HT003826SC005-AOI00002_AOI 02 Posting Questions and Answers 20OCT26.xlsx
XLSX spreadsheet 103 KB Posted
- Solicitation number
- HT003826SC005-AOI0002
- Issued by
-
Defense Health Agency
About this file
This is a Questions and Answers (Q&A) document for Area of Interest (AOI) #02 under the Defense Health Agency (DHA) Commercial Solutions Opening (CSO HT003826SC005), addressing Data Exchange Platform (DxP) operations, modernization, and development.
The Government seeks commercial solutions to sustain and modernize the Data Exchange Platform, which processes real-time clinical and operational data with more than 15 external systems and partners, including the Department of Veterans Affairs and other Federal healthcare entities. The requirement covers four technical focus areas: (1) 24x7 legacy sustainment of Data Exchange Services (DES), Clinical Health Data Repository (CHDR), and Access Control Services Data Access Layer (ACS-DAL); (2) Risk Management Framework (RMF) and continuous Authority to Operate (ATO) readiness; (3) FHIR/HL7 modernization and real-time interoperability; and (4) OMOP Common Data Model transformation and AI/ML-ready capabilities. The incumbent contract (HHSN316201200022W Order 140D0422F0251, awarded to Mantech Advanced Systems Inc.) expires March 26, 2027, with the Government anticipating a 12-month base period and 30-day transition period following a March 2027 award. Phase I submissions are due October 28, 2026, and must include a five-page technical solution brief, two-page SOO crosswalk, 20-page draft Performance-Based Work Statement, and two-page Organizational Conflict of Interest mitigation approach, evaluated on a Go/No-Go basis against seven criteria. The Government will not provide specific technical details such as current SLAs, interface inventories, or architecture diagrams during Phase I; vendors must state assumptions and propose measurable performance targets. All work occurs in the Government's AWS GovCloud environment with Government-provided virtual desktop access; AWS consumption costs are Government-funded and must not be included in vendor pricing. Personnel must be U.S. citizens holding Tier 1, 2, or 3 investigations with appropriate IT-level designations for DoD environment access, with favorable adjudication required before system access is granted. The anticipated award instrument is Firm-Fixed-Price (FFP) milestone-based pricing under either FAR Part 12 or 10 U.S.C. 4022 prototype Other Transaction authority; the Government has not committed to a specific number of awards or division of scope and reserves the right to make one or multiple awards. All software code, configuration scripts, database structures, and documentation developed under the resulting contract must be delivered with Government Purpose Rights, though pre-existing commercial software may retain standard commercial license terms.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| Number | Question | Response |
| 1 | Is there any incumbent/recompete or this is a brand-new project? If yes, could you please provide us with their award number or even if the customer bought similar services in the past. | This requirement is a recompete of an existing requirement. The current incumbent contract is HHSN316201200022W Order 140D0422F0251, awarded to Mantech Advanced Systems Inc, with a period of performance of 03/27/22-03/26/27. The Government will not release nonpublic, proprietary, or protected information. |
| 2 | Objective 1 requires availability of DES, CHDR and ACS-DAL in alignment with established SLAs, which are not stated. Would the Government share the current SLA targets so the draft PWS performance measures can align to them? | The Government is not providing specific technical details like SLAs, interface inventories, or current architecture diagrams. This information may be provided in later phases. Proposals should state assumptions on items that require additional information. |
| 3 | Section 2.1 of the AOI names the legacy DES, CHDR and ACS-DAL services. Would the Government share a current inventory of the in-scope production interfaces and SOAP services so the draft PWS can size operations and phased migration? | See response to #2 |
| 4 | Section 5 requires Tier 1, 2 or 3 investigations and IT-Level designations. Does any position also require a collateral security clearance, with a DD Form 254 and a facility clearance held by the offeror? | No DD254 will be issued as part of this contract. Contractor will not have access to classified information. Compliance with DoW CUI, PHI, and PII standards and guidelines are identified in the SOO. |
| 5 | Is there an incumbent contract number for this requirement, and would the Government share it? | See response to #1 |
| 6 | May one lead vendor submit a single Phase I response that identifies proposed subcontractors or commercial technology partners and allocates responsibilities among them? | See response to #9 |
| 7 | Must all proposed personnel hold the stated clearance or IT-level eligibility when the Phase I response is submitted or is that required before award and access to DHA environments? | Phase I submissions should describe a credible staffing and transition approach demonstrating how personnel will meet the stated investigation, eligibility, and access requirements. Personnel must meet applicable requirements before receiving access to DHA environments. The AOI does not require offerors to demonstrate that all proposed personnel hold the required eligibility at Phase I; however, the proposed approach must demonstrate transition capability at award. |
| 8 | Does the Government Purpose Rights requirement apply to newly developed code, configurations, database structures and documentation while preserving a vendor’s properly identified pre-existing commercial software and background intellectual property? | The Government’s data-rights requirement is as stated in the AOI. All software code, configuration scripts, database structures, and documentation developed under the resulting contract shall be delivered to the Government with Government Purpose Rights. Offerors should clearly identify any pre-existing commercial software or other materials included in their proposed solution. |
| 9 | Would DHA consider a Phase I submission from a commercial solution provider addressing a discrete component of the overall requirement—specifically RMF, continuous ATO readiness, and compliance automation—or must each Phase I respondent independently provide a complete solution addressing all four technical focus areas? If component-level solutions are within scope, would DHA consider integrating such a capability within a multi-vendor solution or otherwise pairing it with other selected commercial capabilities? | The AOI requires each Phase I submission to propose a complete solution addressing all four technical focus areas. Component-only submissions are not within scope. The Government does not prescribe a teaming approach; respondents should comply with the AOI and SOO requirements. |
| 10 | Given the scope of the required Phase I response, which includes a 20 page draft Performance-Based Work Statement traceable to all Draft SOO objectives, performance measures, deliverables, and milestones, would the Government consider extending the Phase I submission deadline by two weeks, to November 11, 2026? Additional time would allow vendors to incorporate the Government's answers to these questions and to propose more precise, measurable performance standards, which we believe would improve the quality and comparability of responses. | The Government does not intend to extend the Phase I submission deadline at this time |
| 11 | Can the Government provide baseline information for the DES, CHDR, and ACS-DAL environments, including the number of active interfaces, approximate daily transaction volumes, current availability targets, and existing Service Level Agreement values? | See response to #2 |
| 12 | Can the Government describe the current technology stack for these systems (for example, application frameworks, messaging middleware, and databases) and the AWS GovCloud services currently in use? | See response to #2 |
| 13 | Will the Government provide existing Interface Control Documents, architecture diagrams, or runbooks to vendors invited to Phase II? | See response to #2 |
| 14 | Must proposed personnel hold the required Tier 1, 2, or 3 investigations at the time of Phase I submission, or may vendors propose a staffing pipeline in which investigations are initiated or transferred after award? | See response to #7 |
| 15 | Does the existing DxP ATO boundary transfer to the awardee as Government Furnished Information, and which AWS GovCloud services are currently authorized within that boundary for modernization and AI/ML use? | The existing ATO boundary will remain with the system. Each new capability added to DxP will require accreditation through the RMF process. |
| 16 | Will the Government accept a commercial services offering built on mature commercial and open source components (for example, AWS managed services, HAPI FHIR, OHDSI tools, and Apache Kafka) as satisfying the commercial solution criteria for this AOI? | Proposals will be evaluated according to the stated Go criteria. |
| 17 | Is the current incumbent eligible to respond to this AOI, and what is the period of performance end date for the current support contract? | See response to #1 |
| 18 | Section 5 requires contractor personnel to be U.S. citizens holding Tier 1, 2 or 3 investigations for access to DoD environments. Does the citizenship requirement apply to personnel who will not access DoD environments, systems or data? | See response #7 and #34. |
| 19 | Phase I format. The AOI directs respondents to the attached documents for submission requirements. Please confirm the Phase I white paper page limit and page format, and whether a required template or response outline is issued. | Phase I submission requirements are stated in AOI Section 3.1. No template or response outline is provided. Standard business formatting is recommended, including 1-inch margins and a legible font of 11 points or greater. Each required component must comply with the applicable page limit stated in AOI Sections 3.1(a) through (d). Unless expressly stated otherwise in the AOI, all pages submitted as part of a component, including cover pages, tables of contents, lists of acronyms, references, tables, and graphics, count toward that component’s page limit. The page limits are firm, and the Government may decline to review material exceeding those limits. |
| 20 | Award path. Please confirm the intended award instrument and sequence - whether the Government contemplates a Phase I white paper, then a Phase II prototype or demonstration, then a follow-on production award under the same CSO authority, and whether each phase is separately competed. | The AOI outlines a multi-phase CSO process. The anticipated pricing structure will be Firm-Fixed-Price (FFP). |
| 21 | Contract type for the sustainment baseline. For the Data Exchange Platform operations and sustainment work, does the Government intend a firm-fixed-price managed-service construct, a time-and-materials construct, or a hybrid, and is a performance work statement or service-level baseline available at Phase I? | See responses to #2 and #20 |
| 22 | Set-aside and teaming. Please confirm whether any small-business set-aside, or a small-business participation goal, is contemplated for AOI 02, and whether teaming or subcontracting arrangements may be presented at Phase I. | See response to #9 |
| 23 | Incumbent and current vehicle. Please confirm the current contract vehicle and whether an incumbent contractor currently performs the Data Exchange Platform operations and sustainment functions described. | See response to #1 |
| 24 | Evaluation criteria. Please confirm the Phase I evaluation factors and their relative weighting, and whether a live demonstration or a customer reference is expected at Phase I or only at Phase II. | Phase I submissions will be evaluated on a Go/No-Go basis in accordance with AOI Section 3.2. A submission must satisfy all seven stated Go criteria to receive a Go rating; the AOI does not establish relative weights or require a specific number of customer references. Phase I will be evaluated based on the written submission, and no oral presentation or live demonstration is planned. If conducted, Phase II may include oral presentations, live demonstrations, and additional validation or information requests for selected vendors. |
| 25 | Question and answer publication. Please confirm whether questions received by the 14 October 2026 deadline and the Government answers will be posted for all potential respondents, and where. | The Government will post responses to timely submitted questions and any related updates on SAM.gov under the original AOI posting. Interested parties should monitor the original posting for updates. |
| 26 | May an eligible lead offeror identify a specialist subcontractor responsible for only an explicitly scoped portion of Focus Areas 2–4, while the lead demonstrably meets the entire four-area Go/No-Go requirement, or must all past performance and capabilities reside with the lead itself? | See response to #9 |
| 27 | Would DHA consider a stand-alone, narrower commercial capability or technical demonstration in a later acquisition/action under the parent CSO, separate from this AOI #02 integrated 24x7 solution, and if so, what is the authorized mechanism for such a submission? | The Government is not considering alternate scopes under this AOI. Interested parties should submit responses consistent with the AOI requirements. |
| 28 | Please confirm any required font size, margins, and page size for the Phase I volumes. Please also confirm whether a cover page, title block, or table of contents counts toward each volume's page limit. | See response to #19 |
| 29 | The AOI requires that software code, configuration scripts, database structures, and documentation developed under the resulting award be delivered with Government Purpose Rights. Please confirm that pre-existing commercial software incorporated into a proposed solution may be furnished under standard commercial license terms (DFARS 227.7202), with GPR applying to items developed under the award. | See response to #8 |
| 30 | Please identify any FHIR Implementation Guides (for example, the US Core version or VA/DoD-specific profiles) that the Government expects responses to target. | See response to #2 |
| 31 | The AOI/SOO require U.S.-citizen personnel with Tier 1/2/3 (or equivalent) investigations and favorable PSIs for DoD environment access. May personnel begin work with an investigation initiated and in process, or must favorable adjudication be complete before access is granted? Which IT-level designations apply to Phase I performers vs. later phases? | Personnel may perform authorized transition or knowledge-transfer activities that do not require CAC or system access while an investigation is pending. Favorable adjudication is required before CAC issuance or access to DoD environments is granted. Phase I does not authorize contractor performance; applicable personnel eligibility and IT-level requirements for later phases or any resulting award are stated in the SOO and will be addressed as applicable. |
| 32 | For DES, CHDR, and ACS-DAL, what are the current SLA targets (availability, Tier 2/3 response and resolution times)? Will the Government evaluate an automation-heavy monitoring model with principal-engineer on-call response as responsive at Phase I, with staffing scale-up defined in Phase II/III? | See response to #2 |
Submission will be reviewed for contractor's proposed solution.
| 33 | The SOO states work occurs in the Government's authorized AWS GovCloud environment with a Government-provided virtual desktop. What is the expected lead time and process for a new small-business offeror to receive accounts and access after Phase I selection? | See response to #31 | ||
| 34 | Should the four Phase I parts (Technical Solution Brief, SOO Crosswalk, Draft PWS, OCI Approach) be submitted as one combined PDF or separate files? Are there font, margin, or email-size requirements beyond the stated page limits? | Offerors may submit the Phase I components as a single compiled file or as separate files. Each component must independently comply with the applicable page limit in AOI Section 3.1. See response to #19 for formatting requirements. | ||
| 35 | For Focus Area 3, how will the Government weigh demonstrated HL7v2/FHIR delivery experience combined with a specification-based OMOP CDM transformation approach, where the offeror's OMOP work would be performed and validated under this effort? | See response to #24. | ||
| 36 | May an offeror introduce teaming partners or subcontractors at Phase II or Phase III that were not named in the Phase I response? | See response to #9 | ||
| 37 | The notice names Boston Consulting Group and Andrew Morgan, LLC as potential reviewers. Should offerors address any OCI considerations involving these advisors in Part D, or is Part D limited to the offeror's own conflicts? | Part D is not limited to conflicts involving the named non-Government advisors. Vendors must identify known or potential organizational conflicts of interest associated with their proposed team, including subcontractors and teaming partners, and describe their mitigation approach. If a vendor is aware of a potential conflict involving a named advisor, it should address it in Part D. | ||
| 38 | If a prototype OTA under 10 U.S.C. § 4022 is used, please confirm that small-business / nontraditional-defense-contractor status satisfies the § 4022(d) participation criterion for an offeror in Daveclar's position. | The Government will evaluate eligibility and participation requirements, as applicable, in accordance with 10 U.S.C. § 4022 and the terms of any resulting solicitation or award. The Government will not make advance determinations regarding an individual vendor’s eligibility or status. | ||
| 39 | Could you kindly let me know whether the EIDS PMO would welcome white papers from small business teams, or whether small business participation is expected through teaming with a larger offeror? | See response to #9 | ||
| 40 | Do the cover page, table of contents, acronym list, figures, and appendices count toward the page limits? May the SOO traceability appendix to the 20-page work statement be submitted as a separate attachment? Would a link to a code repository or recorded demonstration be reviewed, and would that content count toward the limits? Please also confirm the minimum font size, page size and margins, file format (PDF or Word), whether the four parts may be separate files, and the maximum attachment size (or whether DoD SAFE may be used). | See response to #19, #34, and #122. No external links/repositories will be reviewed. | ||
| 41 | Will the Government provide a bidders' library before October 28 with the current SLAs, Interface Control Documents, architecture diagrams, and runbooks for DES, CHDR, and ACS-DAL? If any are CUI, how will you release them? If no library is planned, please provide the SLA targets (availability, restoration, and remediation by severity), approximate daily transaction volume, number of environments, and the Tier 1 support provider. | See response to #2 | ||
| 42 | Which DxP components already run in production on an API gateway, containerized microservices, or FHIR interfaces? Will the awardee receive the existing source code, infrastructure code, ATO package, and ICDs, and under what data rights? | See response to #2 | ||
| 43 | Please identify the "more than 15 external systems and partners" with protocol, message standard and version (for example HL7 v2.x, HL7 v3, IHE profiles, C-CDA, FHIR), transport, and direction. Are IHE national-network transactions in scope for transition, or retained as standards-based interfaces? Will any partner be required to change its interface during the base period? | See response to #2 | ||
| 44 | Which authoritative service maps DoD and VA patient identifiers, and how are link, unlink, and merge events delivered to the DxP? Which consent and segmentation requirements apply (for example, 38 U.S.C. § 7332 and 42 CFR Part 2), and which component enforces them today? | See response to #2 | ||
| 45 | At what impact level is the DxP authorized, and is the authorization a continuous ATO? Beyond Azure DevOps, which source control, CI/CD, scanning, monitoring, and IT service management tools are in use, and are vendors expected to use them? Must vendor-proposed tools hold a DoD provisional authorization or appear on a DHA-approved list? | a. | IL4 | |
| b. | No Continuous ATO but we are working toward it for MIP-SF | |||
| c. | MIP-SF uses Trivy Scanning tool for the CI/CD Pipelines and yes vendors are expected to use the tool. | |||
| d. | Yes, they must be on the DHA-Approved Product List (APL). | |||
| 46 | SOO §5 refers to Tier 1, 2, or 3 investigations and IT-level designations. Which apply to each role, including privileged GovCloud administrators? Does any role require eligibility for access to classified information, a facility clearance, or a DD Form 254? May personnel begin work on an interim determination, and what is the typical time to CAC and virtual desktop access? Since remote work is authorized, what does "facility access" in GO criterion 7 require? | See response to #4 and #31, facility refers to system access for criterion 7. | ||
| 47 | What transition-in period is anticipated? Will the current provider support an overlap and knowledge transfer? Does the 12-month base period begin at award or after transition-in? | See response to #80 | ||
| 48 | Does "zero disruption" exclude CCB-approved maintenance windows and partner-coordinated cutovers? | Offeror should propose their solution to meet this criterion. | ||
| 49 | Under the anticipated milestone-based FFP structure, will operations be paid monthly, separate from modernization milestones, and how will milestone acceptance treat delays caused by Government dependencies such as CCB, ATO, or partner availability? Are AWS GovCloud accounts and consumption costs provided by the Government, with the vendor responsible for administration and cost optimization? | Specific payment structures, milestone alignments, and government dependency terms will be negotiated prior to award. The government provides the AWS GovCloud hosting environment. The contractor is responsible for system administration, operations, and cost optimization. | ||
| 50 | Are DFARS 252.204-7012 or CMMC requirements expected when all work is performed on the Government virtual desktop? What requirements apply to contractor-owned devices used to reach it, and to whom should contractors report cyber incidents and privacy breaches? | DFARS 252.204-7012 and standard DoD endpoint security policies apply; cybersecurity incidents or privacy breaches must be reported immediately to the Contracting Officer (CO) and the EIDS Program Manager. | ||
| 51 | System inventory. The AOI states that the Data Exchange Platform exchanges real-time clinical and operational data with more than fifteen external systems and partners. Can the Government provide the current interface inventory and, where releasable, the interface specifications and message standards in use today? | See response to #2 | ||
| 52 | Standards in force. Please confirm the current interface standards and versions in production (for example FHIR, HL7 version 2.x or version 3, CDA, DICOM), and whether the Government target end state imposes a specific mandatory standard or version. | See response to #2 | ||
| 53 | Hosting boundary and authorization. Please confirm the required hosting boundary and the authorization the solution must hold or inherit - specifically whether the Government provides the authorization boundary or the contractor must bring its own, and whether a FedRAMP or Department of Defense cloud authorization is required at Phase I or only at the point of award. | The MIP-SF has an active ATO. | ||
| 54 | Legacy sustainment and transition. Please describe the Government expectation for sustaining the legacy services in parallel while modernisation proceeds: is a defined cutover plan, a dual-run period, or a fixed legacy decommission date contemplated? | Offerors should describe their proposed approach to sustaining legacy services during modernization in accordance with AOI Section 3.1. | ||
| 55 | Data classification and volumes. Please confirm the data classifications the platform handles and provide, to the extent releasable, current volumes and throughput so that hosting and sustainment can be sized responsibly. | See responses to #2, #45, #239, #541, #542, and #550. |
This effort does not involve classified data; therefore, a DD Form 254 is not applicable.
However, all data handled by the platform is considered sensitive and contains Controlled Unclassified Information (CUI), Protected Health Information (PHI), and/or Personally Identifiable Information (PII). All systems and data must adhere to stringent DoD/DHA cybersecurity, privacy, and safeguarding requirements for CUI within a DoD Impact Level 4/5 (IL4/IL5) environment.
Specific operational volume and throughput metrics are not being provided during Phase I. Offerors must state their architectural and sizing assumptions in their response. As noted in other responses, underlying AWS GovCloud hosting and consumption costs are funded directly by the Government and should not be included in vendor pricing.
| 56 | Test environment and data. Will the Government provide a development or test environment, and representative test data, or is the contractor expected to stand up and populate its own non-production environment? | Provided by the Government |
| 57 | AI/ML readiness. The AOI describes an AI/ML-ready end state. Please confirm whether the Government intends the Data Exchange Platform to host inference workloads, or to deliver a governed, modelled data layer that downstream analytics consume. | See response to #2 |
| 58 | Personnel and place of performance. Please confirm whether any personnel on this effort require a security clearance or background investigation, and whether the Government contemplates on-site presence or permits distributed performance. | See response to #4. All work is performed in the GovCloud, no physical presence is required. |
| 59 | Proprietary review. Please confirm the process by which a respondent marks proprietary material for protection from the named non-Government advisors, and the point of contact for any objection to that review. | Per the AOI posting, respondents are responsible for clearly marking all proprietary, restricted, or competition-sensitive information on each applicable page. Companies with concerns or objections regarding support-contractor access must contact the Primary Point of Contact (Lacey Lockard, lacey.n.lockard.civ@health.mil) prior to submission. |
| 60 | What are the format requirements for the Phase I solution brief — page limit, file format, font/margin requirements, and any required sections or template? Is there a separate administrative/volume or pricing component at Phase I? | See response to #19 |
| 61 | Should the brief be organized against specific headings (e.g., technical approach, solution maturity, commercial viability), and should respondents map their solution explicitly to the four assessment areas named in the AOI (solution maturity, technical feasibility, commercial viability, acquisition pathway)? | The AOI does not prescribe a required response outline. Offerors should organize their submissions to address the AOI requirements and evaluation criteria. |
| 62 | Is a pitch session, demonstration, or oral presentation part of the Phase I evaluation, or will Phase I be evaluated on the written brief alone? | No oral presentation, pitch session, or demonstration is planned for Phase I. The Government will evaluate Phase I submissions in accordance with the process stated in the AOI |
| 63 | When does the Government expect to post answers to submitted questions, and will answers be distributed to all interested vendors or only to those who submit questions? | The Government will post responses to timely submitted questions and any related updates on SAM.gov under the original AOI posting. Interested parties should monitor the original posting for updates. |
| 64 | The Draft SOO requires personnel to possess and maintain Tier 1, 2, or 3 investigations with IT-level designations. Will DHA sponsor investigations initiated after award for qualified U.S. citizen personnel who do not currently hold a favorable Tier 2 or Tier 3 determination, and may personnel begin non-privileged work (for example, design and development in non-production environments) while those investigations are pending? | See response to #31 |
| 65 | Is a small business prime that teams with a subcontractor for 24x7 Tier 2/3 legacy sustainment acceptable under this AOI, and does DHA have a preferred award instrument (FAR Part 12 contract or 10 U.S.C. 4022 prototype OT) for the modernization work? | See response to #9 |
| 66 | For Phase II or any pitch, will DHA provide current artifacts such as the service and API inventory for DES, CHDR, and ACS-DAL, interface control documents for the external partners, and current SLO and availability data? | See response to #2 |
| 67 | Given that the solicitation permits the Government to make one or multiple awards, would DHA consider Phase I submissions from specialized vendors proposing to address a defined subset of the Statement of Objectives, such as software quality assurance, automated testing, and independent validation, rather than all four technical focus areas? | See response to #9 |
| 68 | If partial-scope submissions are not acceptable under this Area of Interest, does DHA anticipate opportunities for specialized small businesses to participate in discrete testing or quality engineering workstreams through separate awards or other acquisition approaches? | See response to #9 |
| 69 | If the requirement is intended to be awarded as an integrated solution, does DHA anticipate that specialized small businesses may participate as subcontractors or teaming partners under the resulting award? | See response to #9 |
| 70 | the SOO requires Tier 1/2/3 or IT-level designations. Please confirm whether offerors may propose U.S.-citizen personnel whose investigations the Government sponsors at award, or whether clearances must already be held at time of proposal. This materially affects small-business participation. | See response to #7 |
| 71 | please define the measurable standard for zero disruption during modernization (for example, no unplanned partner-visible outage; a rollback time threshold; parity-gated cutover evidence), so offerors can commit against a testable bar. | See response to #48 |
| 72 | please confirm formatting guidance for the four Phase I documents (font and size, margins, cover pages, and whether cover sheets count against page maxima) and whether submissions should be PDF attachments to this mailbox. | See response to #19 |
| 73 | for Focus Area 1, may offerors name 24x7 managed-services teaming partners at Phase II, or must partnerships be evidenced in the Phase I submission? | See response to #9 |
| 74 | will the Government release, or summarize in its question responses, the current interface inventory (protocols, partner counts, message volumes, peak throughput) for DES, CHDR, and ACS-DAL, so Phase I approaches can be sized honestly? | See response to #2 |
| 75 | does the Government have a standing broker or container standard (for example, MSK versus Kinesis, or ECS versus EKS) that solutions should target, or is that an offeror recommendation? | See response to #2 |
| 76 | Would DHA consider a Phase I response proposing a bounded API/interoperability, automated testing and DevSecOps engineering workshare under a qualifying operations provider, with the operational responsibilities and dependencies explicitly identified, or must each responding vendor demonstrate a complete integrated approach meeting all Go criteria? If the bounded approach is permissible, should the response identify a committed operations provider at Phase I? | See response to #16 |
| 77 | would the Government consider a Phase I response from a teaming arrangement in which a cleared partner leads 24x7 operations while we lead the modernization and developer-experience objectives? | See response to #9 |
| 78 | Page counting: do cover pages, headers, footers and figure captions count toward the five, two, 20 and two page limits? Is there a minimum font size or required margin? Our working assumption is a cover page that isn't counted, 12-point body text, 9-point tables and captions, and one-inch margins. | See response #19 |
| 79 | Submission format: does the Government prefer PDF or Microsoft Word, one file per document or a single package, and what is the attachment size limit for lacey.n.lockard.civ@health.mil? May a response be split across more than one email if the limit requires it? | See response to #19, #34, and #122. |
| 80 | Transition overlap: does the Government intend for the current data exchange support contractor to remain in place after the anticipated March 2027 award to provide an overlap period, and if so, for how long? Will the Government furnish the current runbooks, interface control documents and monitoring configuration at award if the outgoing team isn't available? | For planning purposes, the Government anticipates a 12-month base period and a 30-day transition period. Specific transition support and Government-furnished information will be addressed in subsequent phases with selected vendors and, as applicable, in any resulting award. |
| 81 | ACS-DAL baseline: can the Government describe the Access Control Services Data Access Layer technical baseline (platform, interfaces, consumers, hosting) at the same level of detail available publicly for DES and CHDR, or provide it to Phase II invitees under non-disclosure terms? | See response to #2 |
| 82 | Interface scope and volumes: approximately how many external partner interfaces, message types and consumers are in scope across DES, CHDR and ACS-DAL today, and what are the current transaction volumes and established service level agreements the Government measures against? | See response to #2 |
| 83 | FHIR repository: is a contractor-operated FHIR R4 repository inside the DxP authorization boundary acceptable, given that no managed FHIR service is offered in AWS GovCloud? Does the Government expect reuse of an existing EIDS FHIR service or platform? | See response to #2 |
| 84 | Authorization path: for the base period, does the Government intend a continuous ATO under the DoD CIO continuous ATO criteria or a conventional ATO with continuous monitoring? Which release of the DoD Cloud Computing SRG and which impact level apply to the DxP, and does the DxP currently operate under an approved DevSecOps platform? | a. Answered in question #45 |
b. DHA provides the Cloud SRG we are currently on V4.
| 85 | Standards versions: which US Core (USCDI) version and which OMOP CDM version does the Government want vendors to target, and should OMOP work align to the MHS Common Data Model? | See response to #2 |
| 86 | Access lead times: what is the typical lead time after award for Government Azure DevOps accounts, the virtual desktop environment, CAC issuance and AWS GovCloud account roles for contractor staff? | See response to #31 |
| 87 | Clearance tiers by role: which positions does the Government expect to require a Tier 3 investigation or IT-I designation versus Tier 1 or Tier 2, and may personnel begin work on interim eligibility? | See response to #7 |
| 88 | Verifiable commercial experience: does experience performed as a subcontractor count as verifiable commercial experience under Go criterion 2, and will the Government contact references during Phase I? | Experience of the offeror with the Government, DoW, large-scale data exchange platforms in all capacities should be documented. |
| 89 | Commercial maturity evidence: what evidence does the Government want in Phase I to satisfy Go criterion 4 (for example product documentation, customer references, licensing terms, deployment history), given that Phase II may request pricing and demonstrations? | See response to #88 |
| 90 | Multi-vendor environment: which other contracts or vendors currently touch the DxP (for example MIP, HIA, MHS GENESIS and Federal EHR integrators), and is there an existing interface change process or Scrum of Scrums the awardee will join? | See response to #2 |
| 91 | Priority use cases: which near-real-time data exchange use cases and which AI/ML use cases would the Government want delivered first in the base period, and are there existing demand or onboarding backlogs the developer portal should absorb? | See response to #2 |
| 92 | Instrument preference: at this stage, does the Government have a preference between a FAR Part 12 award and a 10 U.S.C. 4022 prototype Other Transaction, and does nontraditional defense contractor status factor into the Phase II evaluation? | See response to #20 |
| 93 | Cybersecurity service provider: which cybersecurity service provider supports the DxP today, and will the awardee forward telemetry to its SIEM and follow its incident reporting timelines? | NIWC CSSP and CyOC |
| 94 | Zero Trust allocation: has DHA allocated Zero Trust Target Level activities to the DxP as a system, and if so, which activities and dates will the awardee be expected to deliver? | a. We have just completed a gap analysis but do not have a list of activities at this time. However, Zero Trust must be completed by September 2027. |
| 95 | Incident system and priority matrix: what is the ITSM system of record for incidents, is Azure DevOps also the incident ticket system, and what priority definitions and response targets apply today? | GSD provides Tier 1 support. See response to #2 |
| 96 | Interface transports: does the CHDR exchange with VA run over MLLP or HTTPS, which IHE profiles (if any) does DES expose to external partners, and does the current baseline already include an API gateway or a commercial interface engine the awardee would inherit? | See response to #2 |
| 97 | Access sponsorship: will the Government designate a trusted agent for CAC sponsorship at award, how many virtual desktop seats can be provisioned for transition-in, and may transition-in begin before the current support order ends? | Yes, Government will provide a CAC sponsor. All contractor employees with a CAC will be provisioned for a virtual desktop. See response to #80. |
| 98 | Data sources and licenses: which data sources does the Government expect to map into OMOP first, and will the Government furnish the vocabulary licenses (UMLS for SNOMED CT, AMA for CPT) a terminology service needs inside the boundary | See response to #2 |
| 99 | Program Increment calendar: what Program Increment length and iteration cadence does the EIDS PMO run on its SAFe calendar, and when does the first full PI after the anticipated March 2027 award begin? | See response to #2 |
| 100 | eMASS and continuous monitoring: which eMASS instance will hold the DxP authorization package, will contractor staff receive eMASS accounts and in which roles, is eMASS API access available for automated evidence upload, and does DHA operate a continuous monitoring dashboard the Authorizing Official uses? | MIP-SF |
b. If eMASS access is needed you will only be given “Read Only” Access.
| 101 | GovCloud streaming and caching services: are Amazon MSK Connect, MSK tiered storage and Amazon ElastiCache authorized at the DxP's impact level in the Government's AWS GovCloud account and region, and does the Government prefer a managed streaming service or self-hosted Kafka on EKS inside the existing boundary? | See response to #2 |
| 102 | May respondents satisfy the Phase I experience, commercial maturity, operational capability, and staffing criteria through the combined capabilities of the prime and named subcontractors? Which qualifications must reside with the prime, and what teaming commitments or supporting evidence are required in Phase I? | See response to #9 |
| 103 | Please identify the systems and infrastructure within the contractor’s operating responsibility, including any on-premises or non-AWS environments. How are responsibilities divided among the contractor, DHA, and other providers for cloud administration, networking, identity, security monitoring, and Tier 1 support? | See response to #2 |
| 104 | Please identify the incumbent contractors and current contract or task order numbers. Will DHA provide the releasable current PWS, staffing and coverage levels, system and interface inventory, transaction volumes, and recent service performance to establish a common planning baseline? | See response to #1 |
| 105 | What transition period and incumbent overlap are anticipated, and when must the successor assume full operational responsibility? Please clarify the availability of knowledge transfer, repositories, runbooks, and Government-sponsored access, including the treatment of delays outside the successor’s control | See response to #80 |
| 106 | Does 24x7 support require continuously staffed coverage, on-call coverage, or a specified combination? Please provide required availability, incident response and restoration targets, RTO/RPO, and the acceptance criteria for “zero disruption” and “zero downtime,” including treatment of external system outages. | See response to #190 |
| 107 | Please identify applicable data classifications, cloud impact levels, and authorization boundaries. Please also distinguish personnel investigation and IT-level requirements from classified-access clearances, identify any facility clearance requirements, and clarify which requirements must be satisfied at Phase I, award, or transition. | a. See response to #45 |
b. It is within the AOI
| 108 | Which interfaces and modernization outcomes should respondents prioritize during the first Program Increment and base period? Please distinguish required demonstrations from production deployments and identify Government acceptance criteria, approved test data, and support available from mission partners and clinical subject matter experts | See response to #2 |
| 109 | Should Phase I respondents use the SOO’s 12-month base period and milestone-based firm-fixed-price structure as the planning basis? Is a funding range available, and who will fund AWS consumption, software licenses, test environments, and third-party support? | For planning purposes only, offerors should use the anticipated 12-month base period and Firm-Fixed-Price pricing structure stated in the SOO. No additional funding-range or cost-responsibility information is provided at this time. |
| 110 | The documents emphasizes sustaining mission-essential legacy operations while modernizing toward cloud-native, API-driven, and AI/ML-ready capabilities. Could the Government clarify the expected balance or priority between maintaining legacy system availability and accelerating modernization efforts? Specifically: 1) Are there critical legacy systems or services that must remain fully operational without interruption during modernization? 2) What are the acceptable levels of risk or downtime during transition phases? 3) Are there preferred modernization milestones or phased delivery expectations? | See response #54 |
| 111 | The Government seeks commercially available capabilities that may require configuration, integration, or modification. Could the Government provide: 1) A list or examples of preferred or mandated commercial off-the-shelf (COTS) products or platforms currently in use or under consideration? 2) Clarification on the extent to which custom development or proprietary solutions are acceptable or preferred? 3) Any constraints or preferences regarding open-source versus proprietary technologies? | The Government is seeking commercially available solutions consistent with the AOI and SOO. Offerors should propose the commercially available capabilities, including any necessary configuration, integration, or modification, that best meet the stated objectives. |
| 112 | The Government desires AI/ML-ready capabilities and developer self-service. Could the Government elaborate on: 1) The current AI/ML platforms or toolsets in use or planned for integration? 2) Expectations for AI/ML model development, deployment, and lifecycle management support? 3) Any specific AI/ML use cases or performance metrics that the solution must address? | See response to #2 |
| 113 | The solicitation references Government Azure DevOps (ADO) for delivery and dependency management. Please clarify: Is the Government’s Azure DevOps environment fully provisioned and accessible to the contractor at contract start? 2) Are there specific DevSecOps pipelines, automated testing frameworks, or CI/CD tools mandated or preferred? 3) What level of integration with Government security and monitoring tools is expected? | Government ADO will be available to the awardee, subject to applicable access and security requirements. Offerors should propose their DevSecOps approach and integration with Government security and monitoring tools. |
| 114 | The Draft SOO outlines requirements for high-availability operations, monitoring, and incident response. Please clarify: 1) What are the specific uptime or availability targets (e.g., 99.9%, 99.99%) for critical services? 2) Are there defined Service Level Agreements (SLAs) or Key Performance Indicators (KPIs) for incident response times and resolution? 3) What are the Government’s expectations for incident reporting, escalation procedures, and root cause analysis? | See response to #2 |
| 115 | There is a reference to alignment with cybersecurity and Risk Management Framework (RMF) requirements. Could the Government provide: Details on the specific cybersecurity standards, policies, and frameworks that must be adhered to (e.g., FedRAMP, FISMA, NIST SP 800-53)? Any existing Authority to Operate (ATO) or security accreditation status for current systems? Expectations for continuous monitoring, vulnerability management, and penetration testing? | a. Answered in question #45 |
b. Yes
| 116 | The Government requires current, usable technical documentation and orderly transition-in and transition-out support. Please clarify: The expected level of detail and format for technical documentation deliverables? The duration and scope of transition-in and transition-out periods? Any existing knowledge repositories or tools that the contractor must use or integrate with? | See response to #80 |
| 117 | To help offerors propose an architecture that complements the Department's broader direction, could the Government please describe how the DxP modernization effort is expected to relate to other current or planned DHA data and IT modernization initiatives? In particular, could the Government clarify the anticipated relationship between the modernized DxP and the Department's efforts to use the War Data Platform to expand access to and visibility of MHS data? | Data housed in EIDS storage/platforms will be federated into WDP through a variety of mechanisms depending on the requirements of the use case. |
| 118 | Objective 1 of the Draft SOO calls for operational availability, reliability, and performance of DES, CHDR, and ACS-DAL 'in alignment with established Service Level Agreements (SLAs).' Section 3.1(c) of the AOI asks offerors to describe their approach to applicable service-level objectives and to define measurable outcomes and performance measures in the draft performance-based work statement. To help offerors propose service levels that are realistic and match current operations, could the Government please provide whatever baseline information it is able to share? | See response to #2 |
| 119 | Please confirm required file formats, whether each Phase I component should be submitted separately or in one file, and applicable font, margin, page-size, and file-size requirements. Please also clarify whether covers, contents pages, and references count toward each page limit. | See responses to #19 and #34. |
| 120 | Please identify the anticipated performance start date, authorized transition duration, incumbent overlap, and Government-furnished transition materials and support. When must personnel access and operational readiness be demonstrated? | See response to #7, #24 and #2 |
| 121 | May a team (prime plus subcontractors) submit a single response covering all four focus areas? Will submissions addressing only a component (for example, real-time event streaming) be considered, or rated No-Go? | See response to #9 |
| 122 | Please confirm font size, margins, page size, file type, and email size limit, and whether the cover page, table of contents, and tables count toward the 5/2/20/2-page limits. May all four parts be submitted in one email or file? | See response to #19 and #34. The AOI does not establish a specific email attachment-size limit; offerors are responsible for ensuring their submissions are received by the deadline. |
| 123 | Is an active SAM.gov registration and CAGE code required at Phase I submission, or only prior to award? | An active SAM.gov registration and CAGE code are not required to submit a Phase I response; however, the selected vendor must maintain an active SAM.gov registration and CAGE code before award. |
| 124 | Must proposed staff already hold Tier 1/2/3 investigations at Phase I, or is a credible staffing pipeline acceptable? Will the Government sponsor investigations after award? | See response to #7 and #31 |
| 125 | Can the Government share, or provide under NDA, current SLAs, the interface and partner inventory, message volumes, current streaming/integration technology, and the incumbent and transition timeline? | See response to #2 |
| 126 | Can the Government share, or provide under NDA, current SLAs, the interface and partner inventory, message volumes, current streaming/integration technology, and the incumbent and transition timeline? | See response to #8 |
| 127 | Do the page limits exclude cover pages, tables of contents, acronym lists, and diagrams? | See response to #19. |
| 129 | Please also confirm any font, margin, or file-format requirements | See response to #19 |
| 130 | AOI Section 3.1(b) references “Section 3.1, Item 3” for the PWS. Could the Government confirm whether this reference is intended to point to Section 3.1(c)? | Corrected in AOI; Yes Section 3.1(c) is the correct reference. |
| 131 | Is the DxP currently supported under an existing contract? If so, will incumbent documentation, including runbooks, architecture diagrams, and interface control documents (ICDs), and knowledge-transfer support be available to the awardee during transition-in? | See response to #80 |
| 132 | Is an overview of the Data Exchange Services (DES), Clinical Health Data Repository (CHDR), Access Control Services Data Access Layer (ACS-DAL) systems that includes their technology stack, current architecture, hosting details, and functional specifications available? | See response to #2 |
| 133 | What are the established SLAs for these systems? | See response to #2 |
| 134 | What are the monthly volumes of incidents by priority and tier, service requests, change board changes, and releases? | See response to #2 |
| 135 | Are operational volumes available (e.g. transactions per day and at peak, data volumes, number of SOAP calls per day) | See response to #2 |
| 136 | Which flows should be modernized in the 12-month base period? Are interface control documents available for them prior to award? | See response to #2 |
| 137 | Are there any priority AI/ML use cases that DHA has in mind (for example, NLP on clinical notes, or operational analytics), and who will use the results? | See response to #2 |
| 138 | Who uses the portal (Federal partners, commercial partners, internal developers), and how many partners per year? | See response to #2 |
| 139 | What does today's developer partner onboarding process look like and how long does it take? | This information may be provided in later phases. Proposals should state assumptions on items that require additional information. See response to #31 |
| 140 | Will the portal be reachable outside DoD networks, and what kind of authentication will it need to use? | See response to #2 |
| 141 | The AOI does not specify font, font size, margins, or line spacing. Will the Government set formatting minimums (e.g., 11-pt font, 1" margins, single spacing), or may vendors use their standard corporate format? | See response to #19 |
| 142 | Are cover pages, tables of contents, acronym lists, transmittal/cover letters, and section dividers excluded from the stated page limits for each volume? | See response to #19 |
| 143 | May text inside figures, tables, and graphics use a smaller font than body text, and if so is there a minimum legible font size the Government will enforce? | See response to #19 |
| 144 | Should the four components (Technical Solution Brief, Draft SOO Crosswalk, Draft PWS, OCI Mitigation Approach) be submitted as one combined file or separate files, and is a specific format required (searchable PDF or Word)? | See response to #34 |
| 145 | Is there a maximum email or attachment size, a required file-naming convention, and will the Government confirm receipt of a submission? | See response to #122. |
| 146 | Is team/past-performance experience to be cited within the 5-page Technical Solution Brief, or may it be provided as a separate attachment that does not count against the page limit? | See response to #19 |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .