Programme CORTISONE - Technical Evaluation Applications Integration Architectural Services Partner

Tender description

Summary of the work The Partner will integrate COTS GOLD Discs into the Authority's Test Environment, test, evaluate and document successful process as a deliverable. The Partner will work closely with the Authority assessing all Integration issues including Data Integrity and Network Security. There is a requirement for some Architectural Service based outputs. Expected Contract Length 24 months + possible 6 month extension. Latest start date Monday 14 August 2017 Budget Range £850K to £2.2M subject to approval. Why the Work is Being Done Programme CORTISONE is to provide a suite of Medical Information Services (MED IS) that will allow the Defence medical Services (DMS) to meet its patient safety and duty of care obligations. Programme CORTISONE will be delivered using a range of integrated COTS products. The programme will interface with medical services provided under the NHS and other MoD related systems e.g. Joint Personnel Administration (JPA). CORTISONE require the Technical Evalution Applications Integration Architectural Services (TEAIrS) partner to work with the Authority to develop an Integrated Ecosystem of COTS medical information services and products within an MoD provided hosting solution Problem to Be Solved Programme CORTISONE will be delivered under 5 Themes using COTS products. This is a complex programme which will involve evaluating a number of Solutions. The Authority requires a Partner to undertake the following activities: 1. Installation, configuration and management of COTS products in the Assessment Environment (AE). 2. Testing of COTS products In Accordance with the Test and Strategy Plan. 3. Management and Administration of the AE. 4. Management of systems and tools to support the AE. 5. Knowledge transfer of findings to MoD Staff. 6. Provision of an Architectural Service to support development of designs, solutions and standards. Who Are the Users ISS are responsible for the delivery of CORTISONE to meet the requirements of the DMS. The CORTISONE delivery team need to be able to test and analyse medical information applications to select the optimum solution to meet customer requirements. Applications will be tested by DMS clinicians and a team of specialised testers. Due to the wide range of products to be tested and analysed and the diversity of testers ISS require a partner to work with theCORTISONE Programme team to undertake the administrative duties of the Test Environment to ensure appropriate accounts and access to applications are available. Early Market Engagement None for this specific role. CORTISONE has been the subject of industry briefs at Tech UK, the last being Nov 2016. PLEASE NOTE: Any suppliers currently bidding through the OJEU procurement will not be eligible for this requirement. Work Already Done Programme CORTISONE was established in Apr 2014 and has progressed through the CONCEPT Phase. It is now in the ASSESSMENT Phase with a mature Concept of Analysis. Existing Team The team is a blend of Military and Crown Servants complemented by contract staff and specialist companies. Team size is in the region of 30. Current Phase Alpha Skills & Experience • Experience in the architecture, installation and configuration of COTS medical information systems in a hub and spoke interoperability architecture. (4%) • Experience in the application of healthcare data exchange and information standards (HL7 FHIR, HL7 v2) enabling interoperability between Med IS to support hub and spoke interoperability architecture. (4%) • Experience in architecture and integrating medical information systems with NHS Spine services in the primary healthcare setting. (4%) • Experience working as part of a rainbow team of contractors, crown servants and software vendors. (2%) • Experience in the planning, specification, development and execution of a programme of testing to meet the requirements of a specified Test Strategy. (3%) • Experience in administration/management of typical environment and server applications i.e. Windows 2012 Server, Citrix XenApp v7.6, Linux, SQL Server, Windows Active Directory and Windows Remote Desktop Services 2012. (3%) • Experience of providing a complete architecture service to a complex Government Programme (3%) Nice to Haves • Experience of working in MOD, with a good understanding of ISS and wider business practices and relevant JSPs, including JSP604 and JSP440. (2%) • Experience working with NHS bodies to implement Electronic Patient Record (EPR) systems and interoperability solutions. (2%) Work Location The Programme Team is located at MOD Corsham in Wiltshire (SN13 9NR) and DMS (Defence medical Services) in Whittington (WS14 9PY). It is anticipated that collaborative planning, preparation and assessment work for the CORTISONE Assesment Environments (AE), which will be provided by the Authority, will be at MoD Corsham. In order to support the AE there may be a need to visit the hosting facilities based in Blandford or Andover (this has yet to be confirmed). Working Arrangments The Supplier will be expected to work in an Agile environmnet, working with users and project leads to develop, design, pilot and implement solutions and then to document outcomes and updated designs and standards.  As part of the Agile team they will need to work efficiently and follow best practice to ensure the agreed outcomes meet the quality and standards expected by our stakeholders. Monday to Friday, locations as described above. This resource will work under the guidance of the CORTISONE Delivery Manager. For full details of the requirement please contact: ISSComrcl-NEHub-C1-01@mod.uk. Security Clearance All staff involved in this requirement must hold SC clearance due to the possibility of attendance at secure MoD sites and the need to work within the MoDNet infrastructure. Additional T&Cs MOD DEFCONs form part of this Contract: DEFCON 5J (Edn 18/11/16)-Unique Identifiers, DEFCON 76 (Edn 12/06)-Contractors on site, DEFCON 129J (Edn 18/11/16)-Electronic business Delivery Form, DEFCON 516 (Edn 04/12)-Equality, DEFCON 520 (Edn 18/11/16)-Corrupt gifts and payments of commission, DEFCON 522 (Edn 18/11/16)-Payment and Recovery of Sums Due, DEFCON 531 (Edn 11/14)-Disclosure of Information, DEFCON 534 (Edn 18/11/16)-Subcontracting and Prompt Payment, DEFCON 566 (Edn 07/14)-Change of control contractor, DEFCON 642 (Edn 06/14)-Progress meetings, DEFCON 531-Disclosure of information, DEFCON 658-Cyber Security, DEFSTAN 05-138-Cyber Security, DEFCON 660-Official Sensitive Security Requirements. DEFFORMs will be used: DF111-Addresses And Other Information, DF10-Acceptance Of Offer Of Contract. No. of Suppliers to Evaluate 5 Proposal Criteria • Explain your proposed approach, methodology and timescales. This includes how you will ensure that the Authority is supplied with high quality, appropriately skilled team specialists flexibly and responsively. (10%) • Explain your proposed approach, methodology and timescales for delivery of Work Package 1 (SE&E Prep) including description of skills and scale of resources that will form proposed team. (5%) • Explain proposed approach, methodology, timescales for delivery of Architectural Services appropriate to expected Integration Activities of Medical-Applications, including skills description and scale of resources to form proposed team. (5%) • Explain how you will optimise costs for the Authority and deliver value for money. (5%) • Explain how you plan to retain key resources for the duration of the contract. (5%) • Explain proposal to provide training/knowledge-transfer to CORTISONE Programme team. This should include how you will document/provide input in to documents to ensure the Authority can obtain the knowledge. (5%) Cultural Fit Criteria • Evidence of a willingness to take ownership of problems and issues at their own initiative to ensure a successful outcome. (2%) • Evidence of collaborative approach to problem solving with stakeholders from multiple organisations, including Civil Servants, other contractors and vendors. (2%) • Evidence of an ability to adapt an agile methodology to align to a client’s governance and control process. (2%) • Evidence of working with clients with different levels of technical expertise. (2%) Payment Approach Capped time and materials Evaluation Weighting Technical competence 62% Cultural fit 8% Price 30% Questions from Suppliers 1. A very wide range has been provided on the budget for this opportunity. Could the authority please elaborate on the thinking behind this? The Authority does not disclose its budget but wish to provide an indicator as to the likely value of effort that might be needed. 2. Can the authority clarify if the supplier staff need to be SC cleared ahead of the joining date and/or the SC clearance of the staff can be undertaken by the MoD post contract? The Authority would prefer staff to be SC Cleared ahead of the joining date. 3. Please can the Authority clarify the tendering and down-select process? Are bidders required to respond to the essential & nice-to-have skills AND provide a written, costed proposal by 30th June? Or is this a pre-filtering stage for skills only, to be followed by a proposal evaluation at a later stage. In either case please can you indicate when you will be inviting suppliers for presentations and the date by which you intend to announce your decision The Authority seeks to understand by 30th June if bidders have the necessary skills and experience to perform the tasks required. Thereafter down selected bidders will be invited to provide further information including a proposal and pricing, these will be evaluated for evaluation. They may then be asked to attend a presentation/interview. Dates reserved for presentation/Interviews are Tuesday 25th July and Thursday 27th July, at MoD Corsham. 4. We assume the scope of testing includes assessment of the COTS packages operating in an integrated manner, rather than standalone. Is this assumption correct? The ability to mount and test multiple applications on a single environment implies a degree of technical configuration and/or parameterisation and potentially technical integration with the environment, other applications or both. To what extent does the Authority see this as part of the scope? What obligations have been placed on the COTS providers to bring COTS expertise to assist with installation, configuration and integration? A high level Strategy will form part of the ITT to aid understanding and add value for proposals. The process entails assessment of installing & operating individual COTS solutions in accordance to vendor installation and operating instructions. The HE will be provided by the Authority and is to be representative of the future Med IS “live” hosting environment. This will include some tools and services. The TEAIrS Partner is expected to integrate the COTS solutions with tools and services. COTS providers will have offered call-off services to assist. The Authority will define operational and governance processes. 5. Please can the Authority share the Test and Strategy Plan? Please can the Authority describe the AE, in order that a technical understanding of installation & integration can be developed? Please describe the tooling that is available for the testing, admin and management activities. A high level Test Strategy and Test Plan will be provided as part of the formal ITT for this procurement to enable bidders to demonstrate understanding and value add in their respective proposal. This will include consideration of the following:- Integration and interoperation of COTS solutions.- Load testing.- Performance testing.- Network infrastructure virtualisation.- Functional testing and automated testing. The vendors providing COTS Solutions will also specify other software their Lot Solution are dependent on. This information will not be available until after their ITT submissions have be received and preferred bidder has been identified. 6. Regarding paragraph 15 of the “Further Information for Suppliers” document which states “much of the work may be undertaken at the supplier’s premises”. Can you clarify the percentage and nature of activities a supplier might perform from their own facilities and should they be list x facilities? Efficiency and effectiveness for planning assessment and evaluation, initial hosting environment configuration, resolution of issues and review of results is expected to involve on-site working. The assessment and evaluation hosted environment will operate at OFFICIAL for Phase 1 and Phase 2 therefore the HE will be accessible over a standard internet connection, allowing off-site working. Elements of Phase 3 will require working from one or more of the identified MoD sites for testing over MoD’s infrastructure. 7. What is the current tool stack for testing including those for test and defect management, automation, configuration and version control, environment management? The Authority is in the process of finalising the specification for the suite of test administration and management, test automation and network and performance virtualisation testing tools. The Authority’s preference is to use MoD’s existing licenses, where practicable, to satisfy the test tooling requirements (e.g. JIRA, CONFLUENCE and Microsoft Visual Test Professional). 8. As part of the testing will there be a need for the TEAIrS Partner to obfuscate the test data or should we assume it will be obfuscated before being shared with the supplier? The Authority’s working assumption is that the bulk of the test data, which the TEAIrS Partner will assist in planning and preparing, will be dummy data. Where this is not practical, the Authority will use an accredited third party to provide obfuscated data as part of the GFx provision. 9. Is there a list that details the different data transfer protocols across the interfaces and systems (internal and/or external) that can be shared by the authority? The COTS solutions have to comply with the CORTISONE functional and non-functional requirements. In relation to transfer protocols, the requirements state the COTS solutions need to support international standards: READ2, CTV3, SNOMEDT CT, HL7, FHIR, DICOM, etc. 10. Other than the COTS products that are being procured as part of the Lots, what other authority systems are to be integrated as part of this assessment and evaluation? For the Solution Evolution & Evaluation (SE&E) exercise, only COTS solutions are to be integrated. However, the SE&E hosted environment will include provision for simulation of external interfaces (e.g. NHS, JPA and NATO Allies). These simulated external interfaces will need to be integrated within the ecosystems. 11. How many external services are expected to be interfaced/ integrated with the CORTISONE Ecosystems? For the assessment and evaluation of COTS solutions, the priority external interfaces that need to be integrated are with the NHS (i.e. Summary Care Record), NATO, the Joint Personnel Administration (JPA) system and IDAM (the MoD’s Identity and Access Management system). 12. What level of assurance are the COTS suppliers expected to undertake before it being deployed on the assessment environment and what level of visibility will the TEAIrS partner have into the COTS suppliers testing and assurance? The COTS solution providers will have declared that their products satisfy the Award Criteria in the CORTISONE ITT. For example for Lot 1, the Award Criteria includes: “The Authority judges that the solution proposed requires little or no effort … to maintain and govern.” Therefore, COTS suppliers will not be testing and assuring their own products. Furthermore, in Phase 1 of the Solution Evolution and Evaluation (SE&E) the TEAIrS partner will be expected to assess the ease with which vendor installation and operation instructions can be followed. Vendors will support SE&E activity which will be enacted by the TEAIrS partner. 13. Will the roles like the Test Manager, Product Owner, etc. mentioned in the SE&E be provided by the Authority? The TEAIrS Partner Requirements, which form part of the ITT, clearly show the proposed Governance team structure. The TEAIrS partner is only expected to fill the role ‘Technical Evaluation Applications Integration Architectural Services Partner (Lead)’. 14. Will the suppliers or vendors customise or configure their products before or during the Assessment phase? One aim of the assessment and evaluation process is to establish the ease with which COTS vendor solutions can be configured and integrated in accordance to their documented instructions. However, given that these are complex COTS solutions, the Authority will facilitate access to vendor specialists under an agreed vendor call-off arrangement to support the TEAIrS Partner in the set-up and configuration of the COTS solutions. 15. Will the environment being set up for the installation of the COTS products also cater to external interfaces for testing? The Solution Evolution & Evaluation (SE&E) hosted environment will include services (e.g. file server) to enable the TEAIRS partner to develop simulated interfaces (e.g. data files). 16. Are all the COTS products expected to be on premise; if not will it be SaaS or PaaS? The purpose of the Solution Evolution & Evaluation (SE&E) process is to assess and evaluate the operation, interoperability and interoperation of all COTS solutions in a simulated “live” environments (fixed and deployed) to be managed by the MoD as the Prime Systems Integrator. For this reason, all COTS solutions will be provided for installation and operation on the SE&E hosted environment. 17. Could the authority indicate the external integration requirements for the COTS products and what is the authority’s understanding of the capability of the COTS suppliers and/or integration engine to interface with the external systems? For the assessment and evaluation of COTS solutions, the main external interfaces that need to be integrated are with the NHS (i.e. Summary Care Record), NATO, the Joint Personnel Administration (JPA) system and IDAM (the MoD’s Identity and Access Management system). It is like that for assessment and evaluation purposes, these external interfaces will be simulated. The integration engine COTS solutions are expected to support a range of standard APIs (e.g. support HL7 FHIR messaging). 18. Can the authority advise what data transformation, validations and messaging is needed at the integration layer? The data transformation, validations and messaging is expected to depend on the Test Scenarios, Test Scripts and Test Data. These will reflect the CORTISONE requirements for the COTS solutions. The other factor will be the interoperability standards and data transformation tools supported by the Lot 1 COTS solutions (Health Information Exchange, HIX). 19. Can the authority indicate if encryption/decryption is needed at message level? Any digital signature requirements at message level? For the Solution Evolution & Evaluation (SE&E) based assessment and evaluation, there are no overall non-functional requirements in relation to encryption of messages. However, imaging COTS solutions may support encryption and decryption capabilities which may require testing. There may be a requirement for encryption for interfaces between NHS, MoD and other 3rd parties. This will become clear once the Test Strategy is completed. 20. We believe that the authority is sourcing an integration engine as part of their other market procurement. Can the authority confirm so and if yes, is this engine expected to be open source? The CORTISONE ITT Lot 1 covers the requirements for the Health Information Exchange (HIX), which will include the integration engine capability. At PQQ stage, as with the other Lots, 10 vendor products were to be considered for the ITT stage. The final set of COTS for Lot 1 will not be known until the ITT responses have been evaluated. 21. Can the authority indicate what message level security is needed? For the Solution Evolution & Evaluation (SE&E) based assessment and evaluation, there are no overall non-functional requirements in relation to encryption of messages. However, imaging COTS solutions may support encryption and decryption capabilities which may require testing. 22. Do we need to consider end point registration? And/or end point authentication? Phases 1 and 2 of the Solution Evolution & Evaluation (SE&E) process will be undertaken in an environment operating at OFFICIAL with mainly dummy data and will be accessible by testers over the internet. The hosted environment will provide identity and access management (IDAM) services. The COTS solutions are expected to interoperate with the IDAM for end-point management. For Phase 3 there may be a need to access the assessment and evaluation environment by end user using ModNet for limited functional testing and this will also be managed by the IDAM within the hosted environment. 23. Is there any requirement to manage transactions across multiple end points? In the final stages of Solution Evolution & Evaluation (SE&E) process, three ecosystems will be identified that represent the candidate solutions for the “live” Medical Information Services (Med IS). The core COTS for these ecosystems will be the Lot 1 based integration engine. The nature of transaction and/or service management will be determined by the underlying architecture pattern supported by each of the three integration engines. 24. Can the authority indicate the volume of messages to be handled through the integration layer? The Test Strategy will be provided to the successful bidder for the role of the TEAIrS partner. This will set-out the requirements for the TEAIrS partner to develop Test Scenarios and Test Scripts. At this point, there will be an indication of the volume of messaging. The other main factor will be the architectural patterns that emerge for the three ecosystems for the interaction between the integration engine and the data analytics COTS solutions. 25. Is building fault tolerance part of the architecture? The Solution Evolution & Evaluation (SE&E) hosted environment will include the required fault tolerance. In addition, the integration engine is expected to include appropriate transaction recovery under failure. 26. Is there any requirement to manage workflow across multiple end points? The CORTISONE functional requirement includes workflow management to reflect logical patient pathways. The management of these workflows will be reflected in the anticipated COTS solutions, particularly as part of the Lot 1 Health Information Exchange (HIX) candidate solutions. How the workflows will be implemented, will depend on the integration pattern support by the candidate HIX COTS solutions. 27. Is there any requirement to persist data/requests/messages at integration layer? Programme CORTISONE will be procuring standard COTS solutions to satisfy the CORTISONE requirements which have been configured as nine Lots which represent standard COTS solutions for healthcare. One of these Lots is for the Health Information Exchange (HIX). The requirement for this will be satisfied by, in part, by a COTS solution that supports an integration engine. The functionality that candidate integration engines support, which could include message/data persistence, will be assessed and evaluated against the requirements. 28. Do we need to consider any analytics or reporting requirements? Programme CORTISONE requirements have been configured around nine Lots which represent standard healthcare COTS solutions. Lot 2 is for a health and data analytics capability. The scope of assessment and evaluation required for analytics and reporting will be determined by the Test Strategy, which will be the Authority’s responsibility, and the Test Scenarios and Test Scripts to be prepared TEAIrS Partner. 29. Who would be doing administration of integration layer? Will the authority sourced integration solution have a User Interface based administration solution? The purpose of the Solution Evolution & Evaluation (SE&E) is to assess and evaluate the functional and non-functional capabilities of COTS solutions, including the COTS solution which will include the integration engine. The TEAIRS partner will prepare Test Scenarios and Test Scripts, and these will include assessment for the ease with which a COTS solution can be configured, including the integration engine COTS. The specific functionality (e.g. User Interface) of the COTS solutions being offered is not known at this point as the procurement is still underway. 30. Apart from NHS Digital, are there applications from any other organisations need to be integrated? For the assessment and evaluation of COTS solutions, the main external interfaces that need to be integrated are with the NHS (i.e. Summary Care Record), NATO, the Joint Personnel Administration (JPA) system and IDAM (the MoD’s Identity and Access Management system). It is like that for assessment and evaluation purposes, these external interfaces will be simulated. 31. Are there any requirements to transfer large documents/big data across endpoints? Does integration engine need to hold any documents? The purpose of the Solution Evolution & Evaluation (SE&E) process is to assess and evaluate the candidate COTS solutions, both functional and non-functional aspects. The CORTISONE requirements do include the processing, receipt from NHS and archiving of images. The precise functionality to be assessed and evaluated by the integration engine, for image management, will be addressed as part of Test Strategy (Authority responsibility) and the Test Scenarios and Test Scripts TEAIrS partner. 32. Can the authority share if the CORTISONE system will be deployed for languages other than English? If yes, what are the translation requirements? The CORTISONE solution will not be deployed for languages other than English. However, there will need to be consideration of the requirements as set out in the Welsh Language Act 1993 for interactions with NHS bodies in Wales. In addition, there is a requirement to translate incoming information in other languages into English (e.g. from NATO & Allies). 33. Can the authority share details of any specific messaging standards that will be used by International and private health organisations to feed into the CORTISONE or other MOD provided services? The Authority requires that the COTS solutions support international clinical standards, specifically HL7, FHIR, CDA and SNOMED-CT and technical standards such as REST and SOAP. The expectation is that all external interfaces will support NHS and industry standards. 34. Can you please confirm what your planned dates are for selected suppliers to provide a written proposal and for presentations to be given? Planned dates for the selected suppliers to provide a proposal is Tuesday 18th July. For suppliers subsequently selected for interview/presentation, the dates they would need to be available for are Tuesday 25th & Thursday 27th July. 35. DEFCON 566 (Edn 07/14) has been replaced by Edition 10/16. Please confirm which version is the intended version. DEFCON 566 Edition 10/16 is the intended version. 36. DEFCON 534 (Edn 18/11/16) has been replaced by Edition 06/17. Please confirm which version is the intended version. DEFCON 534 Edition 06/17 is the intended version. 37. DEFCON 520 (Edn 18/11/16) has been replaced by Edition 02/17. Please confirm which version is the intended version. DEFCON 520 Edition 02/17 is the intended version. 38. Could you please detail the predicted timescales and format/word count, or other restrictions, for the second stage of this procurement after down select? The authority has provisionally planned a date of Tuesday 4th July to issue the ITT. Successful bidders will need to respond by Tuesday 18th July and suppliers subsequently selected for interview/presentation will need to be available Tuesday 25th & Thursday 27th July. The word count for the proposal is 2000 maximum. Other requirements are case studies (500 words), pen pictures for a number of roles (250 words) and a summary document (500 words). More information will be provided at stage 2 when the ITT is issued. 39. Could the authority advise if a template will be provided for the proposal or are the suppliers expected to use their own? Also is there a word count limit on the responses for the proposal as well? A proposal template (2000 words maximum) will be provided by the authority as part of the ITT pack for successful bidders. 40. In respect to the time frame could the authority confirm that the original scope is to be delivered in 7 months + 3 months and the additional architectural scope is 24 months + 6 months? The potential scope of works includes a specific Solution Evaluation & Assessment (SEE) Phase and now also other Technical Evaluation Application Integration Architectural Services (TEAIrS) that are being sought from the Partner. Statement of Works will be aligned to Sprint activities. Therefore its expected to extended beyond the SEE Phase so hence the extension of time the contract is being sought for. 41. The original tender (issued 31/5/2017) was for a set of services for a budget range of £850k-£1.6m. The revised tender (issued 16/6/2017) requires the same services plus an Architecture capability with an increase in budget to £2.2m. Is this understanding correct and could you offer a view of the expected volume of the Architecture service considering that additional budget and the 2 year timescale? Yes, the original service described in the previous advert, plus the Architecture capability is required. The new budget range is £850k-2.2m to reflect the potential for additional Technical Evaluation Application Integration Architectural Services. These will be set against Statement of Works and aligned to the Projects Sprint Activities. 42. Does the MOD have a firm view on the number of integrator support staff required between August and the end of calendar year 2017 and how many initial staff members are anticipated between August and September? The Authority is looking for support from the TEAIrS partner to undertake a number of Work Packages; the main ones, which are currently anticipated, will be described in the ITT. The TEAIrS partner will be able to use these to prepare a projection of staff numbers at various points in the programme. 43. Does the authority have a User Researcher on this programme, who can be accessible to the selected supplier through the course of this programme? The Authority does have a Business Analyst who will undertake much of the User Research activity. The Authority expects the TEAIrS Business Architect to manage, scope and support this activity (with support from the CORTISONE Product Owner and Product Manager). 44. To what extent has the authority identified the User Needs and mapped them to the user requirements and test strategy? The CORTISONE programme has published the full set of business, user and non-functional requirements as part of the ITT for COTS solutions for nine Lots for Themes 1 & 2. The Authority is expecting the TEAIrS partner to be guided by the Test Strategy and Test Plan to prepare Test Scenarios and Test Scripts, which will be related to the published requirements and support the evidence collection for the Solution Evolution & Evaluation process. Furthermore, to support the functional evaluation, the Authority expects the TEAIrS partner to take the lead in preparing business prioritised Use Cases and patient journey analysis.