Medical Planning Modeling Simulation RFI 20260813 FINAL.pdf

CUI//PROCURE

Request for Information

Joint Operational Medicine Information System Joint Medical Planning, Modeling and Simulation Capabilities

THIS IS A REQUEST FOR INFORMATION (RFI) ANNOUNCEMENT ONLY. This notice does not constitute a commitment by the Government. All information submitted in response to this announcement is voluntary, and the Government will not pay for information requested nor will it compensate any respondent for any cost incurred in developing information provided to the Government.

OVERVIEW

The Defense Health Agency Contracting Activity (DHACA), on behalf of the Program Executive Office Defense Healthcare Management Systems (PEO DHMS) Joint Operational Medicine Information System (JOMIS) Program Management Office (PMO), is seeking information on modernized, cloud-capable solutions for efficient, adequate, and reliable medical modeling and the development of realistic scenario and plan-based estimates.

The JOMIS PMO requires a solution configurable for full joint interoperability. This joint medical planning capability must satisfy baseline requirements for survivability, patient safety, and quality of care during major combat operations, such as anticipated Large-Scale Combat Operations (LSCO), as well as Defense Support of Civil Authorities (DSCA), Humanitarian Assistance and Disaster Relief (HADR) missions, and multi-domain operations below the threshold of conflict.

Reliable, agile casualty predictions support the timely flow of patient care. This end-to-end process includes:

1. Treatment of patients from Outside the Contiguous United States (OCONUS) Point of Injury (POI).

2. Transport and en-route care between theater hospitals.

3. Inter- and intra-theater patient movement for further treatment.

4. Contiguous United States (CONUS) reception for recovery.

5. Return to Force (RTF) or Return to Duty (RTD).

In LSCO, it is projected that large medical elements will be constrained by exposure to enemy fires and hybrid threats, resulting in loss of life and requiring mass casualty evacuation. Casualty evacuation is likely to be subjected to ground-centric movement schemes stemming from a contested air domain, requiring additional forces to accomplish assigned contingency plan mission objectives. A modernized medical modeling application in a cloud environment will facilitate the seamless sharing of medical planning and modeling data across multiple systems

RFI for JOMIS Medical Planning, Modeling and Simulation Capabilities

CUI//PROCURE

throughout the entire Military Medical Enterprise (MME), reducing operational costs, increasing resiliency, reducing risks, and providing timely planning and decision-making. These capabilities must be rapidly and globally aligned and/or reconfigured to respond to the changing operational requirements of Combatant Commanders (CCDRs).

The Joint Medical Planning Tool (JMPT) and Medical Planners Toolkit (MPTk) are the current legacy medical planning capabilities. These tools are computer-based applications slated for migration to a cloud environment during FY26. In parallel, JOMIS is initiating efforts to modernize these legacy capabilities. Requirements for the modernized capability will be established by the Office of the Joint Staff Surgeon.

DESCRIPTION OF NEED

The legacy JMPT and MPTk applications do not adequately meet the current operational or logistical needs of the joint medical planning community.

Consequently, JMPT and MPTk cannot reliably or efficiently model Class VIIIA (Medical Materiel) and VIIIB (Blood) usage, multimodal transportation requirements, resource utilization, or medical force placement and associated risk with the accuracy and speed required for operational decision-making. Specifically, there is a need to transition from static, Subject Matter Expert (SME)-driven estimates to dynamic models that utilize real-world Electronic Health Record (EHR) patient-demand data and calculate statistical stockout risks.

The purpose of this RFI is to gather market intelligence to support the upcoming formulation of modernized requirements for the Joint Medical Planning community. DHA previously utilized the Theater Medical Information Requirements (TMIR) Capability Based Assessment (CBA) to identify information and knowledge management capability gaps. These gaps were documented in the TMIR Information System Initial Capabilities Document (IS-ICD) (validated via JROCM 049-16), and the follow-on IS Capability Development Document (IS-CDD) (validated via JROCM 019-17). These documents establish the knowledge management capability requirements enabling five core healthcare functions:

1. Health Care Delivery (HCD)

2. Medical Command and Control (MedC2)

3. Medical Situational Awareness (MedSA)

4. Medical Logistics (MEDLOG)

5. Patient Movement (PM)

TECHNICAL & BUSINESS CAPABILITY REQUIREMENTS

The desired system must possess the following capabilities to support clinicians, planners, and theater commanders:

• High-Level Business Requirement (End-to-End Continuum): Identify force requirements by modeling and developing realistic scenario/plan-based estimates for the patient/casualty

CUI//PROCURE

continuum from OCONUS POI, through theater hospitalization, to inter-/intra-theater patient movement, CONUS reception, treatment, up to RTD.

• Modeling: Utilize mathematical and programmatic processes to generate dynamic models that support operational course-of-action (COA) decisions. The system must create realistic simulations, models, and analyses of medical capacity, supply consumption, and casualty care in and through contested and denied environments for distributed, prolonged field care scenarios, including the dynamic physiological deterioration of patients over time due to delayed evacuation.

• Simulation: Execute dynamic, time-step, or event-driven simulations using modeled data to project bottlenecks, mortality rates, and resource depletion rates under varying operational tempos and threat environments.

• Interoperability & Data Ingestion: Ingest, process, and normalize data in a variety of standard and non-standard formats from numerous DOD modeling and operational tools. The system must export compatible data outputs to downstream DOD systems, enabling cross- Service and multinational interoperability and supporting CCDR, Joint Force Commander (JFC), and Service Component Commander (SCC) decision-making.

• Integration: Generate injury distributions from Patient Condition Occurrence Frequency (PCOF) scenarios. Create casualty estimates for ground combat, fixed-base, and shipboard scenarios. Allow user-defined/modified custom weapons profiles and vulnerability factors for casualty stratification.

• Data Management: Align patient stream codes with government-approved computer-based simulation tools modeling patient flow from POI through definitive care. Support advanced regression modeling and statistical sensitivity analysis.

• System Administration & Accessibility: Provide a highly configurable, globally accessible, cloud-native solution that supports strict data authority and role-based access. The solution must interoperate across multiple hardware platforms and be accessible down to Role I through IV care facilities and non-medical units. The inclusion of an AI-driven virtual assistant to support end-user system navigation and functionality is highly desired.

• AI/ML Capability: Leverage Artificial Intelligence (AI) and Machine Learning (ML) to optimize casualty prediction, automate scenario generation, and identify anomalous data trends or resource bottlenecks.

• Dashboard & Reporting: Provide an agile, reactive casualty estimation and visualization dashboard reflecting Commander's intent. Enable the rapid development of medical support plans for LSCO, environmental disasters, and region-wide pandemics.

MODERNIZED PROGRAM SUPPORT SERVICES

CUI//PROCURE

The modernized solution requires comprehensive lifecycle support, including:

• User Support Management: Integrate user research, change management, stakeholder communication, and user engagement events to ensure successful joint adoption.

• Training and Exercise Support: Provide functional and technical training to support operational assessments, operational tests, Service exercises, initial deployments, and legacy migration.

• Release and Deployment: Coordinate with the Services to execute pre-deployment site surveys, product delivery, deployment integration, and post-deployment troubleshooting.

• Tier 3 Support: Provide specialized developer-level Tier 3 software support, bug mitigation, and continuous pipeline optimization.

SECURITY

• Security controls in accordance with Committee on National Security Systems Instruction (CNSSI) No. 1253, Security Categorization and Control Selection for National Security Systems, as outlined within National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171.

• DoDI 8500.01, Cybersecurity.

• DoDI 8510.01, Risk Management Framework (RMF) for DOD Information Technology (IT).

• Security controls in accordance with NIST implementation and validation requirements specified in NIST SP 800-37, Rev. 2, Risk Management Framework (RMF) for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy.

• Information system configuration in accordance with Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs).

• DoDI 8551.01, Ports, Protocols, and Services Management (PPSM).

• DoDI 8520.03, Identity Authentication for Information Systems (prior to granting access).

• DoDI 8582.01, Security of Unclassified DOD Information on Non-DOD Information Systems and Cybersecurity; NIST SP 800-53/53a, Assessing Security and Privacy Controls in Information Systems and Organizations; NIST SP 800-37, Rev. 2, Risk Management Framework (RMF) for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy.; and emerging DOD Cybersecurity Policy designed to address evolving threats.

• DoDD 8140.01, Cyberspace Workforce Management; Defense Federal Acquisition Regulation Supplement (DFARS) 252.239-7001, Information Assurance Contractor Training

CUI//PROCURE

and Certification; and DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting.

• DoDM 8140.03, Cyberspace Workforce Qualification and Management Program [signed 15 February 2023] baseline certifications are required prior to beginning support services.

• CNSSI 1253, Security Categorization and Control Selection for National Security Systems, Privacy Overlay for Cloud Services that contains Personally Identifiable Information (PII)/Protected Health Information (PHI).

• Procedures that address final disposition of PHI and PII and/or the electronic media on which it is stored.

• Compliance with requirements for Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Public Law 104-191), Personnel Security, Electronic Security, and Physical Security. Data which contains PHI will be continuously protected from unauthorized access, use, modification, or disclosure.

• Federal Acquisition Regulation (FAR) clause 52.224-1, Privacy Act Notification, and FAR clause 52.224-2, Privacy Act.

• The Federal Risk and Authorization Management Program Provisional Authorization to host Federal Government missions and DOD Provisional Authorization to Operate.

• JOMIS operates with RMF accreditation and must demonstrate Cyber Survivability and Cyber Resilience per the Joint Chiefs of Staff Joint Capabilities Integration and Development System Manual 2021 and CSEIG v3.0, Cyber Survivability Endorsement Implementation Guide. Any Red Team Testing or Penetration Testing conducted successfully against recommended products would support its Cyber Survivability Risk Posture.

SYSTEM AUTHORITY TO OPERATE

Ideally, a recommended product will already have achieved a successful RMF accreditation within another DOD or Fourth Estate Agency. For discussion purposes, if a recommended product has not already been accredited by either a DOD or Fourth Estate Agency, indicators that demonstrate a quick accreditation process will be requested. Information could include a Federal Agency accreditation, a list of products residing on the Approved Product List, or an analysis of how a product performed in a laboratory/test environment with initial STIG and DISA Security Requirements Guide testing.

The product must demonstrate production-ready capabilities and close any security concerns within Information Assurance Vulnerability Alert required periods (while being continuously updated to address any issues). Any solution must be within a lifecycle that will continue to be supported.

CUI//PROCURE

ORGANIZATIONAL CONFLICT OF INTEREST (OCI)

See FAR 9.5, Organizational and Consultant Conflicts of Interest, and DFARS 209.5, Organizational and Consultant Conflicts of Interest, for background information related to organizational conflicts of interest. PEO DHMS/JOMIS anticipates a relationship that will require the execution of corporate nondisclosure agreements and non-compete commitments.

Any resulting contract(s) may require the execution of appropriate associate agreements with prime-mission product partners to gain access to technical data and other proprietary information generated during the performance of those contracts.

Additionally, respondents to this RFI should be aware that PEO DHMS/JOMIS may use contractor support personnel from the companies listed below to review responses and information submitted.

FEEDBACK REQUESTED

Maximum Page Limit: 15 Pages

Joint Medical Interoperability: Describe how your proposed solution ingests, processes, and normalizes disparate data formats from existing Joint and Service-specific modeling tools. How does your solution export interoperable modeling outputs to downstream MME systems and integrate Allied/Coalition partner medical capabilities to reduce risk-to-force?

Modernized Modeling & Simulation Architecture: Detail your solution's mathematical and simulation capabilities. How does the solution model patient flow, casualty rates, and Class VIIIA/VIIIB supply consumption across contested or denied theater environments? Specifically address how your solution calculates statistical stockout risks (e.g., via Monte-Carlo simulations) versus static averages, and how it simulates the dynamic clinical deterioration of patients during delayed evacuation.

Operation in DDIL Environments: Describe how your solution maintains functionality during periods of disconnected, disrupted, intermittent, and low-bandwidth (DDIL) communications.

How are data synchronization and conflict resolution handled once connectivity is restored?

(Note: General claims of "offline mode" are insufficient; detail your specific database conflict-resolution schema)

Continuous Integration / Continuous Delivery (CI/CD) & DevSecOps: Describe your platform's CI/CD framework. Do you possess a DevSecOps platform with a Continuous Authority to Operate (c-ATO)? If so, specify the hosting cloud environments, impact levels (e.g., IL5, IL6), and classification domains.

Cybersecurity & RMF Accreditation Pathway: Detail your firm's experience navigating the DOD RMF process. Provide examples of active or prior ATOs achieved for the proposed solution. If no DOD ATO exists, outline your proposed timeline and strategy to achieve an ATO.

CUI//PROCURE

Product Supportability & User Adoption: Detail your strategy for providing joint services with User Support Management, Change Management, Joint Exercise/Training Support, and Release/Deployment coordination.

SLA & Performance Attributes: Describe your capability to guarantee a 99.9% Operational Availability rate (excluding scheduled maintenance and network transport disruptions). Detail your Tier 3 incident response thresholds (e.g., target resolution times for urgent vs. routine requests).

Knowledge Management & Access Controls: Describe how your solution implements role-based access control (RBAC) and attribute-based access control (ABAC) to manage varying security, role, and organizational classification layers.

Scalability & Cloud Elasticity: Describe your software's performance when scaling to meet rapid cloud infrastructure expansion (e.g., mass casualty exercises or real-world crises) and contracting back to baseline resource usage.

Company Profile & Contract Vehicles:

• Confirm if your firm is classified as a Small Business under NAICS 541512 (or recommend an alternative NAICS).

• Provide your CAGE Code, UEI, and Socio-Economic Status.

• Specify if your firm has a DCAA/DCMA-approved accounting system.

• List any active, appropriate contract vehicles (e.g., GSA MAS, Oasis, Seaport, health-specific IDIQs, BOAs) through which your solution can be procured.

SUMMARY INSTRUCTIONS

DHMS-CD is issuing this RFI for the purpose of determining solutions capable of fulfilling JOMIS medical modeling and simulation requirements.

Interested parties may submit a written response stating how they would effectively fulfill the requirements and include appropriate documentation describing how this is possible with acceptable performance risk. The written response should provide sufficient detail to allow for an assessment by the Government without the need for additional information. Responses to this RFI are not quotes upon which the DHMS-CD can issue a contract. Therefore, the Government does not intend to award a contract based on responses to this RFI.

SUBMITTAL

Send responses via email to Domonique Holmes, Domonique.p.holmes.civ@health.mil and Beth Ruckwardt, Elizabeth.m.ruckardt.civ@health.mil by September 13, 2026, no later than 1500 Eastern Time.

mailto:Domonique.p.holmes.civ@health.mil mailto:Elizabeth.m.ruckardt.civ@health.mil