Document is no longer acquisition sensitive due to contract award on May 17, 2018 ACQUISITION SENSITIVE Department of Veterans Affairs Electronic Health Modernization Request for Proposal Interoperability Review Report Authors: Jay J. Schnitzer, M.D., Ph.D. (b) (6) ACQUISITION SENSITIVE Confidential and Proprietary Document is no longer acquisition sensitive due to contract award on May 17, 2018 For Department of Veterans Affairs Use Only Document is no longer acquisition sensitive due to contract award on May 17, 2018 ACQUISITION SENSITIVE This page intentionally left blank. ACQUISITION SENSITIVE Confidential and Proprietary Document is no longer acquisition sensitive due to contract award on May 17, 2018 For Department of Veterans Affairs Use Only Document is no longer acquisition sensitive due to contract award on May 17, 2018 ACQUISITION SENSITIVE Document Number: MTR180033 Authors: Jay J. Schnitzer, M.D., Ph.D. (b) (6) (b) (6) McLean, VA January 2018 Sponsor: Department of Veterans Affairs The views, opinions and/or findings contained in this report are those of The MITRE Corporation and should not be construed as an official government position, policy, or decision, unless designated by other documentation. For Internal MITRE Use. This document was prepared for authorized distribution only. It has not been approved for public release. (C) 2018 The MITRE Corporation. All rights reserved. For Department of Veterans Affairs Use Only VA EHRM RFP Interoperability Review Report January 31, 2018 ACQUISITION SENSITIVE Confidential and Proprietary Document is no longer acquisition sensitive due to contract award on May 17, 2018 For Department of Veterans Affairs Use Only Document is no longer acquisition sensitive due to contract award on May 17, 2018 ACQUISITION SENSITIVE This page intentionally left blank. ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only Document is no longer acquisition sensitive due to contract award on May 17, 2018 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Executive Summary This Review Report presents responses to three requests from the Department of Veterans Affairs (VA) to MITRE related to the topic of interoperability within the VA Electronic Health Record Modernization Request for Proposal: I. Conduct an external Interoperability Review Panel to review the interoperability language in the existing Request for Proposal (RFP), II. Engage an independent and unbiased legal expert to identify the specific changes to the RFP language necessary to implement the recommendations from the Interoperability Review Panel, and III. Visit the University of Pittsburgh Medical Center to understand the existing operational multi-vendor solution and interoperability solutions for applicability and scalability to the VA. I. Interoperability Review Panel In support of the Secretary of Veterans Affairs, David J. Shulkin, M.D., The MITRE Corporation convened and hosted a VA Electronic Health Record Modernization (EHRM) Request for Proposal (RFP) Interoperability Review Panel on January 5, 2018, at MITRE's McLean headquarters. The invited external senior electronic health record (EHR) interoperability subject matter experts (the Panel) reviewed the interoperability language in the existing RFP and developed joint suggestions and recommendations for VA to consider for incorporation to support the successful execution of a new commercial EHR contract with industry. The Panel affirmed that the primary goal should be seamless Veteran-centric healthcare achieved through true EHR interoperability. Achieving this goal rests on three overarching principles that should be supported by interoperability language in the RFP: 1) free and open access to data, 2) an ecosystem that provides fair access to third parties by creating a level playing field, and 3) a seamless Veteran and health provider (clinician) experience. Four categories of recommendations from the Panel (the first three to the interoperability language in the RFP, and the fourth for future VA contracts) will enable VA to realize this goal on the basis of the underlying principles: 1) commit to full VA-Department of Defense (DoD) interoperability, 2) leverage current and future standards, 3) commit to open, standards-based application programming interfaces (APIs), and 4) use Care in the Community contracts to foster interoperability. For the first category (commit to full VA-DoD interoperability), the Panel agreed that the Determination and Findings signed by Secretary Shulkin on June 1, 2017, represented the correct approach to interoperability within VA and between VA and DoD. The Panel strongly endorsed the proposed VA "API Gateway" language. The most important specific recommendations included: o Define the degree of interoperability the solution will provide, ranging from basic file sharing to fully interchangeable, integrated and functionally identical patient records. ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only v Document is no longer acquisition sensitive due to contract award on May 17, 2018 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Suggest that the Contractor conduct an annual Interoperability Self-Assessment against current and future standards that shall be specified by the VA; and o The contract language should include the following elements: o performance measures to hold Cerner accountable for reducing the administrative burden in clinician workflow with the objective of increasing efficiency, o ability for bulk data export based on standards, with no proprietary formats (e.g., Flat FHIR [Fast Healthcare Interoperability Resources]), and o "push" capability to insert patient data back into the VA EHR / Cerner database. For the second category (leverage current and future standards), the following specific recommendations were among the most important: o Require that Cerner implement all standards as defined by VA, current and future, o Engage Cerner as an advocate of the VA and DoD position in all relevant standardsmaking bodies, and o Ensure that VA and Veterans have complete access to data. For the third category (commit to open, standards-based APIs), the Panel voiced the following recommendations: o Establish clear publishing and access service requirements, o Provide a VA application platform that supports APIs from third party providers with no barrier to entry, and o Require implementation of clinical decision support (CDS) Hooks to invoke decision support from within a clinician's EHR workflow. The body of this report contains multiple additional specific recommendations. II. Recommendations for RFP Changes MITRE engaged Morrison & Foerster, LLP as the independent and unbiased legal expert to identify the specific changes to the RFP language necessary to implement the recommendations from the Interoperability Review Panel. Appendix C presents all recommended changes to the RFP. III. Observations from University of Pittsburgh Medical Center Site Visit A delegation from VA and MITRE traveled to Pittsburgh, Pennsylvania, on January 19, 2018, for a meeting with representatives from University of Pittsburgh Medical Center (UPMC) Enterprises to discuss aspects of EHR interoperability that UPMC has successfully implemented over the past several years. The report includes an overview of those practices. ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only vi Document is no longer acquisition sensitive due to contract award on May 17, 2018 Document is no longer acquisition sensitive due to contract award on May 17, 2018 IV. Closing Thoughts and Suggested Next Steps The Panelists noted that VA cannot achieve true future EHR interoperability through the Cerner RFP alone, or through technology alone. The state of practice today shares only a small portion of available patient data. For VA to succeed in the future, multiple other components must be present and aligned: innovation, policy, standards, customer buy-in, and legislation, to name a few. The following next steps are recommended for VA consideration: 1. Complete the RFP revisions, conduct appropriate negotiations with the Contractor expeditiously, and complete the contract process as planned. Stand firm during negotiations to maximize ease of access to data and data models for building third party APIs, applications, and services for future community innovations. 2. Continue to work with other federal government agencies and departments with similar interoperability interests and concerns, including, but not limited to, the White House, DoD, Food and Drug Administration (FDA), Centers for Medicare and Medicaid Services (CMS), Office of the National Coordinator for Health Information Technology (ONC), and other parts of the Department of Health and Human Services, to align approaches to EHR interoperability and the development and support of standards government-wide. 3. Support future innovation approaches, including concepts such as an Interoperability Laboratory and outreach to the broader innovation ecosystem (major medical centers, academia, traditional and non-traditional healthcare providers, startups, individual entrepreneurs, others). It is critical to align the innovations planned in VA's Digital Veterans Platform to the VA EHR innovation efforts to ensure consistent continuous improvements to clinician and Veteran health experiences. 4. Create an External Review Panel to provide expert continuous guidance, review, and feedback over the course of the implementation, to help capture best practices from the expert community going forward. Conduct ongoing demonstrations of end-to-end Veteran use cases requiring data sharing across organizational boundaries to validate improvements in Veteran healthcare and reduction of burden for healthcare providers. VA and Contractor will ensure that Federal Advisory Committee Act (FACA) guidelines are followed in leveraging any external review panels. ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only vii Document is no longer acquisition sensitive due to contract award on May 17, 2018 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Table of Contents Background................................................................................................................................. 1 I. Interoperability Review Panel ............................................................................................ 2 Introduction........................................................................................................................ 2 Goal ................................................................................................................................... 2 Methodology/Approach ...................................................................................................... 2 Topic Area: VA Definition of Interoperability .................................................................... 3 Topic Area: Commit to Full VA-DoD Interoperability ....................................................... 4 Topic Area: Leverage Current and Future Standards........................................................... 6 Topic Area: Commit to Open, Standards-Based APIs ......................................................... 7 Topic Area: Use Community Care Contracts to Foster Interoperability............................... 9 Topic Area: Additional Contract Changes ........................................................................ 11 II. Recommendations for RFP Changes................................................................................. 12 III. Observations from University of Pennsylvania Medical Center Site Visit ......................... 13 IV. Closing Thoughts and Suggested Next Steps .................................................................... 16 Appendix A: Interoperability Review Forum Participants ......................................................... 17 Appendix B: RFP Language for Purchasing Extensible Health IT ............................................. 19 Appendix C: Recommended RFP Interoperability Language Changes ...................................... 22 Appendix D: Acronyms ............................................................................................................ 42 ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only viii Document is no longer acquisition sensitive due to contract award on May 17, 2018 Document is no longer acquisition sensitive due to contract award on May 17, 2018 This page intentionally left blank. ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only ix Document is no longer acquisition sensitive due to contract award on May 17, 2018 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Background The Department of Veterans Affairs (VA) plans to establish seamless care for Veterans throughout the health care provider market. Seamless care requires interoperability between the Department of Defense (DoD), VA, VA affiliates, community partners, electronic health record (EHR) providers, healthcare providers, and vendors. VA directed The MITRE Corporation to independently review the capability of Cerner's proposed EHR solution to seamlessly transmit health records between EHR systems supporting healthcare providers who both use and contribute patient data to a Veteran's health record, to include Veterans Choice Program (VCP) community-care service providers and VA affiliates. This Review Report presents responses to three requests: I. Conduct an external Interoperability Review Panel to review the interoperability language in the existing Request for Proposal (RFP), II. Engage an independent and unbiased legal expert to identify the specific changes to the RFP language necessary to implement the recommendations from the Interoperability Review Panel, and III. Visit the University of Pittsburgh Medical Center to understand the existing operational multi-vendor solution and interoperability solutions for applicability and scalability to VA. ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 1 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Document is no longer acquisition sensitive due to contract award on May 17, 2018 I. Interoperability Review Panel Introduction In support of the Secretary of Veterans Affairs, David J. Shulkin, M.D., MITRE convened and hosted a VA Electronic Health Record Modernization (EHRM) Request for Proposal (RFP) Interoperability Review Panel on January 5, 2018, at MITRE's McLean, VA headquarters. MITRE invited external senior EHR interoperability subject matter experts (hereafter referred to as Panelists) to review the interoperability language in the existing RFP and to develop joint suggestions and recommendations for VA to consider incorporating into the RFP to support the successful execution of a new commercial EHR contract with industry. Eleven Panelists took part in person, and several senior government executives observed the process (see Appendix A for the full list of participants). Goal The Interoperability Review Panel sought to provide Secretary Shulkin and his senior leadership team with insights into key best practices and guidance from national experts regarding EHR interoperability. The Panel evaluated the corresponding language in the draft RFP based on successful business transformations and implementations of a new commercial EHR system across a distributed hospital and provider network. This section of the report summarizes the outcome of the Panel: expert recommendations that will inform VA's interoperability contract language. The document also provides actionable and specific best practice recommendations and rationales to enable successful acquisition and implementation of EHR interoperability. Methodology/Approach The first part of the session, which lasted for five hours, was conducted as a fish-bowl exercise and was guided by Chatham House Rule. The Panelists sat at a center table, with VA and other government observers sitting at surrounding tables. The second part, which lasted two hours, consisted of a summary debrief to the Secretary and senior VA leadership. The Secretary could ask questions and engage with the Panel throughout the second session. MITRE moderated the session to elicit inputs from all Panelists and to drive alignment toward consensus in the recommendations. The agenda for the first portion of the session was structured to elicit inputs from all Panelists, with notes captured on-screen as redlines to the RFP interoperability language to ensure recommendations accurately reflected the Panelists' contributions. Subsequently, in a facilitated discussion, the Panelists grouped their recommendations into specific categories in real time. The second portion, as noted, provided opportunities for the Secretary to discuss the recommendations in additional detail. This section of the report summarizes the discussion that took place. It highlights actionable changes to the interoperability language contained in the RFP and additional recommendations and lessons learned that can enable interoperability of the VA EHRM solution. Text boxes ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 2 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Document is no longer acquisition sensitive due to contract award on May 17, 2018 throughout the report present direct quotations from Panelists. To ensure participant confidentiality, MITRE has destroyed the transcript and event recording used to develop this report. Topic Area: VA Definition of Interoperability The key to modernization is creating greater interoperability with Governmental partners, including DoD, in a way that focuses efforts in support of the Veteran's journey, beginning with their military service. We will partner with others to ensure Veterans can get their benefits, care, and services consistently, easily, and with excellent customer service, no matter where they are throughout their lives. VA will work with local communities, and with other Federal, State, Tribal, and Local Government entities to ensure Veterans get what they need. VA will also continue to leverage the private sector where appropriate and needed to deliver the very best outcomes for Veterans. - draft VA 2018-2024 Strategic Plan Enable data sharing, interoperability, and agility through data standardization VA needs to allow data sharing among various business applications, such as appointment scheduling and business intelligence, as well as ensure transportability of information between sites. Panelists "It really optimizes transportability of advised VA to leverage and support the best-in-class best practices, because if you are innovation currently in use within the VA culture. VA trying to transfer best practices from must also enable interoperability as the Department one site to another and you have the integrates the EHR into other supporting systems, both same system where the best practice is within the VA network and with external health service going to land, then it is much easier." providers. Agility is necessary for adoption of future innovative technologies and/or if VA wants to upgrade or change the EHR approach. The Panelists cautioned that the current EHR technology is already 20 years old and, as with all industries and information technology (IT) solutions, many possibly disruptive technologies exist on the horizon. The session began with a discussion on interoperability as currently defined by VA (Figure 1). Prior to establishing a roadmap to inform a nationwide plan to advance health data interoperability, VA must first ensure system-wide interoperability across the Department. Throughout the Review Panel session, the Panelists described and referred to this concept as "Level 1 Interoperability" throughout the Review Panel session; it includes migration of Veteran data from ~130 instances of the Veterans Health Information Systems and Technology Architecture (VistA) to one VA platform. ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 3 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Figure 1. VA Definition of EHR Interoperability "Level 2 Interoperability," as described in the Panel discussion, addresses the ability for VA to leverage the same Cerner platform used by DoD to ensure seamless care from active service to Veteran status. Once this capability is implemented, the clinical data transformation will allow a true longitudinal view of a Veteran's record as he or she transitions from DoD to VA for care and other critical services such as benefit adjudication. "Level 3 Interoperability" will allow both VA and DoD to take an important step toward transforming electronic patient data exchange on a national scale. With the utilization of community healthcare providers via the VA Community of Care initiative and DoD's Tricare network providers, VA has the opportunity to drive interoperability between DoD and VA as well as with the extensive network of healthcare providers that serve our Nation's Veterans, active duty service members, and their beneficiaries. True nationwide EHR interoperability for the entire United States is the ultimate goal, and the Panelists agreed that VA and DoD could reach this goal if the three aforementioned levels of interoperability are achieved. Here, VA has the opportunity to drive clinical transformation and instantiation of a complete EHR for all patients at the national level. Topic Area: Commit to Full VA-DoD Interoperability The Panel focused primarily on reviewing the interoperability language within the RFP for the Cerner contract. However as described in Interoperability Levels 1 and 2, the commitment to the seamless integration of VA and DoD health data represents the foundation required to realize interoperability with private sector "You really have to get the basics done first. Let's just make absolutely sure that the interoperability between DoD and VA [is achieved]." ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 4 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Document is no longer acquisition sensitive due to contract award on May 17, 2018 healthcare providers.1 It is important to note that the interoperability levels can be addressed simultaneously and should not be separated, as they must be integrated to efficiently achieve the larger future data sharing ecosystem. Specify the expectations for interoperability between DoD and VA During discussions about the expectation that Cerner will provide a single EHR solution to be shared by both DoD and VA, the Panel raised concerns about the lack of specificity in the contract language. Current interoperability data standards address a subset of the Veteran's clinical record and VA has the opportunity to ensure Cerner provides interoperability of all discrete data, at a minimum, between VA and DoD. Adopting the same platform would increase seamless sharing, but the Panel stated that VA should take additional action to ensure that such sharing is realized. The DoD and VA systems should use proprietary database-to-database interoperability if necessary, to maximize interoperability between those two systems. These systems should be configured to meet the distinct needs of each while being connected to each other in a native database-to-database method as necessary, leveraging open interoperability standards wherever possible. As a result, clinicians should experience no differences when they move from a VA system to a DoD system. These data should also be computable, or be made computable according to a specific schedule. VA should consider adding language to the RFP that specifically defines the degree of interoperability the solution will provide, ranging from basic file sharing to fully interchangeable, integrated and functionally identical patient records. The Panelists also stated that, for VA and DoD collectively, the contractual language should include the following requirements: o Performance measures to hold Cerner accountable for reducing the administrative burden in clinician workflow with the objective of increasing efficiency o Capability for bulk data export based on standards, with no proprietary formats (e.g., Flat FHIR [Fast Healthcare Interoperability Resources]) o "Push" capability to insert new patient data back into the VA EHR / Cerner database. Pivot the RFP to be Veteran-centric and not system-centric The Panelists discussed the impact of EHR implementations on clinician workflow, describing the issue as one of approaching the implementation as an IT system implementation rather than the preferred Veteran- or clinician-centric implementation. The current RFP appears to be written in a system-centric way rather than leveraging use-cases to describe the Veteran or clinician experience or workflow to characterize the requirement. The Panelists recommended that VA incorporate use-cases to characterize requirements and amend the RFP language to emphasize the Veteran-centric objectives. In addition, Panelists noted that VA should recognize that EHRs do not currently maximize efficient clinical workflow, and that VA specify that the 1 Healthcare providers is used to refer to community based physicians/specialist and hospitals. ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 5 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Document is no longer acquisition sensitive due to contract award on May 17, 2018 solution present clinicians with relevant information where needed with a minimum number of "clicks to find." Topic Area: Leverage Current and Future Standards The integrated EHR platform that DoD and VA are implementing provides the opportunity to significantly influence interoperability standards across the healthcare community, addressing gaps and competition among current standards. The Panel recognized that commercial health systems and technologies would realize only limited business value from making data portable between them, but this would lower the barrier to patient movement among healthcare providers. Engage Cerner as an advocate of the VA and DoD position in all relevant standards-making bodies The Panel recommended increased VA presence and leadership in national health IT standardsmaking activities, in coordination with the DoD. Additionally, VA should encourage Cerner to serve as an active advocate of the VA-DoD position and to participate actively in the development and/or evaluation of new standards, policy directives, operating procedures, processes, etc. As an integrated voting bloc, VA, DoD, and Cerner will have the potential to act as a strong driver of national standards. Panelists understood that VA is not currently active in the FHIR community or in the Health Level Seven International (HL7) Argonaut Project. In addition, Panelists identified a need for standards to exchange patient-reported outcome data for integration into the clinician's workflow. The current RFP language seemingly puts the burden on Cerner for the development of standards, and the Panel recommended that VA take a more active position. This will ensure that VA will participate and drive implementation when standards mature. Where standards are immature, VA must participate in efforts to accelerate standardization. Require Cerner to implement all standards as defined by VA, current and future Because it is unclear where health IT is heading in five years, the Panel strongly suggested VA include contract language to address possible future advancements in the form of standards as defined by VA. At a minimum, VA should seek maximum interoperability with community care organizations, using open interoperability standards wherever possible. This flexibility would ensure that VA does not rely on external stakeholders to determine the standards that VA would be required to accept. The Panel recommended that VA pay particular attention to specific categories of standards: real-time data read/write by care providers and Veterans; interoperability tools; seamless DoD and VA vision records; and principles for data normalization and structure. The Panel also recognized Cerner's influence in ensuring that the CommonWell network interoperates at the highest possible levels with other networks including CareQuality--an influence that VA should continue to promote. ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 6 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Document is no longer acquisition sensitive due to contract award on May 17, 2018 VA must own its data; clear ownership and access are critical to success now and in the future The Panel highlighted an important recommendation regarding data rights that was discussed in the prior VA EHRM Listening Forum on September 7, 2017. The Panel recommended that VA define who has what rights from the perspectives of data ownership, access, and sharing (e.g., VA owns the data and all data products vs. community care providers own the patient data vs. each Veteran owns all of his or her data). Determining the authoritative data source for the various elements of a Veteran's health record is an important Veteran-centric component of interoperability, the longitudinal record, and seamless access to data. "So, what you need is clear access and clear ownership of your information...you need to have absolutely, undisputed, clear ownership and ability to move the data to any place you want to use it and use it in any way you want to use it when you get there. And not have them [Cerner] be able to say no, that's our data or hinder you in any way or have an unreasonable charge to get it." VA should define an enterprise-wide policy for all VA data. A suitable policy would include, but not be limited to, EHRM-specific data, and should be issued by the VA Central Office (VACO) or Veterans Health Administration (VHA). VA must have clear ownership of and access to all the information in the EHR and be able to move that information (into new systems or among systems) as needed, now and in the future. Owning the data ensures that it is available regardless of vendor or system. VA must include this in the Cerner contract. Technology innovations occur rapidly in the 21st century, and VA must have full ability to move its data to future systems. Panelists also recommended that VA publish its data model, for instance to the National Library of Medicine, to further promote commercial interoperability investments. Lastly, Panelists encouraged VA to leverage its investment in the Open Source Electronic Health Record Alliance (OSEHRA) by providing seed money to develop open source connectors between Cerner and Epic, which would encourage other vendors to join in the effort. Topic Area: Commit to Open, Standards-Based APIs A significant technology enabler of seamless interoperability among the community of Veteran healthcare providers is the use of Application Programming Interfaces (APIs). These software intermediaries allow disparate EHR applications to communicate with each other and exchange data using standard, defined forms. The Panel emphasized the need for VA to create an environment that would minimize additional costs to community providers in order to interoperate with VA. VA can accomplish this by requiring the new EHR system to expose APIs that support bi-directional data transactions. The Panel further recommended that VA make a commitment to open, standards-based APIs, including the SMART on FHIR/Argonaut APIs, to facilitate the ready and efficient exchange of data with partners providing care in the community and to support open clinical workflow. ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 7 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Establish clear publishing and access service requirements The Panel recognized that data access requirements differ depending on who provides or accesses that data. Therefore, the Panel recommended that VA be more specific in defining each level of data publishing and access service that is specific to (1) Veteran access (e.g., use of vets.gov); (2) VA clinician access; (3) partner access; and (4) Health Information Exchange (HIE) access. The RFP should include a clear description of identity and access management requirements, including user population types and the association of specific application permissions with particular roles/positions. "The Contractor should provide all of the data that is currently being provided in the Contractor's patient portal to the consumer via an open standards-based API gateway. The Contractor should also provide all of the reporting data required by federal law to the Veteran via an open standards based API framework, accessible via any application or thirdparty data store of the Veteran's choice, that's number one." Machine-to-machine access is also critical for efficient sharing of information. The Panel recommended that VA ensure that all significant data stored in the software be accessible through APIs with no requirement for creation of custom applications to specifically access VA data. From a forward-looking perspective, VA should require that the EHR system support the ability to access data elements using open standards-based interfaces, and include the ability to interface with legacy data, patient-generated data, and third-party data that resides outside the EHR system. In addition, Cerner should provide the required utility services to support intermediary or peer-to-peer services (e.g., support Veteran-directed or Veteran-mediated requests, data exchange, and ingestion of data from non-VA providers). Provide a VA application platform that supports APIs from third-party providers with no barrier to entry Currently vets.gov serves as a portal to Veteran services. The Panel recommended that VA consider "The API Gateway document is awesome ... using such a portal to connect any third-party world class and future looking." application to the EHR solution without requiring fees or vendor permissions. VA should have full authority to connect any third-party application through one of the standard open APIs conformant with the vendor's API without pre-registering the application with the vendor. This is a very important authority to have in terms of the ability to innovate rapidly, without constraints. The Panelists also reviewed the proposed VA "API Gateway" language provided during the API discussion to anchor the dialogue and concurred that this requirement is fundamental to supporting interoperability. The Panel strongly endorsed the "API Gateway" language. Specifically, the Panelists recommended that VA include a requirement that VA have full authority to connect any third-party application to the Cerner system without requiring prior approval by Cerner. Furthermore, VA should ensure that developers of third-party applications connecting to the VA system via the open standard and VA-defined APIs continue to own their ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 8 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Document is no longer acquisition sensitive due to contract award on May 17, 2018 intellectual property (IP). From a usability perspective, the Panel also recommended that VA be able to establish the connectivity business rules, such as the ability for applications to remain connected for a reasonable time frame (e.g., 1 year) and to receive automatic notification about patient information updates. Require implementation of Clinical Decision Service (CDS) Hooks to invoke decision support from within a clinician's EHR workflow EHRs are essential to efficient delivery of high-quality care, as they provide the clinician with essential decision data at the time required. However, current EHR systems approach workflow from an IT system perspective rather than a clinician's perspective. The latter workflow should, of course, be paramount in the VA EHR implementation, and should also leverage a recent innovation called CDS Hooks. This technology provides the clinician with context-driven decision support and capability by enabling the EHR to trigger third-party services at key events that include ordering medication and opening a patient face sheet. For example, when the VA clinician begins to prescribe medication, a CDS Hook can call an external service that presents the clinician with the list of medications already prescribed to the patient by clinicians outside VA. The Panelists strongly recommended that VA require Cerner to implement and use CDS Hooks within the clinician workflow. Topic Area: Use Community Care Contracts to Foster Interoperability The new EHR system must be able to communicate with other EHR systems (e.g., Epic, AllScripts, etc.) within the care community. It is critical that VA ensure the Cerner EHR system remain robust for future interoperability with new products. Cerner must commit itself to supporting other forms of interoperability, such as a presentation layer that is common to other systems (e.g., the App store model). The Panel recommended that prior to execution of the Community Care Act contract VA require third-party providers (and Cerner competitors) to commit to supporting the contract as early adopters. "Innovations going forward are going to come from multiple directions. And having those interfaces, and going with a general interoperability approach that doesn't fork off from what's happening in the rest of the healthcare system, will allow the Veterans to benefit from technology whether that's coming from Google, from a new company, from an innovative shop within VA -- you end up creating a market with good prices, high value." Veterans must be able to access and download a computable form of their health data Panelists noted that access to data represents the biggest problem today. VA must clearly direct Cerner to expose data so it can be used by third parties. In the contract and in conversations with Cerner and third parties, VA must require specifics regarding how Veterans and providers will ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 9 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Document is no longer acquisition sensitive due to contract award on May 17, 2018 access and share their data. In addition, VA must require that any agreements leave the door open for future standards and technologies. Panelists believed that VA could achieve this by invoking the principle that the data belongs to the Veteran, rather than by citing specific technologies and standards (given how rapidly they are evolving). Veterans must be able to invoke their right of access to data to support data exchange across all providers (e.g., pull data through an API on their smartphone and push it to their community care provider), now and in the future. Keeping pace with this requirement will drive continual innovation by Cerner and all providers. VA must own the API layer Cerner ownership of the API layer (across every customer) poses a real threat to achieving interoperability, speed of innovation, and cost efficiency throughout the network of community care providers. Panelists stated that it is of utmost importance that VA include specific language stipulating that VA and Veterans be able to use third-party applications without having to register them with Cerner. VA must control the API key, not Cerner. Additionally, VA should require that Cerner provide access to MPages, a developer toolkit, and a programming interface that will enable innovators and third parties to develop APIs. Require that community care contracts include VA EHR standards to support bidirectional data sharing Panelists agreed that requiring the support and collaboration of community care providers and participating actively in health IT standards bodies would give VA the opportunity to advance the "national" standard for data sharing--closing any gaps and inconsistencies among federal, industry, and inter-industry standards. VA must require every provider in the chain of a Veteran's care to support the same standards for data interoperability in order to ensure seamless, best possible care for Veterans. This includes the requirement that all providers and third-party applications, in exchange for using the VA-provided API gateway, provide bi-directional health information back to VA that can be used for context-driven clinical decisions and informatics. Change the data exchange consent model from "opt in" to "opt out" To encourage seamless interoperability across all entities providing care to Veterans, the consent model for exchanging data between healthcare providers must be modified to follow an opt-out rather than an opt-in policy, which limits participant numbers. This would allow Veterans to invoke their individual right of access under the Health Information Portability and Accountability Act (HIPAA) to move their data as needed. Many states have already adopted an opt-out consent policy as part of their HIE.2 VA can achieve this by aligning its policy to an opt- 2 See https://www.healthit.gov/sites/default/files/State%20HIE%20Opt-In%20vs%20Opt-Out%20Policy%20Research_09-3016_Final.pdf ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 10 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Document is no longer acquisition sensitive due to contract award on May 17, 2018 out model, supported by the new VA proposed rule3 to allow HIEs to collect a Veteran's consent and electronically attest to the consent to VA in order to obtain the required EHR. Topic Area: Additional Contract Changes In addition to the recommendations in the prior sections, the Panelists encouraged VA to add further definitions and clarity in the following areas: o Require Cerner to provide VA with full read and partial write access to all data elements within the EHR, at VA's sole discretion. o Require Cerner to make the VA data model, standards, and other similar interoperability changes available in all other non-VA Cerner instances of its EHR platform. o Clearly define "enabling security framework" so that users know if this means a specific security framework such as those provided by the National Institute of Standards and Technology (NIST), HITRUST, etc. o Amend "national Common Trust Framework" to specifically refer to the intended source. The Panelists suggested that VA replace this wording with "Trusted Exchange Framework and Common Agreement (TEFCA)" as specified in the 21st Century Cures Act. o Amend RFP Performance Work Statement (PWS) Section 5.10.4(i) to clarify if the "provider collaboration via secure e-mail using Direct standards" is limited to the Direct protocols and just the Cerner platform. o Incorporate the model RFP language necessary for Cerner to support the API and SMART on FHIR platform and SMART-enabled applications, as described in Appendix B. 3 See https://s3.amazonaws.com/public-inspection.federalregister.gov/2018-00758.pdf ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 11 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Document is no longer acquisition sensitive due to contract award on May 17, 2018 II. Recommendations for RFP Changes MITRE engaged Morrison & Foerster, LLP, as the independent and unbiased legal expert to identify the specific changes to the RFP language necessary to implement the recommendations made by the Interoperability Review Panel. MITRE provided Morrison & Foerster, LLP, with the summary recommendations and a copy of the RFP.4 In addition, MITRE collected specific ideas for contract language from the Panel. Appendix C presents all recommended RFP changes. 4 Performance Work Statement for the VA Electronic Health Record Modernization System, Final Version 1.7, Amendment 03, December 4, 2017, Department of Veterans Affairs. File name: 001 - VA EHRM IDIQ PWS (Amended 12.04.2017) - Copy.docx ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 12 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Document is no longer acquisition sensitive due to contract award on May 17, 2018 III. Observations from University of Pennsylvania Medical Center Site Visit A delegation from VA and MITRE traveled to Pittsburgh, Pennsylvania, on January 19, 2018, for a meeting with representatives of UPMC Enterprises to discuss aspects of EHR interoperability that UPMC has successfully implemented over the past several years. The VA team, led by John Windom, included Dr. Ashwini Zenooz, (b) (6) , John Short, and (b) (6) (b) . The MITRE group included Richard Byrne, Jay Schnitzer, (6) (b) (6) , and (b) (6) . The hosts at UPMC included Dr. Rasu Shrestha, C. Talbot Heppenstall, Jr., Ed McAllister, Dr. Robert Bart, Adam Berger, Diane Michalec, Phyllis Szymanski, and Dr. Amy Urban, as well as additional staff. The meeting was broken into four parts. Following introductions, Session 1 described the structure of UPMC. Session 2 covered UPMC's last decade of interoperability, and Session 3 centered on the road ahead for UPMC and industry. Dr. Rasu Shrestha began the meeting by making the introductions and setting the agenda. He stated that UPMC's approach had followed a best-of-breed strategy, as opposed to a best-of-suite strategy, with the intention of failing fast and succeeding often. The overall UPMC structure has four parts: provider services, insurance services, international activities, and enterprises. During the discussion of interoperability, the UPMC team described its approach to interoperability, called Connected Healthcare, which is based on the commercial product dbMotion of AllScripts. UPMC has created an entity titled ClinicalConnect HIE (CCHIE) that uses HL7. ClinicalConnect exists as a separate 501c(3) company, of which UPMC is a member. CCHIE contains 90 live interfaces. This HIE went live in June 2012; its members consist of 10 hospitals. It competes with three other HIEs in Pennsylvania. The repository contains data on 8.3 million patients, and, in terms of patient consent, CCHIE uses an opt-out model. It currently has connections to four EHRs: Cerner (two versions), Epic, and Varian. Data available within CCHIE spans allergies, clinical documents, diagnosis, encounters, immunizations, labs, medications, problems, and procedures. Much of this data is in the form of documents (Continuity of Care Document (HITSP C32 CCD format, including problems, allergies, and medications); unstructured clinical documents (HITSP C62 format); Consolidated Clinical Document Architecture (C-CDA CCD, including problems, allergies, medications, immunizations, procedures, and insurance); and HL7 Interface (ADT: encounters, documents, imaging documents, and labs only). At the point of care dbMotion allows multiple views for the CCHIE: 1) a clinical view, 2) a newer view titled EHR agent, and 3) a Cerner MPage integration view. The next phase of the UPMC work in this regard will consist of integration with CommonWell. Figure 2 shows the architecture of the system. Figure 3 depicts the data feeds. ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 13 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Source: From UPMC Enterprises, used with permission, for VA use only Figure 2. ClinicalConnect (Western Pennsylvania) Health Information Exchange Source: From UPMC Enterprises, used with permission, for VA use only Figure 3. Interoperability Data Integration ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 14 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Document is no longer acquisition sensitive due to contract award on May 17, 2018 When asked whether UPMC, or anyone else in the country, has a point-to-point Cerner-to-Epic interoperability solution that does not use an HIE, UPMC representatives responded "No." Furthermore, UPMC representatives noted that about 10 percent of the total available individual patient data is currently transferred with UPMC's interoperability system. This is complicated by an ongoing data explosion that doubles the amount of data in UPMC's system about every 18 months. Following the presentations and lunch, MITRE Chief Technology Officer Jay Schnitzer saw a live demonstration of CCHIE by Dr. Amy Urban and Dr. Rasu Shrestha. The live demonstration confirmed that all of the documents listed above are visible with equal fidelity and a very similar format from both the UPMC end and the community provider end and perspective. The system requires clinicians to know and understand where documents can be found, and sometimes requires multiple mouse clicks, but all documents can be accessed from the same EHR entry page with one single log in. Additionally, some data elements, including vital signs and labs, can be viewed in the form of graphs as a function of time, including data elements from multiple sources. ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 15 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Document is no longer acquisition sensitive due to contract award on May 17, 2018 IV. Closing Thoughts and Suggested Next Steps The Panelists noted that VA cannot achieve true future EHR interoperability through the Cerner RFP alone, or through technology alone. The state of practice today shares only a small portion of available patient data. For VA to succeed in the future, multiple other components must be present and aligned: innovation, policy, standards, customer buy-in, and legislation, to name a few. The following next steps are recommended for VA consideration: 1. Complete the RFP revisions, conduct appropriate negotiations with the Contractor expeditiously, and complete the Contract process as planned. Stand firm during negotiations to maximize ease of access to data and data models for building third-party APIs, applications, and services for future community innovations. 2. Work with other federal government agencies and departments with similar interoperability interests and concerns, including, but not limited to, the White House, DoD, Food and Drug Administration (FDA), Centers for Medicare and Medicaid Services (CMS), Office of the National Coordinator for Health Information Technology (ONC), and other parts of the Department of Health and Human Services, to align approaches to EHR interoperability and the development and support of standards government-wide. 3. Support future innovation approaches, including concepts such as an Interoperability Laboratory and outreach to the broader innovation ecosystem (major medical centers, academia, traditional and non-traditional healthcare providers, startups, individual entrepreneurs, others). It is critical to align the innovations planned in VA's Digital Veterans Platform to the VA EHR innovation efforts to ensure consistent, continuous improvements to clinician and Veteran health experiences. 4. Create an External Review Panel to provide continuous expert guidance, review, and feedback over the course of the implementation and help capture best practices from the expert community going forward. Conduct ongoing demonstrations of end-to-end Veteran use cases that require data sharing across organizational boundaries to validate improvements in Veteran healthcare and reduce burdens on healthcare providers. VA and Contractor will ensure that Federal Advisory Committee Act (FACA) guidelines are followed in leveraging any external review panels. ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 16 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Appendix A: Interoperability Review Forum Participants Panelists Title Organization Aneesh Chopra President CareJourney, former United States Chief Technology Officer Indiana Health Information Exchange Charles E. (Chuck) Christian Vice President, Technology and Engagement Ryan Howells Andrew Karson, MD Chris Klomp Kenneth Mandl, MD Frank Opelka, MD Peter Pronovost, MD, PhD Christopher J. (Cris) Ross Carla Smith Paul R. Sutton, MD, PhD VA Participants Principal Director, Clinical Decision Support Chief Executive Officer Professor, Biomedical Informatics Director, Computational Health Informatics Medical Director, Quality and Health Policy Director, Armstrong Institute for Patient Safety and Quality Senior Vice President, Patient Safety and Quality Chief Information Officer Executive Vice President Professor, Biomedical Informatics and Medical Education Associate Medical Director, Inpatient IT Systems, UW Medicine IT Services Leavitt Partners, LLC Massachusetts General Hospital Collective Medical Technologies, Inc. Harvard Medical School Boston Children's Hospital American College of Surgeons Johns Hopkins University The Mayo Clinic The Healthcare Information and Management Systems Society University of Washington Title Organization David J. Shulkin, M.D. Carolyn Clancy Secretary Department of Veterans Affairs Executive in Charge, Veterans Health Administration Department of Veterans Affairs Bill James Acting Assistant Secretary, Office of Information & Technology Department of Veterans Affairs John Windom Program Executive for EHRM and Special Advisor to the Under Secretary for Health Chief Medical Officer, EHRM; Deputy, Office of Deputy Under Secretary for Health Policy & Services, VHA Chief Technology Officer, EHRM; Executive Director of Information Technology System Modernization Portfolio Lead: Project Transition and VA Integration, VA Center for Innovation Senior White House Advisor, VHA Senior Advisor to the Secretary on Strategic Partnerships Contracts White House Fellow Department of Veterans Affairs Dr. Ashwini Zenooz John Short (b) (6) Camilo Sandoval (b) (6) (b) (6) Kyle Sheetz Department of Veterans Affairs Department of Veterans Affairs Department of Veterans Affairs Department of Veterans Affairs Department of Veterans Affairs Department of Veterans Affairs Department of Veterans Affairs ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 17 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Other Federal Government Participants Title Organization (b) (6) Senior Advisor, Office of Administration Chris Liddell Assistant to the President for Strategic Initiatives *Bruce Moskowitz, M.D. Shannon Sartan Internist Director, Digital Services Dr. Lauren Thompson Director Jon White Deputy National Coordinator for Mental Health The Centers for Medicare & Medicaid Services The White House, Office of American Innovation External Expert Participant The Centers for Medicare & Medicaid Services DoD/VA Interagency Program Office The United States Department of Health and Human Services/The Office of the National Coordinator for Health Information Technology *Upon review of this document on October 6, 2018, Fred Mingo, OEHRM FOIA Officer noticed that Dr. Bruce Moskowitz was incorrectly identified and should not be under the entry column "Other Federal Government Participants." ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 18 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Appendix B: RFP Language for Purchasing Extensible Health IT From https://smarthealthit.org/2017/08/draft-model-rfp-language-for-purchasingextensible-health-it/, as of January 15, 2018. SMART Platform (www.smarthealthit.org) is a project that lays the groundwork for a more flexible approach to sourcing health information technology tools. Like Apple and Android's app stores, SMART provides the means for developers to create and for health systems and providers to easily deploy third-party applications in tandem with their existing electronic health record, data warehouse, or health information exchange platforms. To deploy SMART-enabled applications, health systems must ensure that their existing health information technology infrastructure supports the SMART on FHIR API. The SMART on FHIR starter set detailed below lists the minimum requirements for supporting the API and SMART-enabled applications. You may wish to augment this list of minimum requirements with suggestions from the Add-On Functionality listed depending on the types of applications your organization wishes to deploy. This document is intended as a resource for providers and health systems as they draft Request for Proposals (RFPs) and negotiate with their HIT vendors for added functionality. It has multiple authors from across the SMART team and its advisors. Feedback is welcome. The vendor must support the SMART on FHIR platform, a vendor agnostic API that allows third-party developers to build external apps and services that integrate with the vended product. At a minimum, the vendor product should include the following components in order to support SMART on FHIR and SMART-enabled applications: Data Access o Provide automated, standards-based, read-only access through the FHIR API and FHIR data models (resources) to: o a well-defined set of real-time discrete data (including support for the API parameters and resources described in the Argonaut Implementation Guide) o free-text clinical notes Data Manipulation o Write structured data from third-party apps back to the organization's EHR and, where relevant, a data warehouse, using the FHIR REST API to communicate data including: o free-text clinical notes ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 19 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Standards-Based App Authorization o Protect data and identity endpoints with standards-based authorization mechanisms (including the OAuth2 profiles described in the Argonaut Implementation Guide). o Provide access to data endpoints with an approach that does not require user intervention subsequent to the initial setup such as the method described in the draft SMART Backend Services Profile (http://docs.smarthealthit.org/authorization/backend-services/) Provide capability to restrict this access to a specified set of patients (roster). o Enable Health System to connect any third-party app of their choice that is conformant with the API without pre-registering the app with HIT Vendor. o Enable patients to connect any third-party app of their choice that is conformant with the API without pre-registering the app with HIT Vendor through the OAuth Dynamic Registration protocol. o Provide OAuth refresh tokens with a duration of one year to patient and provider facing apps that support the SMART Client Secret profile. Identity Management o Act as a standards-based Identity Provider using OpenID Connect. This ensures that users can authenticate to plug-in apps using single-sign-in via their existing EHR or patient portal credentials. o Act as a standards-based relying party to a customer-selected Identity Provider using OpenID Connect. This ensures that users can sign into the EHR or patient portal using an external, hospital-supplied single-sign-on account. Workflow o Support standards-based embedding of external application UI (HTML5). This ensures that app developers can build Web apps, and these apps can run directly inside of the EHR. o Support the launch of external applications in the clinician's workflow (this is not limited to the EHR and should include non-EHR integrated tools such as smart phones and tablets). For example, a clinician that has opted to use a third-party-developed native iPad app to visualize a patient's BMI over time can seamlessly use the application alongside the EHR via single-sign-on. o Support notifications to and from running applications. For example, an embedded app can notify the EHR when the user is "done" with it. Add-On Functionality The provider organization may also want to consider the following additions to its RFP depending on the types of applications it wishes to develop and run in the future. ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 20 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Bulk Data Export o Provide automated access to bulk export of data (complete representation of all data in the MU Common Clinical data set as well as free text notes) using a method like the SMART Flat FHIR draft proposal (http://docs.smarthealthit.org/flat-fhir) Data Manipulation o Write structured data from third-party apps back to the organization's EHR and, where relevant, a data warehouse, using the FHIR REST API to communicate data including: o medication prescriptions o lab and diagnostic imaging orders o Support the dependent transactions necessary to ensure that actions completed by thirdparty applications using the API are valid in the EHR and data warehouse. Context-Specific Service Hooks o Support the ability to call an external standards-based service in specific workflow steps, through the CDS Hooks specification, including: o opening a patient record o new prescriptions o new lab orders o new imaging studies Intellectual Property The IP of any app integrated through the SMART on FHIR API belongs to the author and not the vendor. Custom SMART on FHIR Extension to a Proprietary API Should a vendor neglect to provide SMART on FHIR natively, the client has the right to provide a custom extension to the vendor's API. The ownership of the IP for the custom extension is negotiable between the client and the vendor, but the ownership of the app using the custom extension belongs to its author. ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 21 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Appendix C: Recommended RFP Interoperability Language Changes The table below captures the recommended changes to the VA EHRM RFP. Item No. 1 Independent External Review Recommendations EHRM RFP Section(s) Affected and MITRE Recommended Change(s) to the Additional Comments EHRM RFP Commit to Full VA-DoD Interoperability Define specific capability The IDIQ RFP PWS Section 5.1.11 speaks to None. performance requirement and overall EHRM value and performance mechanisms to hold Cerner management monitoring, measurement and accountable for reducing the reporting. Performance metrics will be administrative burden in defined and enforced at the task order level, clinician workflow with the since, for example, hosting metrics will be objective of increasing significantly different from deployment efficiency. metrics. The RFP Section 8.6 refers to the use of Quality Assurance Surveillance Plans (QASP), which will include Functional and Non-Functional Key Performance Indicators (KPIs). The QASP will evolve as the EHRM solution and technology matures and is intended to establish Contractor accountability to what VA requires and values. ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 22 Document is no longer acquisition sensitive due to contract award on May 17, 2018 VA Adjudication Concur. Document is no longer acquisition sensitive due to contract award on May 17, 2018 Item Independent External No. Review Recommendations 2 Define specifically the span of providers who can properly interface with VA under a proposed solution (the number of community providers who would be able to interface with VA under a solution as a function of cost to the provider). 3 Define the degree of interoperability the solution provides (ranging from basic file sharing to fully interchangeable, integrated and functionally identical patient records). EHRM RFP Section(s) Affected and Additional Comments RFP Section 5.2.1(j) states that "The EHRM solution shall support access via tablet or mobile device as adjudicated by joint governance. Platform specifics will be identified by VA at a TO level." Section 5.10.4 states that "The Contractor is required to collaborate with VA affiliates, community partners, EHR providers, healthcare providers, and vendors to advance seamless care throughout the healthcare market." RFP Section 5.10.4 speaks to interoperability and provides sufficient breadth to introduce any additional information exchange requirements in the future, at the sole discretion of VA. MITRE Recommended Change(s) to the VA Adjudication EHRM RFP Suggest amending the language in RFP Section 5.2.1(j) Concur. Will negotiate to: "Support broad access via tablet or mobile devices with Cerner for and pursue technology to reduce the burden to the inclusion of language. clinicians (e.g., providing third-party provide access to information using light-weight portals and support for future generation mobile devices). Platform specifics shall be adjudicated by joint governance and incorporated by VA at a TO level." Suggest adding to RFP Section 5.10.5: "m) The Concur. Will negotiate Contractor shall conduct an annual Interoperability with Cerner for Self-Assessment against standards that shall be inclusion. specified by VA, such as those promulgated by HIMSS or future standards to be identified by VA." Requirements Traceability Matrix (RTM) VA-FR-31 discusses specifics of data management, types of data to be exchanged, and methods of communication. ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 23 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Item Independent External No. Review Recommendations 4 Pivot the RFP to be Veterancentric and NOT systemcentric. Be mindful that lessons learned are that many EHRs do not currently maximize efficient clinical workflow, so build that in (e.g., using CDS Hooks) and present information where needed with minimum "clicks to find" to reduce clinician burden. EHRM RFP Section(s) Affected and Additional Comments RFP Section 5.2.1 speaks to the EHR application supporting workflows. MITRE Recommended Change(s) to the VA Adjudication EHRM RFP Suggest adding to RFP Section 5.5.1: "k) Provide an Concur. Will negotiate understanding of how all workflows will impact VA with Cerner for care coordination and management processes (e.g., inclusion. Section 5.5.1 Workflow development and incorporating community information) to improve normalization addresses configuration of Veteran-centric delivery." workflows to meet VA requirements. Also add to Section 5.5.1: "l) Configure workflows to incorporate all community data at the discrete level in Section 5.5.7 Organizational Change support of clinical decision support, care management, Management discusses optimizing workflows disease management. The clinical workflow within the for each clinical role. EHR should not require users to visit additional screens to view externally sourced data." Section 8.6 refers to the use of Quality Assurance Surveillance Plans (QASP) which See Item 29 for specific recommendations on CDS provides active, continuous measurement Hooks. against the extensive performance requirements captured in Appendices A-1 and A-2: EHRM Key Performance Indicators to ensure a Veteran-centric approach. RTM section VA-FR-33 requires adoption, development and maintenance of metrics to assess timeliness and quality of healthcare delivery to the patient population. 5 Require Cerner support endto-end use cases with major external stakeholders involved. The current RFP language can be clarified to specifically refer to the improvement on Veteran-centric delivery. RFP Section 5.2.1 speaks to the EHR application supporting workflows. The Contractor can only be held responsible for elements of the end-to-end use case that reside within their system. Suggest adding to RFP Section 5.2.1: "Testing Concur. Will negotiate conducted under the Test and Evaluation Program Plan with Cerner for may include specific workflows to inform a inclusion. demonstration of end-to-end clinical use cases involving external stakeholders." ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 24 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Item Independent External No. Review Recommendations 6 Develop detailed data flow requirements between Cerner and all other vendors, be specific using clinical workflow or Veteran/patientcentric use cases. 7 8 9 Specifically define the machine-data readability expectations to ensure interoperability between legacy, community care providers, and Cerner (e.g., notes fields). EHRM RFP Section(s) Affected and Additional Comments Detailed data flow requirements should not be part of the RFP as it will result in the limitation of functionality to the specific data flows specified. They will be part of the Test and Evaluation Plan (TEP), where data flows can be added or modified. However, RFP Section 5.5.1 does not indicate that the external community data and end-to-end workflows will be considered in the configuration of standard EHRM workflows. RTM VA-FR-31 Requires the ability "to manage data structures that are standardized, accessible and editable." Specific requirements are to be incorporated into Task Orders, according to the structure of the contract. MITRE Recommended Change(s) to the VA Adjudication EHRM RFP Suggest adding to RFP Section 5.5.1: "j) The Concur. Will negotiate Contractor shall enable configuration of the application with Cerner for that supports external community data without inclusion. requiring the clinician to go to special screens to see and use external data." See Item #34 for recommended changes to incorporate Concur. Will request the SMART on FHIR and SMART-enabled information from applications. Cerner. See Item # 49 for recommended changes to incorporate sharing of the EHRM data model and to improve the amount of computable data shared with community care providers. Suggest VA obtain a description from the Contractor that describes the current baseline of shareable data elements that are computable. Document the DoD-VA EHR This is information that should be included as None. Exchange Framework - it can part of acquisition baseline developed by serve as a starting point for EHRM Program Management Office the National model. technical activities. Require ability for bulk data RFP Section 5.10.4(g) requires the Contractor None. export. to provide a software solution for multilateral standards-based ingestion, normalization, storage and exporting of Health Information Exchange acquired Veteran health information. ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 25 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Concur. Concur. Document is no longer acquisition sensitive due to contract award on May 17, 2018 Item Independent External EHRM RFP Section(s) Affected and MITRE Recommended Change(s) to the No. Review Recommendations Additional Comments EHRM RFP 10 Require "push" capability to RFP Section 5.10.4(g) requires the Contractor None. send data back in to VA EHR to provide a software solution for multilateral / Cerner database. standards-based ingestion, normalization, storage and exporting of Health Information Exchange acquired Veteran health information. ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 26 Document is no longer acquisition sensitive due to contract award on May 17, 2018 VA Adjudication Concur. Document is no longer acquisition sensitive due to contract award on May 17, 2018 Item Independent External No. Review Recommendations 11 Require that VA drive and own the analytical algorithms and not rely on Cerner. Require that VA health organizations be involved in building the logic models with the community and the vendor. EHRM RFP Section(s) Affected and MITRE Recommended Change(s) to the VA Adjudication Additional Comments EHRM RFP RFP Section 5.1.5 requires the Contractor Suggest adding to RFP Section 5.1.5: "While the Concur. Will negotiate provide requirements development support Contractor shall provide such support, VA reserves the with Cerner for but does not include who is responsible for right to take the lead on coordinating input from the inclusion. coordinating the community input on the logic user and provider communities. VA may, at its models. discretion, incorporate analytics from other entities, and include them in its future Digital Veterans RFP Section 5.1.7 requires the Contractor Platform, with which the EHR must be fully support data management but does not state compatible and interoperable." that VA shall provide the analytical algorithms. Suggest adding to RFP Section 5.1.7(b): "based on community and VA coordinated analytic algorithms." RFP Section 5.5.1(e) requires the Contractor support robust semantic modeling for the Suggest adding to RFP Section 5.5.1(e): "VA and its information associated with the workflows agents shall have unlimited rights to all resulting Further detail to achieve this recommendation models and algorithms." is also detailed in the Functional Requirement documentation, specifically VA-FR-31. VA Suggest adding to RFP Section 5.5.1(f): "which should lead and own the analytical algorithms modeling shall be based on analytical algorithms and as it is in the best interest of the health data models (1) developed by the Contractor, (2) cocommunity. By owning the algorithms, VA developed by the Contractor in coordination with VA will take the lead on coordinating the effort, health organizations and the community, (3) developed but the Contractor will actually develop the by VA health organizations, or (4) provided by thirdparty developers. VA and its agents shall have algorithms. unlimited rights to all algorithms and logic models incorporated in the EHRM solution, and intellectual property rights will be handled in accordance with ? H.2 of the Contract "VA EHRM IP License Agreement" on a Task Order basis." ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 27 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Item Independent External No. Review Recommendations 12 Enhance the data quality management requirements to ensure Cerner is responsible for maintaining and resolving data quality issues. EHRM RFP Section(s) Affected and Additional Comments RFP Section 5.1.8 Requires the Contractor to be responsible for data migration, but RFP Section 5.1.7 does not include a requirement for the Contractor to manage data quality internal to its systems. 13 Define the common identity and access management approach Cerner and others will adopt (e.g., using the Vets.gov identity as the coordinating identity). 14 Adopt the DoD approach to data and system security. RFP Section 5.5.2 describes the required approach to identity and access management across population types and roles. DoD/VA are aligning their efforts to address this going forward. RFP Section 5.4: Information System Authorization, Testing and Continuous Monitoring describes the security approach for the shared DoD/VA authorization boundary. Joint DoD/VA Strategy will be executed. MITRE Recommended Change(s) to the VA Adjudication EHRM RFP Suggest adding to RFP Section 5.1.7: "j) Maintain Concur. backward compatibility of the EHRM solution in such way as to maintain the quality of the data, to ensure that, once captured, the Government has access to and computational use of the data regardless of the evolution of the EHRM or age of the data k) Identify data quality issues found in data sourced from systems beyond its operational remit, applying the same validations and quality standards to incoming external data that it performs for data originated natively within the EHRM solution. Where the principle of seamless care requires that EHRM accept data that does not meet its internal data quality standards, Contractor shall implement the solution so that any incoming data that does not meet EHRM data quality standards be clearly flagged as such and provide both process and user interface to allow incorrect or missing data to be remedied if possible." None. Concur. None. ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 28 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Concur. Document is no longer acquisition sensitive due to contract award on May 17, 2018 Item Independent External No. Review Recommendations 15 Share the VA's security approach to medical and endpoint security with DoD for opportunity to leverage and harmonize. EHRM RFP Section(s) Affected and Additional Comments RFP Section 5.4: Information System Authorization, Testing and Continuous Monitoring describes the security approach for the shared DoD/VA authorization boundary. Joint DoD/VA Strategy will be executed. 16 Require Cerner to make the RFP Section 5.10.4.1 requires opportunity for VA data model, standards, agreed upon Contractor proprietary and other similar information/data model extension points interoperability changes (e.g., ingestion and record APIs) to be available in all other non-VA provided to both international and national Cerner instances of its EHR standards designating organizations, however, this does not include providing the capability platform. to other Cerner users, which would extend Cerner interoperability across the community. 17 Clearly define "enabling VA Requirements Traceability Matrix Nonsecurity framework." Does Functional requirements provides the security this mean a specific security requirements to include Access Management, framework such as NIST, Identity Management, and Information HITRUST, etc. Assurance/Security. RFP Sections 5.4 Information System Authorization, Testing and Continuous Monitoring and 5.5.2 Identity and Access Management provide additional clarification on the security requirements. MITRE Recommended Change(s) to the EHRM RFP VA Adjudication None. Concur. Suggest adding to RFP Section 5.10.4.1: "The Contractor shall provide VA access and usage rights into any underlying proprietary terminology/code systems for the purpose of enhancing national standards to address any gaps identified in the EHRM solution. The Contractor shall also make the interoperability capabilities and product enhancements developed under this contract available to non-VA Cerner clients." None. Concur. Will negotiate with Cerner for inclusion of language. ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 29 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Concur. Document is no longer acquisition sensitive due to contract award on May 17, 2018 Item No. Independent External Review Recommendations EHRM RFP Section(s) Affected and MITRE Recommended Change(s) to the Additional Comments EHRM RFP Leverage Current and Future Standards 18 Specifically describe what and Requirement VA-FR-31 describes data Suggest adding to RFP 5.10.4(m): "The annual how you can read, write, and management requirements: standardized data assessment will report on the state of each data element (e.g., which are supported in what capacities and in reconcile re: health data. and coding terminology systems; use of government endorsed messaging and content which formats). This will help assure standards standards for interoperability; management of implementation consistency and assure standards data elements from various entry points etc. compliance with evolving national standards." The current requirement does not provide understanding of which data elements are being exchanged and the degree of interoperability/ computability supported. 19 Define who has what rights Requirement VA-FR-31 and RFP Section Suggest adding to RFP 5.5.4: "l) Provide standardsfrom a data sharing 5.1.7 describe data management requirements based API access (e.g., FHIR) to all patient data from perspective, impacting APIs (including syndication). the VA-designated authoritative data sources for the (e.g., VA owns the data + all patient's record within the Contractor's product suite." data products vs. Community Section 5.5.4 requires "all, significant data care provider owns their stored in the software is accessible through treatment info on patient vs. API's" however clarification is needed to patient owns all their own ensure access to all data originating from data.) alternate VA-designated authoritative sources. 20 Identify the authoritative RFP Section 5.1.4 requires the Contractor Suggest adding to RFP 5.5.4: "j) assist VA in defining source for the various to provide support in the development and/or and establishing the authoritative data sources elements of a Veteran's health evaluation of new Standards, Policy associated with each data element in the EHR (e.g., record. Directives, Operating Procedures, Processes, where it is available and who has access to the etc. information)." Broader recommendation beyond the scope of the EHRM RFP is for VA to define the authoritative source policy for all VA data. This is not an EHRM specific policy and should be issued by VACO or VHA. ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 30 Document is no longer acquisition sensitive due to contract award on May 17, 2018 VA Adjudication Concur. Will negotiate with Cerner for inclusion of language. Concur. Will negotiate with Cerner for inclusion of language. Concur with the language for 5.5.4. Document is no longer acquisition sensitive due to contract award on May 17, 2018 Item Independent External No. Review Recommendations 21 Increase the VA presence and leadership role in standardsmaking bodies (e.g., Argonaut). 22 Include requirement for Cerner to support VA as an advocate to VA position on all relevant standards-making bodies. 23 Require Cerner to implement all standards as defined by VA. EHRM RFP Section(s) Affected and MITRE Recommended Change(s) to the Additional Comments EHRM RFP Increasing VA presence and leadership roles None. in standards-making bodies is an entirely separate recommendation that is not related to the IDIQ. RFP Section 5.1.4 requires Contractor support None. in the development and/or evaluation of new standards, policy directives, operating procedures, processes and/or assessments on their impacts when implemented. Requirements Traceability Matrix VA-NJ-177 None. defines interoperability data standards and specifically cites support of the health data standards identified in the VA-DoD Health Information Technical Standards Profile and by the VA-DoD Interagency Clinical Informatics board. 24 Clarify the intended reference RFP Section 5.10.4(h) refers imprecisely to Suggest replacing the phrase in RFP Section 5.10.4 h) in the phrase "national the "national Common Trust Framework." "national Common Trust Framework" with "Trusted Common Trust Framework." Exchange Framework and Common Agreement Does this refer to the Trusted (TEFCA)." Exchange Framework and Common Agreement (TEFCA) specified in the 21st Century Cures Act? 25 Clarify if the "provider RFP Section 5.10.4(i) requires the Contractor, Suggest adding to RFP Section 5.10.4(i): "the ONC collaboration via secure eby IOC, to "provide a capability for provider Direct protocol or future VA-designated standard." mail using Direct standards" collaboration via secure e-mail using Direct is limited to the Direct standards within a Cerner Millennium EHR protocols and just the Cerner workflow context." platform. ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 31 Document is no longer acquisition sensitive due to contract award on May 17, 2018 VA Adjudication Concur. Concur. Concur. Concur. Will negotiate with Cerner for inclusion of language. Concur. Will negotiate with Cerner for inclusion of language. Document is no longer acquisition sensitive due to contract award on May 17, 2018 Item No. Independent External Review Recommendations EHRM RFP Section(s) Affected and MITRE Recommended Change(s) to the Additional Comments EHRM RFP Commit to Open, Standards-Based APIs 26 Be specific about the VA RFP Section 5.5.4 includes requirements that Suggest adding to RFP Section 5.5.4 - "standardspublishing / access service all significant data stored in the software is based" in front of APIs. requirements. accessible through API's with no requirement for creation of custom applications to specifically access VA data. RTM VA-NF-7 requires the system to support the ability to access data elements using open standardbased interfaces including legacy data. Clarification is needed to ensure the intention to pursue standards-based APIs. 27 Define in the contract the VA RFP Section 5.5.2 describes identity and None. publishing / access services access management requirements including specifically for (1) Veteran user population types and the association of access services (e.g., specific application permissions tied to vets.gov), (2) VA clinician roles/positions. RTM VA-NF-6 through 48 access services, (3) Partner describe specific access services required. access services, and (4) HIE access service. 28 Ensure external API RFP Section 5.1.8(d) requires the contractor Suggest replacing the second sentence in 5.10.4.2: developers can host their apps analyze and propose a way forward for the "The Contractor shall integrate the EHRM to on an app platform that is capability for external apps to use interoperate with DVP or future state VA platform." NOT controlled by Cerner HealtheIntent as a data source. (and therefore does not require Cerner licensing and Section 5.5.4 requires the contractor to approval). support data exchanges via the API gateway. Section 5.10.4.2 requires the contractor to work in good faith to integrate the EHRM with the Digital Veterans Platform API gateway. ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 32 Document is no longer acquisition sensitive due to contract award on May 17, 2018 VA Adjudication Concur. Will negotiate with Cerner for inclusion of language. Concur. Concur. Will negotiate with Cerner for inclusion of language. Document is no longer acquisition sensitive due to contract award on May 17, 2018 Item Independent External No. Review Recommendations 29 Include requirement for Cerner to provide CDS Hooks to support open clinician workflow. EHRM RFP Section(s) Affected and Additional Comments RFP Section 5.8 requires the contractor provision robust data analysis toolsets that allow, among other things, analytics and Clinical Decision Support (CDS). MITRE Recommended Change(s) to the EHRM RFP None. VA-NF-T26 requires "integration with Cerner via standards-based interfaces (including but not necessarily limited to support for FHIR APIs and/or OMG CDS API/ HL7 CDS APIs (e.g., CDS Hooks)". 30 Specify the required utility RFP Section 5.10.4(c) requires "the services to support Contractor shall provide a software solution intermediary or peer-to-peer enabling VA to release and consume, via onservices; e.g., support demand access, a Veteran's complete Veteran-directed or Veteran- longitudinal health record to and from DoD mediated request, exchange, and connected community partners. The and ingestion from non-VA longitudinal record solution shall support providers (via APIs where Provider-to-Provider record sharing, as well available). as Provider-Veteran-Provider sharing (Veteran mediated record sharing), including appropriate consent management." 31 Require that VA has full RFP Section 5.7.1 requires the contractor authority to connect any VA- provide on-site integration for devices approved, secure third-party connecting to the Contractor system. app with the Cerner system, VA is fully responsible for the security of its without Cerner approval. systems and protection of its data. VA Adjudication Concur. Suggest adding ", regardless of which EHR they use" Concur. Will negotiate after "connected community partners...to and from with Cerner for DoD and connected community partners, regardless of inclusion of language. which EHR they use." Suggest adding to 5.7.1b: "including via the Digital Veterans Platform...support for VA-approved thirdparty apps connecting to the Contractor system, including via the Digital Veterans Platform." Suggest adding to 5.7.1 - "g) Permit and approve connecting all VA approved secure apps without additional fees or licensing." ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 33 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Concur. Will negotiate with Cerner for inclusion of language. Document is no longer acquisition sensitive due to contract award on May 17, 2018 Item Independent External No. Review Recommendations 32 Ensure the API developers retain their IP rights when their API is used to connect to the Cerner interface. 33 Require the ability for 3rd party apps to remain connected to the Cerner system and receive automatic notification on updates (e.g., vaccination). Allow the app to connect without being cut off in accordance with VA security requirements. EHRM RFP Section(s) Affected and Additional Comments RFP Section 5.5.4 sets forth requirements with respect to APIs, including paragraph (e), which provides for the provision and maintenance of a Developer Portal. MITRE Recommended Change(s) to the VA Adjudication EHRM RFP Suggest adding to RFP 5.5.4(e): " and provide policies Concur. Will negotiate and procedures for the use of the Developer Portal(s) with Cerner for and APIs that promote innovative third-party API inclusion of language. development" and "Third party API developers shall retain their IP rights when their API is used to connect Section 5.10 generally promotes innovation to the Cerner interface, and there will be no derivative while 5.10.4.2 requires the Contractor to IP ownership when third parties consume Cerner support the Digital Veterans Platform (DVP) terminology through open APIs." API gateway which is intended to provide a neutral application platform for third party APIs. Additional language is required to promote innovation in the creation of third party applications by removing derivative or cascading intellectual property restrictions/ constraints. RFP Section 5.7.1 requires the contractor provide on-site integration for devices connecting to the Contractor system. Suggest adding to RFP Section 5.7.1(b): "support for Concur. Will negotiate third-party apps connecting to the Contractor system." with Cerner for inclusion of language. Suggest adding the following new paragraphs (ii) and (iii) to RFP Section 5.7.1(b): "ii. Provide ability for third-party apps to remain connected to the Contractor system in accordance with VA security requirements and receive automatic notification on updates; and iii. Allow the app to remain connected without interruption lasting longer than a certain period of time to be approved by the Government." ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 34 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Item Independent External No. Review Recommendations 34 Incorporate the model RFP language necessary for Cerner to support the API and SMART on FHIR platform and SMART-enabled applications. EHRM RFP Section(s) Affected and MITRE Recommended Change(s) to the Additional Comments EHRM RFP RFP Section 5.10.4 and the Requirements Suggest adding to RFP Section 5.10.4: "In addition, Traceability Matrix refer to SMART and the software and services shall support the VA FHIR based applications but do not designated standards, such as SMART on FHIR and incorporate all elements of the suggested SMART-enabled applications, or published standard at functionality such as the support for the time." standards-based embedding of external application UI (HTML5). Use Community Care Contracts to Foster Interoperability 35 Before the contract is signed, Pre-contractual activity and pertains to future None. get Care Act providers and strategic discussions to drive interoperability Cerner competitors to commit in the marketplace. to support the contract as early adopters. 36 Require publication of the RFP Section 5.10.4.1 states: In support of the None. EHRM /Cerner clinical data interoperability objectives under this Section, model in the National Library agreed upon Contractor proprietary of Medicine (following the information/data model extension points Kaiser example). (e.g., ingestion and record APIs) may be provided to both international and national standards designating organizations as described and set forth in an applicable Task Order. 37 Require the Veteran to be able RFP Section 5.7.1 requires support to Suggest adding to RFP Section 5.7.1(c): "using mobile to invoke their right of access Veterans ensuring they can effectively apps, thin-client and thick-client solutions" and to data as the intermediary to navigate the HealtheLife patient portal and "Veterans shall be able to enable sharing of their health data with their community care providers in support data exchange (e.g., Wellness programs to effectively manage accordance with all VA-designated national pull through their API on their health. standards." phone and push to their community care provider). ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 35 Document is no longer acquisition sensitive due to contract award on May 17, 2018 VA Adjudication Concur. Will negotiate with Cerner for inclusion of language. Concur. Concur. Concur. Will negotiate with Cerner for inclusion of language. Document is no longer acquisition sensitive due to contract award on May 17, 2018 Item Independent External No. Review Recommendations 38 Require Cerner and the Community Care provider applications provide bidirectional health information in exchange for using the VAprovided API gateway. 39 Shift VA policy enabled by the Choice Care Act from "Opt-In" to "Opt-Out" such that the starting assumption is that data can be shared unless the Veteran "opts out." EHRM RFP Section(s) Affected and MITRE Recommended Change(s) to the Additional Comments EHRM RFP RFP Sections 5.10.1, .2, and .3 require Suggest adding to RFP Section 5.10.4(c): "The bisupport for innovation and other development directional health information exchange shall activities. maximize use of discrete data that supports contextdriven clinical decisions and informatics." Section 5.10.4(c) requires "a software solution enabling VA to release and consume, via ondemand access, a Veteran's complete longitudinal health record to and from DoD and connected community partners." VA-NF-61, -63, and -65 requires bidirectional interface in support of Pharmacy. This requirement can be fulfilled by a flat file and does not require the data to be computable. Review and revise VA policy. None. Other 40 Analyze and understand the Analysis of cost information is not part of a operational cost to VA to IDIQ contract. It will be done as part of the implement and operate under standard PMO processes. the proposed solution. None. ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 36 Document is no longer acquisition sensitive due to contract award on May 17, 2018 VA Adjudication Concur. Will negotiate with Cerner for inclusion of language. Concur. Concur. Document is no longer acquisition sensitive due to contract award on May 17, 2018 Item Independent External No. Review Recommendations 41 Incorporate requirement that subsequent updates and improvements to the Cerner solution is part of the baseline contract (and cost). 42 Address the differences between federal and state privacy laws - policy that Federal laws take precedence over state laws. 43 Ensure VA has no gag order: Require Cerner to allow open, public sharing/reporting (e.g., screen shots) on issues or errors with the EHR solution (e.g., if there is a known anomaly, that anomaly and its work-around is shared with the Cerner user community). 44 Define the way ahead for 3rd party apps (sunset, rebuild and transition) during the Cerner transition. 45 Emphasize the need and resource commitment to achieve clinician consensus, change management, and culture. EHRM RFP Section(s) Affected and MITRE Recommended Change(s) to the Additional Comments EHRM RFP RFP Section 5.2.3 Software Maintenance None. requires: The Contractor shall provide its commercial support and maintenance services described in its End User License Agreement. Leveraging Contractor's best practices and agreed upon upgrade schedule between DoD and VA, software maintenance includes all releases of the software such as major releases, minor releases, maintenance releases. Federal and state privacy laws can only be None. addressed through legislation. RFP Section 5.3.3 - System Quality and Performance Measures and Monitoring is appropriate to capture this requirement. VA Adjudication Concur. Concur. Suggest adding to RFP Section 5.3.3: "Contractor is Concur. Will negotiate responsible for reporting all issues or errors associated with Cerner for with the EHR solution and acknowledges and agrees inclusion of language. that errors shall not be considered confidential, proprietary or trade secrets, and accordingly, shall be releasable to VA or its agents. VA retains the right to share any issue, error or resolution approach." There is no explicit contractual language requiring the contractor to disclose issues or efforts, nor is there language explicitly preserving the right of VA to share such information. This should be evaluated in congruence with None. the legacy transition plans (pivot plans) of existing systems to Cerner. RFP Section 5.5.7 Organizational Change None. Management includes a detailed approach to clinician consensus, change management and culture change. ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 37 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Concur. Concur. Document is no longer acquisition sensitive due to contract award on May 17, 2018 Item Independent External EHRM RFP Section(s) Affected and MITRE Recommended Change(s) to the No. Review Recommendations Additional Comments EHRM RFP 46 Develop a roadmap for all These tasks are not part of the IDIQ and will None. EHR vendors that specifies be addressed via Data Migration Plan and how Veterans and providers Data Management Strategy across VA. access and share their data and get that data from A to B. This is not limited to the Cerner solution, but includes legacy and community care systems. 47 Require ability for VA to RFP Section 5.10: Innovation and None. innovate using the Cerner Enhancements includes an innovation solution, including support to process, categories and development activities to enable VA innovation activities using the a Veteran Interoperability Cerner solution. The language is sufficiently Partnership Lab. broad to support issuance of a Task Order requiring the Contractor to support interoperability activities including a Veteran Interoperability Partnership Lab. MITRE recommends this lab be independently managed and used to support 3rd party innovators, demonstrate interoperability solutions, validate the effectiveness of interoperability solutions in an end-to-end clinical use case context, and serve as a reference architecture to allow 3rd party stakeholders to exercise innovations. ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 38 Document is no longer acquisition sensitive due to contract award on May 17, 2018 VA Adjudication Concur. Concur. Document is no longer acquisition sensitive due to contract award on May 17, 2018 Item Independent External No. Review Recommendations 48 Understand how Cerner will manage data quality, including provenance, error bounds, data looping, security, etc. EHRM RFP Section(s) Affected and MITRE Recommended Change(s) to the Additional Comments EHRM RFP The RFP Section 8.6 refers to the use of None. Quality Assurance Surveillance Plans (QASP), which is intended to establish Contractor accountability to what VA requires and values. VA-NF-T46 requires "The system shall support provenance (chain of custody or ownership) and pedigree (processing history how the data was produced or incorporated) and enable identification, collection, and production of data according to source, custody and ownership and display of data in business, logical, legal or physical models." ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 39 Document is no longer acquisition sensitive due to contract award on May 17, 2018 VA Adjudication Concur. Document is no longer acquisition sensitive due to contract award on May 17, 2018 Item Independent External No. Review Recommendations 49 Understand how Cerner will provide VA with access to the data model, share data for analytics freely to 3rd parties, increase the amount of computable data exchanged with 3rd parties. Panelists acknowledged this recommendation is a stretch goal. EHRM RFP Section(s) Affected and Additional Comments RFP Section 5.8 address the support to business intelligence and data analytics. Section 5.10.4.1 supports the sharing of Contractor proprietary information/data model extension points (e.g., ingestion and record APIs) with both international and national standards designating organizations. However, current language does not require access to the EHRM data model, supporting understanding of and therefore increase the exchange of computable data with community care providers. MITRE Recommended Change(s) to the VA Adjudication EHRM RFP Suggest adding to RFP Section 5.8: "h) Provide VA Concur. EHRM data model, underpinning terminology model, tables, definitions, and examples of fully populated Veteran data files. Provide documentation or software that is used for quality checks and that illustrate what data elements are computable." Suggest adding to Section 5.10.4.1: "n) The Contractor shall support Knowledge Interoperability by supporting the extension of clinical content assets such as terminologies, clinical decision support rules, order sets, etc. This includes the ability to curate, extend, and share that knowledge with clinical partners. This fosters rapid adoption from industry best practices, e.g., clinical professional societies." Suggest VA obtain a price from the Contractor to provide a report explain the steps involved in accessing the data model, including producing an example data file, and demonstrating how much of the data is computable; provide cost estimates for outside parties to access the data via this mechanism. ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 40 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Item Independent External No. Review Recommendations 50 Understand how the Cerner EHRM solution will improve Veteran and clinician experiences. EHRM RFP Section(s) Affected and Additional Comments RFP Section 5.2.1 describes the EHR application, however does not specifically focus priorities on the Veteran and clinician experience as captured in end-to-end use cases. MITRE Recommended Change(s) to the VA Adjudication EHRM RFP Suggest adding to RFP Section 5.2.1.1: "k) Provide for Concur. the ability to measure the EHRM performance that contributes to any end-to-end use case, thereby capturing its impact on improving a Veteran and clinician experience." Section 8.6 refers to the Quality Assurance Surveillance Plans, which include Functional and Non-Functional Key Performance Indicators (KPIs). These KPIs will reflect VA priorities which include improvement of both Veteran and clinician experiences. ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 41 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Document is no longer acquisition sensitive due to contract award on May 17, 2018 Appendix D: Acronyms API Application Programming Interface CCHIE ClinicalConnect Health Information Exchange CDS Clinical Decision Service DoD Department of Defense EHR Electronic Health Record EHRM Electronic Health Record Modernization FHIR Fast Healthcare Interoperability Resources HIE Health Information Exchange HL7 Health Level Seven International IP Intellectual Property IT Information Technology PWS Performance Work Statement RFP Request for Proposal UPMC University of Pittsburgh Medical Center VA Department of Veterans Affairs VACO VA Central Office VHA Veterans Health Administration ACQUISITION SENSITIVE Confidential and Proprietary For Department of Veterans Affairs Use Only 42 Document is no longer acquisition sensitive due to contract award on May 17, 2018