JA25-061 Electronic Health Record- 250505_Redacted.pdf

CUI

Controlled By: DISA Controlled By: PS8511 CUI Category: PROCURE Distribution/Dissemination Control: FEDCON POC: disa.scott.ditco.mbx.ditco-jwcc@mail.mil

JUSTIFICATION & APPROVAL FOR FEDERAL ACQUISITION

REGULATION SUBPART 16.5 ACQUISITIONS

EXCEPTION TO FAIR OPPORTUNITY

Multiple Award Contract

Orders under Fair Opportunity Federal Acquisition Regulation (FAR) 16.505(b), Defense FAR Supplement 216.505(b), Procedures, Guidance, and Information 216.505(b)

Military Interdepartmental Purchase Request Number:

Joint Warfighting Cloud Capability (JWCC) Contract Number: HC105023D0004 Task Order (TO) Number: To be determined Procurement Title: Electronic Health Record (EHR) Network and Core Services Enclave

Statutory and Regulatory Authority: 10 United States Code (U.S.C.) 3204(a) and FAR 16.505(b)(2)(i)(B)

EXCEPTION TO FAIR OPPORTUNITY

Number: JA25-061

Upon the basis of the following justification, I, as the Procuring Activity Competition Advocate (PACA), hereby approve this exception to fair opportunity pursuant to the Statutory Authority of 10 U.S.C. 3204(a) and Regulatory Authority of FAR 16.505(b)(2)(i)(B).

1. REQUESTING AGENCY AND CONTRACTING OFFICE:

Requesting Agency:

Defense Health Agency (DHA) / Program Executive Office (PEO) Medical Systems / Chief Information Officer (CIO) J6 7700 Arlington Blvd Falls Church, VA 22042 United States of America

Contracting Activity:

Defense Information Systems Agency (DISA) / Defense Information Technology Contracting Organization (DITCO) / Cloud Capabilities Section (PS8511)

2300 East Drive Scott Air Force Base, IL 62225-5406

2. NATURE/DESCRIPTION OF ACTION(S):

This action is to issue a firm-fixed-price task order (TO) against the JWCC Indefinite Delivery/Indefinite Quantity Contract for EHR Network and Core Services Enclave. This TO will be issued directly to Oracle. The anticipated period of performance is for a 12-month base period, plus two, 12-month option periods. The total estimated value is which will be funded by Operations & Maintenance and Procurement funds.

JA25-061 Electronic Health Record Network and Core Services Enclave

Page 2 of 8 Pages

3. DESCRIPTION OF SUPPLIES/SERVICES:

DHA PEO Medical Systems requires compute and storage resources to establish a separate virtual enclave boundary and demilitarized zone protections (Virtual Datacenter Security Stack (VDSS) & Virtual Datacenter Management System (VDMS)) for EHR applications and services.

This enclave will include cybersecurity tools, infrastructure and network foundations, and core services such as Active Directory, Domain Name Services, and monitoring workloads, in order to support the EHR applications as they are migrated into a cloud environment.

4. SUPPORTING RATIONALE, INCLUDING A DEMONSTRATION THAT THE

PROPOSED CONTRACTOR’S UNIQUE QUALIFICATIONS OR THE NATURE OF THE

ACQUISITION REQUIRES USE OF AN EXCEPTION TO FAIR OPPORTUNITY:

(a) Exception to Fair Opportunity.

FAR 16.505(b)(2)(i)(B) - Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

(b) Description of the Justification.

The EHR Network and Core Services Enclave within the Oracle Cloud Infrastructure (OCI) commercial cloud environment will be an enduring capability supporting the overall DHA Information Technology strategy due to the migration of the Federal EHR to the OCI environment. Protections and operational support of this commercial cloud hosting environment must be established to support the migration of on-prem workloads to this cloud service offering (CSO).

In July 2015, the Department of Defense (DoD) awarded a multibillion-dollar DoD Healthcare Management System Modernization contract to support the EHR to the Leidos Partnership consisting of four core partners - Leidos, Cerner Corporation, Accenture, and Henry Schein. Cerner provided the on-prem hosting environment for the EHR, that is directly connected to the Medical Community of Interest (Med-COI) network and serves all beneficiaries. In December 2021, Oracle acquired Cerner which included the EHR contract. With Government approval, Oracle developed a strategy to migrate the Cerner on-prem environment to OCI cloud environment.

Per the Security Requirements Guide (SRG), DHA is required to provide a VDSS/VDMS that is implemented within the CSO applications. The VDSS/VDMS provides DHA enterprise-level cloud security and management services. This provides a standard approach for boundary and application-level security for Impact Level (IL) 4 and IL5 data hosted in commercial cloud environments.

DHA needs to be connected to the EHR environment within the same CSO in order to comply with the SRG. This will allow DHA to perform cybersecurity functions, control

Page 3 of 8 Pages

CUI

network infrastructure, and provide DHA shared services as outlined in the SRG. Oracle is the only Cloud Service Provider (CSP) capable of providing cloud services in this OCI environment. Migrating these services to another CSP would negate DHA’s ability to access the OCI environment, which would result in mission failure. Oracle is the only CSP capable of transitioning DHA’s existing workload seamlessly to JWCC with no impact to mission critical services.

(c) Justification.

(1) Minimum Government requirements.

DHA PEO Medical Systems requires IL5 services to support the cybersecurity tools, infrastructure and network foundations, and core shared services to support the migration of the EHR. A VDSS/VDMS environment will also be required to support the CSP data centers in Ashburn and Chicago.

DHA requires compute and storage to provision four Windows servers and seven Red Hat Enterprise License (RHEL) servers at two production sites. There is also a requirement for a Key Management Server Vault to manage and control the encryption keys for data stored in the CSO environment. A test environment will be needed containing four RHEL servers and should be co-located at the Ashburn production site.

The environment will need to support the following metrics for data flow:

-Inbound or outbound streaming data not to exceed 100 GB per month -Monitoring ingestion not to exceed 500 million datapoints -Monitoring retrieval no to exceed 1 billion datapoints -Cloud performance monitoring -Cloud financial monitoring capability to monitor and report on services used.

The following are the requirements for multiple 100 GB virtual private circuits:

-Two (2) Virtual circuits from the VDSS/VDMS environment in Ashburn to the nearest Med-COI Boundary Cloud Access Point (BCAP)/Meet-me Point connection with diversity.

-Two (2) Virtual circuits from the VDSS/VDMS environment in Chicago to the nearest Med-COI BCAP/Meet-me Point connection with diversity.

- Two (2) Virtual circuits from the VDSS/VDMS environment in Chicago to the nearest Med-COI BCAP/Meet-me Point connection.

- Two (2) Virtual circuits from the VDSS/VDMS environment in Ashburn to the nearest Med-COI BCAP/Meet-me Point connection.

The Med-COI virtual circuits with diversity are permanent and enduring. The other four virtual circuits (two in Chicago and two in Ashburn) are for connections to Cerner data centers in Kansas City and Lee’s Summit and are temporary and are only required for a period of six months to assist with the transition from the on-prem data center to the OCI CSO environment.

Page 4 of 8 Pages

CUI

There is a requirement for the CSP to comply with DoD Risk Management Framework set forth by DoD Instruction (DoDI) 8510 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800 series. The CSP must be able to demonstrate compliance with DoDI 8510 and NIST SP 800. Using the compliance documentation, the CSP must be able to obtain an Authority to Operate (ATO) in the Chicago location. The ATO is granted by the DHA Authorizing Official (AO), in accordance with the DoD standards to operate on the DHA Med-COI network, which is DHA’s authorized network separate from the Non-Secure Internet Protocol Router Network.

(2) Proposed sole source contractor.

Oracle America, Inc

(3) Discussion regarding the cause of the sole source situation.

The only CSP capable of providing the specific infrastructure at both established locations is Oracle. Selection of other sites would cost an estimated and delay DHA from supporting the migration of on-prem workloads to the OCI CSO by 31 months. Due to compatibility requirements, in addition to the costs and time, DHA would have to refactor critical cloud offerings. This will not meet the Government’s current need.

DHA will be the mission owner for the OCI CSO. Providing local and integrated DHA protections and network connectivity for the OCI commercial cloud hosting environment is the only way to support this mission critical workload in a specific cloud environment and is the feature that necessitates the sole source award. Another CSP would be unable to establish a presence inside the required environment and infrastructure. This environment must be accredited under a DHA ATO. Having a local presence on the OCI network is the only way to meet the DHA AO requirements for scanning, reporting, and monitoring in order to obtain a DHA ATO.

If another CSP were capable of establishing an agreement to operate with the CSO, that CSP would still not be able to provide a solution at both locations. A request for Additional Research to Support Exception to Fair Opportunity was sent to all the CSPs on January 28, 2025. The Government received responses from Oracle, Amazon Web Service (AWS), Microsoft, and Google on January 31, 2025.

DHA determined that the components of the VDSS/VDMS and the data flow metrics are available from all four CSPs. The responses from the CSPs and other research of CSP offering indicated that only Oracle was able to meet the requirement at the Chicago location. Attempting to extend the VDSS & VDMS to another location would introduce ineffective design complexity that would introduce technical risk and would lead to mission performance failures and schedule delays, and thus would not meet the Government’s current requirements.

Page 5 of 8 Pages

CUI

(4) Demonstration of unique source.

Oracle possesses the knowledge, skills, capabilities, certification, clearance, and experience required to continue the program without a break in critical mission services.

In order to comply with the CC SRG, DHA requires applications implemented in an Infrastructure as a Service CSO to leverage an enterprise level application protection service (VDSS/VDMS) that is integrated within the same CSO. Oracle is the only CSP that is capable of providing VDSS/VDMS at the specific Chicago location to ensure mission success and avoid a complete mission failure.

Selecting an alternate location would be highly impactful and cost prohibitive in that the DHA EHR would not be accessible in its new CSO hosting location without this task order for core network services. This would prevent the delivery of healthcare for 9.6M beneficiaries and impact the military readiness of all garrison forces in the DoD. All CSPs’ responses received on January 31, 2025, indicated a location in the Ashburn area, but only Oracle had a location in Chicago. Both locations must be provided by one CSP in order to properly implement the requirement.

Oracle is the only CSP capable of meeting all the requirements and providing the connections to the OCI environment, allowing DHA to control this OCI environment and provide the protections of the VDSS/VDMS in the OCI locations.

(5) Procurement discussion.

Based on outreach to the four CSPs on January 28, 2025, the only CSP that is currently capable of meeting the minimum needs of the Government is Oracle. The DoD guidance in the SRG states that the VDSS & VDMS provided by the mission owner must be instantiated within the same CSO. Oracle is the only CSP that can provide the cloud compute and storage required to create the VDSS & VDMS in the Chicago location.

(6) Impact.

Migration to another CSP from Oracle is not feasible based on the inability of any other CSP to seamlessly integrate with the existing architecture. The impact of not procuring through Oracle would result in DHA being unable to provide cybersecurity, network, and shared services to the OCI network. This will stop the migration of the EHR system currently located at the on-prem datacenter to the OCI Cloud network, impacting multiple customers across DHA PEO MS/J-6, PEO Defense Healthcare Management Systems, and the Veteran Affairs.

In addition to the previously noted mission failures, DHA would be delayed in the adoption of commercial cloud-based capabilities essential for modernization efforts. This would result in noncompliance with DoD directives, such as the DoD Software Modernization Implementation Plan. Furthermore, DHA would continue to miss the opportunity to leverage key benefits of cloud computing, including survivability, scalability, rapid expandability, advanced cloud technologies, and enhanced security.

Page 6 of 8 Pages

5. COST/PRICE FAIR AND REASONABLE DETERMINATION:

A determination that the price is fair and reasonable will be based on a comparison of the contractor’s proposal to the Independent Government Cost Estimate and the JWCC Catalog pricing, including any discounts, which was previously found to be fair and reasonable and based on the contractor’s commercial pricing.

6. MARKET RESEARCH:

Market research for the basic JWCC Contracts was conducted and resulted in a signed market research report on November 9, 2021, that was revalidated and recertified on July 29, 2024.

After a survey of the market, it was concluded that the use of the JWCC Contract is in the Government’s best interest due to technical feasibility and cost to the Government.

Additional research was conducted Nov 11, 2024, by reviewing the specific capabilities in the JWCC Contracts and it was determined that Oracle America, Inc is the only source capable of fulfilling the Government’s minimum needs in the manner and time frame required.

On January 28, 2025, DHA issued a request for Additional Research to Support Exception to Fair Opportunity to the four JWCC CSPs. The Government received responses from Oracle, AWS, Microsoft, and Google on January 31, 2025. After reviewing the information gathered from the Market Research, it was determined that Oracle is the only CSP capable of meeting all the requirements and providing the connections to the OCI environment. Oracle is the only CSP that allows DHA to manage this OCI environment and provide the protections of the VDSS/VDMS in the OCI locations in both Chicago and Ashburn. Microsoft, AWS, and Google are unable to support the Chicago site. Robert Hutton, DHA Hardware Section Chief, became familiar with Cloud Initiative contracts, being the COR on the initial MilCloud II contract. This also gave him knowledge of and contact with individuals in the Government and industry regarding cloud contracts. Lists of like-type service offerings and catalogue listings were reviewed to compare cloud offerings of various CSP’s to determine if any CSP was capable of providing connections to the OCI environment other than Oracle. All CSPs were able to demonstrate compliance with DoDI 8510 and NIST SP 800. DHA determined that the components of the VDSS/VDMS and the data flow metrics are available from all the CSPs, but Oracle is the only CSP capable of operating in the required Chicago location.

7. ANY OTHER SUPPORTING FACTS: None.

8. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FAIR OPPORTUNITY:

(a) Procurement History:

Not Applicable

Page 7 of 8 Pages

CUI

(b) To overcome future barriers to competition, DHA will continue to monitor the development and availability of new solutions through extensive, on-going market research, technical analysis of emerging technologies, and evaluations of CSP’s to determine if alternative solutions arise.

Page 8 of 8 Pages

CUI

TECHNICAL CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: Mr. Robert Hutton

TITLE/AGENCY: Chief, Hardware Section, DCOPS, Defense Health Agency (DHA)

REQUIREMENTS CERTIFICATION: I certify that the supporting data under my cognizance which are included in the J&A are accurate and complete to the best of my knowledge and belief.

NAME: Mr. Robert Hutton TITLE/AGENCY: Chief, Hardware Section, DCOPS, Defense Health Agency (DHA)

CONTRACTING OFFICER CERTIFICATION: I certify that this justification is accurate and complete to the best of my knowledge and belief.

NAME: Lara Chiaurro TITLE/AGENCY/ORGANIZATION: JWCC Contracting Officer, DISA/DITCO/PS8511

PROCURING ACTIVITY COMPETITION ADVOCATE APPROVAL: I have reviewed this justification and find it to be accurate and complete to the best of my knowledge and belief.

Since this justification does not exceed $15M, this review serves as approval and my written determination that the aforementioned FAR circumstances apply.

NAME: Gay Arnold

TITLE/AGENCY/ORGANIZATION: DISA/DITCO

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO

Morgan Bauer,