20250206 BHL PWS V1.1 for RFI.docx

Behavioral Health Lab (BHL) Software

<VA-XX-XXXXXXXX>

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information and Technology Office of Mental Health Services Veterans Integrated Service Network 4 Mental Illness Research and Education Clinical Center

Behavioral Health Lab (BHL) Software Maintenance and Technical Support

<VA-25-00008201>

PWS Version Number: 1.0

Contents

BACKGROUND

The Department of Veterans Affairs (VA), Veterans Health Administration (VHA), Office of Mental Health, and the Veteran Integrated Service Network (VISN) 4 Mental Illness Research Education and Clinical Center (MIRECC) has a requirement for software that supports our clinical priority of using measurement-based care for the treatment of mental illness. This shall require software maintenance and technical support. Measurement-based care encompasses the use of standardized patient reported outcomes (PRO’s) to inform clinical decision making and to screen for symptoms. Currently VA uses the “BHL software suite” which is a commercial product by Capital Solution Design (CSD). The software is actively used throughout all VA Medical Centers (VAMCs) for delivering evidence-based measurement-based health care. The scope of work for this contract must either continue supporting the BHL suite as outlined in the work or propose a replacement strategy with no interruption in the current service.

Currently, the BHL software suite consists of two versions of the software. A web-based version (BHL Touch) allows staff to send patient reported outcome measures (PROM) to Veterans by text or email as well as on properly configured tablet. As well as a desktop version for structured assessments to monitor patient progress.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21, 2018

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

70. Review And Use Of Patient-Generated Health Data Under The Office Of Connected Care, VHA Directive 6506

71. Guideline for the Collection, Monitoring and Use of Asynchronous Veteran Self-Reported Health Data Office of Mental Health SharePoint https://dvagov.sharepoint.com/sites/VACOMentalHealth/SitePages/Async_Comms-Data.aspx.

SCOPE OF WORK

The Contractor shall provide enterprise software licenses, maintenance, training, and updates for desktop and/or web-based versions of the assessment software. This effort shall include program management, software development, software maintenance, testing, helpdesk, and training for software features. The software shall require interface with VA electronic health records, currently including Oracle/Millennium and Vista/CPRS systems.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The Period of Performance (PoP) shall be 12-month Base Period with four (4) 12-month Option Periods and optional tasks that can be exercised throughout the life of the contract. The overall Period of Performance shall not exceed 60 months.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

TRAVEL

The Government does not anticipate travel under this effort.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the tasks outlined in paragraphs 5.1 to 5.4 below. This contract covers the use of a software solution for use in measurement-based care (including all VHA users) and OMH program evaluation.

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

REPORTING REQUIREMENTS

The Contractor shall provide the Contracting Officer’s Representative (COR) with Monthly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding Month.

The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. The Contractor shall keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Deliverable:

A. Monthly Progress Report

WEEKLY, BI-MONTHLY AND AD-HOC TELECONFERENCES

The Contractor shall participate in monthly teleconferences with representatives of the VISN 4 MIRECC for ongoing project management review and discussions of priorities for upgrades and enhancements. Ad-hoc calls may be necessary for urgent issues such as a system failure, deadlines that are urgent for the Government Accountability Office, Inspector General or Congressional inquiries, or an unforeseen problem.

SOFTWARE REQUIREMENTS

Software development and sustainment efforts shall include Human Centered Design (HCD) and Software Application Performance Monitoring (APM). VA Digital Service has developed two (HCD and APM) Digital Service PWS Language guides to assist. https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=27

A software solution shall allow Veteran completion of PROs on the Veteran’s phone or computer; as well as by tablet device in the office or by clinical staff entry on Government furnished equipment (GFE). The software shall support a variety of PRO’s as a library with VA input on the selection. The VA is responsible for all licensure and copyright requirements for any PRO’s.

The solution shall allow staff to send assessments to Veterans by text or email. Additionally, the solution shall be available at all facilities with access controlled by SSO authentication. The suite shall also be available to OMH program staff for use. If desktop software is part of solution, then desktop software shall be installed enterprise wide. Solution shall provide for regular structured assessments to monitor patient progress and determine when treatment adjustments or additional resources are needed to ensure Veterans are contacted and monitored on a regular basis. In addition, the software must be available to be used for program evaluation purposes. The solution must allow creation of a panel of patients for each VA staff member to follow.

The self-assessment data shall have the ability to be used as part of program evaluation or for direct patient care. In the case of direct patient care, all assessments collected by the software shall be written into the electronic health record (Oracle/Millennium and Vista/CPRS) as a progress note. This will include item level data deposited in the MH Vista file when appropriate or the corporate data warehouse (CDW) for other assessments. Data from program evaluation will be separately stored for VA use.

This software shall also provide clinical program informatics support that allows for tracking patients over time and monitoring patients’ symptoms (graphing of results) overtime.

In addition, the Software shall:

1. Be easily used by VA clinicians regardless of setting.

2. Support measurement-based care throughout all healthcare settings.

3. Include decision support including scoring of PROs and flagging for high-risk responses.

4. Creates progress notes and patient facing summary materials that include graphs of progress.

5. Provide a tool for patient tracking & panel management (this may be limited to the desktop version).

6. Be easy to use for clinical staff to order assessments and login via single sign in PIV card.

7. This software must also provide clinical program informatics support that allows for tracking patients over time, monitoring patients’ symptoms over time, and accessing patient and program level data.

8. A software solution shall meet all VA Office of Information Technology, privacy, security and technical requirements for enterprise-wide use.

9. Building and testing new/existing program evaluation forms (to be counted in the “new assessment” counts) and assisting with deployment of forms to field sites.

10. Support of user account configuration (multi-site), single sign-on and Oracle/Millennium and Vista/CPRS transmission (all tasks enabling new suicide prevention assessments to transfer to Oracle/Millennium)

11. Building data feeds of form data to OMH/NEPEC servers and workspaces.

New assessments. The base contract shall allow the Business Owner to approve up to 20 new assessments (~10 questions in length) to the software solution. Subsequent option years will include 10 new assessments. This would be for either program evaluation or measurement- based care. If the need is greater than stated in this paragraph new or updated assessments, this shall be done through the optional tasks.

New assessments placed in either the Web or Desktop versions shall be approved by VA. For Mental health related assessments, this shall be in cooperation with the STEC or program office for program evaluation assessments. The VA is responsible for all issues related to assessment copyright and licensing when applicable.

Any assessments collected solely for the purposes of program evaluation shall not be entered into the EMR and the data shall be partitioned in the software from the clinical data. Program evaluation data shall also be partitioned in separate files in VA data storage (e.g. CDW).

The Contractor shall comply with recommendations by the Digital Health Office and Office of Mental Health on the collection of asynchronous clinical data. This includes flagging any high-risk responses.

MAINTENANCE

This agreement shall cover the licensing, maintenance, technical support, and enhancement of both software versions (Web Based, Desktop).

The Contractor shall provide licensing and maintenance support for the availability of both web-based and desktop versions of software at all facilities with the potential for all authenticated electronic health record users and program staff to have access. This shall consist of all updates, patches, fixes, and security resolutions developed by the software provider.

The Contractor shall provide maintenance and technical support for all software across the enterprise to ensure the software remains operational. This shall include troubleshooting and software defect fixes for the software applications and related databases. The Contractor shall upgrade any defect fixes for the software to all the other installation sites. The Contractor shall also provide technical support for site audit, site inspection, backup issues and security issues to be handled through a help desk service operating Monday through Friday, 9:00AM until 5:00PM Eastern Standard Time.

LICENSING

Specific licensing requirements include:

a. Self-reported clinical data collected through the Software shall populate the electronic medical record (EMR) as the system of records. Patient response placed in the EMR shall reflect the same wording as presented to the patient. In instances in which the VA maintains a data repository of item line responses, the BHL software shall populate those responses including date and time stamps (e.g. ORACLE smart forms, VISTA Mental Health file).

b. Self-reported item level data not available in a VA EMR repository, shall be made available to the Clinical Data Warehouse (CDW) for storage.

TECHNICAL SUPPORT

The Contractor shall work with the enterprise service desk to manage user first queries. For items escalated to the contractor, the contractor shall have 48 hours to resolve any user access or account issues. If not within 48 hours, the VA shall be notified with a remediation plan.

The Contractor shall maintain a helpdesk presence by email. Users may email suggestions, complaints, outage issues, etc. If there is a significant use issues reported through this helpdesk, they shall have 48 hours to resolve any user access or account issues. If not within 48 hours, the VA shall be notified with a remediation plan.

The Contractor shall provide clinical and technical support to site users for both software versions, to include User account configuration (multi-site), single sign-on and Oracle/Millennium transmission (all tasks enabling new suicide prevention assessments to transfer to Oracle/Millennium).

The Contractor shall provide virtual remote clinical and technical support to manage user calls, create trouble tickets, and provide responses within four hours of a request.

The Contractor shall provide clinical and technical support to site users for the software solution, to include User account configuration (multi-site), single sign-on and Oracle/Millennium and Vista/CPRS transmission.

The support required ranges from normal to high priority to include log in issues, clinical set ups, platform crashes, and server downtime. The frequency of tickets is on average 104 tickets and calls per month, one (1) to eight (8) tickets/calls a day, Monday through Friday. (Calls may increase 5-10% due to the suicide prevention assessments.) Support services shall be provided Monday through Friday from 9:00 AM until 5:00 PM Eastern Standard Time (EST). The Contractor shall provide virtual remote clinical and technical support to manage user calls, create trouble tickets, and provide responses within four hours of a request.

The Contractor shall provide all technical support information performed in the monthly report (5.1.2) to track all assistance support provided and the time it took to resolve issues.

In collaboration with OMH and the VISN 4 MIRECC, development schedules, plan deployment dates, and coordinate rollout with OMH teams.

Deliverable:

Monthly Technical Support Report

EMR INTEGRATION AND VA ATO COMPLIANCE

Authority to Operate (ATO): Contractor shall comply with all VA regulations governing managing clinical data. Moreover, the Contractor shall work with the Office of Information Technology, the Digital Health office, and Office of Mental Health to assure appropriate security reviews, data storage requirements, and an ATO for the software solution. The Contractor shall work with VA Notify to maintain compliance with all Veteran messaging.

EMR integration: The Contractor shall also manage ad-hoc meetings with Oracle and the Behavioral Health council to identify assessment priority, define Oracle and CSD implementation assessment tasks, configure assessment mapping information, identify deployment dates.

SOFTWARE ENHANCEMENTS AND CHANGES

SOFTWARE UPGRADES

The Contractor shall upgrade the software solution and database platform to include any security, deployed mutually agreed upon user feedback, and VA Standards based functional enhancements for all users. This shall include new measures to specifically support VHA. This service encompasses changes requested by VA to be made to the software solution including:

· Operational sustainment task support

· Helpdesk

· Backup & Restoration

· System Upgrades

· Defect resolution and maintenance of:

· Assessment logic

· Reports

· Administrative functions

· Security

· Electronic Health Records interface modifications

· General Software functions

· VA specific documentation for security, policy or other required documents

OPTIONAL TASKS

ADDITIONAL ASSESSMENTS OPTIONAL TASK

Agile Development For software enhancements and upgrades the Contractor shall:

For each assigned analytics product/development project, the Contractor shall follow an Agile project management approach in the development, execution, and deployment of BI&A and data science products. The Contractor shall recommend and adopt, subject to Government approval, the most appropriate method or methods (or hybrids) to use in deployment of analytics products and solutions (e.g., Scrum, Scrumban, Kanban, and Extreme Scoping).

The Contractor shall:

1. Follow best practices in Agile solutions delivery

2. Ensure transparency into all build/product development activities

a. Maintain and make available all standard artifacts based on chosen Agile methodology (e.g. for Scrum – product/sprint backlog, burndown chart, velocity chart, product increment, retrospective)

b. Utilize a single Agile management tool to track execution (Confluence, Jira, or other Agile tool as required) as the authoritative data source

3. Maintain a backlog of requirements

a. Coordinate and conduct regular backlog refinement with participation of key stakeholders (business customers, DAPM leadership, COR, product owner, OIT and system subject matter experts, others as applicable) to capture and update requirements, which will be stored as a Requirements Packages in VA-approved tools (Confluence, Jira, etc.) at an interval agreed upon by key stakeholders

1. Requirements Packages shall include prototypes, proofs of concept, mock-ups, visual aids, and dynamic wireframes as required to demonstrate the navigation, taxonomy, menus and dependencies between features in the user interface (UI) and all aspects of the presentation layer that interact with the user

b. Score user stories in the backlog based upon a standardized story point sizing methodology, submitted to and approved by the product owner or other relevant key stakeholders

c. Implement a change control process to coordinate change request approval

d. Develop, update as necessary, and make available a ranked and prioritized Product Backlog Report

4. Build/Product Increment (PI) Planning

a. Coordinate and conduct PI planning with key stakeholders prior to beginning any increment

b. Coordinate and conduct Initial Design Review (as applicable) with key stakeholders to ensure design is technically acceptable

c. Develop Build plan/roadmaps, taking into account build complexity, resource availability, and resource capability and deliver to key stakeholders for review/approval

5. Build Test Plan (as applicable)

a. Provide a Build Test Plan to key stakeholders for review and approval prior to beginning any development activities

b. Demonstrably execute the Build Test Plan throughout development

6. Conduct regular Sprint Retrospectives

a. Identify and document pain points, gaps, risks, and opportunities for system enhancements for potential inclusion in the backlog

b. Review sprint activities to identify areas for improvement

c. Every quarter, meet with the COR and provide a general overview of work achieved during that quarter. This can be done along with a Sprint Retrospective. The COR will provide the schedule for these quarterly reviews.

7. Capture information shared in meetings as appropriate and upload to a central repository (e.g. Teams)

The Contractor shall adjust deliverables and repository tool updates to match the nature of the analytic process under development/operation.

Deliverables (due as a file that will be uploaded to eCOR by the COR):

A. Build Plan/Roadmap B. Build Test Plan C. Product Backlog Report D. Sprint Burndown Charts E. Velocity Charts

ADDITIONAL SCRUM TEAM SUPPORT (OPTIONAL TASK ONE) (FFP)

For additional enhancements, each task may be of different level of effort. In order to meet VA priorities and may require completion of additional projects throughout the PoP of this Task Order. VA may exercise this optional task for additional scrum teams to support development, interfaces, testing and/or system enhancement projects following the software development lifecycle described in Section 5.3, including all subparagraphs, of this PWS. The specific scope of functionality to be delivered for each build in the optional task shall be determined with VA Product/Project business owners prior to the start of each build cycle and may include product line management support defined in Section 5.2, software enhancements/upgrades in section 5.3. based on current business priorities. The Government will provide these requirements to the Contractor during the intake process and the Contractor shall make a recommendation as to the size of team and the mix of labor categories and resources needed to complete the requirement.

If exercised, the Contractor shall provide Agile teams (of varying size) and individual resources (when necessary) to build and maintain a platform with capabilities to streamline systems, improve scalability, increase availability and reliability of services, and more accurately measure investments in terms of business value while enabling more efficient delivery. The Agile team(s) shall work to strengthen the software by meeting and continuing to exceed Product Line Management maturity guidelines and DevSecOps and SAFe methodologies. These guidelines are evolving and subject to change as maturity develops within VA.

Examples of optional tasks that could be covered as part of a scrum team.

· Adding assessments in excess of those outlined in the base or option years.

· Releasing Spanish versions of assessments

· Providing administrative reports for supervisors, program offices.

· Adding flags for Veterans that are on the ReachVet list or have high risk Flags.

· Adding a lock out process for use of IPADs in the office.

· The ability to send groups of Veterans the same assessments.

· Support of multi-instance (CPRS) access for programs such as clinical resource hubs which allows a user to interact with more than one CPRS or ORACLE instance.

· Development of improved automation for alerting providers or sending assessments when clinically indicated without provider action.

· Develop SUD Application

· Ability to show more than one question at a time when in an interview mode.

MICRO SCRUM TEAM

The Contractor shall provide an additional scrum team consisting of 1 or 2 full time equivalents (FTEs) for a month made up of the appropriate technical skill sets to support multiple builds throughout each PoP. This option may be exercised up to 25 times in the base and in each option period, for a total of up to 125 times over the life of the Task Order.

SMALL SCRUM TEAM

The Contractor shall provide an additional scrum team consisting of 3 or 4 FTEs for a month made up of the appropriate technical skill sets to support multiple builds throughout each PoP. This option may be exercised up to 25 times in the base and in each option period, for a total of up to 125 times over the life of the Task Order.

MEDIUM SCRUM TEAM

The Contractor shall provide an additional scrum team consisting of 5 or 6 FTEs for a month made up of the appropriate technical skill sets to support multiple builds throughout each PoP. This option may be exercised up to 30 times in the base and in each option period, for a total of up to 150 times over the life of the Task Order.

LARGE SCRUM TEAM

The Contractor shall provide an additional scrum team consisting of more than 7 FTEs for a month made up of the appropriate technical skill sets to support multiple builds throughout each PoP. This option may be exercised up to 35 times in the base and in each option period, for a total of up to 175 times over the life of the Task Order.

GENERAL REQUIREMENTS

ENTERPRISE AND IT FRAMEWORK

VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns, https://www.oit.va.gov/library/recurring/edp/index.cfm. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500 Appendix F, “VA System Security Controls”, and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-05-24, M-19-17, and NIST Federal Information Processing Standard (FIPS) 201-2. OMB Memoranda M-05-24 and M-19-17 can be found at: https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2005/m05-24.pdf, and https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf respectively. Contractor delivered applications and systems shall be on the FIPS 201-2 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Person Index (MPI) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable design pattern as outlined in VA Enterprise Design Patterns.

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion-based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

10. Role Based Access Control.

11. Auditing and reporting capabilities.

12. Compliance with VIEWS 00155984, PIV Logical Access Policy Clarification https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896.

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) shall support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and dual stack (IPv6 / IPv4) operations.

TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 “Secure External Connections”, and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the Cybersecurity & Infrastructure Security Agency (CISA) (https://www.cisa.gov/publication/tic-30-core-guidance-documents). Any deviations must be approved by the VA TIC 3.0 Working Group at vaoisesatic30team@va.gov.

STANDARD COMPUTER CONFIGURATION

The Contractor IT end user solution that is developed for use on standard VA computers shall be compatible with and be supported on the standard VA operating system, currently Windows 10 (64bit), Edge (Chromium based), and 365 Apps for enterprise. Applications delivered to VA and intended to be deployed to Windows 10 workstations shall be delivered as a signed .msi package with switches for silent and unattended installation and updates shall be delivered in signed .msp file formats for easy deployment using Microsoft Endpoint Configuration Manager (CM) VA’s current desktop application deployment tool. Signing of the software code shall be through a vendor provided certificate that is trusted by VA using a code signing authority such as Verizon/Cybertrust or Symantec/VeriSign. The Contractor shall also ensure and certify that their solution functions as expected when used from a standard VA computer, with non-admin, standard user rights that have been configured using the United States Government Configuration Baseline (USGCB) and Defense Information Systems Agency (DISA) Secure Technical Implementation Guide (STIG) specific to the particular client operating system being used.

VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT LINE MANAGEMENT (PLM)

The Contractor shall support VA efforts IAW the updated Veteran Focused Integration Process (VIP) and Product Line Management (PLM). The major focus of the new VIP is on Governance and Reporting and is less prescriptive, with a focus on outcomes and continuous delivery of value. Product Line Management (PLM) is a framework that focuses on delivering functional products that provide the highest priority work to customers while delivering simplified, reliable, and practical solutions to the business, medical staff, and our Veterans. The VIP Guide is a companion guide to the PLM Playbook and can be found at: https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 and the PLM Playbook can be found at https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946. The PLM Playbook pivots from project-centric to product-centric delivery and contains descriptive practices that focuses on outcomes. The PLM Playbook contains a set of “plays” that implement Development, Security, and Operations (DevSecOps) principles and processes such as automated development, continuous integration/continuous delivery, and release on demand. The PLM Playbook details how product lines implement Lean-Agile principles, methods, practices, and techniques through levels of maturity. VIP and PLM are the authoritative processes that IT projects must follow to ensure development and delivery of IT products.

PROCESS ASSET LIBRARY (PAL)

The Contractor shall perform their duties consistent with the processes defined in the OIT Process Asset Library (PAL). The PAL scope includes the full spectrum of OIT functions and activities, such as VIP project management, operations, service delivery, communications, acquisition, and resource management. PAL serves as an authoritative and informative repository of searchable processes, activities or tasks, roles, artifacts, tools and applicable standards and guides to assist the OIT workforce, Government and Contractor personnel. The Contractor shall follow the PAL processes to ensure compliance with policies and regulations and to meet VA quality standards. The PAL includes the contractor onboarding process consistent with Section 6.2.2 and can be found at https://www.va.gov/PROCESS/artifacts/maps/process_CONB_ext.pdf. The main PAL can be accessed at www.va.gov/process.

AUTHORITATIVE DATA SOURCES

The VA Enterprise Architecture Repository (VEAR) is one component within the overall EA that establishes the common framework for data taxonomy for describing the data architecture used to develop, operate, and maintain enterprise applications. The Contractor shall comply with the department’s Authoritative Data Source (ADS) requirement that VA systems, services, and processes throughout the enterprise shall access VA data solely through official VA ADSs where applicable, see below. The Information Classes which compose each ADS are located in the VEAR, in the Data & Information domain. The Contractor shall ensure that all delivered applications and system solutions support:

1. Interfacing with VA’s Master Person Index (MPI) (formerly the Master Veteran Index (MVI)) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

2. Interfacing with Capital Asset Inventory (CAI) to conduct real property record management actions, if the solution relies on real property records data. CAI is the authoritative source for VA real property record management data.

3. Interfacing with electronic Contract Management System (eCMS) for access to contract, contract line item, purchase requisition, offering vendor and vendor, and solicitation information above the micro-purchase threshold, if the solution relies on procurement data. ECMS is the authoritative source for VA procurement actions data.

4. Interfacing with HRSmart Human Resources Information System to conduct personnel action processing, on-boarding, benefits management, and compensation management, if the solution relies on personnel data. HRSmart is the authoritative source for VA personnel information data.

5. Interfacing with Vet360 to access personal contact information, if the solution relies on VA Veteran personal contact information data. Vet360 is the authoritative source for VA Veteran Personal Contact Data.

6. Interfacing with VA/Department of Defense (DoD) Identity Repository (VADIR) for determining eligibility for VA benefits under Title 38, if the solution relies on qualifying active duty military service data. VADIR is the authoritative source for Qualifying Active Duty military service in VA.

SOCIAL SECURITY NUMBER (SSN) REDUCTION

The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN with the ICN in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA Master Person Index (MPI) for identity traits to include the use of the ICN as the Primary Identifier. The Contractor solution may only use a Social Security Number to identify an individual in an information system if and only if the use of such number is required to obtain information VA requires from an information system that is not under the jurisdiction of VA.

SOFTWARE AND LICENSING REQUIREMENTS

The Contractor shall be responsible for the provision of all software licenses and any associated licensing maintenance required for any development, delivery, integration, operation, and/or maintenance associated with its proposed application(s), software products, software solution, and/or system including, but not limited to, any and all application(s), software and/or software products that comprise, are a part of, or integrate with the Contractor’s proposed application(s), software products, software solution, and/or system for the life of any resulting contract.

SECURITY AND PRIVACY REQUIREMENTS

It has been determined that protected health information may be disclosed or accessed and a signed Business Associate Agreement (BAA) shall be required. The Contractor shall adhere to the requirements set forth within the BAA, referenced in Section D of the contract, and shall comply with VA Directive 6066.

POSITION/TASK RISK DESIGNATION LEVEL(S)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Position Sensitivity and Background Investigation Requirements by Task

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

Contractor Responsibilities:

1. The Contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain the appropriate Background Investigation, and are able to read, write, speak, and…