VA118-17-R-2324-002.docx

VA Electronic Health Record Modernization System Basic PWS

Performance Work Statement (PWS) for the

VA Electronic Health Record Modernization System

DATE: October 5, 2017 Final Version 1.7 Department of Veterans Affairs

Contents

Background This Performance Work Statement (PWS) establishes the requirements for Contractor-provided solutions in support of an enterprise-wide Department of Veterans Affairs (VA) Electronic Health Record (EHR). VA is replacing its current EHR, Veterans Information Systems and Technology Architecture (VistA) with a commercial EHR to modernize VA EHR processing and to promote interoperability of medical data between the Department of Defense (DoD), VA and community providers. When implemented, the EHR System will provide access to authoritative clinical data sources, and over time become the authoritative source of clinical data to support improved population health, patient safety, and quality of care provided by VA.

The Contractor shall provide a total EHR solution including the following: program management, an enterprise-wide EHR system, change management, training, testing, deployment services, sustainment and other solutions encompassing the entire range of EHR requirements, to include but not be limited to hosting, software, and hardware incidental to the solution. Accordingly, Task Orders (TOs) may include acquisitions of software and information technology (IT) products as well as the services required to implement the EHR solution across VA. For purposes of this PWS, the VA EHR solution will be referred to as the VA Electronic Health Record Modernization system (EHRM).

EHRM is based on the electronic health record acquired by the Department of Defense known as the MHS GENESIS system, which is at its core, Cerner Millennium. The adoption of a single joint system between VA and DoD will allow all patient data to reside in a common system to have a seamless link between the DoD and VA. The DoD authorized system will be augmented to include additional functionality to meet VA requirements. Over time, the goal is the creation of an integrated inpatient and outpatient solution with software components that have been designed, integrated, maintained, and deployed with a design architecture that allows for access to and sharing of common data, common user interface, common workflows, common business rules, and common security framework that supports end-to-end healthcare related clinical and business operations.

EHRM is not intended as a mechanism to solely purchase IT products. Such products may be purchased to the extent that those products are necessary to deliver the solution required. These services, as well as related IT products, may encompass the entire life-cycle of EHRM. Moreover, services and related products covered under this contract shall be global in reach and the Contractor must be prepared to provide services and deliverables worldwide.

This PWS provides general requirements. Specific requirements shall be defined in individual TOs. Functional and non-functional requirements are described in Section 5.0 and are not mutually exclusive for TO requirements. Requirements may fall within one specific functional or non-functional area but in many cases, the requirements will encompass and apply across and within multiple areas to provide the total life cycle solution.

In addition, VA and Contractor intend to collaborate to create innovations designed to strengthen and improve healthcare for all veterans and active service members, and to improve the productivity and user experience for VA system users.

Scope The Contractor shall provide, host and deploy EHRM across the VA enterprise including the following areas: project management, change management, training, testing, deployment services, sustainment and other solutions encompassing the entire range of EHR requirements, to include hosting, software, and hardware incidental to the solution. The Contractor shall develop and maintain interfaces as required to meet EHRM solution requirements. The Contractor shall deploy EHRM to all VA Medical Centers (VAMCs), Outpatient Clinics and other approved users of VA EHR functionality. The Consolidated Mail Outpatient Pharmacies (CMOPs) will have access to the EHRM. The Contractor shall support the Veterans Health Administration (VHA) revenue cycle reporting, business intelligence, data analysis and new employee/continuing education training activities and system optimization. EHRM capabilities will also be deployed to Veteran Benefits Administration (VBA) facilities and/or to support other VA use cases as required.

Applicable Documents The Contractor shall comply with the following applicable documents. Additional applicable documents may be listed in individual TOs. The Contractor shall comply with VA security, privacy and records management policies, directives, handbooks, and guidelines except where there is a conflict with DoD security, privacy and records management policies, directives, handbooks, and guidelines implemented in the MHS Genesis environment, in which case, joint governance will provide guidance to the Contractor.

1. 44 U.S.C. § 3541, “Federal Information Security Management Act (FISMA) of 2002”

2. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements For Cryptographic Modules”

3. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

4. FIPS Publication 199, “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Publication 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

7. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, title IX Information Security Matters

8. 10 U.S.C. § 2224, "Defense Information Assurance Program"

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

10. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010

11. VA Handbook 6102 (Internet/Intranet Services), July 15, 2008 Health Insurance Portability and Accountability Act (HIPAA); 45 CFR Part 160, 162, and 164; Health Insurance Reform: Security Standards; Final Rule dated February 20, 2003

12. VHA Handbook 1605.05, Business Associate Agreements, July 22, 2014(http://www.va.gov/vhapublications/)

13. 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility Standards,” July 1, 2003

14. NIST SP 800-161, Supply Chain Risk Management Practices for Federal Information systems and Organizations

15. Office of Management and Budget Circular A-130, “Managing Federal Information as a Strategic Resource”, July 28, 2016

16. Title 32 CFR 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST Special Publication 800-66 Revision 1: An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. Section § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998

19. VA Directive 6500, “Managing Information Security Risk: VA Information Security Program,” September 20, 2012

20. VA Handbook 6500, “Risk Management Framework for VA Information Systems – Tier 3: VA Information Security Program,” March 10, 2015 (

21. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI)”, July 28, 2016

22. VA Handbook 6500.3, “Assessment, Authorization, And Continuous Monitoring Of VA Information Systems,” February 3, 2014

23. VA Handbook 6500.8, “Information System Contingency Planning”, April 6, 2011 (http://www1.va.gov/vapubs/)

24. Office of Information and Technology (OI&T) ProPath Process Methodology (Transitioning to Process Asset Library (PAL) (reference process maps at http://www.va.gov/PROPATH/Maps.asp and templates at http://www.va.gov/PROPATH/Templates.asp).).

25. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, “Recommended Security Controls for Federal Information Systems and Organizations”

26. One-VA Technical Reference Model (TRM) (http://www.va.gov/trm/TRMHomePage.aspx)

27. Federal Segment Architecture Methodology (FSAM) v1.0, December 2008

28. VA Directive 6508, Implementation of Privacy Threshold Analysis and Privacy Impact Assessment, October 15, 2014

29. VA Directive 6300, Records and Information Management, February 26, 2009

30. OMB Memorandum, “Transition to IPv6”, ”, September 28, 2010

31. VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, October 26, 2015 )

32. VA Handbook 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, March 24, 2014

33. OMB Memorandum M-06-18, Acquisition of Products and Services for Implementation of HSPD-12, June 30, 2006

34. OMB Memorandum 05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, August 5, 2005

35. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011

36. NIST SP 800-116, A Recommendation for the Use of Personal Identity Verification (PIV) Credentials in Physical Access Control Systems, November 20, 2008

37. OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007

38. NIST SP 800-157, Guidelines for Derived PIV Credentials, December 2014

39. NIST SP 800-164, Guidelines on Hardware-Rooted Security in Mobile Devices (Draft), October 2012

40. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981 Mobile, PIV, and Authentication, March 2014

41. VA Memorandum, VAIQ #7100147, Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12), April 29, 2011

42. VA Memorandum, VAIQ # 7011145, VA Identity Management Policy, June 28, 2010

43. IAM Identity Management Business Requirements Guidance document, May 2013,

44. OMB Memorandum M-08-05, “Implementation of Trusted Internet Connections (TIC), November 20, 2007

45. OMB Memorandum M-08-23, Securing the Federal Government’s Domain Name System Infrastructure, August 22, 2008

46. VA Memorandum, VAIQ #7497987, Compliance – Electronic Product Environmental Assessment Tool (EPEAT) – IT Electronic Equipment, August 11, 2014 (reference Document Libraries, EPEAT/Green Purchasing Section,

47. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access”, January 15, 2014,

48. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

49. VA Memorandum, “Implementation of Federal Personal Identity Verification (PIV) Credentials for Federal and Contractor Access to VA IT Systems”, (VAIQ# 7614373) July 9, 2015,

50. VA Memorandum “Mandatory Use of PIV Multifactor Authentication to VA Information System” (VAIQ#7613595), June30, 2015,

51. VA Memorandum “Mandatory Use of PIV Multifactor Authentication for Users with Elevated Privileges” (VAIQ#7613597), June30, 2015; (VAIQ#7613597), June30, 2015;

52. Veteran Focused Integration Process (VIP) Guide 12.0

53. “VIP Release Process Guide”, Version 1.4, May 2016,

54. “POLARIS User Guide”, Version 1.2, February 2016,

55. Veteran Focused Integration Process (VIP) Major Program Development and Deployment Guides: https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4411 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4412

56. 38 U.S.C. 7301 (b): Functions of Veterans Health Administration

57. VHA Handbook 1907.01: Health Information Management and Health Records

58. Office of Management and Budget Circular A-123: Management responsibilities for internal controls in Federal Agencies Performance Details The Contractor shall provide and/or acquire the services, hardware, and software required by individual TOs pursuant to the general requirements specified below. The ordering period of the ID/IQ will be ten years, with one three year optional ordering period. TOs may be executed up to, and may extend no further than five years beyond, the last day of the ordering period.

Contract Type This is an Indefinite Delivery/Indefinite Quantity (IDIQ) Single Award TO contract. Individual TOs shall be issued on a performance-based Firm Fixed Price basis.

Ordering Period The total potential ordering period for this effort is ten years.

Hours Of Work Hours of work shall be in accordance with (IAW) individual TO requirements.

Place Of Performance The place of performance shall be identified in individual TOs. Locations in the Enterprise will be Government or non-Government sites within the continental United States (CONUS) and/or outside the continental United States (OCONUS) and set forth on Section D Attachment 005: List of Enterprise Sites. Locations may include but are not limited to Federal, State, or VA, data centers, facilities, regional offices, benefits delivery centers, medical treatment facilities, health clinics and community care facilities as defined in individual TOs.

Travel Travel shall be IAW individual TO requirements. All travel shall be IAW the Federal Travel Regulations (FTR).

EHRM Function Areas Individual TOs may encompass more than one task area listed below. Further task details are described to provide greater insight into the complexity and uniqueness of some potential TO requirements covered by this PWS. Task area requirements are not mutually exclusive and may apply across multiple functional areas and multiple task orders. Efforts to be performed by the Contractor under this contract are of such a nature that they may create a potential organizational conflict of interest as contemplated by Subpart 9.5 of the Federal Acquisition Regulation (FAR). Contractor personnel may be required to sign a non-disclosure agreement.

At some point in time, DoD and VA will establish joint governance over the shared environment containing MHS GENESIS and EHRM. Under joint governance, decisions pertaining to the shared environment will be reviewed and concurred by the joint governance entity. In the interim, VA shall be informed and consulted on all decisions impacting EHRM for VA review and concurrence.

Project Management The Contractor shall provide EHRM Project Management, monitoring and analysis, strategy, enterprise architecture and planning support on an enterprise or individual task order level.

Project Management Support The Contractor shall provide project management support to accomplish the administrative, managerial, logistical, integration and financial aspects specified in the overall program as well as in individual TOs. The Contractor shall identify an individual as the primary contact point for all project issues/concerns/status. The primary POC shall be empowered to make decisions and manage issue resolution across all supporting legal entities comprising the EHRM solution. The Contractor shall support project management functions and reporting which include, but are not limited to:

a) Project Planning

b) Schedule Management

c) Site Deployment Tracking

d) Financial Management

e) Quality Management

f) Resource Management

g) Requirements Management

h) Communications Management

i) Project Change Management

j) Organizational Change Management

k) Risk Management

l) Configuration Management

m) Performance Management

n) Value Management

o) Knowledge Management

p) Governance

q) Security

VIP Reporting

In accordance with Major Program VIP Development Deployment Processes, the Contractor shall provide program development and deployment status and reporting to VA for VA documentation and support of VIP requirements.

Strategy and Planning The Contractor shall provide services that facilitate strategic decisions for VA’s implementation of EHRM. This includes conducting a systematic assessment of the enterprise VistA installation and supporting systems and processes in order to provide strategic recommendations on such key considerations as:

a) EHRM enterprise architecture and hosting

b) Deployment strategy

c) Site preparation requirements

d) Interface requirements

e) Compliance with applicable security requirements

f) Compliance with applicable Identity Access Management requirements

g) Network requirements

h) Additional hardware and software requirements

i) Data and workflows

j) Legacy systems and legacy data

k) Training and change management

l) Configuration management

m) Risk management

n) Performance metrics

o) Applicable governance requirements

p) Synchronization with DoD

q) Innovation strategy

r) Usability

s) Biomedical Devices

t) Health Information Exchange and Community Care

Standards, Policy, Procedure and Process Development, and Implementation Support The Contractor shall provide support in the development and/or evaluation of new Standards, Policy Directives, Operating Procedures, Processes and/or assessments on their impacts when implemented.

Requirements Development and Analysis Support The Contractor shall provide requirements development support as required by individual TOs. Requirements support may include, but is not limited to:

a) Business and Application architecture

b) Business Process Reengineering

c) Requirements planning and management

d) Requirements gathering

e) Use Case development

f) Requirements analysis

g) Change management

h) Business Process Modeling and workflow management

i) Identification of site-specific requirements

j) Analytics and Business Intelligence

k) Innovation

Technology Refresh and Configuration Reviews The Contractor shall perform technology refresh and configuration reviews to include any structure or process for realizing innovations that provides for business or technical changes. Technology refresh ensures new innovations are reviewed and adopted as required throughout the period of performance (PoP) of this contract.

Data Management

The Contractor shall support data aggregation, normalization, standardization and syndication.

The Contractor shall:

a) Perform an analysis of all data stored in VistA including historical data, interfaces, and paper records to determine data management requirements

b) Actively participate in joint governance for planning, strategy and tools for master-data management of VA data in the Contractor-provided solutions.

c) Perform an analysis of data stored in other legacy systems in order to determine data migration approach and interface requirements if any.

d) Propose approaches for legacy data management and archiving

e) Propose a methodology for ingestion and syndication of data with other government agencies and affiliates.

f) Plan an approach to ensure operational integrity for CDW based enterprise solutions

g) Establish an analytic and reporting strategy that includes an analytic and reporting environment provisioned with data and reporting tools

h) Perform an analysis and propose terminology standards for DoD/VA data synchronization.

i) Conduct exploratory analytics to inform policy, for knowledge discovery, and for model creation.

Data Migration Planning

The Contractor shall support data migration planning to support seamless care and to ensure operational integrity.

The Contractor shall:

a) Develop a Data Migration Plan (DMP) that provides an understanding of the EHRM Solution implementation sequence and priorities, data quality, data volumes, and data extract, transformation and load strategy for both the EHRM and Population Health Management solutions.

i. The DMP shall describe the approach for data storage, access, data conversion, and data security strategies.

ii. The DMP shall account for key clinical data in VistA along with other relevant systems and outline a strategy to make that viewable and actionable.

iii. The DMP shall also address data validation assessing the migration of VistA legacy data to HealtheIntent and Millennium.

iv. The DMP should address how to migrate data that is still actionable and to maintain actionability

v. The DMP shall identify, clarify, and propose approaches for the following:

1. Data Integration (Data flow from VA to Cerner)

2. Data Continuity (VA Legacy Data Integration)

3. Data Syndication (Data flow from Cerner to VA and partner applications and databases)

b) Plan and document the data ingestion mechanism and processes along with terminology mapping to standards associated with data migration and data synchronization/syndication.

c) Plan initial and incremental loading of data into HealtheIntent to include batch and streaming (i.e. near real-time) options

d) Analyze and propose way forward for the capability for external apps to use HealtheIntent as a data source

e) Organize and facilitate a Joint VA/DoD/Cerner Data Governance Board to develop strategy and priorities.

Contractor and VA to create a strategy to establish an archival instance of a VistA instance once the site has migrated to Milleniuum and the local VistA instance is no longer being updated. This instance will be accessible and can be used for high latency extraction.

Implementation Planning

The Contractor shall:

a) Deliver an Implementation Plan that defines the Contractor’s plan for deployment, training, change management, and sustainment of EHRM to the VA Enterprise

b) Brief VA EHRM management on, at a minimum, the following information:

i. Enterprise deployment strategy

ii. Change management approach

a. EHRM System User Role definitions

b. The availability of EHRM User Provisioning workflows

c. Level of Effort estimate to provision all EHRM users during migration

d. Level of Effort estimate to provision new users and maintain end user permissions post migration

iii. Training approach

iv. Sustainment and helpdesk approach

c) Propose recommended change management activities for the most efficient and effective change management support of EHRM in the Monthly Progress Report

i. Execute such activities upon Government approval

d) Participate in VA EHRM business process reengineering discussions and advise or present industry leading practices, processes and workflow

e) Conduct a comparative analysis between the EHRM solution-inherent workflows and the “As-Is” organizational business processes and provide recommendations on process re-engineering, change management and product configuration

f) Provide Business Process Workflow Diagrams and Role Definitions that define business and clinical workflows and describe functionality, improved efficiency, how meaningful use has been achieved, and establish EHRM System user role definitions

g) Provide a Role Assignment Identification Document that maps user roles to EHRM roles

Configuration Management

The Contractor shall draft a Configuration Management (CM) Plan for review and comment by the EHRM Program Management Office (PMO). After mutual agreement on the plan, the Contractor shall adhere to the CM policies and practices as described in the Plan. CM includes supporting the definition of Configuration Items (CIs) and relevant attributes and relationships to manage, establishing procedures for change and controlling request for change, providing the status of the CIs, and auditing the actual and authorized versions of each item. Maintaining a complete and accurate CM system ensures the integrity of system/software baselines and designated CIs required to provide services.

Value and Performance Management Reporting

The Contractor shall propose and monitor value objectives for improved outcomes and continuous performance improvement throughout the PoP of this contract. The Contractor shall:

a) assist with data analysis to identify possible optimization projects to further drive performance excellence after implementation at each site.

b) work with VA leadership to establish future value objectives through strategic planning sessions.

c) incorporate change management, workflow and process review and data analytics using the change management methodology agreed by Contractor and VA with consistent recognition and promotion of value achieved.

The Contractor shall use a value realization framework and tools to assist VA with creating value metrics aligned with VA, VHA and clinical strategic goals, and targeted to EHRM and specify goals and Critical Success Factors (CSFs). Value metrics will include Key Results Indicators (KRIs), Key Performance Indicators (KPIs), and traditional Performance Indicators (PIs). The Contractor shall develop and implement tracking mechanisms to measure and report EHRM progress against clinical and business goals.

Clinical goals may include:

a) Patient experience

b) Clinical staff experience

c) Clinical Efficiency

d) Operational Efficiency

e) Safety and Quality (Better Health, Better Care)

f) Patient Engagement

g) Best Practices Adoption

h) Financial Outcomes

i) Access to Care

j) Community Care

· Health Plan Operations

k) Population Health

i. Seamless Care

ii. Access to Care

iii. Choice Business goals may include:

a) Cost

b) Scope

c) Schedule

d) Security

e) Quality

f) Technical Performance

g) Patient Access to Care

The Contractor shall develop standards for VA approval to be used as input for VA determination of successful site deployment. These standards may be related to the Clinical and business goals, including user adoption rates, process adherence, training competency test results, patient throughput or other similar indicators of success. For system performance (example: availability, accuracy, efficiency) the Contractor shall propose any deviation from or changes to the metrics jointly agreed with VA that will need to be approved as success criteria. The ability to measure these clinical and business requirements shall be documented in a monitoring and reporting plan and measured and reported to VA throughout the PoP. These tracking mechanisms will evolve over time throughout the PoP of this contract as deployments advance across the enterprise and the data available to support metrics expands.

EHRM System The Contractor shall provide an operational managed services solution for EHRM applications (software and subscriptions), application services and all supporting third party content required to deliver the functional and non-functional requirements set forth in the Requirements Traceability Matrix (RTM) included in Section D, Attachments 002 and 003 to this document.

Electronic Health Record Application

EHRM requirements are established at a strategic level and will guide the configuration and implementation of the system across VA. In addition to the requirements in the Government RTM, the Government may place orders for product enhancements or improvements to meet emerging needs, activate existing, but dormant capabilities in EHRM, or to address a need in the overall EHRM solution not explicitly extrapolated into the Government RTM.

EHRM is expected to unify and increase accessibility of integrated, evidenced-based healthcare delivery and decision-making. EHRM will support the availability of longitudinal medical records for the patients currently enrolled in the VA EHR and new patients as they transition into EHRM as set forth in the VA Enterprise as defined in section H1. EHRM will enable the application of standardized workflows, integrated healthcare delivery, and data standards for improved and secure electronic exchange of medical and patient data between the VA and its external partners, including the DoD, and other Federal and private sector healthcare providers. The workflows inherent to EHRM will be configured, adopted by and standardized throughout VA as applicable. EHRM will leverage data exchange capabilities in alignment with the Interagency Program Office (IPO) for standards-based health data interoperability and secure information sharing with external partners.

1.1.1.1 Software Requirements

The Contractor shall:

a) Provide all applicable software licenses in accordance with all clauses, identifications and assertions, terms, and conditions related to commercial and non-commercial technical data, computer software, and computer software documentation to support the configuration, integration, custom development, test, software management, training, deployment, and end-user usage of EHRM

b) Manage and track all software licenses required to establish, operate, and maintain EHRM.

c) Provide initial limited licensing for Multum testing and integration with VistA

d) Maximize utilization of VA-provided enterprise licenses where available and appropriate.

e) Provide and update an EHRM Enterprise Release Schedule identifying:

i. Software release packages based on security and system incidents

ii. Planned Technology Refresh and Modernization activities

iii. New installations and service upgrades

f) Identify and report issues and risk associated with software and report risks/issues and status of any mitigation actions in the Monthly Progress Report and at Program Management Reviews (PMRs), technical reviews, program milestones and configuration audits.

g) Configure workflows inherent to HealtheIntent for adoption throughout VA as applicable

h) Provide the ability to segregate information (e.g. from users, from DoD, separate practices for military sexual trauma (MST), employee health, and others)

i) Provide the ability to exclude/segregate/de-identify specific practices from HealtheIntent, e.g., MST.

j) The EHRM solution shall support access via tablet or mobile device as adjudicated by joint governance. Platform specifics will be identified by VA at a TO level.

1.1.1.2 Hardware Requirements

The Contractor shall provide and maintain Cerner-specific hardware required for the EHRM solution. This hardware includes such items as connectivity engines and device adaptors.

Additional EHRM Functionality

VA’s requirements will evolve over the course of the IDIQ. To maximize meeting of government requirements while minimizing risk to the Contractor and VA, the parties will engage in periodic future-capability planning cycles. Future requirements may include such items as clinician access to EHRM via tablet.

The Contractor shall meet with the VA once a year to provide visibility to Contractor’s roadmap of future capabilities. The Contractor’s roadmap shall detail capabilities that the Contractor is anticipating to develop as part of its generally available (GA) product over one, two, and three years. The VA may request such capabilities in a manner that corresponds with wave task orders As mutually agreed between the Contractor and VA, the Contractor may host an interim capability planning event upon request. These interim planning events are expected to focus on wave task orders in the subsequent 12 months or to make adjustment to future milestones based on unforeseen information or events.

The Contractor shall include VA in all user groups and other planning activities that other major clients participate in and that are used to inform the prioritization of the Contractors development backlog. In addition, VA will provide input to applicable Cerner business units on capability prioritization.

The Contractor shall provide VA the right to acquire additional modules developed to support the evolving electronic health record commercial baseline throughout the PoP of this contract.

Software Maintenance

The Contractor shall provide its commercial support and maintenance services described in its End User License Agreement. Leveraging Contractor’s best practices and agreed upon upgrade schedule between DoD and VA, software maintenance includes all releases of the software such as major releases, minor releases, maintenance releases. Maintenance will be conducted in such a way to minimize impact to the user community.

Contractor shall:

a) Maintain EHRM software including any Off the Shelf software applications and tools included in the solution

i. Notify the Government of any software that is within two years of end of life, end of service, or end of Software maintenance release

ii. Ensure all software has continuous vendor support

b) Renew software licensing and maintenance agreements as required throughout the PoP of the TO.

c) Support other functional dependencies, such as device certificates and PKI, if applicable

EHRM Hosting and Managed Services

The Contractor shall provide enterprise datacenter hosting and services consistent with the hosting requirements set forth in Contractor’s Hosting Agreement. The Contractor shall:

a) Provide hosting and managed services to support delivery of the EHRM

b) As a minimum, employ appropriately tailored security controls from the high baseline of security controls defined in NIST Special Publication 800-53 and must ensure that the minimum assurance requirements associated with the high baseline are satisfied. The hosting environment shall be compliant with FISMA- High or equivalent or higher controls. Any deviation from high impact controls must be approved by the Authorizing Official or designee.

c) Provide a primary and alternate data center to support continuity of operations and disaster recovery requirements

d) Support VA Network connectivity requirements

e) Provide all hardware, software, and services necessary to perform sustainment of EHRM in Contractor’s hosted environment

f) Provide continuous technical support and system monitoring to immediately react to a system event

g) Utilize established commercial and proprietary automated tools to monitor and managed vital datacenter infrastructure and EHRM systems.

h) Administer support access by contractor personnel to the EHRM environment using two factor authentication via RSA SecurID in lieu of CAC/PIV authentication for managing solutions within the accredited boundary

i. Access to the EHRM environment by administrative personnel external of the Cerner hosted network will be provided through a VDI and utilize appropriate CAC/PIV authentication

ii. Administrators shall use non-privileged accounts, or roles, when accessing other system functions such as email, and if feasible, audits any use of privileged accounts, or roles, for such functions.

i) Support VA troubleshooting for network latency and packet loss issues to assist in identification of sources of network transport response time issues.

j) Leveraging Contractor’s best practices and agreed upon upgrade schedule between DoD and VA, hosting maintenance includes patches, cybersecurity, and software assurance updates. Maintenance will be conducted in such a way to minimize impact to the user community.

Non-Production Environments / Domains

The Contractor shall:

a) Host and operate all EHRM non-production environments/domains that are functionally equivalent to production environments/domain. The environment/domains will support the non-production requirements and needs across the lifecycle of the VA EHRM, including development, testing, training, certification (for upgrades), and sustainment. Development activities include the activities to develop/build the interfaces between the EHRM and VistA and other VA systems. Test activities will be executed in these test environments that represent operationally and technically realistic test environments.

b) Work closely with VA to identify the number and use of non-production environment/domains required to mitigate the risk of development/test events schedule collisions or usage issues/conflicts between Contractor, VA EHRM and DoD MHS GENESIS teams performing work in the same non-production environment/domain.

c) Work closely with VA EHRM and DoD MHS GENESIS teams to create/maintain a Non-Production Domain Integrated Master Tracking/Schedule of key activities taking place in non-production environments/domains to mitigate risks/issues impacting EHRM schedules. Risks/Issues may arise due to multiple teams sharing the domain environment.

d) Coordinate new requirements and modifications that impact the existing DoD-VA Joint Test Environments thru the DoD-VA Joint Test Environment workgroup.

e) Work jointly with VA and DoD MHS GENESIS teams as needed to establish network connectivity between non-production environments/domains and use established connectivity processes such as, VA ESCCB and DoD MHS GENESIS PEO change control for non-production environments.

f) Participate with VA in environment/domain network connectivity test to ensure the environments pass connectivity tests

g) Ensure EHRM system installed within the non-production environment/domain are functional

h) Participate with DoD MHS GENESIS/VA teams in environment/domain smoke tests as needed to ensure any DoD interfaces (like Joint Legacy Viewer or DoD DEERS) are functional (pass smoke tests)

i) Provide Access to non-production environments for VA (both VA government and VA contractors) resources involved in VA Test & Evaluation, as needed

j) Use a non-production environment/domain to support VA Mockups of the medical operational environment (aka sim labs/learning centers) in which end users will interact with EHRM potentially to be used for training and other end user engagement activities.

k) Work closely with VA EHRM resources to determine which facility/site test data within non-production/domains would be used in support of the VA Mockups environment particularly which facility/site the medical devices in the VA Mockup operational environment would be setup against.

l) Create, maintain, and provide the architecture/system diagrams showing how each non-production/domain environment is interfaced to VA systems with input from VA for the EHRM and VA systems integration.

VA will provide the non-production development/test environments for interface/integration development and test to VA’s VistA and VA legacy systems. Contractor resources performing development and testing of VA Systems Interfaces will require VA network access depending on the location of development/testing environments/domains.

The medical device and peripherals configuration within the non-production environment/domain that supports the VA Mockup operational environment will be executed by the contractor upon VA request.

Continuity of Operations (COOP), Disaster Recovery (DR), and Business Continuity Planning Services

Disaster Recovery encompasses the policies and procedures to prepare for recovery of technology infrastructure and business operations critical to an organization after a natural or human-induced disaster to partially or completely restore services and critical functions within a predetermined time after a disaster or extended disruption.

The Contractor shall develop, maintain and update a Disaster Recovery Plan (DRP) (data center) level contingency plan which shall include a Policy Statement and a Crisis Communications plan proposed by the Contractor. The plan will be signed jointly by VA and DoD, and the Contractor shall facilitate a governance board which includes membership from all three organizations.

The Contractor shall:

a) Design, install, operate, and maintain COOP capabilities to enable plans for emergency response and supporting infrastructure (e.g., storage and backup operations, off-site storage) for post-DR of information systems

b) Develop system and network designs that enable EHRM services and network operations to survive individual component failure

c) Provide input to the Government for making system performance decisions in the event of a disaster or incident

d) Provide input to the Government After Action Reports (AAR) and lessons learned following exercises

e) Execute emergency failover COOP requirements

f) Support annual exercises of the DRP

The Contractor shall provide 724 Downtime Viewer read-only system to replace each of the over 170 instances of VistA Read-Only installations. This replacement shall be implemented as part of each site deployment.

The Contractor shall provide a back-up solution that includes a feed of EHRM data to an off-site location. The back-up system or equivalent off-line data source shall be subject to governance approval. The feed shall be encrypted in transit to the storage location. Cerner shall be responsible for transmitting the data to the VA-Cerner demarcation boundary. Data stored will be encrypted in accordance with the standards of the PWS. The Contractor shall provide VA access to the encryption keys.

System Quality and Performance Measures and Monitoring

The Contractor shall provide its commercial performance measurement system for system acceptance for discussion and review with VA. The Contractor shall conduct analysis and design activities for system quality and performance. The Contractor shall provide performance and availability trend analysis and supporting data in the Monthly Progress Report to show prediction, trending, and monitoring of system’s performance trends.

Virtual Training Environment

The Contractor shall:

a) Install, integrate and maintain the Virtual Training Environment (VTE) and provide scenario-based training simulations with de-identified or synthetic data.

b) Provide access to the VTE as required for EHRM end-user training to meet deployment timetables.

c) Ensure that the VTE provides the following utilities/requirements:

i. A non-production instance of the EHRM system, configured to the greatest extent practical, in order to resemble the production environment to meet training requirements

ii. Accessible locally or via a secure tunnel on the internet using desktops or laptops

iii. Accessible from Government networks

iv. Accessible by VA government and VA contractor users (upon signing of an NDA)

v. Scalable to support up to 15,000 concurrent virtual users

Solution-specific Hardware and Hardware Maintenance

The Contractor shall:

a) Maintain EHRM System Contractor-provided hardware

b) Renew and manage EHRM system hardware maintenance agreements as required

c) Provide the necessary supply support (e.g., hardware spares, cabling, and test equipment) required for the repair of failed EHRM system components as described in End User License Agreement

d) Maintain all EHRM hardware components in compliance with manufacturers’ warranties

e) As required, de-install, move, and install EHRM System computer hardware, excluding medical devices, in a manner that will not void warranties

f) Support hardware items once the commercial product warranties expire without voiding Return to Factory (RTF) warranties

Hosting of Legacy Data

1.1.1.3 Image Hosting

To support the transition to the EHRM Vendor Neutral Archive (VNA) for imaging, the Contractor shall migrate all DICOM and non-DICOM images from each VISN or site into the EHRM VNA at the time of deployment to each VISN or site.

1.1.1.4 Legacy System Hosting

The Contractor shall provide infrastructure hosting services to support the Data Migration Plan (DMP) with the following alternatives:

a) Host a Mirrored copy of the VX130 extract to facilitate Data Migration into the HealtheIntent platform.

b) Host one or more VistA shadow instances as a ‘read-only’ archive of the legacy data.

Information System Authorization, Testing And Continuous Monitoring

The Contractor shall adhere to all applicable FISMA, FIPS, and NIST standards related to information system authorization, testing and continuous monitoring.

The Contractor shall meet agency Risk Management Framework (RMF) requirements (NIST SP 800-37, Guide for Applying the Risk Management Framework to Federal Information System) for the maintenance of Authority-to-Operate (ATO). The commercial off-the-shelf (COTS) Electronic Heath Record (EHR) (Cerner Millennium) system hosted by Cerner Corporation is the Defense Health Agency (DHA) Enterprise Mission Assurance Support Service (eMASS) registered system (MHS GENESIS) and the IPO recognized authorization boundary. Changes to the system must be reported through the appropriate change control board with a Security Impact Analysis (SIA) conducted to determine if the changes constitute a significant change requiring re-authorization. If re-authorization is required as determined by the SIA, the Contractor shall adhere to the information system authorization, testing, and continuous monitoring activities as defined by NIST. The appropriate government official will be notified in the event that a significant change as defined by the SIA will occur.

The Contractor shall provide and maintain the ATOs IAW the guidance provided in VA Directive and Handbook 6500, “Information Security Program”, VA Handbook 6500.3, “Assessment, Authorization, and Continuous Monitoring of VA Information Systems,” February 3, 2014, using a Governance Risk and Compliance (GRC) tool.