Attachment J.4 - Performance Work statement-eFax.pdf

IT Modernization - eFax Services Version 2.0 6/5/2026

Performance Work Statement (PWS) C.1. Purpose The purpose of the Federal Occupation Health (FOH) Electronic Fax (eFax) contract is to procure commercial-off-the-shelf (COTS), Software-as-a-Service (SaaS), secure electronic faxing services for ~150 clinic, administrative and regional geographically dispersed site locations across the continental United States and Hawaii with allowable growth up to 125 new locations during the life of the contract. Therefore, the Contractor shall support expansion from approximately 150 locations to a potential total of 275 locations during the contract period without requiring architectural redesign or service interruption. The eFax services will replace physical fax machines and fax lines currently in-use that are utilized to transmit various documentation including those that contain Protected Health Information (PHI) and Personally Identifiable Information (PII).

C.2. Program Description and Background The mission of Federal Occupational Health (FOH), a component of the Program Support Center (PSC), within the U.S. Department of Health and Human Services (HHS), is to improve the health, safety, and productivity of the Federal workforce. Granted authority under 5 USC § 7901, FOH promotes and maintains the physical and mental fitness of federal employees of HHS and other federal agencies by providing occupational health programs and services, including clinical services delivery, expert medical consultation tailored to a particular federal agency’s occupational health service needs, wellness and health promotion services, behavioral health services, and environmental health and safety services.

FOH provides occupational health programs and services as centralized services through the HHS Service and Supply Fund (SSF) authorized at 42 USC 231. The Continuing Appropriations Act, 2021, and Other Extensions Act, Pub. L. No. 116-159, div. C, title I, sec. 2107 (Oct 1, 2020) states that the SSF Statute “shall be applied with respect to any fiscal year as though the phrase ‘central services’ referred to central services for any Federal agency.” This provides specific transfer authority for the provision of occupational health services under 5 USC §7901 for both HHS employees and employees of another federal agency.

FOH provides such occupational health services to federal customer agencies exclusively through Interagency Agreements (IAAs). FOH is the largest provider of occupational health services in the Federal Government. FOH negotiates IAAs with federal departments, agencies' national headquarters, and their regional/local components for occupational health and consultation services. FOH maintains sole responsibility for consulting with its federal departments and federal agency customers.

FOH comprehensive services include:

a) Clinical Health Services (CHS) - Occupational medicine services, medical employability and fitness for duty services that focus on assessing the ability of the employee to meet immediate job demands, increase employee productivity and improve employee performance

b) Environmental Health and Safety (EHS) - ensures a safe working environment through site assessments, environmental health oversight of all FOH occupied spaces, emergency preparedness and emergency response

c) Wellness and Health Promotion Services (WHPS) - services to assist employees in achieving and maintaining good health so that they can sustain peak performance

d) Behavioral Health Services (BHS) – Employee Assistance Program, Work/Life and other behavioral health services designed to promote emotional well-being and a healthy life balance through stress management, financial and legal counseling, and professional referrals.

A significant portion of FOH’s mission‑critical operations depends on the secure and efficient exchange of health‑related documentation from federal agencies, healthcare providers, and program participants. Many partners continue to rely on traditional faxing, resulting in manual workflows, delays, increased administrative burden, and elevated information security risks. The continued reliance on legacy fax systems limits FOH’s ability to optimize service delivery and protect sensitive information such as PHI and PII.

To modernize these communication channels and support FOH’s digital transformation, FOH requires a secure, FedRAMP‑authorized, cloud‑based electronic fax (eFax) service capable of supporting enterprise‑wide, HIPAA‑compliant digital inbound and outbound faxing. The eFax solution is essential for enabling FOH program areas to exchange sensitive documents rapidly, reliably, and in alignment with federal cybersecurity, privacy, and interoperability standards.

By transitioning from traditional manual faxing to a managed, cloud‑hosted eFax service, FOH will strengthen information security, reduce operational risk, improve efficiency, enhance service delivery, and support its mission of being the occupational health provider of choice for the Federal Government. This contract establishes the requirements for a comprehensive, enterprise‑ready eFax capability fully aligned with FOH’s operational, technical, and security needs.

C.3 Scope The Contractor shall provide, implement, and sustain a fully managed, cloud-hosted, Commercial-off-the-Shelf (COTS), Software-as-a-Service (SaaS) electronic fax (eFax) solution for the Federal Occupational Health (FOH) enterprise. The solution shall support all FOH program areas and geographically dispersed service locations, including clinical sites, administrative offices, and remote operational environments. To deliver this enterprise-wide managed eFax service, the Contractor shall furnish all management, personnel, equipment, tools, materials, supplies, supervision, and support services necessary to accomplish the following:

• Implementation & Configuration – Plan, configure, integrate, and deploy the eFax solution across the FOH enterprise.

• Operations & Maintenance – Operate, monitor, and maintain the solution to ensure reliability, scalability, and continuous availability.

• Security & Compliance – Secure the solution and ensure ongoing compliance with all applicable federal requirements.

• Quality & Continuous Improvement – Conduct quality assurance, risk management, and continuous improvement activities throughout the life of the contract.

• Documentation & Testing – Develop and maintain all required documentation and perform testing to validate solution performance and integrity.

The Contractor shall establish and maintain governance processes necessary to ensure effective management of functional requirements (Section 6), technical requirements (Sections C.5.2 and 6), operational requirements (Sections C.5.1 and C.5.2.3), security requirements (Section 7), and performance requirements (Section 8) throughout the contract lifecycle.

C.4. Performance Details

C.4.1 Performance Period The period of performance for this contract shall consist of the following twelve (12) month base period, followed by up to four (4) additional twelve (12) month option periods, to be exercised at the sole discretion of the Government in accordance with Federal Acquisition Regulation (FAR) requirements.

• Base Period – 9/25/2026-9/24/2027

• Option Period 1 – 9/25/2027-9/24/2028

• Option Period 2 – 9/25/2028-9/24/2029

• Option Period 3 – 9/25/2029-9/24/2030

• Option Period 4 – 9/25/2030-9/24/2031

Unless otherwise directed in writing by the Contracting Officer (CO) or Contracting Officer’s Representative (COR), onsite work at Government‐controlled facilities shall not occur on Federal holidays or weekends. When mission needs are required, the CO/COR may authorize Contractor personnel to perform work during weekends or Federal holidays.

As part of the Department of Health and Human Services (HHS), Federal Occupational Health (FOH) observes the eleven (11) Federal holidays established under 5 U.S.C. § 6103:

Holidays Set by Dates:

• New Year’s Day – January 1

• Juneteenth National Independence Day: June 19

• Independence Day – July 4

• Veterans Day – November 11

• Christmas Day – December 25

If any of the above dates fall on a Saturday, the holiday will be observed on the preceding Friday.

If any fall on a Sunday, the holiday will be observed on the following Monday.

Holidays Set by Day of the Week:

• Martin Luther King Jr. Day – Third Monday in January

• President’s Day (Washington’s Birthday) – Third Monday in February

• Memorial Day – Last Monday in May

• Labor Day – First Monday in September

• Indigenous People’s Day (Columbus Day) – Second Monday in October

• Thanksgiving Day – Fourth Thursday in November

C.4.2 Place of Performance The majority of services under this contract shall be performed at the Contractor’s facilities using Contractor‐provided, cloud‐hosted resources approved for use within a FedRAMP‐authorized environment. Work performed at Government facilities shall be limited to meetings, technical reviews, security assessments, or operational activities that require physical access to FOH or HHS sites.

Primary Government locations include:

• Parklawn HHS Building, Rockville, Maryland

• Hubert H. Humphrey (HHH) Building, Washington, DC

Additional work may occur at FOH Service Provision Sites (SPS), FOH clinical centers, administrative offices, or other locations designated by FOH to support enterprise‐wide eFax service deployment and sustainment.

All onsite activities shall comply with HHS and FOH facility access control requirements, including escort procedures, PIV card requirements (as applicable), security screening, and adherence to official building hours.

The Contractor shall ensure all remote, onsite, and hybrid work arrangements fully support uninterrupted delivery of managed eFax services across FOH’s nationwide operational footprint.

C.5. Specific Tasks & Deliverables

C.5.1 - Program Management Effective program management is essential to ensuring that the FOH enterprise eFax service is implemented, operated, and sustained in alignment with FOH mission needs, stakeholder expectations, and federal requirements. The Contractor shall provide comprehensive program management support throughout the contract lifecycle, encompassing planning, governance, reporting, staffing, communications, and coordination with FOH, as directed by the COR. The Contractor's program management approach shall ensure the eFax service is delivered as a fully managed, secure, FedRAMP-authorized SaaS capability with minimal operational burden on

FOH

C.5.1.1 Contractor Program Management Plan (CPMP) The Contractor shall develop, deliver and maintain a Contractor Program Management Plan (CPMP) that describes the strategy, structure, methods, tools, and processes the Contractor will use to manage the FOH eFax program. The CPMP shall describe how the Contractor will organize, execute, monitor, and control all work under this contract.

At a minimum, the CPMP shall include:

• Program governance model and organizational structure

• Roles and responsibilities of all Contractor personnel

• Work plan and project schedule including milestones, dependencies, and deliverable timelines

• Resource allocation and staffing plan

• Risk management and mitigation processes

• Issue tracking and resolution procedures

• Quality management and continuous improvement processes

• Communications and reporting structure

• Change control and configuration management procedures

• Performance measurement and SLA monitoring approach

• Security, privacy, and compliance alignment (including FedRAMP, HIPAA, HHS/PSC/FOH policies)

Delivery Requirements:

• Initial CPMP is due within 30 calendar days of contract award

• Updated annually and upon FOH/COR direction

Deliverable: Contractor Program Management Plan (CPMP)

C.5.1.2 Reporting Requirements

C.5.1.2.1 Monthly Configuration and Deployment Status Reports The Contractor shall develop and deliver a Monthly Configuration and Deployment Status Reports that summarize configuration and deployment activities, performance metrics, compliance status risks, and task completion during each reporting period.

Each Monthly Progress Report shall include:

• Summary of work completed during the reporting period

• Planned activities for the next reporting period

• Risks, issues, and mitigation plans

• SLA performance and service availability metrics

• Trouble ticket statistics and resolution timelines

• Status of deliverables and milestones

• Summary of any security, privacy, or compliance related events

• Contractor or FOH dependencies that may impact performance

• Anticipated schedule, resource, or technical challenges

Deliverable: Monthly Configuration and Deployment Status Report

C.5.1.2.2 Monthly Utilization and Status Report The Contractor shall provide FOH with a Monthly Utilization and Status Reports that summarizes system utilization, operational performance, and service behavior for the managed eFax solution.

Each report shall include at a minimum:

• Inbound and outbound fax utilization metrics, including total volumes, peak usage periods, concurrency utilization, retry rates, and delivery success/failure counts

• Month-over-month trend analysis for fax volume, SLA performance, and incident activity

• Operational performance metrics, including routing performance, workflow exceptions, and system health indicators

• Inbound fax details: date, time, originating fax number, receiving fax number, number of pages and transmission status (complete, busy, incomplete)

• Outbound fax details: date, time, originating fax number, destination fax number, number of pages and transmission status (complete, busy, incomplete)

• Trouble ticket and incident activity related to utilization trends

• Capacity or performance considerations that may affect FOH program areas

• Service‑Specific SLA (SSLA) Compliance Reporting, including:

o Monthly availability performance o Mean Time to Restore (MTTR) compliance o Inbound and outbound fax delivery performance o Concurrency performance against required thresholds o Notification and outage reporting compliance o Any SLA or SSLA failures, root cause analysis, corrective actions, and applicable SLA credits

Deliverable: Monthly Utilization and Status Report (including SSLA Compliance Reporting)

C.5.1.3 Key Personnel The Contractor shall designate a Program Manager as the sole Key Personnel position for this contract. The Program Manager shall serve as the primary point of contact for all contract administration matters and shall be responsible for overall contract performance, deliverable quality, and FOH communications.

The Program Manager shall possess at least five years of experience managing enterprise SaaS or telecommunications services contracts of similar scope and complexity.

The Contractor shall submit the Program Manager's resume at time of award and upon any substitution.

The Contractor shall notify the COR at least 15 business days in advance of any planned substitution and ensure an effective transition of knowledge and skills to avoid any performance delays/gaps. For unplanned changes, the Contractor shall notify the CO, FOH, and the COR as soon as practicable and propose a qualified replacement within 5 business days.

Deliverable: Program Manager Designation (including resume)

C.5.1.4 Transition-In (Base-Year Only) The Transition-In process shall achieve the following objectives:

Effective transition-in is essential to ensure a smooth, orderly migration from FOH’s existing faxing environment to the new FedRAMP authorized, cloud-based enterprise eFax service. The Contractor shall develop and execute a Transition-In Plan that enables FOH to move from the current manual and legacy fax processes to the fully managed eFax solution with minimal operational disruption.

C.5.1.5.1 Transition-In Objectives The Transition-In process shall focus on achieving the following objectives:

• Establish the technical, operational, and security foundations of the FOH eFax service

• Complete all onboarding and configuration tasks following an industry‑standard, phased cloud service implementation methodology

• Ensure continuity of operations for all FOH service areas during migration from existing fax workflows

• Prepare FOH users to operate using the new digital faxing workflows

• Complete number porting and routing configuration to ensure uninterrupted receipt of inbound faxes

C.5.1.5.2 Transition-In Activities The Contractor shall:

a) Provide all personnel, planning, coordination, and technical resources required for a successful transition in accordance with the approved schedule.

• Develop and maintain an integrated transition schedule aligned with a structured, phased onboarding model (planning, design, deployment, and transition)

b) Conduct discovery activities to confirm FOH business workflows, routing requirements, and number porting needs.

c) Preparing ATO documentation to support compliance with HHS/FOH and federal security requirements.

d) Configure email routing, inbound fax workflows, outbound fax capabilities, and administrative tools.

e) Implement secure cloud-based fax routing workflows, including email-based send/receive and other integration models.

f) Coordinate and complete number porting activities, including Letter of Authorization (LOA) processing, carrier coordination, and validation.

g) Provide regular status updates and escalate risks as they occur.

h) If number porting is delayed due to circumstances outside the Contractor's control (e.g., carrier non-responsiveness or regulatory holds), the Contractor shall notify the COR within 2 business days of identifying the delay, provide a written impact assessment, and propose a revised porting schedule and contingency approach to maintain continuity of inbound fax operations.

Transition-In Phases The Contractor shall follow a structured onboarding and implementation framework. The overall duration shall be determined by the approved Transition-In Plan and integrated schedule, subject to ATO authorization timelines. To maximize efficiency, the Contractor shall sequence activities so that those not requiring ATO approval — such as discovery, planning, number inventory, carrier coordination, and administrative configuration — are initiated and completed as early as practicable. Activities requiring ATO authorization shall commence upon issuance of the ATO.

The Contractor shall identify all phase dependencies, concurrent activities, and ATO-gated milestones within the integrated transition schedule.

Phase I: Planning and Initial Setup

• Conduct kickoff meetings with FOH program, IT, and security staff.

• Perform discovery of business workflows, routing needs, and inbound/outbound requirements.

• Validate FOH eFax Requirements and site characteristics.

• Begin number inventory and porting readiness.

• Identify any legacy fax dependencies.

• Initiate ATO documentation activities.

Phase II: Service Configuration and Integration

• Configure inbound fax-to-email routing, outbound email-to-fax workflows, and designated routing rules.

• Confirm compatibility with Microsoft 365 and FOH email security configurations.

• Configure administrative consoles and access roles.

• Integrate collaboration or messaging tools, as directed by the COR.

• Establish logging, reporting, monitoring, and auditing functionality.

• Conduct preliminary functional testing.

Phase III: Deployment and Limited Operational Capability

• Deploy initial configurations to pilot FOH sites.

• Execute phased number porting; validate each port event.

• Validate inbound fax receipt, routing accuracy, and outbound transmission.

• Optimize workflows, routing rules, and exception handling.

• Remediate defects or issues identified during initial deployment.

Phase IV: Enterprise Readiness and Full Transition

• Expand rollout to all FOH clinical and administrative sites.

• Complete final number porting for all FOH lines.

• Validate performance, reliability, concurrency, and SLAs.

• Finalize security controls, logging, and reporting mechanisms.

• Prepare the solution for long-term steady-state operations.

Deliverables:

• Transition-In Plan (including integrated schedule)

• Number Porting Plan

• Number Porting Status Updates (at each porting milestone)

• Site Configuration and Onboarding Documentation (within 5 business days of each site activation)

• Initial Operational Capability (IOC) Readiness Report (upon Phase III completion)

C.5.2. Technical Tasks

C.5.2.1. Technical Discovery and Requirements Validation The Contractor shall conduct technical discovery activities to validate and update FOH workflow requirements throughout the contract period. Initial discovery activities shall be performed during Transition-In Phase I (see Section 5.1.4); subsequent discovery shall address new program areas, site additions, or workflow changes arising during Option Years.

The contractor shall:

• Confirm inbound and outbound fax workflow requirements.

• Validate FOH IT eFax Requirements for all program areas.

• Identify fax numbers requiring porting or reconfiguring and identify any legacy fax dependencies.

• Document integration requirements needs with FOH email systems and operational workflows.

• Produce and maintain formal eFax workflow documentation based on stakeholder input

Deliverable: Technical Discovery Summary (including documented eFax workflows)

C.5.2.2 Ongoing Configuration and Integration Following completion of Transition-In, the Contractor shall manage all configuration changes, integration updates, and platform modifications required to sustain and improve the FOH eFax service during steady-state operations. All configuration changes shall be submitted through the FOH change control process prior to implementation.

a) Process and implement approved configuration change requests

b) Maintain and update inbound/outbound routing rules, access roles, and administrative console settings

c) Ensure continued compatibility with Microsoft 365 and FOH email security configurations as updates are applied

d) Support integration with any additional FOH tools or systems as directed by the COR

e) Maintain logging, reporting, monitoring, and auditing configurations

f) Provide knowledge-transfer sessions for FOH administrators as needed

Deliverables: Configuration Documentation; Integration Validation Report

C.5.2.3 Operational Monitoring and Support The Contractor shall provide technical support coverage during FOH core business support hours, including system monitoring, incident response, troubleshooting, and operational analytics. Core business support hours shall be 7:00 a.m. to 9:00 p.m. Eastern Time (ET), Monday through Friday, excluding Federal holidays unless otherwise specified by the Contracting Officer. The Contractor shall maintain staffing and operational support capabilities sufficient to support FOH users across all U.S. time zones, including users located in the Pacific Time Zone, throughout the designated support period.

The Contractor shall:

a) Monitor service availability and SLA performance continuously

b) Receive and address trouble tickets reported by FOH users and the FOH Application Support team

c) Provide real-time dashboards accessible to FOH

d) Perform Government-approved software updates, patches, and platform maintenance

e) Maintain system logs and auditing capabilities

f) Provide FOH with the ability to submit and electronically track support issues

Deliverables: Monthly Operational Report; Incident Response Logs

C.5.2.4 System Testing and Validation The Contractor shall conduct comprehensive testing to ensure full and accurate functionality, including:

• Functional testing (inbound, outbound, routing rules, retries).

• Volume and concurrency testing (minimum 3–4 simultaneous lines per FOH requirements).

• Security testing aligned with FOH’s ATO process.

• Failover and resiliency testing.

• User acceptance testing (UAT) with FOH.

Deliverables: Test Plan; Test Results; UAT Sign-off

C.5.2.5 Deployment and Site Enablement Following successful Configuration and Integration and testing, the Contractor shall deploy the eFax solution t to FOH users as directed by the COR, including

• Coordinating rollout with FOH users.

• Executing the eFax aligned cutover timeline.

• Validating successful operations after deployment.

• Providing deployment specific documentation and readiness checklists.

Deliverable: Deployment Completion Report

C.5.2.6 Technical Documentation and Training The Contractor shall develop, maintain and deliver all technical documentation required to support FOH operations. All documentation shall be kept current throughout the contract period.

Updated versions shall be delivered to FOH within 5 business days of any revision, new release, or update.

Documentation and training deliverables include:

a) Technical Standard Operating Procedures (SOPs)

b) End-user and administrator training materials

c) Technical and administrative manuals

d) Configuration, architectural, and security documentation

e) Software update and patch release notes

The Contractor shall clearly distinguish between Contractor-owned training materials and any Government-approved or Government-owned materials and shall obtain COR approval before modifying Government-owned content.

Deliverables: Technical SOPs; Training Materials; Architecture Documentation

C.5.2.7 Enterprise Performance Lifecycle The Contractor shall develop, review and advise on the IT system, design, planning, and implementation requirements according to the HHS EPLC process. The Contractor shall provide support throughout implementation and maintenance of the system, FOH The Government shall manage EPLC documentation over the lifecycle of the system with support from the Contractor, as appropriate. The Government or designee shall notify the Contractor of any required revisions and recommendations identified during the review process that require changes to the documentation or affect the management and/or direction of the program over the life cycle of the system. The Government shall manage, review, and provide final approval on all Contractor furnished content supporting the EPLC.

C.6.1 Functional Requirements

C.6.1.1 Inbound Fax Reception and Digital Conversion

• Receive inbound faxes over standard fax protocols on existing FOH numbers. Convert to a digital format (PDF preferred) and deliver to designated email inbox(es).

• Support multiple simultaneous inbound lines to prevent queueing delays; solution shall sustain at least 3–4 concurrent fax lines at initial scale, with ability to expand.

C.6.1.2 Email Based Routing

• Route converted inbound faxes (attachments) automatically to one or more FOH email destinations (single mailbox, distribution lists, or role based shared inboxes). Include originating fax number metadata in subject/body where feasible.

C.6.1.3 Outbound Faxing

• Support email to fax workflows: authorized users send email with attachments

(PDF/DOC/DOCX/TXT, etc.); the service converts and transmits as fax. Provide status notifications (success, failure, retry). Provide alternate outbound method if email to fax is unavailable.

C.6.1.4 Number Portability

• Port existing FOH fax numbers to the cloud service without business disruption. Maintain a

Number Porting Plan, coordinate LOAs and carrier interactions, and validate receipt post port for each line.

C.6.2 Non Functional Requirements

C.6.2.1 Reliability and Availability

• Provide enterprise reliability targets and high availability; solutions should be ≥99.9% uptime and include queuing/retry logic to mitigate temporary network issues.

C.6.2.2 Performance and Concurrency

• Process inbound/outbound transactions without exceeding acceptable response times under typical load. (Reference SLA targets in Section 8 for detailed thresholds.)

C.6.2.3 Security and Privacy (Technical Controls)

• Protect confidentiality and integrity of PHI/PII throughout transmission and processing; use

FIPS validated cryptography consistent with FOH/HHS standards. Do not retain fax payloads at rest; any service side handling shall be transient/buffered and purged on failure.

C.6.2.4 Usability

• Keep workflows intuitive and minimize training. Email inbox access and email based send should require no specialized client software on FOH endpoints.

C.6.2.5 Maintainability & Supportability

• Provide clear logs, diagnostics, and configuration documentation to aid FOH troubleshooting and operations. Support and standardized change procedures.

C.6.2.6 Scalability

• Support growth in lines and volume; scale beyond initial 3–4 lines to sustain higher throughput as program needs expand.

C.6.3 Interoperability & Integration

C.6.3.1 Email & Identity

• Interoperate with FOH’s Microsoft 365 environment (allowlists/domains/IPs as needed).

Apply role-based access aligned to FOH identity governance.

C.6.3.2 Administrative Interfaces

• Provide secure, web-based admin consoles for routing rules, user/role management, and audit/report access. Support directory synchronization (AD/LDAP) where applicable.

C.6.3.3 Reporting, Logging, and Auditing

• Expose operational data (source/destination numbers, timestamps, file types, status, counts, uptime) and searchable logs for compliance and service management. Support export in standard formats (CSV/PDF).

C.6.3.4 Data Handling & Persistence

• Delete documents no later than 24 hours following successful completion of transmission or expiration of retry attempts unless otherwise authorized in writing by the Government; only maintain transient buffers for retries, then purge after defined retry counts. (No long-term storage of fax payloads in the provider’s domain. Fax payloads may be retained only for the minimum period necessary to support successful transmission, receipt, retry processing, or troubleshooting activities and shall be permanently deleted.)

• All fax metadata, reports, configuration data, documentation, and information generated in performance of this contract shall remain the property of the Government.

C.6.3.5 Numbering & Dialing

• Support North American Numbering Plan (NANP) dialing and FOH tollfree/DID assignments; manage inventory and annual reporting of FOH owned numbers.

(Inventory/reporting cadence defined in Section 5.2.4.)

C.6.4 Document Formats & Content Features

• Accept common business formats for outbound faxing (PDF, DOC/DOCX, TXT; image formats as supported). Provide date/time stamps on received items. (Advanced OCR/IDR/ICR and barcode-based routing are optional features; include only if requested by

FOH.)

C.6.5 Compliance & Accessibility

• Meet HIPAA and Privacy Act handling requirements for PHI/PII workflows. (Security/ATO specifics in Section 7.)

• Conform to Section 508 / HHS Digital Accessibility standards for user facing portals and documentation.

• Align with FOH/HHS encryption standards and records retention/sanitization guidance

(NIST SP 800-88).

C.6.7 Constraints & Implementation Timing

• Integrate with legacy fax infrastructure used by external providers; the solution cannot rely solely on partners switching to non-fax channels. Support immediate implementation and staged rollout with pilot → enterprise migration per Transition In.

C.6.8 Acceptance Criteria (Summary) The technical solution will be accepted when the Contractor demonstrates:

• Inbound/outbound email fax functionality operating on FOH numbers, with correct routing to designated inboxes.

• Concurrency of at least 3–4 simultaneous lines with successful retry logic and status notifications.

• Number porting completed for pilot lines with validated inbound receipt post port event.

• Number porting shall be considered complete only when the Government validates successful inbound and outbound fax transmission using the ported number and confirms routing accuracy.

• Logging/reporting available to FOH with searchable audit trails and export.

• No payload retention at rest; transient buffering only, with purge on failure; encryption in transit per FOH/HHS standards.

In addition, the following shall be completed to the government’s satisfaction and COR acceptance:

• Successful completion of UAT

• Successful security testing

• Successful number port validation

• Successful SLA demonstration

C.6.9 Technical Deliverables

• Technical Requirements Baseline & Traceability Matrix (TRTM) – mapping FOH requirements to platform capabilities and test cases.

• Number Porting Plan & Inventory – master list of FOH numbers, port status, and validation results (aligned to Section 5.2.4).

• Routing & Integration Configuration Guide – email allowlists/domains/IPs, inbox definitions, role mappings, and retry policies.

• Reporting & Audit Specifications – fields, retention, export formats, and access controls.

Data Handling & Sanitization Procedure – transient buffer limits, purge conditions, and sanitization steps referencing NIST SP 80088.

C.7 Security, Privacy, and Authority to Operate (ATO) This section defines the security, privacy, FedRAMP, and Authority to Operate (ATO) requirements for the FOH enterprise eFax service. The Contractor shall ensure the solution complies with all applicable federal laws, HHS/PSC/FOH policies, and FedRAMP requirements necessary to protect FOH information systems and sensitive data, including PHI, PII, and Controlled Unclassified Information (CUI).

The proposed solution shall operate within a cloud environment that maintains an active FedRAMP High Authorization throughout the period of performance. FedRAMP Ready status shall not satisfy this requirement.

C.7.1 General Security Requirements The Contractor shall:

• Implement all security and privacy controls required for a federal information system categorized at FIPS 199 Moderate impact.

• Protect the confidentiality, integrity, and availability of data processed or transmitted by the eFax solution.

• Ensure all components of the service operate within a FedRAMP authorized cloud environment at the Moderate or High baseline, as appropriate.

• Ensure the eFax service supports secure transmission of PHI/PII and complies with the

HIPAA Security and Privacy Rules.

• Prevent any long-term retention of fax payload data; only transient buffering for retries is allowed, consistent with FOH requirements.

C.7.2 FedRAMP Authorization Requirements The Contractor shall:

• Host the eFax platform exclusively in a FedRAMP authorized cloud environment.

• Leverage the cloud provider’s inheritance model and document how inherited controls apply to the eFax service.

• Maintain continuous compliance with FedRAMP requirements, including security documentation, vulnerability management, and continuous monitoring.

• Provide FOH with access to the system’s FedRAMP package or the relevant authorization artifacts when required.

C.7.3 Authority to Operate (ATO) FOH requires the Contractor to fully support the issuance and maintenance of an ATO for the eFax service under the HHS Risk Management Framework.

The Contractor shall deliver and maintain, at minimum, the following artifacts in alignment with HHS/PSC/FOH requirements:

• System Security Plan (SSP)

• Privacy Impact Assessment (PIA) or supporting artifacts

• Security Assessment Report (SAR)

• Risk Assessment (RA)

• Information System Contingency Plan (ISCP)

• Incident Response Plan (IRP)

• Disaster Recovery Plan (DRP)

• Plan of Action and Milestones (POA&M) for any outstanding vulnerabilities

The Contractor shall:

• Participate in assessment activities performed by independent assessors.

• Maintain all ATO documentation as “living” artifacts throughout the contract.

• Remediate vulnerabilities within timeframes defined by HHS or FedRAMP (e.g., high/critical findings within mandated deadlines).

C.7.4 Data Security and Encryption Requirements The Contractor shall ensure:

• Encryption in transit using FIPS validated TLS.

• Encryption at rest, where applicable within cloud infrastructure (e.g., system metadata, logs), following HHS encryption standards.

• Zero retention of fax document payloads after successful transmission or after defined retry attempts.

• Secure, role-based access controls aligned with FOH identity governance and Microsoft 365 integration.

C.7.5 Privacy and CUI Requirements

• The Contractor shall:

• Adhere to HIPAA, the Privacy Act of 1974, and FOH/HHS privacy policies.

• Ensure completion of a Privacy Threshold Analysis (PTA) and support updates if a PIA is required.

• Support proper marking, safeguarding, and handling of Controlled Unclassified Information

(CUI).

• Ensure all data handling and retention procedures comply with HHS Records Management and NARA requirements.

C.7.6 Incident Reporting and Breach Response The Contractor shall:

• Report suspected or confirmed security incidents within one (1) hour to FOH and HHS-designated contacts in accordance with federal policy.

• Provide all supporting data required for investigation, including logs, audit trails, and system information.

• Cooperate fully with FOH, PSC, HHS CSIRC, and federal oversight authorities.

• Follow HHS breach response rules for PII/PHI.

C.7.7 Personnel Security Requirements The Contractor shall:

• Ensure all staff with access to FOH systems or data complete the required HHS/PSC/FOH security, privacy, and records management training before gaining access.

• Submit and maintain a complete Contractor Staff Roster for individuals requiring logical or physical access.

• Ensure personnel undergoes required background investigations, commensurate with sensitivity levels.

• Immediately notify FOH when staff with access privileges are removed, replaced, or reassigned.

C.7.8 Network and Connectivity Requirements

• Ensure the solution integrates securely with FOH systems, including Microsoft 365, through approved methods such as allow-listing and boundary protections.

• Comply with HHS network security standards, including TIC aligned requirements when applicable.

• Ensure all administrative interfaces are accessible only through secure connections using multifactor authentication and role-based authorization.

C.7.9 Logging, Monitoring, and Continuous Security The Contractor shall:

• Provide continuous monitoring of system health, performance, and security.

• Maintain audit logs necessary for compliance, troubleshooting, and incident response.

• Support FOH oversight by providing log exports, dashboards, and audit trails.

C.7.10 Business Continuity and Disaster Recovery The Contractor shall:

• Maintain a Disaster Recovery Plan (DRP) and Continuity of Operations (COOP) plan.

• Support annual testing of DR/COOP procedures.

• Meet FOH defined RTO/RPO requirements and restore services with minimal operational disruption.

C.7.11 Security Deliverables Deliverables under this section include at a minimum:

• System Security Plan (SSP)

• Privacy Threshold Analysis (PTA) and PIA (if required)

• Incident Response Plan (IRP)

• Information System Contingency Plan (ISCP)

• Disaster Recovery Plan (DRP)

• Security Assessment artifacts

• Continuous Monitoring reports

• Monthly vulnerability and remediation reports

• POA&M updates

C.7.12 Multifactor Authentication The Contractor shall ensure that the systems under this contract implement and enforce Multi- Factor Authentication (MFA) in accordance with Section 3 of Executive Order 14028, Improving the Nation’s Cybersecurity, as well as guidance issued by the Cybersecurity and Infrastructure Security Agency (CISA), the Office of Management and Budget (OMB), and the National Institute of Standards and Technology (NIST).

The Contractor shall implement MFA for all users accessing cloud-based systems, including but not limited to the following:

• Federal employees, contractors, and authorized third parties.

• Privileged and administrative accounts.

• Non-privileged user accounts accessing government data and systems.

The MFA must:

• Utilize at least two authentication factors (e.g., something you know, something you have, something you are).

• Align with NIST SP 800-63B (Digital Identity Guidelines) requirements for authentication assurance.

• Support phishing-resistant MFA for privileged accounts, in compliance with OMB

Memorandum M-22-09.

• The Contractor shall coordinate with the FOH/COR, at the FOH/COR’s discretion, to plan, schedule, implement, and verify all necessary MFA actions, including coordination with third parties.

C.8 SLAs / Service Levels This section defines the Service Level Agreements (SLAs) governing performance, availability, responsiveness, and quality of the FOH enterprise eFax service. These SLAs establish clear, measurable expectations for the Contractor and ensure that FOH receives a reliable, secure, and mission-ready cloud faxing capability.

SLA remedies and service credit calculations, if applicable, will be established at contract award.

C.8.1 SLA Framework Overview The eFax service shall be monitored and measured using the following categories of performance:

• Availability SLAs – ensuring the service is accessible and operational.

• Responsiveness SLAs – ensuring prompt response to service-impacting issues.

• Operational SLAs – ensuring timely processing of faxes, service requests, and routing operations.

• Notification SLAs – ensuring FOH is promptly informed of outages, events, or changes.

• Business Continuity SLAs – ensuring resilience and recovery capabilities.

• Performance Credits & Remedies – ensuring accountability and financial remedies for SLA failures.

C.8.1.1. Enterprise Service Level Agreement (SLA) Summary Table

Metric Requirement AQL Measurement Reporting Availability 99.9% uptime/month 0.1% max downtime Automated monitoring

Monthly

MTTR ≤4 hours 95% compliance Incident logs Monthly Inbound Fax

Delivery ≤60 seconds 99.5% compliance System reports Monthly

Outbound Fax Initiation

≤30 seconds 99.5% compliance

System reports Monthly

Status Notifications

≤5 minutes 99.5% compliance

System reports Monthly

Concurrency 3-4 concurrent lines minimum

99% compliance Performance monitoring

Monthly

Critical Incident Response

15-minute acknowledgement

100% Ticket records Monthly

Outage Notification

15 minutes 100% Incident records As Occurs

Security Incident

Notification

1 hour 100% Incident records As Occurs

RTO ≤12 hours 100% DR testing Annual RPO ≤2 hours 100% DR testing Annual

C.8.2 Service Availability (Key Performance Indicator) Service Availability Target: 99.9% uptime per calendar month.

• Downtime is any minute during which the eFax service cannot receive, process, or deliver inbound or outbound faxes.

• Scheduled maintenance windows shall be communicated at least 72 hours in advance.

• Unscheduled downtime beyond 45 minutes monthly is considered an SLA failure.

Measurement Method: Continuous automated monitoring and FOH dashboard reports.

Acceptable Quality Level (AQL): No more than 0.1% downtime per month.

Remedy: Corrective Action Plan and any contractually established service remedies.

C.8.3 Mean Time to Restore (MTTR) MTTR Target: Restore service within 4 hours for any service-impacting outage.

Measurement: Time between opening of a trouble ticket and confirmation of service restoration.

AQL: ≥ 95% of incidents resolved within 4 hours.

Measurement Method: Review of incident ticket records and monthly SLA reports.

C.8.4 Fax Delivery Performance SLAs Measurement Methods: Monthly utilization reports.

C.8.4.1 Inbound Fax Delivery

• 99.5% of inbound faxes shall be delivered to designated FOH email inbox(es) within 60 seconds of successful receipt by the service.

• 99.5% routing accuracy.

C.8.4.2 Outbound Fax Processing

• 99.5% of outbound fax attempts shall be initiated within 30 seconds of receipt of a valid email request.

• 99.5% delivery notifications (success/fail) shall be returned within 5 minutes.

These requirements reflect FOH’s functional needs and reliability expectations.

C.8.4.3 Fax Transmission Success Rate

• 98% successful transmission rate.

C.8.5 Concurrency SLAs The service shall support the concurrent transmission and receipt of faxes with no queuing delays for at least 3–4 simultaneous fax lines, scalable upward as FOH expands.

AQL: No more than 1% of faxes experiencing transmission delay attributable to concurrency limits.

Measurement Methods: Monthly performance reports and utilization statistics.

C.8.6 Support & Help Desk SLAs

C.8.6.1 Incident Response Time

• Critical incidents: Immediate acknowledgment within 15 minutes; full engagement within 1 hour.

• High-severity incidents: Acknowledgment within 1 hour.

• Low/Medium incidents: Acknowledgment within 4 hours.

AQL: 95% of incidents shall meet the applicable acknowledgment requirement.

Measurement Method: Incident response times shall be measured using the Contractor's ticket management system and reported monthly.

C.8.6.2 Ticket Resolution SLA

• Critical: 4 hours

• High: 1 business day

• Medium: 2 business days

• Low: 5 business days AQL: 95% of tickets shall meet the applicable resolution timeframe.

Measurement Method: Resolution times shall be measured using ticket open and close timestamps and reported monthly.

C.8.7 Notification SLAs

C.8.7.1 Outage Notifications

• FOH shall be notified within 15 minutes of system-classified outages.

C.8.7.2 Maintenance Notifications

• Routine maintenance: 72 hours advance notice.

• Emergency maintenance: 1 hour advance notice, when feasible.

C.8.7.3 Security Incident Notifications Security incident notification performance shall be measured in accordance with Section 7.6 Incident Reporting and Breach Response.8.8 Business Continuity & Disaster Recovery SLAs

C.8.8.1 Disaster Recovery

• Recovery Time Objective (RTO): ≤ 12 hours.

• Recovery Point Objective (RPO): ≤ 2 hours.

Measurement Method: Annual DR testing; Actual outage performance (if applicable)

C.8.8.2 Annual DR/COOP Testing

• Conduct annual DR/COOP testing

• Submit results within 30 days of testing

• Correct deficiencies within 30 days AQL: 100% compliance Measurement Method: Review of annual test reports

C.8.9 Service Level Remedies and Corrective Actions The Contractor shall monitor performance against all Service Level Agreements (SLAs) established in this Performance Work Statement and shall promptly notify the Government of any actual or anticipated SLA failures.

C.8.9.1 Corrective Action Requirements For any SLA failure, the Contractor shall:

• Notify the COR within two (2) business days of identifying the failure.

• Perform root cause analysis.

• Identify corrective and preventive actions.

• Provide a written Corrective Action Plan (CAP) within five (5) business days.

• Implement corrective actions within timelines approved by the Government.

C.8.9.2 Repeated SLA Failures Repeated failures of the same SLA metric may result in:

• Increased Government surveillance.

• Additional reporting requirements.

• Contractor performance concerns documented in CPARS.

• Consideration during option-year exercise decisions.

• Other remedies available under the contract.

C.8.9.3 SLA Performance Reporting All SLA failures, root cause analyses, and corrective actions shall be reported within the Monthly Utilization and Status Report required by Section C.5.1.2.2.

C.8.10 SLA Reporting Requirements SLA performance reporting shall be incorporated into the Monthly Utilization and Status Report required under Section C.5.1.2.2. Separate SLA reports may be provided at the Government's request.

These metrics support FOH’s governance and quality assurance model.

C.8.11 SLA Deliverables The Contractor shall provide SLA-related reporting through:

• Monthly Utilization and Status Reports (Section C.5.1.2.2)

• Annual DR/COOP Test Reports

• Incident Reports

• Corrective Action Plans (when required)

C.9.0 Documentation Requirements All deliverables shall be provided in FOH approved electronic formats including:

• Microsoft Word, Excel, PowerPoint, Project

• PDF

• CSV (for logs or reports) Documents shall be:

• Clear, consistent, version controlled

• Free from vendor branding unless approved by FOH

• Compatible with FOH’s accessibility and records management requirements

C.9.1 Government Furnished Information / Property (GFI/GFP) FOH does not anticipate providing hardware or equipment for this service.

The Contractor may receive access to FOH information, systems, or remote access tools in support of the eFax service.

All use shall comply with FOH/HHS policies for safeguarding government information.

No prohibited hardware, software, or services may be used in delivering the eFax service or its related components.

A detailed Transition Out plan will be required prior to the end of the performance period.

9.2 Contractor Responsibilities at Closeout

Upon FOH direction, the Contractor shall:

• Return all records, artifacts, and system documentation

• Provide data sanitization certificates

• Ensure all access privileges are revoked

• Provide written notification to the COR at transition‑out, including all required information

(such as personnel names, PIV/access status, and any system or data disposition details.

In short, transition-out support shall include transfer of configuration information, number inventories, routing tables, reporting data, documentation, administrative knowledge transfer, and support for migration to a successor provider.

C.10 Deliverables Table The Government shall have ten (10) business days to review submitted deliverables and either accept, reject, or request revisions.

Deliverable Section Description Frequency

Timing

Owner Acceptance Criteria

Base vs.

Option Year

Contractor Program Management Plan (CPMP)

C.5.1.1 Program plan with governance, schedule, risk, reporting

Initial 30 days;

Annual

Contractor Accepted by

FOH/COR

Base & All Years

Monthly Configuration and Deployment Report;

Monthly Utilization and Status Reports

C.5.1.2.

Monthly config, deployment, utilization reporting

Monthly Contractor FOH/COR acceptance;

completeness

All Years

Monthly Utilization and Status Report (including

SSLA

Compliance Reporting)

C.5.1.2.

Monthly report summarizing system utilization, fax activity, and SSLA compliance, including performance metrics, issues, and any required corrective actions

Monthly Contractor FOH/COR acceptance;

completeness

All Years

Key Personnel List

5.1.3 List of key

staff with roles & training

30 days;

Updates

Contractor FOH/COR approval

Base & All Years

Configuration and Integration Plan

5.1.5.1

Documents the planned approach, sequencing, and activities for eFax configuration and onboarding.

Once (Base Year)

Contractor FOH/COR acceptance

Base Year Only

Config…