T4NG PWS Sustainment of Blood Bank Maintenance draft for RFI.pdf

TRANSFORMATION TWENTY-ONE TOTAL TECHNOLOGY

NEXT GENERATION (T4NG)

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Software Product Management (SPM)

Sustainment of Blood Bank Maintenance

Date: September 6, 2023

VA-24-00008574

Task Order PWS Version Number: 1.0

Contents

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

3.1 APPLICABILITY

3.2 ORDER TYPE

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

4.2 PLACE OF PERFORMANCE

4.3 TRAVEL OR SPECIAL REQUIREMENTS

4.4 CONTRACT MANAGEMENT

4.5 GOVERNMENT FURNISHED PROPERTY

4.6 SECURITY AND PRIVACY

4.6.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

5.1.2 REPORTING REQUIREMENTS

5.1.3 TECHNICAL KICKOFF MEETING

5.1.4 PRIVACY TRAINING

5.1.5 PRODUCT MANAGEMENT AND OVERSIGHT/KEY PERSONNEL .. Error!

Bookmark not defined.

5.2 SOFTWARE MAINTENANCE SUPPORT

5.2.1 AZURE DevOps

5.2.2 VBECS SOFTWARE DEVELOPMENT SUPPORT

5.2.3 REQUIREMENT REVIEWS SUPPORT

5.2.4 VBECS SOFTWARE RELEASE SUPPORT

5.2.5 SOFTWARE CODE AND DATABASE STRUCTURE SUPPORT

5.2.6 STANDARDS AND TECHNICAL GUIDELINES SUPPORT

5.2.7 DEVELOPMENT CYCLES SUPPORT

5.2.8 VBECS NETWORK CONFIGURATION SUPPORT

5.2.9 SOFTWARE MAINTENANCE TESTING

5.3 QUALITY SYSTEM SUPPORT FOR VBECS

5.3.1 SYSTEM DOCUMENTATION SUPPORT

5.3.2 CHANGE MANAGEMENT SYSTEM SUPPORT

5.3.3 CONFIGURE MANAGEMENT SUPPORT

5.3.4 CHANGE MANAGEMENT COMMITTEE SUPPORT

5.3.5 VBECS TEST DOCUMENTATION SUPPORT

5.3.6 UNIT TESTING SUPPORT

5.4 USER ACCEPTANCE TESTING (UAT) AND INITIAL OPERATING

CAPABILITY (IOC) PHASE

5.4.1 DEVELOPMENT/FUNCTIONAL TESTING

5.4.2 IOC TESTING

5.4.3 IOC DOCUMENTATION SUPPORT

5.4.4 IOC ENTRY EFFORTS

5.4.5 IOC SUCCESSFUL TEST CYCLE COMPLETION

5.4.6 IOC DEFECTS AND ISSUES SUPPORT

5.4.7 REGRESSION TESTING SUPPORT

5.5 FDA MEDICAL DEVICE CERTIFICATION SUSTAINMENT

5.5.1 VBECS COMPLIANCE DOUMENTATION

5.5.2 CORRECTIVE AND PREVENTIVE ACTION (CAPA) SUPPORT

5.5.3 QUALITY SYSTEM AUDIT SUPPORT

5.5.4 FDA 510(k) SUBMISSION DOCUMENTS

5.6 OPTION PERIOD ONE

5.7 OPTION PERIOD TWO

5.8 OPTION PERIOD THREE

5.9 OPTION PERIOD FOUR

5.10 OPTIONal Task Transisition

6.0 GENERAL REQUIREMENTS

6.1 PERFORMANCE METRICS

6.2 SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY

(ICT) STANDARDS

6.2.1 COMPATIBILITY WITH ASSISTIVE TECHNOLOGY

6.2.2 ACCEPTANCE AND ACCEPTANCE TESTING

6.3 ENTERPRISE AND IT FRAMEWORK

6.3.1 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT

(FICAM)

6.4 INFORMATION TECHNOLOGY USING ENERGY-EFFICIENT PRODUCTS . 26

6.4.1 EPEAT

6.4.2 ENERGY STAR

6.4.3 FEMP

ADDENDUM B- VA INFORMATION AND INFORMATION SYSTEM SECURITY /

PRIVACY LANGUAGE

1.0 BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Software Product Management (SPM) strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

SPM is responsible for Blood Bank Services. The purpose of the Health Provider Product Enhancement (HPPE) is to provide maintenance and support in the Blood Bank program, including maintenance and support to Veterans Health Information Systems and Technology Architecture (VistA) Blood Bank v5.2, VistA Blood Establishment Computer Software (VBECS), and interface support to maintain communications with other VistA or vendor applications such as Data Innovations for automated instrument interfacing. Maintenance and support ensure these applications continue to provide effective support to clinicians in delivering patient care, laboratory staff in providing safe blood transfusions, meeting blood bank regulatory agency requirements, and required hospital reporting services.

The primary purpose of VBECS is to automate the daily activities of a hospital transfusion service without causing harm to the Veteran: blood inventory and patient transfusion processing. The major goals of the application are:

1. Improve the safety of blood/blood component transfusions by decreasing the risk of errors through effective use of current technology such as barcode scanning, retrieval of previous records used for comparison, and detection of inconsistencies in data input.

2. Improve the quality of patient care through evaluation of transfusion appropriateness and follow-up on the effectiveness of transfusions.

3. Provide comprehensive reporting capabilities for quality monitoring within the transfusion service and for clinicians.

VBECS facilitates ongoing compliance with the FDA standards for medical devices, enhances VA’s ability to produce high-quality blood products and services to Veterans, and meets the needs of the user community. The system follows blood bank standards, standards of national accrediting agencies, FDA regulations, and VA policies. VBECS software has been classified by the FDA as a Class 2 medical device. Because of that the FDA requires that its Good Manufacturing Practice regulations be followed.

The objective of this acquisition is to continue the support and maintenance of VistA Blood Establishment Computer Software (VBECS). This is VA developed software which is a Class 2 Medical Device that is FDA 510(k) certified to meet the needs of blood banking services to Veterans we serve. VBECS provides each site with an application server and database server to perform automated blood banking duties to eliminate human error.

The major goals of the application are:

1. VBECS Blood transfusion services electronically performs: Cross and Type, utilize Blood Truth Tables, Coombs testing, Antibody Serology Tests, Immediate Spin Crossmatch, patient transfusion processing and blood inventory management.

2. VBECS supplies the healthcare provider with the blood or blood components that will be appropriate to the patient based on the patient history and interactions with blood products.

3. Improve the safety of blood/blood component transfusions by decreasing the risk of errors through effective use of current technology such as VBECS, barcode scanning, VBECS retrieval of previous records used for comparison, and detection of inconsistencies in data input.

4. Improve the quality of patient care through VBECS evaluation of transfusion appropriateness and follow-up on the effectiveness of transfusions.

5. Provide comprehensive reporting capabilities for quality monitoring within the VBECS transfusion service and for clinicians.

Interface expertise is required to maintain communications with VistA and vendor applications such as Data Innovations for automated instruments. Maintenance and support, ensures these applications continue to provide effective support to clinicians in delivering patient care, laboratory staff in providing safe blood transfusions, meeting blood bank Food and Drug Administration (FDA), International Council for Commonality in Blood Bank Automation (ICCBBA), and American Association of Blook Banks (AABB) regulatory agencies regulations, standards, requirements, and required hospital reporting services.

2.0 APPLICABLE DOCUMENTS

The Contractor shall comply with the following documents, in addition to the documents in Paragraph 2.0 in the T4NG Basic Performance Work Statement (PWS), in the performance of this effort:

a. FDA Title 21 Code of Federal Regulation (CFR), Part 11, Electronic Records;

Electronic Signature

b. FDA Title 21 CFR, Part 803, Medical Device Reporting

c. FDA Title 21 CFR, Part 806, Medical Devices; Reports of Corrections and

Removals

d. FDA Title 21 CFR, Part 820, Quality System Regulation

e. FDA Title 21 CFR, Part 821, Medical Device Tracking Requirements

f. VA Directive 6066, “Protected Health Information (PHI) And Business Associate

Agreements Management”, September 2, 2014 Contractor shall follow FDA Title 21 CFR Part 11, Part 803, Part 806, Part 820, and Part 821 regulations, VA PAL, and internal project procedures which follows the FDA Title 21 CFR regulations addressed in Paragraph 2.0 Applicable Documents.

3.0 SCOPE OF WORK

The Contractor shall support the sustainment and maintenance of the Blood Bank application and all VBECS systems for IT product maintenance, sustaining patch releases, system testing, system administration, configuration management, all system documentation, ServiceNow (SNOW) ticket resolution and disaster recovery solutions.

These systems are currently hosted in the Azure cloud environment. Sustainment and maintenance support includes assessing and complying with updates from AABB Standards, ICCBBA Standards, software maintenance support, testing, network support, quality system support, and FDA 510(k) Class 2 medical device certification sustainment.

3.1 APPLICABILITY

This TO effort PWS is within the scope of the following T4NG Basic PWS paragraphs:

4.1 Program Management, Strategy, Enterprise Architecture and Planning Support

4.2 Systems/Software Engineering

4.4 Test & Evaluation (T&E)

4.8 Operations and Maintenance (O&M)

3.2 ORDER TYPE

The effort shall be proposed on a Firm Fixed Price (FFP) basis.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The period of performance (PoP) shall be 12 months from date of award with four 12-month option periods. Any work at the Government site shall not take place on Federal Holidays or weekends unless directed by the Contracting Officer (CO).

Under current definitions, five are set by date: including one new by date Juneteenth.

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October

Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

Efforts under this TO shall be performed in Contractor provided facilities located at remote locations and when required at Hines Office of Information Field Office (OIFO), Hines, IL 60141. During FDA audits, internal, and external audits contractor staff will be required to work at the Hines VA facility based on requirements of the VA PM. Work may be performed at remote locations with prior concurrence from the Contracting Officer’s Representative (COR). The Contractor shall identify the Contractor’s place of performance in their Task Execution Plan submission.

4.3 TRAVEL OR SPECIAL REQUIREMENTS

Travel shall be in accordance with the Federal Travel Regulations (FTR) and requires advanced concurrence and approval by the Contracting Officer’s Representative (COR).

Travel and per diem shall be reimbursed in accordance with FTR. Each Contractor invoice must include copies of all receipts that support the travel costs claimed in the invoice. Local travel within a 50-mile radius from the Contractor’s normal duty location is considered the cost of doing business and will not be reimbursed. This includes travel, subsistence, and associated labor charges for travel time. Travel performed for personal convenience and daily travel to and from work at the Contractor’s facility will not be reimbursed. Travel, subsistence, and associated labor charges for travel time for travel beyond a 50-mile radius of the Contractor’s facility are authorized on a case-by-case basis and must be pre-approved by the COR. The Government anticipates travel to perform the tasks associated with the effort, as well as to attend program related meetings, inspections, or conferences throughout the PoP of the base and each option period. Include all estimated travel costs in your firm-fixed price line items.

Round Trip Location Number of Trips

Number of Persons

Number of Days

Hines VAMC, IL 5 5 5

4.4 CONTRACT MANAGEMENT

All requirements of Sections 7.0 and 8.0 of the T4NG Basic PWS apply to this effort.

This TO shall be addressed in the Contractor’s Progress, Status and Management Report as set forth in the T4NG Basic contract.

4.5 GOVERNMENT FURNISHED PROPERTY

The Government has multiple remote access solutions available to include Citrix Access Gateway (CAG), Site-to-Site Virtual Private Network (VPN), and RESCUE VPN.

The Government’s issuance of Government Furnished Equipment (GFE) is limited to Contractor personnel requiring direct access to the network to: development environments; install, configure and run Technical Reference Model (TRM) approved software and tools (e.g., Oracle, Fortify, Eclipse, SoapUI, WebLogic, LoadRunner);

upload/download/ manipulate code, run scripts, and apply patches; configure and change system settings; check logs, troubleshoot/debug, and test/QA.

When necessary, the Government will furnish desktops or laptops, for use by the Contractor to access VA networks, systems, or applications to meet the requirements of this PWS. The overarching goal is to determine the most cost-effective approach to providing needed access to the VA environment coupled with the need to ensure proper Change Management principles are followed. Contractor personnel shall adhere to all VA system access requirements for on-site and remote users in accordance with VA standards, local security regulations, policies, and rules of behavior. GFE shall be approved by the COR and Program Manager on a case-by-case basis prior to issuance.

Based upon the Government assessment of remote access solutions and requirements of this TO, the Government estimates that the following GFE will be required by this TO:

1. Six (6) standard laptops

2. Eleven (11) developer-grade laptops

The Government will not provide IT accessories including but not limited to Mobile Wi-Fi hotspots/wireless access points, additional or specialized keyboards or mice, laptop bags, extra charging cables, extra Personal Identity Verification card readers, peripheral devices, or additional Random Access Memory (RAM). The Contractor is responsible for providing these types of IT accessories in support of the TO as necessary and any VA installation required for these IT accessories shall be coordinated with the COR.

The Status of Government Furnished Equipment Report under the T4NG Basic Contract requirements is applicable to this TO and shall be delivered to the COR/VA PM as required.

4.6 SECURITY AND PRIVACY

All requirements in Section 6.0 of the T4NG Basic PWS apply. Addendum B requirements have been tailored to reflect the security and privacy requirements of this specific TO.

It has been determined that protected health information may be disclosed or accessed, and a signed Business Associate Agreement (BAA) shall be required. The Contractor shall adhere to the requirements set forth within the BAA, referenced in Section D of the Request for Task Execution Plan (RTEP) and shall comply with VA Directive 6066.

4.6.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity, and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Position Sensitivity and Background Investigation Requirements by Task

Task Number Tier1 / Low Risk Tier 2 / Moderate Risk

Tier 4 / High Risk

5.1 5.2 5.3 5.4 5.5

The Tasks identified above, and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of this TO effort. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the TO.

The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

5.1.2 REPORTING REQUIREMENTS

The Contractor shall deliver Bi-Weekly (every two weeks) VBECS Status Reports.

These reports shall provide accurate, timely, and complete project information supporting VBECS reporting requirements. The Bi-Weekly VBECS Status Report shall include the following data elements:

1. Overarching Project Name and PWS Name

2. Overview and description of the PWS

3. Overall high-level assessment of Contractor progress

4. Current schedule overlaid on initial schedule showing any delays or advancement in schedule.

5. Current definition of user requirements / function points overlaid over the original function points and the last reported function points to specifically identify changes in the function points to be delivered since the previous report.

6. Workforce staffing data showing all Contractor personnel performing on the effort during the current reporting period. After the initial labor baseline is provided, each Bi-Weekly VBECS Status Report shall identify any changes in staffing identifying each person who was added to the contract or removed from the contract.

7. Original schedule of deliverables and the corresponding deliverables made during the current reporting period.

These reports shall not be the only means of communication between the Contractor, COR, and the Program/Product Manager to advise of performance/schedule issues and to develop strategies for addressing the issues. The Contractor shall continuously monitor performance and report any deviation from the CPMP or previous Bi-Weekly VBECS Status Report to the COR and Program/Project Manager during routine, regular communications.

Deliverable:

A. Bi-Weekly VBECS Status Report

5.1.3 TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after TO award. The Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five (5) calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the Sustainment of Blood Bank Maintenance Effort. The Contractor shall submit the final updated presentation to the CO for review and signature within three (3) calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR and all attendees within three (3) calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

Deliverables:

A. Draft and Final Agendas B. Draft and Final PowerPoint Presentation C. Draft and Final Meeting Minutes

5.1.4 PRIVACY TRAINING

The Contractor shall submit status of VA TMS Privacy and Information Security Awareness training for all individuals engaged on the task. The status reporting shall identify the following: a single Contractor Security point of contact (POC), the names of all personnel engaged on the task, their initial training date for VA Privacy and Information Security training, and their next required training date. This information shall be submitted as part of the Bi-Weekly VBECS Status Report delivered in Section 5.1.2.

The Contractor shall submit VA Privacy and Information Security Training Certificates in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”.

The Contractor shall expedite all requests for information or documents related to background checks, Personal Identity Verification (PIV) card application forms, project training, and any other artifacts that must be generated or shared for Contractors to be on boarded for this TO. The Contractor Project Manager shall be responsible for coordinating and completing all on boarding to facilitate a rapid state of readiness.

Deliverables:

A. VA Privacy and Information Security Training Certificates

5.2 SOFTWARE MAINTENANCE SUPPORT

For the sustainment of Blood Bank Maintenance Program and maintenance of VistA Blood Bank Version 5.2 and VBECS, the Contractor shall follow the edict of FDA Good Manufacturing Practices and quality standards for medical devices (refer to Paragraph 2.0 Applicable Documents). The Contractor shall meet the regulations and processes specified within this PWS immediately upon award of this TO. The project schedule does not allow time for training Contractor resources on tools or regulations/processes. The Contractor shall ensure that all software is free from identified patient safety deficiencies (defined as direct or indirect injury to a Veteran patient) that arise within the scope of the project/assignment. The Government will not provide training on the pre-existing VBECS application. The Contractor shall not utilize the reverse engineering methodology to reproduce source code to enhance its functionality as an approach under this effort.

5.2.1 AZURE DevOps

The Contractor shall use VA’s implementation of Azure DevOps to provide a single Need to review Agile project/product lifecycle management tool to track execution details. The Azure DevOps/Product Data and Artifact Repository will be used to provide a single authoritative project and product data and artifact repository. All OIT project data and artifacts shall be required to be managed in this data and artifact repository daily. All checked out artifacts shall be checked back in daily, and any data updated daily. Azure DevOps synchronizes all changed information immediately for all team members to access work proficiently without the concern of working on aged information.

The Contractor shall use Azure DevOps tools in accordance with the VA Guidelines to:

1. Input and manage project/product risks and issues.

2. Input and manage project/product configurations and changes.

3. Input and manage project/product test plans and execution.

4. Input and manage project/product planning and engineering documentation.

5. Input and manage linkages to correlate requirements to change orders to configurable.

6. Items to risks, impediments, and issues to test cases and test results to show full traceability.

The Contractor shall show all requirements, changes, tests performed and test results in Azure DevOps to show evidence of code coverage and test coverage of all the requirements specified. This requirement will allow VA to have high confidence in a fully documented, as evidenced by data in the tools, requirements traceability matrix. This information shall be submitted as part of the Bi-Weekly VBECS Status Report delivered in Section 5.1.2.

5.2.2 VBECS SOFTWARE DEVELOPMENT SUPPORT

The Contractor shall support and maintain all VBECS software created in Microsoft .NET Framework v.4.5 (using C#), a Microsoft SQL Server 2016 Service Pack (SP) 4 database (with AlwaysOn), stored procedures, with HL7 version 2.3, 2.4, 2.5, and 2.6 interfacing, hosted in Microsoft Azure Government Cloud using virtualization with a Microsoft Server 2016 data center (x64) server operating system. The VBECS infrastructure also utilizes Microsoft Windows Services, Clustering, Azure monitoring, JIRA, VistA Blood Bank v5.2, GitHub CodeQL and/or Fortify. VBECS is in use at 135 VHA medical facilities. The Contractor shall respond to and resolve all questions and complaints lodged against the VBECS software (approximately 800 per year) in the VA approved complaint handling tool (ServiceNOW) within 24 hours of notification unless it requires software code changes. The Contractor shall conduct risk assessments on these changes to set priority and resolve software changes in the next available software release. The Contractor shall follow an Agile methodology and follow the Veteran-focused Integration Process (VIP) established by OIT SPM. The Contractor shall comply with any applicable VA/Veterans Health Administration (VHA) or other Government mandates, as necessary. The Contractor shall deliver VBECS Releases into a production environment at a minimum every 90 days. Meeting this delivery schedule is critical.

A. VBECS software releases

5.2.3 REQUIREMENT REVIEWS SUPPORT

The Contractor shall plan, schedule, and conduct requirement review meetings with VA stakeholders to analyze, refine, and translate the requirements into Agile epics, user stories, and acceptance criteria. The Contractor shall document and maintain the epics, user stories, and acceptance criteria throughout the PoP in the VA identified software (JIRA). The Contractor shall conduct a detailed requirements analysis and make recommendations as to the most effective technical approach to accomplishing/implementing VA’s requirements. The Contractor shall populate and maintain an Agile Product Backlog. The priority of the items on the product backlog shall be determined based on input from the VA PM. The Contractor shall ensure that the VA PM has access to the current product backlog throughout the PoP. The Contractor shall plan and execute Agile sprints every three weeks. Prior to each sprint, the Contractor and VA shall meet to review the status of the product backlog and finalize the sprint goals. The Contractor shall revise, document, test, and support the VBECS application at a minimum every 90 days with VBECS Releases which can include source code, system configuration, executable code, and/or database updates. The Contractor shall support and maintain VBECS releases after release and assist with implementation by resolving problems that arise during the deployment.

Deliverables:

A. Updated Agile Product Backlog

5.2.4 VBECS SOFTWARE RELEASE SUPPORT

The Contractor shall revise, document, test, and support the VBECS software. The Contractor shall support and maintain VBECS releases after release and assist with implementation by resolving problems that arise during the deployment. The Contractor shall revise and maintain (per VBECS release) all Software Design Documents (SDD), Database Model, architecture documents (Application Architecture, Hardware and Infrastructure, Security Architecture, and Disaster Recovery Architecture), System Interface Descriptions, ATO documentation , Technical Manual-Security Guide, Installation Guide, System Security Plan, Operations and Maintenance Plan, Disaster Recovery Plan, Development System Configuration Log, to document VBECS project releases. The Contractor shall conduct software tool validation (assessed monthly), system performance testing, installation and integration testing, and disaster recovery testing for each release (twice yearly). The Contractor shall create, test, and release Monthly Security Patch Releases and VBECS releases. The Contractor shall follow the Agile methodology and VIP guidelines for all software development. Releases shall include Source Code, Executable Code, Databases, and Executable Database Code.

Additionally, the need may arise for a patient safety critical release which shall require an accelerated schedule. Historically, there has been one patient safety critical release within three years.

A. Updated Software Design Documents (SDD)

B. Updated Application Architecture Document C. Updated Hardware and Infrastructure Document D. Updated Security Architecture Document E. Updated Disaster Recovery Architecture Document F. Updated System Interface Descriptions G. Updated ATO documentation H. Updated Technical Manual-Security Guide I. Updated Installation Guide J. Updated System Security Plan K. Updated Operations and Maintenance Plan L. Updated Disaster Recovery Plan M. Updated Development System Configuration Log

5.2.5 SOFTWARE CODE AND DATABASE STRUCTURE SUPPORT

The Contractor shall ensure that any changes to the software code and database structure meets the business and technical requirements in accordance with internal project documents which follows the FDA regulations addressed in Paragraph 2.0 Applicable Documents and adheres to the existing requirements and design of the software. The contractor will provide an Updated Database Model for each release.

The Contractor shall scan all software releases with Fortify or other VA approved static code analysis tool as defined by the TRM and confirm that no code vulnerabilities have been created within a Release. For informational purposes, the current VBECS business requirements comprise approximately 103 Use Cases, 1,109 Business Rules, 50 Maintenance Business Rules,104 Software Design Documents, and 289 individual Hazard Analysis cause IDs, fully traced into the implemented code. There are over 550,000 lines of code in VBECS with another 92,000+ lines of code operation within the database. Additionally, there are over 25,000 lines of code that requires support of the custom VBECS Provisioning tool. The Contractor shall create, test, and release Monthly Security Patch Releases. The Contractor shall follow the Agile methodology and VIP guidelines for all software development. Additionally, the need may arise for a patient safety critical release which shall require an accelerated schedule.

Deliverables:

A. Updated Database Model

5.2.6 STANDARDS AND TECHNICAL GUIDELINES SUPPORT

The Contractor shall comply with all standards and technical guidelines for programming and software security defined in internal project documents to include the FDA Quality System Regulations (QSR), FDA Current Good Manufacturing Practices (CGMP), Federal Information Security Management Act (FISMA), Health Insurance Portability and Accountability Act (HIPAA), National Institute of Standards and Technology (NIST), VA VIP, and VA PAL. The Contractor shall deliver all System Documentation outlined above as required to comply with VIP milestone reviews. The Contractor shall ensure that all software tools used to support VBECS are VA approved.

The list of approved tools is available at http://www.va.gov/trm/TRMHomePage.asp.

Prior approval in writing by the COR shall be required to use a non-approved tool.

5.2.7 DEVELOPMENT CYCLES SUPPORT

All development cycles shall be referred to as a build. Builds shall never exceed three months (90 calendar days) planned length but can be of a shorter duration. The Contractor must deliver customer facing functionality into production prior to the end of each build, this is a mandatory VIP requirement. A build would be considered on-time if the functionality passed User Acceptance Testing (UAT) and Initial Operating Capability (IOC) testing, was accepted by the Product Owner, and was placed into a Production environment before the end of the 90-day build cycle. The Contractor must provide the source code for every build that is developed to the SPM Open-Source Coordination Office.

Deliverables:

A. Source Code

5.2.8 VBECS NETWORK CONFIGURATION SUPPORT

The Contractor shall adjust VBECS network configurations in accordance with standards issued by VA Operations. This shall include changes to VBECS Virtual Local Network (VLAN) settings, Active Directory, Windows Updates and Virus Definition releases. The Contractor shall create ESECC requests as required to request changes in the VBECS network in support of such things as access to instrument manager servers for automated instruments.

Deliverables:

A. ESECC Requests B. Updates to Active Directory C. Updates to Windows D. Updates to Virus Definitions E. Updates to VLAN Settings

5.2.9 SOFTWARE MAINTENANCE TESTING

The Contractor shall test monthly security patch releases. The Contractor shall test all software releases. The Contractor shall perform unit, integration, load, performance, and system testing on the software in accordance with internal project processes (following FDA references) and VA PAL. The Contractor shall conduct this risk-based testing on all VBECS releases to verify the patch is functional and compatible with the deployed software and the VA IT Network without negatively affecting the performance of either system. The Contractor shall provide a Unit Testing Validation Protocol, Unit Test Plan, Unit Test Cases, Unit Test Report and Validation Report. The Contractor shall analyze the Unit Test Report and create a Critical Areas to Code Coverage Report

A. Unit Testing Validation Protocol B. Unit Test Plan C. Unit Test Cases D. Unit Test Report E. Validation Report F. Critical Areas to Code Coverage Report

5.3 QUALITY SYSTEM SUPPORT FOR VBECS

The Contractor shall keep all System Documentation current and up to date to meet FDA regulations addressed in Paragraph 2.0 Applicable Documents.

The Contractor shall develop, review and/or revise VBECS System Documentation as part of this maintenance with input from VA analysts, VA stakeholders, and VA project staff as required.

5.3.1 SYSTEM DOCUMENTATION SUPPORT

The Contractor shall follow internal procedures which follow the FDA regulations addressed in Paragraph 2.0 Applicable Documents to organize and facilitate reviews of documents (such as above), along with reviewing SDD and technical documents updated by developers with members of the project team and record meeting notes.

The Contractor will develop and update the following:

a. User Guides – Review and update existing.

b. Use Cases (UC) – Develop new UCs. Review and update existing.

c. Maintenance Use Cases (MUC) – Review and update existing.

d. Business Rules (BR) – Review and update existing.

e. Maintenance Business Rules (MBR) –Review and update existing.

f. Truth Tables (TT) – Review and update existing.

g. Hazard Analysis Cause IDs (HA) – Review and update existing.

h. VBECS Application Interface Specification – Review and update existing.

i. Technical Manual Security Guide – Review and update existing.

j. Installation Guide – Review and update existing.

k. VBECS Online Help – Review and update existing.

l. System Security Plan – Review and update existing.

m. Operations Acceptance Plan – Review and update existing.

n. Operations and Maintenance Plan – Review and update existing.

o. Release Notes – Create new with each release.

p. Requirements – Create and update existing

q. Requirements Traceability Matrix

r. Phase Review Checklist

s. VBECS Test Documentation

Deliverables:

A. Updated User Guides B. Updated Use Cases C. Updated Maintenance Use Cases

D. Updated Business Rules E. Updated Maintenance Business Rules F. Updated Truth Tables G. Updated Hazard Analysis Cause IDs H. Updated VBECS Application Interface Specification I. Updated Technical Manual Security Guide J. Updated Installation Guide K. Updated VBECS Online Help L. Updated System Security Plan M. Updated Operations Acceptance Plan N. Updated Operations and Maintenance Plan O. Updated Release Notes P. Updated Requirements Q. Updated Requirements Traceability Matrix R. Updated Phase Review Checklist S. Updated VBECS Test Documentation

5.3.2 CHANGE MANAGEMENT SYSTEM SUPPORT

The Contractor shall maintain the existing VA electronic change management system, electronic document storage system, and a hard copy archive of project documents required above for medical device manufacturers. The hardcopy files are kept at the location described in Paragraph 4.2. The Contractor shall also deliver all project documentation required to comply with VA VIP milestone reviews and potential FDA 510(k) submissions.

Deliverables:

A. Hard copy files stored at location described in Paragraph 4.2

5.3.3 CONFIGURE MANAGEMENT SUPPORT

The Contractor shall perform configuration management on project tools for controlling software and document configuration that is traceable from requirement to implementation in the software. Project tools may include software development tools such as Microsoft Visual Studio, JIRA, Red Gate, Araxis Merge, Toad, xUnit, NCover, and NUnit which are used on VBECS systems, and its processes, 31 Internal Operating Procedures (IOP) and 81 Work Instructions (WI), development and testing environments (VA owned comprised of 10 VBECS and 10 VistA accounts.

Deliverables:

A. Updated IOPs B. Updated WIs C. Updated Development and Testing environments

5.3.4 CHANGE MANAGEMENT COMMITTEE SUPPORT

The Contractor shall hold weekly Change Management Committee meetings with the PM and project team leads to review change task created in Azure DevOps and document meeting notes and action items. The Contractor shall manage the assignment and closure of action items from the Change Management Committee meetings. The Contractor shall update and maintain a business Requirements Traceability Matrix. The Contractor shall conduct phase review audits and provide a completed Phase Review Checklist of the project at the conclusion of each phase of the software development life cycle (initiation phase, development phase, optimization phase, and implementation phase.

Deliverables:

A. Weekly Change Management Committee (CMC) Meeting B. Meeting Minutes for weekly CMC meeting C. Action items from CMC Meetings

5.3.5 VBECS TEST DOCUMENTATION SUPPORT

The Contractor shall analyze business requirements to conduct Development, Functional, Independent Verification and Validation (IV&V), Full Integrated System Performance Testing, Load Testing, Regression Testing, IOC Testing, and Security Testing The following VBECS Test Documentation will need to be created or updated:

a. Master Test Plan (update)

b. Validation Protocols (create)

c. Test Cases (Approximately 233 total exist. New test cases shall be created as needed for the releases.)

d. Requirements to Testing Tracing (update)

e. Validation Reports (create).

Deliverables:

A. Updated Master Test Plan B. Updated Validation Protocols C. Updated Test Cases D. Updated Requirements to Testing Tracing E. Updated Validation Reports

5.3.6 UNIT TESTING SUPPORT

The Contractor shall utilize Unit Testing which are used on project owned servers and follow FDA Title 21 CFR Part 11, Part 803, Part 806, Part 820, and Part 821 regulations, and internal project procedures which follows the FDA Title 21 CFR regulations addressed in Paragraph 2.0 Applicable Documents to validate 100 percent testing coverage of business rules and hazards. The Contractor shall conduct risk-based integration, load, performance, and system testing on each software release candidate to verify enhancement functionality and that the content did not alter VBECS system behavior.

5.4 USER ACCEPTANCE TESTING (UAT) AND INITIAL OPERATING

CAPABILITY (IOC) PHASE

The Contractor shall deploy the software to the UAT environment and provide technical support for the maintenance of the environment for the duration of the tests. The Contractor shall work with the VA Business to provide technical support in UAT and incorporate the results into Azure DevOps.

The Contractor shall perform the following:

1. Development/Functional Testing

2. Regression Testing

5.4.1 DEVELOPMENT/FUNCTIONAL TESTING

The Contractor shall provide technical support for the following:

1. UAT

2. Independent Verification and Validation (IV&V) testing

3. Joint testing between External Partners and VA

4. Full Integrated System Performance Testing

5. Load Testing

6. Cybersecurity Testing

7. IOC testing

8. Regression Testing

The Contractor shall perform and coordinate Development system testing. The Contractor shall include all Development tests. The Contractor shall provide all Test Cases/Scripts and provide Test Results documentation, to include a status of all testing and all relevant metrics.

Deliverables:

A. Unit Testing Validation Protocol B. Unit Test Plan C. Unit Test Cases D. Unit Test Report E. Validation Report F. Critical Areas to Code Coverage Report

5.4.2 IOC TESTING

The Contractor shall conduct IOC testing for all VBECS releases. IOC shall be conducted virtually at VA-approved test site(s) in accordance with the PAL process which requires no less than a 45-day notice from the Contractor to the COR prior to testing for the COR to help secure Memorandums of Understanding (MOU) from field test sites. IOC shall be conducted using formal Government Acceptance Test policies and procedures as defined in VIP. IOC shall be witnessed by the COR or a representative, designated in writing by the COR.

The Contractor shall deliver a Test Evaluation Report after completion of IOC.

Deliverables:

A. Test Evaluation Report

5.4.3 IOC DOCUMENTATION SUPPORT

The Contractor shall deliver project documentation that includes a Deployment Plan, Release Notes, Updated Installation Guide, Updated User Guide, and Updated Technical Manual Security Guide prior to the start of IOC. Additionally, the Contractor shall update the Installation Guide, User Guide, and Technical Manual-Security Guide at the completion of the IOC, for each release.

5.4.4 IOC ENTRY EFFORTS

The Contractor shall support IOC Entry efforts to include patch notification messages and patch installation tracking. The Contractor shall respond to any defects and/or errors that result from IOC within 5 business days, including all Security defect resolutions. This may require the Contractor to provide revised software code, repeat testing, and respond to all defects that are found until IOC completes with customer acceptance of the release.

Deliverables:

A. Updated Deployment Plan B. Updated Release Notes C. Updated Installation Guide D. Updated User Guide E. Updated Technical Manual Security Guide F. IOC Entry Request

5.4.5 IOC SUCCESSFUL TEST CYCLE COMPLETION

Following successful completion of the IOC test cycle, the Contractor shall update and finalize all project documentation and deliverable products and make final, formal delivery to VA of Updated Software Code, materials, manuals, user guides, and release notes. All project documentation and deliverable products shall be delivered to the COR as required in the Schedule of Deliverables for acceptance. If any discrepancies are found, the Contractor shall resolve all discrepancies.

Deliverables:

A. Updated Installation Guide B. Updated User Guide C. Updated Technical Manual-Security Guide D. IOC Exit Summary

5.4.6 IOC DEFECTS AND ISSUES SUPPORT

The Contractor shall resolve and track all defects, as well as address all issues and questions identified during IOC. For each defect identified, the Contractor shall log the defect, identify a resolution for the defect, and provide a Defect Resolution Plan, including timeline and impacts to the schedule, software code, and documentation.

Following COR approval of the plan, the Contractor shall execute the approved plan. At the completion of each defect correction, the Contractor shall deliver a Defect/Fix Status Report and shall make delivery of any updates to the Software Source Code, coordinate the installation of the software update into the test site production accounts, and deliver updated documentation as applicable (User Guides, Technical Manual-Security Guide, Installation Guide, VBECS Online Help, and Release Notes). After any defect correction during IOC, IOC shall continue with the updated Software Source Code for a minimum of five (5) days error free before exiting IOC as agreed upon with the COR.

Deliverables:

A. Defect Resolution Plan B. Defect Fix/Status Report C. Updated Software Source Code D. Updated User Guides E. Updated Technical Manual-Security Guide F. Updated Installation Guide G. Updated VBECS Online Help H. Updated Release Notes

5.4.7 REGRESSION TESTING SUPPORT

The Contractor shall develop and execute implementation plans, plan for contingencies during a release of software, and support all aspects of software deployment within the development/test platform, pre-production, and production platform during the IOC Phase. This shall include installing new product builds in development/test platforms, providing new product builds to VA for pre-production and production platforms, and tracking installation of product builds into pre-production and production platforms for IOC testing. The Contractor shall deliver the IOC Entry Request and Exit Summary prior to the IOC entry meeting. The Contractor shall deliver the updated IOC Entry Request and Exit Summary and the Package/Patch Completion Transition Document after the successful completion of IOC. The Contractor shall also deliver Lessons Learned, the National Deployment Addendum Issues Brief, and the Software Release Request after successful completion of IOC.

Deliverables:

A. Package/Patch Completion Transition Document B. Lessons Learned C. Software Release Requests

5.5 FDA MEDICAL DEVICE CERTIFICATION SUSTAINMENT

The Contractor shall comply with all standards and technical guidelines for programming and software security defined in FDA Title 21 CFR Part 820 regulations.

The Contractor shall have technical proficiency in the technologies and FDA 510(k) submissions end Quality System Management Reviews listed in PWS Section 1.0. A new 510(k) submission is required for changes or modifications to an existing device that could significantly affect the safety or effectiveness of a device, or for devices that are to be marketed for a new or different indication for use. 510(k) submissions are required for any significant release such as a database change. Some releases will require a 510(k) submission and others will not.

5.5.1 VBECS COMPLIANCE DOUMENTATION

The Contractor shall review, revise, and follow VBECS documentation to ensure compliance with FDA Title 21 CFR Part 803, Part 806, and Part 820 regulations. This includes review and revision of Internal Operating Procedures (reviewed and revised annually), and Work Instructions (8-10 per year) with input from analysts, stakeholders, and VA staff (project analyst and project compliance officer).

Deliverables:

A. Updated Internal Operating Instructions B. Updated Work Instructions

5.5.2 CORRECTIVE AND PREVENTIVE ACTION (CAPA) SUPPORT

The Contractor shall apply the established Corrective and Preventive Action (CAPA) Processes that include identifying and resolving new CAPA events resulting in a CAPA Investigations Report (1-2 per month), a CAPA Report (2 per year), and a CAPA Management Report, which summarizes the CAPA report for VA management (2 per year) to monitor and report on continuous quality improvement activities.

Deliverables:

A. CAPA Investigations Report B. CAPA Report C. CAPA Management Report

5.5.3 QUALITY SYSTEM AUDIT SUPPORT

The Contractor shall facilitate at least one annual audit of the quality system. The audit shall be conducted by individuals not having direct responsibility for the area audited to assure compliance with FDA regulations. The Contractor shall create a Response to any Audit Report detailing the corrective actions the project intends to take to come back into compliance. The Contractor shall perform corrective actions for audit findings and re-audit any deficiencies.

A. Response to Audit report B. Corrections for audit findings

5.5.4 FDA 510(k) SUBMISSION DOCUMENTS

The Contractor shall prepare the FDA 510(k) Submission Documents required to start any FDA 510(k) Submission for PM review and PM submission and support the FDA review process.

Deliverables:

A. All VBECS FDA Submission Documents

5.6 OPTION PERIOD ONE

All tasks in the following sections shall apply: 5.1 through 5.5, and all subsections (except 5.1.3 which pertains to the base period only).

5.7 OPTION PERIOD TWO

All tasks in the following sections shall apply: 5.1 through 5.5, and all subsections (except 5.1.3 which pertains to the base period only).

5.8 OPTION PERIOD THREE

All tasks in the following sections shall apply: 5.1 through 5.5, and all subsections (except 5.1.3 which pertains to the base period only).

5.9 OPTION PERIOD FOUR

All tasks in the following sections shall apply: 5.1 through 5.5, and all subsections (except 5.1.3 which pertains to the base period only).

5.10 OPTIONAL TASK TRANSISITION

The Contractor shall provide a plan for 30 days of outgoing transition for transitioning work from the current contract to a follow-on contract/order or Government entity. This transition may be to a Government entity or to another Contractor. In accordance with the Government approved plan, the Contractor shall assist the Government in planning and implementing a complete transition from this contract to the successful offeror in the follow-on contract/task order for the VBECS effort. The transition shall include formal coordination with Government staff and successor staff and management. It shall also include delivery of copies of existing policies and procedures, and delivery of required metrics and statistics. This transition plan shall include, but is not limited to:

1.…