P03 WebEOC Justification 17 September 2020 Final Redacted.pdf

FORCE NUMBER: VA-20-00034153

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 1701 Director’s Blvd.

Austin, TX 78744

2. Description of Action: The proposed action is for a Firm-Fixed-Price delivery order to be issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Governmentwide Acquisition Contract (GWAC) for brand name Juvare WebEOC Software As A Service (SaaS) and support services.

3. Description of the Supplies or Services: Veteran Health Administration (VHA), Office Emergency Management (OEM) has a requirement for the procurement of an Emergency Incident Management SaaS in order to efficiently respond to, manage, and coordinate response with FEMA to multiple natural disaster operations such as hurricanes during a national COVID-19 pandemic. The OEM is the emergency management organization within VHA. As such, the OEM is responsible for the agency’s overall preparedness for and response to incidents (disasters). In addition, the OEM also has the responsibility to coordinate and direct resources to support the VA “fourth mission” with the Federal Emergency Management Agency (FEMA) through the Department of Health and Human Services. During the COVID-19 pandemic, VHA OEM has seen a dramatic increase of “fourth mission” requests and assignments with states across the nation that require coordination with FEMA and VHA certified and deployable staff and other medical resources to assist with incident responses. To manage and coordinate all these disparate disaster operations the OEM currently uses email, spreadsheets, and phone calls which are an inefficient means of tracking and do not provide ability for automatic coordinated response efforts with FEMA.

The OEM activated the Emergency Management Coordination Cell (the operations center for the organization) in January 2020, which has been in continuous operation to respond to the COVID-19 pandemic and other incidents. As the COVID-19 pandemic continues for an unknown period of time, and other incidents/disasters continue to occur, the need for a comprehensive emergency management incident management system that can both track personnel, certifications, and availability and coordinate response efforts with FEMA has become even more pronounced.

The acquisition of this SaaS will enable VA with that tracking capability and offer automatic coordinated response with FEMA to incidents. Included with this SaaS is help desk support which will be available via email, telephone, and on-site as necessary. Additionally, VA requires additional support services each time OEM activates response to incidents. This additional support will provide a technician on-site to support for a period of up to 2 weeks to assist in any issues with using the SaaS. The period of performance for the initial procurement of the brand name Juvare WebEOC SaaS will be for 12 months from date of award. Additionally, this

Juvare WebEOC, Justification for an Exception to Fair Opportunity acquisition will provide for two 1-year option periods to provide continued support to OEM incident response operations. The total dollar value of this action is $ , inclusive of all option periods.

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) Subpart

16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C.

4106(c)(2) as implemented by FAR Subpart 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized”.

5. Rationale Supporting Use of Authority Cited Above: Based on extensive market research detailed in paragraph 8, the VHA OEM requires the brand name Juvare WebEOC SaaS, as only brand name Juvare WebEOC can meet the VHA OEM’s requirements. The COVID-19 pandemic along with other natural disasters have highlighted the need for the OEM to acquire a SaaS that can manage day to day operations for reporting, and information tracking while at the same time supporting pandemic during response operations. The SaaS will allow VA staff the ability to automatically coordinate a response with FEMA while additional incidents occur. The system must be able to quickly manage all incidents without requiring administrative access that provides advanced data importing, exporting, and the ability to automatically populate status boards. Additionally, VA requires the SaaS to catalog requests and track resources in a manner that is compliant with FEMA’s National Incident Management System, WebEOC. FEMA utilizes WebEOC in the National Response Coordination Center (NRCC) and 10 Regional Response Coordination Centers (RRCCs). Due to VA’s “fourth mission,” OEM must be able to communicate with FEMA to exchange information and execute coordinated mission assignments.

Due to the data structure with incident management tools and the ability to restrict access from outside platforms, it is critical to use software that is permitted to directly interface with FEMA’s WebEOC. Specifically, in 2018, guidance was released from FEMA, that due to cybersecurity vulnerabilities, no other third-party Application Programming Interface (API) and incident management tools would be allowed to directly interface with their WebEOC. Only through use of brand name Juvare WebEOC can VA and FEMA access data in the others file libraries that would allow for automatic coordination of mission assignments and response to incidents. This function is critical as it will allow VA to streamline its deployment process and create quicker, more efficient response to incidents. Although other vendors incident management tools may have the ability to interface with a generic version of WebEOC, FEMA, as part of its ATO, has restricted any other third-party API and incident management tool from directly interfacing with their WebEOC. The use of any other brand’s incident management tool would restrict VA from accessing FEMA’s file library data directly, and consequently, VA would be prohibited from automatically coordinating mission assignments and deploying response teams. In the face of disasters where each minute matters, the use of any other incident management tool would require a duplication of effort to manually track and maintain information and resources in separate tools that would require the use of outside communication with

FEMA through emails and phone calls. This process would mirror VA’s current process and would not allow VA to improve its ability to coordinate response with FEMA as it would not allow for automatic tracking and coordination.

Additionally, OEM requires the SaaS to have an Open API interface that enables third party software integration. This capability would enable future connectivity to VHA emergency management systems such as Performance Improvement Management System (PIMS). The SaaS must be able to provide incident reports, automated reporting, automated incident data and trend analysis, mapping and situational awareness, resource management and tracking, dashboard visualization, ability to upload the last 5-years of OEM’s historical incident related data, and to provide common easily understood workflow process that enables and improves the decision cycle in response to a disaster or multiple incidents occurring simultaneously. The SaaS must be a web based and be able to provide the same level of capability from mobile platforms. The system must have the ability to connect to other published public/private emergency management web-services, allowing for seamless information sharing across response organizations and the ability to import information (field reports, photos, etc.) in a variety of formats and populate status/dashboards.

Due to working with multiple organizations, the OEM requires the ability to take geocoded data entered into SaaS solution’s status boards and make it available to users outside of the OEM. The SaaS must provide a dynamic geographically based Common Operating Picture (COP) that utilizes automated feeds from various sources to include third parties in order to maintain constant situational awareness. The COP should not require specialized GIS or mapping expertise to manage. Additionally, the SaaS is required to provide incident reporting capabilities such as the ability to upload photos, maps, narrative reports, auto population capabilities, storyboards, and tracking systems. In addition, solution must have the capability to create and populate new reports and forms very easily and quickly. All data, reports and documents need to be automatically retained in an incident folder as the historical record for that incident. The SaaS must also be able to have real-time integration with Microsoft Teams – a key requirement as Teams was recently implemented as the primary communication and collaboration technology across the VA enterprise. Additionally, VA requires the SaaS to provide Single Sign On (SSO) for Active Directory capability that allows for quick and secure access in a similar manner as other VA applications.

Lastly, the OEM requires the SaaS to offer training on an enterprise wide level to support Area Emergency Managers and other staff supporting VA Medical Centers and the VHA nationally. This training will assist users to effectively utilize the SaaS so they can perform during incidents.

The VHA Office of Emergency Management requires the capabilities outlined above in order to properly maintain situational awareness, send and track data, and coordinate response efforts with FEMA. Only brand name Juvare WebEOC SaaS can meet all requirements and bolster VA’s capability to better prepare for and provide coordinated response to multiple incidents occurring at the same time. Brand name Juvare WebEOC can uniquely provide the ability to automatically improve collaboration and coordinate resources to make key leader decisions much faster.

This improved capability will ensure the continuum of healthcare, protection of VA facilities and most importantly the saving of lives during incidents. Additionally, the support services required by OEM can only be provided by Juvare or a reseller as the support requires access to the proprietary source code to provide adequate response and assistance. Only the brand name Juvare WebEOC SaaS can meet these requirements. Without this capability, VHA and OEM will not have the ability to adequately prepare for, respond to, and automatically coordinate disaster operations with FEMA affecting both the VHA and the nation during the COVID-19 pandemic which could lead to the inability to provide services and care to the Veteran and non-Veteran populations.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in Section 8 of this justification. This effort did not yield any additional sources that can meet the Government's requirements. However, is was determined that limited competition is available among resellers for brand name Juvare WebEOC. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the Federal Business Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed.

8. Market Research: VHA Office of Emergency Management staff conducted market research in March and June 2020 by submitting Request for Information (RFIs) to ascertain if other brands could meet VA’s functionality requirements. The results of the two RFIs are listed below.

None of the below respondents could meet the requirement for interoperability with FEMA’s WebEOC as detailed in Section 5 which is required to allow for automatic coordinated mission assignments and response to incidents. As of 2018, FEMA has restricted third-party APIs (alternative incident management tools) from directly interfacing with their WebEOC due to cybersecurity vulnerabilities.

Additionally, respondents were reviewed and found unable to meet additional functional requirements which are listed below. Some vendors are listed multiple times in the below as they did not meet several of the below additional functional requirements.

* Denotes vendor did not meet multiple additional requirements.

The following companies were found unable to meet the Government’s requirements because they offered the which is a mass notification system and not an incident management system. Mass Notification systems focus on notifying personnel and tracking messages. During an incident the mass notification

2018, FEMA has restricted third-party APIs (alternative incident management tools) from directly interfacing with their WebEOC due to cybersecurity.

The VHA OEM reviewed the additional information provided by The OEM found VHA OEM found still unable to meet the Government’s requirements. In their response stated an ability to connect to WebEOC, however they did not address the ability to connect and work with FEMA’s WebEOC. As of 2018, FEMA has restricted third-party APIs (alternative incident management tools) from directly interfacing with their WebEOC due to cybersecurity vulnerabilities. Additionally, made additional statements regarding the ability to provide help desk support but did not provide additional clarity in regard to their ability and how they would meet this requirement.

Based on the above research, Juvare WebEOC SaaS is the only SaaS that meets the Government’s requirements. The Contract Specialist (CS) conducted market research in August and September 2020 by using NASA SEWP V GWAC Provider Look-up and Market Research tools to determine what vendors are capable of meeting the requirement. Based on this market research, the CS found multiple resellers capable of meeting the full requirement.

9. Other Facts: N/A

10. Technical and Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

Date: _____________________

Contracting Officers Representative Signature:

11. Fair and Reasonable Cost Determination: I hereby determine that the anticipated price to the Government for this action will be fair and reasonable because NASA SEWP V GWAC prices have previously been determined fair and reasonable.

Additionally, the successful quote will be compared to the published price lists on the NASA SEWP V GWAC price catalog of the successful offeror. Finally, the successful quote will be compared with the Independent Government Cost Estimate.

Date: _______________________