PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Veterans Health Administration (VHA) Clinical Services

Pathology and Laboratory Medicine Service (PLMS)

National Digital Telepathology – Artificial Intelligence (NDTP-AI)

Date: May 27, 2026

VA-26-00058955

PWS Version Number: 1.0

NDTP-AI

Contents

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

3.1 SALIENT CHARACTERISTICS

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

4.2 PLACE OF PERFORMANCE

4.3 TRAVEL

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 PROJECT KICK-oFF MEETING

5.2 PROJECT MANAGEMENT

5.2.1 CONTRACTOR PROJECT MANAGEMENT PLAN

5.2.2 REPORTING REQUIREMENTS

5.2.3 METHOD AND DISTRIBUTION OF DELIVERABLES

5.3 IMPLEMENTATION IN THE VAEC

5.3.1 ARCHITECTURE AND DESIGN

5.3.6 MONITORING PERFORMANCE AND REPORTING

5.4 OPTIMIZED NETWORK

5.5 HEALTH LEVEL SEVEN (HL7) MESSAGES

5.6 INTERFACE CONTROL DOCUMENTS

5.7 TECHNICAL SUPPORT

5.8 READINESS REVIEWS

5.9 PLANS, REVIEWS AND REPORTS

5.9.4 TEST PLANS AND WORKFLOW TOOLS

5.9.5 RESOURCE UTILIZATION OPTIMIZATION PLAN

5.9.3 OUTAGE REPORT

5.10 SECURITY TRAINING CERTIFICATION

5.11 POST-IMPLEMENTATION REVIEW

5.12 IMPLEMENTATION SUMMARY REPORT

5.13 APPLICATION TRAINING

5.14 Optional Expansion Task

5.15 ONGOING SUPPORT TO NDTP – AI

5.16 OPERATIONS AND MAINTENANCE

5.16.1 ON-PREMISES SERVER/STORAGE HARDWARE

5.16.2 PATCHING, UPDATES & UPGRADES

5.16.3 TECHNICAL SUPPORT DESK

5.16.4 WORK ORDER MANAGEMENT

5.16.5 CRITICAL SYSTEMS MONITORING

5.16.6 CLOUD SPECIFIC SUPPORT

5.16.7 TECHNICAL SUPPORT

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.2 VA TECHNICAL REFERENCE MODEL

6.3 ZERO TRUST – VA CRITICAL SECURITY CONTROLS

6.4 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

6.5 INTERNET PROTOCOL VERSION 6 (IPv6)

6.6 TRUSTED INTERNET CONNECTION (TIC)

6.7 STANDARD COMPUTER CONFIGURATION

6.8 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT LINE

MANAGEMENT (PLM)

6.9 PROCESS ASSET LIBRARY (PAL)

6.10 AUTHORITATIVE DATA SOURCES

6.11 SOCIAL SECURITY NUMBER (SSN) REDUCTION

6.12 SOFTWARE AND LICENSING REQUIREMENTS

6.13 GENERATIVE ARTIFICIAL INTELLIGENCE REQUIREMENTS

6.14 AI SYSTEM/LLM DEVELOPMENT AND OPERATION DOCUMENTATION

REQUIREMENTS

6.15 Monitoring, Reporting, And Corrective Action

6.16 AI Model Updates And Change Disclosures

6.17 SOURCE CODE HARMONIZATION AND REUSE IN INFORMATION

TECHNOLOGY (SHARE IT Act)

6.18 SECURITY AND PRIVACY REQUIREMENTS

6.19 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

6.20 SERVICE LEVEL PERFORMANCE METRICS

6.21 POSITION/TASK RISK DESIGNATION LEVEL(S)

6.22 METHOD AND DISTRIBUTION OF DELIVERABLES

6.23 PERFORMANCE METRICS

6.24 FACILITY/RESOURCE PROVISIONS

6.25 GOVERNMENT FURNISHED PROPERTY

6.26 SHIPMENT OF HARDWARE OR EQUIPMENT

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM SECURITY/

PRIVACY LANGUAGE

ADDENDUM C – RECORDS MANAGEMENT OBLIGATIONS

RECORDS MANAGEMENT FOR RECORDS OFFICERS AND LIAISONS, ITEM

#3873736

1.0 BACKGROUND

The VHA National Pathology and Laboratory Medicine (PALM) Office is VA’s in-house laboratory service and provides 24 hours/day x 7days/week (24x7) service to VA facilities.

PALM is currently supporting digital telepathology capabilities at approximately 52 sites across all Veterans Integrated Services Networks (VISN) and is projected to add many more sites annually. PALM requires a best-in-class digital telepathology that is designed, deployed, and optimized for VA’s Enterprise Cloud (VAEC) environment. VISN 1 with the support of the PALM Office is leading the Integrated Artificial Intelligence Software for Prostate and Gastric Cancer Detection proof of concept work and the Cloud Storage Pilot proof of concept VA-wide.

The Integrated Artificial Intelligence Software for Prostate and Gastric Cancer Detection system must also adhere to VA’s Cloud First Policy mandating that all new and existing Information Technology (IT) solutions be assessed to determine suitability to be offered as an enterprise cloud computing service. VAEC was established by the Enterprise Cloud Solutions Office in 2017, to host cloud computing solutions. In November 2018, VA issued the Cloud First Policy mandating that all new and existing IT solutions be assessed to determine suitability to be offered as an enterprise cloud computing service. As an IT-related medical system, the Integrated Artificial Intelligence Software for Prostate and Gastric Cancer Detection system will follow this policy.

The Integrated Artificial Intelligence Software for Prostate and Gastric Cancer Detection will be integrated with current Philips IntelliSite Pathology Solution (PIPS) software. The Integrated Artificial Intelligence Software for Prostate and Gastric Cancer Detection associated application servers shall be hosted in the Cloud via Amazon Web Services (AWS). VA shall be responsible for providing the VAEC resources, while the Contractor shall be responsible for all application and Operating System (OS) management and provision of all software and licenses required by their product.

The Cloud Storage Pilot Service provides long-term, off-site archival of historical Whole Slide Images (WSI) generated by Customer’s Digital Pathology Equipment (“Equipment”) to a secure cloud environment.

While cloud technology has been available for several years, the use of cloud technology with telepathology is very innovative within VA. Telepathology is defined as the practice of remote pathology using telecommunication links (as opposed to looking into a microscope on site) to enable the electronic transmission of digital pathology images for primary diagnosis, quality assurance, education, or second opinion diagnoses.

The addition of Cloud Storage will give facilities the ability to not only reliably store a higher capacity of images, but also more easily share those images across the VA enterprise. This innovative capability streamlines laboratory workflows, reducing turnaround times for pathology reports and enhancing overall operational efficiency within VA medical facilities, and eliminates the need for physical transportation of irreplaceable glass slides, reducing the risk of loss or damage and optimizing resource utilization within the VA healthcare system. The cycle of cancer care for our nation’s Veterans begins with diagnosis and staging from a pathologist. Adding cloud storage to VA’s existing on-premises Telepathology system expedites this care cycle, which is critical when it comes to a cancer diagnosis.

This service is designed to support:

• Long-term retention of pathology image data for regulatory compliance and reference purposes.

• Scalable cloud storage of historical image data, allowing VA to optimize on-premises storage and maintain a comprehensive digital pathology repository.

The vendor shall configure multiple archive storage tiers (e.g., standard, long-term, deep archive) based on access frequency and cost optimization.

VA will specify the preferred storage tier(s) for every WSI generated by Customer’s Digital Pathology Equipment as part of the implementation planning process.

Deployment with final validation of the Integrated Artificial Intelligence Software for Prostate and Gastric Cancer Detection and the Cloud Storage Pilot must be completed no later than 6 months after award, with the optional task to be available later in FY27.

The deployment and final validation of the Integrated Artificial Intelligence Software for Prostate and Gastric Cancer Detection and the Cloud Storage will be accomplished in this project that is named the National Digital Telepathology – Artificial Intelligence (NDTP-AI) project

Post deployment, additional facilities or VISNs may elect to exercise optional Tasks to utilize the NDTP-AI project with a separate organizational structure.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and

Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and

Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information

Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5,

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed

Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

19. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

20. VA Handbook 6500, “Risk Management Framework for VA Information

Systems VA Information Security Program,” February 24, 2021

21. VA Handbook 6500.2, “Management of Breaches Involving Sensitive

Personal Information (SPI),” March 12, 2019

22. VA Handbook 6500.5, “Incorporating Security and Privacy into the System

Development Lifecycle,” March 22, 2010

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010

24. VA Handbook 6500.8, “Information System Contingency Planning,” April 6,

25. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

26. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

27. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference

Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

30. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

31. VA Handbook 6510, “VA Identity and Access Management,” January 15,

32. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

33. VA Directive 6300, “Records and Information Management,” September 21,

34. VA Handbook, 6300.1, “Records Management Procedures, “ March 24, 2010 https://www.va.gov/vapubs/index.cfm https://www.va.gov/vapubs/index.cfm http://www.va.gov/vapubs http://www.va.gov/vapubs https://www.va.gov/process/ https://www.va.gov/process/maps.asp https://www.va.gov/process/artifacts.asp https://www.va.gov/trm/TRMHomePage.aspx

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-

12) Program,” March 24, 2014

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access, “June 2018

44. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile

Devices (Draft),” October 2012

47. Draft National Institute of Standards and Technology Interagency Report

(NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

48. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland

Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

49. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

51. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

52. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

53. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008 https://arch.idmanagement.gov/#what-is-the-ficam-architecture https://arch.idmanagement.gov/#what-is-the-ficam-architecture https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.cisa.gov/publication/tic-30-core-guidance-documents

54. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

55. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

56. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

57. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August

2, 2001

58. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

59. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

60. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote

Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

61. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

62. VA Memorandum “Proper Use of Email and Other Messaging Services,”

January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

63. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

64. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol

Version 6 (IPv6),” November 19, 2020

65. Social Security Number (SSN) Fraud Prevention Act of 2017

66. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23,

67. VA Directive 6066, “Protected Health Information (PHI) And Business

Associate Agreements Management”, September 2, 2014

68. VA Enterprise Cloud Technical Reference Guide, Version 1.3 July 2018

69. Executive Order 14028, Executive Order on Improving the Nation’s

Cybersecurity, May 12, 2021.

70. VA Directive 6550, “Pre-procurement assessment and implementation for medical devices/systems”, June 3, 2019

3.0 SCOPE OF WORK

The Contractor shall design and implement Cloud Hosting and Architecture solutions that comply with the VA Cloud Provider guidelines. The Contractor shall provide solutions that enhance the scalability, resilience, and security of VA systems, ensuring cost-effective hosting and optimal resource utilization.

This solution shall be hosted in the VAEC environment and be fully functional no later than 120 business days after award. In the event that a VAEC cloud service provider (CSP) has not yet been selected by VA, the Contractor shall recommend a CSP for the solution. The Contractor shall not be responsible for providing or acquiring cloud capacity or server hosting infrastructure for this contract. VA will furnish VAEC capacity as Government Furnished Equipment

(GFE).

Computational pathology uses computer vision (AI) to analyze digitized slides at the pixel level to improve diagnostic accuracy and improve workflow. VHA has a need to procure clinical-grade AI software for prostate and gastric cancer https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 detection that will integrate with current clinical digital pathology scanner and software, PIPS.

The Contractor shall enable transfer of historical WSIs from the Equipment to a secure VA-managed AWS cloud archive. Image archival is performed either as a one-time migration of historical data or as ongoing periodic archival of images per VA’s defined retention policy.

The Contractor shall focus on the below areas:

1. Low-Code/No Code Development: Where applicable, the Contractor shall leverage low-code and no-code tools to accelerate development and reduce maintenance overhead, as is feasible.

2. AI: The Contractor shall incorporate AI-driven capabilities (e.g. predictive agent to detect cancer.) to optimize operational efficiency and enhance user experience.

3. Containerized Hosting: The solution shall support containerized deployments, utilizing industry standard orchestration tools such as Kubernetes or Docker.

4. Serverless Computing: The solution shall adopt serverless infrastructure and/or components where feasible and applicable to minimize resource waste and cost.

5. Infrastructure as Code: The Contractor shall implement automated deployment and configuration management using Indicator of Compromise principles (e.g., Terraform, AWS CloudFormation, or Azure Resource Manager Templates), throughout the solution where practical and capable of supporting testing and optimization over time of the application lifecycle.

6. Ephemeral Instances: To optimize cost and resource allocation, the Contractor shall utilize a solution leveraging ephemeral instances where appropriate and feasible, ensuring efficient scaling and cost reduction.

The vendor shall develop and implement a cost optimization strategy that ensures efficient use of resources, minimizes total project costs, and maintains required performance standards.

Other areas include.

• Efficient resource allocation to minimize operational costs.

• Auto-scaling mechanisms to adjust workloads dynamically.

• Strategic Cost Optimization Planning for the duration of the Period of

Performance (PoP).

The vendor shall provide a scalable solution for enterprise VHA medical facility access to utilize AI software starting with VISN 1.

3.1 SALIENT CHARACTERISTICS

The items in this section are Performance Outcomes that must be met by this acquisition. The offeror shall provide narrative descriptions of how these requirements will be met:

A. Diagnostic-related Outcomes:

• Food Drug and Administration (FDA) 510 (K) clearance

• Integration and compatibility with PIPS

• Demonstrated accuracy for:

o Detecting prostatic adenocarcinoma in prostate biopsy specimens and providing prognostic information including Gleason grading, tumor burden, and perineural invasion

• Image analysis for gastric pathology detection including detection of gastritis and gastric malignancies.

• Workflow tools to triage cases and generate standardized reports.

• Ongoing support, sustainment, and system optimization of the Integrated

Artificial Intelligence (AI) Software for Prostate and Gastric Pathology Detection.

• Templates should be editable by the user and will be able to transfer to pathological reports.

• Clinical validation will be at no cost to the government. (i.e. VA will not be charged per test during the validation.)

o The validation is to include one clinical validation of the PIPS system in the cloud environment following College of American Pathology (CAP) Guideline for validating whole slide imaging systems and two clinical validation studies for AI intended use cases with parameters determined by the medical director and up to date CAP recommendations. The vendor will configure multiple archive storage tiers (e.g., standard, long-term, deep archive) based on access frequency and cost optimization.

• VA will specify the preferred storage tier(s) for every WSI generated by Customer’s Digital Pathology Equipment as part of the implementation planning process.

B. Office of Information and Technology (OIT)-related Outcomes:

• All hardware and software shall comply with OIT TRM, network security, and

Authority to Operate (ATO) requirements. Failure to obtain TRM and OIT network connectivity approval within 75 days of award (extendable if significant progress is being made) shall be cause for termination.

• A complete hardware and software warranty that meets or exceeds the industry standard for this type of system, both in level of coverage and warranty period. This warranty should include, at no additional charge, any and all equipment service programs, such as remote diagnostics and equipment replacement, during the warranty period.

• The Integrated AI Software for Prostate and Gastric Cancer Detection system must also adhere to VA’s Cloud First Policy mandating that all new and existing IT solutions be assessed to determine suitability to be offered as an enterprise cloud computing service.

• The Integrated AI Software for Prostate and Gastric Cancer Detection associated application servers must be hosted in the Cloud via AWS.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The PoP shall be a 12-month base period plus 4 12-month option periods. The system must be fully functional in VISN 1 within the base period. There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

The National Digital Telepathology system shall be delivered to a VA data center designated by the Government. All virtual devices, associated data, and platform management components shall operate entirely within this Government-controlled environment. VA Technical subject matter experts shall perform all installation, configuration, patching, administration, and testing activities. All Contractor obligations under this contract shall be performed remotely. The Contractor technical support personnel shall be available via phone and email on normal Federal Government workdays between the hours of 8:00 a.m. and 5:00 p.m. Eastern Time, excluding Federal holidays, and shall provide an initial response within 1 hour for outages reported during those support hours. All Contractor technical support personnel shall be located within the Continental United States.

This is proof of concept that the procured software will function in a multi-site configuration. This proof of concept will include the following sites in VISN1:

VA Connecticut Healthcare System West Haven Campus Laboratory - 113 950 Campbell Avenue West Haven, CT 06516

VA Providence Laboratory - 113 830 Chalkstone Avenue Providence, RI 02908

VA White River Junction Laboratory - 113 163 Veterans Drive White River Junction, VT 05001

VA Maine Healthcare System Laboratory - 113 1 VA Center Augusta, ME 04330

VA Boston Healthcare System West Roxbury Campus Laboratory - 113 1400 VFW Parkway West Roxbury, MA 02132

However, as requirements change, facilities within VISN 1 may be added or deleted by supplemental agreement of the Government and the Contractor.

Tasks shall primarily be performed remotely at the Contractor’s facility via site-to-site Virtual Private Network (VPN), but where required for the installation, on-site work will be required at VA facilities. Applications training will be provided on-site.

4.3 TRAVEL

The Government anticipates travel under this effort to perform the tasks associated with the effort, such as installation and providing end-user applications training. Travel costs will not be directly reimbursed by the Government and will be included within the Contractor’s implementation work.

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 PROJECT KICK-OFF MEETING

The Project Kick-Off Meeting will be hosted by the vendor at a VA facility and/or virtually on the VA network. The purpose of the meeting is to introduce and align the project team, stakeholders, and sponsors on the project objectives, scope, roles, and expectations. Communicate the project’s purpose, goals, timelines and critical success factors. Review high-level milestones, deliverables, assumptions, constraints, risks, dependencies, and reporting and communications requirements.

Deliverables:

Kick-off Meeting Report (Report will include:

Kick-off Meeting Agenda Stakeholder List

Roles and Responsibilities Matrix Communications Plan Outline Action Item Tracker Project Charter Outline Initial High-level Project Schedule Milestones List)

5.2 PROJECT MANAGEMENT

This section establishes requirements for Contractor project management, reporting, technology partner coordination, and transition planning. The Contractor shall manage all aspects of contract execution, maintain transparent communication with the Government, and ensure deliverables from all parties—including technology partners integrate into a cohesive solution.

5.2.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall include the methodology and approach the Contractor shall use for development, implementation and validation. It shall include the coordination and planned execution, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon by the VA PM and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP. The Contractor shall also deliver a detailed Development, Implementation, and Testing Plan.

Deliverables:

A. Contractor Project Management Plan B. Development, Implementation, and Testing Plan

5.2.2 REPORTING REQUIREMENTS

The Contractor shall provide the Contracting Officer's Representative (COR) with Weekly/Monthly Progress Reports in electronic format. The report must include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding week.

The Weekly/Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved.

Weekly Progress Report during initial design shall focus on planning and design decisions, and standing up the solution with emphasis on design activities completed (e.g. requirements, design reviews, architecture decisions); deployment preparation (e.g. environments stood up, configurations, integrations planned); upcoming milestones (e.g. design sign-offs, deployment windows); and risks/issues affecting design or deployment schedule.

Weekly Progress Report during implementation shall focus on test execution status (e.g. test cases planned vs. executed, pass/fail rates); defects/bugs (e.g. counts, severity, age, top problem areas); test environment status and any blockers; readiness for go-live (e.g. entry/exit criteria, what remains to be tested); and risks related to quality or schedule based on test results.

Monthly Progress Report during post activation shall focus on current system health and stability after activation; upgrades and changes completed or planned (e.g. patches, version upgrades, configuration changes); open work orders or tickets (e.g. counts, priority, aging, resolution rate); trends (e.g. incident volume, performance metrics, user adoption, recurring issues), and continuous improvement items and upcoming changes.

Deliverables:

A. Weekly Progress Report during initial design/deployment activities B. Weekly Progress report during testing C. Monthly progress report following activation with review or upgrades, upgrades, open work orders, trends

5.2.3 METHOD AND DISTRIBUTION OF DELIVERABLES

The Contractor shall deliver documentation in electronic format, unless otherwise directed in Section B of the solicitation/contract. Acceptable electronic media include Microsoft 365, MS Word 2000/2003/2007/2010/2019, MS Excel 2000/2003/2007/2010/2019, MS PowerPoint 2000/2003/2007/2010/2019, and Adobe Postscript Data Format (PDF).

5.3 IMPLEMENTATION IN THE VAEC

The Telepathology Prostate and Gastric detection software solution shall be implemented with the VAEC. The Contractor shall coordinate with the Government Points of Contact (POC) identified in individual task orders to accomplish this task. The Contractor shall provide support for all phases of the system/software lifecycle. The support shall include project management, product customization, security compliance, system integration/implementation, training, help desk support, system management and maintenance, Operations & Maintenance and phase-out transition support.

5.3.1 ARCHITECTURE AND DESIGN

Develop and maintain the solution architecture aligned with the VAEC Technical Reference Architecture as well as the One-VA Enterprise Architecture. Design VAEC hosted solution and address VA identified cloud-readiness gaps.

Deliverables:

A. VAEC Solution Architecture B. VAEC Solution Design

5.3.2 PLANNING

Develop, maintain, and execute the VAEC Implementation Plan that defines the implementation approach, processes and activities (prior to, during, and after), test strategy, setup and configuration procedure, inventory of IT assets, implementation checklist, risk assessment, key dependencies, and schedule. In the event that a VAEC CSP has not yet been selected by VA, the Contractor shall recommend a CSP.

Develop and execute the VAEC Transition Plan, as part of the Implementation Plan, that defines the approach and action plans to prepare VA stakeholders to receive and operate the solution. This includes improving stakeholder engagement, outreach, and communications. Develop and update project’s Veteran-Focused Integration Process (VIP) Deployment and Installation, Back-out, and Rollback Plan that describes the installation, back-out, and rollback approach, processes and activities, dependencies, and schedule.

The plan shall also include the provisioning and installation procedures for VAEC resources. Determine cloud capacity and workload requirements. VA shall review and approve cloud capacity requirements and provide the VAEC cloud capacity for the solution as GFE.

Deliverables:

A. VAEC Implementation Plan

5.3.3 BUILD AND DEPLOYMENT

Support setup, configuration, and provisioning of the solution in the VAEC environments. Work with VA to provide inputs for establishing VAEC capacity, accounts and privileges. This includes monitoring and tracking the creation, update, and deletion of application user (e.g., developer, systems administrator) accounts, and ensuring cloud capacity requirements are satisfied.

Develop necessary artifacts to obtain a VA ATO for the solution and complete VA Assessment and Authorization (A&A) process. After ATO is achieved, the Contractor shall update and maintain the A&A documentation as required to ensure continued compliance. The Contractor shall monitor, track, and respond to Plan of Action and Milestones (POAM). The Contractor shall provide input to update the VAEC ATO, as needed.

Provide information and documentation to support operational and production readiness reviews and go-no-go decisions. The Contractor shall execute corrective actions to address gaps and provide all required data and prepare supporting documents/artifacts for the reviews.

5.3.4 IMPLEMENTATION

Implement the solution in the VAEC as defined in VIP Deployment and Installation, Back-out, and Rollback Plan as well as the VAEC Implementation Plan.

Provide the inputs and documentation for the Post-Implementation Review, within 5 days of implementation completion, to review lessons learned and identify improvement opportunities.

Provide an Implementation Summary Report that describes implementation results, lessons learned, open issues, corrective action, and improvement opportunities.

Deliverable:

A. VAEC Implementation Summary Report

5.3.5 OPERATION AND MAINTENANCE

Operate and maintain the solution hosted in the VAEC in accordance with the application and VAEC service level agreements (SLA) and operate the solution in its current environment in parallel as applicable. Utilize VAEC General Support Services (GSS) when available and applicable in order to minimize cloud services costs and optimize operations.

The Contractor shall use native tools and capabilities of the VAEC environment. Provide for the backup and recovery of information stored by the solution to meet the application and VAEC SLA using native tools and capabilities of the VAEC environment.

The Contractor shall recommend best practices for requirements analysis, planning, design, deployment, and ongoing operations management and technical support. The Contractor shall also maintain a current and up-to-date library of all operational documentation, logs of operational events, maintenance of operational monitoring and management tools, operational scripts, and operational procedures, all to be made available in real time to VA personnel.

The Contractor is responsible to perform and deliver all software maintenance through the life cycle. Software maintenance shall include all adaptive, perfective, and defect maintenance. Adaptive maintenance activities are those required to adapt software and systems to support changing externally initiated changes in requirements. Examples include regulatory changes, Content Management System changes or updates, congressional actions, VA mandates, and changes required to maintain interoperability with key systems (internal or external to VA).

Perfective maintenance activities are those required to increase deployed software and systems efficiency to improve performance and/or lower cost of operation. Defect maintenance includes those activities required to identify and repair defective coding or systems postproduction deployment.

The Contractor shall provide for the backup and recovery of information stored by the solution to meet the application and VAEC SLA using native tools and capabilities of the VAEC environment.

5.3.6 MONITORING PERFORMANCE AND REPORTING

A. Provide a Quarterly Solution Performance Report that summarizes solution availability, usage, events and incidents, improvement opportunities, risks and issues, status, action plans, and planned and actual resolution timelines.

B. Review all usage of cloud computing services provided by VAEC. The Contractor shall submit and implement Quarterly Resource Utilization Optimization Plans on how to best optimize the environment to reduce the costs associated with resource utilization.

C. Provide a breakdown of all costs by solution, environment, and utilization. The Contractor shall report on utilization of each class of resource as a percentage of provisioned capacity in a Monthly Utilization Report. The Contractor shall, as part of its Monthly Utilization Report, include the total infrastructure expenditure and total number of request services for Cloud Resource Optimization.

Deliverables:

A. Quarterly Solution Performance Report B. Quarterly Resource Utilization Optimization Plan C. Monthly Utilization Report

5.4 OPTIMIZED NETWORK

The system shall support optimized network performance to enable timely transfer of mission data, meeting the following minimum thresholds: (e.g. e2e latency, throughput, or availability metrics).

5.5 HEALTH LEVEL SEVEN (HL7) MESSAGES

The system shall be capable of sending and receiving HL7 2.3 and 2.4 messages using VA VistA HL7 interface specifications and profiles, including required segments, fields, and event types defined for VA use. The contractor shall document any constraints or deviations from VA VistA HL7 2.3/2.4 implementation guides.

5.6 INTERFACE CONTROL DOCUMENTS

The Contractor shall prepare Interface Control Documents (ICD) to ensure all interfacing parties understand and agree upon interface specifications, minimize integration issues and facilitate ongoing maintenance. The Contractor will create and maintain a Solution Architecture Document that describes the overall solution architecture and integration framework. ICDs defining the technical specifications for all system interfaces will supplement the Solution Architecture Document. At minimum, the IDCs should include:

a) Purpose and Scope

a. Explains the objectives of the document, what systems/components are involved, and which interfaces are being addressed.

b) Interface Overview

a. High-level description of the interface, including its function, relevance, and context within the larger system architecture.

c) Interface Description

a. Detailed professional documentation of:

b. Data formats and protocols (e.g., eXtensible Markup Language, JavaScript

Object Notation, Representational State Transfer, HL7)

c. Input/output parameters and their data types

d. Data flow diagrams, sequence diagrams, or state diagrams

e. Message structure and payload examples

f. Error handling and response codes

d) Physical and Logical Interface Requirements

a. Specifications for:

b. Hardware, software, network requirements

c. Security, authentication, and authorization protocols

d. Supported communication methods (e.g., Application Programming Interface

(API) calls, web services)

e) Data Definitions

a. Comprehensive list of fields/attributes exchanged, including:

b. Field names

c. Data types

d. Allowed values, ranges, units

e. Descriptions

f) Constraints and Assumptions

a. Any limitations, dependencies, and prerequisites for proper interface operation.

g) Change Control and Version Management

a. Mechanisms for updating interface specifications, including:

b. Document version history

c. Change tracking

h) Test and Validation Procedures

a. Methods for verifying interface implementation and conformance, including:

b. Test cases

c. Validation criteria

d. Sample messages

i) Points of Contact

a. Stakeholders responsible for interface development, maintenance, and issue resolution.

j) Appendices

a. Supporting information, such as:

b. Glossary

c. References

d. Example message payloads

e. Data mapping tables

Deliverables:

A. Solution Architecture Document B. ICDs for all interfaces

5.7 TECHNICAL SUPPORT

The Contractor shall provide the following general technical support:

a. The Contractor shall provide all application updates and upgrades for the life of the contract across all components.

b. The Contractor shall provide remote support via VA site-to-site VPN with accompanying VA mandated annual information security and privacy training along with background investigations. The Contractor and all subcontractors shall agree to comply with all applicable VA security requirements and obtain/maintain VA credentials.

c. The Contractor shall limit system access to only those individuals requiring access to perform functions related to NDTP-AI. The Contractor shall permit only authorized users at their site to have access to VA supporting systems and resources.

d. The Contractor shall provide vulnerability remediation. Monthly vulnerability reports shall be provided by the VA to the Contractor. Remediations shall be completed according to the timelines outlined in the Department of Homeland Security, Cybersecurity and Infrastructure Security Agency's Binding Operational Directive (BOD) 22-01 and its successors. For vulnerabilities not covered by BOD 22-01, the following deadlines will apply: Critical = 60 days, High = 90 days, Medium = 120 days, and Low = 150 days.

e. The Contractor shall implement and maintain all security patches, updates, upgrades, and configuration changes necessary to ensure the system remains compliant with applicable NIST, FISMA, and VA security and privacy requirements (including, as applicable, NIST SP 800-53 controls, FIPS publications, and VA security directives, VA handbooks, and VAAR 852.239-70).

f. The Contractor shall perform routine vulnerability scanning, timely system patching, and change management in accordance with VA policy, and shall update all associated security documentation (including the System Security Plan and related risk assessments) to reflect these changes.

g. The Contractor shall limit the maintenance window for software updates to 15 minutes of downtime Tuesday-Thursday mornings unless otherwise specified by the VA. Maintenance updates requiring longer than 15 minutes will be addressed on a case-by-case basis. Major application upgrades shall be addressed on a case-by-case basis but shall not exceed 90 minutes of downtime. Note that scheduled maintenance downtime does not count towards the monthly service level performance metrics unless it exceeds the pre-arranged time window.

h. The Contractor shall provide remote service, support, and all software updates and upgrades remotely or on-site when work cannot be completed remotely. The Contractor shall provide on-site service if remote service fails.

i. The Contractor shall create an incident report each time remote or on-site service is required, and the Contractor shall follow industry standard change control processes.

j. The Contractor shall utilize VAEC GSS when available and applicable to minimize cloud services costs and optimize operations. The Contractor shall use native tools and capabilities of the VAEC environment.

Deliverable:

A. Incident Report

5.8 READINESS REVIEWS

The Contractor shall provide information and documentation to support operational and production readiness reviews and Go/No-Go decisions. The Go/No-Go decision is made only when all the criteria below are met, or acceptable risk mitigations are in place and documented. The Contractor shall execute corrective actions to address gaps, provide all required data and prepare supporting documents/artifacts for the reviews. At a minimum, the document shall include:

a) Functional Readiness

a. All critical functionality and business requirements are fully implemented and verified through formal testing (User Acceptance Testing, system/integration testing).

b. No unresolved high/critical defects remain that could impact business operations.

c. All acceptance criteria (user stories, requirements traceability) are met.

b) Technical Readiness

a. Solution has been successfully deployed in a pre-production environment that mirrors production.

b. Performance, security, and scalability testing is complete and meets all defined thresholds.

c. Data migrations, back-ups, and disaster recovery plans are tested and validated.

c) Security & Compliance

a. Security ATO or Interim Approval to Operate has been granted.

b. Privacy requirements (e.g., encryption, audit logs) are met, and PII/PHI is protected.

c. All open security vulnerabilities are resolved or have documented mitigation plans.

d) Support & Maintenance Readiness

a. Operations and maintenance procedures are documented and approved.

b. Monitoring, alerting, and incident response plans are in place.

c. Help Desk and support teams are trained and prepared for launch.

d. Roles and responsibilities for ongoing operations are clearly defined.

e) Documentation & Training

a. All system and user documentation are complete, reviewed, and distributed.

b. Training materials have been developed and delivered to end-users and support personnel.

c. Communication plans for stakeholders and users are executed.

f) Change Management & Rollback

a. Change request and management process is in place and tested.

b. Rollback plans and contingencies are defined, documented, and tested.

g) Stakeholder Approval

a. All key stakeholders, including business owners, security, operations, and user representatives have provided formal approval to proceed.

Deliverables:

A. ATO Documentation B. Operation and Production Readiness Plan C. Training Materials

5.9 PLANS, REVIEWS AND REPORTS

5.9.4 TEST PLANS AND WORKFLOW TOOLS

The Contractor shall develop, execute, and document a test plan that verifies the solution meets all functional and performance requirements identified in Section 3, 4, and Section 5. The Contractor shall implement and deploy their system workflow tools.

Deliverable:

A. Test Plan

5.9.5 RESOURCE UTILIZATION OPTIMIZATION PLAN

The Contractor shall review all usage of cloud computing, storage, and bandwidth utilized by VAEC. The Contractor shall submit and implement Monthly Resource Utilization Optimization Plans on how to best optimize the environment to reduce the costs associated with resource utilization. At a minimum, the plan will include:

a. Assessment and Right-Sizing:

a. Review current AWS resource usage, including compute (Elastic Compute Cloud/

Elastic Container Service/Elastic Kubernetes Service), storage (Simple Storage Service, Elastic Block Store), and database services (Relational Database Service, DynamoDB). Conduct a detailed analysis of resource allocation versus actual consumption will identify over-provisioning, unused assets, or underutilized instances. Provide recommendations for right-sizing environments, such as adjusting instance types, leveraging auto-scaling groups, and terminating idle resources.

b. Cost and Performance Optimization:

a. Cost Explorer and Trusted Advisor tools shall be leveraged to monitor spending patterns and uncover efficiency gaps. Reserved or Savings Plan models will be evaluated for workloads with predictable usage. Performance metrics will drive optimization of storage tiers, network utilization, and database configurations to ensure an efficient balance between cost and performance.

c. Automation and Governance:

a. Implement resource tagging, automated scheduling, and lifecycle policies to support improved governance and accountability. Automation of resource deployment and teardown in non-production environments to further reduce waste.

d. Security and Compliance:

a. The optimization plan shall ensure resource efficiency aligns with VA information security practices, supporting timely patching, continuous monitoring, and compliance with federal mandates.

e. Continuous Monitoring and Improvement:

a. Provide ongoing monitoring to leverage AWS CloudWatch and third-party dashboards to ensure resource utilization targets are maintained. Conduct regular reviews of usage patterns with application stakeholders will drive a culture of continuous improvement.

Deliverable:

A. Monthly Resource Utilization Optimization Plan

5.9.3 OUTAGE REPORT

The Contractor shall provide a Monthly Outage Report and adjusted billing of the ongoing service/support cost per the service level performance metrics.

Deliverable:

A. Monthly Outage Report and adjusted billing

5.10 SECURITY TRAINING CERTIFICATION

The Contractor shall provide Annual Security Training certification for Contractor employees with access to VAEC.

5.11 POST-IMPLEMENTATION REVIEW

The Contractor shall provide inputs and documentation for the Post-Implementation Review, within five days of implementation completion, to review lessons learned and identify improvement opportunities.

Deliverable:

A. Post-Implementation Review

5.12 IMPLEMENTATION SUMMARY REPORT

The Contractor shall provide an Implementation Summary Report that describes deployment and implementation results, lessons learned, open issues, corrective action, and improvement opportunities. Implementation Summary Report focuses on planning, deployment preparations, milestones, and risks/issues affecting implementation schedule.

Deliverables:

A. Implementation Summary Report

5.13 APPLICATION TRAINING

The Contractor shall provide application training. Training shall be role-based (including but not limited to users and administrators) and shall be provided either on-site and/or via remote web application and shall cover all functions of the overall system. The Contractor shall provide training for initial installation, major software releases, and new/refresh employees new and updated software modules as released. Training in new and updated software shall be provided free of charge. The Contractor shall deliver or provide links to training plans, manuals, and associated training tools. Training frequency:

a) Initial Installation (After System Install)

b) New/Refresh Employees (Every Six Months (as needed))

c) New/Updated Software (60 Days after Release)

Deliverables:

A. NDTP – AI Application training plans, manuals, and associated training tools

5.14 OPTIONAL EXPANSION TASK

VA…