DRAFT TheraDoc Product Description.docx

TheraDoc Patient Clinical Monitoring Intervention Software

VA-26-00084433

PRODUCT DESCRIPTION (PD) TEMPLATEDRAFT

DEPARTMENT OF VETERANS AFFAIRS

VA New Jersey Healthcare Systems East Orange Campus

TheraDoc Patient Clinical Monitoring Intervention Software

Date: August 3, 2026

VA-26-00084433

PD Version Number: 1.0 Disclaimer: The TAC accepts no liability for the completeness or correctness concerning the Information Technology content of this template. This template is a means to simply assist the requiring activity in developing their requirements. It is the Requiring Activity’s responsibility to ensure the correctness of all requirements within their final Product Description.

Contents

1. Artificial Intelligence Requirements All requiring activities must adhere to the policy for all in-scope AI use-case owners to submit their AI Use-Cases through the CAIO Team Site which contains AI Use-Case Intake Form. Please see the Intake Form site referenced for further information on AI Use-Cases, and the submission instructions. See below for the Use-Case Categories and Examples of Use-Cases that would require submission of your effort using the AI Use-Case Intake Form.

Use-Case Categories and Examples That Require Intake Submission:

· VA AI Use-Cases required for Intake commonly fall under the following categories:

1. A software system that learns from data

1. A tool that mimics or supports human decision making

1. A tool exposed to new data to make predictions, decisions, or recommendations about real people, agency service delivery, or agency program execution

· Some examples of AI Use-Cases at VA include:

1. Machine learning or other AI tools to provide a clinical diagnosis or determine a recommended treatment;

1. AI chat tools to summarize claims and contention data;

1. Natural language processing to review Veteran survey comments and identify potential risks of crisis;

1. AI tools to automate components of benefits and application processing.

The answers provided within the AI Use-Case Intake Form including, but not limited to the type of AI used, the domain the AI is in, the benefit and output of the AI, will be used by CAIO to evaluate and determine if the use-case is required for Inventory, as well as if it is High-Impact, as required by M-25-21. See also Identification and Review of High-Impact AI Use Cases.

1. After submitting the use-case to the CAIO office Intake process, CAIO office representatives will assist the Use-Case Owner through next steps required for their Use-Case. If High Impact Use-Case, the CAIO office will also provide information regarding required risk management practices, the AI Impact Assessment, and Risk Mitigation Plan requirements. As a result, the Requiring Activity should determine if any specific related requirements tasks are needed for their PD to support these minimum risk management requirements.

0. Use-Case Owners should also indicate to CAIO whether the AI Use-Case is a pilot, which will release them from the full compliance process, but will trigger a follow-up by CAIO at six months

1. See Section 5.7 in the PD Template for the required information and language that will always be included in your PD, regardless of intake determination, and instructions regarding any modifications to the requirements, as necessary. Section 5.7 also contains PD requirements to ensure Unbiased AI Principles are adhered to and incorporated into the AI System/LLM.

1. Additionally, there are solicitation instructions/requirements for the Vendor to submit with its proposal, located in the Notes to the CO Section at the end of this document.

2. Source Code Harmonization and Reuse in Information Technology (SHARE IT) Act Requirements:

All custom software development efforts (except for those programs/products for use in national security systems, classified code, or code whose disclosure would create an identifiable risk to individual privacy) must include software source code delivery of custom-developed code for Federal re-use requirements in accordance with the SHARE IT Act, P.L. 118-187, December 23, 2024. (Custom-developed code means source code, or segregable portions of source code, written for a software project, module, plugin, script, middleware, or application programming interface, that is first produced in the performance of a contract, exclusively funded by the Federal Government, for which the Federal Government could obtain unlimited rights under FAR Part 27

a. See Section 5.8, Source Code Harmonization and Reuse in Information Technology (SHARE IT) Act, in this PD Template for the required information and language to be included in this PD if the SHARE IT Act applies.

b. The formal deliverable and task such as, “The Contractor shall provide a Custom-Developed Code Package including the source code or segregable portions of source code, and other key technical components of the code (including documentation, data models, schemas, metadata, architecture designs, configuration scripts, and artifacts required to develop, build, test, and deploy the code) to support reuse and transparency in accordance with the SHARE IT Act,” (or similar) must be added to the Software Development requirements at the appropriate location within the PD task in Section 1.x (to include adding the associated Custom Developed Code Package deliverable and its due date requirements in the Schedule for Deliverables table within the Notes to the CO Section (and corresponding CLIN within the Price Schedule)) to ensure delivery of the custom developed code package throughout the development process to the current VA GitHub Source Code Inventory Repository for VA/Federal re-use, as required in the SHARE IT Act.

3. VA Enterprise Cloud (VAEC) Efforts, Enterprise Cloud Solutions Office (ECSO):

The VA CIO and Infrastructure Operations Director require that, if a solution cannot be provided by a SaaS solution or Infrastructure as Code, that it next be assessed for hosting on one of VA’s Enterprise Cloud Hosting Platforms including the VA Enterprise Cloud (VAEC), and VA Platform One (VAPO). VAEC is a multi-cloud hosting platform, providing both Amazon Web Services and Microsoft Azure government community clouds. VAPO provides a containerization strategy for migrations and new development within the VAEC clouds. Both VAEC and VAPO support the efficient migration to and utilization of cloud technology by the requiring activity. Through VAEC and VAPO, Infrastructure Operations (IO) provides applications and systems with secure and seamless cloud functionality together with enterprise tools, standards and common services. IO adheres to the Cloud Smart Policy (https://cloud.cio.gov/strategy/),which offers practical implementation guidance to fully realize the potential of cloud-based technologies while ensuring thoughtful execution that incorporates practical realities. New cloud hosting requests can be directed to the IO Unified Intake Services Request here: IO Unified Intake Services Request. To expedite a request, contact OIT IO INTAKE TRIAGE.

To aid requiring activities that need to migrate applications or systems to the VAEC or are implementing applications or systems in the VAEC, the Office of Strategic Sourcing (OSS), Technical Acquisition Center (TAC), and the Enterprise Cloud Solutions Office (ECSO) have provided a VAEC Technical Reference Guide VAEC Technical Reference Guide 11/2022 This guide is applicable to migrations to or new development in the VAEC platforms.

Requiring Activities should also note that there is standard VAEC performance work statement (PWS) language (see below) to be used by project teams that need to migrate applications or systems to the VAEC or are implementing applications or systems in the VAEC. This language includes cloud-specific requirements and deliverables that should be considered in your PWS/PD.

Projects where an existing COTS or custom, legacy application or system has been deemed cloud suitable and is targeted to be migrated to and hosted in the VAEC (or is currently hosted in a VAEC) should refer to the “Standard VAEC PWS Language for Migrations” document for PWS/PD sample language considerations regarding specific VAEC requirements to be added to the Requiring Activity’s PWS/PD.

Projects where there is a new solution implementation should refer to the “Standard VAEC PWS Language for New Implementations” document for PWS/PD sample language considerations regarding specific VAEC requirements to be added to the Requiring Activity’s PD.

These documents can be found at the VAEC Acquisition Resources page: https://dvagov.sharepoint.com/sites/OITECSO/SitePages/VAEC-Acquisition.aspx?csf=1&e=dhnDL4. If you require further assistance, please contact ecsoinfo@va.gov.

4. SaaS EFFORTS:

In addition, Requiring Activities should note that for Software as a Service (SaaS) acquisitions, Digital Transformation Center (DTC) has developed standardized PWS/PD Language for several scenarios regarding FedRAMP, etc., to be added to your PWS/PD requirements document, as appropriate. Please see the document “SaaS Contract Language and Price Schedule – FY24” in the “SaaS” folder for the latest language and example price schedule, located in the “OIT Acquisition Guides” folder within the “OPAL Acquisition Requirements Package (ARP) Templates” area: OIT Acquisition Guides. Please also see the VA Digital Marketplace at DigitalVA Product Marketplace for existing VA-approved software as a service (SaaS), platform as a service (PaaS), and low-code no-code (LCNC) products to consider reusing an existing, proven solution in the catalog that may satisfy your requirements. However, the Digital VA Product Marketplace is not intended to direct procurements.

5. Clinical Data Determination Standards:

(Requiring Activities should note that for acquisitions of solution(s) involving a Clinical and Data Management System, the VHA Health and Medical Informatics office has developed standardized PWS/PD requirements language to be added to your PWS/PD requirements document as appropriate. Please see the document “PWS Guide – Clinical Terminology Standards Requirements” located in the “VHA Acquisition Guides” folder within the OPAL Acquisition Requirements Package (ARP) Templates” area: VHA Acquisition Guides. This Guide is intended to help programs and projects develop and/or select Clinical and Data Management systems that are aligned with terminology standards. Please contact VHA Health Informatics Knowledge Based Systems Terminology Standards Staff at VHA10P2AHIKBSTerminologyStandardsStaff@va.gov for any questions regarding these requirements.)

PRODUCT REQUIREMENTS

The Department of Veterans Affairs (VA) New Jersey Healthcare System requires a comprehensive patient clinical monitoring and intervention software program that provides clinical staff immediate, real-time lists of patients, identifies those who need clinical intervention based on current best practice guidelines and facility determined criteria and provides the ability of clinical staff to monitor and protect patients from drug interactions and adverse events. The program must have the capability of targeting only those patients who need clinical interventions, resulting in increased resourcing of staff. The software program will also need to allow Pharmacy and facility to meet regulatory requirements set by Joint Commission Standards, National Patient Safety Goals as part of the Joint Commission requirements and Veterans Health Administration (VHA) directives. Additionally, the software solution needs to provide clinical staff antimicrobial stewardship which will directly assist the facility in meeting its Directive 1031, Antimicrobial Stewardship Programs (ASP) dated January 30, 2019 delineating VA Medical Center’s responsibilities with antimicrobial stewardship. The software maintenance and support program will need to include security patches and software updates, and 24/7 technical support via multiple channels, including telephone support. Software maintenance and support shall also include enhancements/changes to the proprietary interface and software via interpretation of site-specific VistA programmatic uniqueness to meet functional needs of clinical staff. The software program shall include clinical surveillance that can be customized for users within section cohorts (i.e., Pharmacy, Infection Control, ADT, Laboratory, Mico, Surgery, Impatient Pharmacy, Radiology, BCMA, and Vital Signs via alert panels stratified by clinical section, alert type, date/time range and unit/hospital/outpatient locations.

The clinical surveillance system, with associated services must be able to interface with existing VA data resources including, but not limited to:

· Veterans Health Information Systems and Technology Architecture (VistA)

· Computerized Patient Record System (CPRS)

· Process Information Management System/Asset Information Management System (PIMS/AIMS) systems

· Bed Management

· Bar Code Medication Administration (BCMA)

· Others future systems (CERNER etc.)

2. Scope of Work TheraDOC surveillance and monitoring software shall be able to provide the following services:

· Meets all the needs of VANJ Healthcare System services that will utilize the surveillance program and be operational.within 90 days of award.

· Meets data, alerting and workflow needs for a broad range of healthcare users including pharmacists, infection preventionists, physicians, nurses, laboratory, and others requiring access to clinical surveillance data and information.

· The software shall be able to allow clinical pharmacists to create alerts, reports and track recommendation and interventions made by physicians during daily rounding in the areas of anticoagulation, diabetes, and cholesterol management and treatment.

· Provide a platform for inpatient and outpatient anticoagulation monitoring.

· Allow pharmacy and other services to create reports and alerts for high-risk, non-formulary, or other drug/drug evaluations.

· Allow creation of medication use evaluation reporting and provide tools for monitoring of medication adherence.

· Allow the documentation of clinical pharmacist interventions for prescribing changes/errors by intervention type – for example, dosage adjustments, changes in drug therapy, allergy preventions and Intravenous to Oral conversions.

· Allow documentation within the system to communicate with other users.

· Ability to generate reports on hand-hygiene/isolation precaution compliance.

· Ability to generate patient days reports.

· Ability to generate reports for assessment of outcome measures.

· Ability to create queries to identify patients with reportable communicable diseases.

· Ability to query for patients on specific drugs and or laboratory parameters.

· Ability to create targeted patient lists by either medication, class, or lab values.

· Allow for renal dose monitoring for timely and appropriate adjustments

· Allow for productivity reports by clinician including type and number of interventions

· Allow for calculation of cost savings per intervention type.

· Adverse Drug Event (ADE) surveillance and monitoring shall include prospective alerts on pending ADE’s for prevention, retrospective alerts on possible cases for assessment of cause and workflow tools for ad hoc identification and follow-up reporting opportunities.

· Identify patients by admission diagnosis and/or problem list diagnoses.

Requirements for Antimicrobial Stewardship/Infection Control Surveillance The required brand name TheraDoc clinical monitoring and intervention software shall provide the following clinical decision support system features:

· Ability to crate antimicrobial usage reports such as days of therapy (DOT), unit based antibiogram reports and charting of antimicrobial resistance trends.

· Availability of customized alerts for newly ordered targeted antimicrobials for prospective review and intervention opportunities.

· Must have a built-in alerting system for antimicrobial drug/bug mismatch events.

· Surveillance program must have the availability to generate reporting for inpatient (includes inpatient orders and BCMA) and or outpatient drug usage.

· Clinical software must allow the ID specialist to identify potential hospital acquired infections (HAI) including catheter-associated urinary tract infections (CAUTI), central line associated blood stream infections (CLABSI) or other blood stream infections (BSI), ventilator-associated events/pneumonia (VAE/VAP), Clostridium difficile infections (CID), Legionella, Tuberculosis, influenza, carbapenem-resistant Enterbacteriaceae (CRE) , Methicillin-resistant Staphylococcus aureus (MRSA) , multidrug resistant organisms (MDRO), and other positive cultures or laboratory tests of interest.

· Ability to create ad hoc alerts and reports

· Ability to identify patients on isolation precautions

· Ability to generate annual report on the number of microbial tests performed.

· Ability to provide outbreak/disease management (tracking patient unit/bed history/new case identification/histograms).

· Ability to generate reports electronically on healthcare-acquired infections to CDC, IPEC, and NHSN (National Health and Safety Network).

· Provides lab and other alerting of providers for the following:

1. Cardiac Enzymes

2. Chemistries

3. Dietary

4. Electrolytes

5. Endocrinology

6. Hematology

7. Hepatology

8. Toxicology

· The clinical surveillance and monitoring system must have the ability to integrate with VANJ systems already in use (CPRS, VistA, and PIMS/AIMS and interface with common leading software platforms and operating systems.

· The software must be able to run on VA, provided, virtual servers hosted on the government network.

· The contractor shall coordinate with VANJ Office of Information and Technology (OI&T) for the installation and configuration of the proprietary clinical surveillance system.

· The contractor shall provide onsite or virtual implementation, configuration, and training at VANJ, conduct regular calls with various groups and representatives as necessary.

· Utilize a data security interconnection infrastructure that shall address storage, generation, transmission and exchanging of data.

· The contractor shall provide maintenance and support that shall include security patches and software updates/enhancements, and 24/7 troubleshooting support for 12-months from date of Installation.

· All new software versions shall be covered in the maintenance services, including all subsequent versions designed to replace the version installed under this contract.

· Software shall include VA Single Sign On (SSOi) functionality so users can use their PIV (Personal Identify Verification) identification card and PIV pin to sign in.

· The contractor shall distribute maintenance updates or releases by using an appropriate electronic or printed media notifying the appropriate VANJ Point of Contact (POC).

· The contractor shall support the VA enterprise management framework. In association with the framework, the contractor shall comply with OI&T Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate ad maintain enterprise applications.

IT Architectural Requirements and Guidelines

· The applications, supplies, and services furnished under this Product Description (PD) must comply with One-VA Enterprise Architecture (EA), available at http://www.ea.oit.va.gov/index.asp and more specifically the Technical Reference Model (One-VA TRM) in force at the time of issuance of each PD. VA reserves the right to assess PD deliverables for each compliance prior to acceptance.

· The contractor shall ensure adequate Local Atrea Network LAN/Internet, data, information, and system security in accordance with VA standard operating procedures and standard contract language, conditions laws, and regulations. The contractor’s firewall and web server shall meet or exceed the government minimum requirements for security. All government data shall be protected behind an approved firewall. Any security violations or attempted violations shall be reported to the VA project manager and the VBA Headquarters Information Security Officer as soon as possible. The contractor shall follow all applicable VA policies and procedures governing information security, especially those that pertain to certification accreditation.

· The system operating system shall be Windows Server 2016 or higher

· The system shall function in a virtualized environment

· Due to the urgent nature of this request, the software shall be currently validated with VistA and established in other VA medical centers to decrease implementation time.

Deliverables

· The Contractor shall deliver the software within 90 days of award.

· If for any reason any deliverable cannot be delivered within the scheduled time frame, the contractor is required to explain why in writing to the CO, including a firm commitment of when the work shall be completed. This notice to the CO shall cite the reasons for the delay, and the impact on the overall project. The CO will then review the facts and issue a response, in accordance with applicable regulations.

· The Contractor shall install a clinical surveillance solution that meets the needs of the government.

· The Contractor shall provide an Open Virtual Application/Open Virtualization Format OVA/OVF to the Agency for the virtual environment

· Initial User Training:

· At least 30 days prior to “Go-Live” date, the contractor shall provide web-based technical end-user training on the use and operations of the software, and will also provide initial user training throughout the period of performance of the contact as new users are designated by the Government. Final dates and time for all training sessions shall be agreed upon between contractor and Point of Contact (POC) and/or designated POC.

· Refresher Training:

· The Contractor shall provide refresher training throughout the contract. Final dates and time for all refresher training sessions shall be agreed upon between contractor and COR and/or designated POC.

3. Training

a. All Contractor employees and Subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the VA Information Security Rules of Behavior, relating to access to VA information and information systems;

2) Successfully complete the VA Privacy and Information Security Awareness and Rules of Behavior course (TMS #10176) and complete this required privacy and information security training annually;

3) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the CO for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

b. The Contractor shall provide to the CO and/or the COR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 2 days of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training and electronically sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

NOTICE OF THE FEDERAL ACCESSIBILITY LAW AFFECTING ALL INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) PROCUREMENTS (SECTION 508)

On January 18, 2017, the Access Board issued a final rule that updated accessibility requirements covered by Section 508 and refreshed guidelines for telecommunications equipment subject to Section 255 of the Communications Act. The final rule went into effect on January 18, 2018. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.

SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) STANDARDS

The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT. These standards are found in their entirety at: Revised 508 Standards and 255 Guidelines (access-board.gov). A single PDF file version of the Revised Section 508 Standards and 255 Guidelines will be supplied upon request, or can be obtained from the Access Board website. Federal agencies must comply with the Rehabilitation Act of 1973, as amended.

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

COMPATABILITY WITH ASSISTIVE TECHNOLOGY

The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

ACCEPTANCE AND ACCEPTANCE TESTING

Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery. The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

INFORMATION TECHNOLOGY USING SUSTAINABLE PRODUCTS

Not Applicable.

SHIPMENT OF HARDWARE OR EQUIPMENT

Inspection: Destination Acceptance: Destination Free on Board (FOB): Destination

Ship To and Mark For:

Primary

Alternate

Name:

Name:

Address:

Address:

Voice:

Voice:

Email:

Email:

SPECIAL SHIPPING INSTRUCTIONS

Not applicable.

NATIONAL ACQUISITIONS

Not applicable.

GENERAL REQUIREMENTS

VA TECHNICAL REFERENCE MODEL

The Contractor shall comply with the VA OIT Technical Reference Model (VA TRM). Compliance with the VA TRM is achieved by using only technologies and standards that are listed as approved for use in the VA TRM. The Contractor shall provide all necessary information requested by VA to ensure TRM approval is obtained prior to use on VA’s network.

ZERO TRUST – VA CRITICAL SECURITY CONTROLS

VA has established minimum mandatory security requirements and requires that any network connected software system or service must meet the VA Critical Security Controls as outlined in the VA Memorandum, “VA Security Controls”, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010. VA Critical Security Controls identify the minimum mandatory requirements that must be implemented across all VA enterprise infrastructure, cloud computing environments, information systems, networks, and specialized devices (medical devices/systems, special-purpose systems, and research scientific computing devices) that process, store, and/or transmit VA data. Effective July 1, 2025, the Contractor shall implement these VA Critical Security Controls, within any network connected software system or service prior to being authorized for use in the VA. This functional requirement is not negotiable, and Plan of Action & Milestones (POAM) will not be accepted in the event these controls cannot be implemented for new systems. Critical Security Controls are intended to increase VA’s security posture and provide security and privacy risk visibility into the VA network and is not a new requirement. The Contractor’s failure to maintain these VA Critical Controls after implementation will result in VA discontinuing the use of the system.

SOCIAL SECURITY NUMBER (SSN) REDUCTION

The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN with the Integrated Control Number (ICN) in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA Master Person Index (MPI) for identity traits to include the use of the ICN as the Primary Identifier. The Contractor solution may only use a Social Security Number to identify an individual in an information system if and only if the use of such number is required to obtain information VA requires from an information system that is not under the jurisdiction of VA.

INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support IPv6-Only based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). Which defines IPv6-only as the state of an operational system or service when IPv4 protocol functions (addressing, packet forwarding) are not in use. The NIST USGv6 profile defines technical requirements for a product to be capable of operating in IPv6-Only environments. IPv6-Only technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices, applications, and systems shall support all applicable functionality on native IPv6-Only as well as dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g., web, email, DNS, ISP services, etc.) shall support native IPv6-Only and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall support using native IPv6-Only and dual stack (IPv6 / IPv4) for all functionality and operations.

SOFTWARE AND LICENSING REQUIREMENTS

The Contractor shall be responsible for the provision of all software licenses and any associated licensing maintenance required for any development, delivery, integration, operation, and/or maintenance associated with its proposed application(s), software products, software solution, and/or system including, but not limited to, any and all application(s), software and/or software products that comprise, are a part of, or integrate with the Contractor’s proposed application(s), software products, software solution, and/or system for the life of any resulting contract.

TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 “Secure External Connections”, and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the Cybersecurity & Infrastructure Security Agency (CISA) (https://www.cisa.gov/publication/tic-30-core-guidance-documents.)

GENERATIVE ARTIFICIAL INTELLIGENCE REQUIREMENTS

If Artificial Intelligence (AI) is part of the Contractor system/solution, the Contractor shall be in compliance with E.O. 13960 and 14319, OMB Memorandums M-25-21, M-25-22, and M-26-04, and VA Directive and Handbook 6500 to support VA in trustworthy, secure, responsible, accountable, Truth Seeking, and Ideologically Neutral AI innovation.

No web-based, publicly available generative AI service has been approved for use with VA-sensitive data including, but not limited to OpenAI’s ChatGPT, Microsoft’s Copilot, Google’s Gemini, and Anthropic’s Claude. No PII, protected health information (PHI), or VA-sensitive data should be entered into these unapproved services. The entire definition of VA Sensitive Data can be found at 38 U.S.C. § 5727 (23). The Contractor shall protect VA Sensitive data from unauthorized disclosure or use, and from being used to train or improve the functionality of the vendor's commercial offerings without express permission from VA. Only VA-hosted instances of generative AI services may be approved for use with VA-sensitive data.

The Contractor shall deliver the services, technical data, configurations, models, weights, documentation or other information, including source code, developed during contract performance. The Contractor, in collaboration with VA, must evaluate the output of any AI tool for accuracy prior to using the output in VA efforts. All data, including models, weights, algorithms, and outputs generated using either Government-furnished data or data first developed under this contract shall be the property of the Government with unlimited rights as defined by FAR 52.227-14. The Contractor shall also deliver any custom-developed code developed with AI methodologies in accordance with the SHARE IT Act, if applicable. VA shall also retain unlimited rights to any improvements to that data, including the continued design, development, testing, and operation of AI systems and/or systems utilizing AI.

The Contractor shall ensure that all AI Systems, including Large Language Models (LLM), whether standalone LLMs or integrated into broader software platforms, procured under this effort and/or used in performance of this contract complies with the Unbiased AI Principles as defined in Executive Order 14319 and OMB Memorandum M-26-04, e.g. Truth Seeking and Ideologically Neutral, as applicable to the intended use of the system.

The Contractor shall ensure that AI System/LLM generated outputs are truthful in responding to user prompts seeking factual information or analysis, prioritize historical accuracy, scientific inquiry, and objectivity, as well as acknowledge uncertainty where reliable information is incomplete or contradictory and do not fabricate, hallucinate, or present unverifiable information as fact.

The Contractor shall ensure that LLMs and AI outputs are neutral, nonpartisan tools that do not manipulate responses in favor of ideological dogmas such as Diversity, Equity, and Inclusion (DEI). The Contractor shall ensure that the LLMs, including the AI System, are not intentionally encoded with partisan or ideological judgments within an AI System’s/LLM’s outputs unless those judgments are prompted by or otherwise readily accessible to the end user.

Compliance with the AI requirements of this contract, including adherence to the Unbiased AI Principles, Truth-Seeking and Ideological Neutrality requirements, disclosure obligations, monitoring and reporting requirements, and corrective action responsibilities, is a material condition of eligibility for payment and continued performance. In accordance with OMB Memorandum M-26-04, failure to comply with these requirements, or refusal to take timely and appropriate corrective action to remedy identified noncompliance, may constitute a material breach of contract and may result in remedies consistent with the terms of the contract and applicable law including but not limited to withholding of payment, termination for cause/default, or other appropriate contractual remedies, as determined by the Contracting Officer.

All AI for delivery and/or use in performance of the contract shall adhere to the VA Trustworthy AI Framework, available at https://department.va.gov/ai/trustworthy/. Once the Contractor has obtained CO authorization to use specific AI in contract performance, the Contractor shall provide the COR a signed Statement of Attestation prior to AI implementation as identified in the Artificial Intelligence in VA Contracts clause, to include its associated list of AI being used in contract performance.

Deliverable:

1. Statement of Attestation

“H Clause” Incorporation Artificial Intelligence in VA Contracts For purposes of this clause, AI is defined as set forth by VA and Section 238(g) of the National Defense Authorization Act for Fiscal Year 2019 to include:

1. Any artificial system that performs tasks under varying and unpredictable circumstances without significant human oversight, or that can learn from experience and improve performance when exposed to data sets.

1. An artificial system developed in computer software, physical hardware, or other context that solves tasks requiring human-like perception, cognition, planning, learning, communication, or physical action.

1. An artificial system designed to think or act like a human, including cognitive architectures and neural networks.

1. A set of techniques, including machine learning (ML), that is designed to approximate a cognitive task.

1. An artificial system designed to act rationally, including an intelligent software agent or embodied robot that achieves goals using perception, planning, reasoning, learning, communicating, decision making, and acting.

The Contractor shall provide a list of all AI it will be proposing, creating, delivering, and/or using as part of contract performance, for VA approval. The list of AI shall be provided directly to the VA PM, COR, and CO at least annually but also at the following times: upon proposal submission, contract award, the COR’s request, and upon the Contractor’s proposed use of new AI tools not contemplated at the time of last reporting. AI shall not be used in performance of the contract without the written approval and authorization of the CO. The Contractor shall also report all AI intended for use in contract performance for VA’s inclusion in the VA AI Use Case Inventory. The Contractor shall actively engage in AI discovery, assessment, and compliance activities undertaken by VA.

Once the Contractor has obtained CO authorization to use specific AI in contract performance, the Contractor shall provide the COR a signed Statement of Attestation prior to AI implementation. All AI for delivery and/or use in performance of the contract shall adhere to the VA Trustworthy AI Framework, available at https://department.va.gov/ai/trustworthy/. The Statement of Attestation shall include, but is not limited to, a description of all controls, processes, technologies, and mechanisms utilized to satisfy VA’s six (6) AI Principles: Purposeful, Effective and Safe, Secure and Private, Fair and Equitable, Transparent and Explainable, and Accountable and Monitored. The Statement of Attestation shall also certify that the Contractor owns or possesses all legally required rights, copyright, and licenses to use the specified AI. The Statement of Attestation shall clearly state that the use of the AI by VA personnel in performance of the contract:

1. Does not and will not infringe upon any intellectual property rights of any kind.

2. Does not violate any intellectual property rights of any kind.

3. Does not violate any other third-party rights of any kind.

The Statement of Attestation shall also affirm that there have not been any persisting or existing material errors, defects, failures, or interruptions in AI performance of its intended purpose. Additionally, the Statement of Attestation shall include the Contractor’s endorsement that the AI has materially performed in accordance with its specifications and intended purpose. Lastly, the Statement of Attestation shall be updated and resubmitted, at a minimum, annually, prior to the exercise of any contract option periods. The Statement of Attestation shall be deemed separate from, and in addition to, the Contractor’s reporting requirements relative to the use of AI. The Statement of Attestation is a material term of the contract; accordingly, failure to provide the Statement of Attestation, to include all requirements, may be deemed a breach of contract and thus, cause for termination.

Data Ownership and Use. VA data (“Data”) shall include data collected, used, processed, stored, or generated as the result of the use of AI. VA data is and shall remain the sole and exclusive property of VA. Contractor is provided a limited, non-exclusive license to access and use Data solely for performing its obligations under the Contract. The Contractor shall: (a) keep and maintain VA data in strict confidence and as further described in this Contract and applicable law to avoid unauthorized access, use, disclosure, or loss; (b) not use, sell, rent, transfer, distribute, or otherwise disclose or make available VA Data for Contractor’s own purposes or for the benefit of anyone other than VA without the CO’s prior written consent; and (c) not store, use, and transmit VA Data outside of the United States. This applies to both identified and de-identified data.

The Contractor (or Subcontractor at any tier, including affiliates, third-party affiliates, and any other non-VA entities) shall not sell, monetize, release, share, reuse, transfer, or misuse any VA data, to include any models, training data, testing data, patterns, documentation, implementation artifacts, runtime artifacts, or any other digital artifacts, partially or as a whole, derived from AI or machine learning (ML) without the express written consent and approval from the CO.

The Contractor is prohibited from using non-public VA data, including Veteran data, and outputted results to train publicly or commercially available AI algorithms, fine-tune, or otherwise develop AI or ML models for reuse, transfer, or commercial purposes, without the express written authorization from the CO specifying VA data that may be used along with the acceptable scope of such usage. Contractor agrees that any AI models, weights, or derivative artifacts trained, or fine-tuned, on VA non-public data, if authorized by VA, may not be commercialized or used for the benefit of any third party without prior written approval by the CO and must be conducted within a VA authorized environment that has obtained an Authority to Operate

The Contractor shall indemnify VA and its officers, employees, and agents against liability, including costs, for actual or alleged direct or contributory infringement of, or inducement to infringe, any United States or foreign patent, trademark, or copyright, arising out of VA use of any AI products and/or services under the contract.

The Contractor shall maintain commercially reasonable insurance coverage for claims or losses pertaining to the AI products or services being used in performance of the contract.

The Contractor shall maintain commercially reasonable and industry standard conforming security safeguards and controls, including proper access controls for the AI. The Contractor agrees the VA Contracting Officer has the unilateral right to require deactivation of any AI for any reason and without notice.

Any development and/or creation of AI, including any AI derivatives, during performance of this contract, is subject to applicable Intellectual Property and data rights clauses under the Federal Acquisition Regulation (FAR) including, FAR 52.227-14. The VA retains the unlimited right to reuse, share, and/or redeploy AI code and AI models procured under this contract. License rights in any Commercial Computer Software shall be governed by this contract.

This clause applies to both existing and new uses of AI, both stand-alone AI and AI embedded within other systems or applications, AI developed both by VA or by third parties on behalf of agencies for the fulfilment of specific VA missions, including relevant data inputs used to train AI and outputs used in support of decision making, and VA procurement of AI applications.

This clause does not apply to AI embedded within common commercial products, such as word processors or map navigation systems. The Contractor shall inform the VA Contracting Officer in writing if it believes the AI it intends to use during contract performance is not covered by this clause. The burden to demonstrate the AI is a common commercial product shall rest solely with the Contractor.

Non-compliance with the terms above, or loss of sensitive VA medical records information resulting from AI use (whether accidental or intentional), may result in Contractor liability to VA for any and all rights and remedies provided by law, including but not limited to contract termination, liquidated damages, and referral to VA’s Suspension and Debarment Committee.

The Contractor shall include the substance of this clause in all subcontracts, including Subcontractors at any tier, affiliates, third-party affiliates, and any other non-VA entities.

INFORMATION SECURITY CONSIDERATIONS

All VA sensitive information shall be protected at all times in accordance with local security field office System Security Plans (SSP’s) and Authority to Operate (ATO)’s for all systems/LAN’s accessed while performing the tasks detailed in this Product Description.

POINTS OF CONTACT

VA Program Manager:

Name: Ann Verghese Address: VA New Jersey Healthcare System – East Orange Campus

Contracting Officer’s Representative:

Name: Michele Ramos Address: VA New Jersey Healthcare System

Contracting Officer:

Name: Brandon Caltabilota Address: 23 Christopher Way

Contract Specialist:

Name: Candice Mazzetta Address: 23 Christopher Way

PD Template Revision History

Product DescriptionTemplate_MAY_16_2025_Rev3_APR_10_2026 image1.jpeg