MSG5 Send secure messages to non-users of the SVCMC secure text messaging system. HD MSG6 Support user-customizable “quick list” of response messages to secure text messaging users. D MSG7 Send secure messages to patients in at least two circumstances: post-discharge, and pre-visit. D MSG8 Support user-customizable “quick list” of response messages to patients. D System Integration INT1 Support message initiation from the treatment and care team displays in HealthLink (Epic). HD INT2 For messages initiated from the treatment team or care teams in HealthLink (Epic), seamlessly pass the user (sender) and patient contexts along with the message. HD INT3 Support group messaging to selected members of treatment and or care team as maintained in HealthLink (Epic). HD INT4 Support message initiation from the on-call system (Amion and successor systems TBD) HD INT5 For messages initiated from the on-call system, seamlessly pass whatever context information is available (user/sender +/- patient contexts). HD INT6 Support group messaging to selected individuals from the on-call system HD INT7 Once the user has authenticated via the SCVMC active directory, use those credentials to support secure messaging (no additional sign-on requirement). HD INT8 All or part of a thread must be made readily available for copying into nursing documentation (equivalent to Provider Notification documentation currently implemented in HealthLink). HD INT9 Data from the solution messaging archive must be available from within the Enterprise Reporting Environment at SCVMC HD INT10 If standard one-way text paging is still supported, make sure this is indicated on contact lists as “non-secure”, and support numeric paging ONLY on such devices. D INT11 Supports web-based portal to view, edit and send text messages D Technical pre-
REP3 Links between messages in a conversation (thread) must be recorded for later access via reporting HD REP4 Escalations for all messages must be recorded and included as part of links in a conversation HD REP5 All data available for reporting from the archive must be retrievable according to at least an ODBC standard interface via SQL HD REP6 Support messages to all devices in the message archive, including non-secure devices HD Change Management CM1 Solution shall have built in process to inform all applicable governing bodies (e.g. Medical Executive Committee) of changes prior to implementation HD CM2 Capture enhancement and bug fix requests D CM3 Capture application change and maintenance requests D CM4 Manage status and disposition of all service and change requests D CM5 Manage application down time schedule D CM6 Capture versioning and patch levels related to applications D CM8 Provide automated notification for required upgrades and patching D System Administration SA1 System automatically performs incremental and/or full data backups at least nightly. HD SA2 Specify access to and control of, and ownership of backup data. HD SA1 System automatically performs incremental and/or full data backups at least nightly. HD User Interface UI1 Solution shall have ADA compliant capabilities (e.g. voice recognition, languages, fonts, viewing). HD UI2 GUI screens should use reasonable colorful differentiation. D UI3 Fully scalable fonts (resizing of workspace for visibility or real estate). D UI4 Easy forward and backward navigation between workflow/entry. D
2. Offeror shall place the appropriate letter response code in the “Availability” column for non-mandatory requirements. If your availability response is “B” or “C”, please provide the estimated delivery date in the Comments column. “A” means specification is one that currently exists in the proposed software, in the current production version and included in the County’s price. ‘B” means specification is not in the proposed software but it is a planned enhancement. The enhancement will be included in the system at no additional cost. “C” means specification is not part of the proposed software but can be added at an additional cost. Disclose all costs on the Cost Response Form. “D” means specification is not available in the proposed solution. Offeror may use the “Comments” column to reference, by title, any related technical material and include the material in Tab 6 of the proposal. ID Description Importance (HD) Highly Desirable (D) Desirable (U) Useful Availability (A/B/C/D) Comments Reference related material by title and include in Tab 6 (If your availability response is “B” or “C”, please provide the estimated delivery date in the Comments column) Messaging MSG1 Support message priority flags (at least “high”, “normal”) HD MSG2 Support request for acknowledgment. HD MSG3 Support message recall. HD MSG4 Support group and broadcast messages. HD MSG5 Send secure messages to non-users of the SVCMC secure text messaging system. HD MSG6 Support user-customizable “quick list” of response messages to secure text messaging users. D MSG7 Send secure messages to patients in at least two circumstances: post-discharge, and pre-visit. D MSG8 Support user-customizable “quick list” of response messages to patients. D System Integration INT1 Support message initiation from the treatment and care team displays in HealthLink (Epic). HD INT2 For messages initiated from the treatment team or care teams in HealthLink (Epic), seamlessly pass the user (sender) and patient contexts along with the message. HD INT3 Support group messaging to selected members of treatment and or care team as maintained in HealthLink (Epic). HD
Facility Security Offsite equipment Do you provide (describe/explain/attach/embed associated documents) tenants with documentation describing your policies and procedures governing asset management and repurposing of equipment? Facility Security Asset Management Do you maintain a complete inventory of all of your critical assets, which includes ownership of the asset? Facility Security Do you maintain a complete inventory of all of your critical supplier relationships? Human Resources Security Human Resources Security Background Screening Pursuant to local laws, regulations, ethics and contractual constraints are all employment candidates, contractors and third parties subject to background verification? What is checked during the background verification? Human Resources Security Employment Agreements Do you specifically train your employees regarding their role vs. the tenant's role in providing information security controls?
Do you document employee acknowledgment of training they have completed? Human Resources Security Employment Termination Are Roles and responsibilities for following performing employment termination or change in employment procedures assigned, documented and communicated? Information Security Information Security Management Program Do you provide (describe/explain/attach/embed associated documents) tenants with documentation describing your Information Security Management Program (ISMP)?
Information Security How are users made aware of their responsibilities for leaving unattended equipment in a secure manner? Information Security Workspace Do your data management policies and procedures address tenant and service level conflicts of interests? Information Security Do your data management policies and procedures include a tamper audit or software integrity function for unauthorized access to tenant data? Information Security Does the virtual machine management infrastructure include a tamper audit or software integrity function to detect changes to the build/configuration of the virtual machine? Information Security Encryption Do you have (describe/explain/attach/embed associated documents) a capability to allow creation of unique encryption keys per tenant? 16.3 17.1 17.2 17.3
Incident Response Legal Preparation admissible chain-of-custody management processes & controls? Information Security Does your incident response capability include the use of legally admissible forensic data collection and analysis techniques? Information Security Are you capable of supporting litigation holds (freeze of data from a specific point in time) for a specific tenant without freezing other tenant data? Information Security Do you enforce and attest to tenant data separation when producing data in response to legal subpoenas? Information Security Incident Response Metrics Do you monitor and quantify the types, volumes, and impacts on all information security incidents? Information Security Will you share statistical information security incident data with your tenants upon request? Information Security Acceptable Use Do you provide (describe/explain/attach/embed associated documents) documentation regarding how you may utilize or access tenant data and/or metadata? Information Security Do you collect or create metadata about tenant data usage through the use of 25.1 25.2 26.1 26.2