POCUS RFI.docx

Enterprise Point-of-Care Ultrasound (POCUS) Middleware and Image Management System

VA-27-00007275

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Veterans’ Health Administration (VHA) National Radiology Program Office

Enterprise Point-of-Care Ultrasound (POCUS) Middleware and Image Management System

Date: October 13, 2026

VA-27-00007275

PWS Version Number: 1.5

Contents

BACKGROUND

The Department of Veterans Affairs (VA), Veterans Health Administration (VHA), through the Office of Healthcare Technology Management (19HTM) and in coordination with the Electronic Health Record Modernization - Integration Office (EHRM-IO), strives to provide high-quality, effective, and efficient point-of-care diagnostic imaging capabilities to those responsible for the care of Veterans across the continuum of VA health care.

Point-of-Care Ultrasound (POCUS) is diagnostic ultrasound performed and interpreted by a treating clinician at the bedside to inform immediate clinical decision-making. POCUS is used across a broad range of clinical services including Hospital Medicine, Emergency Medicine, Critical Care, Anesthesiology, Cardiology, Nephrology, Endocrinology, Rheumatology, Surgery, Primary Care, and Women's Health, and is used both for diagnostic assessment and for real-time procedural guidance (e.g., vascular access, thoracentesis, paracentesis, arthrocentesis, nerve blocks). POCUS is designated by VHA as one of the Top 30 clinical technologies for enterprise standardization.

POCUS studies are not archived in the Veterans Health Information Systems and Technology Architecture (VistA), and there is no native integration between commercial POCUS middleware and either VistA or Oracle Health Millennium. As a result:

· Clinicians manually type interpretation notes and paste image links into VistA, a redundant and time-consuming workflow that is prone to error and is the only workaround currently available.

· POCUS image archiving is fragmented across a small number of local Picture Archiving and Communication System (PACS) instances (e.g., Synchronicity) deployed at individual VA Medical Centers; not all departments or facilities have access to a POCUS PACS.

· The absence of an image archive interface has driven clinicians to order duplicate ultrasound examinations through Radiology or Cardiology solely to document findings performed at the bedside, driving unnecessary utilization, delaying care, and increasing cost.

· Certain in-clinic ultrasound systems (e.g., in Endocrinology and Rheumatology) do not transmit images to the Federal Electronic Health Record (FEHR), as documented in VA Functional Escalation FE83 (May 2025).

VHA requires a comprehensive, enterprise-wide POCUS middleware and image management solution, referred to as POCUS System throughout the rest of this PWS. The POCUS System shall:

a. capture and archive POCUS still images and cine loops from cart-based and handheld ultrasound devices,

b. associate each study with the correct patient and encounter or order,

c. support interpretation, documentation, Quality Assurance (QA), and credentialing workflows required by national POCUS clinical standards, and

d. integrate bidirectionally with both VistA/Computerized Patient Record System (CPRS) and Oracle Health Millennium so that POCUS results and images are accessible to any treating provider at any VA facility.

The POCUS System shall support both order-based and encounter-based clinical workflows within the same deployment. Business stakeholders have identified support for both workflow patterns as a non-negotiable requirement.

VHA requires substantial interfacing between the POCUS System and both VistA (including VistA Imaging) and Oracle Health Millennium across VHA facilities and Veterans Integrated Service Networks (VISN), a variety of Radiology Information Systems, PACS, and ultrasound device fleets alongside the Electronic Health Record (EHR). The POCUS System shall integrate seamlessly with these diverse systems to ensure cohesive and efficient management of POCUS clinical data across the VHA network. This POCUS system shall be deployed to a total of 172 VA facilities across the country.

This effort implements the requirements defined under New Service Request 20220737 / REQ 53014 (POCUS Middleware Integration – VistA and Oracle Health) and OIT demand DMND0011532 and shall align with the VA Standard – POCUS Interface Control Document (ICD) maintained on the VA-Oracle Health project portal.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

3. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

4. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022

6. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and Information Technology Act of 2006, as amended, Title IX, Information Security Matters

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

10. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

11. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

12. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

13. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended

14. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

15. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”, as amended

16. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

17. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

24. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

25. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

26. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

27. OIT Process Asset Library (PAL), OIT Process Asset Library.

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

30. VA Directive 6510, “VA Identity, Credential and Access Management,” September 3, 2024

31. VA Handbook 6510, “VA Identity, Credential and Access Management,” September 27, 2024

32. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

33. VA Directive 6300, “Records and Information Management,” September 21, 2018

34. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

44. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

47. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

49. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

50. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

51. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

52. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L. 110–140), December 19, 2007

53. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005

54. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

55. VA Directive 0057, “VA Environmental Management Program,” October 25, 2022

56. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

57. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

58. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

59. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

60. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

61. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

62. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

63. Social Security Number (SSN) Fraud Prevention Act of 2017

64. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

65. C.F.R Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”, as amended

66. Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

67. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

68. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

69. OMB M-22-18, “Enhancing the Security of the Software Supply Chain through Secure Software Development Practices,” September 14, 2022

70. OMB M-23-16, “Update to Memorandum M-22-18,” June 9, 2023

71. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27, 2021

72. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December 2014

73. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02: Vulnerability Remediation Requirements for Internet-Accessible Systems | CISA

74. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

75. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

76. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019

77. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

78. E.O. 13960, “Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government,” December 3, 2020

79. E.O. 14319, “Preventing Woke AI in the Federal Government,” July 23, 2025

80. OMB Memorandum M-25-21, “Accelerating Federal Use of AI through Innovation, Governance, and Public Trust,” April 3, 2025

81. OMB Memorandum M-25-22, “Driving Efficient Acquisition of Artificial Intelligence in Government,” April 3, 2025

82. OMB Memorandum M-26-04, “Increasing Public Trust in Artificial Intelligence (AI) Through Unbiased AI Principles,” December 11, 2025

83. VHA Directive 1105.04 “Fluoroscopy Safety”

84. VHA Directive 1129 “Radiation Protection for Machine Sources of Ionizing Radiation”

85. Standardized Radiology Imaging Integration Interface Control Document

86. Attachment A: List of VA Facilities

SCOPE OF WORK

The Contractor shall provide an enterprise license for a fully functioning commercial-off-the-shelf (COTS) POCUS middleware and image management solution supporting all authorized users and supported POCUS devices at approximately 172 VHA facilities, inclusive of the functionality specified in this PWS. The solution shall include:

1. a POCUS-specific Picture Archiving and Communication System (POCUS PACS) engineered for the POCUS workflow

2. middleware providing device connectivity, patient/exam association, worklist services, and bidirectional EHR integration

3. clinical documentation and reporting capabilities

4. Quality Assurance (QA), credentialing, and education-tracking capabilities

The solution shall provide oversight and analytics capabilities at the facility, VISN, and national program levels and shall be scalable to accommodate additional device types, clinical specialties, and locations.

The Contractor shall support standards‑based connectivity to POCUS devices across VHA, including but not limited to cart-based ultrasound systems and handheld/pocket ultrasound devices (e.g., Butterfly iQ family, GE Vscan Air family, Philips Lumify, Sonosite, Mindray, Konica Minolta, and equivalent successor devices). Connectivity for images and cine loops shall be provided using the Digital Imaging and Communications in Medicine (DICOM) standard, and patient, order, and encounter metadata exchange shall use Health Level 7 (HL7) and/or Fast Healthcare Interoperability Resources (FHIR)‑based Application Programing Interfaces, consistent with VHA imaging interoperability specifications. The solution shall be device-agnostic such that any POCUS device implementing these standards and conforming to VHA DICOM/HL7/FHIR interface requirements can be onboarded without custom, vendor‑specific integrations.

Implementation shall be managed through a phased deployment approach across the base period and four 12-month option periods to maximize organizational learning and efficiently utilize project management resources. The base period shall deploy the initial wave of sites and establish the enterprise framework; subsequent option periods shall deploy additional waves until all 172 facilities listed in Attachment A are live, while sustaining previously deployed sites. Each phase shall be coordinated with the assigned Contracting Officer's Representative (COR), the National POCUS Program Office, and local/regional Points of Contact (POCs).

The Contractor shall provide all services related to the furnishing, integration, installation, training, sustainment, data migration, and change management for the POCUS System across all 172 facilities listed in Attachment A within the overall Period of Performance (PoP).

PERFORMANCE DETAILS

PEFORMANCE PERIOD

The PoP shall be 12 months from date of award, with four 12-month option periods. The overall Period of Performance shall not exceed 60 months.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO). There may be instances during deployment or system upgrades where work may need to occur on Weekend, Holidays, Evening, or Nights. In those instances, the work schedule needs to occur with express permission from the Enterprise-level COR or local POC in writing.

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed primarily at the Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission. Installation, data migration, system testing, training, and sustainment services shall be performed at the VA facilities detailed in Attachment A – List of Facilities.

Additionally, work may be conducted at remote locations, provided that prior concurrence is obtained from the COR. All remote work must adhere to VA policies regarding remote connections to ensure compliance and security.

TRAVEL

The Government anticipates travel under this effort to perform the tasks associated with the effort for installation, implementation, data migration, testing, training, cutover, troubleshooting, and other activities that cannot reasonably be performed remotely. Include all estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government. Please see Attachment A – List of Facilities.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall provide a fully functional POCUS System on a national basis for a total of 172 sites throughout the PoP in accordance with this PWS.

PROJECT MANAGEMENT

The Contractor shall provide a dedicated Program Manager for this overall effort. The Contractor shall provide project management to include software, network implementation planning, data migration, training and disaster recovery.

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Additionally, the CPMP shall include a detailed Integrated Project Schedule (IPS) identifying major milestones, dependencies, critical-path activities, deployment waves, interface development/testing, data migration, training, site readiness, go-live activities, and transition to sustainment. The IPS shall consist of a comprehensive project timeline for the entire deployment, including optional tasks detailing national, regional, and site level installation and implementation.

Deliverable:

A. Contractor Project Management Plan

TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after TO award. The Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer, the VA Program Manager, the Contract Specialist (CS), COR, The Contractor shall provide a draft agenda to the CO and VA PM at least five calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute the agenda to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting. The Contractor shall also prepare the meeting minutes of the kickoff meeting. The Contractor shall distribute the updated presentation and meeting minutes to the CO, COR and all attendees within three calendar days after the meeting.

Deliverables:

A. Draft and Final Agendas B. Draft and Final PowerPoint Presentation C. Draft and Final Meeting Minutes

REPORTING REQUIREMENTS

The Contractor shall provide the Enterprise-level COR with Monthly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding month. The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Additionally, the Contractor shall conduct a Shipment/Delivery Kick-off Meeting with the VA Program Manager, COR, Delivery Date Coordinator, Implementation Manager, and Facility CIOs (or designee) to discuss delivery schedule requirements and facilitate delivery of equipment. This meeting shall be coordinated during the technical kickoff meeting.

Deliverable:

A. Monthly Progress Report

INFORMATION SECURITY, PRIVACY AND COMPLIANCE REQUIREMENTS

The Contractor shall ensure that the proposed POCUS system fully complies with all applicable federal and VA cybersecurity, privacy, and information protection requirements, including but not limited to FedRAMP, VA Authority to Operate (ATO), and VA Handbook 6500. The following activities, deliverables, and timelines apply:

1. FedRAMP Authorization for Cloud-Based Systems - If any component of the POCUS system utilizes cloud computing services (including Software-as-a-Service, Infrastructure-as-a-Service, or Platform-as-a-Service), the Contractor shall provide solutions from Cloud Service Providers that possess a current FedRAMP Authorization at Moderate or higher impact level, applicable to the system’s security categorization. Proof of FedRAMP Authorization must be furnished to the VA Contracting Officer and Enterprise Level COR at least 30 calendar days prior to Government Acceptance Testing or system deployment.

2. VA ATO - Prior to processing, storing, or transmitting any VA data, the Contractor shall:

a. Attain a VA ATO for the POCUS system in accordance with the VA Risk Management Framework and VA Handbook 6500.

b. Be responsible for preparing, updating, and submitting all required documentation, reports, test results, and artifacts as necessary to achieve and maintain ATO status for the duration of the contract.

c. Obtain Interim Approval and/or Full ATO within 90 calendar days of contract award, unless otherwise authorized in writing by the Contracting Officer.

3. Ongoing Security and Privacy Compliance - The Contractor shall provide all documentation, system access, and support required for VA security assessments, audits, and ongoing continuous monitoring as directed by the VA. The Contractor shall maintain compliance with all applicable VA privacy and security requirements at all times, including those related to PHI and PII. The Contractor shall promptly report to the Contracting Officer and COR any new or unanticipated security threats, incidents, or breaches (including suspected or confirmed loss, theft, or unauthorized disclosure of PHI or PII) within one hour of discovery, following VA policies and procedures.

Deliverables:

A. Proof of FedRAMP Authorization B. VA ATO Documentation

ENTERPRISE POCUS SYSTEM

The Contractor shall provide site licenses and implement a COTS POCUS System at an enterprise level, to be managed at the facility, VISN, and/or VHA National Program level, across all 172 VA facilities identified in Attachment A – List of Facilities. Deployment shall be phased across the base period and option periods.

The Contractor shall provide a single, comprehensive Enterprise Network Topology and Architecture that serves as the overarching framework for the entire deployment effort. The Enterprise Network Topology and Architecture shall outline standard architectural principles, core infrastructure, security policies, data integration methods, and redundancy measures that apply across all 172 sites, and shall specify how POCUS studies acquired anywhere in the enterprise are made accessible to authorized providers at any VA facility.

The Contractor shall integrate load-balancing functionality into the enterprise POCUS System to ensure adequate distribution of processing workloads (image ingest, DICOM routing, interface engine throughput, viewer requests), thereby guaranteeing efficient and timely data processing during peak clinical activity.

The Contractor shall provide a centralized National Pre-Production Test Environment that accurately replicates the national production environment. This environment shall house all core components and integrations (EHR interfaces, DICOM routing, device connectivity, QA workflow, credentialing module) and shall be used to validate updates, configurations, new device models, and new integration endpoints prior to deployment across sites. The National Pre-Production Test Environment shall adhere to the same standards, configurations, and policies as production. The National Pre-Production Test Environment shall also serve as the centralized test system for validating software upgrades, new device connectivity, integrated applications, and overall system performance prior to production deployment.

A. Enterprise Network Topology and Architecture B. National Pre-Production Test Environment

POCUS SYSTEM REQUIREMENTS

The Contractor shall provide and implement a fully functioning COTS POCUS System at an enterprise level. The POCUS System shall:

1. Integration and interfaces

a. Seamlessly integrate with VistA (including VistA Imaging and CPRS) and Oracle Health Millennium via HL7 v2.x interfaces (Admission, Discharge, and Transfer (ADT), Order Message (ORM), Observation Result Unsolicited (ORU)) and, where applicable, HL7 FHIR R4, consistent with the VA Standard – POCUS ICD.

b. Support the entry of POCUS orders into the VistA Radiology Package (and, as applicable, other order entry pathways used for POCUS) and Oracle Health Millennium OpenLink.

c. Accommodate the existence of potentially two separate instances of VistA HL7 feeds per location and one national instance of the Oracle Health Millennium OpenLink HL7 feed within VHA.

d. Support all HL7 interfaces required to implement and sustain the POCUS System across the 172 facilities without a product-imposed interface limitation that prevents full enterprise deployment.

e. Simultaneously support multiple ORU and ORM HL7 connection pathways — there is one production Federal EHR instance (Oracle Health EHR) and multiple legacy VistA/CPRS and VistA Imaging instances.

f. Utilize an interface engine capable of managing HL7 messages to both VistA/CPRS and Oracle Health EHR simultaneously.

2. Workflow support (non-negotiable dual-workflow requirement)

a. Support both:

i. order-based POCUS workflows (where a POCUS study is initiated from a placed order in VistA or Oracle Health).

ii. encounter-based POCUS workflows (where a POCUS study is performed and documented within the context of an existing patient encounter without a discrete order).

b. Both patterns shall be supported concurrently within the same deployment and without requiring facility-level configuration changes to switch between them.

3. Device support

a. Provide device-agnostic support for cart-based ultrasound systems and handheld/pocket ultrasound devices in current VHA use and in common commercial availability, including at minimum: Butterfly iQ family, GE Vscan Air family, Philips Lumify, Sonosite, Mindray, and Konica Minolta ultrasound systems.

b. Support DICOM Modality Worklist (MWL) delivery to POCUS devices where the device supports MWL and shall accommodate handheld devices with limited or no DICOM MWL capability through mobile-application-based patient association workflows.

c. Support secure wireless image transfer from mobile devices to the POCUS archive.

4. Enterprise architecture

a. Include an enterprise exam-volume licensing model with no per-device or per-user surcharges.

b. Provide a guaranteed uptime of 99.5%.

i. Production-system availability shall be measured monthly. Approved scheduled maintenance and outages attributable solely to VA infrastructure or Government-directed actions may be excluded from the calculation when documented and approved by the COR. The Contractor shall report monthly availability and provide root-cause analysis and corrective action for any month in which the standard is not met.

c. Support automatic update of patient demographics upon registration and receive demographic data from VistA/CPRS and/or Oracle Health Millennium.

d. Be capable of receiving and managing multiple patient identifiers including Electronic Data Interchange Personal Identifier (EDIPI) and SSN, with EDIPI (or the VA Integrated Control Number (ICN)) as the primary identifier consistent with the SSN Reduction requirements in PWS Section 6.

e. Be capable of transferring patients between facilities and between EHRs without creating duplicate patient records.

f. Function according to specifications across all time zones where VHA may deploy the POCUS System.

g. Comply with existing standards including DICOM (ultrasound and multi-frame ultrasound Service-Object Pair (SOP) classes) and Integrating the Healthcare Enterprise Radiology profiles.

h. Provide administrative capabilities to schedule database synchronizations, determine completeness, and identify missing records.

i. Ensure the POCUS System enables national staff from the National POCUS Program and applicable clinical program offices to view all data in the system and access reports at local, VISN, and national levels.

j. Possess unique and separate production and test systems/servers.

k. Provide a dashboard that serves as a central hub for monitoring, tracking, and managing the deployment and operational status of the POCUS System across all VA facilities, with real-time visibility into key metrics, interface health, exam volumes, and status updates.

5. Authentication, access, and roles

a. Support application authentication using Single Sign-On or Lightweight Directory Access Protocol via Personal Identity Verification (PIV) / Common Access Card (CAC).

b. Provide the capability to develop user groups with distinct privileges/permissions; default user group permissions shall be modifiable by a system administrator or Super User.

c. Allow staff to see patients nationwide and input information at their local facility without creating a duplicate patient.

d. Provide customizable administrative and clinical access.

e. Support a variety of user roles with varying levels of access and functionality (see PWS Section 5.4).

6. User experience and viewing

a. Provide a user-friendly interface with role-based access controls and clinician-oriented navigation, supporting efficient retrieval of prior POCUS studies to facilitate accurate case planning.

b. Provide a zero-footprint web-based POCUS viewer accessible from any workstation on the VA network and from within CPRS/Oracle Health with launch-in-context (patient-context handoff) capability.

c. Support cine-loop playback, multi-frame review, measurement tools appropriate to POCUS (distance, area, volume, ejection fraction estimation, Inferior Vena Cava (IVC) measurements, and other clinician-defined tools), and annotation

d. The Contractor shall provide POCUS System Design and Architecture Documentation including a high-level description of the system's purpose, scope, and functionalities; visual representations of the system's architecture (hardware, network, and software components); detailed descriptions of the system's design including data-flow diagrams, entity-relationship diagrams, and database schema; and a description of interface patterns for VistA and Oracle Health.

Deliverable:

A. POCUS System Design and Architecture Documentation

POCUS DATA MANAGEMENT AND CONTENT REQUIREMENTS

The Contractor shall ensure that all data including any proprietary metadata schemas shall be maintained in an exportable format to ensure seamless transfer and future use within VA-owned systems or alternative platforms. VA retains unlimited rights to all data inputted into the system as well as all data generated by this system.

The Contractor shall deliver a POCUS System that captures, stores, and makes available the following data at minimum:

Study-level data

· Patient demographics (name, Date of Birth, sex, EDIPI/ICN, Medical Record Number, encounter/order identifier)

· Exam type and clinical indication (mapped to a VHA-standardized POCUS exam taxonomy — see PWS Section 5.3.2)

· Ordering clinician (if order-based) and performing clinician

· Date, time, and location of acquisition

· Ultrasound device manufacturer, model, and serial number/asset tag

· Probe/transducer used

· Preset(s) used Image data

· DICOM-conformant still images and cine loops (multi-frame ultrasound SOP classes) at native acquisition resolution

· Secondary screen capture DICOM images where applicable

· Measurements and annotations stored as DICOM Structured Reports (DICOM SR — TID 5200 series or equivalent) where the acquisition device supports it, and as discrete database fields where it does not Interpretation data

· Clinician interpretation/findings entered through the POCUS System or through the EHR

· QA reviewer identity, QA status (pending, approved, revision requested, rejected), QA comments, and QA timestamp (see PWS Section 5.5)

· Attestations and credentialing counts (see PWS Section 5.5) Procedural POCUS data (where applicable)

· Procedure performed (e.g., central venous access, thoracentesis, paracentesis, arthrocentesis, regional anesthesia block)

· Guidance images/loops

· Complications and outcomes fields as required by clinical workflow

All data shall be capable of aggregation at both the local and enterprise levels, ensuring consistency despite variations in local naming conventions. Data shall be groupable to a VHA-standardized exam taxonomy (see PWS Section 5.3.2) to permit standardized comparative reporting for direct comparison across the enterprise.

The Contractor shall deliver to the Government all data first produced under this Task Order with Unlimited Rights as defined by FAR 52.227-14. This includes Unlimited Rights to source code and all documentation created in support thereof. Data shall be delivered and protected in accordance with VA Handbook 6500.

A.

POCUS SYSTEM REPORTING

The Contractor shall deliver a POCUS System with reporting capability that disseminates pertinent operational, clinical, and quality data to individual VAMCs, VISN Coordinators, and the National POCUS Program Office. The POCUS System shall:

· Provide pre-configured standard reports including:

· Exam volume by facility, VISN, service, clinician, exam type, and device

· Turnaround time from acquisition to QA sign-off

· QA reviewer workload and QA status distribution

· Individual clinician credentialing dashboards (exams performed by type, QA pass rates, progress toward credentialing thresholds — see PWS Section 5.5)

· Duplicate-imaging avoidance metrics (POCUS exams that supplanted an otherwise-ordered formal ultrasound, where documented)

· Device utilization by asset

· Permit the creation of custom reports and dashboards to address evolving clinical, operational, and regulatory requirements without requiring vendor intervention.

· Provide tools or interfaces that enable authorized users to define, schedule, and export reports.

· Permit reports and analytics to be restricted by role.

· Provide reports with clearly identified titles and scope of data (e.g., entire facility, single clinician, entire VISN, national).

· Support export to Comma-Separated Values, Excel, and Adobe Postscript Data Format (PDF) at minimum, and support scheduled automated export/delivery.

· Provide a variety of Data Reports and Exports on annual, quarterly, monthly, and ad hoc bases.

QUALITY ASSURANCE AND QUALITY COMPLIANCE

The Contractor's POCUS System shall include QA and Quality Compliance capabilities that enable VA staff to independently perform necessary case corrections and maintain data integrity and accuracy without requiring Contractor assistance. This includes ensuring the POCUS System is user-friendly, configurable, and supportive of VA's quality management processes. The POCUS System shall provide the following capabilities:

1. Patient Demographics - Tools for VA staff to update and correct patient demographic information, such as name, date of birth, gender, and contact information.

2. Exam Demographics - Enables the correction and update of exam-related demographics, including exam type, date, time, performed by, and associated clinical information.

3. End user customizable reports - A reporting module that allows end users to create, modify, and generate custom reports. This shall be a user-friendly interface for defining report criteria, selecting data fields, applying filters, and formatting output.

4. Dashboard and reports - A configurable dashboard that provides real-time insights and status updates. The dashboard should be customizable to meet the specific needs of different users, allowing them to monitor Key Performance Indicators (KPIs), track compliance metrics, and access detailed reports.

5. Device management - Capabilities for managing and monitoring medical imaging devices. This includes tracking device usage, performance, calibration status, and maintenance schedules. The POCUS System should alert staff to any device issues or required maintenance to ensure continuous operation and compliance with safety standards.

The Contractor shall provide a QA and Compliance Report as an addendum in the Monthly Progress Report as detailed in PWS Section 5.1.3. The QA and Compliance Report shall include system performance including usage statistics, system uptime, and data quality metrics; utilization information, issues/resolutions and continuous reporting updates.

CLINICAL WORKFLOW REQUIREMENTS

The Contractor's POCUS System shall support the clinical workflows required by VHA POCUS practice, defined and validated in coordination with the National POCUS Program Office and the Subject Matter Experts identified in the POC list.

USER ROLES

At minimum, the POCUS System shall support the following user roles, each with configurable permissions:

· Ordering Clinician — places or associates a POCUS order (where order-based workflow is used)

· Performing Clinician (Operator) — acquires POCUS images, enters interpretation and measurements, signs the study

· QA Reviewer / POCUS Program Director — reviews studies performed by others (particularly trainees and clinicians in the credentialing pathway), provides QA disposition and feedback

· Facility POCUS Coordinator — administers local users, credentialing thresholds, exam catalogs, and QA queues

· VISN POCUS Coordinator — cross-facility visibility and reporting within a VISN

· National POCUS Program Office — enterprise-wide visibility, reporting, policy configuration

· Read-Only Consulting Clinician — views POCUS images and interpretations for treating-provider purposes at any VA site

· HTM / Biomedical Engineer — device inventory and connectivity administration

· System Administrator — technical administration, integration configuration, user provisioning

STANDARDIZED POCUS EXAM TAXONOMY

The Contractor shall configure the POCUS System to a VHA-standardized POCUS exam taxonomy covering, at minimum: cardiac (focused cardiac ultrasound / limited echocardiography), lung, abdominal (Focused Assessment with Sonography in Trauma (FAST) / Extended Focused Assessment with Sonography in Trauma (eFAST), hepatobiliary, renal, bladder, aorta), vascular (Deep Vein Thrombosis, IVC), musculoskeletal, soft tissue, ocular, obstetric/gynecologic (as scoped for POCUS), procedural guidance (vascular access, thoracentesis, paracentesis, arthrocentesis, nerve blocks), and other exam types added by the National POCUS Program Office.

The taxonomy shall be extensible without vendor intervention.

IMAGE ASSOCIATION AND IDENTITY ASSURANCE

The POCUS System shall associate every POCUS study with the correct patient prior to archival. Patient identification shall be validated against Master Patient Index (MPI)/EDIPI via the EHR interface. For purposes of data migration, the ‘Data Migration Master List’ is the baseline patient-identifier reconciliation/crosswalk generated from the applicable legacy archive for migration purposes. It is distinct from VA’s MPI, which remains the authoritative VA patient-identity source.

The POCUS System shall not permit permanent archival of unassociated ("orphan") studies without an assigned patient; unassociated studies shall be held in a triage queue requiring active reconciliation by an authorized user.

The POCUS System shall support post-hoc patient reassignment by authorized users, with full audit trail.

DOCUMENTATION AND RESULTS FLOW

POCUS interpretation shall be entered once, in either the POCUS System or the EHR, and shall be reflected in the EHR of record via the ORU interface without requiring manual re-entry.

The POCUS System shall eliminate the current manual workaround of typing notes and pasting image links into VistA.

Signed and QA-approved studies shall be viewable within CPRS and Oracle Health with launch-in-context to the POCUS viewer for image review.

POCUS results shall be available to any authorized VA provider treating the patient at any VA facility.

VHA EHR INTEGRATION

The integration of the POCUS System with VHA EHR systems provides interoperability and efficient data management across the VA healthcare network. The Contractor shall establish robust and reliable HL7 interfaces (and FHIR interfaces where applicable) that support bidirectional exchange of patient demographics, orders, results, and image access pointers.

Depending on project schedule, the Contractor shall integrate POCUS at each facility either with VistA/CPRS or with the Federal EHR (FEHR), corresponding to whichever EHR the facility is using at the time of go-live. Facilities transitioning from VistA to FEHR shall have their POCUS integration reconfigured as part of the EHR cutover.

The Contractor shall implement HL7 ADT (patient demographics), ORM (orders), and ORU (results) interfaces between the POCUS System and both VistA/CPRS and the Federal EHR (Oracle Health EHR). The Contractor shall implement patient-context launch (e.g., Clinical Context Object Workgroup or equivalent context management, or Uniform Resource Locator (URL)-based launch as supported by the applicable EHR) so a clinician can open POCUS images for the patient currently in context in CPRS or Oracle Health without manual patient search.

As it relates to testing and go-live of the interface with the Federal EHR, the Contractor shall:

· Document VA Enterprise Risk Assessment (ERA) specific to interface with FEHR

· Connectivity testing and smoke testing between POCUS System and FEHR

· Install and configure HL7 interfaces on the POCUS System test and production environments

· Attend and support Interface Solution Testing sessions with VA and Oracle Health

· Attend and support planning activities in advance of the cutover (e.g., Dry Run / Tabletop activities)

· Execute cutover of the FEHR interface to production outside normal business hours

· Provide end-user training for any workflows specific to the FEHR interface

The Contractor shall implement the interface defined in the VA Standard – POCUS ICD (maintained on the VA-Oracle Health Project Portal) for the connection between the POCUS System and the Federal EHR. The Contractor shall develop a VA Vendor Integration Document (VID) in coordination with VA and Oracle Health, documenting the VistA/CPRS and VistA Imaging interface design, applicable message flows, configuration assumptions, dependencies, testing requirements, and deviations from applicable VA interface standards .