LSJ One-Year Logical Follow on-_Redacted.pdf

DEPARTMENT OF HEALTH & HUMAN SERVICES

Centers for Medicare & Medicaid Services 7111 Security Boulevard, Mail Stop B3-30-03 Baltimore, Maryland 21244-1850

OFFICE OF ACQUISITION AND GRANTS MANAGEMENT

INFORMATION SYSTEMS FOUNDATIONAL COMPONENTS SUPPORT LIMITED-SOURCES

JUSTIFICATION

Acquisition Title: Information Systems Foundational Components Support (ISFCS) Logical Follow-On

Agency: Centers for Medicare & Medicaid Services / Center for Clinical Standards and Quality / Information Systems Group

Acquisition Year: Fiscal Year 2025

Author: , Contracting Officer’s Representative (COR), Contracting Officer (CO)

1. Description of Action:

Nature New Requirement Follow-On Order Modification of Existing Purchase Order:

Contract Type IX Firm-Fixed Price IX Time and Materials

Cost Plus Fixed Fee (CPFF) Term Completion

Cost Plus Award Fee (CPAF) Other:

Total Projected Cost / Price:

The estimated value of the proposed sole source action, being justified within this J&A is:

3. Authority:

IX:ORDER AGAINST FSS: Authority of the Multiple Award Schedule Program, Title III of the Federal Property and Administrative Services Act of 1949 (41 U.S.C. 251, et seq.); Title 40 U.S.C. 501, Services for Executive Agencies; and Section 803 of the National Defense Authorization Act of 2002 (PL 107-107) and implemented by FAR 8.405-6. Mark the applicable exception and for each discuss how the cited authority applies in accordance with FAR 8.405-6(c)(2)(iv).

An urgent and compelling need exists, and following the procedures would result in unacceptable delays (FAR 8.405-6(a)(1)(i)(A));

Only one source is capable of providing the supplies or services required at the level or quality required because the supplies or services are unique or highly specialized (FAR 8.405-6(a)(i)(B)); or

IX In the interest of economy and efficiency, the new work is a logical follow-on to an original Federal Supply Schedule order provided that the original order was placed in accordance with the applicable Federal Supply Schedule ordering procedures. The original order or BPA must not have been previously issued under sole-source or limited sources procedures (FAR 8.405-6(a)(1)(i)(C));

The original order was awarded in accordance with applicable GSA ordering procedures under the Federal Supply Schedule program and was not issued under sole source or limited sources procedures.

This new work is a logical follow-on to the original order, as it will enable the continuity of essential services without lapse or disruption. Flexion Incorporated, the incumbent contractor, has the unique expertise and technical skill set required to seamlessly continue providing the foundational components support services. Maintaining Flexion's involvement is critical to ensure the successful completion of the identified critical tasks, such as verifying the identity of contract personnel, inheriting the existing AWS environment, and obtaining the necessary authorizations to operate the various systems.

This one-year logical follow-on allows the current contractor to continue to complete the following critical tasks:

In accordance with OMB Memorandum M-05-24, Implementation of Homeland Security Presidential Directive 12 (HSPD-12), and Federal Information Processing Standard (FIPS) PUB Number 201-2, CMS must achieve appropriate security assurance by verifying the claimed identity of contract personnel. Those that require physical access to a CMS facility and/or access to a CMS federally controlled information system will be required to obtain a CMS issued PIV card or applicable equivalent.

The awarded contractor will inherit the Amazon Web Service (AWS) environment provided by CMS Infrastructure/Cloud providers to the incumbent contractor, and no costs will be incurred by the awardee. The systems currently have a FISMA Moderate authority to operate (ATO). Incumbent will be required to obtain DUAs for QPP, EQRS, and CQP as needed.

While QPP was built natively on AWS Cloud Infrastructure, other ISG LOB’s systems were on-prem and are currently at a different phases of being modernized and migrated to AWS Cloud Infrastructure Rather than award a new task order using fair opportunity at this time, a one-year logical follow-on proves to be economical because any other source would require transition to another contractor, which is a risk to the above referenced critical tasks. Onboarding a new contractor during that time introduces unacceptable risk of unsuccessful performance. The increased risk during this critical timeline could potentially expose the government to addition costs through potential modifications and/or increased use of government resources, such as heavy monitoring by CMS personnel to ensure a subsequent contractor is meeting this pressing requirements.

Please see below for a more detailed overview of the tasks set to be performed during the one-year follow-on, that the government believes are critical and must be performed by the current contractor.

QPP:

The Quality Payment Program (QPP) system is primarily built using Node.js and Angular, with one application (QPP Conversion Tool) running Java and three applications (QPP Cost+, QPP Analytics and Reporting, QPP Claims-to- quality) running Python. Node packages are used to share some functionality such as the scoring engines, the common style guide, and common libraries such as application loggers, a health check endpoint, and a versioning package. Databases are typically MySQL RDS, but there is also DynamoDB (used by the authentication session management service) and Redshift (used by analytics and reporting).

For almost all deployments, uses Terraform to provision AWS resources, Packer to build AMIs, Docker to build and run applications, and includes other management tools written in Python. The QPP Front End team uses Ansible for both AMI builds and provisioning, is beginning to use Terraform, and is currently using a collection of custom auto scaling group deployment tools developed for healthcare.gov called Deployer.

Deploys are run by independent Jenkins servers. Each application development team runs their own VPCs, typically one per environment (DEV, IMPL, and PROD). Peering between the VPCs has been a source of some manual pain, as it requires the CCS AWS team to implement the request.

Logging is maintained in a centralized Splunk server, also run by CCS. NewRelic and Google Analytics are also run through shared accounts.

EQRS:

The End Stage Renal Disease Quality Reporting System (EQRS) is designed to unify the Consolidated Renal Operations in a Web-Enabled Network (CW) / Renal Management Information System (REMIS) and the Quality Incentive Program (QIP) systems into a combined system. This system is primarily built in AWS Cloud utilizing DevOps tools such as creating CI/CD pipelines with Jenkins, Talend studio, AWS PostgresSQL datatbase engines, Neo4j and Apache Zeppelin for data ingestion, exploration and visualization.

CQP:

The CMS Quality Improvement Organization Platform (CQP) is built using Salesforce as the platform (Service Cloud) with a few sites built using Experience Cloud. CQP also maintains a 3-tier AWS infrastructure to support data sharing between existing CCSQ systems and Salesforce. Below is a list of specialties the team will need to continue to focus on.

Salesforce – Platform (Service Cloud, Experience Cloud, CRM Analytics, Shield) AWS/API - API Gateway, S3, Glue, Lambda CI/CD - Copado, Copado Robotic Testing, Github, Github Actions Own Backup/Restore Security/Monitoring - ClamAV, Splunk, Snyk, New Relic, AppOmni

The primary CQP support area for this team will be data sharing between Salesforce and internal/external systems. CQP will send and receive data from the Centralized Data Repository (CDR) and will receive data from the Program Resource System (PRS) 2.0. CQP will also collect data from external sources of Provider data through APIs or uploads.

An item peculiar to one manufacturer can be a particular brand name, product, or a feature of a product, peculiar to one manufacturer). A brand name item, whether available on one or more schedule contracts, is an item peculiar to one manufacturer. (FAR 8.405-6(b). N/A

4. Market Research:

This modification would require for continued services of this work performed by the current contractor, Flexion, Inc. Flexion has been a high-performing contractor that has received no negative performance evaluations throughout the life of the current contract and has no known significant performance issues on other contracts by CMS.

CMS plans to recompete this work under the Agile Collaboration and Modernization

Endeavors (ACME) Blanket Purchase Agreement (BPA), a CMS owned vehicle, at the conclusion of this one-year logical follow-on. The ACME BPA contains eight (8) vendors who perform work similar in nature to this current contract. The eight (8) vendors selected for the ACME BPA were all small businesses at time of award and CMS plans to keep the work within the small business category for the follow-on. This requirement is set aside for small businesses, thus removing the requirement to address subcontracting goals.

5. Actions to Increase Competition:

This effort of a one-year logical follow-on will be awarded as a sole-source effort to the current contractor, Flexion Inc. CMS is doing this in the best interest of the government. As stated above in the Market Research section, CMS plans to compete this opportunity at the conclusion of this one-year logical follow-on using the ACME BPA, which it will be competed as a small-business set aside.

6. Any other facts supporting the justification:

The supplies and services required are unique or highly specialized, as they involve the development and maintenance of foundational components and common code libraries to support the various ISG systems and development teams. The contractor's ability to obtain CMS-issued PIV cards and inherit the existing AWS environment is also essential to maintaining the appropriate security posture and operational continuity.

Awarding this as a logical follow-on to Flexion Incorporated will be economical and efficient for CMS. Continuing with the incumbent contractor will save an estimated 6 months of transition time that would have been required to onboard a new contractor.

Flexion has been a high-performing contractor with no negative performance issues, and the agency is already familiar with their capabilities, which will enable a more efficient transition and avoid disruptions to the critical services.

By maintaining Flexion's involvement, CMS will be able to avoid the significant time and effort that would be required to bring a new contractor up to speed on the existing systems,

5. OGC Legal Review

N/A Name / Date

6. HHS Competition Advocate Approval

7. Senior Procurement Executive (SPE) Approval

Based on the foregoing justification, I hereby confirm the circumstances described above apply and approve the Limited Source Justification.