escalation process, and location of support resources. Indicate the availability of support resources after normal business hours.

4. Describe the methods you use to measure customer satisfaction and actions taken based on customer feedback.

5. Describe how updates, enhancements, and new releases are delivered to customers. Indicate how federal and state regulatory changes are made.

6. What is the frequency of software versions and releases?

7. Describe how you engage the user community for input to product development. Indicate the types of user groups and how they interact with your company.

8. Is an Internet-based support portal available to the customer?

9. Is a knowledgebase available for customers to self-service their support questions?

Technical Architecture This section is required for all responders. Please list the requirements of your product/solution.

A. System Infrastructure & Scalability Requirement Yes No Comments

Support a cloud based scalable SAAS web application. Redundant load balanced platform.

For Integration Engine software, provide Common Reporting Tools and Analytics that are compatible with recognized, industry standard reporting tools such as Microsoft SQL, Crystal Reporting, Tableau, NOSQL.

Provide a data dictionary where appropriate.

Database tools are provided to allow end-user access for queries and extraction or output of data into other file formats.

Application exposes data via Web Services.

1. List all platforms from which your application can be hosted and accessed. Examples include

Windows 10/11, Mac OSX, Linux, Android, and iOS.

2. List minimum and ideal workstation specifications to access your application(s).

3. List the Internet browser versions supported (oldest-newest) required for Mac OSX, Windows

Edge, Mozilla Firefox, Google Chrome, Android, iOS.

B. Network Capabilities

Please describe LAN/WAN network requirements, including but not limited to:

1. For hosted solutions, what are the expected steady state and burst condition bandwidth requirements?

2. What are the maximum tolerable latency thresholds for the application(s)?

3. OKTA/SSL/AD versions supported

4. Threads and enhancements to allow more traffic to access IP/Port of solution. Is the solution multi-threaded and is there a max threads amount?

C. Security

Support Role Based Access.

Support task-based and object-based user authorization profiles.

Provide an audit trail that can be used to identify transactions or data accesses that have been performed by:

• Function

• Terminal

• Diagnosis class (e.g. HIV)

• Patient

• Patient Classes (e.g. VIP)

• User

Provide audit log reporting features.

Log all successful and unsuccessful logons and lock out users after a certain number of unsuccessful attempts as defined by the customer.

Provide a “time out” feature that automatically signs off a user if a workstation has been left unattended for a user-defined time period.

Multiple levels of secure access control and user roles to deliver appropriate data to users.

User logins support Active Directory and/or

LDAP.

Ability to support admin capabilities by named login user.

List all ports (TCP, UDP, etc.) required to open for any traffic using the Internet/secure VPN tunnel to support the application(s).

Provide functions to restrict access to specific high profile patient records for individual users.

Authenticate user based upon a minimum of one-factor authentication utilizing one or more of the following in combination with a User

ID:

• Password

• Biometric Identification

• Proximity Controls (RFID)

• Token (e.g., Secure ID)

• MFA

Permit creation of temporary user accounts with specific expiration timeframes.

Permit the security administrator to specify that passwords must adhere to strong password guidelines of no less than eight characters, including at least two of the three following conditions: capital letter, number or special character.

Permit the security administrator to specify that at a minimum the past three passwords cannot be reused for at least one year.

Force a user to select a new password at initial sign-on and when the password has been reset.

Support the encryption of the password file and password information.

Do your products meet or exceed the specification for data in motion or at rest per the HHS “safe harbor provision” of the HIPAA/HITECH Break Notification Rule by the HHS Interim Final Rule (45 CFR, parts 160 and 164)?

Permit Security Administrator to require set up of new passwords based on number of days.

Support Microsoft AD Login methods and security.

1. Discuss the authentication process including encryption and wireless devices.

2. How does your system support single sign-on? Does the application(s) support integration with the Imprivata single sign-on tool?

3. Does the system provide audit logs/error logs to detect unauthorized access or activity?

4. Describe the system components in place that support a user/ client’s adherence to the HIPAA security regulations.

5. Does your system support OKTA (https://www.okta.com/) and Palo Alto Networks routing for user sign in? If so, how does it do so?

D. Interoperability

Provide pre-defined interfaces that expedite interface development time and automatic wizards that can be used to implement model definitions, e.g. XDS.b., CDA

Users can view a display of archived transactions and audit files as well as the transactions as they are being processed.

Provide a custom adapter development kit such as COM or API, making it possible for a user to create utilities and applications that can communicate directly.

Support FHIR R4, R5 Standard and STU3 standard

Support Claims Data and Clinical Data file formats

Provide ability to generate test transactions as well as clear all messages from interface engine channels.

The generation of alert messages can be configured by the time of day and day of week, for each interface via user-defined peak, off-peak and scheduled downtimes.

Alert messages can be sent to any device including cell phones and printers as well as to other interfaces. Alerts can also be configured based on change of interface status, idle time and excessive transaction backlog.

The following data types are supported:

Base64, HL7, XML, ASCII, BLOB, EBCDIC, hex16, hex32, printable, raw, signed binary and unsigned binary.

https://www.okta.com/

Monitoring and troubleshooting tools to identify errors in data transmission.

Error Monitoring provides an alert subsystem which generates alert messages that are stored and viewable online and can be routed via various mechanisms such as e-mail.

Templates exist for various protocol, connection types and interface ports.

1. What tools does your system provide to allow monitoring and guaranteed delivery of your interfaces?

2. Describe the auditing capabilities to verify the counts of records sent or received by your system.

3. List supported Technical Standards such as IHE Profile Support, DIRECT, HL7, DICOM, FHIR

SMART on FHIR, FHIR APIs, XML. Include detailed information if appropriate (e.g. IHE profiles)

4. Does your solution require a EMPI, EMR to add software integration, hooks that another vendor might not have available to them. Example Mirth and Rhapsody.

5. List supported Code Sets such as ICD9, ICD10, LOINC, SNOMED CT,HCPCS, CPT, RxNorm, CDT, NDC, UDX.

Software as a Service (SaaS) This section is required for all responders.

A. Performance Reliability

1. Detail your performance metrics for Service Level Agreements (SLAs) for measuring application availability, performance, and network connectivity. Attach a copy of your SaaS SLA.

2. Detail any tools offered to measure application availability offered to report on real time or historical performance information (uptime, outages, and degradations).

3. Disclose any use of 3rd party server hosting companies. (AWS/Google/Azure)

4. How are sudden demand surges managed without adversely affecting system use?

5. How is planned growth in demand managed without adversely affecting system use?

6. Where are your data centers located? Do you offer backup disaster recovery protection?

7. How are application and server upgrades conducted, scheduled, and communicated to the customer? Who performs the upgrades?

8. Is off-line data access available in the event of a loss of connectivity?

9. Detail your high availability capabilities.

10. Access to Integration Engine from a secure web connection. Is VPN required? SMCHS support personnel will need access from places such as mobile connection, remote work, etc

11. Attach a copy of your disaster recovery plan. Do you have redundancy with multiple data centers in differing geographic locations?

12. Describe your backup and recovery capabilities that ensure prompt and complete data recovery.

13. List the 3rd party security audits such SAS 70, HITRUST, or SSAE 16 immediately available to San Mateo County on demand. (Copies may be included in your Proposal).

B. Security

1. Detail how your organization would respond to a data security breach.

2. Detail the number and roles of your data security personnel.

3. Vendor maintains a well-documented security infrastructure.

4. Detail the level of auditing that is available and what access the customer has to audit logs.

5. Describe any use of incident protection and detection software.

6. Is data encrypted at rest and transmission? How do you compensate for performance implications?

7. Vendor maintains infrastructure standards certification like International Standards

Organization/International Electrical Commission (ISO/IEC 27002).

8. What is the estimated response time from vendor support personnel when contacted by customer regarding security issues?

9. Can the customer’s data be moved among multiple data centers? If so, how is the customer notified?

10. Customer’s data must remain within the United States of America. What audit methods are available to the customer to verify?

11. Do you provide for the delegation of user provisioning administration to the customer?

12. What physical controls exist to manage the ingress/egress of the software production/delivery facility?

Data Sharing, Integration Engine

A. List the name of the software application(s) you are proposing for your solution. Include the base system, any additional modules and whether customizations are required or recommended.

B. List the name(s) of any third-party software applications required to run the proposed software applications. Examples of applications are MS SQL Server, First Data Bank, Crystal Reports, Tableau.

C. Is there a TEST and Production version?

D. Integration Engine is available 24 x 7?

E. Describe the models supported for user authentication.

a. What directory access protocols do you use (e.g. LDAP)?

b. Do you support multi-factor identification?

c. What are the differences in your authentication process over public networks versus over private networks?

d. How are user access privileges determined?

F. Describe each attribute used by your authorization implementation, and how that attribute is used in determination of granting an access request.

G. Access management is a dynamic process and proper management of user privileges is critical.

Please describe your process and timing requirements for the management of user privileges.

Overall Questions

1. What are your Programming and Configuration Capabilities?

2. Do you Interface with programming languages – java, javascript, python, APIs, etc.?

3. What kind of Custom Libraries for building common integration channels/routes and channel/route capabilities?

4. Do you have Open APIs for remote monitoring and configura�on?

5. What are your capabili�es of Deploying in your private cloud, hosted in our cloud, or as an Integra�on Pla�orm as a Service (iPaaS)

6. What are your HL7, FHIR, API Integra�on Capabili�es

7. Describe the Test messaging flow of data from channel/route into interface and scenarios where Integration Engine builds upon EMR message and sends to outside agencies. Example – CAIR, CDC, Public Health, State of California, HIE’s, DxF.