JA RFO Part 12 Data Exchange and Database Subscritpion Services Final Redacted.pdf

CUI

Control Number:

Source Selection Information - See FAR 2.101 and 3.104-4

Justification and Approval (J&A) for Other than Full and Open Competition

Revolutionary Federal Acquisition Regulation (FAR) Overhaul (RFO) Parts 6 and 12 Implemented by Class Deviation 2026-O0017, Revision 1

1. Identification of the Agency and Contracting Activity: The Defense Health Agency (DHA) Medical Logistics (MEDLOG) has the below requirement that is being procured by the Defense Health Agency Contracting Activity (DHACA), Research and Development Contracting Division 1, Contracts Branch 2.

2. Nature and/or Description of Action being Approved: The DHA MEDLOG is pursuing a follow-on, individual justification and approval (J&A) for Medical Logistics Authoritative Data Exchange and Database Subscription services. The current contract is due to expire on 30 September 2026.

3. Description of Supplies/Services and Estimated Value: The Department of Defense (DoD) Medical Logistics Community supports diverse Lines of Business (LOBs) to include equipment property and bio-medical maintenance management; pharmaceuticals and medical surgical inventory management; purchasing and quality assurance, patient safety; and assemblage and facilities management. The primary information systems supporting these LOBs are the Defense Medical Logistics Standard Support (DMLSS) system and the Theater Enterprise-Wide Logistics System (TEWLS). Over the last 20 years, these two (2) systems have inherited, as-built data, that has been incorporated and merged into different formats from various legacy applications, to include Army, Navy and Air Force logistics and property legacy applications. As a result of these historical data merges, the two (2) aforementioned systems contain data variance and data diversion. The lack of authoritative source data has impeded effective decision analysis and constrained optimized business processes, which has an overall negative effect on our ability to support the various LOBs.

The DHA and Medical Logistics Information Technology Program Management Office have conducted a major technical refresh that merges both the programmatic and technical components of all existing Defense MEDLOG applications - DMLSS, TEWLS and the Joint Medical Asset Repository - into a single program. The technical refresh has entered the transition of Minimum Viable Capability (MVC) phases. MVC 1 has been completed and MVC 2 begins implementation in February 2027 and spans at least nine months.

and applicable law. The Transferee has the technical capability, personnel, resources, and financial capacity necessary to perform all obligations of HT942524C0122.

As the nation’s only independent medical device testing organization, ECare Opco Inc. maintains propriety, direct-access relationships with equipment manufacturers. This allows for the collection of salient information – including product characteristics, attributes and sustainability requirements that is unavailable through secondary aggregators or vendors. Additionally, ECare Opco Inc. does not license its "real-time" authoritative data to third parties for resale, only static data, rendering any third-party vendor unable to provide MEDLOG with real time data. An award to a vendor other than ECare Opco Inc. would introduce major risks to patient safety as well as increased costs, funding constraints, schedule delays and data integrity vulnerabilities.

The subscription services provided by ECare Opco Inc. assist in identifying how the services’ medical treatment facilities compare to others of similar size and circumstance which provides each medical treatment facility the ability to identify areas for improvement and offerors different optimization methods. This data assists with medical materiel quality control, assists in identifying hazard alerts and the recall alerts, and the life-cycle logistics for procurement of medical devices and materiel. The in-depth level of information provided enables the services to accurately track deficient medical devices and medical materiel. Patient safety is greatly increased due to the information provided from ECare Opco Inc. in real-time.

As the nation’s only independent medical device testing organization, ECare Opco Inc. is able to obtain salient and authoritative information directly from the equipment manufacturers to include product characteristics, product attributes, and product sustainability requirements. ECare Opco Inc. is the only supplier capable of providing the salient and authoritative information in real-time from the manufacturers, which is a requirement for this procurement.

Third party vendors may purchase the authoritative data from ECare Opco Inc. to provide subscription data to DHA MEDLOG. However, the introduction of a third-party vendor jeopardizes the requirement for real-time data. A pass-through vendor introduces inherent data latency during retrieval and application transfers, significantly increasing the risk of synchronizing incorrect data. Furthermore, if a vendor other than ECare Opco Inc. is awarded the contract, the current DMLSS/LogiCole system would require unfunded modifications and testing to grant the new vendor access to the business-to-business (B2B) gateway.

Cost Impact and Resource Utilization: Utilizing a pass-through vendor to understand, correct, or align data and cybersecurity documentation is estimated to incur an additional 1–2 business days of administrative lag per event. Historically, DHA MEDLOG requires data content and connection clarifications approximately four (4) times annually. This results in eight (8) business days of lost operational value due to subcontracting delays and communication silos. The financial impact of these delays is calculated based on the 103 Full-Time Equivalents (FTEs) directly reliant on this data (three (3) headquarters-level FTEs managing the exchange and 100

MTF-level FTEs utilizing the data for patient safety. A quality delay in providing accurate data equates to a total cost of over the life of contract (base and four option years).

System Integration and Schedule Risks: The introduction of an unauthorized intermediary would necessitate extensive, unfunded modifications to the DMLSS/LogiCole Business-to-Business (B2B) gateway. These modifications and subsequent security testing would result in a service interruption lasting between six (6) months and two (2) years. Adding a communication layer or third-party handler between DHA and ECare Opco Inc. would result in increased latency as additional layers added onto a system require additional processing time and serialization/deserialization as well as the potential of network hops when data moves between adjacent devices, increasing the time for data to travel from source to destination. Additional communication layers can also result in leaky abstractions in which the additional communication layer may result in an unexpected “leak” (i.e. an unknown error as a result of data going through an additional layer) in which time has to be accounted for to identify the unexpected error and find how to debug the error. Also, additional communication layers can lead to failure cascades in which a failure in a new middle layer can propagate through the entire system making it harder to isolate the root cause of the failure which would also lead to a delay.

An additional communication layer can also lead to consistency loss. A consistency loss can occur as a result of previous transactional guarantees through the gateway becoming difficult through the introduction of a third party, which would lead to consistency issues of obtaining communication through the system. Finally, an additional communication layer could lead to functional duplication as the additional communication layer could end up re-implementing error-checking or security logic already present in the current gateway. The introduction of any of these potential issues could lead to a gap in obtaining real-time data which represents a critical vulnerability as without real-time data, medical devices and materiel are susceptible to undetected recalls or hazard alerts, directly compromising clinical outcomes and patient care.

Technical Standardization and UMDNS Interoperability: DHA currently maintains direct contact and integration with ECare Opco Inc.’s Clinical Data Governance and Unique Medical Device Numbering System (UMDNS) teams. The UMDNS is a registered international nomenclature system used by DHA for managing Medical Device and Equipment (MDE) inventory, MDE scheduled maintenance intervals, and Hazards, Alerts & Recall (HAR) notifications. It is an integral part of daily operations from the point of care at the MTFs, through the entire medical maintenance and logistics process, up to higher headquarters. Utilizing this internationally accepted nomenclature ensures a common language, consistent descriptions, and interoperability across areas of responsibility, functioning similarly to how the services use National Stock Numbers (NSN) for cataloging. Any secondary layer between the government and ECare Opco Inc. would sever this direct feedback loop, duplicate costs, and increase timelines due to extra handling. The speed of current operations requires the “same day” responsiveness – often within a few hours – currently provided by ECare Opco Inc. to support data-driven mission decisions.

Market research examined if the requirement met the definition of a commercial product, as specified in RFO Part 2, which is a product, other than real property, that is of a type customarily used by the general public or by nongovernmental entities for purposes other than governmental purposes and (i) has been sold, leased, or licensed to the general public; or (ii) has been offered for sale, lease or license to the general public. Market research determined that the requirement does meet this definition and is commercially available; thus, commercial terms and conditions will apply.

Market research conducted in accordance with RFO Part 10 does not support that a minimum of two or more capable small businesses could potentially satisfy this requirement. Given the information above, this requirement is not appropriate for a small business set-aside.

Market research included posting a Sources Sought Notice with capability statements received from 4 respondents. The DHA MEDLOG reviewed the 4 responses and none of the respondents could meet the requirement of providing real-time data. The below provides further requirements that were not met for each respondent:

1. did not meet all of the requirements of the Performance Work Statement (PWS). The capability statement offered advisory services while the requirement is for data exchange and database subscription services. The respondent explicitly stated they do not own or provide the proprietary subscription platforms required by the PWS and capabilities are limited to independent advisory support (integrating and operationalizing systems) however, the PWS requires the delivery of the underlying technology to achieve real-time data objectives.

2. - The respondent did not meet the PWS requirements. The capability statement did not address the ability to provide data integration or data integration support, subscription equivalent to ECare Opco Inc.’s alerts workflow, alerts automatch – equipment and alerts – automatch supplies.

3. - The respondent did not meet the requirements of the PWS. The capability statement lacked a Service Level Agreement (SLA) to address communication or subcontracting delays through the proposal to modify LogiCole. Furthermore, there is no agreement through the Defense Logistics Agency (DLA) for modifications to LogiCole. The vendor failed to demonstrate the ability to interpret ECare Opco Inc.’s proprietary data to independently verify content accuracy, cybersecurity deliverables or the Business to Business (B2B) capabilities. Additionally, stated that they would “participate” in the LogiCole/ ECare Opco Inc. interface testing, whereas the contract would require the awardee to conduct and manage this testing. This fundamental misunderstanding introduces severe risks to performance validation.

4. - The respondent did not meet the requirement of the PWS. The respondent did not demonstrate the ability to verify the accuracy of ECare Opco Inc.’s proprietary data, cybersecurity deliverables, or B2B capabilities. The respondent did not address an SLA or the necessary scope for data ingestion with DLA.

Additionally, a NOI was posted where 1 response was received and DHA MEDLOG provided the following review:

- The respondent did not meet the requirements of the PWS.

The respondent proposed using re-configuring DMLSS/LogiCole without out-of-scope modifications, however, routing authoritative data through a third-party intermediary physically requires reconfiguring DMLSS/LogiCole B2B gateway endpoints. Modifying the B2B gateway falls outside the scope of the requirement baseline and the DMLSS/LogiCole sustainment contract. A critical disruption of six

(6) months to two (2) years could result due to the extensive system engineering and mandatory security reaccreditation that would be needed to support proposed approach.

The NOI identified the Government intended to award a sole source to ECRI however, the novation agreement was received after the NOI closed.

9. Other Facts:

a. Procurement History:

(1) Is this a new requirement? No

(2) If 9.a.(1) is No, was the action just prior to this one competed? No

(3) If 9.a.(2) is Yes, what has changed where this action cannot be competed? Not Applicable

b. Additional Information: None

10. Interested Sources: As stated earlier in the J&A, there were four (4) responses to the Sources Sought Notice posted on 11 February 2026. See Section 8 of the subject J&A. A NOI was then posted to the SAM.gov on 13 May 2026 for 15 days and there was one (1) response received.

11. Technical Certification:

I certify the supporting data under my cognizance, which are included in the justification, are accurate and complete to the best of my knowledge and belief.

12. Requirements Certification: I certify the supporting data under my cognizance, which are included in the justification, are accurate and complete to the best of my knowledge and belief.

13. Legal Review: I have reviewed this justification and have found it to be legally sufficient.

14. Contracting Officer Determination of Fair and Reasonable Pricing and Certification of Accuracy and Completion.

Fair and Reasonable Cost Determination: I hereby determine the anticipated cost to the Government for this contract action will be fair and reasonable.