7571TE-26CSS-1527532-PWS.pdf

PERFORMANCE WORK STATEMENT (PWS) - FedRAMP-Compliant Cloud Electronic Fax Solution Integrated with Microsoft Teams

1.0 INTRODUCTION

The mission of the Indian Health Service (IHS) is to raise the physical, mental, social, and spiritual health of American Indians and Alaska Natives to the highest level.

To support this mission, IHS requires a secure, cloud-based electronic fax solution that ensures the protection of Protected Health Information (PHI), enhances clinical and administrative workflows, and integrates seamlessly with enterprise collaboration platforms.

This PWS establishes requirements for a FedRAMP-authorized electronic faxing solution (Moderate or higher) that is fully integrated with Microsoft Teams, supports HIPAA compliance, and ensures Government ownership and portability of Direct Inward Dial (DID) numbers.

2.0 OBJECTIVES

• Provide a FedRAMP Moderate or High authorized cloud electronic fax solution

• Ensure full integration with Microsoft Teams (native or API-based)

• Maintain HIPAA-compliant transmission and storage of PHI

• Ensure Government ownership and portability of all fax DIDs

• Enable secure, auditable, and reliable fax communications across IHS

• Eliminate on-premises fax infrastructure (cloud-only solution)

• Provide high availability and continuity of operations

3.0 SCOPE

The contractor shall provide all labor, materials, software, licenses, cloud services, and support necessary to deliver a fully managed, cloud-native electronic fax solution.

Consistent with the sample fax PWS, the contractor shall provide a secure web-based faxing capability with audit logging, encryption, and technical support.

The work will start with approximately ¼ of the agency, starting with the Great Plains Area, Billings Area and Oklahoma Areas. If the implementation is successful, this system will expand and add in the additional areas of Indian Health Service over a phased approach and be available to all of the agency.

The full integration with Microsoft Teams and our SharePoint environment allows for the agency to ensure that data is stored in our Office 365 tenant and follows Indian Health Service aligned data retention, audit and security policies.

3.1 Core Requirements

• Cloud-only SaaS (no on-prem infrastructure)

• FedRAMP Moderate or High Authorization (active ATO required)

• Microsoft Teams integration (send/receive fax within Teams interface)

• Exchange Online / Outlook integration (optional but preferred)

• Web portal and API access

• Support for enterprise identity (Azure AD / Entra ID SSO)

3.2 DID Number Requirements

• All fax numbers (DIDs) shall be:

o Owned by IHS (Government retains ownership rights) o Fully portable to another provider at contract end o Not restricted by vendor lock-in or proprietary constraints

4.0 CONTRACTOR RESPONSIBILITIES

4.1 Solution Delivery & Configuration

The contractor shall:

• Provide a secure, encrypted cloud fax platform

• Configure Microsoft Teams integration, including:

o Send/receive fax via Teams channels, chat, or apps o Notification workflows within Teams

• Provision and migrate existing fax numbers (DIDs)

• Configure role-based access controls (RBAC)

• Enable centralized administration

4.2 Security & Compliance

The contractor shall ensure:

• FedRAMP Moderate or High authorization (mandatory)

• End-to-end encryption:

o Data in transit (TLS 1.2+) o Data at rest (FIPS 140-2/3 validated cryptography)

• HIPAA compliance (45 CFR Part 164)

• Audit logging for all transmissions

• Support for Zero Trust architecture principles

• Support VPN users authenticated on the IHS network

• Integration with IHS identity systems (Azure AD)

Consistent with the sample PWS, the system must provide:

• Audit trails for all transmissions

• Secure encrypted connections and authentication controls

4.3 System Integration

The contractor shall:

• Integrate with:

o Microsoft Teams (required) o Exchange Online / Outlook (preferred) o Electronic Health Record (EHR) systems (if applicable)

• Provide APIs for interoperability

• Support inbound/outbound fax routing rules

4.4 Operations & Maintenance

The contractor shall:

• Provide 24/7 technical support (consistent with sample PWS expectations)

• Maintain system uptime ≥ 99.9%

• Perform updates, patches, and enhancements automatically

• Provide incident response and resolution

4.5 Data Management

The contractor shall:

• Ensure all data is stored within U.S.-based FedRAMP-authorized environments

• Provide configurable retention policies

• Allow export of all fax data and metadata

• Ensure Government retains full ownership of all data

4.6 Training & Documentation

The contractor shall:

• Provide user and administrator training

• Deliver user guides and SOPs

• Provide onboarding support for IHS facilities

5.0 DELIVERABLES

Deliverable Frequency Format Implementation Plan At project start PDF System Configuration Documentation Post-implementation PDF Training Materials Initial + updates Digital Monthly Usage & Audit Reports Monthly PDF/Excel Security Compliance Reports Quarterly PDF Incident Reports As required PDF

6.0 PERFORMANCE STANDARDS (QASP SUMMARY)

Performance Objective Standard Method

System Availability ≥ 99.9% uptime Monitoring reports

Fax Delivery Success Rate better than or equal to analog fax industry standard success rates

≥ 95% Audit logs

Support Response Time ≤ 1 hour (critical) Ticket review Security Compliance FedRAMP/HIPAA Audit Teams Integration Functionality 100% operational COR validation

7.0 SECURITY REQUIREMENTS

The contractor shall comply with:

• FedRAMP Moderate or High baseline

• HIPAA Security Rule (45 CFR Part 164)

• Privacy Act (5 U.S.C. §552a)

• FISMA

• NIST SP 800-53 controls

• FIPS 140-2/3 cryptographic standards

No system shall:

• Restrict Government access to data

• Prevent number portability

• Create vendor lock-in

8.0 PERIOD OF PERFORMANCE

• Base Year: 12 months

• Four (4) Option Years (12 months each)

9.0 PLACE OF PERFORMANCE

• Cloud-hosted (FedRAMP-authorized environment)

• Accessible across all IHS facilities nationwide

10.0 GOVERNMENT-FURNISHED EQUIPMENT (GFE)

• Network access

• Identity services

• Existing fax numbers (for migration)

11.0 ACCEPTANCE CRITERIA

The solution will be accepted when:

• FedRAMP authorization is verified

• Microsoft Teams integration is fully functional

• Fax transmission and receipt tested successfully

• DID ownership confirmed contractually

• Security and compliance controls validated

12.0 CONSTRAINTS

• Cloud-only (no on-prem solutions permitted)

• Must integrate with Microsoft Teams

• Must be FedRAMP authorized (Moderate or higher)

• Government must retain ownership of:

o Data o Fax numbers (DIDs) o Configuration access

13.0 QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

Aligned with the sample PWS structure, the Government will:

• Monitor system performance and availability

• Validate compliance with HIPAA and FedRAMP

• Review audit logs and reports

• Conduct periodic security assessments

Failure to meet performance standards may result in:

• Service credits

• Corrective action plans

• Contract remedies

14.0 EVALUATION CRITERIA (SECTION M)

Award will be made using a Lowest Price Technically Acceptable approach. The Government will evaluate proposals based on the following factors:

14.1 Technical Capability (Most Important)

The Government will evaluate the extent to which the offeror demonstrates:

• Compliance with all FedRAMP Moderate or High requirements

• Depth and maturity of Microsoft Teams integration o Native vs API-based integration o User experience within Teams

• Ability to ensure Government ownership and portability of DIDs

• Demonstration of Past Performance with Federal agencies

• Security architecture (encryption, access control, audit logging)

• System scalability and performance

• API availability and interoperability with IHS systems

14.2 Security & Compliance

Evaluation will include:

• Verified FedRAMP Authorization (ATO) status

• Alignment with:

o NIST SP 800-53 o HIPAA Security Rule o FIPS 140-2/3 cryptography

• Zero Trust Architecture alignment (see Section 15.0)

• Data residency and protection controls

• Incident response and breach notification procedures

14.3 Management Approach

The Government will evaluate:

• Project management methodology

• Staffing plan and qualifications

• Risk management strategy

• Service delivery model and escalation procedures

14.4 Migration Approach

The Government will evaluate:

• Completeness and feasibility of the legacy fax migration plan

• Ability to migrate:

o Existing fax numbers (DIDs) o Historical fax data (if required) o User accounts and workflows

• Minimization of operational disruption

14.5 Past Performance

Evaluation will consider:

• Relevant experience with federal healthcare or HHS agencies

• Past performance delivering:

o FedRAMP-authorized SaaS solutions o Cloud fax or secure messaging systems

• CPARS ratings or equivalent documentation

14.6 Price

• Evaluated for reasonableness and realism

• Not scored numerically but considered in tradeoff decision

15.0 ZERO TRUST ARCHITECTURE REQUIREMENTS

The contractor shall design and operate the solution in alignment with Federal Zero Trust Architecture (ZTA) principles (OMB M-22-09 and NIST SP 800-207).

15.1 Identity-Centric Security

• Integration with Active Directory

• Support for:

o Multi-Factor Authentication (MFA) o Conditional Access Policies o Role-Based Access Control (RBAC)

15.2 Device & Access Controls

• Enforce device compliance policies where applicable

• Restrict access based on:

o User identity o Device posture o Location and risk signals

15.3 Data Protection

• Encrypt all data:

o In transit (TLS 1.2+) o At rest (FIPS 140-2/3 validated)

• Support Data Loss Prevention (DLP) integration

• Ensure secure handling of PHI at all stages

15.4 Continuous Monitoring

• Provide real-time logging and monitoring

• Integrate with Security Information and Event Management (SIEM) tools

• Support anomaly detection and alerting

15.5 Least Privilege & Micro-Segmentation

• Enforce least privilege access across all roles

• Logical isolation of tenant environments

• No shared access to Government data across tenants

15.6 Audit & Visibility

• Full audit trail of:

o Fax transmissions o User activity o Administrative actions

• Logs must be exportable to Government systems

16.0 MIGRATION PLAN FROM LEGACY FAX SYSTEMS

The contractor shall provide a comprehensive migration strategy to transition IHS from legacy fax systems to the cloud-based solution.

16.1 Migration Planning

The contractor shall:

• Conduct a current state assessment, including:

o Existing fax numbers (DIDs) o Fax volumes and workflows o Integration points (EHR, email, etc.)

• Develop a Migration Plan including:

o Timeline and milestones o Risk mitigation strategies o Rollback procedures

16.2 DID Number Porting

• All existing fax numbers shall be:

o Ported without service interruption o Verified for successful transfer

• Contractor shall coordinate with carriers to ensure continuity

• Ownership of DIDs remains with IHS at all times

16.3 Data Migration (If Applicable)

• Migrate historical fax data where required

• Preserve:

o Metadata o Audit logs

• Ensure integrity and confidentiality of PHI during migration

16.4 Phased Implementation

Migration shall occur in phases:

1. Pilot deployment (Great Plains Area, Billings Area, Oklahoma Area)

2. Incremental rollout across IHS facilities

3. Full enterprise deployment

4. Decommissioning of legacy systems

16.5 Parallel Operations

• Maintain parallel operations (legacy + new system) during transition

• Ensure no disruption to clinical or administrative workflows

16.6 Testing & Validation

The contractor shall:

• Perform end-to-end testing of:

o Fax send/receive functionality o Teams integration o DID routing

• Validate:

o Security controls o Audit logging o User access

16.7 Training & Change Management

• Provide targeted training for:

o End users o Administrators

• Deliver change management support, including:

o User communications o Job aids o Help desk readiness

16.8 Cutover & Go-Live

• Execute a controlled cutover plan

• Provide enhanced support during go-live period

• Ensure immediate issue resolution capability

16.9 Decommissioning

• Safely decommission legacy fax systems

• Ensure:

o Data is archived or migrated per policy o No residual PHI exposure

• Provide decommissioning report

16.10 Post-Migration Support

• Provide on-going support throughout the life of the contract

• Monitor system performance and user adoption

• Address defects and optimize workflows

17.0 CONSTRAINTS

All tasks under this contract will be conducted in accordance with Homeland Security Presidential Directive 12 https://www.dhs.gov/homeland-security-presidential-directive-12, and FPS-201 http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-3.pdf . All work must follow HSPD‑12/FIPS 201‑3; procure APL‑validated PACS solutions; comply with §889 prohibitions; never lock the Government out of any system, data, or keys; and observe all confidentiality/privacy requirements.

Access to Government Property (on-site contractors) The COR and/or Project Manager will make all necessary arrangements for access by contractor personnel to the work site(s). While on government property, the contractor personnel shall comply with all rules and regulations pertaining to health and safety, not only as they apply to themselves, but also to other personnel and property at the site. Contractor personnel shall comply with all regulations restricting the disclosure of information which may become known during the performance of this contract

In the performance of work hereunder and with the price herein, the contractor shall obtain and maintain in effect all necessary permits and licenses required by Federal, State, Tribal, or local government, or subdivisions thereof, or of any other duly constituted public authority. Further the contractor shall obey and abide by all applicable laws and ordinance.

https://www.dhs.gov/homeland-security-presidential-directive-12 https://www.dhs.gov/homeland-security-presidential-directive-12 http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-3.pdf

18.0 AUTHORITY

1. No person other than the Contracting Officer has authority to bind the Government with respect to this contract.

2. No action or omission of any government employee or representative other than the Contracting Officer shall increase or decrease the scope of this contract or shall otherwise modify the terms and conditions of this contract.

3. In no event shall any of the following be effective or binding on the Government or imputed to the Contracting Officer with respect to this contract:

a. An understanding or agreement between the Contractor and anyone other than the Contracting Officer;

b. A purported modification or change order issued by anyone other than the

Contracting Officer;

c. A promise by anyone other than the Contracting Officer to provide additional funding or make payments; or

d. An order, direction, consent, or permission from anyone other than the

Contracting Officer to:

i. Incur costs in excess of a specified estimated cost, allotment of funds, or other ceiling; or

ii. Expend hours in excess of a specified level of effort.

19.0 The contractor will comply with the following listed regulations:

- Privacy Act, 5 U.S.C. 552a - Office of Privacy and Civil Liberties | Privacy Act of 1974

- Health Insurance Portability and Accountability Act (HIPAA) - eCFR :: 45 CFR Part 164 -- Security and Privacy

- CFR 42 Part 2 - eCFR :: 42 CFR Part 2 -- Confidentiality of Substance Use Disorder Patient Records

20.0 Indemnification and Governing Law

Indemnification, Liability, Statute of Limitations: Any provisions in the Terms of Service (TOS) related to indemnification and filing deadlines are hereby waived, and shall not apply except to the extent expressly authorized by law. Liability for any breach of the TOS as modified by this amendment, or any claim arising from the TOS as modified by this amendment, shall be determined under the Federal Tort Claims Act, or other governing federal authority. Federal statute of limitations provisions shall apply to any breach or claim.

Governing law: Any arbitration, mediation or similar dispute resolution provision in the TOS is hereby deleted. The TOS and this amendment shall be governed by and interpreted and enforced in accordance with the laws of the United States of America without reference to conflict of laws. To the extent permitted by federal law, the laws of the State of locations covered in this PWS will apply in the absence of applicable federal law.

https://www.justice.gov/opcl/privacy-act-1974 https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164 https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164 https://www.ecfr.gov/current/title-42/chapter-I/subchapter-A/part-2 https://www.ecfr.gov/current/title-42/chapter-I/subchapter-A/part-2

21.0 Section 508 And Accessibility

• This product must conform to the Revised Section 508 (https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines) and WCAG 2.1 Level AA standards as outlined below.

• Solicitations for supplies and services shall require the submission of a Section 508 Product Assessment Template. The template can be found at https://www.itic.org/policy/accessibility/vpat.

All Information and Communication Technology (ICT) deliverables under this contract (e.g., websites, applications, electronic documents, and multimedia) must comply with the Revised Section 508 Standards (36 CFR Part 1194) and the Web Content Accessibility Guidelines (WCAG) 2.1 Level AA standards. The Contractor shall ensure accessibility of all ICT deliverables and provide conformance documentation in the form of a Voluntary Product Accessibility Template (VPAT®) / Accessibility Conformance Report (ACR), or by completing the HHS Section 508 Accessibility Checklists. The current VPAT 2.5 template includes fields for reporting conformance to WCAG 2.1 and shall be used to document accessibility. The Contractor shall remediate any identified accessibility issues at no additional cost. The Contracting Officer will include the applicable Health and Human Services Acquisition Regulation (HHSAR) clauses 352.239-73 and 352.239-74 in the solicitation and resulting contract.

https://urldefense.us/v3/__https:/www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines__;!!Og_tST9LxTiQE1I!vedKLLB5_q-JnK_FWuxIHjnfvu3bigv6MkrYklx75ENWFof8NoauH6JFLD1wOKGX-P6kI-KyTMAxuVtJTY90E0t0pOA0ev6N0g$ https://urldefense.us/v3/__https:/www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines__;!!Og_tST9LxTiQE1I!vedKLLB5_q-JnK_FWuxIHjnfvu3bigv6MkrYklx75ENWFof8NoauH6JFLD1wOKGX-P6kI-KyTMAxuVtJTY90E0t0pOA0ev6N0g$ https://urldefense.us/v3/__https:/www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines__;!!Og_tST9LxTiQE1I!vedKLLB5_q-JnK_FWuxIHjnfvu3bigv6MkrYklx75ENWFof8NoauH6JFLD1wOKGX-P6kI-KyTMAxuVtJTY90E0t0pOA0ev6N0g$ https://urldefense.us/v3/__https:/www.itic.org/policy/accessibility/vpat__;!!Og_tST9LxTiQE1I!vedKLLB5_q-JnK_FWuxIHjnfvu3bigv6MkrYklx75ENWFof8NoauH6JFLD1wOKGX-P6kI-KyTMAxuVtJTY90E0t0pOAoG-BB7w$ https://www.w3.org/TR/WCAG21/ https://www.w3.org/TR/WCAG21/ https://www.itic.org/policy/accessibility/vpat https://www.itic.org/policy/accessibility/vpat https://www.hhs.gov/web/section-508/accessibility-checklists/index.html https://www.acquisition.gov/hhsar/part-352-solicitation-provisions-and-contract-clauses#Section_352_239_73_T48_4018362938 https://www.acquisition.gov/hhsar/part-352-solicitation-provisions-and-contract-clauses#Section_352_239_73_T48_4018362938