National Practitioner Data Bank (NPDB)

SOURCES SOUGHT NOTICE Agency/Office: HHS/HRSA/OAMP Contracting Office Location: 5600 Fishers Lane, Rockville, MD 20857 Title: National Practitioner Data Bank (NPDB) NAICS Code: 541512 - Computer Systems Design Services Incumbent: SRA International, INC Response Due Date: February 19, 2019 This is a SMALL BUSINESS SOURCES SOUGHT NOTICE (hereafter referred to as "notice) issued for the purpose of planning and market research. This is NOT a solicitation for proposals, proposal abstracts, or quotations and this does not obligate the Health Resources and Services Administration (HRSA) to award a contract now or in the future. The purpose of this notice is to obtain information regarding the availability and capability of qualified small businesses only (including 8(a), service-disabled-veteran-owned-small business (SDVOSB), Historically Underutilized Business Zone (HUBZone) small business, small disadvantaged business (SDB), veteran-owned small business (VOSB), and women-owned small business (WOSB) to provide Operations and Maintenance (O&M) and Development, Modernization and Enhancement (DME) support Services for the NPDB platform. This sources sought is seeking responses from small businesses from the following sources: - GSA IT 70 Schedule 70 No reimbursement will be made for any costs associated with providing information in response to this announcement and any follow-up information requests. Respondents will not be notified of the results of the capability assessment. All information submitted in response to this announcement must arrive on or before the closing date. THIS IS STRICTLY MARKET RESEARCH. HRSA WILL NOT ENTERTAIN QUESTIONS REGARDING THE RESULTS OF THIS MARKET RESEARCH. REQUESTS FOR ADDITIONAL INFORMATION WILL NOT BE HONORED. Background The National Practitioner Data Bank (NPDB) is a web-based repository of reports containing information on medical malpractice payments and certain adverse actions related to health care practitioners, providers, and suppliers. The purpose of the NPDB is to protect the public, improve the quality of health care, and deter fraud and abuse in the health care system by providing information about the past adverse actions of practitioners, providers, and suppliers to authorized health care entities and agencies. The Congress established the NPDB because it perceived that the increasing occurrence of medical malpractice litigation and the need to improve the quality of medical care had become nationwide problems that warranted greater efforts than could be undertaken by individual States. The Congress also identified the need to restrict the ability of incompetent physicians and dentists to move from State to State without disclosure or discovery of the physician's previous damaging or incompetent performance. The Congress felt that the threat of private money damages liability under Federal laws, including treble damages liability under Federal antitrust law, unreasonably discouraged physicians and dentists from participating in effective professional peer review. Therefore, the Congress sought to provide incentives and protection for physicians and dentists engaging in effective professional peer review. The NPDB serves as an alert or flagging system to assist federal and state licensing and certification authorities, hospitals, and other health care entities in evaluating the qualifications of health care practitioners they seek to license, hire, or contract with, or to whom they wish to grant clinical privileges. The NPDB discloses to eligible entities information on medical malpractice payments, adverse clinical privileges actions, adverse licensure actions, and other adverse actions taken against physicians, dentists, and other health care providers by State licensing authorities, hospitals, and professional societies. Further, the system was designed to reduce healthcare fraud and abuse by collecting and disclosing to authorized entities information on health care-related civil judgments and criminal convictions, adverse licensure and certification actions, exclusions from health care programs, and other adjudicated actions taken against health care providers, suppliers, and practitioners. The NPDB maintains over 1,400,000 reports on health care practitioners, providers, and suppliers and in Fiscal Year (FY) 2018 received an average of 7,000 new reports each month. In FY2018, the NPDB responded to over 8,100,000 queries from its authorized users, who use query output to make informed hiring, licensing and credentialing decisions that contribute to a better quality health care workforce. The NPDB's 42,000 users represent over 23,000 hospitals, licensing boards, and other health care organizations. In FY2018, the NPDB also responded to over 161,000 self-queries from health care practitioners, providers, and suppliers, which provide an opportunity to review and verify the accuracy of the reports. Authorized entities and users can access the NPDB information using the online Integrated Querying and Reporting System (IQRS) or the batch interface Querying and Reporting XML Service (QRXS) for continuous and one-time query responses. Health care practitioners, providers and suppliers can query on themselves using the online Self-Query service. Project Requirements 1. Operations, Maintenance and Enhancement of the NPDB - Provide Information Systems Engineering and Operations to operate, maintain, and enhance the NPDB and related support services. The requirement includes providing full life-cycle support for all systems, following the Health Resources Services Administration (HRSA) Enterprise Project Life Cycle (EPLC). 2. Security, Confidentiality, and Personally Identifiable Information (PII) - The NPDB contains highly sensitive, confidential PII. The contractor must ensure that all information technology (IT) security measures are implemented, updated, and maintained in accordance with HRSA Office of Information Technology (OIT) guidance, National Institute of Standards and Technology (NIST) documentation, and other Federal guidelines as appropriate. 3. Compliance Workflow - Maintain and develop automated compliance workflows. BHW is expanding NPDB's compliance initiatives, working with state licensing boards, hospitals, and other entities to ensure they are submitting all reports required by law. The volume of compliance transactions has grown exponentially, requiring significant automation of the workflow. 4. Data Integrity - Data integrity is paramount to the NPDB and must be enforced within the NPDB and maintained through rigorous error checking and validation routines. 5. Business Intelligence - Maintain existing and explore emerging business intelligence (BI) technology, including dashboards, geocoded maps, public data query tools, and other technologies to satisfy the Office of Management and Budget's (OMB's) Open Government Initiative. 6. Usability - Evaluate the NPDB system to improve usability and reduce administrative burden for users. 7. Customer Service - Provide Tier 1 and Tier 2 call center support. Capability Statements In response to this Sources Sought Notice, HRSA is seeking capability statements from small businesses who can demonstrate experience in developing and managing enterprise systems of a similar capacity that impacts multiple stakeholders and contractors. Capability statements are NOT proposals and do not address price/cost. The contractor community is asked for information which proves that they have expertise and capacity to meet the requirements of this work. Respondents should provide enough information for HRSA to make an informed determination of their capability to perform the work as identified below. For each response, please provide a list of contract numbers that your organization has had (if applicable), your role on the contract (prime contractor or subcontractor), and the dollar value/percentage of the work performed. If you were a subcontractor on a particular contract, please clarify the work that you did on that contract. No marketing literature should be submitted in response to this notice. When responding to this notice, vendors must demonstrate their experience in developing and managing enterprise systems of a similar capacity that impacts multiple stakeholders and contractors. A mere statement that the vendor has a required capability is not sufficient. When answering the following questions, vendors must provide specific and detailed examples of work performed, that demonstrates required capabilities for each of the questions and the attendant level of effort involved. Program Focused Capability Questions: 1. Do you have the knowledge, understanding, and experience in implementing statutory, regulatory, and sub-regulatory requirements and policies related to healthcare? 2. Do you have the knowledge, understanding, and experience in managing user fee-based programs specific to public health or healthcare? (Note: NPDB funding is not federally appropriated; rather , user query fees are collected to support program operations). 3. Do you have both the ability and experience implementing regulatory compliance and case management of compliance actions in healthcare? 4. Do you have both the ability and experience collecting and managing a large database of information specific to public health or healthcare? 5. Do you have both the ability and legal experience to properly interpret legislation, regulation, and policy in handling and resolving healthcare-related disputes? 6. Do you have both the ability and experience conducting system usability studies and surveys to evaluate program and system effectiveness in order to improve overall program business processes, usability, and overall user experience? 7. Do you have both the ability and experience (a) generating de-identified datasets for public use and statistical data analysis; and (b) conducting data analysis activities that support a public health or healthcare program mission? System and Technical Capability Questions: 1. Do you have program and project management experience with large IT systems that require (a) development and management of complex workflow/case management applications in a secure environment supporting a large number of federal and non-federal healthcare stakeholders (Please note: "secure environment" in this context refers to handling sensitive and confidential information such as PII for a government agency as well as being familiar with other industry data security best practices); and (b) developing Section 508-compliant web applications? 2. Do you have both the ability and experience in maintaining a system with around 3 million lines of codebase with historical and current data? 3. Do you have experience developing and maintaining systems that comprise secure, user-friendly interfaces for federal and non-federal entities and individuals? 4. Do you have both the ability and experience to address all phases of the Software Development Lifecycle (SDLC) using Agile methodology in the Federal environment? 5. Are you well versed with cloud-based architecture? 6. Do you have both the experience developing, managing and monitoring systems using Amazon Web Services (AWS) Infrastructure as a Service (150-200 Elastic Computing Cloud instances)? 7. Do you have both the ability and experience (a) to meet National Institute of Standards and Technology (NIST) 800-53 requirements and maintain an authorization to operate (ATO) for a Federal Information Security Management Act (FISMA) 'Moderate' system; and (b) to undergo security control assessment (SCA)? 8. Do you have both the ability and experience processing credit card, check and Electronic Funds Transfer (EFT) payments? 9. Is your organization a certified Payment Card Industry Data Security Standard (PCI DSS) Level 1 service provider? 10. Do you have both the ability and experience using tools such as Atlassian JIRA, Confluence, and other infrastructure and DevOps support tools? 11. Do you have both the ability and experience implementing and managing a customer service center with toll free help desk support and utilizing Customer Relationship Management (CRM) tools such as Salesforce/Five9? 12. Do you have both the ability and experience to transition system services between contractors (e.g. from incumbent) to ensure continuous operation with no disruption of critical support services? 13. Do you have both the ability and experience utilizing Business Intelligence (BI) tools (e.g. Tableau) including dashboards, geocoded maps, and data query tools? 14. Do you have both the ability and experience integrating data from disparate software systems to provide usable information to federal and non-federal entities and individuals? Responses Requested Please submit your responses by 3:00 pm EST on February 19, 2019, to Mario Checchia at contact@example.gov in the following format: - Microsoft Word (or PDF) document with page size 8.5 by 11 inches, with a minimum of 1" margins. - Times New Roman, font size 12 with single spacing between lines. - Submission shall not exceed twenty-one (21) pages. Cover page is not included in the total page count Respondents are requested to state their capabilities and expertise in clear and concise language. Respondents are strongly encouraged to avoid use of excessive marketing and sales language. Note: Language in any resultant RFP will require all small businesses to recertify their size status at the submission of proposal. You are not required to respond to this sources sought notice if you cannot recertify your size as small. Cover Page Vendors shall include the following Business information on the Cover Page: a) Sources Sought Notice number, title, and date of issuance b) DUNS c) Company Name d) Company Address e) Company Point of Contact, Phone and Email address f) Current GSA IT 70 small businesses schedules appropriate for this effort g) Validation of small business status under NAICS: 541512 - Computer Systems Design Services (Size Standard: $27.5 million). Additional information on NAICS codes can be found at www.sba.gov. Confidentiality No proprietary, classified, confidential, or sensitive information should be included in your response. The Government reserves the right to use any non-proprietary technical information in any resultant solicitation(s). Disclaimer and Important Notes This notice does not obligate the Government to award a contract or otherwise pay for the information provided in response. The Government reserves the right to use information provided by respondents for any purpose deemed necessary and legally appropriate. Any organization responding to this notice should ensure that its response is complete and sufficiently detailed. Information provided will be used to assess alternatives available for the potential requirement and may lead to the development of a solicitation. Respondents are advised that the Government is under no obligation to acknowledge receipt of the information received or provide feedback to respondents with respect to any information submitted. Respondents will not be notified of the results of this market research. Capability statements will not be returned, and will not be accepted after the due date for responses. Teaming Arrangements Firms seeking to respond to this notice as a team or to rely on subcontractors to perform any portion of the work must include the above-requested information and certifications for each entity on the proposed team or each proposed subcontractor. Responses must clearly indicate the nature of the teaming arrangement. The contractor and any subcontractors must not have any relationships or arrangements through business operations or its employees that could be considered as possibly lessening the company's objectivity concerning any aspect of the proposed tasks. If such relationships or arrangements exist, contractors or subcontractors shall be required, during the procurement process (if one occurs), to identify potential conflicts of interest and discuss how the conflicts will be addressed and mitigated.