Draft Product Description - Sources Sought Notice 36C10B26Q0320

DRAFT

PRODUCT DESCRIPTION

DEPARTMENT OF VETERANS AFFAIRS (VA)

Office of Information & Technology Veterans Integrated Service Network 8

Bruce W. Carter, Miami VA Medical Center For

Brand Name or Equal NeoSoft LLC suiteHEART Cardiac Magnetic Resonance

Image Processing Software

Date: April 6, 2026 Version: 1.0

Contents

1.0 PRODUCT REQUIREMENTS

1.1 SALIENT CHARACTERISTICS

2.0 NOTICE OF THE FEDERAL ACCESSIBILITY LAW AFFECTING ALL

INFORMATION AND COMMUNICATION TECHNOLOGY (ICT)

PROCUREMENTS (SECTION 508)

2.1 SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY (ICT)

STANDARDS

2.2 COMPATABILITY WITH ASSISTIVE TECHNOLOGY

2.3 ACCEPTANCE AND ACCEPTANCE TESTING

3.0 INFORMATION TECHNOLOGY USING SUSTAINABLE PRODUCTS AND

SERVICES

4.0 DELIVERY AND GOVERNMENT POINTS OF CONTACT

5.0 GENERAL REQUIREMENTS

5.1 VA TECHNICAL REFERENCE MODEL

5.2 ZERO TRUST – VA CRITICAL SECURITY CONTROLS

5.3 SOCIAL SECURITY NUMBER (SSN) REDUCTION

5.4 INTERNET PROTOCOL VERSION 6 (IPV6)

5.5 TRUSTED INTERNET CONNECTION (TIC)

5.6 SOFTWARE AND LICENSING REQUIREMENTS

5.7 GENERATIVE ARTIFICIAL INTELLIGENCE REQUIREMENTS

5.8 INFORMATION SECURITY CONSIDERATIONS

1.0 PRODUCT REQUIREMENTS

The Department of Veterans Affairs (VA), Office of Information & Technology, Veterans Integrated Service Network (VISN) 8, Bruce W. Carter, Miami VA Medical Center requires brand name or equal NeoSoft LLC (NeoSoft) Cardiac Magnetic Resonance (CMR) image processing software, including term software licensing with software maintenance and technical support. The software will be installed by VA staff on a local server and will be accessed by one end user at a time, noting that there may be multiple, non-concurrent users.

VISN 8 uses cardiac Magnetic Resonance Imaging (MRI) image processing software to process Magnetic Resonance (MR) studies. VISN 8 requires this software to provide initial analyses, including evaluate function (EF), quantification of flow, Four- Dimensional (4D) Flow, myocardial tissue characterization, strain analysis, mapping, perfusion for stress testing, and other elements as listed in Section 1.1 of this Product Description (PD).

The Contractor shall deliver all software licensing to the Government Points of Contact (POC) listed in Section 4.0 of this PD no later than five business days After Receipt of the Order. The performance period is a 12-month base period beginning when the software is live (in production and available for use) on the VA network, and with two 12-month Option Periods.

The Contractor shall provide software maintenance and technical support for the brand CMR image processing software. Within 24 hours ARO, the Contractor shall provide the Government POCs listed in Section 4.0 of this PD with the Contractor’s POC name and telephone number to required maintenance and technical support. Software maintenance and technical support shall begin when the CMR image processing software is live on the VA network. Upon notification of a service issue, the Contractor shall attempt to resolve the issue within the first 48 hours from notification. If the service issue has not been completely resolved within the first 48 hours, the Contractor shall provide the Government POC listed in Section 4.0 of this PD an explanation that includes a plan for resolving the issue including the timeframe for resolving the issue, which shall not exceed five business days. In the event the issue is not resolved at the end of the five business days, the Contractor shall commit to deploying all Subject Matter Expert resources necessary to resolve the issue(s). Upon resolution, the Contractor shall provide the Government POCs a detailed root cause diagnosis and resolution report.

The Contractor shall provide secure connection capabilities for downloading software, software updates, upgrades and/or uploading diagnostic information using Secure File Transfer Protocol (SFTP).

The Contractor shall provide the following brand name or equal NeoSoft CMR image processing software, including software licensing, software maintenance, and technical support:

Description NeoSoft Part Number (#) Quantity Brand Name or Equal NeoSoft suiteHEART Service Contract – 12 months – 1 User

NS-02-003-0012 1

Option Period 1 suiteHEART Service Contract – 12

Option Period 2 suiteHEART Service Contract – 12

1.1 SALIENT CHARACTERISTICS

The Contractor shall provide brand name or equal NeoSoft suiteHEART NeoSoft) Cardiac Magnetic Resonance (CMR) image processing software, including term software licensing with software maintenance and technical support, that provides the following technical capabilities and functionalities:

Brand Platform and Licensing:

• All software, licenses, training, and maintenance shall be from the same brand to ensure seamless integration and consistent cardiovascular reading and reporting across the VISN.

• To function as intended, the software shall operate as a one-brand platform, e.g., if the primary CMR software is brand “XYZ,” all modules required to make the software function as intended must be brand “XYZ”.

• Software licensing shall provide nonconcurrent users full access to the software. Multiple non-concurrent users have access to fully functional instances.

• The software shall function properly regardless of the brand of MRI scanner it interfaces with.

Core CMR Image Processing Capabilities:

• Functional Analysis: Detect wall motion abnormalities, stroke volume and evaluation of cardiac function (EF), ejection fraction assessment from short and long axis images.

• Flow Analysis: provide full flow analysis and semi-automated flow analysis, with semi-automated contour detection. Provide full comparisons for pulmonary flow (Qp): systemic flow (Qs) calculations. Make minor adjustments and correct aliasing artifacts.

• Myocardial Tissue Characterization: Assessment of myocardial perfusion, scar, edema, microvascular obstruction (MVO), extracellular volume (ECV), and iron concentration; analysis of early/late enhancement and T2-weighted images using Artificial Intelligence (AI)-based and semi-automated characterization tools; mapping (T1, T2, T2 mapping and T2* Analysis) o Tissue Characterization: provide analysis of early and late enhancement and T2 weighted images. AI-based contour detection.

Semi-automated regional and global scar, edema, MVO analysis.

Ability to derive and synchronize contours between series.

o Strain Analysis: provide fully automated AI-based left ventricle (LV) contour detection. Calculation of radial, circumferential, and longitudinal strain that includes strain rate, displacement, velocity, torsion, and torsion rate.

o Perfusion Analysis for stress testing: Absolute myocardial blood flow analysis; supports multi-vendor, multi-sequence support, dual bolus, and dual sequence protocols; motion compensation for free-breathing;

side-by-side views of rest, stress, function, and late gadolinium enhancement.

o T1 and T2 Mapping: provide global and regional T1 and T2 analysis;

motion correction and registration; and T1, T2, and ECV map generation with customizable color tables. Note: to be used in the diagnosis of heart failure, coronary artery disease, ischemic cardiomyopathy, myocardial infarction/scar, myocarditis, cardiac masses, and atrial fibrillation.

o T2* Mapping: global and regional T2* analysis - reporting of iron content. Note: to be used in the diagnosis of thalassemia or hemochromatosis.

Semi Quantitative Perfusion: provide for:

- Absolute myocardial blood flow

- Multi-vendor support

- Multi-sequence support

- Dual Bolus and Dual Sequence support

- Analysis of multi-slice, SAX perfusion images

- Automatic motion compensation

Note: this analysis allows for absolute myocardial blood flow. Multi sequence support. Dual bolus and dual sequence support. It allows analysis of multislice short axis (SAX) perfusion images. It performs motion correction allowing free breathing acquisition. Side-by-side view of rest, stress, function and late gadolinium enhancement.

Contour forwarding for breathing motion. Automatic analysis and fully automatic quantification. No manual segmentation. Artifact correction.

• 4D Flow Quantification: provide quantify flow, automatically calculate Qp:Qs and correct for aliasing. Ability to crop large data sets to a region of interest. Provide Semi-automated centerline extraction for multiple structures. Provide comprehensive visualization and analysis of ventricular flow, pulse wave velocity, wall shear stress energy loss.

• Anatomical Visualization: Provide access complex cardiovascular morphology/anatomy with 2D and 3D visualization options.

Automation and AI Functionality:

• Provide AI-based single-click results for clinical needs, including measurements in the LV, right ventricle, left atrium, and right atrium. The results of the AI-based processes shall be reproducible.

• Pre-process data and images automatically upon scan completion without requiring physician/operator interaction.

• AI-based contour detection and single-click analysis for clinical applications.

• Automated data analysis that reduces the need for physician/operator manual intervention and configurable AI-assisted workflows.

• Ability to analyze and export multiple studies simultaneously with minimal physician/operator input.

Measurement, Rendering, and Comparison Tools:

• Tools for baseline and follow-up scan comparison, displayed side-by-side.

• Manual combination of image series.

• Auto-populated reports with standard reference values.

• Comprehensive measurement and rendering capabilities for all core functions listed above.

Data Management and Integration:

• Secure download/upload for software, updates, and diagnostic information via SFTP.

• Export data to external software, e.g., Microsoft Excel, for research or analysis.

• Storage and retrieval compatible with standard data management systems.

Reporting and Documentation:

• Automated and customizable reporting tools.

• Accurate and detailed documentation management consistent with clinical standards.

• Auto-populating reports integrated with measured values and reference ranges.

Security and Compliance:

• Shall comply with Health Insurance Portability and Accountability Act and VA data security standards.

• Protection of Protected Health Information, Personally Identifiable Information, and other sensitive data through secure handling protocols.

Support, Maintenance, and Training:

• Continuous user training and education resources availability.

• 24/7 technical support with defined response and resolution times.

• Root cause analysis and detailed resolution documentation for reported issues.

• Ongoing software maintenance, updates, and upgrades included.

Scalability and Usability:

• Modular and scalable design allowing expansion with additional features and modules.

• User-friendly interface, i.e., tailored for efficiency and ease of use in clinical environments.

2.0 NOTICE OF THE FEDERAL ACCESSIBILITY LAW AFFECTING ALL

INFORMATION AND COMMUNICATION TECHNOLOGY (ICT)

PROCUREMENTS (SECTION 508)

On January 18, 2017, the Access Board issued a final rule that updated accessibility requirements covered by Section 508 and refreshed guidelines for telecommunications equipment subject to Section 255 of the Communications Act. The final rule went into effect on January 18, 2018. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.

2.1 SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY (ICT)

STANDARDS

The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT.

These standards are found in their entirety at: Revised 508 Standards and 255 Guidelines (access-board.gov). A single PDF file version of the Revised Section 508 Standards and 255 Guidelines will be supplied upon request, or can be obtained from the Access Board website. Federal agencies must comply with the Rehabilitation Act of 1973, as amended.

https://www.access-board.gov/ict/ https://www.access-board.gov/ict/

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

☒ E205 Electronic Content – (Accessibility Standard -WCAG 2.0 Level A and AA Guidelines)

☒ E204 Functional Performance Criteria ☐ E206 Hardware Requirements ☒ E207 Software Requirements ☒ E208 Support Documentation and Services Requirements

2.2 COMPATABILITY WITH ASSISTIVE TECHNOLOGY

The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

2.3 ACCEPTANCE AND ACCEPTANCE TESTING

Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery.

The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

3.0 INFORMATION TECHNOLOGY USING SUSTAINABLE PRODUCTS AND

SERVICES

The Contractor shall comply with Sections 524 and Sections 525 of the Energy Independence and Security Act of 2007; Section 104 of the Energy Policy Act of 2005;

Executive Order 13221, “Energy-Efficient Standby Power Devices,” dated August 2, 2001; and the Federal Acquisition Regulation (FAR) to provide ENERGY STAR®, Federal Energy Management Program (FEMP) designated, and products and services that meet EPA Recommendations of Specifications, Standards, and Ecolabels in effect as of October 2023 (e.g. Electronic Product Environmental Assessment Tool (EPEAT) registered products) in providing information technology products and/or services. The Green Procurement Compilation (GPC) website available at Green Procurement Compilation - GSA Sustainable Facilities Tool (sftool.gov) provides a comprehensive list of sustainable products and services and sustainable acquisition guidance.

https://sftool.gov/greenprocurement https://sftool.gov/greenprocurement

The Contractor shall provide products that meet the definition of sustainable products and services if the products are delivered to the Government; furnished by the Contractor for use by the Government, incorporated into the construction of a public building or public work, or acquired by the Contractor for use in performing services under a Government contract where the cost of the products is a direct cost to a Government contract (versus costs which are normally applied to a contractor's general and administrative expenses or indirect costs).

Specifically, the Contractor shall provide sustainable products under this contract in accordance with FAR 52.223-23. The applicable products with their associated certification, designation, and/or ecolabel (e.g. Energy Star, FEMP, and/or EPEAT) are identified within the product specifications in this PD. The Contractor shall ensure proposed products meet the certification(s) / designation(s) / ecolabel(s) specified at the time of submission of proposals and at the time of award.

4.0 DELIVERY AND GOVERNMENT POINTS OF CONTACT

Electronic Delivery:

Inspection: Destination Acceptance: Destination Free on Board (FOB): Destination

Ship To and Mark For: Delivery of software licenses, confirmation of delivery, and all other communications shall be directed electronically to the following:

Program Manager:

Name: To Be Provided (TBP) at award Address:

Email:

and

Senior IT Analyst:

Name: To Be Provided (TBP) at award Address:

Email:

Packing Slips/Labels and Lists shall also include the following:

IFCAP PO # or Contract No.: ____________ (e.g., 166-E11234 (the IFCAP PO number is located in block #20 of the SF 1449)) Project Description: (e.g. Tier I Lifecycle Refresh)

Total number of Containers: Package ___ of ___. (e.g., Package 1 of 3)

5.0 GENERAL REQUIREMENTS

5.1 VA TECHNICAL REFERENCE MODEL

The Contractor shall comply with the VA Office of Information and Technology (OIT) Technical Reference Model (VA TRM). Compliance with the VA TRM is achieved by using only technologies and standards that are listed as approved for use in the VA TRM. The Contractor shall provide all necessary information requested by VA to ensure TRM approval is obtained prior to use on VA’s network.

5.2 ZERO TRUST – VA CRITICAL SECURITY CONTROLS

VA has established minimum mandatory security requirements and requires that any network connected software system or service must meet the VA Critical Security Controls as outlined in the VA Memorandum, “VA Security Controls”, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010. VA Critical Security Controls identify the minimum mandatory requirements that must be implemented across all VA enterprise infrastructure, cloud computing environments, information systems, networks, and specialized devices (medical devices/systems, special-purpose systems, and research scientific computing devices) that process, store, and/or transmit VA data. Effective July 1, 2025, the Contractor shall implement these VA Critical Security Controls, within any network connected software system or service prior to being authorized for use in the VA. This functional requirement is not negotiable, and Plan of Action & Milestones (POAM) will not be accepted in the event these controls cannot be implemented for new systems. Critical Security Controls are intended to increase VA’s security posture and provide security and privacy risk visibility into the VA network and is not a new requirement. The Contractor’s failure to maintain these VA Critical Controls after implementation will result in VA discontinuing the use of the system.

5.3 SOCIAL SECURITY NUMBER (SSN) REDUCTION

The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010 with the Integrated Control Number (ICN) in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA Master Person Index (MPI) for identity traits to include the use of the ICN as the Primary Identifier. The Contractor solution may only use a Social Security Number to identify an individual in an information system if and only if the use of such number is required to obtain information VA requires from an information system that is not under the jurisdiction of VA.

5.4 INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support IPv6-Only based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). Which defines IPv6-only as the state of an operational system or service when IPv4 protocol functions (addressing, packet forwarding) are not in use. The NIST USGv6 profile defines technical requirements for a product to be capable of operating in IPv6-Only environments. IPv6-Only technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices, applications, and systems shall support all applicable functionality on native IPv6-Only as well as dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g., web, email, DNS, ISP services, etc.) shall support native IPv6-Only and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall support using native IPv6-Only and dual stack (IPv6 / IPv4) for all functionality and operations.

5.5 TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 “Secure External Connections”, and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the Cybersecurity & Infrastructure Security Agency (CISA) (https://www.cisa.gov/publication/tic-30-core-guidance-documents.)

5.6 SOFTWARE AND LICENSING REQUIREMENTS

https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1 https://doi.org/10.6028/NIST.SP.500-267Br1 https://doi.org/10.6028/NIST.SP.800-119 https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf https://www.cisa.gov/publication/tic-30-core-guidance-documents

The Contractor shall be responsible for the provision of all software licenses and any associated licensing maintenance required for any development, delivery, integration, operation, and/or maintenance associated with its proposed application(s), software products, software solution, and/or system including, but not limited to, any and all application(s), software and/or software products that comprise, are a part of, or integrate with the Contractor’s proposed application(s), software products, software solution, and/or system for the life of any resulting contract.

5.7 GENERATIVE ARTIFICIAL INTELLIGENCE REQUIREMENTS

No web-based, publicly available generative AI service has been approved for use with VA-sensitive data including, but not limited to OpenAI’s ChatGPT, Microsoft’s Copilot, Google’s Gemini, and Anthropic’s Claude. No Personally Identifiable Information, protected health information, or VA-sensitive data shall be entered into these unapproved services. The entire definition of VA Sensitive Data can be found at 38 U.S.C. § 5727 (23). The Contractor shall protect VA Sensitive data from unauthorized disclosure or use, and from being used to train or improve the functionality of the vendor's commercial offerings without express permission from VA.

The Contractor, in collaboration with VA, must evaluate the output of any AI tool for accuracy prior to using the output in VA efforts. All data, including algorithms and outputs generated using either Government-furnished data or data first developed under this contract shall be the property of the Government with unlimited rights as defined by FAR 52.227-14. VA shall retain unlimited rights to any improvements to that data.

The Contractor shall ensure that all AI Systems, including Large Language Models (LLM), whether standalone LLMs or integrated into broader software platforms, procured under this effort and/or used in performance of this contract complies with the Unbiased AI Principles as defined in Executive Order 14319 and OMB Memorandum M- 26-04, e.g., Truth Seeking and Ideologically Neutral, as applicable to the intended use of the system.

The Contractor shall ensure that AI System/LLM generated outputs are truthful in responding to user prompts seeking factual information or analysis, prioritize historical accuracy, scientific inquiry, and objectivity, as well as acknowledge uncertainty where reliable information is incomplete or contradictory and do not fabricate, hallucinate, or present unverifiable information as fact.

5.8 INFORMATION SECURITY CONSIDERATIONS

All VA sensitive information shall be protected at all times in accordance with local security field office System Security Plans (SSP’s) and Authority to Operate (ATO)’s for all systems/LAN’s accessed while performing the tasks detailed in this Product Description.