Request for Certification and Release of Funds Form
All Certified Projects Must Follow NM State Policies and Procurement Code
Initiation / Planning / Implementation / T / CloseoutProject Name
/ Laboratory Information Management System (LIMS)Project Number / Date / 11/19/2007
Lead Agency / DOH / Agency Code / 665
Other Agencies
Executive Sponsor
/ David Mills, PhD, SLD DirectorProject Manager / Tim Elsbrock
Agency Head / Dr. Alfredo Vigil, Secretary Designate
Agency CIO/IT LEAD / Robert Mayer
Project Description (Provide a brief description and purpose for this project)
The New Mexico Department of Health’s Scientific Laboratory Division (SLD) currently utilizes a number of stand-alone applications and data sets to meet its laboratory information system needs. The current systems utilize a combination of manual processes and electronic technologies.
The SLD is receiving increasing demands from regulatory agencies, key clients and partners to modernize its information systems. Necessary functionality, such as required electronic reporting formats, privacy controls, electronic data exchange with clients and regulatory agencies (Centers for Disease Control, Environmental Protection Agency), internal tracking of specimens, and the ability to collect and analyze required quality assurance data, is not currently in place. The ability to manage the entire SLD operation from one computer screen, in a holistic manner is impossible under the current IT infrastructure, as the current information management system is based upon a laboratory section-by-laboratory section “ledger system” (lab section-specific listing of specimens) that is merely an electronic version of the paper-based recording system used by the laboratory 20 years ago. In the current system, specimens are only viewable and can only be queried from within each ledger.
SLD receives more than 150,000 samples a year that result in over 700,000 unique test results. In the existing system, all of these samples are managed by a numeric identifier that has to be manually entered multiple times, i.e. each time an analyst enters or retrieves information on a sample. The LIMS implementation will result in a barcode system whereby samples will be traceable through the entire lab with a single pass of the work order by a barcode reader or by a single query. The current silo structure will be eliminated so that the location and status of a sample will be viewable by a single query. This increased capability will significantly augment the business processes within the laboratory by enabling management to monitor processes and turn around times and also to track work loads for the laboratory’s numerous clients. The latter will indirectly facilitate SLD billing processes and increase accountability to DOH administration and the legislature by improving the accuracy of performance measures. The LIMS implementation will also enhance the electronic data transfer capabilities between SLD and its clients, allowing data transfer directly in formats required by clients, e.g. HL 7 messaging and Safe Drinking Water Information System (SDWIS) formats. Currently, data are transferred in flat files and must be manually converted to required formats.
Since the project was originally certified, the LIMS project has reviewed the COTS products currently on the market, performed extensive analysis of current and desired business processes, generated detailed system requirements, issued an RFP, and is currently in contract negotiations with the selected vendor.
Planned Start Date / 12/19/2005 / Planned End Date / 8/30/2009
Justification for Certification (Include budget adjustment request; Business Value and/or program Results)
To date, the LIMS project has planned and structured the project, defined the Lab’s general and specific requirements, determined business process improvements related to the implementation of a LIMS, identified performance improvement goals and objectives, published an RFP, solicited bids and viewed product demonstrations of market leading vendors, made a vendor selection, and entered into negotiations with said vendor. To date the Project has completed the following deliverables:· Document of current workflow and business practices
· Documented an exhaustive list of deliverables (700+ specific requirements)
· Documented a ‘to be’ workflow and business practices
· Developed and issued an RFP
· Reviewed all proposals from competing vendors
· Requested and received product demonstrations from 2 market leading LIMS vendors.
· Selected a vendor with which to enter negotiations
· Entered into contract negotiations with the selected vendor
Approval of this request is to allow SLD to continue the Implementation Phase. This is required because of several delays incurred during 2006-2007. The largest delay was the contracting of a LIMS Implementation Specialist to further refine the Product Requirements Document prior to RFP issuance. Other delays were the securing of additional funds to cover the price differential between estimated and actual costs of a LIMS system through implementation, as well as a longer than expected price and contract negotiation phase which is still ongoing.
Due to the delays mentioned above, a large portion of the $845,000 certified in 2006 has not been spent. When a contract is finalized with the selected LIMS vendor, the current Certification Request together with the unspent portion of 2006 Certification Request will cover the LIMS project through implementation. The contract with the LIMS vendor will be in approximately $1,000,000 which will span two fiscal years, FY08 and FY09.
When the LIMS Project is completed and the COTS solution is fully deployed, SLD, DOH, and the citizens of NM will benefit from the following.
· Full compliance with federal laboratory regulations and Health Insurance Portability and Accountability Act of 1996 (HIPAA)
· Improved reporting on Chain of Custody for Implied Consent section
· Integrated lab management information system for supplies, orders, results, and quality exceptions
· Improved web-services to SLD customers including secure lab test order entry processing.
· Reduced cost of system maintenance
· Ability to participate in the electronic exchange of data and information with other DOH partners such as the Environmental Protection Agency (EPA) and the Centers for Disease Control and Prevention (CDC)
· Improved data security.
· Faster reporting of lab test results.
· Electronic reporting of lab results
Total Appropriated Amount (include any new funds) / $1,879,986 / Amount Previously Certified / $1,000,000
Requested Amount this Certification / $879,986 / Remaining Appropriation not Certified / 0
Certification History (Include any previous project or phase certifications)
Date
/ Amount / Funding Source(s) (use specific citations to laws, grants, etc.)12/19/2005 / $155,000 / Laws 2005, Chapter 33, Section 7, Subsection 23
7/27/06 / $845,000 / Laws 2005, Chapter 33, Section 7, Subsection 23
Proposed Certification Schedule for Current Fiscal Year (agency to complete for all phases)
Phases / Amount Requested /
Major Deliverable(s)
/Due Dates
Initiation:
/ $155,000 / Detailed Product Requirements Document, Project Charter / 9/05 - 6/06Planning:
/ $253,925 / RFP developed by LIMS Implementation Specialist, IV&V Reviews, As Is Workflow Diagrams, To Be Workflow Diagrams / 7/06 - 3/07Implementation / $591,075 / RFP Issuance, Vendor Selection, Contract Negotiations, IV&V Periodic Reports / 4/07 – 1/08
$879,986 / Execute contract, System Implementation and User Acceptance, LIMS Implementation testing, IV&V Periodic Reports / 2/08 – 7/09
Closeout: / DoIT Project Closure Report, Project Materials Archive, Closed Contract File / 8/09
Appropriation History (Include all Funding sources, e.g. Federal, State, County, Municipal laws or grants)
Fiscal Year
/ Amount / Funding Source(s)FY06 / $1,000,000 / $1,000,000 - Laws 2005, Chapter 33, Section 7, Subsection 23
FY07 / $108,550 / $1,000,000 (extended from FY06) – Laws 2006, Chapter 109, Section 7, Subsection 20
$108,550 – Preparedness and Response to Bioterrorism Grant (CDC Cooperative Agreement U90/CCU616999-05)
FY08 / $771,436 / $1,000,000 (extended from FY05 and FY06) – Laws 2007, Chapter 28, Section 7, Subsection 25
$554,000 – Preparedness and Response to Bioterrorism Grant (CDC Cooperative Agreement U90/CCU616999-05)
$217,436 – Scientific Laboratory Division Operating Budget – Laws 2007, Chapter 28, Section 4, Subsection F, DOH, Paragraph 3
Budget
Comments:
Description
/ FY06 / FY07 / FY08 / FY09Staff - Internal
/ $35,000 / $90,000 / $90,000Consulting Services / $39,829 / $80,171 / $318,600 / $525,280
Hardware / $305,106
Software / $286,000 / $110,000
Total / $39,829 / $115,171 / $999,706 / $725,280
Independent Verification & Validation Approach (Include summary of the latest IV V report)
IV&V Activities for Implementation Project Phase:I. Project Information Collection & Discovery
• Review Project Documents
• Review State and Federal Lab Audit Reports
II. Process Review
• Monitor Procurement Process
III. Conduct Project Deliverable Reviews
• LIMS Implementation Contract
IV. Conduct Ongoing Project Monitoring
• Monitor Procurement Process
• Attend Appropriate Project Meetings
• Review Project Status Reports
• Review Project Steering Committee Minutes
• Prepare Monthly Reports
Below please find the Summary from most recent IV&V report dated June 15, 2007:
“Overall, this phase of the project, the Procurement, moves to completion. Thus far the documents, plans, evaluation tools and requirements identification are of high quality and the team, led by the project manager, has managed to get this phase to the final vendor selection process. As indicated above, the original schedule slipped due to the importance in assuring the requirements were complete prior to issuance of the RFP and the overall procurement process in place for the State in general. Since the revision of the plan, this process has proceeded extremely well since the RFP was posted. Overall, the project is on schedule according to the revised project plan. Funding has been encumbered/extended into FY08 so that the project can proceed smoothly.”
Significant Risks and Mitigation Strategy
Description –User acceptance of LIMS workflow / Probability: Expected / Impact : High
Mitigation Strategy : Heavy user training, translation of existing tables where possible, executive leadership stressing importance of user acceptance
Contingency Plan : Retraining of users, increase training on code translations from old system to new system, rework LIMS configuration options to make reasonable accommodations to justifiable concerns
Description –
Misunderstood requirements / Probability: Likely / Impact: Medium
Mitigation Strategy: Currently working with selected LIMS vendor before contract negotiations are complete.
Contingency Plan: SLD is bringing the LIMS administrators (primary and backup) into ALL committee meetings and technical discussions upfront to have technical understanding of each requirement. There is also $100,000 of funding in current budget that could be used for System configuration post implementation.
Description - Funding / Probability: Likely
(LIMS Project lost $100,000 in federal grant funds due to delay of an approved social services architecture pursuant to Laws 2005, Chapter 33, Section 7, Subsection 23) / Impact : Medium
Mitigation Strategy: SLD is aware of tight budget through project completion. Executive sponsor has spent time considering various streams of funding to cover what would be a small shortfall within a project with a $2M total budget
Contingency Plan: Reduce consulting work at final implementation phase; bring in more configuration work for SLD admins. Postpone some instrument interface configurations with environmental systems until SLD moves into new building. There are several ways to cover the shortfall which will be small should it even materialize. Moreover, all assumptions to date are based on no expansion of SLD operating budget.
Description –
Insufficient network capacity / Probability: Likely / Impact : Medium
Mitigation Strategy: ITSD is conducting a Network Assessment to confirm existing bandwidth capacity is sufficient to support expected LIMS response times.
Contingency Plan: Network Assessment will provide recommendations which will be implemented in coordination with DoIT to mitigate this risk.
Description - Technical Dependencies / Probability: Likely / Impact : Medium
Mitigation Strategy: The lab will increasingly depend on communication protocols into and out of the LIMS. To mitigate, one of each known protocol will be implemented.
Contingency Plan: Protocols and technical dependencies expected to arise will be accommodated within the support plan. Will attempt to work on each known protocol during implementation. Also working with major state and federal interfaces that will be looking for SLD data feeds as way to get such protocols functionally in place. Much of this is still under development by the external parties.
Security Strategy (Summarize Plan for Security, Backup and Disaster Recovery)
Backup: The production instance will be able to hold current year plus 2 years of live data. This database will in turn be imaged daily onto a removable tape and stored offsite to provide a back up should a data corruption take place.Disaster Recovery: The entire LIMS will have a mirror install functioning as a hot backup housed in an off-site vendor based location different from the main production system. This DR system will be able to fulfill normal operation with a manual failover achieving minimal functional downtime. Annual cost for back-up off-site hosting is estimated at $18,000 and is accounted for in the current budget.
Security: The LIMS will provide application-level security to protect the integrity of the data and shall be compatible with NM DOH systems software. The security measures shall be compatible with Windows XP and MS SQL Server database application. At a minimum the LIMS shall provide:
· Authentication – Verification that the user who is accessing the system is who they claim to be. This is implemented with Username, Password, Tokens, etc.
· Role based authentication
· Logging – Requirement per DOH HIPAA Security Policy. Access to the system as well as changes to the system must be logged. Logs must contain (at a minimum) username, date and time, and details of change.
· Malicious software – system and data files will have the ability to be scanned by DOH Anti-Virus and other malware scanners
· Encryption – system will have the ability to comply with DOH HIPAA Security Policies regarding encryption of confidential data.
The LIMS will be in full compliance with Federal regulations and standards pertaining to electronic transmission of patient and health information at the time of implementation. Specifically, the LIMS will address the Health Insurance Portability and Accountability Act (HIPAA) of 1996 and the Public Health Information Network (PHIN) guidelines.
User Authentication for NM SLD personnel shall be performed using Active Directory per Public Health Information Network (PHIN) guidelines. The LIMS shall perform user authentication independent of Active Directory for external users who are not listed in the DOH primary Active Directory.
Some external parties will require access to data in the LIMS (example: customer retrieving results), and as such will not be managed in Active Directory. For all external parties the LIMS will:
· Authenticate users utilizing, at the minimum, a unique user identifier and password.
· Allow the NM DOH to set the requirements for user names and passwords.
· Allow passwords to contain a mixture of upper case letters, lower case letters, numbers and special characters.
· Allow the system administrator to configure a password expiration policy based on NM DOH policy. The LIMS shall automatically require new passwords after a system administrator configurable amount of time.
· Prevent a user from re-using a password for a system administrator configurable number of times.
Consolidation Strategy (Summarize Collaboration Efforts and Plans with Other Agencies)