HT9427-26-RFI-707 Request for Information.pdf

Request for Information (RFI) for Hosting Solutions

Title: Data Hosting, Integration, and Sustainment Support for the OBHAT/BHAS Program

1. Purpose

The Department of War (DoW), through the Defense Health Agency (DHA), is conducting market research to identify potential approaches, capabilities, constraints, and estimated costs associated with hosting, managing, integrating, securing, and sustaining data generated by vendor-developed and Department of Veterans Affairs (VA) applications.

DHA is seeking information to inform a future data-hosting strategy. This RFI is not a solicitation, request for proposal, commitment to procure, or authorization to incur costs.

2. Background

The DoW uses or anticipates using data from multiple sources, including vendor applications and VA-connected or VA-originating applications. DHA does not currently have a finalized enterprise strategy for where and how this program data will be hosted, governed, integrated, accessed, retained, and sustained for DHA use.

The future solution must support the program’s mission needs while addressing data ownership, interoperability, cybersecurity, privacy, hosting authorization, records management, continuity of operations, vendor transition, and long-term sustainment.

This RFI seeks market information on viable hosting and data-management models, including but not limited to DHA-managed environments, DoW enterprise cloud environments, vendor-hosted environments, government cloud environments, hybrid architectures, and federated-data approaches.

3. Objectives

The DHA seeks responses that help answer the following questions:

I. What hosting models are feasible for data supporting DHA users and mission requirements?

II. What are the advantages, limitations, risks, and dependencies associated with each model?

III. How can data from vendor and VA applications be securely made available to DHA without creating unnecessary duplication, vendor lock-in, or data-governance issues?

IV. What technical, contractual, security, privacy, and operational requirements should DHA establish before selecting a hosting approach?

V. What transition approach would enable DHA to assume or maintain access to required program data if a vendor, application, contract, or partnership changes?

4. Scope of Information Requested

Respondents should address capabilities and recommend approaches for the following areas.

A. Hosting Architecture and Deployment Models

Describe available solutions or recommended architectures for:

I. Government-managed hosting in an authorized DoW environment.

II. Commercial cloud hosting available to and authorized for DoW use.

III. Vendor-hosted software-as-a-service or platform-as-a-service models.

IV. Hybrid hosting, including separation of application hosting, data storage, analytics, and integration services.

V. Federated or virtualized data-access models that allow DHA to access data while data remains in an external system.

VI. Data warehouse, data lake, data lake-house, operational data store, and master-data-management approaches, as applicable.

VII. Segregation of production, test, training, development, and disaster-recovery environments.

VIII. Scalability to support additional data sources, users, applications, and reporting requirements.

For each proposed model, identify:

I. Primary hosting location and ownership model.

II. Government and contractor responsibilities.

III. Major assumptions and dependencies.

IV. Advantages and disadvantages.

V. Expected implementation complexity and sequencing.

VI. Potential barriers to transition or future migration.

B. Data Ingestion, Integration, and Interoperability

Describe capabilities to ingest, normalize, exchange, reconcile, and make available data from multiple vendor and VA-connected applications.

Address:

I. Supported interfaces and integration patterns, such as application programming interfaces (APIs), secure file transfer, event-based integration, database replication, and batch processing.

II. Support for applicable healthcare-data interoperability standards, including HL7 and Fast Healthcare Interoperability Resources (FHIR), where relevant.

III. Methods to map, validate, deduplicate, transform, and reconcile data from disparate source systems.

IV. Metadata management, data lineage, data-quality monitoring, and error handling.

V. Master patient index, identity matching, or cross-system record-linkage capabilities, if required.

VI. Mechanisms to identify the authoritative source for specific data elements.

VII. Data refresh frequency, latency, throughput, and service-level options.

VIII. Ability to support structured, semi-structured, and unstructured data.

IX. Approaches for maintaining interoperability if source vendor systems are replaced or modified.

C. Data Ownership, Access, and Portability

Provide recommendations for ensuring DHA retains appropriate access to and control over program data.

Address:

I. Data ownership and stewardship constructs appropriate for a government program using vendor and VA-originating data.

II. DHA access to raw data, normalized data, derived data, metadata, audit logs, and system documentation.

III. Data-export capabilities, formats, frequency, and restrictions.

IV. Processes for transferring data and associated metadata to DHA or a successor system at contract transition or termination.

V. Measures to minimize proprietary dependencies and vendor lock-in.

VI. Required documentation for data models, interface specifications, business rules, transformations, and system configurations.

VII. Government purpose rights, licensing considerations, and contractual provisions DHA should consider for data portability and continuity.

Respondents should identify issues for government legal, privacy, security, and contracting review; this RFI does not establish legal positions or contract terms.

D. Cybersecurity, Privacy, and Access Control

Describe how the proposed approach supports applicable DoW, DHA, federal, and partner-system security and privacy requirements.

Address:

I. Authorization approach and responsibility model for the hosting environment, applications, interfaces, and data services.

II. Support for identity, credential, and access management; role-based access control; least privilege; multifactor authentication; and privileged-access management.

III. Encryption for data in transit and at rest, including key-management approaches.

IV. Audit logging, monitoring, incident response, vulnerability management, and security-event retention.

V. Tenant isolation and data segregation, where applicable.

VI. Protection of sensitive health and personally identifiable information.

VII. Data-loss prevention, backup security, and recovery capabilities.

VIII. Continuous monitoring and reporting capabilities.

IX. Dependencies on DHA, VA, vendor, cloud-service-provider, or other approvals and interconnection agreements.

X. Any known limitations or additional controls required when integrating with VA applications or VA-provided data.

E. Data Governance, Records, and Lifecycle Management

Describe proposed governance and lifecycle-management capabilities, including:

I. Data-governance roles and decision rights for DHA, vendors, and external data providers.

II. Data cataloging, classification support, stewardship, quality management, and issue resolution.

III. Data-retention, archival, disposition, and legal-hold capabilities.

IV. Backup, restoration, and disaster-recovery procedures.

V. Data availability requirements and recovery objectives.

VI. Auditability of data access, modification, movement, and deletion.

VII. Procedures for managing corrections, source-data updates, duplicate records, and conflicting data.

VIII. Controls to ensure only authorized users and systems can access or exchange data.

F. Operations and Sustainment

Describe the operating model necessary to sustain the proposed solution.

Include:

I. Roles, staffing, and skill sets required for operations, data engineering, cybersecurity, integration, database administration, service management, and user support.

II. Help desk, incident-management, problem-management, change-management, and release-management capabilities.

III. Proposed service-level agreements and performance measures.

IV. Maintenance windows, patching approach, upgrade processes, and technology-refresh strategy.

V. Business continuity and disaster-recovery support.

VI. Training and knowledge-transfer approach for DHA personnel.

VII. Documentation deliverables and update cadence.

VIII. Estimated recurring operations and sustainment requirements.

G. Transition and Implementation

Provide a notional transition approach from the current state to a future hosting model.

Address:

I. Discovery activities needed to establish a complete inventory of applications, data sources, interfaces, data types, data volumes, owners, and access requirements.

II. Recommended implementation phases and decision points.

III. Data migration, validation, reconciliation, and user-acceptance-testing activities.

IV. Parallel operations and rollback options.

V. Risks associated with transition from incumbent vendors or external systems.

VI. Dependencies on source-system owners, VA coordination, DHA infrastructure, authorizations, contracts, and funding.

VII. Recommended timeline ranges for planning, pilot, initial operating capability, and full operating capability.

VIII. Conditions that must be met before DHA accepts operational responsibility for hosted data.

5. Required Respondent Information

Responses should include:

1. Company Information

I. Company name, address, point of contact, email, telephone number, and business size/status, if applicable.

II. Relevant contract vehicles or acquisition pathways available to DHA, if known.

2. Relevant Experience

I. Examples of comparable work involving healthcare data, government data hosting, multi-organization data exchange, vendor transition, data migration, or enterprise data platforms.

II. Experience supporting DoW, DHA, VA, federal healthcare, or similarly regulated environments, if applicable.

III. Description of outcomes, scale, lessons learned, and challenges encountered. Do not include sensitive customer information.

3. Technical Response

I. Proposed hosting model(s).

II. Notional architecture diagram.

III. Description of interfaces, security controls, governance model, operations model, and transition approach.

IV. Identification of assumptions, exclusions, dependencies, and customer-provided requirements.

4. Rough-Order-of-Magnitude Information

I. Non-binding estimated cost ranges for implementation, migration, licensing, cloud consumption, operations, sustainment, and transition support.

II. Major cost drivers and assumptions.

III. Recommended contracting structure, such as fixed-price, labor-hour, managed service, consumption-based cloud, or hybrid approach.

5. Risk Assessment

I. Top technical, cybersecurity, privacy, interoperability, governance, schedule, and vendor-lock-in risks.

II. Recommended mitigations and decisions DHA should make early.

6. Key Parameters for Response

To improve comparability, respondents should address the following parameters. DHA may refine these values as requirements mature.

Technical and Data Requirements Information Request

Parameter Information Requested

User Population Supported user types, role-based access, and scalable user capacity.

Data Sources Vendor applications, VA-connected/VA-originating applications, DHA systems, and future sources.

Technical and Data Requirements Information Request

Parameter Information Requested

Data Types Clinical, administrative, operational, financial, scheduling, encounter, assessment, document, and analytics data, as applicable.

Data Volume Current and projected storage volumes; ingestion and growth assumptions.

Data Refresh Near-real-time, daily, weekly, and on-demand options.

Availability Proposed uptime/service-level options and maintenance assumptions.

Recovery Proposed recovery-time and recovery-point objectives.

Data Retention Configurable retention, archival, export, and disposition capabilities.

Integration API, FHIR, HL7, batch, secure file transfer, event-streaming, and other supported patterns.

Security Authentication, authorization, encryption, audit logging, monitoring, and incident-response capabilities.

Portability Ability to export complete data sets, metadata, documentation, and audit records in nonproprietary or widely usable formats.

Analytics Reporting, dashboards, data-science enablement, and controlled data-sharing capabilities.

Sustainment Staffing, support hours, ticket response, patching, upgrades, and knowledge transfer.

Transition Implementation timeline ranges, migration methodology, validation, and rollback options.

7. Questions for Industry

DHA specifically requests industry feedback on the following:

I. Which hosting model provides the best balance of security, DHA data access, interoperability, scalability, cost, and long-term sustainability?

II. Under what circumstances should DHA use a vendor-hosted model versus a DHA-managed or enterprise-hosted model?

III. What data should remain in source systems, what data should be replicated to a DHA environment, and what data could be accessed through federation or virtualization?

IV. What minimum data-rights, data-export, documentation, and transition-assistance provisions should DHA require from vendors?

V. What common failure points occur when government organizations seek to host or reuse data from vendor-owned applications?

VI. What governance model best defines DHA, vendor, and VA roles for data stewardship, quality, access, correction, retention, and release?

VII. What are the major technical and administrative dependencies for obtaining and sustaining connectivity with VA systems or VA data sources?

VIII. What architecture best supports future program growth, replacement of individual vendor applications, and integration of additional data sources?

IX. What minimum viable solution could DHA implement quickly while building toward an enduring enterprise approach?

X. What information must DHA collect before issuing a future solicitation or making a hosting decision?

8. Requested Response Format

Responses should be submitted in an electronic format and include:

I. Executive summary: maximum two pages.

II. Technical response addressing Sections 4 through 7.

III. Notional architecture diagram.

IV. Relevant past-performance summaries.

V. Rough-order-of-magnitude cost information and assumptions.

VI. Recommended implementation timeline and key dependencies.

DHA requests that respondents clearly label proprietary information in accordance with applicable submission instructions. Respondents should not include sensitive operational, personal, or other information not necessary for this market-research effort.

9. Government Notice

This RFI is issued solely for planning and market-research purposes. It does not constitute a solicitation, request for proposal, commitment, promise, or obligation by the Government to procure services or award a contract. The Government will not reimburse respondents for costs associated with preparing or submitting a response.