BNJ_APPLE_CCPC cdpV2_Redacted.pdf

JUSTIFICATION AND APPROVAL

BRAND NAME

CONNECTED CARE PRODUCT CATALOG

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Acquisition Operations

Strategic Acquisition Center (SAC) 10300 Spotsylvania Ave, Suite 400 Fredericksburg, VA 22408

2. Description of Action:

The purpose of this action is to justify VA’s need for Apple Inc. brand name items for the Connected Care Product Catalog (CCPC) Blanket Purchase Agreement (BPA) Contracts. The required items are mobile devices that are used to deliver VA health care services to Veterans. VA’s connected care technology network includes the combined VA ecosystem of clinical video equipment and software; store and forward technologies; web and mobile health applications; software-as-a-service (SaaS) technologies; commercial-off-the-shelf (COTS) software products; mobile medical devices, peripherals, and wearables; remote patient monitoring technologies; online health portals; future connected care technologies; and ancillary items. The network supports the delivery of Mobile Applications and Telehealth services, including Clinical Video Telehealth (CVT) via the Clinical Enterprise Video Network (CEVN), Store and Forward Telehealth (SFT), and Home Telehealth (HT).

This Brand Name Justification (BNJ) for brand name products only covers a portion of the procurement (18 out of 266 contract line items) and the brand name, as detailed below, is required for seamless operation of the connected care technology network.

Aside from these 18 line items and separate BNJs, the procurement will be solicited as Full and Open Competition and conducted utilizing Federal Acquisition Regulation (FAR) Part 12 in conjunction with FAR Part 13.

3. Description of Supplies or Services:

OCC established a connected care technology network for the distribution of health care, self-care, and related services that consists of telehealth devices, web and mobile medical applications, and online health platforms. These connected care technologies expand the operations of VA’s expansive health care network by remotely connecting Veterans with health care professionals who can best meet their needs. The scale of VA’s connected care program and its basis is unique. The products and services provided by OCC comprise the largest, most innovative virtual care program in the US, used throughout all 50 states and US territories.

Historically, all products and contractor support for VA’s connected care technology network have been delivered through the single-award Clinical Enterprise Video Network (CEVN) Blanket Purchase Agreement (BPA) (VA119-15A-0131), awarded in 2015, and the follow-on, single-award OCC Equipment and Services Transition Requirements Contract (36C10G21D0016), awarded in 2021. Acquisition planning for future connected care technology network support has resulted in the development of three distinct and separate contracts to leverage innovation and flexibility to meet mission needs by establishing:

a) Program Support Integration (PSI), planned as a single-award IDIQ responsible for all program and project management functions required by OCC, including program integration and program support; project, release, and implementation management; communications; and training.

b) Connected Care Integrated Network (CCIN), planned as a single-award IDIQ responsible for all technical support services required by OCC, including product ordering, inventory, and asset management; help desk support; connected care technology software and mobile medical application design, development, enhancement, and remediation; infrastructure and architecture support.

c) Connected Care Products Catalog (CCPC), planned as a catalog of multiple BPAs and outlined below.

VHA will utilize the CCIN contract for product ordering, distribution, and inventory and asset management services. The CCIN Contractor will place orders against the CCPC Product List, which will be formed by awarding Blanket Purchase Agreements (BPA) to Original Equipment Manufacturers (OEM), suppliers, and authorized resellers of connected care technologies (referred to as “BPA Holders”).

This procurement will establish multiple BPAs in direct support of VA’s Connected Care Program. This procurement is a key element in the success of the program as the BPAs will provide the mechanism that will supply connected care products for distribution to VHA facilities located in the United States (US) and US Territories. The CCPC Product List will include all supplies awarded under BPAs.

The period of performance (PoP) is anticipated to be 60 months from the date of award.

This BNJ covers the Apple Inc. brand name items throughout the PoP. The justification for these brand name items is included in the sections below:

Product Description: VA issues mobile devices, i.e., tablets, to clinical providers and patients to initiate and participate in telemedicine appointments and to reduce VA staff exposure to Veterans hospitalized with transmissible diseases such as COVID-19 as well as to allow Veterans to communicate with family members at a distance and to receive VA education on self-care, virtual care, and other topics. To date, VA has approximately 130,000 tablets in use by Veterans and in VA facilities. To support ongoing clinical care, VA providers and patients will continue to need tablets that are approved to operate on and with VA systems.

Justification: VA’s Office of Information and Technology (OIT) evaluates and approves hardware and software products that run on VA networks. The evaluations are based upon Federal Government standards that are derived from well-known sources such as Homeland Security Presidential Directive 12 (HSPD-12) and National Institute of Standards & Technology (NIST) 800-157 that specify minimum requirements for user authentication, role-based access, logging, and security of data in transit and at rest.

Based on these standards and other relevant security requirements, VA OIT has determined that the only mobile device operating system approved for general use on VA networks is iOS, a proprietary Apple operating system. Apple mobile device hardware are the only devices that run the proprietary iOS operating system. If in the future, when other mobile device operating systems are approved for use on the VA network, VHA will evaluate purchasing mobile devices from non-Apple vendors.

After a careful review of all applicable standards and policies, VA subscribes to the following mobile device operating system minimum requirements, currently met only by the unique capabilities of Apple’s iOS:

VA requires that Operating System (OS) security vulnerabilities be patched in 30 days for critical, 60 days for moderate, and 90 days for minor deficiencies from the time of discovery through the life of the device. The updates must be delivered to all devices, regardless of age in the lifecycle, at the same time through an automated deployment technology. Apple device updates are deployed to their mobile devices directly from their OEM-controlled software deployment infrastructure. For a non-Apple OS to be approved for use on our network, the OEM of the device would need to demonstrate a similar capability.

Apple’s iOS has demonstrated that it can successfully interface with VA’s derived credential solution (Entrust) to ensure VA employees remain two-factor authentication (2FA) enabled to meet HSPD-12 and NIST 800-157. The ability of a user’s Active Directory identity to be passed to various applications and the data sources the end user needs to access applications is critical to ensure proper implementation of least privilege and access logging in accordance with Federal security standards. To date, VA has not been able to demonstrate that non-Apple mobile operating systems can consistently interface with its derived credential infrastructure.

A demonstrated OEM commitment must be present that ensures the major OS version continues to work with the derived credential solution (Entrust) in future patches and update releases. All updates must be tested against the derived credential functionality and issues remediated within 24 hours of discovery. Apple has demonstrated a multi-year commitment to ensuring compatibility of IOS with VA’s derived credential infrastructure. Apple’s iOS beta tests major iOS versions to ensure VA’s derived credential solution continues to work. Failure of any mobile device operating system vendor to ensure all OS upgrades work with VA’s derived credential essentially causes a work stoppage on the device since a user would be unable to authenticate to VA resources.

Mobile devices must be able to run the latest operating system, such as iOS 16, and must remain compatible with the latest OEM operating system for at least three years after delivery. Apple devices support the latest OS for at least 3-4 years.

Operating system settings and features (menu options, settings, location of native features, etc.) must be consistent while running the same version between the various devices through the 3-year life cycle of the device. This helps ensure ease of support by centralized VA helpdesks by allowing VA to easily maintain helpdesk scripts and user self-help documents. Apple has demonstrated that any device running the same iOS version has the exact same look and feel across its various hardware configurations, regardless of model. Non-Apple mobile operating systems are often customized by the device OEM and thus there are variants of the OS across OEMs that make consistent help desk documentation harder to maintain.

Devices must be able to be provisioned by VA’s mobile infrastructure via wireless services, including mobile device management (MDM) systems. This includes the ability to accept provisioning and configuration profiles over the air, update profiles, and meet all published Security Technical Implementation Guides (STIG) requirements for security settings, all without needing to connect to any other devices, such as a provisioning computer system. The devices must function under Apple’s Device Enrollment Program (DEP), or equivalent, and must currently function with VA’s current Enterprise Mobility Management (EMM) platform, VMware’s WorkSpace One.

Impact of the failure to obtain a brand-name product: Only Apple iOS devices meet the above requirements and no other product will work for VA. Due to the proprietary nature of Apple iOS, no other manufacturer has the ability to provide a device that runs on the approved mobile device operating system. Apple owns the intellectual property rights to iOS devices. Failure to meet the requirements will adversely impact patient care by disrupting provider access to information and Veteran access to telemedicine care, particularly Veterans in rural communities.

4. Statutory Authority:

The statutory authority permitting other than full and open competition is 41 U.S.C.3304(a)(1) as implemented by the Federal Acquisition Regulation (FAR) Subpart 6.302-1 entitled, “Only One Responsible Source and No Other Supplies or Services Will Satisfy Agency Requirements, for brand name applications.”

5. Rationale Supporting Use of Authority Cited Above:

This is a brand name justification in accordance with FAR 11.105, Items Peculiar to One Manufacturer. The overall requirement consists primarily of critical connected care products needed to maintain VA’s connected care technology network, including web and mobile applications and Telehealth Services enterprise CEVN/CVT, SFT, and HT.

The brand name products identified in the CCPC solicitation, are proprietary to the manufacturer listed above. As described and justified more fully in Section 3, the brand name products are major components of VA’s connected care technology network and are essential to the Government’s requirements. Based on extensive market research, as described in Section 8 of this document, it was determined that only Apple Inc. can meet the Government’s requirements. Currently, iOS is the only operating system that meets unique Federal Government security requirements (HSPD-12 and NIST 800-157) for 2FA requirements. iOS is a proprietary operating system available only from Apple or its authorized reseller.

Use of other than the identified brand name products would cause a significant interruption to direct patient care, create unnecessary risks to patient safety, and introduce potential security vulnerabilities, at a level unacceptable to VA’s mission and the connected care technology network. Additionally, the Government would experience a significant increase in costs associated with delays in the delivery of connected care technology products and services and a disruption of VA’s ability to deliver virtual patient care.

VA’s connected care capabilities have become a vital part of VA’s health care system.

The importance has never been more apparent than during the COVID-19 pandemic when record numbers of Veterans and VA health care professionals used virtual care for the first time to access VA care safely and virtually. Beginning in March of 2020 week-over-week telehealth video appointments surged exponentially due to the COVID- 19 pandemic. This expansion of telehealth care was made possible by the reengineering of VA’s information technology infrastructure, rapid adoption by VA healthcare professionals, and an increase in VA Video Connect (VVC) capacity to accommodate a greater number of concurrent users. As recently as FY22, VA provided over 9.2 million documented video encounters to the home, for an average of 185,703 per week.

During a time of year-over-year growth of connected care provided by VA, including the significant growth during the COVID-19 pandemic, any delays and/or disruptions to the connected care technology network would have an even more dramatic negative impact on Veterans’ access to health care. This impact is even greater in rural areas where VA health clinics are not easily available, requiring Veterans to physically travel long distances to VA locations or receive care in the community, resulting in increased costs to the Government for reimbursements both in Veterans’ travel fees and private care providers and their facilities.

Use of any other brand name would cripple the operation of the current connected care technology network. Integration of new technologies other than those required by this justification into a new connected care technology network would cause redevelopment of significant portions of VA’s connected care infrastructure, resulting in a monumental duplication of costs and a level of effort that would be almost impossible to recover through price reductions achieved through competition. The aftermath of this would result in an unprecedented cessation of virtual care services as well as mandated requirements for OCC to provide telehealth services as a result of the CARES Act, MISSION Act, Hannon Act, and others.

6. Efforts to Obtain Competition:

Market research was conducted as set forth in Section 8 of this document. Three separate Requests for Information (RFI) have been posted to the public, as well as extensive research of Federally approved, Food and Drug Administration (FDA)-certified, and VA-approved equipment and associated services. As required by FAR 5.201, this action will be synopsized through SAM (http://sam.gov/). In addition, this justification will be published in accordance with FAR 6.305(c). The solicitation shall be provided to the public via Contract Opportunities (https://sam.gov/content/opportunities) to reasonably ensure proposals are received from vendors who can fulfill the requirement.

7. Determination of Fair and Reasonable Price:

The Government anticipates the price for this requirement will be fair and reasonable. The Government may utilize historical pricing, commercially available pricelists, and comparison of proposed pricing received in response to the solicitation. The Government, in accordance with FAR 15.404-1(b)(2), may also use various price analysis techniques and procedures and reserves the right to do so to ensure a fair and reasonable price is obtained.

8. Market Research:

Market research was conducted from July 2021 to February 2023. VA issued three Requests for Information (RFI) (July 2021, October 2021, and December 2021) utilizing the NAICS code 334111 Electronic Computer Manufacturing. These are commercial products. The most applicable Product Service Code (PSC) is 6515 – Medical and Surgical Instruments, Equipment, and Supplies, specifically as it relates to products that support patient care.

The RFI dataset from Dec 2021 included responses from 4 companies. An analysis of the RFI revealed that 3 of the 4 respondents indicated they can provide 100% of the parts list, including all brand name equipment and services identified in this document, with existing distributor agreements or ones that can be obtained, indicating that the Government will get significant competition for items identified in this brand name justification.

On January 25, 2023, SAC posted a Special Notice to SAM.gov with the draft Statement of Work and the draft Product Catalog to receive additional feedback from industry. This notice generated a total of nineteen questions from one large, one small, and one SDVOSB business that informed the SOW and the product groupings within the catalog. Additionally, an internet search performed in February 2023 showed that there are multiple SDVOSB sources capable of providing Apple products.

Also as required as part of the market research process, the following databases were queried:

Services on the Procurement List maintained by the Committee for Purchase From People Who Are Blind or Severely Disabled, known as Ability One (FAR subpart 8.7) http://www.abilityone.gov/procurement_list/index.html;

VetBiz databases (IAW VAAR 810.001-70);

GSA eLibrary databases;

Dynamic Small Business Search.

9. Other Facts:

Not applicable.

10. Actions to Increase Competition:

The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable a deviation from the brand name requirement for future actions to be competed. VA will continue to monitor market trends and new/emerging products, looking for compatible and more advanced technologies to meet its needs.