Operational Medicine Enterprise Imaging System(s) (OMEIS) RFI.pdf

Request for Information 1

Joint Operational Medicine Information System 2

Operational Medicine Enterprise Imaging System(s) 3

THIS IS A REQUEST FOR INFORMATION (RFI) ANNOUNCEMENT ONLY. This notice does not constitute a 5 commitment by the Government. All information submitted in response to this announcement is 6 voluntary, and the Government will not pay for information requested nor will it compensate any 7 respondent for any cost incurred in developing information provided to the Government. 8

The Defense Health Agency Contracting Activity (DHACA) Defense Healthcare Management Systems 9 Contracting Division (DHMS-CD), in support of Program Executive Office (PEO) DHMS, Joint Operational 10 Medicine Information System (JOMIS) Program Office (PMO), is seeking potential sources with effective 11 capabilities to provide the capability to deploy an Operational Medicine (OpMed) Tele-12 Radiology/Medicine capability with user training and support services, that provides electronic 13 transmission of radiological images from one location to another throughout the range of military 14 operations (ROMO). 15 The primary mission of the Military Health System (MHS) is to ensure the Nation continuously has a 17 healthy fighting force and the ability to support ROMO. OpMed services include, but are not limited to, 18 preventive, routine, emergency, surgical, en-route care, and diagnostic care. OpMed systems provide 19 Commanders and medical professionals with integrated, timely, and accurate information to make 20 critical Command and Control and medical decisions. 21 In pursuit of this objective, Department of Defense (DOD) medical providers in operational 23 environments require the capability to receive, capture, store, view, share, annotate, and archive 24 imaging studies and medically related images (e.g., scanned paper records) in all common modalities. 25 Description of Need 27 The JOMIS PMO requires a deployable tele-radiology capability and management services in support of 29 medical/dental images produced in operational environments and archived in a regional repository. 30 Currently, the regional repository is in Germany and other Operational Medicine Enterprise Imaging 31 System(s) (OMEIS) capabilities are potentially required in other ROMO. 32 The desired system must possess the following capabilities to satisfy the requirements to support 34 clinicians: 35

• Provide ability for timely interpretation and/or consultation of radiological images (i.e., store 37 and forward), and access to secondary consultations (i.e., users in different locations may 38 simultaneously view images). 39

• Ability to support voice transcription and structured reporting. 40

• Operate in a disconnected, intermittent, and limited (DIL) environment on an unclassified 41 Department of Defense (DOD) Internet Network (DODIN). 42

• Provide a “Zero Foot Print” viewer option. 43

Request for Information (RFI) for JOMIS Deployable OpMed Tele-Radiology Capabilities

• Provide a distributed enterprise imaging capability for radiologist from any facility in the DOD to 44 provide OpMed support. 45

• Host and accommodate encrypted HL7 interface(s) with other Electronic Health Records (EHRs) 46 systems. 47

• Possess artificial intelligence (AI) capabilities and algorithms to evaluate, research, and cleanse 48 data to assist providers with clinical decision support with, at minimum, fracture detection and 49 brain trauma evaluation, image interpretation, workflow management, and predictive medicine. 50

• Provide an explanation of the diagnostic reports to include utilization of structured reports (SR) 51 and Digital Imaging and Communications in Medicine (DICOM) wrapping. 52

• Operate in a DIL environment with the ability to transmit and receive DICOM studies in an 53 encrypted format. 54

• Include a regional repository to act as the authoritative data source for OpMed radiology studies 55 and reports (with the ability to archive records). 56

• Analyze and cleanse all patient demographics against Defense Enrollment Eligibility Reporting 57 System (DEERS). 58

• Provide a Tiered Service Desk for training and telephone work order support. 59

• Acquire and maintain a security clearance commensurate with the requirements of the 60 project/program. 61

Security 62

• Security controls in accordance with Committee on National Security Systems (CNSS) 64 Instruction No. 1253, “Security Categorization and Control Selection for National Security 65 Systems” as outlined within NIST SP 800-171. 66

• DODI 8510.01, Risk Management Framework (RMF). 67

• DODI 8500.01, Cybersecurity. 68

• Security controls in accordance with NIST implementation and validation requirements 69 specified in the NIST SP 800-37 Risk Management Framework (RMF). 70

• Information system configuration in accordance with Defense Information Agency (DISA) 71 security technical implementation guides (STIGs). 72

• DODI 8551.01 “Ports, Protocols, and Services Management (PPSM)”. 73

• DoDI 8520.03 “Identity Authentication for Information Systems” prior to granting access. 74

• DODI 8582.01 "Security of Unclassified DOD Information on Non-DOD Information Systems” 75 and “Cybersecurity” and National Institute of Standards and Technology (NIST) Special 76 Publication (SP) 800-53/53a and NIST SP 800-37, “Risk Management Framework (RMF) Guide 77 for Applying the Risk Management Framework to Federal Information Systems, as well as 78 emerging DOD Cybersecurity policy designed to address evolving threats. 79

• DODD 8140.01, Defense Federal Acquisition Regulation Supplement (DFARS) 252.239-7001 and 80 DOD 8570.01-M baseline certifications required prior to beginning support services. 81

• CNSSI 1253 Privacy Overlay for cloud services that contain Personally Identifiable Information 82 (PII)/Protected Health Information (PHI). 83

• Procedures that address final disposition of PHI and PII and/or the electronic media on which it 84 is stored. 85

• Compliance with requirements for Health Insurance Portability and Accountability Act of 1996 86 (HIPAA) (P.L. 104-191), Personnel Security, Electronic Security, and Physical Security. Data 87 which contains PHI will be continuously protected from unauthorized access, use, modification, 88 or disclosure. 89

• FAR clause 52.224-1, “Privacy Act Notification” and FAR clause 52.224-2, “Privacy Act.” 90

• FedRAMP Provisional Authorization (PA) to host Federal Government missions and DOD 91 Provisional Authorization to Operate (P-ATO). 92

• JOMIS operates with both RMF accreditation and must demonstrate Cyber Survivability and 93 Cyber Resilience. JCIDS Manual 2021 and CSEIG v3.0. Any Red Team Testing or Penetration 94 Testing conducted successfully against recommended products would support its Cyber 95 Survivability Risk Posture (CSRP). 96

System Authority to Operate (ATO): 98 A recommended product will have ideally already achieved a successful RMF accreditation within 100 another DOD or Fourth Estate Agency. For discussion purposes, if a recommended product has not 101 already been accredited by either a DOD or Fourth Estate Agency, indicators that would demonstrate a 102 quick accreditation process would be requested. Information could include a Federal Agency 103 accreditation, a list of products residing on the Approved Product List (APL), or an analysis of how a 104 product did in a laboratory/test environment with initial STIG/SRG testing. 105 The product must demonstrate production-ready capabilities and be able to close any security concerns 107 within Information Assurance Vulnerability Alert (IAVA) required periods and is being continuously 108 updated to address any issues. Any solution must be within a lifecycle that will continue to be 109 supported. 110 Organization Conflict of Interest: 112 Please see FAR 9.5 and DFARS 209.5 for background information related to organizational conflicts of 114 interest. PEO DHMS/JOMIS anticipates a relationship that will require the execution of corporate 115 nondisclosure agreements and non-compete commitments, and any resulting contract(s) may require 116 the execution of appropriate associate agreements with prime-mission product partners to gain access 117 to technical data and other proprietary information generated during the performance of those 118 contracts. 119 Additionally, respondents to this notice should be aware that PEO DHMS/JOMIS may use contractor 121 support personnel from the below listed companies to review responses and information submitted. 122

• SeKON Enterprise 124

• Boston Consulting Group (BCG) or its subcontractors 125

These companies and their individual employees are bound contractually by Organizational Conflict of 127 Interest (OCI) and disclosure clauses with respect to proprietary information, and they will take all 128 reasonable action necessary to preclude unauthorized use or disclosure of a respondent’s proprietary 129 data. Request for Information responses must clearly state whether permission is granted allowing the 130 program office support contractors identified below access to any proprietary information. 131 Feedback Requested (Maximum Page Limit: 10 Pages): 133

Data Rights 134 Please describe the recommended approach, ensuring the Government maintains the right level of data 135 rights ownership. Describe how this approach could be leveraged in other program management offices 136 or organizations that use your capabilities. 137 Technical Capability Questions 139 Deployable Picture Archiving and Communications/Tele-medicine capabilities in support of OpMed 141 throughout ROMO 142 Please explain your company’s experience supporting OpMed in the development, deployment, 143 installation, use, and sustainment of Deployable Tele-Radiology capabilities while complying with HIPAA. 144 Include insights, recommendations, strategies, and past performance. Describe any challenges, gaps and 145 pain points delivering Deployable Tele-Radiology capabilities based on experience. 146 Data Interface Management 148 Please describe yours prior DOD imaging experience with Enterprise Clinical Imaging Archive (ECIA) and 149 your ability to manage data interfaces between DOD and non-DOD systems. 150 Continuous Integration/Continuous Delivery (CI/CD) Strategy/Approach 152 Provide a description of your approach to managing the CI/CD process for this system. Does your 153 company have a DevSecOps platform, does it provide a continuous Authority to Operate (cATO)? On 154 what domains and classification levels? 155 Image Exchange 157 Please describe how you will support health care providers’ capability to share DICOM images with 158 authorized DOD and non-DOD providers and how it will enable users to capture and organize, at the 159 individual and aggregate levels, relevant patient health and safety-related data and treatment history 160 into individual electronic health records (EHR) according to formats and timelines required by DOD. 161 Describe how you use Webservices. How will your capability employ AI capabilities and algorithms to 162 assist providers with clinical decision support, image interpretation, workflow management, and 163 predictive medicine? Please describe how your system uses a patient Medical Record Number (MRN) for 164 system queries or patient launch. 165 Capture, Import and Store 167 Provide a description of how you will provide the capability to capture all standard DICOM medical 168 imaging modalities including radiography, computed tomography, magnetic resonance imaging, and 169 ultrasound from issued medical imaging devices, import DICOM images from media such as CD/DVD, 170 and store images in DICOM format with associated patient identification and demographic information. 171

DIL Environment Support 174 The capability will need to be able to be accessible by end users anywhere in the world where U.S. 175 forces are deployed. The system must provide clinicians with limited technical support in DIL unclassified 176 DODIN environments with the ability to receive, capture, store, view, share, annotate, and archive 177 imaging studies in all common modalities and will support virtual radiological healthcare between the 178 battlefield operational and garrison medical facilitates. Please describe how your system will meet 179 these requirements. 180 CAC-Enabled Authentication Capabilities 182 Describe how your system accommodates Common Access Card (CAC)-enablement for user 183 authentication and demographics acquisition. 184 Cybersecurity/Accreditation 186 Please provide examples of previous or current work in support of DOD or Fourth Estate cybersecurity 187 accreditation activities, independent verification, and validation (IV&V), and support of Plan of Action 188 and Milestones (POA&Ms) for Risk Management Framework (RMF) activities. 189 Product Supportability 191 Describe your approach to deploying, sustaining, and supporting end users of your solution. What 192 methods and tools would you use to train DOD end users? Describe how you would support a regional 193 repository. 194 Viewing 196 Please describe how your solution will support PDF and 2D/3D/4D and DICOM compliant medical image 197 viewing capability with referential and diagnostic standard functionality to display diagnostic images at 198 variable magnifications and from variable perspectives supporting radiography, computed tomography, 199 magnetic resonance imaging, and ultrasound modalities. Also describe how your solution will enable 200 interpretive tools including measurement of distance, angles, and Houndsfield Units within supported 201 images and capability to save those measurements. 202 Archiving 204 Please describe how your solution will provide the capability to cleanse and archive verified studies 205 performed on DOD personnel and beneficiaries to the regional repository and permanently archive 206 verified studies to the DOD ECIA. Describe how the capability will verify the appropriate deletion of the 207 records captured in that storage when and as directed by the DOD. 208 Performance Attributes 210 Please describe how your company would ensure Deployable Tele-Radiology capabilities will provide a 211 99.9% Operational Availability (not including planned outages or network disruptions) as measured at 212 point of delivery across the negotiated incremental capability duration. Describe how your company will 213 provide incident response and Tier III support services to urgent incidents and requests for service 214 within two hours of telephonic notification and to routine incidents and requests for service within eight 215 hours of notification. 216

Recommended: Software/Hardware Ports and Protocols 219 Please provide a list of hardware and software products required to implement the software, a Ports 220 Protocols Services and Management (PPSM), and appropriate completed DISA Security Technical 221 Implementation Guidance (STIG) and DISA Security Requirements Guide (SRG) results for your product. 222 Summary Instructions 224

DHMS-CD is issuing this RFI for the purpose of determining solutions capable of fulfilling JOMIS’ 226 Deployable Tele-Radiology requirements. 227

Interested parties may submit a written response stating how they would effectively fulfill the 228 requirement and include appropriate documentation describing how this is possible with acceptable 229 performance risk. The written response should provide sufficient detail to allow for an assessment by 230 the Government without the need for additional information. Responses to this RFI are not quotes upon 231 which the DHMS-CD can issue a contract. Therefore, the Government does not intend to award a 232 contract based on responses to this RFI. 233

Please send responses to Ms. Elizabeth Ruckwardt and Ms. Jena Bowman by 17 June 2024, no later than 234 1500 Eastern Time via email to elizabeth.m.ruckwardt.civ@health.mil & jena.l.bowman.civ@health.mil. 235