NNG15SD19B-254.pdf

Control Number VA-20-00014577

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA)

Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: The proposed action is for a firm-fixed-price Delivery Order under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government-Wide Acquisition Contract (GWAC) for the procurement of technical support and maintenance services of brand name Imprivata Single-Sign On (SSO) and Context Management (CM) software and hardware.

3. Description of the Supplies or Services: VA, Office of Information and Technology, Information Technology Operations and Services, Enterprise Program Management Office, requires the renewal of brand name Imprivata (formerly known as Caradigm) technical support and maintenance services for the existing brand name Imprivata software and hardware integrated solution that was purchased by VA in 2009.

Imprivata SSO and CM solution (hardware and software) supports the clinical workflow for all Veterans Health Administration (VHA) providers and clinical staff. The CM infrastructure was originally purchased with Dell 1950 vault equipment and Vergence CM software manufactured by Sentillion; however, today this software is currently owned by Imprivata. VA’s current Imprivata infrastructure consists of 360,000 Imprivata SSO and CM software licenses and a set of 150 network appliances (i.e. hardware) referred to as vaults (Dell 1950 servers) which are used to run the SSO and CM software which are installed at four regional datacenters and 22 Veterans Integrated Service Network (VISN) based datacenters. Support of the clinical workflow is provided utilizing Health Level-7 based Clinical Context Object Workgroup functionality embedded in core Veterans Health Information Systems Technology Architecture (VistA) applications and delivered via the Imprivata SSO and CM infrastructure. The SSO and CM infrastructure is a hardware and software solution that is implemented consistent with both a regional and VISN data center architecture. The Imprivata solution has served as the backbone for the VistA Graphical User Interface application architecture providing for both clinical efficiency and patient safety.

The required technical support and maintenance services include SSO and CM annual support, 24 hours per day, 7 days per week coverage, 365 days per year, phone and website access, problem and incident resolution support based upon severity, to include software updates including major releases, point releases, service releases and security releases of applicable software/firmware, support assistance, remote access, hotfixes, documentation, and upon request onsite support services. Hardware maintenance includes continuing support, repair, or replacement of the solution vaults; 24 hours per day, 7 days a week, 365 days per year, phone and website access availability for

Imprivata Technical Support and Maintenance Services Control Number VA-20- 00014577 reporting a trouble ticket with four-hour response time.

The period of performance shall include one 12-month base period and two 12-month option periods. The total estimated value of the proposed action is , inclusive of option periods.

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) Subpart 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C.

4106(c)(2) as implemented by FAR Subpart 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.”

5. Rationale Supporting Use of Authority Cited Above: Based on market research, as described in Section 8 of this justification, it was determined that limited competition is viable among authorized resellers for brand name Imprivata technical support and maintenance services. Imprivata is the only SSO/CM product that is currently capable of interfacing with VA’s Computerized Patient Record System, VistA Imaging, VistA Vitals, VistA Web, Bar Code Medication Administration, enterprise Health Management Platform, and iMedConsent. The Government technical team reviewed other commercially-available SSO/CM software products to determine the ability of transitioning to another SSO/CM solution, rather than the existing Imprivata solution. If the existing Imprivata software and hardware solution were to be replaced, any other product would require extensive additional software development work and testing in order to integrate seamlessly with those VA systems, and therefore they cannot satisfy VA’s ongoing requirement for a fully functioning SSO/CM solution. Additionally, Imprivata is the only single vendor solution that supports both the VA enterprise implementation requirements and the extended capabilities at James A. Lovell Federal Health Care Center (JALFHCC), which is a facility jointly operated by VA and the Department of Defense (DoD) and requires additional capabilities in order to comply with the all technical and security requirements imposed by both governing organizations.

Alvarez and Associates, LLC, a Service Disabled Veteran-Owned Small Business (SDVOSB) and Carahsoft, a large business, are the only authorized resellers of Imprivata software, with access to the Imprivata proprietary source code, and therefore are the only vendors who can provide the required technical support and maintenance.

Furthermore, Imprivata confirmed that it does not contract directly with the Government and the only way to obtain support is through its authorized resellers, Alvarez and Carahsoft. Other technical support and maintenance providers do not have the proprietary source code and the software updates and releases necessary to provide the required technical support and maintenance services. This code is required to push through updates and to ensure that all the services provided are properly configured.

Without access to this code, any other source would not be able to provide the technical support and maintenance services on the existing software and hardware. Maintenance services performed by parties not authorized by Imprivata invalidate product warranties and remove liability for performance from the manufacturer. It is critical that the existing SSO and CM infrastructure remains operational at all times and maintenance services are continuously available to provide support. The infrastructure has become a critical component of VA’s overall application and security infrastructure. Losing this capability significantly impacts the efficiency with which the VHA providers provide patient care due to health care providers not being able to use SSO throughout the VA and Medical Sign On (MSO) capability at JALFHCC in violation of the joint VA/DoD MSO agreement.

The ability to use SSO/CM is significant as it simplifies the VHA providers’ workflows by eliminating the need to repeatedly type usernames and passwords; thereby enabling quick and secure access across multiple applications. The result is simplified authentication and access to the appropriate patient records in seconds across multiple applications. The loss of the infrastructure presents a potential patient safety issue as the applications would no longer behave how clinicians currently use them.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in Section 8 of this justification. This effort did not yield any additional sources, other than brand name Imprivata authorized resellers, that can meet the Government's requirements. Although the Government is limiting competition as a result of specifying a brand name solution, limited competition is viable amongst authorized resellers of the required brand name Imprivata technical support and maintenance services. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the Contract Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: In order to remove or overcome barriers to competition in future acquisitions for this requirement, the Government will continue to perform market research to determine if there are any products and/or source providers available that would enable future requirements to be competed.

8. Market Research: Market research was conducted in December 2019 to ascertain the ability of any source, other than Imprivata, or an authorized reseller, that can provide the aforementioned technical support and maintenance services, and to determine the viability of transitioning to another commercially-available SSO/CM software solution.

After researching other similar commercially-available SSO/CM software products and services, Harris’s CareFX, International Business Machines, and Novell, VA concluded that no other company currently on the market offers a compatible solution or has the capability to support the current software and hardware. In addition, as detailed in Section 5, all other available SSO/CM software products reviewed would require significant additional development work by or on behalf of VA in order to successfully interface with other VA systems. The only CM software available besides Imprivata is CareFX, but there are no third-party vendors supporting CareFX, and the manufacturer of CareFX cannot and does not support Imprivata software. No source other than Imprivata, or its authorized resellers, can access the proprietary source code to provide the required maintenance, as outlined in Section 5 of this document. No other source has access to the proprietary data to be able to provide the required four-hour on-site maintenance repair and hardware replacement parts; 24 hours per day, 7 days a week, 365 days per year, phone and website access availability for reporting a trouble ticket with four-hour response time. Additionally, access to Imprivata proprietary data is required to provide software updates, including major releases, point releases, service releases and security releases of applicable software/firmware. In February 2020, the Government contacted Imprivata to ascertain if this proprietary source code was for sale. Imprivata advised that this data is not for sale.

Further Market Research was conducted on January 3, 2020, by posting a Request for Information (RFI) to the NASA SEWP V GWAC portal to identify resellers of Imprivata technical support and maintenance services. The RFI closed on January 13, 2020 with one response received from Alvarez and Associates, LLC (Alvarez), a NASA SEWP V GWAC holder from Group B(2) comprised of SDVOSB and VOSB Value Added Resellers. In addition, on January 3, 2020, RFI 36C10B20Q0104 was posted to the Contract Opportunities website which provided a description of the required technical support and maintenance services and requested authorized reseller status. Vendors were also requested to identify any current contract vehicles under which the services would be available. On January 13, 2019 one response was received from Software Information Resource Corp (SIRC), a woman-owned small business contract holder under General Services Administration Federal Supply Schedule 70. On January 14, 2020, the Contract Specialist followed up with SIRC requesting verification of authorized reseller status for the required brand name Imprivata technical support and maintenance services, but a response was never received. Therefore, on January 22, 2020, the Government contacted Imprivata requesting verification of resellers that are authorized to provide the required Imprivata technical support and maintenance services. In response, Imprivata advised that it does not contract directly with the Government that this support was only available on the NASA SEWP V GWAC, and the only authorized resellers for Imprivata are Alvarez, a SDVOSB, and Carahsoft, a Large SEWP V GWAC holder; thus, SIRC was found to be not capable of providing the requirements. This was confirmed with a search performed by the Contract Specialist on the NASA SEWP V Provider Look-up Tool which lists only these two firms as authorized resellers. Furthermore, the Government’s technical experts reviewed the response submitted by Alvarez and Associates LLC and found it capable of meeting all the requirements.

9. Other Facts: Dell no longer supports the 1950 model, however, Imprivata is capable of providing continued hardware support in order to keep the SSO and CM legacy solution operational until VA moves to a virtualized infrastructure.