P02 Draft PWS.docx

Enterprise Mammography Tracking & Reporting System VA-26-00046145

DRAFT

PERFORMANCE WORK STATEMENT

DEPARTMENT OF VETERANS AFFAIRS

Veteran’s Health Administration Healthcare Technology Management Program Office National Radiology Program

Enterprise Mammography Tracking & Reporting System

Date: March 26, 2026

VA-26-00046145

PWS Version Number: 1.0

Contents

BACKGROUND

The Department of Veterans Affairs (VA), Veterans Health Administration (VHA), National Radiology Program Office strives to provide high quality, effective, and efficient solutions to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Clinical Information Systems (CIS) to meet mission goals.

Veterans Integrated Service Networks (VISNs) facilities across VHA may utilize various Radiology Information Systems (RIS) and Picture Archiving and Communication Systems (PACS), in addition to the Electronic Health Record (EHR). Therefore, the proposed Mammography Tracking System must be capable of integrating with these systems to ensure interoperability, accurate data exchange, and compliance with VHA standards. This integration will enable seamless workflow, reduce duplication of effort, and support comprehensive reporting and patient care management. Furthermore, VHA has substantial interface requirements between the proposed Mammography Tracking and Reporting System (MTRS), the Veterans Health Information and Systems Technology Architecture (VistA), and Federal Electronic Health Record (FEHR). This integration is critical to enable seamless workflow, reduce duplication of effort, support comprehensive reporting, and enhance patient care management.

The Veterans Health Administration (VHA) requires an Enterprise Mammography Tracking and Reporting System, software licenses, installation and technical services, and training. The MTRS will provide radiologists and clinical staff with enhanced tools to efficiently manage and monitor VHA mammography programs.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

3. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

4. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022

6. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and Information Technology Act of 2006, as amended, Title IX, Information Security Matters

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

10. VA Directive 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/index.cfm

11. VA Handbook 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/index.cfm

12. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

13. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended

14. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

15. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”, as amended

16. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

17. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”, VA Notice 25-16, dated September 15, 2025, “Amending VA Handbook 6500 to Replace Enterprise Mission Assurance Support Services Tool With Office of Information Technology Governance Risk Compliance Tool, and VA Notice 25-17, dated September 22, 2025, “Rescission Of Office Of Information Security (OIS) Deputy Assistant Secretary (DAS) Memorandum – Requirements of Proper Plan of Action and Milestones (POA&M) Completion)

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

24. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

25. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018 (see VA NOTICE 25-10, dated June 9, 2025, “Use of Personally Owned Mobile Devices Policy Amendment of Department of Veterans Affairs Handbook 6500.10”, and VA Notice 25-15, dated August 22, 2025, “Update to VA Handbook 6500.10 Mobile Device Security Policy”)

26. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

27. OIT Process Asset Library (PAL), OIT Process Asset Library.

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

30. VA Directive 6510, “VA Identity, Credential and Access Management,” September 3, 2024

31. VA Handbook 6510, “VA Identity, Credential and Access Management,” September 27, 2024

32. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

33. VA Directive 6300, “Records and Information Management,” September 21, 2018

34. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

44. NIST SP 800-63 Rev 4, 800-63A-4, 800-63B-4, 800-63C-4, “Digital Identity Guidelines,” August 1, 2025

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

47. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

49. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

50. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

51. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

52. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L. 110–140), December 19, 2007

53. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005

54. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

55. Executive Order 14148, “Initial Rescissions of Harmful Executive Orders and Actions,” dated January 20, 2025

56. VA Directive 0057, “VA Environmental Management Program,” October 25, 2022

57. OIS VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

58. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

59. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

60. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

61. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

62. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

63. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

64. Social Security Number (SSN) Fraud Prevention Act of 2017

65. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

66. C.F.R Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”, as amended

67. Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

68. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

69. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

70. OMB M-26-05, “Adopting a Risk-based Approach to Software and Hardware Security,” January 23, 2026

71. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27, 2021

72. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December 2014

73. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02: Vulnerability Remediation Requirements for Internet-Accessible Systems | CISA

74. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

75. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

76. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019

77. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

78. E.O. 13960, “Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government,” December 3, 2020

79. E.O. 14319, “Preventing Woke AI in the Federal Government,” July 23, 2025

80. OMB Memorandum M-25-21, “Accelerating Federal Use of AI through Innovation, Governance, and Public Trust,” April 3, 2025

81. OMB Memorandum M-25-22, “Driving Efficient Acquisition of Artificial Intelligence in Government,” April 3, 2025

82. OMB Memorandum M-26-04, “Increasing Public Trust in Artificial Intelligence (AI) Through Unbiased AI Principles,” December 11, 2025

SCOPE OF WORK

The Contractor shall provide an enterprise-level MTRS that delivers the functionality described herein to all VHA Facilities offering in-house mammography services, including the National Teleradiology Program, and provides oversight and analytics capabilities for the National Radiology Program (NRP).

The Contractor shall provide a scalable solution to support future in-house mammography programs and shall be implemented through a phased deployment approach to maximize organizational learning and optimize project management resources. The Contractor shall coordinate each phase of the project with the Primary Contracting Officer’s Representative (COR) or point of contact. Detailed discussions regarding phase activities shall occur with the Contractor during the pre-work orientation.

The Contractor shall provide an enterprise-level software license and installation services for a Mammography Tracking and Reporting System. The Contractor shall also provide training, system maintenance, and data migration services for each facility. Upon completion of installation, testing, and training, VHA shall have a national, state-of-the-art Mammography Tracking System.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The Period of Performance (PoP) shall be 12 months from the date of award, with four 12-month option periods, and four Optional Tasks that may be exercised anytime during performance. The overall Period of Performance, including the exercise of any options, shall not exceed 60 months.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO). There may be instances during deployment or system upgrades where work may need to occur on Weekends, Holidays, Evening, or Nights (WHEN hours). In those instances, the work schedule needs to occur with express permission from the COR or local Point of Contact (POC) in writing.

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed in VA facilities located in 88 in-house Mammography Programs across 56 VAMC/Healthcare Systems in addition to the National Teleradiology Program (NTP) and National Radiology Program Office. Work may be performed at remote locations with prior concurrence from the Contracting Officer’s Representative (COR). Please refer to Addendum C for a complete list of the facilities as of December 25, 2025.

VA reserves the right to update Addendum C to add locations as required to define future requirements.

TRAVEL

The Government anticipates travel under this effort for task execution, go-live support, and training throughout the PoP. The Contractor shall include the travel price as a firm-fixed-price line items (e.g., site preparation support, implementation support, system training). Travel costs will not be separately reimbursed by the Government.

The total estimated number of trips in support of site prep support, implementation support, training and other related efforts for this effort is 58 trips estimated at 5-days each. The Government may require additional ad hoc trips for system upgrades or ad hoc training.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall deliver a fully functional MTRS in accordance with Sections 5.1 through 5.13 of the PWS. The Contractor shall deliver a solution that provides a single service account manager for VHA. The solution shall incorporate comprehensive project management services, including but not limited to:

a. Software, network, and implementation planning

b. Timeline

c. National-level installation with regional and site-level permissions.

d. Contracting logistics for system support and sustainment planning

Deliverable:

Fully functioning MTRS

The contractor shall perform the following:

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that defines the Contractor’s approach, timeline, and tools for a fully functioning Mammography Tracking and Reporting System(MTRS). The CPMP shall include both narrative and graphic formats displaying the schedule, milestones, risks, and resource allocations, as well as planned, routine, and ad hoc procedures for data collection and reporting as specified in the PWS. The initial baseline CPMP shall be reviewed and approved by VA and updated in accordance with Section B of the contract. The Contractor shall maintain and update the VA PM-approved CPMP throughout the PoP. The Contractor shall provide a dedicated Project Management and Installation Support team for the planning, implementation, sustainment, and contracting phases of the project. The Contractor shall provide a software obsolesce plan, including advance notification of any end of life or end of support events. Notifications shall be provided at a minimum of six-months prior to the end of support date or as soon as the Contractor becomes aware, whichever is earlier.

Deliverable:

Contractor Project Management Plan

REPORTING REQUIREMENTS

The Contractor shall provide the COR with Monthly Progress Reports during the implementation phase in electronic form (Microsoft Word and Project formats). The Monthly Progress Reports shall include detailed instructions and explanations for each required data element, to ensure that data is accurate and consistent. The report shall reflect data as of the last day of the preceding month. The Contractor shall include system support updates in the monthly progress report. At a minimum, the report shall identify all system support activities performed, issues resolved, enhancements implemented, outstanding support tickets, and any risks or dependencies affecting system performance or availability.

The Monthly Progress Reports shall include work completed during the reporting period, work planned for the next period, and identify any issues encountered, along with the resolution actions taken. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall include an itemized list of all Information and Communication Technology (ICT) deliverables and the current Section 508 conformance status. The Contractor shall monitor performance in accordance with the CPMP and report any deviations. The Contractor shall maintain regular communication with VA to ensure transparency regarding any issues that arise and to prevent escalation of unresolved matters.

Deliverable: Monthly Progress Report

CLINICAL FUNCTIONALITY

The Contractor’s fully functional MTRS solution shall support comprehensive clinical operations, including breast examination management, system and interface integration, patient data collection, user communication, radiologist workflow, patient tracking, summary letter generation, compliance and analytics reporting, and records management. The MTRS shall include the following capabilities:

BASELINE CLINICAL FUNCTIONALITY

The Contractor shall provide a capability statement for the MTRS solution that supports reporting for the following breast examinations:

1. Magnetic Resonance Imaging (MRI)

2. Ultrasound

3. Mammography

4. Contrast Enhanced Mammography (CEM)

5. Various image guided breast biopsies & tumor localizations

6. Molecular Breast Imaging (MBI)

Deliverables:

Breast Examination Capability Statement

MAMMOGRAPHY TRACKING AND REPORTING SYSTEM ADMINISTRATION

The Contractor shall provide an MTRS solution with the following system functionality:

A. The Contractor shall provide a solution that enables reports customization at the system administrator level.

B. The system shall allow role-based access control for reports and analytics, ensuring that access can be restricted to specific user groups through routine system administration.

SYSTEM INTERFACES AND SYSTEM INTEGRATION

The Contractor shall deliver a MTRS solution with the following functionality:

A. Auto-updates patient demographics upon registration.

B. Solution that receives demographic data from VistA and FEHR via Health Level 7 (HL7).

C. Receive multiple Patient identifiers including Electronic Data Interchange Personal Identifier (EDIPI) and social security number (SSN).

D. Ability to transfer patients between facilities and EHR systems.

E. Bi-directionally integrates with both VistA/CPRS and FEHR for admit discharge transfer (ADT) and transmission of reports and lay letters.

F. Diagnostic breast imaging reporting and data system (BI-RADS) Codes both discreetly AND within the textual HL7 report message.

G. Integrate with third (3rd) party artificial intelligence (AI) software systems to enhance diagnostic workflow support.

The Contractor shall deliver a system interface and integration workflow validation checklist that demonstrates the functionality in Sections A through G.

Deliverables:

System Interface and Integration Workflow Validation Checklist

Patient Data Collection

The Contractor proposed solution shall:

A. Deliver a solution that includes patient/family history questionnaire.

B. Provides multiple ways to gather patient history.

C. Summary of proposed tablet‑based solutions capable of importing intake information directly into the system.

D. Complete a separate VA form 6550 for a tablet solution to properly assess capability to meet VA’s networking and security requirements.

E. Includes Breast Cancer Risk Assessment.

1. Breast cancer risk modules, including the Tyrer Cuzick risk management module.

2. Turns on and off the different risk management modules.

The Contractor shall deliver a screenshot(s) confirmation that clearly documents all physical findings, including the date, time, and system or asset inspected. The documentation must be sufficiently detailed to verify the results and support Government review.

Deliverables:

A. Physical Findings Screenshot.

B. Completed VA Form 6550

USER COMMUNICATION

The Contractor’s MTRS solution shall provide a functional user communication process that enables Radiologists and Technologists to enter or delete comments within the system and annotate the patient history form with clinical findings such as scars, moles, or other relevant observations.

Deliverables:

Functional User Communication Process

RADIOLOGIST WORKFLOW

The Contractor’s fully functional MTRS radiologist workflow solution shall:

A. Provide vendor-driven radiologist workflows incorporating application programming interface (API) functionality with PACS and voice dictation systems.

B. Integrate with the VA’s voice recognition system(s) at the time of implementation (currently PowerScribe 360 or PowerScribe One 2019).

C. Integrate with multiple instances (20+) of VA’s current voice recognition system(s) simultaneously (currently PowerScribe 360 or PowerScribe One 2019).

D. Deliver reporting template capabilities, mammography screening, and diagnostic reports.

Deliverables:

Functional MTRS Radiologist Workflow

PATIENT TRACKING

The Contractor’s fully functional MTRS solution shall:

A. Allow for identification of women due for a screening mammogram.

B. Allow for identification of patients waiting for pathology results.

C. Support comprehensive patient tracking from mammogram screening through tissue diagnosis. The solution shall also include the ability to demonstrate this functionality through screenshots displaying sample worklists and patient tracking workflows. The Contractor shall deliver patient tracking screenshots.

Deliverables:

Patient Tracking Screenshots

PATIENT LAY SUMMARY LETTERS

The Contractor’s fully functional MTRS solution shall:

A. Deliver a solution that includes a workflow for sending results letters to the patients with different triggers to initiate the letter.

B. Allow for some nationally standardized portions of the Results letters that cannot be changed locally, while still allowing some aspects of the results letter to be customized by the facility.

C. Provide the ability to create a customizable patient lay summary letter for both sexes to incorporate Mammography Quality Standards Act (MQSA) guidelines.

D. Allow approved VA personnel to edit the patient lay summary letters with no or minimal support from the Contractor.

E. Include a workflow that seamlessly archives the patient lay summary letters into VISTA/CPRS & FEHR in association with the final report or images.

Deliverables:

Functional MTRS Patient Lay Letters Workflow

COMPLIANCE, DATA ANALYTICS, AND REPORTING

The Contractor’s fully functional MTRS solution shall:

A. Comply with the FDA regulations, American College of Radiology (ACR) accreditation, and VHA data reporting requirements:

1. FDA Mammography Audit

2. Includes all reports included in the audit and monitoring section of the ACR BI-RADS v2025 manual.

B. The vendor shall have the ability to continuously meet and maintain any updated ACR BIRADS manual during the life of this contract.

C. The capability analyze data and develop customized reports for Veteran-specific data.

D. Ability to document the Radiologist’s continuing experience through both primary and secondary reads.

E. Ability to analyze data, document the number of mammograms a Radiologist has reviewed to maintain their credentials.

F. Analyze data and provide reports with clearly identified titles and scope of data (e.g., entire facility, single radiologist, entire VISN, entire VA).

G. Ability to restrict access based on assigned roles, ensuring facility‑level users see only their facility’s data, while designated personnel may access VISN‑ or VHA‑level reports.

H. Allow VA to be compliant with the FDA’s Enhancing Quality Using the Inspection Program (EQUIP) components.

The Contractor shall provide compliance, data analytics, and reporting screenshots illustrating the system’s functionalities.

Deliverables:

Compliance, Data Analytics, and Reporting Screenshots

RECORDS MANAGEMENT

The Contractor’s fully functional MTRS solution shall enable access to patient records for forms printing and information upload when the system is unavailable at the time of the exam.

TECHNICAL FUNCTIONALITY

The Contractor’s fully functional MTS solution shall be delivered at an enterprise level. The solution shall be managed according to assigned roles at the facility, VISN, and/or VHA level.

1. The solution must be non-developmental (i.e., commercially available, in current production as of the date this offer is submitted). The Contractor shall:

a. Specify the proposed server and client software versions, as well as any web-based client software capabilities.

b. List the actual major and minor releases, including dates, for the past two years for the proposed Mammography Tracking and Reporting System.

c. List any third (3rd) party software components included in the proposed MTRS and whether the cost is included in the proposed licensing models.

i. Describe the business and technical agreements that are in place to ensure ongoing support and development.

ii. List all database(s) that are used for the proposed Mammography Tracking and Reporting System.

d. Provide optional turnkey pricing for any database licensing requirements for the servers (i.e. SQL, Oracle, etc.)

2. The Contractor shall provide a comprehensive disaster recovery plan to ensure data integrity and restoration including internal MTRS backup capabilities, and the ability of the software to support enterprise backup solutions such as Commvault. The plan shall include:

a. A process for performing automated system backups.

b. A process for restoring system backups.

c. A summary of 3rd party enterprise solutions/agents that the MTRS system supports (For example, Commvault)

3. The proposed MTRS Solution shall include a test system that replicates the production environment. The Contractor shall provide system architecture for production and test environments.

a. The test system shall validate software upgrades, new modalities, interfaces, and integrated applications.

b. The physical location for the test system will be at the discretion of VA.

4. The Contractor shall provide recommended hardware specifications and network requirements for the following:

a. Main production system

b. Workstation, including specifications regarding graphic cards and monitors

c. Test server

5. The Contractor shall provide a completed copy of the Manufacturer Disclosure Statement for Medical Device Security (MDS2).

6. The Contractor shall provide a completed copy of the VA Form 6550.

7. The Contractor’s solution shall provide patient context exchange and synchronization between PACS/Dictation applications and mammography tracking software solution.

8. The Contractor’s solution shall be able to work across all time zones where VHA may deploy the solution.

Deliverables:

A. Disaster Recovery Plan B. Hardware Specifications and Network Requirements C. Manufacturer Disclosure Statement D. Completed VA Form 6550 E. Production and Testing System Architecture

ENTERPRISE LICENSES

The Contractor shall provide an enterprise-level software license that permits unlimited concurrent user access. A list of applicable sites can be found herein at Addendum C.

Deliverable Enterprise Software Licenses

IMAGING ORDERS AND REPORTS

The Contractor’s fully functional MTRS solution shall be capable of entering imaging orders into the VistA Radiology Package or Oracle Health Millenium OpenLink. Each location may have up to two (2) separate VistA HL7 feeds instances, and one (1) national instance for OH OpenLink HL7 feed within VHA. The MTS solution must support an unlimited number of HL7 interfaces for ingestion.

DATA MIGRATION

The Contractor’s fully functional MTRS solution shall include data migration and reports formatting of studies from the current Mammography information systems for all prior studies in advance of each respective VAMC go-live. The data migration must include, at a minimum, the last five (5) years of data.

VHA currently uses the following systems:

Prior to contract completion or termination, the Contractor shall deliver all MTS data in a user-accessible format, assume full responsibility for project management and associated costs. Furthermore, the Contractor shall provide the Department of Veterans Affairs with all administrative system and database credentials required for system management and sustainment.

The Contractor shall conduct data migration services and provide a report for all VHA sites/legacy MTRS systems as listed in Appendix C.

The Contractor shall provide a comprehensive list of all administrative MTRS system and database credentials available at the time of go‑live.

Deliverables:

A. Data Migration Report B. MTRS data in a user-accessible format C. Administrative MTRS System and Database Credentials

SYSTEM PERFORMANCE

The Contractor’s fully functional MTRS solution shall include a minimum uptime guarantee of 99%.

1. System events caused by the VA network side, where the vendor is not at fault, will not be counted towards the count of system downtime hours.

2. Uptime is calculated based off the following:

a. Hours of coverage in the above equation excludes hours for preventative and scheduled maintenance of the system.

b. The MTRS system is classified as “down” when the system is unavailable for clinical use due to an unplanned event.

3. Planned Maintenance shall be planned outside of normal business hours, unless specified otherwise by the VA in writing.

4. The Contractor shall review the VA provided quarterly uptime log and performance report, verify compliance with a minimum system availability threshold of 99%, and provide a quarterly review certification.

The Contractor’s solution shall communicate the capability to remain active during database maintenance jobs or other server activities.

Deliverables:

Quarterly Review Certification

USER AND GROUP FUNCTIONALITY

The Contractor’s fully functional MTRS solution shall:

A. Support application authentication using Single Sign-On (SSO) or Lightweight Directory Access Protocol (LDAP) via personal identity verification (PIV) cards.

B. Provide the capability to develop user groups with distinct privileges/permissions. The permissions for the default user groups shall be capable of being modified by a designated VA system administrator.

C. Allow staff to see patients nationwide and input information at their local facility without creating a duplicate patient. Staff shall not be capable of printing letters for other stations.

D. Allow customizable administrative and clinical access.

The Contractor shall ensure all user and group functionality is fully validated and confirmed operational prior to each VAMC go‑live. The Contractor shall deliver a user and group functionality validation report documented test results demonstrating correct role assignments, access permissions, authentication behavior, and successful execution of all required user and group functions without error. Validation shall be complete upon Government acceptance and concurrence.

Deliverables:

User and Group Functionality Validation Report

HEALTH LEVEL SEVEN (HL7) INTEGRATION

The Contractor’s fully functional MTRS solution shall support bi-directional HL7 integration with VistA and FEHR. The Contractor shall ensure the solution complies with and successfully completes the VA qualification process for both VistA and FEHR HL7 interfaces to guarantee interoperability and adherence to VA standards.

The contractor shall deliver a report confirming validation for the bidirectional HL7 integration with both VistA and FEHR. The report shall be updated upon go-live at each site.

Deliverables:

Bi-Directional HL7 Integration Validation Report

DIGITAL IMAGING AND COMMUNICATIONS IN MEDICINE (DICOM) INTEGRATION

The Contractor’s fully functional MTRS solution shall be fully compliant with the Digital Imaging and Communications in Medicine (DICOM) standard for features and workflows involving the storage, retrieval, and transmission of medical images and associated data in accordance with DICOM protocols to ensure interoperability with VA imaging systems, Picture Archiving and Communication Systems (PACS), and other healthcare applications.

The Contractor shall deliver a DICOM Conformance Statement detailing all supported DICOM services, modalities, message types, and implementation specifications no later than 30 days prior to go‑live.

Deliverables:

DICOM Conformance Statement(s)

TRAINING

The Contractor’s fully functional MTRS solution shall include clinical, system administrator, and Healthcare Technology Management (HTM) training as specified below.

The Contractor shall provide training plan, attendance records, and quick reference guides for all personnel who participate in required training activities. All training documentation shall be delivered to the Government in a format acceptable within 5 business days after training completion.

Deliverables:

Training Plan Training Attendance Records Training Quick Reference Guides

CLINICAL-USER TRAINING

A. Clinical users training shall include, but not limited to:

1. Radiologic Technologist

2. Radiologist

3. Breast imaging nurse navigators/coordinators

4. System-wide clinical administrators

5. Program support assistant/medical support assistant (MSA)

B. Upon completion of training, clinical users must be able to successfully utilize all available features with minimal or no assistance from a VA or Contractor super user.

SYSTEM ADMINISTRATOR TRAINING

The Contractor shall provide power-user and system administrator training for operational support of the MTRS solution.

Upon completion of training, the System administrator must be able to:

1. Act as the local super user for the clinical users

2. Act as the local trainer for the clinical users

3. Resolve the top ten most common user questions

4. Create and manage user accounts

5. Install and configure the client application for a new user

6. Monitor system utilization

7. Manage other day-to-day tasks required for the system

HEALTHCARE TECHNOLOGY MANAGEMENT

The Contractor shall provide biomedical engineer training for implementation and operational support for MTRS solution.

Upon completion of training the biomedical engineers shall:

1. Act as the local system expert

2. Understand the functions of each system’s components

3. Be able to start the system, including the different services that make up the MTRS solution

4. Locate and review application logs

5. Install and configure the client application for a new user

6. Be able to conduct, at minimum, basic troubleshooting

7. Understand the procedure for a “graceful” system shutdown/reboot

8. Understand disaster recovery recommendations and features

9. Understand contingency operations actions and steps for VAMCs if the system were to go down or be in a compromised state.

SERVICE MANUALS

The contractor shall provide clinical user and technical administrator service manuals for the MTRS in an electronic format.

Deliverables:

Service Manuals

CUSTOMER SUPPORT

The contractor shall provide MTRS clinical and technical support as follows:

A. Software obsolescence, major upgrades, revisions, patches and fixes for the contract period. The Contractor shall deliver an Obsolesce Plan, which shall be included in the CPMP as specified in Section 5.1.1 of this PWS.

B. The contractor shall provide support based on the severity level of the event as outlined in the table below. Business hours are defined as 7 am ET to 6 pm Hawaii standard time due to the national enterprise system having to account for business hours across time zones with VA mammography programs.

Communication and updates need to occur on a regular basis until the case is resolved.

C. The Contractor shall provide remote technical and clinical applications support.

D. The contractor shall support ongoing workflow and integration changes as VA incrementally adds additional sites as requested.

E. Contractors with an existing approved Memorandum of Understanding Information Security Agreement (MOU/ISA) shall provide remote system support and comply with all requirements written in the MOU/ISA.

F. The contractor shall provide technical expertise regarding system patching and updates including but not limited to operating system (OS) patches, application updates, database updates, and system vulnerabilities.

The Contractor must submit a Customer Support Status Report. This report shall be included in the monthly report as specified in Section 5.1.2 of this PWS

Deliverables:

A. Customer Support Status Report B. Software Obsolesce Plan

ELECTRONIC HEALTHCARE RECORD MODERNIZATION (EHRM) FEHR TRANSITION SUPPORT SERVICES

LEGACY DATABASE BULK EDIT FOR ELECTRONIC DATA INTERCHANGE PERSONAL IDENTIFIER & SOCIAL SECURITY NUMBER CONVERSION

The Contractor shall provide support services for a one-time patient identifier conversion and merge process within the legacy Mammography Tracking System (MTS) database. This effort shall include move/downgrade primary Medical Record Number (MRN) (Patient Identifier) that is currently Social Security Number (SSN) to a secondary Patient Identifier if possible and insert corresponding Electronic Data Interchange Personal Identifier (EDIPI) (New Patient Identifier) into the primary MRN field or status.

The Contractor shall compile and deliver a master list of legacy patient records, including SSNs and available attributes (e.g., Last Name, First Name, Date of Birth, Sex), in Excel or text format on the MTS production server for SSN to EDIPI reconciliation. Upon receipt of the reconciled list from VA, the Contractor shall update the database primary identifier to EDIPI and set the SSN to secondary status in the legacy database if possible. The Contractor shall provide a delta list of patient names and SSNs added between the initial extract and go-live for subsequent identifier conversion. VHA will provide a reconciled list, and the Contractor shall perform the delta patient identifier change.

The Contractor shall collaborate with VA Healthcare Technology Management (HTM) staff to test EDIPI functionality as the primary identifier, identify and resolve any issues. Additionally, the Contractor shall collaborate work with VA to develop and adhere to a conversion schedule within the period of performance.

Deliverables:

A. Master Legacy Patient List B. Delta Patient List

VHA ELECTRONIC HEALTH RECORD (EHR) INTEGRATION

The Contractor shall provide an MTRS solution with separate and distinct production and test environments. The solution shall include an interface engine capable of managing HL7 messages to both VistA/CPRS and the Federal Electronic Health Record (FEHR) [Oracle Health EHR] simultaneously.

The Contractor shall implement HL7 Orders (ORM) and HL7 Results (ORU) interfaces between VA MTS and both VA’s EMRs (VistA CPRS and Federal Electronic Health Record [Oracle Health EHR]). Based on the project schedule, the Contractor shall integrate MTS at facilities with either VistA CPRS or Federal Electronic Health Record (FEHR). This is dependent on the facility’s EHR at the time of go live.

The MTS solution shall support multiple concurrent ORU/ORM HL7 connection pathways, including one production FEHR instance and multiple legacy VistA CPRS/VistA Imaging instances. For VA Medical Centers still using VistA CPRS, each VistA CPRS instance is unique to the facility and has its own IP address.

The Contractor shall perform all required testing and go-live activities for FEHR integration, including:

1. VA Enterprise Risk Assessment (ERA) specific to the FEHR interface documentation

2. Connectivity and smoke testing

3. Installation and configuration of HL7 interfaces on both test and production systems

4. Participation in Interface Solution Testing (IST) sessions with VA and Oracle

5. Attendance at planning activities such as dry runs and table-top exercises

6. Execution of FEHR interface cutover to production outside normal business hours

7. End-user training for workflows specific to FEHR integration.

Contractor shall develop a VA Vendor Integration Document (VID) in coordination with VA and Oracle Health. The VID will document any deviations from “Standardized Radiology Imaging Integration Interface Control Document” for the MTRS system.

The Contractor shall develop and deliver a FEHR integration and validation checklist.

Deliverables:

FEHR Integration and Validation Checklist

GENERAL REQUIREMENTS

ENTERPRISE AND IT FRAMEWORK

VA TECHNICAL REFERENCE MODEL

The Contractor shall comply with the VA OIT Technical Reference Model (VA TRM). Compliance with the VA TRM is achieved by using only technologies and standards that are listed as approved for use in the VA TRM. The Contractor shall provide all necessary information requested by VA to ensure TRM approval is obtained prior to use on VA’s network.

ZERO TRUST – VA CRITICAL SECURITY CONTROLS

VA has established minimum mandatory security requirements and requires that any network connected software system or service must meet the VA Critical Security Controls as outlined in the VA Memorandum, “VA Security Controls”, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010. VA Critical Security Controls identify the minimum mandatory requirements that must be implemented across all VA enterprise infrastructure, cloud computing environments, information systems, networks, and specialized devices (medical devices/systems, special-purpose systems, and research scientific computing devices) that process, store, and/or transmit VA data. Effective July 1, 2025, the Contractor shall implement these VA Critical Security Controls, within any network connected software system or service prior to being authorized for use in the VA. This functional requirement is not negotiable, and Plan of Action & Milestones (POAM) will not be accepted in the event these controls cannot be implemented for new systems. Critical Security Controls are intended to increase VA’s security posture and provide security and privacy risk visibility into the VA network and is not a new requirement. The Contractor’s failure to maintain these VA Critical Controls after implementation will result in VA discontinuing the use of the system.

FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Architecture (EA), and VA Identity and Access Management (IAM) approved Enterprise Technology Guidelines (ETG). The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in Executive Order 14028, VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program, CISA Binding Operational Directive 23-01, and align with the Federal Identity,…