S06 - 36C24826Q1057 0003_Answer Vendor Questions_Update PWS_Extend Close Date.pdf

5. PROJECT NUMBER (if applicable)

CODE 7. ADMINISTERED BY

2. AMENDMENT/MODIFICATION NUMBER

CODE

6. ISSUED BY

8. NAME AND ADDRESS OF CONTRACTOR

4. REQUISITION/PURCHASE REQ. NUMBER 3. EFFECTIVE DATE

9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED

PAGE OF PAGES

10A. MODIFICATION OF CONTRACT/ORDER NUMBER

10B. DATED

BPA NO. 1. CONTRACT ID CODE

FACILITY CODE CODE

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

E. IMPORTANT:

is extended,

(a) By completing Items 8 and 15, and returning __________ copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY is not extended.

12. ACCOUNTING AND APPROPRIATION DATA

(REV. 11/2016)

is required to sign this document and return ___________ copies to the issuing office. is not, A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.

15C. DATE SIGNED

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER

Contractor

16C. DATE SIGNED

14. DESCRIPTION OF AMENDMENT/MODIFICATION

16B. UNITED STATES OF AMERICA

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER 16A. NAME AND TITLE OF CONTRACTING OFFICER

15B. CONTRACTOR/OFFEROR

STANDARD FORM 30 PREVIOUS EDITION NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.243

(Type or print) (Type or print)

(Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

(Number, street, county, State and ZIP Code)

(If other than Item 6)

(Specify type of modification and authority)

(such as changes in paying office, appropriation date, etc.)

(If required)

(SEE ITEM 11)

(SEE ITEM 13)

(X)

CHECK

ONE

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS,

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

(Signature of person authorized to sign) (Signature of Contracting Officer)

1 14

0003 11-09-2026

None

36C248

Department of Veterans Affairs Network Contracting Office 8 (NCO 8)

8875 Hidden River Pkwy Suite 525 Tampa FL 33637

36C248

Department of Veterans Affairs Network Contracting Office 8 (NCO 8)

8875 Hidden River Pkwy Tampa FL 33637

To all Offerors/Bidders

36C24826Q1057

09-15-2026

X

X X

** HOUR & DATE for Receipt of Offers is EXTENDED to: 11-23-2026 4:30pm EST

X one (1)

The purpose of this amendment is to:

1. Extend the due date and time for the receipt of quotations for the above referenced Request for Quotations (RFQ), block 9a, from Monday, November 9, 2026, at 4:30pm to Monday, November 23, 2026, at 4:30pm.

2. Provide responses to vendor questions.

3. Update sections 2.1.1 and 4.3 of the Performance Work Statement (PWS).

See continuation sheet.

Jayne Messer Contracting Officer

VA-VHARPOE-2023-0120

CONTINUATION SHEET

Performance Work Statement (PWS) Updates

PWS section 2.1.1, License, page 12 of the Request for Quotations (RFQ), is hereby revised to read as follows:

2.1.1 License: Contractor personnel assigned to perform services under this contract shall possess a current, full, and unrestricted license in any State, Territory, Commonwealth of the United States, or the District of Columbia, when licensure is applicable to the services performed.

PWS section 4.3, page 16 of the Request for Quotations (RFQ), is hereby revised to read as follows:

4.3 In addition to the multiplanar reformatting, contractor shall provide an interactive 3D reconstructed model of the patient's aneurysm. Thus, allows for complete 360-degree manipulation of the model for exact analysis of the morphology of the aneurysm, its relation to adjacent arteries, and vessel angle or tortuosity, all of which critically impact the technical aspect of Endovascular Aneurysm Repair (EVAR) procedure.

3D Image Reconstruction and Case Planning Services Vendor Questions and Answers

Q.1 Can the Small Business Set Aside requirement be removed for this solicitation?

No.1 No. The solicitation will remain a total Small Business Set-Aside.

Q.2 Is this service intended for the Malcolm Randall VA facility only or additional facilities within

VISN 8?

A.2 The service is required for the Malcolm Randall VA facility only. See Performance Work Statement (PWS) section 1.1.

Q.3 Services Provided: Please clarify the use of the term “acquisition.” When the RFP states “acquisition, upload, and assessment of quality of digital CT Scan images,” does “acquisition” refer to the performance of the CT examination/scanning itself, or to the receipt/acquisition of digital CT images that have already been obtained by the facility?

A.3 All CT scans are performed by the VA. Acquisition in this context is used to convey the vendors receipt of the images.

Q.4 Would patient interaction be managed by a VA employee?

A.4 Yes. All patient interaction will be conducted by VA personnel. The contractor will not have direct contact with patients. See PWS sections 1.1 and 1.2.

Q.5 Software Updates and technical support: Please clarify the Government’s expectations regarding the software environment? Specifically, is the Contractor required to provide, host, maintain, and license the proprietary software used to transform routine CT data for interactive measurements and treatment device planning, or will the Government provide the required software, infrastructure, or hosting environment?

A.5 The contractor is required to provide, host, maintain and license the proprietary software.

See PWS sections 1.1.3 and 1.2.

Q.6 Does VISN 8 have the proprietary software required to perform the remote post-processing services?

A.6 No. The North Florida/South Georgia VA Healthcare System, Malcolm Randall VAMC does not possess the proprietary software platform required to perform the requested services. The contractor is responsible for providing the software necessary to perform the reconstruction and case-planning services required by the PWS. See PWS sections 1.1.3 and 1.2.

Q.7 If a proprietary software platform is already in place, would multiple or all VAMCs within VISN 8 be able to send images to that centralized software platform for the contractor to perform the required reconstructions and case planning?

A.7 The VAMC does not have the proprietary software platform. See response to question six (6).

Q.8 Place of Performance: The RFP states that “all services shall be performed off-site at the contractor’s facility.” Does this requirement permit the Contractor’s qualified technologists to perform the services remotely from secure, approved home-based work locations, or is a centralized physical contractor facility required?

A.8 The solicitation requires all services to be performed off-site at the contractor's facility. Any contractor location used to perform contract requirements involving VA information must comply with all applicable cybersecurity, privacy, access-control, personnel-vetting, and information-protection requirements contained in the solicitation and the updated PWS section 6.8, Contractor Security Requirements (VA Handbook 6500.6): VA CYBERSECURITY AND PRIVACY per Amendment 0002.

Q.9 QUALIFICATIONS: License: Please clarify the reference to the “State of Licensure.” For Contractor personnel providing remote 3D post-processing services, is licensure/registration required in the state where the technologist is physically located, the state where the facility/patient is located, or both, if applicable?

A.9 See update to PWS section 2.1.1 on page two (2) of this amendment.

Q.10 Clinical/Professional Performance and 2.7. Indemnification: Please confirm that a radiologist or physician retains responsibility for the clinical interpretation, diagnosis, and final report, while the contractor is responsible only for the technical preparation of the requested 3D renderings and post-processing?

A.10 The contractor only prepares the 3D models. They provide no interpretation or report of the images.

Q.11 VA RESPONSIBILITIES: 5.1. VA Support Personnel, Servies, or Equipment: 5.1.2 Please clarify what is meant by “peer review results” and the specific peer review requirements applicable to the contractor. Specifically, does this require the contractor to provide documentation of an internal quality assurance/peer review process for 3D post-processing, and if so, what frequency, methodology, and reporting format are required? (Table under 6.2)

A.11 The peer review results referenced in PWS section 5.1.2 relate to information that may be used by the Government in evaluating contractor performance. The solicitation does not prescribe a specific internal peer-review process, methodology, frequency, documentation format, or reporting requirement for the contractor. The contractor shall meet the performance standards and acceptable quality levels identified in the Performance Requirements Summary.

Q.12 Reduction in Services: If utilization or the Government’s requirements change and result in a reduced need for contracted hours, would the contractor receive at least 30 days’ notice prior to an attempt to negotiate a contract modification reducing the scope of services and corresponding contract price? For clarity, we are seeking to understand the process and notice period that would apply if the Government determines that the contracted hours are no longer required due to a change in requirements.

A.12 The Government will administer any reduction in services in accordance with PWS section 6.5, Reduction in Services. PWS section 6.5 provides that any reduction associated with unutilized quantities will be addressed at the end of the applicable period of performance.

Q.13 Can the VA provide historical utilization data for the services included in this contract, including an estimated number of studies, and study type to be processed per month and annually?

A.13 Base Year: 21 cases; Option Year 1: 67 cases; Option Year 2: 48 cases; Option Year 3: 53 cases.

Q.14 VA INFORMATION CUSTODIAL LANGUAGE. h. Please clarify whether encryption is required for data that is stored or transferred solely within VA facility network, or if the encryption requirement applies only to data transmitted outside of the customer’s network?

A.14 The contractor shall protect VA information in accordance with the cybersecurity and privacy requirements of the solicitation. Updated PWS section 6.8 requires VA sensitive information to be stored using VA-approved encryption methods and transmitted using VA-approved TLS and FIPS-validated cryptographic mechanisms.

Q.15 ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS d. Please clarify the expected level of detail and required format for the contractor’s plan addressing communications, personnel control, data protection, and potential legal issues?

Additionally, please confirm when this plan is required to be submitted and whether the VA will provide any specific templates, standards, or requirements that contractors should follow.

A.15 All contractors and subcontractors shall comply with conditions specified in VAAR 852.204-71(d); Contractor operations required to be in United States. All contractors and subcontractors working with VA information must be permanently located within a jurisdiction subject to the law of the United States or its Territories to the maximum extent feasible. If services are proposed to be performed abroad the contractor must state where all non-U.S.

services are provided. The contractor shall deliver to VA a detailed plan specifically addressing communications, personnel control, data protection and potential legal issues. The plan shall be approved by the COR/CO in writing prior to access being granted. Please also see the updated PWS section 6.8 per amendment 0002.

Q.16 INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE OR USE

d. All external internet connections to VA network involving VA information must be in accordance with VA Trusted InternetConnection (TIC) Reference Architecture and VA Directive and Handbook 6513, Secure External Connections and reviewed and 36C24826Q1057 Page 40 of 89 approved by VA prior to implementation. Government-owned contractor-operated systems, third party or business partner networks require a Memorandum of Understanding (MOU) and Interconnection Security Agreements (ISA).

A.16 All external internet connections used to transmit or receive VA information must comply with VA Trusted Internet Connection architecture, VA Directive 6513, VA Handbook 6513, and applicable MOU/ISA requirements. Such connections must be reviewed and approved by VA prior to implementation. See updated PWS section 6.8(f).

Q.17 PRODUCT INTEGRITY, AUTHENTICITY, PROVENANCE, ANTICOUNTERFEIT AND

ANTI-TAMPERING If the software is hosted within the VA environment, please confirm whether this section’s requirements and associated regulations apply.

A.17 Applicable cybersecurity requirements contained in updated PWS section 6.8 apply regardless of whether software is contractor-hosted or VA-hosted when provided under this contract. Applicability of specific controls depends on the proposed solution and service architecture. See updated PWS section 6.8(i).

Q.18 DATA CENTER PROVISIONS. d. Please clarify whether this requirement applies when the contractor is accessing VA-hosted proprietary software through the VA’s existing network infrastructure, but the contractor does not manage or operate any portion of the VA’s WAN. If the VA hosts the software and provides the network connection, please confirm which party is responsible for meeting the encryption requirements described in this section.

A.18 The applicability of the Data Center Provisions depends on the proposed technical architecture. Regardless of the hosting model, contractors shall comply with all applicable cybersecurity, encryption, connectivity, and information-protection requirements in updated PWS section 6.8.

Q.19 Who performs the measurements. PWS 1.1 refers to software that "allows interactive measurements." PWS 4.2 requires datasets that allow "detailed precise measurement of vessel diameter, length, angle and aneurysm volume." Should the contractor deliver a completed EVAR measurement report with each case? Or should the contractor provide the datasets and software so VA surgeons take the measurements themselves?

A.19 The solicitation requires delivery of the datasets, reconstructions, 3D models, and software functionality described in the PWS. The solicitation does not require the contractor to provide a clinical interpretation, diagnostic report, physician-level measurement report, or completed EVAR measurement report. The contractor is required to provide the original image data, reformatted datasets, reconstructed images, patient-specific 3D models, and associated software capabilities that allow interactive review and measurements by authorized VA clinicians. VA clinicians will perform their own measurements and clinical planning activities using the delivered datasets and models. Accordingly, the Government is not requesting a specific measurement report, reporting template, or reporting protocol under this solicitation.

See PWS sections 1.1.2, 4.2, and 4.3.

Q.20 Measurement protocol. If a measurement report is expected, does the Vascular Service have a preferred protocol or template? For example, should it include proximal neck, iliac and access-vessel measurements, or measurements tied to a specific endograft manufacturer's instructions for use?

A.20 A measurement report is not required. The contractor shall provide the datasets, reconstructions, 3D models, and software functionality required by the PWS to support VA clinician measurement and case-planning activities.

Q.21 Accuracy standard. Is there a required measurement accuracy or tolerance beyond the 99% AQL in PWS 4.7?

A.21 A measurement report is not required under this contract. Accordingly, no separate measurement accuracy or tolerance requirement has been established beyond the performance standards identified in the PWS.

Q.22 3D model rotation. PWS 4.3 calls for "complete 60-degree manipulation" of the 3D model.

Please confirm whether this should read 360 degrees.

A.22 See update to PWS section 4.3 on page two (2) of this amendment.

Q.23 Number of users. About how many VA providers will need portal access to view and measure cases?

A.23 The number of users will be < five (5) (primarily it is two (2) – three (3) faculty members;

with the potential of two (2) APP providers).

Q.24 Block 10 of the SF 1449 identifies this requirement as a total small business set-aside under NAICS 621512. The RFQ also includes VAAR 852.219-75, and Volume 4 asks SDVOSB/VOSB offerors to complete its certification. When an SDVOSB quotes on this small business set-aside, should the limitations on subcontracting be applied under the small business rules (13 CFR 125.6), where similarly situated small businesses under NAICS 621512 qualify? Or does VAAR 852.219-75 apply, where only certified SDVOSBs/VOSBs qualify?

A.24 The solicitation is a total small business set-aside under NAICS 621512. Limitations on subcontracting shall be applied in accordance with SBA regulations, the solicitation, and all incorporated FAR and VAAR clauses. Contractors are responsible for ensuring compliance with applicable subcontracting requirements.

Q.25 Annual software licensing and setup costs: May the quoted price include annual software licensing, maintenance, and support required to perform reconstruction and case-planning services? Should these costs be incorporated into the specified per-case pricing units, or may they be identified as separate line items? Please clarify the treatment of initial setup costs and the applicable billing structure.

A.25 Contractors shall submit pricing in accordance with the Schedule of Services and pricing instructions contained in the solicitation. The Government has not established separate contract line items for software licensing, software maintenance, software support, hosting, implementation, or setup costs. Contractors are responsible for determining how costs are reflected in their quotations and for ensuring their pricing is consistent with the solicitation’s line-item structure and contract requirements. See section B.2, Schedule of Services, and PWS sections 1.1.2 and 1.1.3.

Q.26 Case complexity and additional processing costs: Does the solicitation permit separate pricing for routine and complex reconstruction cases? Cases involving existing stents or stent grafts, substantial calcification, metal or motion artifacts, or poorly defined anatomical boundaries may require considerably more manual segmentation, correction, and quality review than comparable studies with clearly visualized anatomy.

A.26 The solicitation does not provide separate line items for routine and complex cases.

Q.27 If complexity-based pricing is permitted, what classification criteria and authorization process should apply? May offerors propose a routine per-case rate and a complex-case rate or an approved additional-processing charge? If fixed unit prices must apply regardless of complexity within each specified service category, please provide the anticipated proportion of complex cases. May additional processing time be authorized, and how would this affect routine and urgent turnaround requirements?

A.27 See response to question 26.

Q.28 Existing VA workstations: What workstations will clinicians use at the participating VA sites to open, review, and manipulate reconstructed models? Please provide available specifications, including operating system, processor, RAM, graphics card/GPU memory, and restrictions on software installation.

A.28 VA clinicians will access and review the contractor-provided online service using VA-authorized workstations. The Government does not guarantee specific workstation specifications, hardware configurations, operating systems, or software installation permissions.

Contractors shall submit a solution capable of supporting the requirements of the PWS within the VA computing environment and applicable cybersecurity requirements. See PWS sections 1.1.2, 4.2, and 4.3.

Q.29 Software for viewing and manipulating models: What viewing or surgical-planning software does the VA currently have available? Must delivered models be compatible with a particular application or platform? Please clarify the contractor's responsibilities for viewer licenses, software installation, user training, updates, and technical support, including the number of sites and users to be supported.

A.29 The Government does not currently possess the proprietary software platform required to perform the requested services. The contractor is responsible for providing, hosting, maintaining, licensing, updating, and supporting the software required to perform the contract requirements. See responses to Questions five (5) and six (6).

Q.30 Responsibility for additional equipment: If existing VA equipment cannot adequately support viewing and manipulating the required models, would the VA provide workstation upgrades, or should the contractor include that equipment in the quotation? If contractor-supplied equipment is contemplated, how should it be priced?

A.30 The Government does not contemplate contractor-provided equipment or workstation upgrades at VA facilities under this solicitation.

Q.31 Typical and maximum CT dataset specifications: Please provide representative ranges and maximum anticipated values for:

• Image matrix dimensions, such as 512 × 512 pixels, and pixel bit depth.

• In-plane pixel spacing, slice thickness, and spacing between reconstructed slices.

• Number of images per series and number of series or contrast phases per case.

• Total DICOM data size per case, as transferred and uncompressed where available.

• Anatomical coverage and whether multiple studies must be combined for one case.

A.31 The Government does not maintain representative statistics for the requested parameters.

Contractors should base their quotations on the requirements identified in the solicitation.

Q.32 Would a de-identified representative dataset be available to prospective offerors for evaluating processing requirements?

A.32 No. A representative dataset will not be provided.

Q.33 Source image quality, artifacts, and uncertain anatomy: Are there standardized CT angiography acquisition protocols or minimum image-quality requirements for the intended reconstruction and planning tasks?

A.33 The requirement does not establish a specific CT acquisition protocol or minimum image-quality standard beyond the requirements necessary to perform the requested reconstruction and planning services.

Q.34 How should the contractor handle incomplete anatomical coverage, inadequate contrast enhancement, motion artifacts, or obscured boundaries associated with calcification, existing stents, or other metallic implants? These limitations may prevent reliable identification of the vessel lumen or surrounding anatomy and may require interpolation or estimation.

A.34 The solicitation is performance-based and does not prescribe a specific methodology for addressing incomplete anatomical coverage, inadequate contrast enhancement, motion artifacts, calcification, stents, metallic implants, or other imaging limitations. Contractors shall utilize their professional expertise and technical approach to provide the reconstruction and case-planning services required by the PWS and meet the applicable performance standards.

See PWS sections 4.2, 4.3, and 5.1.

Q.35 Should the contractor flag uncertain regions, request additional imaging, or provide a model with documented limitations? If interpolation, smoothing, or other adjustments affecting anatomical geometry are permitted, what documentation and VA clinical review or approval are required? Would processing a replacement scan or substantially revised dataset count as a new case or as part of the original service?

A.35 The solicitation is performance-based and does not prescribe a specific methodology for addressing uncertain regions, interpolation, smoothing, anatomical estimation, or other image-processing techniques. Contractors shall utilize their professional expertise and technical approach to provide the reconstruction and case-planning services required by the PWS and meet the applicable performance standards. The solicitation does not establish specific documentation, clinical-review, or approval requirements for such processing methods beyond the contract requirements. A replacement scan or revised dataset associated with the same patient case shall be considered part of the original case and not a separate case for pricing purposes. See PWS sections 4.2, updated section 4.3, and 5.1.

Q.36 Model accuracy, intended use, and acceptance criteria: What quantitative accuracy requirements and validation methods apply to reconstructed models and associated measurements—for example, vessel diameter, centerline length, branch location, and other dimensions used in procedural planning?

A.36 Contractors shall meet the contract requirements, performance standards, and acceptable quality levels identified in the PWS.

Q.37 Will models be used for visualization and case planning, selection and sizing of commercially available devices such as stent grafts, or patient-specific device design or fabrication? Are different accuracy and validation requirements applicable to these uses?

A.37 The reconstructed models may be used for visualization, case planning, and selection and sizing of commercially available devices. See PWS sections 1.1, 4.2, updated 4.3, and 4.7.

Q.38 How will model acceptance be evaluated when the resolution, completeness, or quality of source CT images does not support the requested precision? How should uncertainty be reported, and how should regions reconstructed directly from visible anatomy be distinguished from regions requiring estimation?

A.38 This is a performance-based service. Contractors are responsible for implementing processes necessary to meet contract requirements and performance standards using the source data provided.

Q.39 Which deliverables and file formats are required—for example, interactive 3D models, STL files, measurements, annotated images, or planning reports—and what extent of clinician-requested revision is included in each case?

A.39 The required deliverables are identified in PWS Sections 4.2 and updated section 4.3.

Measurement reports, planning reports, and other clinician-generated analyses are not required.

The delivered model must support clinician review, manipulation, and measurement for case-planning purposes.

Q.40 Data transfer and storage: Please clarify the approved workflow for transferring source DICOM studies and returning completed models, including the contractor's responsibilities and costs for the required exchange platform. Are there additional integration, remote-access, storage, retention, or hosting requirements that should be accounted for in the technical approach and pricing?

A.40 Source CT datasets will be transmitted using the Medicom Imagex exchange service identified in the PWS. Contractors are responsible for complying with all applicable privacy, records-management, cybersecurity, storage, hosting, access-control, retention, and information-protection requirements contained in the solicitation and updated PWS 6.8. See PWS 1.1.2 and updated PWS 6.8.

Q.41 Workload and turnaround expectations: Please confirm anticipated routine and urgent case volumes, likely peak workload, and applicable turnaround times. Are the stated quantities estimates or guaranteed minimums? What after-hours or weekend availability is required, and when does the turnaround clock begin if the initial dataset is incomplete or requires clarification?

A.41 The quantities are identified in the Schedule of Services. Historical workload has averaged approximately 40 to 50 cases annually. Urgent cases require a turnaround time of 24 hours.

Q.42 Potential future scope: Is the anticipated scope limited to the endovascular applications described in this solicitation, or does the VA foresee future requirements for other anatomical reconstruction and planning services, such as intracranial aneurysm models, tumor or resection-defect models, or implant planning?

A.42 Contractors shall submit quotations based on the requirements contained in the current solicitation and amendments.

Q.43 We would also be interested in whether patient-specific tissue scaffold modeling is a separate future research interest. Should the present quotation address only the stated services, with any broader capabilities described separately?

A.43 Contractors shall submit quotations based on the requirements identified in the current solicitation and amendments. Additional capabilities beyond the stated requirements will be evaluated in accordance with FAR 52.212-2 and the evaluation criteria contained in the solicitation.

Q.44 Would the VA accept a professionally managed, U.S.-resident cloud environment for storage and processing of contract CTA/DICOM images, with Adiana-authorized personnel working through protected, GPU-enabled virtual graphics workstations at approved U.S.

locations? Or must the production servers and workstations be physically located at Adiana’s Tampa headquarters?

A.44 The solicitation does not require production servers or workstations to be physically located at the contractor’s headquarters. All services shall be performed off-site at the contractor’s facility. Any contractor-hosted cloud or non-cloud environment used to create, collect, process, store, transmit, or disseminate VA information must comply with the cybersecurity, privacy, Assessment and Authorization (A&A), FedRAMP, and information-hosting requirements identified in the solicitation. Contractor operations are required to be in the United States, and information processing and data storage must be restricted to facilities located within the legal jurisdictional boundary of the United States. See PWS 1.2; PWS 6.8(c)(1); PWS 6.8(e)(3); and updated PWS 6.8(f)(1)-(2).

Q.45 What specific security documentation, reviews, and authorizations must be in place before patient CTA datasets are sent to such a contractor-operated environment? In particular, please clarify the applicability of any System Security Plan, security assessment/authorization, Privacy Impact Assessment, Business Associate Agreement, VA cyber/privacy controls, and requirements applicable to the cloud provider and supporting subcontractors. Does a FedRAMP-authorized cloud foundation change any of those VA-specific obligations? Who would be the appropriate VA information-security and privacy contacts?

A.45 Prior to hosting, operation, maintenance, or use of a contractor-hosted environment on behalf of VA, applicable cybersecurity and privacy controls must be implemented, assessed, and approved in accordance with the solicitation. Contractor-hosted systems are subject to security-control testing, compliance risk assessments, security architecture analysis, vulnerability scanning, change management, contingency planning, incident-response planning, and applicable A&A requirements. Cloud-computing solutions must comply with FedRAMP requirements and applicable VA authorization requirements. The solicitation includes a Business Associate Agreement as an attachment. The solicitation does not specifically identify a System Security Plan or Privacy Impact Assessment by name. Information-security and privacy matters shall be coordinated through the Contracting Officer and Contracting Officer’s Representative. See Section D.5; PWS 5.2; PWS 6.8(f)(1)-(2); and updated PWS 6.8(e)(2)-(4).

Q.46 For a contractor-owned U.S.-hosted interactive 3D viewing and measurement service, would approved VA clinicians be permitted to access it remotely through agency-authorized authentication and networking? Must the viewer be installed within VA systems, integrate with existing clinical systems, or meet a particular validation and security requirement?

A.46 The contractor shall provide secure, password-protected electronic access to original image data, reformatted datasets, 3D reconstructed images, and associated software to support remote viewing, analysis, and case planning. The solicitation does not expressly require installation within VA systems or integration with a specific VA clinical system. Any proposed solution must comply with applicable VA cybersecurity, authentication, identity-management, connectivity, and authorization requirements. See PWS section 1.1.2; and updated PWS sections 6.8(c)(4)-(5); PWS 6.8(e)(5), (9); and PWS 6.8(f)(6).

Q.47 Medicom Imagex and DICOM case handling: For the contemplated off-site services, will the VA provide CTA DICOM studies through Medicom Imagex with patient identifiers already removed or replaced by VA-generated case codes, or must the contractor perform this process within an authorized environment? Is Medicom Imagex expected only to exchange encrypted clinical files, or also to provide de-identification/pseudonymization?

A.47 See PWS section 1.1.2 regarding transmission of CT datasets through Medicom Imagex.

All transmitted information shall be handled in accordance with the privacy, encryption, cybersecurity, and information-protection requirements of the solicitation. See PWS 1.1.2, PWS 4.6.1, and updated PWS 6.8(b) and (c).

Q.48 If coded datasets may be used for clinical planning, what standard or approved de-identification process should be applied (including DICOM PS3.15 confidentiality profiles, where applicable)? How should burned-in image identifiers, private DICOM tags, structured reports, overlays, derived objects, and other potential identifying information be handled? Please confirm what original spatial/acquisition metadata and study-series-image relationships must be preserved for accurate measurements, and which entity is responsible for validating that protection.

A.48 Contractors shall comply with all applicable privacy, confidentiality, records-management, cybersecurity, and information-protection requirements. The solicitation does not establish a specific de-identification methodology for this procurement. See PWS section 4.6.1 and updated PWS section 6.8(b) and (c).

Q.49 What approved case-identification and clinical traceability mechanism should connect the contractor’s reconstructed models and measurement reports to the original patient record? May the VA retain the patient-to-case-code linkage, with Adiana using only a unique case identifier, and how should the returned deliverables be re-associated with the correct patient by authorized VA personnel?

A.49 Contractors shall comply with applicable privacy, cybersecurity, records-management, and access-control requirements when handling patient-specific data and deliverables. Any quoted approach must support performance of the contract requirements.

Q.50 Please identify the appropriate VA technical or imaging contact for determining Imagex contractor-endpoint connectivity, transfer-test procedures, approved exchange of derived series/models/reports, and any requirements concerning audit logs, data retention, or return of completed records.

A.50 Contract administration and technical coordination shall be conducted through the Contracting Officer and Contracting Officer’s Representative identified in the solicitation. See PWS sections 5.2 and 5.4.1.

Q.51 Scientific subcontractors and access from Belgium: Adiana is exploring collaboration with the University of Antwerp’s Antwerp Centre for Advanced Microscopy (ACAM) for segmentation-method development, quantitative imaging, and technical validation. Would an overseas scientific subcontractor be permitted to develop algorithms and conduct tests solely on synthetic, nonpatient data without receiving or accessing VA clinical information? How should that limited scope be described under the applicable subcontracting provisions?

A.51 Any access to VA information, VA records, or VA information systems must comply with the solicitation and updated PWS section 6.8 requirements.

Q.52 Is any remote access by personnel physically located in Belgium to actual VA clinical DICOM studies, case-coded or derived patient-specific images/models, or contractor-hosted processing desktops permissible under this solicitation? If so, what specific prior written VA permissions, contractual provisions, personnel authorizations, and access controls would be required? We recognize that pseudonymizing metadata or retaining files in U.S. cloud infrastructure does not itself establish permission for international access. No such access would be permitted unless expressly authorized.

A.52 Any contractor or subcontractor creating, collecting, processing, storing, transmitting, disseminating, or accessing VA information must comply with the cybersecurity, privacy, personnel-vetting, and access-control requirements identified in the solicitation. Contractor operations are required to be in the United States, and information processing and data storage must be restricted to facilities located within the legal jurisdictional boundary of the United States. If services are proposed to be performed abroad, the contractor must identify the foreign location, submit a detailed risk-mitigation plan addressing communications, personnel control, data protection, and legal issues, and obtain written Contracting Officer approval before access is granted. The contractor is not permitted to access VA networks or internal resources from a foreign country except as specifically authorized in accordance with the solicitation requirements. See updated PWS sections 6.8(c)(1)-(2) and 6.8(c)(7).

Q.53 Implementation and schedule: May an offeror describe a post-award implementation, vendor integration, testing, and VA security-authorization period before accepting the first clinical case? If so, what operational readiness or go-live date and approval milestones should the quotation commit to, and does the VA provide a test dataset or validation mechanism?

A.53 Contractors may describe their implementation approach in their quotation. However, contractors remain responsible for meeting all contract requirements and performance timelines.

Q.54 May a qualified small-business prime contractor subcontract the specialized 3D medical image reconstruction and case-planning services to an experienced medical imaging company, provided the arrangement complies with applicable limitations on subcontracting?

A.54 The solicitation contemplates the use of subcontractors. The prime contractor remains responsible for compliance with all contract requirements and for the quality and timeliness of services provided under the contract. Any subcontracting arrangement must comply with the applicable limitations on subcontracting, SBA regulations, and all solicitation provisions and clauses governing subcontractors.

Q.55 Will the Government consider the technical qualifications, professional credentials, and relevant past performance of a proposed subcontractor when evaluating the prime contractor’s technical capability?

A.55 The Government will evaluate quotations in accordance with the evaluation criteria set forth in the solicitation. Relevant experience, qualifications, and past performance information submitted in support of the quotation, including information pertaining to subcontractors performing contract requirements, may be considered to the extent permitted by the solicitation's evaluation criteria.

Q.56 Are there specific required licenses, professional certifications, or software certifications that must be held by the prime contractor, or may those qualifications be satisfied by the proposed subcontractor performing the technical services?

A.56 Contractors shall provide the qualifications, certifications, competencies, and licensure information required by the solicitation. The prime contractor remains responsible for ensuring that all personnel and subcontractors performing under the contract satisfy applicable contract requirements. Also see response to question 22.

Q.57 Must all VA cybersecurity approvals, access authorizations, and related security requirements be completed before award, or may certain onboarding requirements be completed following award and before performance begins?

A.57 Certain onboarding requirements may be completed following contract award and prior to access being granted or applicable performance beginning. Personnel requiring access to VA information or VA information systems must satisfy applicable personnel-vetting, training, Rules of Behavior, credentialing, authorization, and cybersecurity requirements before access is granted. Contractor-hosted systems may also be subject to applicable cybersecurity review, Assessment and Authorization (A&A), and approval requirements.

Q.58 Are the estimated quantities of standard and rush cases used solely for pricing and evaluation, or does the contract include a guaranteed minimum quantity?

A.58 The solicitation contemplates award of a Firm-Fixed-Price contract and identifies quantities for standard and rush cases in the Schedule of Services.

Q.59 Amendment 0001 indicates that an additional amendment addressing vendor questions will be forthcoming. Can the Government advise whether that amendment will be issued before the October 28, 2026 quotation deadline?

A.59 Yes, this amendment provides responses to vendor questions.

Note:

Responses addressing cybersecurity, cloud hosting, remote access, system security, data storage, privacy, subcontracting involving VA information, external network connectivity, and related subjects shall be interpreted in conjunction with Amendment 0002 replacing PWS Section 6.8, Contractor Security Requirements (VA Handbook 6500.6). In the event of a conflict between a question-and-answer response and the amended PWS language, the amended PWS language controls.