DRAFT - FOR MARKET RESEARCH ONLY | SSN No. 75H71326Q00063

DRAFT PERFORMANCE WORK STATEMENT

PHARMACY VAULT AND PRESCRIPTION RETRIEVAL SYSTEM

Western Oregon Service Unit SSN No. 75H71326Q00063

Draft Date: July 2026 This draft PWS is provided solely for industry review and market research. It is not a solicitation and does not create any obligation on the Government.

The Government may revise any requirement, assumption, schedule, performance standard, or acquisition approach before issuing a solicitation.

1.0 GENERAL INFORMATION

1.1 Scope and Requirement. The Contractor shall furnish, deliver, install, configure, implement, test, train, transition, maintain, and support a complete, commercially available Pharmacy Vault and Prescription Retrieval System for the Indian Health Service (IHS), Western Oregon Service Unit (WOSU), also known as Chemawa Indian Health Center. The scope includes a turnkey solution and all equipment, software, licenses, labor, materials, accessories, project management, implementation services, documentation, warranty, maintenance, and technical support necessary to achieve the required outcomes. The Contractor shall provide the complete solution without reliance on undisclosed Government resources or third-party products or services.

1.2 Background. WOSU is an IHS outpatient health center located in Salem, Oregon. The pharmacy currently uses a leased system to support secure controlled-substance storage and accountability and secure storage, tracking, and retrieval of filled prescriptions awaiting patient or authorized-proxy pickup. The incumbent contract ends December 31, 2026. The successor acquisition requires a new or replacement solution and includes physical installation and implementation during the base period.

1.3 Objectives. The objectives are to maintain patient safety and continuity of pharmacy operations; strengthen controlled-substance security and accountability; accurately track filled prescriptions and pickup transactions;

preserve required data and audit history; reduce manual workload and medication-dispensing risk; and implement the successor solution with the least practical disruption to patients and pharmacy personnel.

1.4 Contract Structure and Period of Performance. The contemplated contract will include one 12-month base period and four 12-month option periods. All initial site survey, project management, delivery, installation, data migration, configuration, testing, training, cutover, and operational-acceptance activities will be included in the base period. Exact award, base-period, installation, cutover, and acceptance dates will be established after market research. The Government anticipates a transition to successor capability beginning on or about January 1, 2027 and may need to authorize implementation activity before that date.

1.5 Place of Performance. Western Oregon Service Unit / Chemawa Indian Health Center, 3750 Chemawa Road NE, Salem, Oregon 97305. Off-site project management, configuration, staging, testing, help-desk support, and other activities may be performed at Contractor facilities when approved and when consistent with security and privacy requirements.

1.6 Pharmacy Hours and Access. The pharmacy is open to the public from 7:30 a.m. to 5:00 p.m. Monday, Tuesday, Thursday, and Friday, and from 1:00 p.m. to 5:00 p.m. Wednesday, excluding Federal holidays. Pharmacy personnel are typically present Wednesday mornings for training, meetings, and documentation, although the pharmacy is not open to the public. The Contractor may propose installation, training, testing, cutover, or related work during Wednesday mornings, evenings, weekends, or Federal holidays. Work outside normal public hours is subject to advance discussion, coordination, and approval by the Contracting Officer's Representative (COR). Any change affecting contract scope, price, or terms requires written authorization from the Contracting Officer.

1.7 Incumbent-System Reference Configuration. The existing system includes one four-drawer filled-prescription storage cabinet, one four-drawer controlled-drug storage cabinet, a management operating system, three signature-capture pads, two RFID readers, six barcode scanners, one signature-capture label printer, automated notification capability, and related technical support. The incumbent system uses an on-premises physical server.

This information is provided only as a planning reference and does not establish a required manufacturer, technology, architecture, cabinet count, drawer count, or successor-system configuration.

1.8 Site and Transition Constraints. Space is limited, and two complete systems cannot be installed or operated simultaneously. The incumbent owns the existing equipment and is responsible for shutting it down and removing

it. A successor Contractor other than the incumbent will not be responsible for those activities. If the incumbent is awarded the successor contract, it may propose an integrated removal-and-replacement approach. The incumbent removal schedule and duration are unknown. The Contractor shall assume the existing equipment will not remain available after December 31, 2026. The successor Contractor will be responsible for migration of all Government-designated data and for minor site restoration necessary to return the installation area to working order after site turnover. Detailed site photographs and floor-plan information are not included with this draft PWS and may be provided with a later solicitation or site visit.

1.9 Delivery and Implementation Schedule. The Contractor shall propose an integrated schedule identifying the contract-award or notice-to-proceed date and the performance-start date needed to minimize downtime. The schedule shall include the site survey, final design, Government prerequisites, equipment allocation or manufacturing, off-site configuration, delivery, site turnover, installation, data migration, testing, training, cutover, go-live support, and operational acceptance. It shall identify the critical path, the effect of delays, and the time required from Government turnover of a cleared installation area to production availability. The final schedule will be subject to Government approval, and all initial installation and implementation activities shall be completed during the base period.

2.0 DEFINITIONS

2.1 Contractor-Controlled Transition Time. The elapsed time from Government turnover of a cleared, installation-ready space until the replacement system is available for production use.

2.2 Cutover. The controlled transition from the incumbent or interim workflow to the successor production system, including final data transfer, inventory transfer, validation, and authorization for production use.

2.3 Degraded or Manual Operations. A period in which pharmacy personnel can continue a required function only through a temporary, manual, reduced-capability, or contingency process.

2.4 Complete Operational Interruption. A period in which the applicable pharmacy function cannot be performed through either the production system or an approved contingency process.

2.5 Operational Acceptance. Written Government acknowledgment that installation, configuration, data migration, testing, training, documentation, security and privacy prerequisites, and other applicable acceptance criteria have been successfully completed and the system is authorized for production use.

2.6 Production-System Unavailability. A period during which the applicable automated production function is unavailable, whether or not a manual or temporary process remains available.

2.7 Site Restoration. Work necessary after site turnover and installation to leave affected areas, surfaces, utilities, cabling, pathways, and pharmacy workspaces safe, clean, functional, and suitable for intended use.

2.8 Total Deployment Lead Time. Calendar time from contract award, effective date, or notice to proceed through operational acceptance.

3.0 SPECIFIC TASKS AND PERFORMANCE REQUIREMENTS

3.1 Complete Solution. The Contractor shall provide all components and services necessary for a complete operational solution. The solution shall not depend on undisclosed third-party products, licenses, subscriptions, interfaces, utilities, or services. The Contractor shall identify all Government-furnished prerequisites and all recurring and one-time dependencies.

3.2 Filled-Prescription Storage, Tracking, and Retrieval. The solution shall securely store, identify, locate, track, retrieve, and manage filled prescriptions awaiting patient or authorized-proxy pickup. It shall support intake, storage assignment, pickup, partial pickup when applicable, reassignment, exception handling, return to stock, and reporting. The solution shall maintain an accurate status and location for each stored prescription or prescription group and reduce the risk of misidentification or delivery to an unauthorized person.

3.3 Controlled-Substance Storage and Accountability. The solution shall provide secure, access-controlled storage and inventory management for controlled substances. It shall support authorized-user access, role-based permissions, inventory counts and reconciliation, transaction logging, discrepancy identification, alerts, audit trails, and configurable accountability or witness workflows. The solution shall support pharmacy policies and applicable controlled-substance security, diversion-prevention, and accreditation requirements.

3.4 Patient or Proxy Verification and Signature Capture. The solution shall support verification of the patient or authorized proxy and electronic capture of pickup acknowledgment or signature at Government-designated dispensing locations. Each record shall be linked to the applicable prescription transaction and include date, time, user, patient or proxy designation, and other required metadata.

3.5 Identification Technology. The Contractor may use RFID, barcode, light-guided, computer-vision, or other commercially available technology. The proposed method shall reliably associate prescriptions, storage locations, controlled-substance inventory, users, and transactions and shall include controls for unreadable, damaged, missing, or duplicate identifiers.

3.6 Reports, Audit Trails, and Notifications. The solution shall provide searchable reports and audit trails sufficient to support operational management, inventory accountability, prescription-location history, pickup documentation, user activity, discrepancy review, return-to-stock management, audits, investigations, and records requests. Audit records shall be protected against unauthorized alteration. The solution shall provide configurable patient or staff notifications when included in the accepted technical approach.

3.7 Capacity and Footprint. The final solicitation will state required workload and minimum capacity information after market research. For this draft PWS, the Contractor shall identify the usable storage capacity, controlled-substance capacity, maximum concurrent records, expected growth capacity, physical footprint, required operating and maintenance clearances, delivery-path requirements, and all sizing assumptions. The solution shall be suitable for the limited space available at WOSU.

3.8 Technical Architecture. The Government will consider on-premises, cloud, hybrid, appliance-based, and other commercially available architectures, subject to IHS review and approval. The Contractor shall identify all servers, appliances, endpoints, network connections, remote-support methods, identity and access dependencies, data flows, hosting locations, backup methods, and security services. A cloud component that processes or stores Government data shall meet all applicable Federal and HHS authorization requirements.

3.9 Interfaces and Workflow Integration. The Government has not yet determined whether a direct interface with an existing electronic health record, pharmacy information system, robotic dispensing system, or other pharmacy automation system will be mandatory. The Contractor shall describe the integration and workflow capabilities of its proposed solution, including direct electronic interfaces, application programming interfaces, data feeds, barcode or label scanning, or other methods; the data exchanged; required hardware, software, licenses, third-party or original equipment manufacturer participation; cybersecurity approvals; implementation lead time; one-time and recurring costs; and all manual workflow steps. The proposed solution shall support a complete pharmacy workflow without requiring modification of an existing Government system unless such modification is expressly authorized by the Government. The Contractor shall identify and minimize duplicate scanning, duplicate data entry, separate logins, application switching, manual data transfer, and manual reconciliation. If multiple products, manufacturers, subcontractors, or components are proposed, the Contractor shall remain responsible for end-to-end integration, operation, maintenance, technical support, and resolution of cross-component issues. The final solicitation may establish specific interface or workflow requirements after consideration of market research.

3.10 Availability and Continuity. The solution shall be designed and supported to minimize outages, data loss, and operational disruption. The Contractor shall provide backup, recovery, failure notification, and documented contingency procedures appropriate to the proposed architecture and shall identify any single points of failure.

4.0 BASE-PERIOD IMPLEMENTATION AND TRANSITION

4.1 Post-Award Conference. The Contractor shall participate in a post-award conference with the Contracting Officer, COR, pharmacy personnel, information-technology personnel, facilities personnel, privacy or security personnel, and other Government stakeholders. The conference will confirm roles, schedule assumptions, site access, data requirements, approval paths, communication procedures, and critical risks.

4.2 Implementation and Transition Plan. The Contractor shall prepare and maintain an integrated implementation and transition plan from award through operational acceptance. The plan shall be backward-planned from the approved cutover target and shall include milestones, dependencies, responsible parties, required Government decisions, manufacturing or equipment-allocation lead time, shipping, site readiness, data migration, testing, training, incumbent-removal coordination, contingency procedures, downtime estimates, and acceptance activities.

The Contractor shall immediately notify the Contracting Officer and COR of any condition that may affect the critical path.

4.3 Site Survey and Final Design. The Contractor shall conduct a site survey before finalizing its design. The survey shall evaluate available footprint, operating clearances, delivery and egress paths, door and corridor dimensions, floor and wall conditions, anchoring, loading, power, network connectivity, environmental conditions, accessibility, staging limitations, and any Government facility work. The Contractor shall submit a final layout, equipment list, utility and network requirements, installation method, site-readiness checklist, and list of assumptions or exclusions.

4.4 Site Readiness. The Contractor shall identify all site-readiness actions and the date each action must be completed. The Contractor shall not begin installation until the Government has made the designated area available and authorized the work. The Contractor shall verify site conditions at turnover and promptly document any condition that prevents safe or timely installation.

4.5 Incumbent Shutdown, Removal, and Site Turnover. The incumbent owns and is responsible for shutting down and removing the existing equipment. The incumbent removal schedule and on-site duration are unknown.

The Government will coordinate incumbent access, removal, and turnover of the designated installation area. A successor Contractor other than the incumbent will not be responsible for shutting down, disconnecting, altering, or removing incumbent equipment or media. The successor Contractor shall identify the minimum turnover condition it requires and the time needed from turnover of a cleared, installation-ready area to production availability. If the successor Contractor is also the incumbent, it may propose a single integrated plan for shutdown, removal, migration, and replacement. All proposed approaches will be subject to the same functional, schedule, downtime, and acceptance requirements.

4.6 Data Migration. The Contractor shall be responsible for planning and executing migration of all Government-designated data needed for continuity, accountability, operations, audit, records retention, and reporting.

Responsibilities include defining source-data requirements; coordinating authorized export; securely receiving and transferring data; mapping and transforming fields; importing data; validating completeness and accuracy;

reconciling record counts and financial or inventory totals as applicable; documenting exceptions; and obtaining Government approval. Data may include active prescription-pickup records, controlled-substance inventory, users and roles, transaction and audit history, electronic signatures, configuration, reports, and other Government records.

When direct migration of historical data is not technically feasible, the Contractor shall propose a Government-accessible, searchable archive or other compliant method that preserves required access and retention. The Contractor shall identify all incumbent cooperation, source formats, access, decisions, and lead times required.

4.7 Data Sanitization of Incumbent Equipment. Data sanitization means the secure removal, clearing, destruction, or other approved disposition of Government data remaining on retired storage media. Because the incumbent owns and removes the existing equipment, sanitization of incumbent-owned media is an incumbent responsibility coordinated by the Government and is separate from the successor Contractor's data-migration responsibility. If the same firm is both incumbent and successor, the firm shall address both activities in the approved transition plan.

4.8 Delivery and Physical Installation. The Contractor shall provide transportation, unloading, material handling, assembly, positioning, anchoring, cabling, connections, labeling, tools, equipment, and qualified personnel required for installation. The Contractor shall protect patients, staff, property, medications, records, and pharmacy operations and shall comply with approved access, infection-control, safety, security, and facility procedures. Installation shall be scheduled to minimize interference with public pharmacy hours.

4.9 Site Restoration. After site turnover, the Contractor shall perform the minor patching, repair, finishing, anchoring, cable management, cleanup, disposal, and other work necessary for its installation and shall leave the affected area safe, clean, fully functional, and ready for pharmacy operations. The Contractor shall identify in its proposal any major construction, electrical work, structural modification, hazardous-material work, or latent condition that is excluded or requires separate Government action.

4.10 Configuration and Security Setup. The Contractor shall configure workflows, storage locations, users, roles, permissions, alerts, reports, backups, audit functions, peripherals, network settings, and other parameters required for production use. Default accounts, passwords, unnecessary services, and insecure settings shall be removed or changed before production. The Contractor shall provide configuration documentation and coordinate required Government security, privacy, and information-technology reviews.

4.11 Testing and Operational Acceptance. The Contractor shall develop and execute an approved test and acceptance plan. Testing shall address physical installation; power and network connectivity; storage and retrieval;

controlled-substance access and reconciliation; identity and role controls; patient or proxy verification; electronic signature capture; identification functions; notifications; reporting; audit trails; backup and recovery; data migration; performance; accessibility; workflow integration; and failure or contingency scenarios. End-to-end testing shall include prescriptions produced through automated and manual filling workflows; controlled-substance transactions; multiple prescriptions for one patient; patients with similar names; patient and authorized-proxy pickup; partial pickup when applicable; return to stock; storage-location reassignment; unreadable, missing, or duplicate identifiers; prevention of incorrect patient or prescription selection; system, interface, network, or component failure; contingency operations; recovery; and reconciliation. The Contractor shall demonstrate the accepted interface, barcode, label, or other workflow method and disclose all manual steps. The proposed solution shall not require unauthorized modification of an existing Government system. Deficiencies shall be corrected and retested at no additional cost. Operational acceptance will occur only after the Government approves required test results, documentation, training completion, data reconciliation, site restoration, and production-readiness criteria.

4.12 Training. The Contractor shall provide role-based training for pharmacy end users, administrators, supervisors, information-technology support personnel, and other designated staff. Training shall include normal operations, controlled-substance workflows, exception handling, return to stock, reports, audit functions, user administration, backup and recovery, troubleshooting, downtime procedures, and escalation. The Contractor shall provide accessible training materials and may propose Wednesday-morning, after-hours, remote, train-the-trainer, or blended delivery methods.

4.13 Cutover and Downtime Minimization. The Contractor shall plan and execute cutover to minimize production-system unavailability, degraded or manual operations, and complete operational interruption. Full parallel operation of two complete systems is not available. The Contractor shall use commercially reasonable measures such as off-site preconfiguration, staged or component-level replacement, temporary or compact equipment, additional personnel, approved after-hours work, preloaded configuration, prevalidated data, and rollback or recovery procedures. The final solicitation will establish maximum allowable downtime after consideration of market research. The Contractor shall record and report actual downtime by function and category.

4.14 Go-Live Support. The Contractor shall provide enhanced go-live support during cutover and the initial production period. The Contractor shall propose the duration, on-site or remote staffing, escalation path, issue tracking, daily status reporting, and criteria for transition to routine support.

5.0 OPERATIONS, MAINTENANCE, AND SUPPORT

5.1 Licensing and Entitlements. The Contractor shall provide and maintain all licenses, subscriptions, certificates, support entitlements, and third-party rights needed for the accepted solution throughout each funded contract period.

The Contractor shall provide advance notice of expirations, product end-of-life, end-of-support, and required upgrades.

5.2 Preventive and Corrective Maintenance. The Contractor shall perform preventive maintenance, inspections, calibration when applicable, corrective maintenance, repair, and replacement necessary to maintain safe and reliable operation. Maintenance shall be scheduled to minimize disruption and shall not reduce security, privacy, auditability, or data integrity.

5.3 Help Desk and Technical Support. The Contractor shall provide a documented help-desk and escalation process, issue tracking, remote and on-site support as needed, and qualified personnel familiar with the installed configuration. The final solicitation will establish support hours, incident severities, response times, restoration targets, and reporting requirements after consideration of industry recommendations.

5.4 Software, Firmware, and Security Updates. The Contractor shall provide supported software and firmware versions, security patches, defect corrections, and updates throughout the contract. Updates shall be tested, scheduled, documented, and implemented without loss of Government data or material disruption. The Contractor shall notify the Government of vulnerabilities, unsupported components, and required remediation.

5.5 Replacement Parts and Equipment. The Contractor shall maintain access to replacement parts, peripherals, and equipment sufficient to meet the accepted service levels. Replacement components shall be equal to or better than the accepted configuration and shall not introduce unapproved security, privacy, interoperability, or accessibility changes.

5.6 Backup, Recovery, and Business Continuity. The Contractor shall implement and document backup, restoration, disaster-recovery, and business-continuity procedures appropriate to the architecture. The Contractor shall test recovery at an agreed frequency, document results, correct deficiencies, and maintain procedures for operating during partial or complete system unavailability.

5.7 Performance Reporting. The Contractor shall provide reports on system availability, incidents, response and restoration performance, maintenance, updates, vulnerabilities, backups, storage capacity, data exports, open risks, and other measures established in the final contract.

6.0 SECURITY, PRIVACY, CYBERSECURITY, DATA, AND RECORDS

6.1 Government Data Ownership. All Government data, patient information, transaction records, audit history, configurations funded by the Government, reports, and other records created, received, maintained, or processed for this requirement remain Government property. The Contractor shall not assert a lien or restrict Government access because of a payment dispute, contract expiration, termination, or transition.

6.2 Data Access and Export. The Government shall have timely access to its data throughout the contract. The Contractor shall provide complete exports in documented, commonly usable, nonproprietary formats upon request and at contract transition or termination. Exports shall include sufficient metadata and documentation to support interpretation, audit, migration, and retention.

6.3 Privacy and Confidentiality. The solution may collect, maintain, process, or transmit protected health information and personally identifiable information. The Contractor shall comply with the Privacy Act, HIPAA, 42 CFR Part 2 when applicable, the Business Associate Agreement, confidentiality requirements, applicable systems-of-record requirements, and Government privacy instructions. The Contractor shall use Government data only for authorized contract performance and shall not sell, monetize, analyze for unrelated purposes, or disclose the data without authorization.

6.4 Cybersecurity. The Contractor shall comply with applicable HHS and IHS cybersecurity requirements, security-assessment and authorization processes, configuration standards, vulnerability-management requirements, incident-reporting procedures, access controls, encryption requirements, logging, and remote-access restrictions.

The Contractor shall identify all hosting, subcontractor, supply-chain, and external-service dependencies.

6.5 Personnel, System, and Facility Access. Contractor personnel shall obtain and maintain all required suitability, training, badging, account, remote-access, and facility-access approvals before receiving access. The Contractor shall apply least-privilege principles, protect credentials, use only Government-approved devices and media when required, promptly report personnel or role changes, and comply with escort, safety, infection-control, and facility procedures. The final solicitation and contract will identify the specific approval and access requirements applicable to the accepted solution.

6.6 Records Retention and Audit Support. The Contractor shall preserve records for the retention period directed by the Government and shall support authorized audits, investigations, legal holds, records requests, and regulatory reviews. Records shall remain searchable and attributable to the applicable transaction, user, date, time, patient or proxy, prescription, storage location, and controlled-substance event, as applicable.

6.7 End-of-Contract Transition and Sanitization. At expiration, termination, or transition, the Contractor shall provide complete data exports, documentation, credentials and keys that the Government is entitled to receive, transition assistance, and verification that Government data has been returned or transferred. After Government acceptance of the transfer and written authorization, the Contractor shall sanitize Government data from Contractor-owned media using a Government-approved method and provide certification when required.

7.0 SECTION 508 AND ACCESSIBILITY

Information and communication technology deliverables shall conform to the applicable Revised Section 508 Standards (36 CFR Part 1194) and the specific accessibility requirements identified in the final solicitation and contract. The Contractor shall provide current accessibility conformance documentation, such as an Accessibility Conformance Report based on an appropriate VPAT template, identify known nonconformances and remediation plans, support Government accessibility testing, and correct contract-required accessibility deficiencies at no additional cost.

8.0 DELIVERABLES AND DELIVERY SCHEDULE

The final solicitation will establish due dates, review periods, and acceptance points. For market research, respondents should comment on the feasibility of the following deliverables and recommend commercially reasonable timing.

No. Deliverable Minimum Content Draft Timing

1 Implementation and Transition Plan

Integrated schedule, critical path, roles, Government prerequisites, risk register, communications, downtime plan, contingency and rollback procedures.

Contractor proposed

2 Site Survey and Final Design Package

Site conditions, layout, equipment list, footprint, clearances, pathway, anchoring, power, network, facility work, assumptions, exclusions, and site-readiness checklist.

After site survey

No. Deliverable Minimum Content Draft Timing

3 Data Migration Plan Data inventory, source formats, export method, mapping, secure transfer, import, validation, reconciliation, exception handling, audit-history preservation, and archive alternative.

Before migration

4 Security, Privacy, and Architecture Package

Architecture and data-flow diagrams, hosting, components, interfaces, remote access, accounts and roles, encryption, logging, backup, vulnerabilities, privacy and security documentation.

Before approval / connection

5 Test and Acceptance Plan Test cases, expected results, data reconciliation, performance, accessibility, security, contingency, defect tracking, acceptance criteria, and approval roles.

Before testing

6 Training Plan and Materials Audience, curriculum, delivery method, schedule, accessible materials, competency checks, administrator training, and refresher resources.

Before training

7 Cutover and Go-Live Plan Minute-by-minute or task-level sequence, site turnover, inventory and data transfer, staffing, communications, downtime estimates, contingency, rollback, and go-live support.

Before cutover

8 As-Built and Operations Documentation

Final configuration, inventory, serial numbers, diagrams, credentials handoff, manuals, backup and recovery, maintenance procedures, support contacts, and warranty information.

Before acceptance

9 Acceptance Report Executed test results, corrected defects, data reconciliation, training completion, site restoration, open items, and recommendation for operational acceptance.

At acceptance

10 Recurring Performance Report Availability, incidents, service levels, maintenance, updates, backups, capacity, risks, vulnerabilities, and corrective actions.

Frequency TBD

11 End-of-Contract Transition Package

Complete data export, data dictionary, archive, documentation, transition assistance, equipment disposition, and sanitization certification when applicable.

Before transition / expiration

9.0 GOVERNMENT-FURNISHED EQUIPMENT, INFORMATION, AND RESPONSIBILITIES

9.1 Government-Furnished Equipment. No Contractor-use Government-furnished equipment is currently anticipated. The Contractor shall furnish all equipment, tools, test instruments, temporary equipment, software, licenses, and other resources necessary for performance unless the final solicitation expressly identifies an item as Government-furnished. Existing facility utilities, network connectivity, workstations, and other Government resources may be used only when specifically authorized and shall not be assumed to be available.

9.2 Government-Furnished Information. The Government may provide, as available and applicable, site photographs, floor plans, measurements, operating procedures, workload and capacity information, source-data exports, data dictionaries, user and role information, interface and network information, security and privacy instructions, and other information necessary for performance. Detailed site photographs and floor-plan information may be provided with a later solicitation or site visit. The Contractor shall validate information and site conditions through the approved site survey and shall promptly identify missing or inconsistent information.

9.3 Other Government Responsibilities. The Government will perform the following activities, subject to the terms of the final contract:

• Designate a Contracting Officer and COR and identify Government technical, pharmacy, information-technology, privacy, security, and facility points of contact.

• Provide reasonable facility access, escort, work-window coordination, and access approvals consistent with patient care, safety, privacy, and security requirements.

• Coordinate incumbent shutdown and removal and make the designated area available to the successor Contractor. The incumbent-removal schedule and duration are unknown. The Government does not anticipate that the existing equipment will remain available after December 31, 2026.

• Facilitate authorized access to the incumbent system, source data, and incumbent personnel as available for the Contractor to execute the approved data-migration plan.

• Provide or approve available network, power, identity-management, security, and facility information and complete Government actions identified in the approved implementation plan.

• Review and approve or reject Contractor submittals, test results, training completion, site restoration, and operational acceptance within the timeframes established in the final contract.

• Provide detailed site photographs, measurements, or floor-plan information with a later solicitation or site visit when available and appropriate.

10.0 CONTRACTOR RESPONSIBILITIES

• Provide qualified project-management, installation, configuration, migration, training, privacy, security, maintenance, and support personnel and manage all subcontractors and manufacturers.

• Provide all labor, supervision, travel, tools, delivery, rigging, staging, equipment, software, licenses, supplies, safety equipment, documentation, and incidentals not expressly identified as Government-furnished.

• Protect Government property, data, medications, patients, staff, and operations; repair damage caused by

Contractor personnel; remove debris and packaging; and maintain a safe work area.

• Coordinate work and outages through the Contracting Officer and COR; do not rely on oral direction that changes scope, price, or schedule; and promptly report risks, delays, deficiencies, and security or privacy incidents.

• Maintain manufacturer authorization, licenses, certifications, insurance, permits, and other qualifications necessary to provide and support the proposed solution.

11.0 PERFORMANCE MONITORING, INSPECTION, AND ACCEPTANCE

11.1 Performance Monitoring. The Government will monitor Contractor performance through deliverable reviews, status meetings, schedule and risk reviews, site inspections, acceptance testing, system and audit logs, incident tickets, availability and maintenance reports, training records, data-migration reconciliation, invoice supporting documentation, and user feedback. The COR may use a Quality Assurance Surveillance Plan or other surveillance methods established in the final contract. Government monitoring, review, or approval does not relieve the Contractor of responsibility for meeting contract requirements.

11.2 Inspection and Acceptance. The Government will inspect supplies and services for conformance with the contract. Operational acceptance will occur only after the complete solution has been delivered and installed;

required data have been migrated or preserved in an approved archive; functional, security, privacy, accessibility, backup, recovery, and contingency tests have passed; required training and documentation have been completed; the installation area has been restored; and material deficiencies have been corrected or otherwise resolved in writing by the Government. Acceptance does not waive latent defects, warranty obligations, or continuing service requirements.

Performance Area Draft Standard Method of Verification AQL / Threshold Implementation schedule Complete milestones by the approved schedule and notify Government promptly of critical-path risks.

Schedule review and status reports

No unapproved critical milestone miss

Functional acceptance All required functional and security test cases pass;

deficiencies corrected and retested.

Executed acceptance report 100% required tests pass

Data migration All Government-designated records are migrated or preserved in an approved archive; counts and totals reconcile; no unexplained loss.

Migration and reconciliation report

100% reconciled or documented and approved

Downtime Actual downtime does not exceed the approved cutover plan or final contract maximum by function and category.

System logs and cutover report TBD after market research

Site restoration Affected area is safe, clean, functional, and accepted by the COR.

Inspection 100% accepted

Training All scheduled personnel receive required training and materials before independent use.

Attendance and competency records

100% scheduled completion

Availability and support Meet established availability, response, restoration, and reporting standards.

Service reports and incident tickets

TBD after market research

Privacy and security No unresolved critical privacy or security deficiency before production; incidents reported and corrected as required.

Security review and incident records

Zero unresolved critical findings

12.0 RISK CONTROL AND SPECIAL CONSIDERATIONS

12.1 Risk Control. The Contractor shall identify, track, and mitigate risks throughout implementation and operations. The implementation plan and status reports shall include a risk register identifying each risk, probability and impact, responsible party, mitigation, trigger, contingency, due date, and status. Priority risks include a potential capability gap after December 31, 2026; unknown incumbent-removal timing; inability to operate two complete systems in parallel; limited space; site-readiness dependencies; equipment or supply-chain lead times; data availability, migration, and reconciliation; privacy and cybersecurity; operational downtime; and site restoration.

The Contractor shall promptly notify the Contracting Officer and COR of any risk that may affect cost, schedule, performance, patient care, controlled-substance accountability, or security.

12.2 Continuity and Contingency Planning. The Contractor shall propose a transition sequence, contingency process, and rollback or recovery approach that minimizes production-system unavailability, degraded or manual operations, and complete operational interruption. The plan shall not assume that the incumbent equipment will remain available after December 31, 2026 or that two complete systems can operate simultaneously. Temporary equipment, temporary workflows, and nonstandard work hours require advance Government review and approval.

12.3 Identification of Possible Follow-on Work. No work beyond the funded base period and exercised option periods is guaranteed. The Government may later require additional capacity, peripherals, interfaces, technology refreshes, relocation, or transition support. Any such work must be separately authorized in writing by the Contracting Officer and may be subject to a separate acquisition.

13.0 INVOICING AND PAYMENT REQUESTS

13.1 Mandatory Electronic Invoicing. The Contractor must submit all payment requests electronically through the Department of the Treasury Invoice Processing Platform (IPP), or successor system, in accordance with HHSAR 352.232-71, Electronic Submission of Payment Requests, except when the Contracting Officer authorizes alternate procedures in writing. Information regarding IPP, including IPP Customer Support information, is available at www.ipp.gov or any successor site. Emailing an invoice to the Contracting Officer, COR, or another Government employee does not constitute submission of a payment request. If alternate procedures are authorized, the Contractor must include a copy of the Contracting Officer's written authorization with each payment request.

13.2 Invoice Content and Timing. Each payment request must comply with FAR 32.905(b), the applicable payment clause, and the invoicing instructions in the final contract. The final contract will establish invoice frequency and required supporting documentation. Invoices must identify the contract or order number, invoice number and date, billing period, applicable contract line item, description, quantity, unit price, amount, and required acceptance or performance documentation. One-time installation and implementation charges and recurring lease, subscription, maintenance, or support charges must be separately identified, as applicable. The Contractor may invoice only for supplies or services delivered and accepted, or for recurring service periods completed, unless the contract expressly provides otherwise.

14.0 INDUSTRY COMMENT AREAS

Respondents should use the Sources Sought Notice response instructions to comment on this draft PWS. The Government is particularly interested in recommendations concerning:

• The latest practical contract-award and performance-start dates needed to minimize or avoid a capability gap after December 31, 2026.

• Typical and accelerated deployment schedules, contractor-controlled site-to-production time, and downtime by function and category when full parallel operation is unavailable.

• Required footprint, site conditions, delivery pathways, utilities, staging space, Government staffing, and incumbent-removal assumptions.

• Data formats, source access, incumbent cooperation, migration and archive methods, validation, reconciliation, retention, and audit-history requirements.

• Appropriate storage capacity, transaction capacity, workload data, workflow integration, available interface or barcode/label methods, manual steps, third-party dependencies, architecture, privacy, security, accessibility, and support service levels.

• Requirements that may restrict competition or favor a particular product, technology, architecture, acquisition model, or manufacturer, together with proposed performance-based alternatives.