Performance Work Statement (PWS)

Contents

1. PROJECT TITLE

2. PROCUREMENT TYPE

5. SCOPE

6. PLACE OF PERFORMANCE

7. PERIOD OF PERFORMANCE (POP)

8. POINTS OF CONTACT (POCS) AND ESCALATION

9. EQUIPMENT LIST AND CHANGES

10. OUT-OF-SCOPE SERVICES

11. WORK PERFORMANCE REQUIREMENTS

12. CONFORMANCE STANDARDS

13. TEST EQUIPMENT CALIBRATION

14. CONTRACTOR QUALIFICATIONS / REQUIREMENTS

15. SAFETY REQUIREMENTS

16. SECURITY AND PRIVACY (NETWORK, DATA, REMOVABLE MEDIA, EXTERNAL CONNECTIONS)

17. NETWORK AND HARDWARE BASELINE (VISN 23 HOSTING)

18. ELECTRICAL/POWER

19. PROJECT MANAGEMENT AND MILESTONES

20. CHECK-IN/CHECK-OUT AND BADGING

21. INTERFACE CABLES AND CABLE MANAGEMENT

22. REMOTE TECHNICAL SUPPORT

23. TELEPHONE/ONLINE SUPPORT AND COMMUNICATIONS

24. SCHEDULED AND UNSCHEDULED MAINTENANCE

25. SERVICE LEVELS (SLA)

26. SYSTEM TESTING AND VALIDATION

27. UPDATES AND UPGRADES

28. INTERFACES

29. SERVICE REPORTS AND ELECTRONIC SERVICE LOG

30. PRODUCT MODIFICATIONS, RECALLS, EOL/EOS

31. INSPECTION AND ACCEPTANCE

32. DELIVERY, SHIPPING AND MATERIALS

DRAFT

33. WASTE AND JOBSITE CLEANUP

34. MANUALS, RELEASE NOTES AND SERVICE BULLETINS

35. TRAINING

36. INVOICING AND PAYMENT

37. WARRANTY

38. ORDER OF PRECEDENCE

39. ATTACHMENTS

40. ABBREVIATIONS

1. Project Title

VISN 23 BD IV Prep (CATO) Support Agreement.

2. Procurement Type

To be determined by the Contracting Officer (CO)—this PWS can support competitive or sole-source actions consistent with FAR/VA policy.

3. Introduction

VISN 23 requires a consolidated base plus four (4) option year agreement for BD IV Prep (CATO) software, with CCE Basic Connectivity where applicable, to sustain sterile compounding workflows across facilities via BD IV Prep (CATO) subscriptions and service (including updates, patches, parts, and onsite dispatch when necessary).

4. Background

BD IV Prep (CATO) enables medication compounding workflows and interoperates with balances/scales for gravimetric verification. Continued OEM-supported maintenance—software updates, patches, remote support, and hardware service—is required to maintain security, compliance, and clinical continuity.

5. Scope

The Contractor shall provide the following services to all VISN 23 sites listed in Attachment A:

5.1. BD IV Prep (CATO) Software Subscription and Support

Maintain active subscriptions (BD CATO SW SUBSCRIPTION) for each covered site;

provide bug fixes, patches, updates, upgrades, and 24×7×365 remote technical support via BD’s Technical Support Center (TSC).

5.2. CCE Basic Connectivity (if applicable)

Maintain CCE Basic Connectivity services to support interface resources associated with covered systems.

6. Place of Performance

Service is required at (quantities, serials, LIN per site are in Attachment A.):

6.1. Fort Meade VAMC (FTM): 113 Comanche Rd, Marcus, SD 57785

6.2. Hot Springs VAMC (HS): 500 N 5th St, Hot Springs, SD 57747

6.3. Des Moines VAMC (CIH): 3600 30th Street, Des Moines, IA 50310

6.4. Fargo VAMC (FAR): 2101 Elm Street N, Fargo, ND 58102

6.5. Minneapolis VAMC (MN): 1 Veterans Dr, Minneapolis, MN 55417

6.6. Omaha VAMC (OMA): 4101 Woolworth Ave, Omaha, NE 68105

6.7. Grand Island VAMC (GRI): 2201 North Broadwell Ave, Grand Island, NE 68803-2153

6.8. Lincoln VA Clinic (LIN): 420 Victory Park Dr, Lincoln, NE 68510

6.9. Sioux Falls VAMC (SUX): 2501 W 22nd St, Sioux Falls, SD 57105

6.10. St Cloud VAMC (STC): 4801 Veterans Drive, St. Cloud, MN 56303

7. Period of Performance (PoP)

7.1. Base: 12/01/2026 – 11/30/2027

7.2. Option Year 1: 12/01/2027 – 11/30/2028

7.3. Option Year 2: 12/01/2028 – 11/30/2029

7.4. Option Year 3: 12/01/2029 – 11/30/2030

7.5. Option Year 4: 12/01/2030 – 11/30/2031

8. Points of Contact (POCs) and Escalation

Upon award, the COR will provide clinical, biomedical/HTM, and logistics POCs for each facility.

The Contractor shall furnish an Escalation Pathway including after-hours contacts for urgent/emergent issues requiring rapid resolution.

9. Equipment List and Changes

9.1. The Contractor shall support the equipment/software listed in Attachment A and provide an updated spreadsheet of serial numbers and asset tags upon VA request.

9.2. Equipment may be added/removed during the PoP at the CO’s discretion. Credits apply for items removed before any scheduled maintenance is performed;

additions/deletions will be reflected at renewal or upon request.

10. Out-of-Scope Services

Within 24 hours of discovery, the Contractor shall notify the CO and COR in writing if any defect/remediation is outside the contract scope and provide a written cost estimate and plan for remediation. No charges may be incurred without CO approval via the COR.

11. Work Performance Requirements

The Contractor shall:

11.1. Provide 24×7×365 help desk/remote support, onsite repair as needed; deliver software updates, licensing, OS/security patching, drug/medication dictionaries where applicable, interface maintenance, diagnosis/Root Cause Analysis (RCA), workarounds or fixes, configuration corrections, quality/training initiatives, and project management to facilitate testing/validation.

11.2. Communicate third-party dependencies (equipment/software/services) in advance to COR/POCs for VA coordination/procurement; delineate any pre-work, space modifications, network/power requirements.

11.3. Ensure remote diagnostics and firmware/software updates align with VHA and VA OIT security policies.

11.4. Maintain spare parts availability and provide overnight/next-day parts and return shipping for defective parts at no additional cost to the Government.

11.5. Coordinate with VA/other vendors to maintain operational uptime and interface integrity with VistA/Federal EHR.

12. Conformance Standards

All products, services, and maintenance shall conform to Manufacturer specifications, AAMI, JCAHO, NFPA-99, CDRH, OEM, AHA, IEEE, UL, OSHA, CAP, VAHCS standards, and applicable Federal/State/Local regulations.

13. Test Equipment Calibration

Before commencing onsite work, the Contractor shall provide current calibration certificates (traceable to national standards) for test equipment used on VA-owned equipment, and update upon request.

14. Contractor Qualifications / Requirements

Provide Fully Qualified, OEM-Certified field service engineers (FSEs), plus backup FSEs; submit credentials upon request; CO may approve/reject personnel. Subcontractors require CO approval.

15. Safety Requirements

Contractor shall take necessary safety precautions; upon notice of non-compliance from CO/VA POCs, Contractor shall immediately correct conditions or risk work stoppage. VA is not responsible for Contractor safety incidents consistent with law.

16. Security and Privacy (Network, Data, Removable Media, External Connections)

The Contractor shall comply with all VA, VHA, VISN, and facility-level information security, privacy, and network protection requirements when providing any services under this PWS.

Upon request (if applicable) complete and return all required ERA/MOU-ISA/BAA forms and technical artifacts within ten (10) days of receipt from the VA.

16.1. VA 6500 / 6550 Compliance and Required Security Documentation: Comply fully with VA Directive 6500 and VA Handbook 6500 series cybersecurity requirements governing information system security and data protection for all software, hardware, interfaces, and support activities.

16.1.1. Complete and return all VA Form 6550 (Medical Device/Software Cybersecurity Analysis) documents: MDS2, network topology, data‑flow diagrams, and all required technical artifacts upon request by the COR or ISSO.

16.2. External Connections — MOU/ISA Requirement: Complete all required Memorandum of Understanding / Interconnection Security Agreement (MOU/ISA) documentation whenever integrating any product, interface, cloud service, remote access mechanism, or external connection with any VA network, server, endpoint, virtual machine, or information system.

16.2.1. Work with VA OIT, ISSO, and the COR to complete the MOU/ISA prior to enabling any external connection.

16.2.2. Ensure all external connections are explicitly approved by VA OIT and documented in a fully executed MOU/ISA.

16.2.3. Maintain the MOU/ISA throughout the Period of Performance; keep it current.

16.2.4. No external system may exchange data with VA systems unless covered by an approved, active MOU/ISA consistent with VA security policy

16.3. VA Handbook 6513 — Secure External Connections: Comply with VA Handbook 6513 (Secure External Connections) for all external or vendor-initiated connections to VA systems.

16.3.1. Use only VA approved secure methods (e.g., VA approved Site to Site VPN) for remote access.

16.3.2. Ensure vendor hosted/cloud hosted components, remote diagnostic tools, or SaaS elements meet external connection security requirements.

16.3.3. Do not create unapproved tunnels, backdoors, ports, or pathways between contractor systems and VA systems.

16.3.4. Submit all security artifacts required by Handbook 6513 (architecture diagrams, encryption documentation, authentication model, access controls, etc.) as part of the MOU/ISA package.

16.3.5. Ensure Contractor personnel follow VA’s secure external connection procedures when connecting to VA networks.

16.4. Business Associate Agreement (BAA) Requirements — PHI/ePHI: If PHI or ePHI is processed, transmitted, accessed, or stored: follow the BD/CareFusion Business Associate Schedule (HIPAA Privacy Rule, Security Rule, HITECH), including minimum-necessary use, breach reporting, mitigation, subcontractor flow-downs, and PHI destruction/return obligations.

16.5. Removable-Media Scanning: All Contractor-owned USB drives, external media, or service tools must be scanned by Biomedical Engineering prior to being connected to any VA system. Infected media shall not be used and constitutes a security breach.

16.6. Hard Drive and Device Handling / EPHI Protections: Contractor shall not remove, copy, alter, or delete VA or patient data stored on VA systems. All replaced storage media must be surrendered to VA for decommissioning/destruction. Printers and devices capable of storing EPHI must be scrubbed according to VA procedures and remain VA property.

16.7. FIPS Requirements: All cryptographic modules must be FIPS 140-3 validated or letter of attestation to upgrade before the 9/21/26 sunset (or current); Contractor shall provide certificate numbers.

16.8. TRM Compliance: All software (if applicable) must be approved in the VA Technical Reference Model (TRM) or Contractor to assist VA in obtaining approval.

16.9. Cloud Services (if any): If cloud components are used (PaaS, SaaS, or hosted services), they must follow VA Directive 6517 and the VA Enterprise Cloud Solution Intake process.

16.10. SMAK-AM Deployment: Contractor shall allow installation of the System Monitoring and Accountability Knowledge – AntiMalware (SMAK-AM) toolset on all relevant devices prior to integration or operation.

16.11. MAC Addresses: The Contractor shall provide to the VA all MAC addresses for each network-capable device, appliance, software-defined component, or virtual interface no later than one (1) week prior to delivery. This information is required for validation, network registration, address reservations, security controls, and compliance with VA network onboarding requirements.

17. Network and Hardware Baseline (VISN 23 Hosting)

17.1. Site-specific virtual servers will be hosted on VISN 23’s virtual infrastructure (e.g., Nutanix HCI / Acropolis hypervisor); VMware OVA/VMDK packages are supported;

Hyper-V packages are not supported; nightly archival is performed by the platform.

(Contractor shall identify any deviations required for BD Cato hosting and include them in the plan.)

17.2. VA will provide Windows Server 2019 (or current OS) and Microsoft SQL 2019 (or supported DBMS).

17.3. Describe AD/LDAP/SSO integration.

17.4. Workstations must be major-brand, include TPM, SSD, drive encryption, adequate RAM, current CPU (i5+ preferred), and FHD displays; supply login credentials for hardware/software; upgrade OS at no additional charge before End-of-Support to maintain compliance.

17.5. Contractor shall not apply OEM Group policies on the computers.

18. Electrical/Power

Use existing VA electrical services (120 VAC, <20 A per component).

19. Project Management and Milestones

The Contractor shall provide project management services as needed as part of the support purchase for recalls, scheduled maintenance, upgrades and updates included in the support contract.

Provide a Project Management Plan (CPMP) within 2 weeks of award, including narrative and Gantt Chart (or similar) schedule: milestones, roles/responsibilities (Contractor and VA), risks, deliverables, and reporting cadence; conduct kickoff within 3 weeks of award, hold weekly or periodic meetings with agendas/minutes (recordings if feasible), provide daily onsite status reports with photos when onsite, present acceptance letters post-service, and hold a Lessons Learned / After-Action Report within 3 weeks of completion.

19.1.Project Milestone Table

Milestone Description / Activities Responsible Party

Due Date / Timeframe

1. Award Notification & Initial Coordination

Contractor acknowledges award, reviews PWS obligations, receives VA POCs for clinical, HTM, logistics, ISSO, and OIT.

Contractor &

COR

Within 5 business days of award

2. Submit Contractor Project Management Plan (CPMP)

Deliver CPMP including narrative + schedule (Gantt/visual), roles/responsibilities, risks, reporting cadence, technical plans, security tasks.

Contractor Within 2 weeks of award

3. COR/Facility Review & CPMP Finalization

COR and facility POCs review, provide feedback, finalize CPMP.

Contractor &

COR

Within 3 weeks of award

4. Kickoff Meeting

Formal kickoff meeting to review CPMP, communication plan, update/upgrade workflow, security requirements, testing plans, and escalation pathways.

Contractor &

VA

(COR/POCs)

Within 3 weeks of award

5. Security Documentation Submission

Submit VA Form 6550 (MDS2), network topology, data-flow diagrams, encryption/FIPS documentation, TRM info, ERA/BAA, and initiate

MOU/ISA.

Contractor Within 10 days of VA request

Party

Due Date / Timeframe

6. Provide MAC Addresses

Provide all MAC addresses for servers, workstations, interfaces, and devices for network onboarding.

Contractor ≥1 week prior to delivery

7. Hosting Readiness & Technical Validation

Validate VISN 23 hosting (Nutanix/Acropolis), confirm VMware OVA/VMDK compatibility, OS/SQL versions, workstation specs, AD/LDAP/SSO readiness.

Contractor &

VA OIT/ISSO

Prior to installation window

8.

Licensing/Entitlement Activation

Confirm BD IV Prep subscriptions and Support activation for all LINs listed in Attachment A.

Contractor Before installation/configuration

9. System Installation / Configuration

Configure BD IV Prep components, server-side services, workstation clients, security configuration, and remote access tools.

Contractor As scheduled with COR/POCs

10. Remote Access Enablement

Complete VA-approved S2S VPN or equivalent; validate compliance with VA Handbook 6513 (secure external connections).

Contractor &

VA OIT/ISSO

Prior to testing/integration

11. Interface Configuration & Testing

Validate VistA/Federal EHR interfaces, device integrations, CCE connectivity, and complete

Contractor &

VA

Before Upgrade/Replacement Go-Live

Party

Due Date / Timeframe testing using VA-approved test scripts.

12. QA Testing & Validation

Perform quality assurance checks, functional verification, corrective actions, release documentation, and interoperability confirmation.

Contractor Prior to acceptance

13. Training Delivery

Provide clinical, technical, super-user, and Biomed training (remote/onsite), including release-notes walk-through and workflow validation.

Contractor Prior to production use

14.

Upgrade/Replacement Go-Live & Acceptance

System enters production;

Contractor provides acceptance documents for signature by facility POCs and COR.

Contractor &

COR

At completion of installation/testing

15. Initial Stabilization Support

Post Upgrade/Replacement Go-Live support including expedited response for issues identified during initial weeks.

Contractor First 30 days post- Upgrade/Replacement Go-Live

16. Monthly Service Reports

Provide monthly service reports including incidents, updates, SLA metrics, interface issues, and performance indicators.

Contractor Monthly (first week of each month)

Party

Due Date / Timeframe

17. Quarterly Performance Reviews

Review uptime, ticket trends, interface issues, service log summaries, and cross-site recurring patterns.

Contractor &

COR

Quarterly

18. Updates/Upgrades & Patch Cycles

Provide updates/upgrades, security patches, firmware, and corrective actions;

include validation and testing cycles.

Contractor As required; urgent fixes within 30 days (per PWS)

19. Annual Option Year Review

Validate LIN lists, equipment, serials, support quantities, and pricing for the next option year.

Contractor &

COR

150-180 days before PoP anniversary

20. Lessons Learned & After-Action Reporting

Conduct Lessons Learned meeting and provide a written After-Action Report following major updates, annual cycles, or significant events.

Contractor Within 3 weeks of update cycle completion

20. Check-In/Check-Out and Badging

Contractor shall check in/out with facility POCs, wear visible identification, comply with VA privacy training, parking rules, safety/PPE, and licenses/permits; removable media scanning is mandatory (see §P).

21. Interface Cables and Cable Management

Provide required interface cables and coordinate cable management/floor space utilization with VA and other vendors to reduce hazards and clutter (e.g., modems/fiber/conduits).

22. Remote Technical Support

Provide 24×7×365 remote technical support and error correction for software, interfaces, reports/analytics, content modifications.

23. Telephone/Online Support and Communications

Provide toll-free numbers and emails for normal/after-hours; allow unlimited support requests;

for each ticket communicate brief problem description, affected version/product, patient safety impact, workaround (if any), expected patch/update dates, status, and ETA; share known issues in monthly service reports.

24. Scheduled and Unscheduled Maintenance

24.1. Scheduled (PM): Perform PM per manufacturer recommendations and standards (e.g., Joint Commission EC.02.04.01/EC.02.04.03, ANSI/AAMI/ISO 13485, VHA PM SB2025-001); correct defects discovered during PM; schedule with COR/POCs;

recommend resource availability windows

24.2. Unscheduled Maintenance: Provide unlimited corrective maintenance incidents (remote and onsite) with ticketing; restore products/software to manufacturer specs;

replace items at no additional cost if repair is not feasible; Contractor is liable for incidents due to damage/neglect.

25. Service Levels (SLA)

25.1. BD Cato (IV Prep) — Priority Response Targets

Priority Initial Callback Update Interval

Urgent (core features unavailable; care critically disrupted) 1 hour 2–4 hours

High (significant disruption) 4 hours 4–8 hours

Medium (business disruption) 24 hours 48 hours

Low (routine assistance) 48 hours 72 hours

(BD TSC remote support available 24×7×365.)

25.2. System Uptime Target

The software solution should be operable ≥96% of the time, excluding scheduled maintenance. This uptime target is used for Government surveillance only and does not create BD equipment response/uptime credits unless such credit programs are separately procured.

26. System Testing and Validation

Contractor shall perform QA testing before installing patches/maintenance releases; participate in connectivity/interface testing per mutually agreed test scripts; validate compliance with VA data standards; coordinate testing with COR/POCs in TEST and LIVE environments where applicable/best practice; generate release documentation; confirm interface readiness post-install.

27. Updates and Upgrades

27.1. BD Definitions: Updates = bug fixes, patches, minor enhancements; Upgrades = major features/improvements (not including separately licensed products); delivered remotely when feasible, with notice and post-install connectivity checks.

27.2. The Contractor shall furnish, install, and maintain all software/firmware updates, version changes, and upgrades; maintain up-to-date security patches; communicate known patch issues; ensure compatibility with VA patch management tools where applicable; test in non-clinical environments prior to broad deployment; schedule installation within mutually agreed timeframes.

27.3. Urgent Priority Updates

Updates tied to patient safety, regulatory requirements, security vulnerabilities, or EHR/VistA interface integrity are urgent. Provide an action plan within 30 calendar days of discovery/announcement and implement fixes within a mutually agreed time frame; coordinate VISN-wide scheduling; update and distribute all release notes and user/technical literature

28. Interfaces

Contractor shall implement, test, and support all interface requirements between BD CATO and VA systems (e.g., VistA/Federal EHR, host systems, and supported device integrations). The Contractor shall maintain its side of interfaces and coordinate with VA/third-party vendors for changes, upgrades, migrations, or host conversions; when Customer changes IS/platforms, Contractor uses reasonable commercial efforts to modify interfaces to restore functionality (time and materials where applicable).

29. Service Reports and Electronic Service Log

Within 72 hours of completion of any remote/onsite service call, provide a Service Report to facility POCs. Maintain a VA-accessible Electronic Service Log tracking service calls, repairs, updates/upgrades, version changes, corrective actions, parts replaced, dates/times, personnel, and root causes. Provide quarterly performance/utilization/ticket summaries, and host monthly service report meetings upon request.

Emails will be provided at award

Site Email

BHH (FTM, HS)

CIH

FAR

IOW

MIN

NWI (OMA, GRI,

LIN)

SUX

STC

30. Product Modifications, Recalls, EOL/EOS

Notify COR/POCs within 48 hours of any recall, EOL/EOS, or modification; provide identification, reasons, and steps for return/credit/replacement/corrective action; perform required actions across affected facilities.

31. Inspection and Acceptance

Conduct joint inspection with facility POCs upon completion; correct any deficiencies prior to acceptance; provide dates for remediation if not addressed immediately; all identified deficiencies must be fixed prior to acceptance; disputes resolved by the CO.

32. Delivery, Shipping and Materials

Coordinate deliveries with Supply Chain; provide storage plans; parts delivered and stored no more than one (1) week prior to installation; materials must be new in OEM unopened containers labeled with OEM name, model, serial, PO, Tech POC; tag BOM by area/room; use multi-container indicators (e.g., “Package 1 of 2”); provide shipping/tracking in advance; sites may reject non-conforming items.

33. Waste and Jobsite Cleanup

Contractor shall remove/dispose of all waste and packaging daily; provide a waste removal plan to COR/POCs; transport waste off-site.

34. Manuals, Release Notes and Service Bulletins

Provide unlimited electronic access to user/admin manuals, technical service documentation (schematics, diagnostics, parts lists), release notes, service bulletins, training videos; manuals shall match manufacturer service materials and include diagnostic codes/commands used in maintenance/repair/calibration.

35. Training

Provide staff training (clinical users and super users) and technical training (Biomedical Technicians) remotely and/or onsite (as applicable), scheduled to accommodate multiple shifts.

Include curriculum for: application use, workflows, troubleshooting, service passwords (where applicable), server maintenance/backup, interface configuration, and workstation setup.

Provide release-notes walk-throughs and informational sessions for major updates/upgrades.

36. Invoicing and Payment

Submit monthly invoices in arrears mapped to LINs and periods (facility, LIN, quantity, unit price, total, service dates, brief summary); consolidate line items per month; comply with VA FSC e-invoicing and include PO, contract number, LINs, PoP/dates.

37. Warranty

37.1. BD/CareFusion Limited Warranty: For one (1) year after Acceptance, product will perform substantially per the User Guide; remedy is repair or replacement.

37.2. Hardware Warranty (VISN Standard): New/replacement hardware added during PoP is covered under maintenance/response parameters and a 12-month warranty from Go-Live acceptance; factory-trained personnel shall perform service during warranty;

software updates provided for life of product at no charge where applicable.

38. Order of Precedence

In case of conflict, Federal law and the VA contract terms govern, followed by this PWS; BD schedules apply to licensing, support, PHI/privacy, and compliance as integrated herein;

services not in this PWS are out-of-scope.

39. Attachments

Attachment A: Site list, addresses, equipment/serials, LINs, quantities, unit prices, and PoP per site.

40. Abbreviations

AAMI – Association for the Advancement of Medical Instrumentation; AAR – After-Action Report; AHA – American Hospital Association ; BAA – Business Associate Agreement (HIPAA);

BD – Becton Dickinson / CareFusion (manufacturer of BD Cato IV Prep); BHH – Black Hills Health Care System (Ft. Meade/Hot Springs); CATO – BD Cato Medication Workflow / IV Prep System;

CAP – College of American Pathologists ;; CCE – Connectivity / Communication Enhancement (BD “CCE Basic Connectivity”); CDRH – Center for Devices and Radiological Health (FDA) ; CIH – Central Iowa Health Care System; CO – Contracting Officer; COR – Contracting Officer’s Representative; CPU – Central Processing Unit; DBMS – Database Management System; DR – Disaster Recovery; EHR – Electronic Health Record; EPHI / ePHI – Electronic Protected Health Information; FAR – Federal Acquisition Regulation (also, Fargo VA); FHD – Full High Definition (1920×1080 resolution); FIPS – Federal Information Processing Standards (140-2/140-3 Crypto);;

FSE – Field Service Engineer (OEM-Certified); GRI – Grand Island VA; HCI – Hyperconverged Infrastructure (e.g., Nutanix Acropolis); HIPAA – Health Insurance Portability and Accountability Act; HTM – Healthcare Technology Management; IOW – Iowa City VA Health Care System; ISSO

– Information System Security Officer; ISO – Information Security Officer (VA OIT); JCAHO – Joint Commission on Accreditation of Healthcare Organizations; LIN – Line Item Number; LTS – Long-Term Support (OS life-cycle designation); MDS2 – Manufacturer Disclosure Statement for Medical Device Security; MIN – Minneapolis VA Health Care System; MOU/ISA – Memorandum of Understanding / Interconnection Security Agreement (for secure external connections); NWI

– Nebraska-Western Iowa VA Health Care System; OIT – Office of Information and Technology (U.S. Department of Veterans Affairs); OS – Operating System; PaaS – Platform as a Service (VA-approved cloud category); PHI – Protected Health Information; PoP – Period of Performance; POC – Point of Contact; PWS – Performance Work Statement; RCA – Root Cause Analysis; RSS – Remote Support Services (BD terminology for remote diagnostics); S2S VPN – Site-to-Site Virtual Private Network (VA-approved connection method) ; SaaS – Software as a Service; SCCM – System Center Configuration Manager (Microsoft) ; SMAK-AM – System Monitoring and Accountability Knowledge – Anti-Malware (VA-required endpoint toolset); SQL

– Structured Query Language (Microsoft SQL Server 2019); SSO – Single Sign-On (Active Directory authentication); STC – St. Cloud VA Health Care System; TSC – Technical Support Center (BD 24×7×365 support); TPM – Trusted Platform Module (hardware security component); TRM – Technical Reference Model (VA software compliance requirement); UPS – Uninterruptible Power Supply; UL – Underwriters Laboratories safety standard ; VA OIT – Department of Veterans Affairs, Office of Information and Technology; VHA – Veterans Health Administration; VISN – Veterans Integrated Service Network; VMDK / OVA – VMware virtual machine file formats (supported by VISN 23 infrastructure); VistA – Veterans Health Information

Systems and Technology Architecture; WSUS – Windows Server Update Services (VA patching standard)