Amendment 0003 Attachment - Questions and Answers.xlsx

Sheet1

Devices using 802.11 wireless networking require a FIPS certification number at either the device or wireless card level. If vendors are in process of achieving FIPS compliance and provide evidence in the IDIQ submission, the requirement is partially met. In order to fully meet this requirement and be eligible to potentially receive a delivery order award, FIPS 140-2 or 140-3 certification at the device or wireless card level is required.

The above language creates an ambiguity about when requirements must be met. In order to be eligible for an IDIQ contract award, infusion devices must be technically acceptable, which means they meet the SOW requirements. See RFP Am. 0001, § E.12 (“Under the technical acceptability standard, proposals will be evaluated to determine whether offerors’ proposals meet the minimum technical requirements described in Sections B and D.3 of the Statement of Work”). The above quoted language from the VA’s response to Question 1 indicates that proposals will be found to be technically acceptable if they only partially meet the technical acceptability requirements by having an in-progress FIPS certification. This contradicts the existing RFP language.

We understand NIST FIPS 140-3 certification has multiple levels of review. Will the VA amend the RFP to state that devices that are at any level of certification will be eligible for award of an IDIQ contract?

Does this mean that a device that is in the process of FIPS certification can be added/awarded under an IDIQ contract, but cannot be ordered under a delivery order unless/until it receives FIPS certification?

If not, please explain how a device that only partially meets technical acceptability requirements by having an in-progress FIPS certification can be eligible for an IDIQ contract award, and whether such devices can be ordered via a delivery order if the FIPS certification is in progress.

Also, please explain to what other requirements the VA’s “in progress” concept applies that would allow a device to be ordered under a delivery order. For example, does “in progress” apply to FDA 510(k) clearance, Oracle Health CareAware validation, etc.? We understand NIST FIPS 140-3 certification has multiple levels of review. Will the VA amend the RFP to state that devices that are at any level of certification will be eligible for award of an IDIQ contract?

The RFP will not be amended to the requested language. To meet the IDIQ requirement, devices using 802.11 wireless networking require a complete FIPS certification at either the device/wireless card level or be in progress of receiving the certification. To meet the delivery order requirement, devices using 802.11 wireless networking require a complete FIPS certification at either the device or wireless card level.

Does this mean that a device that is in the process of FIPS certification can be added/awarded under an IDIQ contract, but cannot be ordered under a delivery order unless/until it receives FIPS certification?

Devices using 802.11 wireless networking require a complete FIPS certification at either the device or wireless card level and cannot be ordered under a delivery order unless/until either the device or wireless card receives FIPS certification.

If not, please explain how a device that only partially meets technical acceptability requirements by having an in-progress FIPS certification can be eligible for an IDIQ contract award, and whether such devices can be ordered via a delivery order if the FIPS certification is in progress.

Please refer to response above.

Also, please explain to what other requirements the VA’s “in progress” concept applies that would allow a device to be ordered under a delivery order. For example, does “in progress” apply to FDA 510(k) clearance, Oracle Health CareAware validation, etc.? The answers to these questions are required because they impact on an offeror’s proposal and its device offerings.

In addition to the FIPS compliance discussed above, devices cannot be ordered under a delivery order unless/until Oracle Health CareAware validation is obtained.

2 SOW 7 B.1 Large Volume, Syringe and PCA Pumps In reference to the government's response to question 4 of Amendment 0001, which asks how the VA will ensure that IDIQ contract awardees maintain their 510(k) FDA clearance after IDIQ award - the VA states as follows (and also addressed in the VA’s response to Question 6):

The FDA has quality and compliance programs that ensure medical devices in the United States remain safe and effective throughout their lifecycle. Regulations address complaint investigations and other post-market surveillance performance. It is the manufacturer’s responsibility to maintain regulatory compliance and notify VA if at any point there are barriers to meeting this requirement (before procurement and while in use). Any changes may require an updated or new VA Directive 6550 Appendix A to be submitted.

If an IDIQ awardee’s device has an active Class I system or device recall that has not been remediated, will the VA add language to the RFP to restrict such device from being ordered under a delivery order until the FDA clears the recall for safe patient use?

If an offeror’s 510(k) clearance for a device on its IDIQ contract becomes invalid, the offeror may need to modify the device (e.g., by upgrading hardware or software) in order to regain FDA 510(k) clearance. In such cases, the updated device is no longer the same device upon which the VA’s IDIQ contract award was based. The VA will be permitting the offeror of the recalled item to retroactively modify its offer to the government, and renegotiate its IDIQ contract, while denying the same opportunity to all other offerors. How will the VA ensure that allowing one offeror to alter its IDIQ contract offerings does not result in improper, unequal, prejudicial treatment of the other IDIQ contract awardees? If an IDIQ awardee’s device has an active Class I system or device recall that has not been remediated, will the VA add language to the RFP to restrict such device from being ordered under a delivery order until the FDA clears the recall for safe patient use?

No, VA will not add language to the RFP restricting its ability to order recalled devices under a delivery order. VA believes this is a unique circumstance and will be handled accordingly.

How will the VA ensure that allowing one offeror to alter its IDIQ contract offerings does not result in improper, unequal, prejudicial treatment of the other IDIQ contract awardees?

Should any contractor’s IDIQ contract require modification throughout the life of the contract, VA will adhere to applicable procurement law and ensure that the modification complies with the requirements of the FAR. Any breaches to the terms of the IDIQ contract will be addressed in accordance with applicable acquisition regulations and laws, including, but not limited to, the Contract Disputes Act, FAR 33.2, and FAR 52.212-4.

3 SOW 7 B.1 Large Volume, Syringe and PCA Pumps Question 5 of Amendment 0001 asks whether there is a minimum period for a device purchased 30 September 2030 must be supported to help define useful life of the device. In response, the VA states:

Useful life, synonymous with service life, is defined as the time that a device is expected to remain functional and supported by the manufacturer after placed into use. This period of time is defined by the manufacturer. The manufacturer is responsible for end of sale dates. It is not in the best interest of the government to procure medical devices with a known end of sale or end of service life that will occur before the end of the estimated useful life.

Allowing manufacturers to define a device’s useful life (which the VA also advocates in its response to Questions 9, 9(e) and 9(f)) can lead to gamesmanship and unintended results. For example, would it be acceptable for a manufacturer to define the useful life of its device as two years? In a manufacturer’s FDA 510(k) clearance Summary Letter for a device, the useful life is defined. We request the VA use the useful life of a device to be awarded under an IDIQ contract as the time period defined in the manufacturer’s 510(k).

Further, if an IDIQ contract awardee’s infusion device reaches its end-of-life during the IDIQ contract term, will that IDIQ awardee have the opportunity to offer a replacement product as a substitute for the product that has reached its end-of-life? We request the VA use the useful life of a device to be awarded under an IDIQ contract as the time period defined in the manufacturer’s 510(k).

VA expects honesty and transparency in all communications. Manufacturers should report the same useful life reported to FDA.

Further, if an IDIQ contract awardee’s infusion device reaches its end-of-life during the IDIQ contract term, will that IDIQ awardee have the opportunity to offer a replacement product as a substitute for the product that has reached its end-of-life?

Devices on the IDIQ contract that reach their end of life during the IDIQ ordering period no longer comply with the contract requirements and will not be available to VA facilities for ordering. Acquisition of replacement products would have to comply with all applicable procurement laws and regulations. The contracting officer must conduct a scope determination before making changes to the terms of the IDIQ contracts. The Agency will not answer a hypothetical question at this time about what contract administration issues may arise during the IDIQ contracts' performance period.

4 Combined Synopsis/Solicitation Per the VA’s answer to questions 12 and 13 of Amendment 0001, which asks whether an infusion pump or device running Windows Server or SQL Server 2019 meet the requirement of section D.3.1 - the VA states “[a]t this time, yes”; the “requirement is met until end of the support period [and] [u]nder Microsoft’s current timelines, MS 2019 LTSC is in the security support period until 1/9/2029 and SQL Server 2019 is in the security support period until 1/8/2030.”

Question 13 asked whether an infusion system with FDA 510(K) clearance - tested and evaluated with Windows Server and SQL Server 2019 or earlier - would be acceptable under the terms of this RFP, and eligible for award of an IDIQ contract with a period of performance starting on October 1, 2025 and ending on September 30, 2030. In response, the VA states “MS 2019 LTSC and SQL Server 2019 are currently supported. Procurements after the end of the support period indicated in the response to ID 12 are prohibited because it would not meet the D.3.1 requirement.”

How will the VA ensure the Oracle Health’s CareAware certification is fair and equitable, and accreditation is completed in a timely manner for all IDIQ? Under what authority does the VA plan to manage this requirement? Will the VA mandate that Oracle provide written “in process” representations to an offeror/IDIQ awardee? Devices cannot be ordered under a delivery order unless/until Oracle Health CareAware validation is obtained.

VA does not intend to manage the process of obtaining Oracle Health CareAware validation for any manufacturer. It is the manufacturer's responsibility to obtain this validation. In terms of what is required to be submitted with an offeror's proposal, refer to FAR 52.212-1 which states that "[i]f validation by Oracle Health's CareAware Platform cannot be provided [with the proposal submission], include evidence of validation in progress." The RFP does not dictate what "evidence" is required.

7 SOW 8 and 9 B. Technical Requirements In reference to the governemnt's response to question 21 of Amendment 0001, question 21 asks the VA to explain why the RFP allows “the infusion library/dataset” to be transmitted to PCA Pumps either wirelessly, or via a wired connection,” while the RFP only permits syringe pumps to transmit the infusion/library/dataset wirelessly. The VA responded by stating that “[c]hanges to a PCA pump library are very infrequent compared to expected changes for a large volume or syringe device library [and] [m]anually updating large numbers of pumps quarterly requires resources that create barriers to timely updates.” Can the VA please explain how it is not arbitrary and capricious to permit PCA Pumps to use wired connections but not permit Syringe Pumps to use wired connections? Will the VA permit Syringe Pumps to be able to use both/either wired or wireless connections?

First, the refusal to allow Syringe Pumps to be eligible for award under an IDIQ contract with a wired connection is patently a lockout specification favoring one manufacturer. It is our understanding that only one manufacturer has a FIPS 140-3 certificate “in progress” for a Syringe Pump that can transmit the infusion library/dataset wirelessly. If the VA does not permit Syringe Pumps to transmit infusion library/dataset either wirelessly or via a wired connection -as the VA does for PCA pumps - the Agency will be conducting an improper sole source procurement that will unnecessarily preclude competition in violation of the Competition in Contracting Act, prejudice all other offerors, and expose the VA and the RFP to pre-award protests.

Second, the VA’s response to Question 21 is misleading. We agree that the “[i]nventory of PCA pumps is generally far less than large volume” pumps, but the VA inventory of PCA pumps exceeds its inventory of Syringe Pumps for which the VA is allowing wired connection. Thus, the rationale for not allowing wired connection because of the manual process for data transfer for Syringe Pumps is invalid.

This is particularly important because most, if not all, VISNs will seek LVP, PCA, and Syringe Pumps from the same manufacturer in delivery order procurements . Thus, locking out all manufacturers except one on the basis of requiring Syringe Pumps to only connect wirelessly and not through a wired connection effectively limits delivery order competition to one manufacturer.

Will the VA permit Syringe Pumps to transmit the infusion library/dataset either wirelessly or via a wired connection as it has done for PCA pumps? If not, please identify the VA’s compelling need that requires the Agency to eliminate all competition for Syringe Pumps. Can the VA please explain how it is not arbitrary and capricious to permit PCA Pumps to use wired connections but not permit Syringe Pumps to use wired connections? Will the VA permit Syringe Pumps to be able to use both/either wired or wireless connections?

This question was answered in the first amendment. The requirement will not be modified.

Will the VA permit Syringe Pumps to transmit the infusion library/dataset either wirelessly or via a wired connection as it has done for PCA pumps? If not, please identify the VA’s compelling need that requires the Agency to eliminate all competition for Syringe Pumps. VA’s responses to these questions will likely affect a decision to challenge the terms of the RFP.

This question was answered in the first amendment. The requirement will not be modified. Industry day presentations and recent market research resulted in more than one vendor that has the ability to provide a syringe pump that can meet the FIPS 140-2 or FIPS 140-3 certification requirement at the device or wireless card level.

Wireless connectivity in syringe pumps is a clinical need for future interoperability with the Federal EHR. It is also required due to the known use of high alert medications. These are interoperability recommendation by ISMP and The Joint Commission. In addition and as previously mentioned in the first amendment, VA currently experiences limitations in attempts to updating the syringe pump drug libraries timely. Clinicians using PCA pumps for administration of non-PCA medications is not supported by VA and should not be used for consideration.

8 SOW 11 D. Information Security In reference to the government's response to question 27 of Amendment 0001, the VA addresses whether a device must have a supported operating system (“OS”) at the time of IDIQ contract award. The VA responded as follows:

Yes, the discrete device must run on an OS currently supported by the manufacturer at the time of procurement in accordance with the D.3.1 requirement. Unforeseen events that render an OS unusable may require a modification to the IDIQ contract. The details and final decision are made by the Contracting Officer on a case-by-case basis”).

What kind of modification to the IDIQ contract will the VA permit if an OS is rendered unusable? How can the VA permit the offeror whose device or pump OS has been rendered unusable, to modify its device without engaging in improper, prejudicial, unequal treatment of IDIQ contract offerors/awardees?

If the VA permits an IDIQ contract awardee to modify one of its devices, will the VA provide this same opportunity to all other IDIQ contract awardees? How will the VA ensure that allowing one offeror to alter its IDIQ contract offerings does not result in improper, unequal, prejudicial treatment of the other IDIQ contract awardees?

Will the VA insert language requiring IDIQ contract awardees to immediately notify the VA if the OS for a device offered under the IDIQ contract becomes unsupported, discontinued, lacking FDA approval, or otherwise unusable? The VA’s statement that manufacturers must notify the VA of such news could permit items with unusable OSs to be procured since offerors may be resellers, and not OEMs. What kind of modification to the IDIQ contract will the VA permit if an OS is rendered unusable? How can the VA permit the offeror whose device or pump OS has been rendered unusable, to modify its device without engaging in improper, prejudicial, unequal treatment of IDIQ contract offerors/awardees?

Contract administration issues will be addressed as they arise. The Agency will not answer hypothetical questions about whether modifications to the contract will be necessary at this stage of the acquisition.

If the VA permits an IDIQ contract awardee to modify one of its devices, will the VA provide this same opportunity to all other IDIQ contract awardees? How will the VA ensure that allowing one offeror to alter its IDIQ contract offerings does not result in improper, unequal, prejudicial treatment of the other IDIQ contract awardees?

Should any contractor's IDIQ contract require modification throughout the life of the contract, VA will adhere to applicable procurement law and ensure that the modification complies with the requirements of the FAR.

Will the VA insert language requiring IDIQ contract awardees to immediately notify the VA if the OS for a device offered under the IDIQ contract becomes unsupported, discontinued, lacking FDA approval, or otherwise unusable?

VA expects honesty, transparency, and promptness in all communications.

9 SOW 11 D. Information Security In reference to the government's response to question 30 of Amendment 0001, question 30 asked the VA to “identify the authority that permits only an offeror’s wireless card – and not the combination of its wireless card and the device in which the card will be used – to be FIPS certified.” In response, the VA stated that the “NIST Cryptographic Module Validation Program confirms that a cryptographic module that has already been issued a FIPS 140-2 or FIPS 140-3 validation certificate may be incorporated or embedded into another product. A product that uses an embedded validated cryptographic module cannot claim itself to be validated; only that it utilizes an embedded FIPS 140-2 or 140-3 validated module.” The VA’s response does not answer the question but merely underscores the error in the RFP – i.e., that it improperly permits offerors to propose FIPS-certified devices, or devices that use FIPS-certified wireless cards.

The VA correctly states that a “product that uses an embedded validated cryptographic module cannot claim itself to be validated.” Please confirm this interpretation means that a device’s use of a validated wireless card does not make the device itself FIPS-validated. Such a device cannot properly be connected to the VA network and Cerner integration, since that device has no Active Device Certificate.

We cannot locate any information (e.g., authorization, industry input, VA formal or informal explanation or guidance) regarding the VA’s change to VA Directive 6550 Appendix A providing that an embedded wireless card can be the basis for FIPS certification for a device. Further, we cannot locate any other Federal Government agency that has adopted this interpretation. For these reasons, please provide support for the proposition that a device that is not itself FIPS- validated, but which merely uses a FIPS-validated wireless card, can properly be connected to the VA network and Cerner integration, including all communications between the NIST CMVP and the VA on this issue.

Please provide a citation to the specific NIST authority that supports the proposition that a device that uses an embedded, validated cryptographic module cannot claim itself to be validated, but can nevertheless claim itself to be validated when it uses a third-party wireless card’s validated cryptographic modes.

Please provide examples of other medical devices being used in the VA, and connected to the VA network, which are not FIPS-certified but are considered FIPS-validated based on the use of a FIPS-validated wireless card/module.

Question 23(b) asks what authority permits only an offeror’s wireless card – and not the combination of its wireless card and the pump or device in which the card will be used – to be FIPS-certified. In response, the VA conceded that “[a] product that uses an embedded validated cryptographic module cannot claim itself to be validated; only that it utilizes an embedded FIPS 140-2 or 140-3 validated module.” Based on this statement, please explain how a device can be wirelessly connected to the VA network, and Cerner integration, when that device has no Active Device Certificate?

Please provide the VA’s interpretation of the term “embedded,” the VA’s authority for its interpretation, and examples of an “embedded” validated cryptographic module as opposed to the mere “use” of a wireless card that is added to or accompanies a device but is not “embedded”? Please confirm this interpretation means that a device’s use of a validated wireless card does not make the device itself FIPS-validated. Such a device cannot properly be connected to the VA network and Cerner integration, since that device has no Active Device Certificate.

The stated interpretation is incorrect. The wireless card (with an embedded validated cryptographic module) manages the security aspects (encryption, decryption, and other cryptographic processes) required for compliance and secure communication. All other VA security controls must be met.

For these reasons, please provide support for the proposition that a device that is not itself FIPS- validated, but which merely uses a FIPS-validated wireless card, can properly be connected to the VA network and Cerner integration, including all communications between the NIST CMVP and the VA on this issue.

VA does not believe the requested information is required in the offeror’s proposal submission.

Please provide a citation to the specific NIST authority that supports the proposition that a device that uses an embedded, validated cryptographic module cannot claim itself to be validated, but can nevertheless claim itself to be validated when it uses a third-party wireless card’s validated cryptographic modes.

VA does not believe the requested information is required in the offeror’s proposal submission.

Please provide examples of other medical devices being used in the VA, and connected to the VA network, which are not FIPS-certified but are considered FIPS-validated based on the use of a FIPS-validated wireless card/module.

VA does not believe the requested information is needed for an offeror to develop its proposal submission.

Question 23(b) asks what authority permits only an offeror’s wireless card – and not the combination of its wireless card and the pump or device in which the card will be used – to be FIPS-certified. In response, the VA conceded that “[a] product that uses an embedded validated cryptographic module cannot claim itself to be validated; only that it utilizes an embedded FIPS 140-2 or 140-3 validated module.” Based on this statement, please explain how a device can be wirelessly connected to the VA network, and Cerner integration, when that device has no Active Device Certificate?

VA does not believe the requested information is required in the offeror’s proposal submission. Offerors should only be concerned with providing accurate documentation for VA to evaluate whether the requirements in the Statement of Work can be met.

Please provide the VA’s interpretation of the term “embedded,” the VA’s authority for its interpretation, and examples of an “embedded” validated cryptographic module as opposed to the mere “use” of a wireless card that is added to or accompanies a device but is not “embedded”?

“Embedded” refers to the integration of a validated cryptographic module within the core functioning of the wireless card that is part of the overall device. This means the cryptographic functionalities are native to the module and are not a supplementary or external addition.

10 SOW 14 J. References In reference to the government's response to question 37 of Amendment 0001, which asks the VA to define the minimum requirement for infusion pump flow rate accuracy - the VA states “[t]here is not a specified minimum requirement for accuracy. For large volume and syringe pumps respectively, please see requirements B.2.3 and B.3.2 for flow rate precision specifications.” Based on the VA’s answer, a device with a flow accuracy that is +/- 20% inaccurate is acceptable. Please confirm this interpretation is correct. Alternatively, we request the VA amend the RFP to require a minimum accuracy requirement that is consistent with patient safety.

If the Contracting Officer decides whether a new product release can be added to an awardee’s IDIQ contract on a case-by-case basis, and no standards are published that govern this decision, the VA exposes itself to charges that the Contracting Officer engaged in arbitrary, capricious or improper disparate treatment. To avoid such allegations, will the VA add to the RFP the factors that the VA will consider when making this decision, and the relative weights of the factors? Please explain under what circumstance a new product release would not be added.

Contract administration issues will be addressed as they arise. The Agency will not answer hypothetical questions about whether modifications to the contract will be necessary at this stage of the acquisition.

Will the VA add to the RFP the factors that the VA will consider when making this decision, and the relative weights of the factors?

The RFP will not be amended.

12 SOW The revised, May 29, 2025, RFP Statement of Work sets forth Ordering Procedures at section B.12.I. This section states that when conducting delivery order procurements, the VA – under the “Specifications” subfactor of the Factor 1 Capability – will “assess the offeror’s product brochures, technical specification sheets, and other information presented for each proposed product solution . . . against the technical requirements listed in the Statement of Work to determine whether the offer provides any advantages to the Government by exceeding the minimum requirements.”

Is the “Statement of Work” the VA refers to in this quoted language, the Statement of Work for the IDIQ contract (i.e., the revised, May 29, 2025 RFP §§ B.12.A-B.12.H), or will each delivery order procurement contain its own Statement of Work? If each delivery order has its own Statement of Work, what happens if the delivery order Statement of Work conflicts with the IDIQ contract Statement of Work? In the event of a conflict, will the IDIQ contract Statement of Work trump the delivery order Statement of Work? The Statement of Work referenced is for both the IDIQ and fair opportunity solicitations. Delivery orders will not have their own Statement of Works. Additional information specific to each VA medical center, such as the required go-live date, device quantities, and training needs will be provided in each fair opportunity solicitation.