JA OPTN IT System cloud migration for Comp Advocate.pdf

operating within a UNOS-managed Nutanix hyper-converged infrastructure (HCI) environment—to a secure, scalable, and compliant cloud environment. This migration will improve performance, enhance security, and provide HRSA with the oversight and visibility required to effectively monitor and direct the system’s ongoing operations. This action does not include the purchase or transfer of any intellectual property or source code. The system will remain Contractor-Owned and Contractor-Operated (COCO) at this time; however, migration will bring its infrastructure under a modernized, monitored, and compliant platform that supports shared visibility and coordinated oversight between UNOS and the Government.

The services required under this action include a comprehensive assessment of the current environment, the design of a target architecture consistent with federal security and reliability standards, and the execution of a phased migration plan that preserves the integrity, availability, and confidentiality of all OPTN data and operations. The contractor will also provide system stabilization, documentation, and post-migration support to ensure the environment meets federal cybersecurity and operational continuity requirements.

This forward-looking investment ensures the stability of a system vital to the nation’s health and reinforces the Government’s commitment to protecting patients who rely on timely and equitable access to organ transplantation. The modernization will serve as a foundation for future OPTN competition and system improvement, positioning HRSA to make informed decisions about future technological and contractual strategies based on full visibility into the system’s architecture and performance.

The statutory authority permitting other than full and open competition is made under the authority of 41 U.S.C. 3304(a)(2) as set forth in FAR 6.302-1: Only one responsible source and no other supplies or services will satisfy agency requirements.

Since 1986, UNOS has been the contractor operating the OPTN. UNOS owns and manages the information technology system that enables organ matching, allocation, and national data collection, and the system is fully contained within UNOS’s network infrastructure.

The Government does not have full access to the underlying source code, data structures, or configuration management necessary to operate, modernize, or migrate the system independently.

The current UNOS-managed environment has reached a critical inflection point. The hardware supporting is at the end of its lifecycle, and the infrastructure is supported only under a short-term warranty extension. The on-premises hosting environment is not directly integrated with HRSA’s cybersecurity tools or continuous monitoring capabilities, and recurring inconsistencies in audit logs and software asset scans have limited the Government’s ability to exercise meaningful oversight. These deficiencies are not merely technical in nature; they create real operational risks that can affect patient outcomes. In December 2024, an update to a large dataset of calculated panel reactive antibody (CPRA) values resulted in erroneous match scores that took more than twelve hours to correct due to the absence of scalable cloud computing resources. Similarly, a security incident identified in early 2025 revealed significant vulnerabilities in outdated web components, incomplete log data, and stored plaintext credentials, which had allowed unauthorized access to persist for nearly a year.

These incidents underscore that the existing environment is no longer sustainable. Continued reliance on the legacy infrastructure places the national transplant system at growing risk of disruption, data compromise, and reputational harm. The proposed migration will immediately address these risks by transitioning the system to a secure, modern platform with centralized monitoring and improved auditability, thereby enhancing transparency and protecting the integrity of the transplant process.

Continuing under the current configuration would perpetuate serious security and reliability vulnerabilities, while attempting to build a new system would introduce unacceptable delays and costs. Migrating the existing system to a secure, compliant cloud environment under UNOS’s execution, is the only course of action that meets HRSA’s statutory obligations, mission needs, and federal cybersecurity standards while maintaining uninterrupted service to patients awaiting organ transplants.

UNOS is the only responsible source capable of performing the migration of the OPTN IT system.

UNOS possesses the access, technical expertise, and operational authority required to migrate the OPTN IT system safely and effectively while preserving the integrity of ongoing operations.

The Government’s lack of administrative control makes it impossible to direct or oversee modernization efforts without UNOS’s cooperation. The system’s complexity, coupled with its critical public health function, requires that migration be executed by the entity that both owns and operates the environment to prevent catastrophic service disruptions.

Any attempt to have another vendor conduct the migration would require reverse-engineering the system and reconstructing its proprietary architecture—an action that would be technically infeasible, cost-prohibitive, and fraught with risk. The potential consequences include corruption of data, loss of historical records, interruption of organ-matching operations, and immediate threat to patient safety. As such, UNOS is uniquely qualified and solely capable of executing the migration in a manner that ensures uninterrupted service, data fidelity, and compliance with all operational requirements.

No other contractor or federal entity can execute this transition without risking data loss, system downtime, or direct harm to patient care.

Courses of Action Considered

The Government considered multiple courses of action to determine the most responsible and effective path forward.

The first option, maintaining the status quo by continuing to operate within the existing UNOS-managed on-premises environment, was rejected operationally infeasible. uch an approach would conflict with the Securing the U.S. Organ Procurement and Transplantation Network Act, which authorizes HRSA to enter into multiple awards for OPTN operations.

More importantly, it would perpetuate the very issues the modernization effort seeks to resolve outdated hardware, limited security oversight, incomplete audit trails, and elevated risk of system failure.

The second option, developing a completely new OPTN IT system, was assessed and dismissed due to the significant cost, time, and risk associated with building a new system from the ground

up. Developing a new system would require duplicating decades of investment, rebuilding interfaces with hospitals and organ procurement organizations, and migrating vast amounts of sensitive medical data, all while maintaining uninterrupted national transplant operations. The likelihood of service disruption, data integrity issues, and performance instability would be unacceptably high.

The third and final option, is the modernization and controlled migration of the existing system environment to a secure, compliant cloud infrastructure, executed by UNOS. This approach provides the only feasible and timely means of mitigating critical risks while maintaining operational continuity. It enables HRSA to achieve immediate improvements in system reliability, security, and transparency without interrupting life-saving services. Importantly, this procurement does not include the purchase or transfer of the system itself but instead focuses on improving the infrastructure supporting it, thereby establishing the foundation for long-term oversight and potential future competition once the system operates under a federally visible and auditable platform. The selected approach, migrating the existing system to a secure, compliant cloud environment under UNOS’s execution, is the only course of action that meets HRSA’s statutory obligations, mission needs, and federal cybersecurity standards while maintaining uninterrupted service to patients awaiting organ transplants.

Not applicable to this procurement.

Not applicable to this procurement.

HRSA recognizes the importance of fostering future competition for the continued modernization and operation of the OPTN IT system. While the current procurement is limited to the migration of the existing system to a secure, compliant cloud environment, it represents a strategic first step toward expanding competitive opportunities in future OPTN acquisitions.

This immediate action will bring the contractor-owned, contractor-operated system currently managed and maintained by UNOS into a modern, transparent, and federally visible cloud infrastructure. This new environment will provide HRSA with, for the first time, real-time insight into system performance, architecture, dependencies, and operational data. By establishing shared visibility, consistent audit logging, and direct security monitoring, HRSA will gain the foundational understanding necessary to plan and execute a competitive, multi-vendor ecosystem in subsequent phases.

Following successful migration, HRSA intends to assess long-term strategies to expand competition, improve flexibility, and reduce vendor dependency. Among these strategies, the Government will evaluate the feasibility and cost-benefit of acquiring the source code and associated intellectual property rights. Such an acquisition, if pursued in the future, would enable HRSA to make the existing codebase available to multiple qualified vendors under contract, thereby facilitating direct competition for enhancements, operations, and maintenance.

Possession of the source code would allow new vendors to build upon proven, operationally validated logic reducing duplication of effort, lowering future development costs, and accelerating delivery of modernized functionality. Moreover, preserving the existing code would help ensure continuity of the critical business logic that underpins organ allocation and matching, while allowing flexibility for modernization, modularization, and integration with future technologies.

In the interim, the current migration will substantially reduce barriers to competition by eliminating reliance on obsolete, end-of-life hardware and opaque, proprietary hosting arrangements. By moving to a secure and standardized cloud platform, HRSA will establish consistent architectural baselines, modern APIs, and documented configurations that will support future integration and Contractor onboarding. The new environment will also facilitate incremental modernization, allowing future vendors to develop, test, and deploy new components without requiring wholesale replacement of the legacy system.

This phased approach reflects HRSA’s deliberate strategy to first stabilize and secure the existing system, then enable broader industry participation through structured and transparent modernization efforts. Each phase of the modernization plan is designed to incrementally reduce vendor lock-in, enhance system interoperability, and expand the competitive field for future OPTN IT requirements.

By establishing a secure, federally visible cloud foundation, HRSA is creating the conditions necessary for future competitive acquisitions, to potentially including source code acquisition, modular development, and multi-vendor operations, which will sustain innovation, reduce costs, and strengthen accountability in the OPTN IT ecosystem.

HRSA/HSB has conducted continuous market research since 2019 to inform the acquisition strategy for modernizing the OPTN IT System. These efforts reflect the Government’s ongoing commitment to understanding industry capabilities, expanding competition, and promoting transparency in future OPTN procurements.

In November 2024, HRSA issued a Request for Information (RFI) to assess vendor capabilities and market interest in OPTN modernization. The RFI was released on both the GSA e-Buy platform under Multiple Award Schedule (MAS) 54151S – Information Technology Professional Services and SAM.gov from November 15–20, 2024, reaching more than 5,100 potential vendors. HRSA received 126 capability statements, including responses from at least 11 small businesses and 10 other-than-small businesses demonstrating strong technical qualifications in cloud migration, system modernization, and health IT systems management.

Based on this market response, HRSA issued Request for Quote (RFQ) No. 75P00125Q00003, titled OPTN Next Generation (NextGen) IT Multiple Award Blanket Purchase Agreement (MA- BPA), on January 17, 2025, on SAM.gov, to establish a competitive framework for future modernization efforts. However, the RFQ was later cancelled due to a change in administration and resulting programmatic reprioritization. Despite the cancellation, the market research confirmed the existence of a robust and competitive vendor base capable of supporting future OPTN modernization once the Government obtains necessary access and visibility into the contractor-owned system.

The current sole-source migration contract with the United Network for Organ Sharing (UNOS) serves as an interim measure to stabilize the existing environment and mitigate critical operational, cybersecurity, and infrastructure risks. Migrating the system to a secure, compliant cloud platform will provide HRSA with the technical transparency and data required to define modular requirements, develop open standards, and prepare for future competitive acquisitions once the environment is stabilized.

The results of past and ongoing market research confirm that ample competition exists for the modernization of the OPTN IT system. The present action is therefore a necessary first step to enable full and open competition in future phases by providing the Government with visibility, documentation, and technical access that are currently unavailable under the contractor-owned, on-premises configuration.

This is a brand new requirement and not a follow-on action.

This action aligns directly with multiple federal directives and departmental priorities aimed at modernizing legacy systems and improving oversight of high-value IT assets. Specifically, the migration supports Executive Order 14306, which mandates the transition of high-risk federal systems to secure cloud environments; Executive Order 14212 (Make America Healthy Again), which prioritizes modernization and transparency of federal health systems; and the HHS Health IT Security Framework, which emphasizes zero-trust principles and continuous monitoring for mission-critical health systems.

By executing the migration in accordance with NIST SP 800-53 Rev. 5 controls at a FISMA High watermark, using cost-effective compensating controls on a FedRAMP Moderate platform, HRSA will achieve measurable improvements in security posture and operational resilience. The migration also supports the Administration’s broader objective of ensuring that federal health IT systems are transparent, efficient, and accountable to the American public.

By my signature below, I certify that the supporting data included in this J&A is accurate and complete.

Program Manager Name: James Duff Position Title: OPTN System Owner, HRSA HSB Email Address: JDuff@hrsa.gov Telephone Number: 240-701-2715

Program Manager Supervisor (or one level above Program Manager) Name: Hanock John Position Title: Deputy Associate Administrator, HRSA HSB

Email Address: HJohn@hrsa.gov Telephone Number: 301-443-1266

As Contracting Officer, by my signature below, I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable. As the Contracting Officer I will perform a price analysis of the contractor’s proposed price to determine whether the proposed price is fair and reasonable in accordance with FAR 15.404-1(a) (2) and conduct an evaluation of unbalanced pricing in accordance with FAR 15-404-1(g). As the Contracting Officer I may utilize other analysis methods outlined in FAR 15.404-1 as needed to assist in determining the price as fair and reasonable.

Contracting Officer Name: Stephanie Petrone Position Title: Senior Contract Specialist Email Address: SPetrone@hrsa.gov Telephone Number: 240 638 8503

I hereby certify that this justification is accurate and complete to the best of my knowledge. I approve this justification subject to availability of funds, and provided that the services and supplies herein described have otherwise been authorized for acquisition.

Contracting Officer Name: Stephanie Petrone Position Title: Senior Contract Specialist Email Address: SPetrone@hrsa.gov Telephone Number: 240 638 8503 Signature

Attorney Advisor Name: N/A Position Title:

Email Address:

Telephone Number:

STEPHANIE A.

PETRONE -S

Digitally signed by

STEPHANIE A. PETRONE -S

Date: 2025.11.19 11:42:26 -05'00'

Based on the foregoing justification, I hereby approve other than full and open competition for the above-stated procurement, subject to the availability of funds, and provided that the services herein described have otherwise been authorized for acquisition.

Supplies/Services Being Procured: Information Technology (IT) System – Migration of the Organ Procurement and Transplantation Network (OPTN) system from the existing UNOS-managed on-premises infrastructure to a secure, compliant cloud environment to ensure continued operational integrity, enhanced security, and federal oversight visibility.

The statutory authority permitting other than full and open competition is made under 41 U.S.C. § 3304(a)(1), as implemented by FAR 6.302-1, Only One Responsible Source and No Other Supplies or Services Will Satisfy Agency Requirements.

OPDIV Competition Advocate Name: Cynthia Baugh MPA, CGFM Position Title: Associate Administrator Office of Federal Assistance and Acquisition

Management Email Address: CBaugh@hrsa.gov Telephone Number: 240-475-5339 Signature Brian Goodger, HCA for Cynthia Baugh

BRIAN K.

GOODGER -S

Digitally signed by BRIAN K.

GOODGER -S

Date: 2025.11.20 09:01:25 -05'00'