OpMedLOG RFI 20241202.pdf

Request for Information 1

Joint Operational Medicine Information System 2 Joint Operational Medicine Medical Logistics Capabilities 3

THIS IS A REQUEST FOR INFORMATION (RFI) ANNOUNCEMENT ONLY. This notice 5 does not constitute a commitment by the Government. All information submitted in response to 6 this announcement is voluntary, and the Government will not pay for information requested nor 7 will it compensate any respondent for any cost incurred in developing information provided to 8 the Government. 9

OVERVIEW 10

The Defense Health Agency Contracting Activity (DHACA) on behalf of Program Executive 11 Office Defense Healthcare Management Systems (PEO DHMS), Joint Operational Medicine 12 Information System (JOMIS) Program Management Office (PMO), is seeking potential 13 modernized Operational Medicine (OpMed) Medical Logistics (MEDLOG) solutions that can be 14 configured for full joint interoperability. This joint MEDLOG capability must satisfy baseline 15 requirements for survivability, patient safety, and quality of care through responsive, agile, and 16 survivable MEDLOG functions that are integrated with a jointly interoperable health service 17 system. The capability should provide a globally integrated network of theater health service 18 support nodes operating with common standards and procedures that are supported by adaptive, 19 jointly interoperable Defense Medical Logistics (DML) capabilities and MEDLOG 20 organizations. DML capabilities must be rapidly and globally aligned and/or reconfigured to 21 respond to the changing operational requirements of Combatant Commanders. 22 Defense Medical Logistics Standard Support (DMLSS) will be replaced by LogiCole. DMLSS, 24 TEWLS, the DMLSS Customer Assistance Module are the current Joint Class VIII 25 OpMEDLOG solutions providing Roles 1, 2, and 3 OpMEDLOG capability. DMLSS has a 26 decommissioning date anticipated in February 2028. 27

DESCRIPTION OF NEED 29

The JOMIS PMO requires a MEDLOG information system solution that is supported, usable, 30 configurable, provides data authority, and interoperates with specified Joint and Service 31 solutions and multiple hardware platforms. It needs to have the ability to operate in a Denied, 32 Disrupted, Intermittent, and Low-Bandwidth (DDIL) environment and be accessible anywhere in 33 the world as a user in a deployable Department of Defense (DOD) organization. 34 The desired system must possess the following capabilities to satisfy the requirements to support 36 clinicians: 37

• Unit Level Supply: Ability, in a deployable DOD organization (i.e., Roles of Care 1, 2, and 39

3 and non-medical units), to order and receive medical supplies, including status updates and 40 changes. 41

RFI for JOMIS Joint Operational Medicine Logistics Capabilities

• Intermediate Level Supply: Ability to perform medical supply support and basic materiel 42 management functions as a user in an intermediate MEDLOG organization (e.g., MEDLOG 43 companies, Role 3 MEDLOG sections, and Brigade/Group Medical Supply Offices). 44

• Unit Level Equipment: Ability to view, update, and report the maintenance status of 45 authorized medical equipment and request maintenance support as a user in a deployable 46 DOD organization (i.e., Roles of Care 1, 2, and 3 and non-medical units). 47

• Intermediate Level Equipment: Ability to document medical maintenance services and 48 manage medical maintenance support as a user in an intermediate MEDLOG organization 49 (e.g., MEDLOG companies, Role 3 MEDLOG sections, and Brigade/Group Medical Supply 50 Offices). 51

• Anticipatory Logistics: Ability to forecast and anticipate MEDLOG requirements as a user 52 in a deployable DOD organization (i.e., Roles of Care 1, 2, and 3 and non-medical units) or 53 as a user at a headquarters location who is planning for and supporting operational medicine. 54

• Unit Level Assemblage Management: Ability to view, update, and report the supply status 55 of authorized assemblage(s), and place orders for supply shortages to manage unit 56 assemblage(s) as a user in a deployable DOD organization (i.e., Roles of Care 1, 2, and 3 and 57 non-medical units). 58

• Knowledge Management/Situational Awareness: Ability to manage MEDLOG 59 information (e.g., view, update, receive, report, etc.) as a user in a deployable DOD 60 organization (i.e., Roles of Care 1, 2, and 3 and non-medical units) or as a user at a 61 headquarters location who is planning for and supporting operational medicine. 62

• Non-Functional and System Administration: Provide a MEDLOG information system 63 solution that is supported, usable, configurable, and supports data authority; interoperates 64 with specified Joint and Service solutions and multiple hardware platforms; is accessible 65 anywhere in the world to a user in a deployable DOD organization (i.e., Roles of Care 1, 2, 66 and 3 and non-medical units); and has a virtual assistant to answer questions about 67 functionality from end users. 68

• Facility Management: Ability to view, update, and report facility status (and associated 69 equipment) and request maintenance support to manage unit facility equipment. 70

• Contract Services: Ability to view and manage MEDLOG service contracts, including 71 status updates and changes, as a user in a deployable DOD organization (i.e., Roles of Care 72 1, 2, and 3 and non-medical units). 73

• Environmental Services: Ability to view and manage MEDLOG environmental services, 74 including status updates and changes, whether at a home station or deployed as a user in a 75 deployable DOD organization (i.e., Roles of Care 1, 2, and 3 and non-medical units). 76

Additional support needed for the desired system includes: 78

• User Support Management: Integrate user research, change management, stakeholder 80 communication, and user engagement events to ensure the successful adoption and sustained 81 utilization of the product. 82

• Training and Exercise Support: Provide functional and technical training to enable 84 modernized product integration by supporting operational assessment, operational test, 85 Service exercises, initial deployments, and legacy sustainment training. 86

• Release and Deployment: Work with Services to complete pre-deployment (i.e., site 87 surveys), deployment (i.e., product delivery, setup, and integration), and post-deployment 88 (i.e., software updates and troubleshooting) to successfully deliver modernized products to 89 end users. 90

• Tier 3 Support: Provide Tier 3 support for your solution. 91

SECURITY 93

• Security controls in accordance with Committee on National Security Systems Instruction 94 (CNSSI) No. 1253, Security Categorization and Control Selection for National Security 95 Systems, as outlined within National Institute of Standards and Technology (NIST) Special 96 Publication (SP) 800-171. 97

• DoDI 8500.01, Cybersecurity. 98

• DoDI 8510.01, Risk Management Framework (RMF) for DOD Information Technology (IT). 99

• Security controls in accordance with NIST implementation and validation requirements 100 specified in NIST SP 800-37, Rev. 2, Risk Management Framework (RMF) for Information 101 Systems and Organizations: A System Life Cycle Approach for Security and Privacy. 102

• Information system configuration in accordance with Defense Information Systems Agency 103 (DISA) Security Technical Implementation Guides (STIGs). 104

• DoDI 8551.01, Ports, Protocols, and Services Management (PPSM). 105

• DoDI 8520.03, Identity Authentication for Information Systems (prior to granting access). 106

• DoDI 8582.01, Security of Unclassified DOD Information on Non-DOD Information 107 Systems and Cybersecurity; NIST SP 800-53/53a, Assessing Security and Privacy Controls 108 in Information Systems and Organizations; NIST SP 800-37, Rev. 2, Risk Management 109 Framework (RMF) for Information Systems and Organizations: A System Life Cycle 110 Approach for Security and Privacy.; and emerging DOD Cybersecurity Policy designed to 111 address evolving threats. 112

• DoDD 8140.01, Cyberspace Workforce Management; Defense Federal Acquisition 113 Regulation Supplement (DFARS) 252.239-7001, Information Assurance Contractor Training 114 and Certification; and DFARS 252.204-7012, Safeguarding Covered Defense Information 115 and Cyber Incident Reporting. 116

• DoDM 8140.03, Cyberspace Workforce Qualification and Management Program [signed 15 117 February 2023] baseline certifications are required prior to beginning support services. 118

• CNSSI 1253, Security Categorization and Control Selection for National Security Systems, 119 Privacy Overlay for Cloud Services that contains Personally Identifiable Information 120 (PII)/Protected Health Information (PHI). 121

• Procedures that address final disposition of PHI and PII and/or the electronic media on which 122 it is stored. 123

• Compliance with requirements for Health Insurance Portability and Accountability Act of 124 1996 (HIPAA) (Public Law 104-191), Personnel Security, Electronic Security, and Physical 125 Security. Data which contains PHI will be continuously protected from unauthorized access, 126 use, modification, or disclosure. 127

• Federal Acquisition Regulation (FAR) clause 52.224-1, Privacy Act Notification, and FAR 128 clause 52.224-2, Privacy Act. 129

• The Federal Risk and Authorization Management Program Provisional Authorization to host 130 Federal Government missions and DOD Provisional Authorization to Operate. 131

• JOMIS operates with RMF accreditation and must demonstrate Cyber Survivability and 132 Cyber Resilience per the Joint Chiefs of Staff Joint Capabilities Integration and Development 133 System Manual 2021 and CSEIG v3.0, Cyber Survivability Endorsement Implementation 134 Guide. Any Red Team Testing or Penetration Testing conducted successfully against 135 recommended products would support its Cyber Survivability Risk Posture. 136

SYSTEM AUTHORITY TO OPERATE 138

Ideally, a recommended product will already have achieved a successful RMF accreditation 139 within another DOD or Fourth Estate Agency. For discussion purposes, if a recommended 140 product has not already been accredited by either a DOD or Fourth Estate Agency, indicators that 141 demonstrate a quick accreditation process will be requested. Information could include a Federal 142 Agency accreditation, a list of products residing on the Approved Product List, or an analysis of 143 how a product performed in a laboratory/test environment with initial STIG and DISA Security 144 Requirements Guide testing. 145 The product must demonstrate production-ready capabilities and close any security concerns 147 within Information Assurance Vulnerability Alert required periods (while being continuously 148 updated to address any issues). Any solution must be within a lifecycle that will continue to be 149 supported. 150

ORGANIZATIONAL CONFLICT OF INTEREST (OCI) 152

See FAR 9.5, Organizational and Consultant Conflicts of Interest, and DFARS 209.5, 153 Organizational and Consultant Conflicts of Interest, for background information related to 154 organizational conflicts of interest. PEO DHMS/JOMIS anticipates a relationship that will 155 require the execution of corporate nondisclosure agreements and non-compete commitments. 156 Any resulting contract(s) may require the execution of appropriate associate agreements with 157 prime-mission product partners to gain access to technical data and other proprietary information 158 generated during the performance of those contracts. 159 Additionally, respondents to this RFI should be aware that PEO DHMS/JOMIS may use 161 contractor support personnel from the companies listed below to review responses and 162 information submitted. 163

• Boston Consulting Group or its subcontractors 165 These companies and their individual employees are bound contractually by OCI and disclosure 167 clauses with respect to proprietary information and will take all reasonable actions necessary to 168 preclude unauthorized use or disclosure of a respondent’s proprietary data. RFI responses must 169 clearly state whether permission is granted to allow the program office support contractors 170 identified above access to proprietary information. 171

FEEDBACK REQUESTED 173

Maximum Page Limit: 15 Pages 174

Joint Services Interoperability 175 Describe how your proposed solution can incorporate existing logistics systems into one system, 176 synchronizing data so all share the same common logistics operating picture. This capability 177 should stand as the joint solution for OpMEDLOG with the ability to connect, share data, and 178 store information from all jointly interoperable DML capabilities and MEDLOG organizations, 179 including primary and alternate vendors. 180 Data Interface Management 182 Explain how your proposed solution maximizes the ability to integrate with existing DoD and 183 Service-specific logistics and medical logistics systems. Focus on your company’s experience 184 and ability to manage data interfaces between commercial, military, and Government systems, 185 and how you would integrate that data into the OpMed Health Care Delivery ecosystem. 186 Describe your agile or lean methods to document and manage this integration. Is your solution 187 open-source and are open standards easily integrated? 188 Continuous Integration/Continuous Delivery (CI/CD) Strategy/Approach 190 Provide a description of your approach to managing the CI/CD process for your proposed 191 solution. Does your company have a DevSecOps platform? If so, does this platform provide a 192 Continuous Authority to Operate? If so, on what domains and classification levels? 193 Additionally, describe how you will comply with Government-provided Cloud and development 194 resources, as well as your experience in cooperation, collaboration, and integration with other 195 product vendors. 196 DDIL Environment Support 198 Describe how your solution will operate in DDIL environments. Detail how your solution will 199 provide two-way data synchronization capability with other Theater locations, with DoD and 200 Service-specific logistics and medical logistics systems, OpMED Health Care Delivery 201 Platforms, and with other DOD enterprise systems (as appropriate) when network connectivity 202 becomes available. 203 Cybersecurity/Accreditation 205 Provide examples of previous or current work in support of DOD or Fourth Estate cybersecurity 206 accreditation activities, independent verification and validation, and support of Plan of Action 207 and Milestones for RMF activities. 208

Product Supportability 210

Describe your approach to deploying, sustaining, and supporting end users of your solution that 211 incorporates User Support Management, Training and Exercise Support, Release and 212 Deployment, and Tier 3 Support. 213 Performance Attributes 215 Describe how your company would ensure MEDLOG capabilities will provide a 99.9% 216 Operational Availability (not including planned outages or network disruptions) as measured at 217 point of delivery across the negotiated incremental capability duration. Describe how your 218 company will provide incident response and Tier 3 support services for urgent incidents; for 219 requests for service within two hours of telephonic notification; and for routine incidents and 220 requests for service within eight hours of notification. 221 Knowledge Management 223 Describe previous experience using Knowledge Management systems/solutions that require 224 development and management of various roles and systems access levels. 225 Supplier Management 227 Detail experience forecasting for and providing medical supply support and basic materiel 228 management functions within the health care industry. 229 Sustainability and Supportability 231 Describe capabilities or infrastructure your proposed solution provides to support the distribution 232 and operation of software in targeted environments. The capability must be accessible by end 233 users across the DOD. Describe your approach to ensure access during periods of growth and 234 contraction of Cloud infrastructure, and how other approaches to Cloud computing will be 235 implemented to meet current and future requirements. Does your solution work in the DDIL 236 environment? If so, describe how this operates. 237 System Monitoring and Alerts 239 Describe your solution’s capability to view, update, and report maintenance status of authorized 240 medical equipment, and how it will request maintenance support. 241 Company Information 243 The applicable North American Industry Classification System (NAICS) is 541512 and the 244 applicable Product Service Code (PSC) is DA10. Are you a small business under NAICS 245 541512 or do you suggest a different NAICS to support this work? 246 What is your approved Cage Code, UEI, and socio-economic status? 247 Does your firm possess an approved DCAA/DCMA accounting system? 248 Does your firm have contracts on any IDIQ or BOA appropriate for this work? If so, what ones? 249

SUMMARY INSTRUCTIONS 251

DHMS-CD is issuing this RFI for the purpose of determining solutions capable of fulfilling 252 JOMIS MEDLOG requirements. 253

Interested parties may submit a written response stating how they would effectively fulfill the 254 requirements and include appropriate documentation describing how this is possible with 255 acceptable performance risk. The written response should provide sufficient detail to allow for 256 an assessment by the Government without the need for additional information. Responses to this 257 RFI are not quotes upon which the DHMS-CD can issue a contract. Therefore, the Government 258 does not intend to award a contract based on responses to this RFI. 259

SUBMITTAL 260

Send responses to Elizabeth M. Ruckwardt by December 18, 2025, no later than 1500 Eastern 261 Time via email to elizabeth.m.ruckwardt.civ@health.mil. 262