OMIES with eHealth info RFI.pdf

Request for Information 1

Joint Operational Medicine Information System 2

Operational Medicine Enterprise Imaging System(s) 3

THIS IS A REQUEST FOR INFORMATION (RFI) ANNOUNCEMENT ONLY. This notice does not constitute a 5 commitment by the Government. All information submitted in response to this announcement is 6 voluntary, and the Government will not pay for information requested nor will it compensate any 7 respondent for any cost incurred in developing information provided to the Government. 8

The Defense Health Agency Contracting Activity (DHACA) Defense Healthcare Management Systems 9 Contracting Division (DHMS-CD), in support of Program Executive Office (PEO) Defense Healthcare 10 Management Systems (DHMS), Joint Operational Medicine Information System (JOMIS) Program Office 11 (PMO), is seeking potential sources with effective capabilities to provide the capability to deploy an 12 Operational Medicine (OpMed) Tele-Radiology/Medicine capability with user training and support 13 services, that provides electronic transmission of radiological images from one location to another 14 throughout the range of military operations (ROMO). 15 The primary mission of the Military Health System (MHS) is to ensure the Nation continuously has a 17 healthy fighting force and the ability to support ROMO. OpMed services include, but are not limited to, 18 preventive, routine, emergency, surgical, en-route care, and diagnostic care. OpMed systems provide 19 Commanders and medical professionals with integrated, timely, and accurate information to make 20 critical Command and Control and medical decisions. 21 In pursuit of this objective, Department of Defense (DOD) medical providers in operational 23 environments (defined as land, sea, and air) require the capability to receive, capture, store, view, share, 24 annotate, and archive imaging studies and medically related images (e.g., scanned paper records) in all 25 common modalities. 26 Description of Need 28 The JOMIS PMO requires optimization of the existing deployed tele-radiology capability and 30 management solution in support of medical/dental images produced in operational environments 31 across Areas of Responsibility (AORs) and archived in a regional repository. 32 The desired system must possess the following capabilities to satisfy the requirements to support 34 clinicians: 35

Provide ability for timely interpretation and/or consultation of all radiological images (i.e., store 37 and forward), and access to secondary consultations (i.e., users in different locations may 38 simultaneously view images). 39

Ability to support voice transcription and structured reporting. 40

Operate in a disconnected, intermittent, and limited (DIL) environment on an unclassified 41 Department of Defense (DOD) Internet Network (DODIN). 42

Provide a “Zero Foot Print” viewer option. 43

Request for Information (RFI) for JOMIS Operational Medicine Enterprise Imaging System(s)

Provide a distributed enterprise imaging capability for radiologists from any facility in the DOD 44 to provide OpMed support. 45

Host and accommodate encrypted HL7 interface(s) with other Electronic Health Records (EHRs) 46 systems. 47

Possess artificial intelligence (AI) capabilities and algorithms to evaluate, research, and cleanse 48 data to assist providers with clinical decision support with, at minimum, fracture detection and 49 brain trauma evaluation, image interpretation, workflow management, and predictive medicine. 50

Provide an explanation of the diagnostic reports to include utilization of structured reports (SR) 51 and Digital Imaging and Communications in Medicine (DICOM) wrapping. 52

Operate in a DIL environment with the ability to transmit and receive DICOM studies in an 53 encrypted format. 54

Include a regional repository to act as the authoritative data source for OpMed radiology studies 55 and reports (with the ability to archive records). 56

Analyze and cleanse all patient demographics against Defense Enrollment Eligibility Reporting 57 System (DEERS). 58

Provide a Tiered Service Desk for training and telephone work order support. 59

Acquire and maintain a security clearance commensurate with the requirements of the 60 project/program. 61

Description of Optional Scope of Services: 63

The contractor shall describe how they can provide Digital Health (DH) enablement capabilities to 64 support enterprise-wide virtual healthcare delivery. DH encompasses e-Health, telehealth, virtual 65 health, and telemedicine capabilities that facilitate provider-to-provider and provider-to-patient 66 interactions when care teams are not co-located. This optional CLIN enhances Healthcare Delivery (HCD) 67 by improving continuity, access, and quality of care across all roles of care and operational 68 environments. 69

Under an optional CLIN, the contractor would deliver capabilities that include, but are not limited to: 70

Secure, compliant communication tools for synchronous and asynchronous clinical consultation 71 (e.g., secure messaging, phone, video, imaging). 72

Tele-consultation and tele-mentoring services to support clinical decision-making and specialty 73 reach-back. 74

Sensor and peripheral device integration to enhance virtual diagnostic and monitoring 75 capabilities. 76

Technical interoperability, ensuring all virtual encounter documentation is fully integrated into 77 the EHR. 78

Compliance with Service-specific and DOD technical, cybersecurity, and interoperability 79 requirements. 80

Prioritized Outcomes: 82

Leverage the existing platform(s) in place to optimize the solution on an enterprise level. 83

Leverage existing platforms and operational investments. 84

Reduce duplicative services and systems by leveraging existing platforms to hedge against 85 technical debt. 86

Establish unified governance prioritization and modernization planning. 87

Maintain continuity of operations while improving performance and cost efficiency. 88

Streamline, rationalize, and enhance the current ecosystem into a single, scalable, enterprise 89 level contract structure that supports Joint Force medical operations. 90

Unified documentation of virtual encounters inside the enterprise EHR environment. 91

Enhanced continuity of care regardless of communication constraints or operational location. 92

Security 94

Security controls in accordance with Committee on National Security Systems (CNSS) 96 Instruction No. 1253, “Security Categorization and Control Selection for National Security 97 Systems” as outlined within NIST SP 800-171. 98

DODI 8510.01, Risk Management Framework (RMF). 99

DODI 8500.01, Cybersecurity. 100

Security controls in accordance with NIST implementation and validation requirements 101 specified in the NIST SP 800-37 Risk Management Framework (RMF). 102

Information system configuration in accordance with Defense Information Agency (DISA) 103 security technical implementation guides (STIGs). 104

DODI 8551.01 “Ports, Protocols, and Services Management (PPSM)”. 105

DoDI 8520.03 “Identity Authentication for Information Systems” prior to granting access. 106

DODI 8582.01 "Security of Unclassified DOD Information on Non-DOD Information Systems” 107 and “Cybersecurity” and National Institute of Standards and Technology (NIST) Special 108 Publication (SP) 800-53/53a and NIST SP 800-37, “Risk Management Framework (RMF) Guide 109 for Applying the Risk Management Framework to Federal Information Systems, as well as 110 emerging DOD Cybersecurity policy designed to address evolving threats. 111

DODD 8140.01, Defense Federal Acquisition Regulation Supplement (DFARS) 252.239-7001 and 112 DOD 8570.01-M baseline certifications required prior to beginning support services. 113

CNSSI 1253 Privacy Overlay for cloud services that contain Personally Identifiable Information 114 (PII)/Protected Health Information (PHI). 115

Procedures that address final disposition of PHI and PII and/or the electronic media on which it 116 is stored. 117

Compliance with requirements for Health Insurance Portability and Accountability Act of 1996 118 (HIPAA) (P.L. 104-191), Personnel Security, Electronic Security, and Physical Security. Data 119 which contains PHI will be continuously protected from unauthorized access, use, modification, 120 or disclosure. 121

FAR clause 52.224-1, “Privacy Act Notification” and FAR clause 52.224-2, “Privacy Act.” 122

FedRAMP Provisional Authorization (PA) to host Federal Government missions and DOD 123 Provisional Authorization to Operate (P-ATO). 124

JOMIS operates with both RMF accreditation and must demonstrate Cyber Survivability and 125 Cyber Resilience. JCIDS Manual 2021 and CSEIG v3.0. Any Red Team Testing or Penetration 126 Testing conducted successfully against recommended products would support its Cyber 127 Survivability Risk Posture (CSRP). 128

System Authority to Operate (ATO): 130 A recommended product will have ideally already achieved a successful RMF accreditation within 132 another DOD or Fourth Estate Agency. For discussion purposes, if a recommended product has not 133 already been accredited by either DOD or Fourth Estate Agency, indicators that would demonstrate a 134 quick accreditation process would be requested. Information could include a Federal Agency 135 accreditation, a list of products residing on the Approved Product List (APL), or an analysis of how a 136 product did in a laboratory/test environment with initial STIG/SRG testing. 137 The product must demonstrate production-ready capabilities and be able to close any security concerns 139 within Information Assurance Vulnerability Alert (IAVA) required periods and is being continuously 140 updated to address any issues. Any solution must be within a lifecycle that will continue to be 141 supported. 142 Organization Conflict of Interest: 144 Please see FAR 9.5 and DFARS 209.5 for background information related to organizational conflicts of 146 interest. PEO DHMS/JOMIS anticipates a relationship that will require the execution of corporate 147 nondisclosure agreements and non-compete commitments, and any resulting contract(s) may require 148 the execution of appropriate associate agreements with prime-mission product partners to gain access 149 to technical data and other proprietary information generated during the performance of those 150 contracts. 151 Additionally, respondents to this notice should be aware that PEO DHMS/JOMIS may use contractor 153 support personnel from the below listed companies to review responses and information submitted. 154

• Boston Consulting Group (BCG) or its subcontractors 156

These companies and their individual employees are bound contractually by Organizational Conflict of 158 Interest (OCI) and disclosure clauses with respect to proprietary information, and they will take all 159 reasonable action necessary to preclude unauthorized use or disclosure of a respondent’s proprietary 160 data. Request for Information (RFI) responses must clearly state whether permission is granted allowing 161 the program office support contractors identified below access to any proprietary information. 162 Feedback Requested (Maximum Page Limit: 15 Pages): 164

This RFI requests industry feedback on strategies, contract models, and technical architectures that 165 enable a transition to an enhanced enterprise-level contract structure leveraging existing platforms with 166 minimal disruption. 167 Data Rights 169 Please describe the recommended approach, ensuring the Government maintains the right level of data 170 rights ownership. Describe how this approach could be leveraged in other program management offices 171 or organizations that use your capabilities. 172 Technical Capability Submission Points 174 Deployable Picture Archiving and Communications/Tele-medicine capabilities in support of OpMed 176 throughout ROMO 177 Please describe your company’s experience supporting OpMed in the development, deployment, 178 installation, use, and sustainment of Deployable Tele-Radiology capabilities while complying with HIPAA. 179 Include insights, recommendations, strategies, and past performance. Describe any challenges, gaps and 180 pain points delivering Deployable Tele-Radiology capabilities based on experience. 181 Data Interface Management 183 Please describe your prior DOD imaging experience with Enterprise Clinical Imaging Archive (ECIA) and 184 your ability to manage data interfaces between DOD and non-DOD systems. 185 Continuous Integration/Continuous Delivery (CI/CD) Strategy/Approach 187 Provide a description of your approach to managing the CI/CD process for this system. Does your 188 company have a DevSecOps platform, does it provide continuous Authority to Operate (cATO)? If so, 189 which domains and classification levels do the cATO cover? 190 Image Exchange 192 Please describe how you will support health care providers’ capability to share DICOM images with 193 authorized DOD and non-DOD providers and how it will enable users to capture and organize, at the 194 individual and aggregate levels, relevant patient health and safety-related data and treatment history 195 into individual electronic health records (EHR) according to formats and timelines required by DOD. 196 Describe how you use Webservices. How will your capability employ AI capabilities and algorithms to 197 assist providers with clinical decision support, image interpretation, workflow management, and 198 predictive medicine? Please describe how your system uses a patient Medical Record Number (MRN) for 199 system queries or patient launch. 200

Capture, Import and Store 204 Provide a description of how you will provide the capability to capture all standard DICOM medical 205 imaging modalities including radiography, computed tomography, magnetic resonance imaging, and 206 ultrasound from issued medical imaging devices, import DICOM images from media such as CD/DVD, 207 and store images in DICOM format with associated patient identification and demographic information. 208

DIL Environment Support 210 The capability will need to be able to be accessible by end users anywhere in the world where U.S. 211 forces are deployed. The system must provide clinicians with limited technical support in DIL unclassified 212 DODIN environments with the ability to receive, capture, store, view, share, annotate, and archive 213 imaging studies in all common modalities and will support virtual radiological healthcare between the 214 battlefield operational and garrison medical facilitates. Please describe how your system will meet these 215 requirements. 216 CAC-Enabled Authentication Capabilities 218 Describe how your system accommodates Common Access Card (CAC)-enablement for user 219 authentication and demographics acquisition. 220 Cybersecurity/Accreditation 222 Provide examples of previous or current work in support of DOD or Fourth Estate cybersecurity 223 accreditation activities, independent verification, and validation (IV&V), and support of Plan of Action 224 and Milestones (POA&Ms) for Risk Management Framework (RMF) activities. 225 Product Supportability 227 Describe your approach to deploying, sustaining, and supporting end users of your solution. What 228 methods and tools would you use to train DOD end users? Describe how you would support a regional 229 repository. 230 Viewing 232 Describe how your solution will support PDF and 2D/3D/4D and DICOM compliant medical image 233 viewing capability with referential and diagnostic standard functionality to display diagnostic images at 234 variable magnifications and from variable perspectives supporting radiography, computed tomography, 235 magnetic resonance imaging, and ultrasound modalities. Also describe how your solution will enable 236 interpretive tools including measurement of distance, angles, and Houndsfield Units within supported 237 images and capability to save those measurements. 238 Archiving 240 Describe how your solution will provide the capability to cleanse, and archive verified studies performed 241 on DOD personnel and beneficiaries to the regional repository and permanently archive verified studies 242 to the DOD ECIA. Describe how the capability will verify the appropriate deletion of the records captured 243 in that storage when and as directed by the DOD. 244 Performance Attributes 246 Describe how your company would ensure Deployable Tele-Radiology capabilities will provide a 99.9% 247 Operational Availability (not including planned outages or network disruptions) as measured at point of 248 delivery across the negotiated incremental capability duration. Describe how your company will provide 249 incident response and Tier III support services to urgent incidents and requests for service within two 250 hours of telephonic notification and to routine incidents and requests for service within eight hours of 251 notification. 252

Recommended: Software/Hardware Ports and Protocols 254 Provide a list of hardware and software products required to implement the software, a Ports Protocols 255 Services and Management (PPSM), and appropriate completed DISA Security Technical Implementation 256 Guidance (STIG) and DISA Security Requirements Guide (SRG) results for your product. 257 Summary Instructions 259

DHMS-CD is issuing this RFI for the purpose of determining solutions capable of fulfilling JOMIS’ 260 Deployable Tele-Radiology requirements. 261

Interested parties may submit a written response stating how they would effectively fulfill the 262 requirement and include appropriate documentation describing how this is possible with acceptable 263 performance risk. The written response should provide sufficient detail to allow for an assessment by 264 the Government without the need for additional information. Responses to this RFI are not quotes upon 265 which the DHMS-CD can issue a contract. Therefore, the Government does not intend to award a 266 contract based on responses to this RFI. 267

The applicable North American Industry Classification System (NAICS) is 541512 and the applicable 268 Product Service Code (PSC) is DA01. Please send responses to Ms. Elizabeth Ruckwardt by 26 January 269 2026, no later than 1600 Eastern Time via email to elizabeth.m.ruckwardt.civ@health.mil. 270