VA118-17-R-2324-A00004002.docx

VA Electronic Health Record Modernization System Basic PWS

Performance Work Statement (PWS) for the

VA Electronic Health Record Modernization System

ORIGINAL DATE: October 5, 2017 Final Version 2.1

AMENDMENT 01 DATE: November 7, 2017

AMENDMENT 02 DATE: November 20, 2017

AMENDMENT 03 DATE: February 16, 2018

AMENDMENT 04 DATE: May 7, 2018 Department of Veterans Affairs

Contents

Background This Performance Work Statement (PWS) establishes the requirements for Contractor-provided solutions in support of an enterprise-wide Department of Veterans Affairs (VA) Electronic Health Record (EHR). VA is replacing its current EHR, Veterans Information Systems and Technology Architecture (VistA) with a commercial EHR to modernize VA EHR processing and to promote interoperability of medical data between the Department of Defense (DoD), VA and community providers. When implemented, the EHR System will provide access to authoritative clinical data sources, and over time become the authoritative source of clinical data to support improved population health, patient safety, and quality of care provided by VA.

This contract was awarded after a determination by the Secretary of Veterans Affairs to be in the public interest under FAR 6.302-7. The goal of the accelerated award is to deliver a modernized system in the best interests of Veterans, their healthcare, and the providers that care for them both inside the VA and in commercial care settings.

This award contemplates the provision of services by Cerner Corporation, and accordingly the documents reference Cerner Corporation and its software and services. The VA may determine a different source of software and/or services will best serve the interests of Veterans for such services including quality of care, patient engagement, operational efficiency or interoperability to fulfill the goals of Electronic Health Record Modernization, the Veterans’ Choice program, or other areas as the VA may decide. The VA may then follow the Federal Acquisition Regulations to seek other sources for the services.

The Contractor shall provide a total EHR solution including the following: program management, an enterprise-wide EHR system, change management, training, testing, deployment services, sustainment and other solutions encompassing the entire range of EHR requirements, to include but not be limited to hosting, software, and hardware incidental to the solution. Accordingly, Task Orders (TOs) may include acquisitions of software and information technology (IT) products as well as the services required to implement the EHR solution across VA. For purposes of this PWS, the VA EHR solution will be referred to as the VA Electronic Health Record Modernization system (EHRM). The EHRM solution shall focus priorities on the Veteran and clinician experiences.

EHRM is based on the electronic health record acquired by the Department of Defense known as the MHS GENESIS system, which is at its core, Cerner Millennium. The adoption of a single joint system between VA and DoD will allow all patient data to reside in a common system to have a seamless link between the DoD and VA. The DoD authorized system will be augmented to include additional functionality to meet VA requirements. Over time, the goal is the creation of an integrated inpatient and outpatient solution with software components that have been designed, integrated, maintained, and deployed with a design architecture that allows for access to and sharing of common data, common user interface, common workflows, common business rules, and common security framework that supports end-to-end healthcare related clinical and business operations.

EHRM is not intended as a mechanism to solely purchase IT products. Such products may be purchased to the extent that those products are necessary to deliver the solution required. These services, as well as related IT products, may encompass the entire life-cycle of EHRM. Moreover, services and related products covered under this contract shall be global in reach and the Contractor must be prepared to provide services and deliverables worldwide.

This PWS provides general requirements. Specific requirements shall be defined in individual TOs. Functional and non-functional requirements are described in Section 5.0 and are not mutually exclusive for TO requirements. Requirements may fall within one specific functional or non-functional area but in many cases, the requirements will encompass and apply across and within multiple areas to provide the total life cycle solution.

In addition, VA and Contractor intend to collaborate to create innovations designed to strengthen and improve healthcare for all veterans and active service members, and to improve the productivity and user experience for VA system users.

Scope The Contractor shall provide, host and deploy EHRM across the VA enterprise including the following areas: project management, change management, training, testing, deployment services, sustainment and other solutions encompassing the entire range of EHR requirements, to include hosting, software, and hardware incidental to the solution. The Contractor shall develop and maintain interfaces as required to meet EHRM solution requirements. The Contractor shall deploy EHRM to all VA Medical Centers (VAMCs), Outpatient Clinics and other approved users of VA EHR functionality. The Consolidated Mail Outpatient Pharmacies (CMOPs) will have access to the EHRM. The Contractor shall support the Veterans Health Administration (VHA) revenue cycle reporting, business intelligence, data analysis and new employee/continuing education training activities and system optimization. EHRM capabilities will also be deployed to Veteran Benefits Administration (VBA) facilities and/or to support other VA use cases as required.

Applicable Documents The Contractor shall comply with the following applicable documents. Additional applicable documents may be listed in individual TOs. The Contractor shall comply with VA security, privacy and records management policies, directives, handbooks, and guidelines except where there is a conflict with DoD security, privacy and records management policies, directives, handbooks, and guidelines implemented in the MHS Genesis environment, in which case, joint governance will provide guidance to the Contractor.

1. 44 U.S.C. § 3541, “Federal Information Security Management Act (FISMA) of 2002”

2. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements For Cryptographic Modules”

3. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

4. FIPS Publication 199, “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Publication 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

7. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, title IX Information Security Matters

8. 10 U.S.C. § 2224, "Defense Information Assurance Program"

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

10. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010

11. VA Handbook 6102 (Internet/Intranet Services), July 15, 2008 Health Insurance Portability and Accountability Act (HIPAA); 45 CFR Part 160, 162, and 164; Health Insurance Reform: Security Standards; Final Rule dated February 20, 2003

12. VHA Handbook 1605.05, Business Associate Agreements, July 22, 2014(http://www.va.gov/vhapublications/)

13. 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility Standards,” July 1, 2003

14. NIST SP 800-161, Supply Chain Risk Management Practices for Federal Information systems and Organizations

15. Office of Management and Budget Circular A-130, “Managing Federal Information as a Strategic Resource”, July 28, 2016

16. Title 32 CFR 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST Special Publication 800-66 Revision 1: An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. Section § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998

19. VA Directive 6500, “Managing Information Security Risk: VA Information Security Program,” September 20, 2012

20. VA Handbook 6500, “Risk Management Framework for VA Information Systems – Tier 3: VA Information Security Program,” March 10, 2015 (

21. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI)”, July 28, 2016

22. VA Handbook 6500.3, “Assessment, Authorization, And Continuous Monitoring Of VA Information Systems,” February 3, 2014

23. VA Handbook 6500.8, “Information System Contingency Planning”, April 6, 2011 (http://www1.va.gov/vapubs/)

24. Office of Information and Technology (OI&T) ProPath Process Methodology (Transitioning to Process Asset Library (PAL) (reference process maps at http://www.va.gov/PROPATH/Maps.asp and templates at http://www.va.gov/PROPATH/Templates.asp).).

25. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, “Recommended Security Controls for Federal Information Systems and Organizations”

26. One-VA Technical Reference Model (TRM) (http://www.va.gov/trm/TRMHomePage.aspx)

27. Federal Segment Architecture Methodology (FSAM) v1.0, December 2008

28. VA Directive 6508, Implementation of Privacy Threshold Analysis and Privacy Impact Assessment, October 15, 2014

29. VA Directive 6300, Records and Information Management, February 26, 2009

30. OMB Memorandum, “Transition to IPv6”, ”, September 28, 2010

31. VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, October 26, 2015 )

32. VA Handbook 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, March 24, 2014

33. OMB Memorandum M-06-18, Acquisition of Products and Services for Implementation of HSPD-12, June 30, 2006

34. OMB Memorandum 05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, August 5, 2005

35. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011

36. NIST SP 800-116, A Recommendation for the Use of Personal Identity Verification (PIV) Credentials in Physical Access Control Systems, November 20, 2008

37. OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007

38. NIST SP 800-157, Guidelines for Derived PIV Credentials, December 2014

39. NIST SP 800-164, Guidelines on Hardware-Rooted Security in Mobile Devices (Draft), October 2012

40. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981 Mobile, PIV, and Authentication, March 2014

41. VA Memorandum, VAIQ #7100147, Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12), April 29, 2011

42. VA Memorandum, VAIQ # 7011145, VA Identity Management Policy, June 28, 2010

43. IAM Identity Management Business Requirements Guidance document, May 2013,

44. OMB Memorandum M-08-05, “Implementation of Trusted Internet Connections (TIC), November 20, 2007

45. OMB Memorandum M-08-23, Securing the Federal Government’s Domain Name System Infrastructure, August 22, 2008

46. VA Memorandum, VAIQ #7497987, Compliance – Electronic Product Environmental Assessment Tool (EPEAT) – IT Electronic Equipment, August 11, 2014 (reference Document Libraries, EPEAT/Green Purchasing Section,

47. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access”, January 15, 2014,

48. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

49. VA Memorandum, “Implementation of Federal Personal Identity Verification (PIV) Credentials for Federal and Contractor Access to VA IT Systems”, (VAIQ# 7614373) July 9, 2015,

50. VA Memorandum “Mandatory Use of PIV Multifactor Authentication to VA Information System” (VAIQ#7613595), June30, 2015,

51. VA Memorandum “Mandatory Use of PIV Multifactor Authentication for Users with Elevated Privileges” (VAIQ#7613597), June30, 2015; (VAIQ#7613597), June30, 2015;

52. Veteran Focused Integration Process (VIP) Guide 2.0

53. “VIP Release Process Guide”, Version 1.4, May 2016,

54. “POLARIS User Guide”, Version 1.2, February 2016,

55. 38 U.S.C. 7301 (b): Functions of Veterans Health Administration

56. VHA Handbook 1907.01: Health Information Management and Health Records

57. Office of Management and Budget Circular A-123: Management responsibilities for internal controls in Federal Agencies

58. VA Memorandum, “Proper Use of Email and Other Messaging Services”, January 2, 2018

59. Health Data Interoperability Management Plan v 3.0: DoD/VA Interagency Program Office, September 14, 2016

60. Healthcare Information Interoperability Technical Package (I2TP) v 6.0: DoD/VA Interagency Program Office, March 15, 2017

61. Joint Interoperability Strategic Plan (JISP) v1.0: DoD/VA Interagency Program Office, September 30 2017

62. 2015 Edition Health Information Technology (Health IT) Certification Criteria, 2015 Edition Base Electronic Health Record (EHR) Definition, and ONC Health IT Certification Program Modifications: Final Rule - October 6, 2015

63. (http://docs.smarthealthit.org/)

64. (http://docs.smarthealthit.org/authorization/)

65. HL7.org Standards as delineated on www.hl7.org

66. VA Directive 6066, Protected Health Information (PHI) and Business Associate Agreements Management, dated September 2, 2014

67. 2015 Edition Health Information Technology (Health IT) Certification Criteria, 2015 Edition Base Electronic Health Record (EHR) Definition, and ONC Health IT Certification Program Modifications: Final Rule - October 6, 2015.

68. Fast Healthcare Interoperability Resources (FHIR) Draft Standard for Trial Use (DSTU) 2 (v1.0.2-7202)

69. Argonaut Data Query Implementation Guide Version 1.0.0

70. Argonaut Data Query Implementation Guide Server

71. SMART App Authorization Guide : http://docs.smarthealthit.org/authorization/

72. OpenID Connect Core 1.0 incorporating errata set 1

73. Consent2Share (C2S) FHIR Consent Profile Designed for C2S application and associated access control solutions

74. CDS Services v1.0 Draft

75. HL7.org Standards : www.hl7.org

76. Web Services Registry Web Service Interface Specification V3.1

77. Patient Discovery Web Service Interface Specification V2.0

78. Messaging Platform Specification V 3.0

79. Authorization Framework Specification V 3.0

80. Query for Documents Web Service Interface Specification V 3.0

81. Retrieve Documents Web Service Interface Specification V 3.0

82. Document Submission Production Web Service Interface Specification V 2.0

83. Query-Based Document Exchange Implementation Guide V 1.1

84. Technical Trust Policy V1.2

85. CommonWell Health Alliance Services Specification Version 2.9.1

86. Health Data Interoperability Management Plan v 3.0: DoD/VA Interagency Program Office, September 14, 2016.

87. Healthcare Information Interoperability Technical Package (I2TP) v 6.0: DoD/VA Interagency Program Office, March 15, 2017.

88. Joint Interoperability Strategic Plan (JISP) v1.0: DoD/VA Interagency Program Office, September 30 2017.

Performance Details The Contractor shall provide and/or acquire the services, hardware, and software required by individual TOs pursuant to the general requirements specified below. The total ordering period of the ID/IQ will be ten years. TOs may be executed up to, and may extend no further than five years beyond, the last day of the ordering period.

Contract Type This is an Indefinite Delivery/Indefinite Quantity (IDIQ) Single Award TO contract. Individual TOs shall be issued on a performance-based Firm Fixed Price basis.

Ordering Period The total potential ordering period for this effort is ten years, consisting of a five-year base ordering period and one, five-year optional ordering period.

Hours Of Work Hours of work shall be in accordance with (IAW) individual TO requirements.

Place Of Performance The place of performance shall be identified in individual TOs. Locations in the Enterprise will be Government or non-Government sites within the continental United States (CONUS) and/or outside the continental United States (OCONUS) and set forth on Section D Attachment 005: List of Enterprise Sites. Locations may include but are not limited to Federal, State, or VA, data centers, facilities, regional offices, benefits delivery centers, medical treatment facilities, health clinics and community care facilities as defined in individual TOs.

Travel Travel shall be IAW individual TO requirements. All travel shall be IAW the Federal Travel Regulations (FTR).

EHRM Function Areas Individual TOs may encompass more than one task area listed below. Further task details are described to provide greater insight into the complexity and uniqueness of some potential TO requirements covered by this PWS. Task area requirements are not mutually exclusive and may apply across multiple functional areas and multiple task orders. Efforts to be performed by the Contractor under this contract are of such a nature that they may create a potential organizational conflict of interest as contemplated by Subpart 9.5 of the Federal Acquisition Regulation (FAR). Contractor personnel may be required to sign a non-disclosure agreement.

At some point in time, DoD and VA will establish joint governance over the shared environment containing MHS GENESIS and EHRM. Under joint governance, decisions pertaining to the shared environment will be reviewed and concurred by the joint governance entity. In the interim, VA shall be informed and consulted on all decisions impacting EHRM for VA review and concurrence.

Project Management The Contractor shall provide EHRM Project Management, monitoring and analysis, strategy, enterprise architecture and planning support on an enterprise or individual task order level.

Project Management Support The Contractor shall provide project management support to accomplish the administrative, managerial, logistical, integration and financial aspects specified in the overall program as well as in individual TOs. The Contractor shall identify an individual as the primary contact point for all project issues/concerns/status. The primary POC shall be empowered to make decisions and manage issue resolution across all supporting legal entities comprising the EHRM solution. The Contractor shall support project management functions and reporting which include, but are not limited to:

a) Project Planning

b) Schedule Management

c) Site Deployment Tracking

d) Financial Management

e) Quality Management

f) Resource Management

g) Requirements Management

h) Communications Management

i) Project Change Management

j) Organizational Change Management

k) Risk Management

l) Configuration Management

m) Performance Management

n) Value Management

o) Knowledge Management

p) Governance

q) Security

VIP Reporting

In accordance with Major Program VIP Development Deployment Processes, the Contractor shall provide program development and deployment status and reporting to VA for VA documentation and support of VIP requirements.

Strategy and Planning The Contractor shall provide services that facilitate strategic decisions for VA’s implementation of EHRM. This includes conducting a systematic assessment of the enterprise VistA installation and supporting systems and processes in order to provide strategic recommendations on such key considerations as:

a) EHRM enterprise architecture and hosting

b) Deployment strategy

c) Site preparation requirements

d) Interface requirements

e) Compliance with applicable security requirements

f) Compliance with applicable Identity Access Management requirements

g) Network requirements

h) Additional hardware and software requirements

i) Data and workflows

j) Legacy systems and legacy data

k) Training and change management

l) Configuration management

m) Risk management

n) Performance metrics

o) Applicable governance requirements

p) Synchronization with DoD

q) Innovation strategy

r) Usability

s) Biomedical Devices

t) Interoperability: Health Information Exchange and Community Care

Standards, Policy, Procedure and Process Development, and Implementation Support The Contractor shall provide support in the development and/or evaluation of new Standards, Policy Directives, Operating Procedures, Processes and/or assessments on their impacts when implemented.

Requirements Development and Analysis Support The Contractor shall provide requirements development support as required by individual TOs. While the Contractor shall provide such support, the VA reserves the right to take the lead on coordinating input from the user and provider communities. VA may, at its discretion, incorporate analytics from other entities, and include them in its future Digital Veterans Platform, with which the EHR must interoperate using standards based APIs. Requirements support may include, but is not limited to:

a) Business and Application architecture

b) Business Process Reengineering

c) Requirements planning and management

d) Requirements gathering

e) Use Case development

f) Requirements analysis

g) Change management

h) Business Process Modeling and workflow management

i) Identification of site-specific requirements

j) Analytics and Business Intelligence

k) Innovation

Technology Refresh and Configuration Reviews The Contractor shall perform technology refresh and configuration reviews to include any structure or process for realizing innovations that provides for business or technical changes. Technology refresh ensures new innovations are reviewed and adopted as required throughout the period of performance (PoP) of this contract.

Data Management

The Contractor shall support data aggregation, normalization, standardization and syndication.

The Contractor shall:

a) Perform an analysis of all data stored in VistA including historical data, interfaces, and paper records to determine data management requirements

b) Actively participate in joint governance for planning, strategy and tools for master-data management of VA data in the Contractor-provided solutions based on community and VA coordinated analytic algorithms.

c) Perform an analysis of data stored in other legacy systems in order to determine data migration approach and interface requirements if any.

d) Propose approaches for legacy data management and archiving

e) Propose a methodology for ingestion and syndication of data with other government agencies and affiliates.

f) Plan an approach to ensure operational integrity for CDW based enterprise solutions

g) Establish an analytic and reporting strategy that includes an analytic and reporting environment provisioned with data and reporting tools

h) Perform an analysis and propose terminology standards for DoD/VA data synchronization based on industry standards recognized by National Institutes of Health (NIH), Office of the National Coordinator for Health Information Technology (ONC), and others..

i) Conduct exploratory analytics to support policy development, for knowledge discovery, and for model creation.

j) Maintain backward compatibility of the EHRM solution in such way as to maintain the quality of the data, to ensure that, once captured, the VA has access to and computational use of the data regardless of the evolution of the EHRM or age of the data.

k) Identify data quality issues found in data sourced from systems beyond its operational remit, applying the same validations and quality standards to incoming external data that it performs for data originated natively within the EHRM solution. Where the principle of seamless care requires that EHRM accept data that does not meet its internal data quality standards, Contractor shall implement the solution so that any incoming data that does not meet EHRM data quality standards shall be clearly flagged as such, and provide both process and user interface to allow incorrect or missing data to be remedied if possible.

Data Migration Planning

The Contractor shall support data migration planning to support seamless care and to ensure operational integrity.

The Contractor shall:

a) Develop a Data Migration Plan (DMP) that provides an understanding of the EHRM Solution implementation sequence and priorities, data quality, data volumes, and data extract, transformation and load strategy for both the EHRM and Population Health Management solutions.

i. The DMP shall describe the approach for data ingestion and extraction, storage, access, data conversion, and data security strategies.

ii. The DMP shall account for key clinical data in VistA along with other relevant systems and outline a strategy to make that viewable and actionable.

iii. The DMP shall also address data validation assessing the migration of VistA legacy data to HealtheIntent and Millennium.

iv. The DMP should address how to migrate data that is still actionable and to maintain actionability

v. The DMP shall identify, clarify, and propose approaches for the following:

1. Data Integration (Data flow from VA to Cerner)

2. Data Continuity (VA Legacy Data Integration)

3. Data Syndication (Data flow from Cerner to VA and partner applications and databases)

b) Plan and document the data ingestion mechanism and processes along with terminology mapping to standards associated with data migration and data synchronization/syndication.

c) Plan initial and incremental loading of data into HealtheIntent to include batch and streaming (i.e. near real-time) options

d) Analyze and propose way forward for the capability for external apps to use HealtheIntent as a data source

e) Organize and facilitate a Joint VA/DoD/Cerner Data Governance Board to develop strategy and priorities.

Contractor and VA to create a strategy to establish an archival instance of a VistA instance once the site has migrated to Milleniuum and the local VistA instance is no longer being updated. This instance will be accessible and can be used for high latency extraction.

Implementation Planning

The Contractor shall:

a) Deliver an Implementation Plan that defines the Contractor’s plan for deployment, training, change management, and sustainment of EHRM to the VA Enterprise

b) Brief VA EHRM management on, at a minimum, the following information:

i. Enterprise deployment strategy

ii. Change management approach

a. EHRM System User Role definitions

b. The availability of EHRM User Provisioning workflows

c. Level of Effort estimate to provision all EHRM users during migration

d. Level of Effort estimate to provision new users and maintain end user permissions post migration

iii. Training approach

iv. Sustainment and helpdesk approach

c) Propose recommended change management activities for the most efficient and effective change management support of EHRM in the Monthly Progress Report

i. Execute such activities upon Government approval

d) Participate in VA EHRM business process reengineering discussions and advise or present industry leading practices, processes and workflow

e) Conduct a comparative analysis between the EHRM solution-inherent workflows and the “As-Is” organizational business processes and provide recommendations on process re-engineering, change management and product configuration

f) Provide Business Process Workflow Diagrams and Role Definitions that define business and clinical workflows and describe how improved functionality, improved and efficiency, how meaningful use has been achieved, and establish EHRM System user role definitions

g) Provide a Role Assignment Identification Document that maps user roles, rights and permissions to EHRM roles

Configuration Management

The Contractor shall draft a Configuration Management (CM) Plan for review and comment by the EHRM Program Management Office (PMO). After mutual agreement on the plan, the Contractor shall adhere to the CM policies and practices as described in the Plan. CM includes supporting the definition of Configuration Items (CIs) and relevant attributes and relationships to manage, establishing procedures for change and controlling request for change, providing the status of the CIs, and auditing the actual and authorized versions of each item. Maintaining a complete and accurate CM system ensures the integrity of system/software baselines and designated CIs required to provide services.

Value and Performance Management Reporting

The Contractor shall propose and monitor value objectives for improved outcomes and continuous performance improvement throughout the PoP of this contract. The Contractor shall:

a) assist with data analysis to identify possible optimization projects to further drive performance excellence after implementation at each site.

b) work with VA leadership to establish future value objectives through strategic planning sessions.

c) incorporate change management, workflow and process review and data analytics using the change management methodology agreed by Contractor and VA with consistent recognition and promotion of value achieved.

The Contractor shall use a value realization framework and tools to assist VA with creating value metrics aligned with VA, VHA and clinical strategic goals, and targeted to EHRM and specify goals and Critical Success Factors (CSFs). Value metrics will include Key Results Indicators (KRIs), Key Performance Indicators (KPIs), and traditional Performance Indicators (PIs). The Contractor shall develop and implement tracking mechanisms to measure and report EHRM progress against clinical and business goals.

Clinical goals may include:

a) Patient experience

b) Clinical staff experience

c) Clinical Efficiency

d) Operational Efficiency

e) Safety and Quality (Better Health, Better Care)

f) Patient Engagement

g) Best Practices Adoption

h) Financial Outcomes

i) Access to Care

j) Community Care

i. Health Plan Operations

ii. Seamless Care

iii. Access to Care

iv. Choice

k) Population Health

i. Seamless Care

ii. Access to Care

iii. Choice Business goals may include:

a) Cost

b) Scope

c) Schedule

d) Security

e) Quality

f) Technical Performance

g) Patient Access to Care

The Contractor shall develop standards for VA approval to be used as input for VA determination of successful site deployment. These standards may be related to the Clinical and business goals, including user adoption rates, process adherence, training competency test results, patient throughput or other similar indicators of success. For system performance (example: availability, accuracy, efficiency) the Contractor shall propose any deviation from or changes to the metrics jointly agreed with VA that will need to be approved as success criteria. The ability to measure these clinical and business requirements shall be documented in a monitoring and reporting plan and measured and reported to VA throughout the PoP. These tracking mechanisms will evolve over time throughout the PoP of this contract as deployments advance across the enterprise and the data available to support metrics expands.

EHRM System The Contractor shall provide an operational managed services solution for EHRM applications (software and subscriptions), application services and all supporting third party content required to deliver the functional and non-functional requirements set forth in the Requirements Traceability Matrix (RTM) included in Section D, Attachments 002 and 003 to this document.

Electronic Health Record Application

EHRM requirements are established at a strategic level and will guide the configuration and implementation of the system across VA. In addition to the requirements in the Government RTM, the Government may place orders for product enhancements or improvements to meet emerging needs, activate existing, but dormant capabilities in EHRM, or to address a need in the overall EHRM solution not explicitly extrapolated into the Government RTM.

EHRM is expected to unify and increase accessibility of integrated, evidenced-based healthcare delivery and decision-making. EHRM will support the availability of longitudinal medical records for the patients currently enrolled in the VA EHR and new patients as they transition into EHRM as set forth in the VA Enterprise as defined in section H1. EHRM will enable the application of standardized workflows, integrated healthcare delivery, and data standards for improved and secure electronic exchange of medical and patient data between the VA and its external partners, including the DoD, and other Federal and private sector healthcare providers. The workflows inherent to EHRM will be configured, adopted by and standardized throughout VA as applicable. EHRM will leverage data exchange capabilities in alignment with the Interagency Program Office (IPO) for standards-based health data interoperability and secure information sharing with external partners. Testing conducted under the Test and Evaluation Program Plan may include specific workflows to inform a demonstration of end-to-end clinical use cases involving external stakeholders.

1.1.1.1 Software Requirements

The Contractor shall:

a) Provide all applicable software licenses in accordance with all clauses, identifications and assertions, terms, and conditions related to commercial and non-commercial technical data, computer software, and computer software documentation to support the configuration, integration, custom development, test, software management, training, deployment, and end-user usage of EHRM

b) Manage and track all software licenses required to establish, operate, and maintain EHRM.

c) Provide initial limited licensing for Multum testing and integration with VistA

d) Maximize utilization of VA-provided enterprise licenses where available and appropriate.

e) Provide and update an EHRM Enterprise Release Schedule identifying:

i. Software release packages based on security and system incidents

ii. Planned Technology Refresh and Modernization activities

iii. New installations and service upgrades

f) Identify and report issues and risk associated with software and report risks/issues and status of any mitigation actions in the Monthly Progress Report and at Program Management Reviews (PMRs), technical reviews, program milestones and configuration audits.

g) Configure workflows inherent to HealtheIntent for adoption throughout VA as applicable

h) Provide the ability to segregate information (e.g. from users, from DoD, separate practices for military sexual trauma (MST), employee health, and others)

i) Provide the ability to exclude/segregate/de-identify data from specific practices from HealtheIntent, e.g., MST.

j) The EHRM solution shall support broad access via tablet or mobile devices and pursue technology to reduce the burden to the clinicians (e.g., providing third-party provider access to information using light-weight portals and support for future generation mobile devices). Platform specifics shall be adjudicated by joint governance and incorporated by VA at a TO level..

k) PThe EHRM solution shall provide third-party provider access to information using light-weight portals and support for future generation mobile devices. rovide for the ability to measure the EHRM performance that contributes to any end-to-end use case, thereby capturing its impact on improving Veteran and clinician experiences.

l)

1.1.1.2 Hardware Requirements

The Contractor shall provide and maintain Cerner-specific hardware required for the EHRM solution. This hardware includes such items as connectivity engines and device adaptors.

Additional EHRM Functionality

VA’s requirements will evolve over the course of the IDIQ. To maximize meeting of government requirements while minimizing risk to the Contractor and VA, the parties will engage in periodic future-capability planning cycles. Future requirements may include such items as clinician access to EHRM via tablet.

The Contractor shall meet with the VA once a year to provide visibility to Contractor’s roadmap of future capabilities. The Contractor’s roadmap shall detail capabilities that the Contractor is anticipating to develop as part of its generally available (GA) product over one, two, and three years. The VA may request such capabilities in a manner that corresponds with wave task orders As mutually agreed between the Contractor and VA, the Contractor may host an interim capability planning event upon request. These interim planning events are expected to focus on wave task orders in the subsequent 12 months or to make adjustment to future milestones based on unforeseen information or events.

The Contractor shall include VA in all user groups and other planning activities that other major clients participate in and that are used to inform the prioritization of the Contractors development backlog. In addition, VA will provide input to applicable Cerner business units on capability prioritization.

The Contractor shall provide VA the right to acquire additional modules developed to support the evolving electronic health record commercial baseline throughout the PoP of this contract.

Software Maintenance

The Contractor shall provide its commercial support and maintenance services described in its End User License Agreement. Leveraging Contractor’s best practices and agreed upon upgrade schedule between DoD and VA, software maintenance includes all releases of the software such as major releases, minor releases, maintenance releases. Maintenance will be conducted in such a way to minimize impact to the user community.

Contractor shall:

a) Maintain EHRM software including any Off the Shelf software applications and tools included in the solution

i. Notify the Government of any software that is within two years of end of life, end of service, or end of Software maintenance release

ii. Ensure all software has continuous vendor support

b) Renew software licensing and maintenance agreements as required throughout the PoP of the TO.

c) Support other functional dependencies, such as device certificates and PKI, if applicable d)

EHRM Hosting and Managed Services

The Contractor shall provide enterprise datacenter hosting and services consistent with the hosting requirements set forth in Contractor’s Hosting Agreement. If a cloud hosting environment becomes a more viable solution over the Period of Performance, Cerner may migrate the joint DoD/VA hosting environment to a Cerner private cloud or external third party cloud upon concurrence and security validation from the joint DoD/VA governance authority. The Contractor shall:

a) Provide hosting and managed services to support delivery of the EHRM

b) As a minimum, employ appropriately tailored security controls from the high baseline of security controls defined in NIST Special Publication 800-53 and must ensure that the minimum assurance requirements associated with the high baseline are satisfied. The hosting environment shall be compliant with FISMA- High or equivalent or higher controls. Any deviation from high impact controls must be approved by the Authorizing Official or designee.

c) Provide a primary and alternate data center to support continuity of operations and disaster recovery requirements

d) Support VA Network connectivity requirements

e) Provide all hardware, software, and services necessary to perform sustainment of EHRM in Contractor’s hosted environment

f) Provide continuous technical support and system monitoring to immediately react to a system event

g) Utilize established commercial and proprietary automated tools to monitor and managed vital datacenter infrastructure and EHRM systems.

h) Administer support access by contractor personnel to the EHRM environment using two factor authentication via RSA SecurID in lieu of CAC/PIV authentication for managing solutions within the accredited boundary

i. Access to the EHRM environment by administrative personnel external of the Cerner hosted network will be provided through a VDI and utilize appropriate CAC/PIV authentication

ii. Administrators shall use non-privileged accounts, or roles, when accessing other system functions such as email, and if feasible, audit any use of privileged accounts, or roles, for such functions.

i) Support VA troubleshooting for network latency and packet loss issues to assist in identification of sources of network transport response time issues.

j) Leveraging Contractor’s best practices and agreed upon upgrade schedule between DoD and VA, hosting maintenance includes patches, cybersecurity, and software assurance updates. Maintenance will be conducted in such a way to minimize impact to the user community.

Non-Production Environments / Domains

The Contractor shall:

a) Host and operate all EHRM non-production environments/domains that are functionally equivalent to production environments/domain. The environment/domains will support the non-production requirements and needs across the lifecycle of the VA EHRM, including development, testing, training, certification (for upgrades), and sustainment. Development activities include the activities to develop/build the interfaces between the EHRM, VistA, other VA systems and non-VA systems within the EHRM program scope. Test activities will be executed in these non-production environment test environments that represent architecturally, operationally and technically realisticsimilar non-production environments so that test and training results are identical as if run in production test environments.

b) Work closely with VA to identify the number and use of non-production environment/domains required to mitigate the risk of development/test events schedule collisions or usage issues/conflicts between Contractor, VA EHRM and DoD MHS GENESIS teams performing work in the same non-production environment/domain.

c) Work closely with VA EHRM and DoD MHS GENESIS teams to create/maintain a Non-Production Domain Integrated Master Tracking/Schedule of key activities taking place in non-production environments/domains to mitigate risks/issues impacting EHRM schedules. Risks/Issues may arise due to multiple teams sharing the domain environment.

d) Coordinate new requirements and modifications that impact the existing DoD-VA Joint Test Environments thru the DoD-VA Joint Test Environment workgroup.

e) Work jointly with VA and DoD MHS GENESIS teams as needed to establish network connectivity between non-production environments/domains and use established connectivity processes such as, VA ESCCB and DoD MHS GENESIS PEO change control for non-production environments.

f) Participate with VA in environment/domain network connectivity test to ensure the environments pass connectivity tests

g) Ensure EHRM system installed within the non-production environment/domain are functional

h) Participate with DoD MHS GENESIS/VA teams in environment/domain smoke tests as needed to ensure any DoD interfaces (like Joint Legacy Viewer or DoD DEERS) are functional (pass smoke tests)

i) Provide Access to non-production environments for VA (both VA government and VA contractors) resources involved in VA Test & Evaluation, as needed. Access type may vary. For example, some users will need access commensurate with their roles as trainers while others may need the same access they have in the production environment. Functional integration testers will need to change testing roles.

j) Use a non-production environment/domain to support VA Mockups of the medical operational environment (aka sim labs/learning centers) in which end users will interact with EHRM potentially to be used for training and other end user engagement activities.

k) Work closely with VA EHRM resources to determine the data requirements within non-production/domains in support of the VA mockup environment and the facility/site data that the medical devices in the VA mockup operational environment will be set up against. which facility/site test data within non-production/domains would be used in support of the VA Mockups environment particularly which facility/site the medical devices in the VA Mockup operational environment would be setup against.

l) Create, maintain, and provide the architecture/system diagrams showing how each non-production/domain environment is interfaced to VA systems with input from VA for the EHRM and VA systems integration.

VA will provide the non-production development/test environments for interface/integration development and test to…