Enterprise Patient Radiation Dose Tracking System

VA-26-00035148

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Veterans’ Health Administration (VHA) National Radiology Program Office

Enterprise Patient Radiation Dose Tracking System

Date: April 9, 2026

VA-26-00035148

PWS Version Number: 1.3

Contents

BACKGROUND

The Department of Veterans Affairs (VA), Veterans Health Administration (VHA), National Radiology Program Office strives to provide high quality, effective, and efficient solutions to those responsible for providing high quality from the initial point of care through every follow up in an effective, timely and compassionate manner.

VHA requires a comprehensive, enterprise-wide Patient Radiation Dose Tracking (PRDT) system and accompanying support services to significantly enhance patient safety, regulatory compliance, operational efficiency, and quality of care. This system shall also empower radiologists, radiation safety officers, and clinical staff to more effectively manage VHA radiation safety programs.

The system shall be capable of aggregating radiation dose data from all types of imaging equipment and modalities, including X-Ray/General Radiography, Computed Tomography (CT), Fluoroscopy (both fixed and portable), Mammography, Bone Densitometry (DEXA), Magnetic Resonance Imaging (MRI), Linear Accelerators, Dental Radiology, and Nuclear Medicine equipment and dosage.

The system shall also be adept at generating cumulative dose calculations, Peak Skin Dose (PSD), Effective Dose Equivalent (EDE) for transmission and emission imaging, organ-specific dose calculations, and tracking contrast administration and dosage for radiologic exams and procedures. Furthermore, the system shall be able to generate customizable reports for each modality, equipment type, provider, and user, encompassing all relevant dose and dosage measurements. Users must be able to generate these reports at the local, regional, and national levels. The system shall provide Digital Imaging and Communications in Medicine (DICOM)-compliant Radiation Dose Structured Reports (RDSR), Radiopharmaceutical Structured Reports (R-RDSR), and DICOM-compliant screen captures. Finally, it must support Health Level 7 (HL7) inbound and outbound messaging to integrate and aggregate radiation dose data across all VA facilities.

VHA requires substantial interfacing between the PRDT system and both the Veterans Health Information and Systems Technology Architecture (VistA) and Oracle Health (OH) Millenium. Throughout the VHA's facilities and Veterans Integrated Service Networks (VISNs), a variety of Radiology Information Systems (RIS) and Picture Archiving and Communication Systems (PACS) are in use, alongside the Electronic Health Record (EHR). The PRDT system must seamlessly integrate with these diverse systems to ensure cohesive and efficient data management across the entire VHA network. This system shall be deployed to a total of 135 VA facilities across the country.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

3. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

4. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022

6. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and Information Technology Act of 2006, as amended, Title IX, Information Security Matters

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

10. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

11. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

12. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

13. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended

14. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

15. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”, as amended

16. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

17. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

24. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

25. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

26. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

27. OIT Process Asset Library (PAL), OIT Process Asset Library.

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

30. VA Directive 6510, “VA Identity, Credential and Access Management,” September 3, 2024

31. VA Handbook 6510, “VA Identity, Credential and Access Management,” September 27, 2024

32. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

33. VA Directive 6300, “Records and Information Management,” September 21, 2018

34. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

44. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

47. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

49. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

50. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

51. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

52. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L. 110–140), December 19, 2007

53. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005

54. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

55. VA Directive 0057, “VA Environmental Management Program,” October 25, 2022

56. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

57. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

58. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

59. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

60. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

61. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

62. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

63. Social Security Number (SSN) Fraud Prevention Act of 2017

64. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

65. C.F.R Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”, as amended

66. Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

67. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

68. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

69. OMB M-22-18, “Enhancing the Security of the Software Supply Chain through Secure Software Development Practices,” September 14, 2022

70. OMB M-23-16, “Update to Memorandum M-22-18,” June 9, 2023

71. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27, 2021

72. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December 2014

73. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02: Vulnerability Remediation Requirements for Internet-Accessible Systems | CISA

74. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

75. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

76. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019

77. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

78. E.O. 13960, “Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government,” December 3, 2020

79. E.O. 14319, “Preventing Woke AI in the Federal Government,” July 23, 2025

80. OMB Memorandum M-25-21, “Accelerating Federal Use of AI through Innovation, Governance, and Public Trust,” April 3, 2025

81. OMB Memorandum M-25-22, “Driving Efficient Acquisition of Artificial Intelligence in Government,” April 3, 2025

82. OMB Memorandum M-26-04, “Increasing Public Trust in Artificial Intelligence (AI) Through Unbiased AI Principles,” December 11, 2025

83. VHA Directive 1105.04 “Fluoroscopy Safety”

84. VHA Directive 1129 “Radiation Protection for Machine Sources of Ionizing Radiation”

85. Standardized Radiology Imaging Integration Interface Control Document

SCOPE OF WORK

The Contractor shall provide an enterprise license for a fully functional, customized Commercial Off the Shelf (COTS) PRDT system at an enterprise level, inclusive of all functionalities detailed in this document, to approximately 135 Veteran Health Administration (VHA) facilities offering in-house Diagnostic Imaging services. Additionally, the system shall provide oversight and analytics capabilities for the National Radiology Program and shall be scalable to accommodate future modalities and new locations.

The implementation of the proposed PRDT system shall be managed through a phased deployment approach to maximize organizational learning and efficiently utilize project management resources. Each phase of the project shall be coordinated with the assigned Enterprise-level Contracting Officer’s Representative (COR) as well as local/regional Points Of Contact (POC).

The Contractor shall provide all services related to the furnishing, integration and installation of the proposed PRDT system. This includes training, system maintenance, and data migration for each facility. The Contractor shall also ensure that the proposed PRDT system fully complies with all applicable federal and Department of Veterans Affairs (VA) cybersecurity requirements, including Federal Risk and Authorization Management Program (FedRamp), VA Authority To Operate (ATO) and all applicable VA privacy and security requirements specifically those related to Protected Health Information (PHI) and Personally Identifiable Information (PII).

PERFORMANCE DETAILS

PEFORMANCE PERIOD

The Period of Performance (PoP) shall be 12 months from date of award, with four 12-month option periods and 3 optional tasks. The overall Period of Performance shall not exceed 60 months.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO). There may be instances during deployment or system upgrades where work may need to occur on Weekend, Holidays, Evening, or Nights. In those instances, the work schedule needs to occur with express permission from the Enterprise-level COR or local POC in writing.

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed primarily at the Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission. Installation, data migration, system testing and training shall be performed at the VA facilities detailed in Attachment A – List of Facilities.

Additionally, work may be conducted at remote locations, provided that prior concurrence is obtained from the Enterprise-level COR. All remote work must adhere to VA policies regarding remote connections to ensure compliance and security.

TRAVEL

The Government does not anticipate travel will be required to complete tasks associated with this effort.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall provide a fully functional PRDT system on a national basis for a total of 135 sites throughout the PoP in accordance with this PWS.

PROJECT MANAGEMENT

PROJECT MANAGEMENT SUPPORT

The Contractor shall provide a dedicated Program Manager for this overall effort. The Contractor shall provide project management to include:

a. Software, network, implementation planning, and training

b. Timeline

c. Comprehensive Project Timeline for the entire deployment, including optional tasks detailing national, regional, and site level installation and implementation

d. Management of all contract logistics, including coordination of system support, sustainment planning and fulfillment of all contract requirements

The Contractor shall deliver a fully functioning PRDT system on a national basis for a total of 135 sites. The base period of this effort shall include the deployment to 15 initial sites. Optional tasks will detail the deployment of the PDRT to the remaining 120 sites. See Attachment A: List of Facilities for a comprehensive list of sites.

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

The Contractor shall conduct a Shipment/Delivery Kick-off Meeting with the VA PM, Enterprise-level COR, Delivery Date Coordinator, Implementation Manager, and Facility CIOs (or designee) to discuss delivery schedule requirements and facilitate delivery of equipment. This meeting may be held in conjunction with the post award conference or identified technical kickoff meeting. The Contractor shall also present the Shipment/Delivery Weekly Progress Report format detailed in 5.1.2 for review and approval by the Government. This meeting, if held independently, shall be conducted telephonically within ten days after award and shall incorporate any delivery schedule changes to the draft Delivery Schedule identified by the Government.

Deliverable:

A. Contractor Project Management Plan

REPORTING REQUIREMENTS

The Contractor shall provide the Enterprise-level COR with Monthly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding month. The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

A. Monthly Progress Report

INFORMATION SECURITY, PRIVACY AND COMPLIANCE REQUIREMENTS

The Contractor shall ensure that the proposed PRDT system fully complies with all applicable federal and VA cybersecurity, privacy, and information protection requirements, including but not limited to FedRAMP, VA Authority to Operate, and VA Handbook 6500. The following activities, deliverables, and timelines apply:

1. FedRAMP Authorization for Cloud-Based Systems - If any component of the PRDT system utilizes cloud computing services (including Software-as-a-Service, Infrastructure-as-a-Service, or Platform-as-a-Service), the Contractor shall provide solutions from Cloud Service Providers (CSPs) that possess a current FedRAMP Authorization at Moderate or higher impact level, applicable to the system’s security categorization. Proof of FedRAMP Authorization must be furnished to the VA Contracting Officer and Enterprise Level COR at least thirty (30) calendar days prior to Government Acceptance Testing or system deployment.

2. VA ATO - Prior to processing, storing, or transmitting any VA data, the Contractor shall:

a. Attain a VA ATO for the PRDT system in accordance with the VA Risk Management Framework (RMF) and VA Handbook 6500.

b. Be responsible for preparing, updating, and submitting all required documentation, reports, test results, and artifacts as necessary to achieve and maintain ATO status for the duration of the contract.

c. Obtain Interim Approval and/or Full ATO within ninety (90) calendar days of contract award, unless otherwise authorized in writing by the Contracting Officer.

3. Ongoing Security and Privacy Compliance - The Contractor shall provide all documentation, system access, and support required for VA security assessments, audits, and ongoing continuous monitoring as directed by the VA. The Contractor shall maintain compliance with all applicable VA privacy and security requirements at all times, including those related to PHI and PII. The Contractor shall promptly report to the Contracting Officer and COR any new or unanticipated security threats, incidents, or breaches (including suspected or confirmed loss, theft, or unauthorized disclosure of PHI or PII) within one (1) hour of discovery, following VA policies and procedures.

Deliverables:

A. VA ATO Documentation

ENTERPRISE PRDT SYSTEM

The Contractor shall provide site licenses and implement a COTS PRDT system at an enterprise level, to be managed at the facility, VISN, and/or VHA level to approximately 135 VA facilities. The base period of this effort shall include the deployment to 15 initial sites. See Attachment A: List of Facilities for a comprehensive list of sites.

The Contractor shall provide a single, comprehensive enterprise network topology that serves as the overarching framework for the entire deployment effort. This Comprehensive Network Topology Solution shall outline standard architectural principles, core infrastructure, security policies, data integration methods and redundancy measures that apply across all 135 sites.

The Contractor shall integrate load balancing functionality into the enterprise system to ensure the adequate distribution of processing workloads, thereby guaranteeing efficient and timely data processing. This will provide the necessary infrastructure to handle high-volume data flows and enhance overall system performance and reliability. This requirement is critical to maintaining optimal operational efficiency.

The Contractor shall also provide a centralized pre-production test environment that accurately replicates the national production environment. This National Pre-Production Test Environment shall house all core components and integrations, allowing for comprehensive testing of updates, configurations, and new features before they are deployed across all sites. This centralized environment shall adhere to the same standards, configurations, and policies as the production environment to provide reliable and consistent results.

The Contractor shall also establish a core test system environment that replicates the production environment at a centralized location. This Centralized Test System shall be capable of handling the majority of testing needs, ensuring that any changes or updates are validated in a setup that mirrors the overall production environment. This environment shall be used for validating software upgrades, new modalities, integrated applications, and overall system performance before rolling them out to all sites. The physical location of the test system will be given at time of the award.

Deliverables:

A. Comprehensive Network Topology Solution

PRDT SYSTEM REQUIREMENTS

The Contractor shall provide and implement a fully functioning COTS PRDT system at an enterprise level, to be managed at the facility, DICOM VISN, and/or VHA level. The system shall:

1. Seamlessly integrate with the Veterans Health Information Systems and Technology Architecture (VistA) and Oracle Health Millennium (OH Millennium) EHR systems via HL7 interfaces. The system shall be capable of bi-directional data exchange with both VistA and OH Millenium for all relevant radiology workflow, data and demographic updates.

2. Accommodate and integrate a variety of Medical Record Number (MRN) formats from legacy and current EHRs, including the ability to map and convert patient identifiers and MRNs from both VistA and OH Millennium. The system shall perform all required MRN reconciliation and conversion activities at the time of system go-live to ensure continuity and data integrity across all VHA facilities. This includes seamless linkage of patient records regardless of originating MRN format or source system.

3. Support the entry of imaging orders into the VistA Radiology Package or Oracle Health Millennium OpenLink.

4. Accommodate the existence of potentially two separate instances of VistA HL7 feeds per location and one national instance of the OH Millennium OpenLink HL7 feed within VHA.

5. Have no limit to the number of HL7 interfaces it can ingest.

6. Include an enterprise exam volume licensing model.

7. Provide a guaranteed uptime of 99%.

8. Support the naming and renaming of procedures and the anonymization of data to maintain privacy and confidentiality.

9. Shall automatically update patient demographics upon registration.

10. Receive demographic data from VISTA/ Computerized Patient Record System (CPRS) and/or Oracle Health Millenium.

11. Capable of receiving, mapping and managing multiple patient identifiers including various MRN formats, Electronic Data Interchange Personal Identifier (EDIPI) and Social Security Number (SSN) across VistA and OH Millennium. The Contractor’s system shall be able to recognize and reconcile multiple representations of MRNs and SSNs (e.g., with or without dashes), ensuring they are associated with the correct patient record at go-live and in ongoing operations.

12. Be capable of transferring patients between facilities and EHR without creating duplicate patient records.

13. Comply with existing standards including DICOM and Integrating the Healthcare Enterprise (IHE).

14. Provide administrative capabilities to schedule databases synchronizations, determine completeness and identify missing records.

15. Ensure the system enables national staff from the National Radiology Program and the National Health Physics Program to view all data in the system and access reports at local, VISN and national levels.

16. Provide patient context exchange and synchronization between Imaging Archive/Dictation application and Patient Radiation Dose tracking software system.

17. Function according to specifications across all time zones where VHA may deploy the system.

18. Support application authentication using Single Sign-On (SSO) or Lightweight Directory Access Protocol (LDAP) via Personal Identity Verification (PIV) / Common Access Card (CAC).

19. Provide the capability to develop user groups with distinct privileges/permissions.

20. Capable of the permissions for the default user groups being modified by a system administrator or Super User.

21. Allow staff to see patients nationwide and input information at their local facility without creating a duplicate patient

22. Provide customizable administrative and clinical access.

23. Support a variety of User Roles with varying levels of access and functionality.

24. Provide user-friendly functionality and enable efficient retrieval of patient information to facilitate accurate case planning by clinicians. Additionally, the alerts and reports generated by the system shall be intuitive and easily comprehensible. The user interface shall support role-based access controls consistent with VA security standards such as DICOM and Integrating the Healthcare Enterprise, IHE.

25. Possess unique and separate production and test systems/servers.

26. Utilize an interface engine that supports the capability to manage HL7 messages to both VistA/CPRS and Oracle Health EHR simultaneously.

27. Simultaneously support multiple Observation Result Unsolicited (ORU)/ Order Entry (ORM) HL7 connection pathways -- there is one production Federal EHR instance (Oracle Health EHR) and multiple legacy VistA CPRS / VistA Imaging instances.

28. Provide a dashboard that serves as a central hub for monitoring, tracking, and managing the deployment and operational status of the Patient Record Data Transfer system across all VA facilities. This dashboard provides real-time visibility into key metrics, performance indicators, and status updates, ensuring that stakeholders can effectively oversee the national deployment and ongoing operation of the PRDT system.

The Contractor shall provide System Design and Architecture Documentation. This Documentation shall include a high-level description of the system's purpose, scope, and functionalities, visual representations of the system's architecture, including hardware, network configurations, and software components as well as detailed descriptions of the system's design, including data flow diagrams, entity-relationship diagrams and database schema.

Deliverable:

A. System Design and Architecture Documentation

PRDT DATA MANAGEMENT AND CONTENT REQUIREMENTS

The Contractor shall ensure that all data, including any proprietary information, shall be maintained in an exportable format to ensure seamless transfer and future use within VA-owned systems or alternative platforms. VA retains ownership of all data inputted into the system as well all data generated by this system.

The Contractor shall deliver a system that gathers the following information:

a. Primary Data:

i. Computed Tomography (CT) including Positron Emission Tomography (PET) and Single Photon Emission Computed Tomography (SPECT)

1. Computed Tomography Dose Index Volume (CTDlvol)

2. Dose Length Product (DLP)

3. Kilovoltage Peak (kVp (KV))

4. Milliamperes (mA)

5. Pitch

6. Rotation Time (seconds)

7. Slice thickness (millimeters (mm))

8. Nominal Beam width

ii. Fluoroscopy (Fluoro)

1. Reference point Air Kinetic Energy Released per unit Mass (KERMA)

2. Kerma Area Product (KAP)

3. Fluoro Time Minutes

4. Dose (Reference Point (RP)) (mGy) - Dose reference point

5. Acquisition Dose (RP) milliGray (mGy)

6. Fluoro Dose (RP) (mGy)

7. Dose Area Product (DAP) (deciGray-centimeter (dGy.cm))

iii. Projection Radiography

1. DAP

2. Entrance exposure?

3. Exposure index?

4. kVp

5. mAs

iv. Mammography

1. Entrance dose

a. Left and right

2. Organ Dose

a. Left and right

3. Dose Area Product (DAP)

v. PET

1. CTDlvol Mean (mGy)

2. DLP (mGy.cm)

vi. Nuclear Medicine (Gamma Capera/SPECT)

1. Radionuclide Total Dose

2. Radiopharmaceutical dose

b. Derived Data:

i. All modalities

1. Effective Dose

ii. CT

1. Water Equivalent Diameter (WED)

2. Center Mass Offset

3. Median CTDIvol by machine and protocol

4. Effective Dose (millisievert (mSv))

5. Size Specific Dose Estimate (SSDE) (mGy)

iii. Mammography

1. Mean Glandular Dose

a. Left and right

iv. Fluoro

1. Peak Skin Dose

v. Nulear Medicine (Gamma Capera/SPECT

1. Effective dose

c. Data shall be received from the modality or pulled from the Picture Archiving and Communication System (PACS) system. The system must comply with the latest DICOM standards including:

i. Digital Imaging and Communications in Medicine (DICOM) Radiation Dose Structured Report (RDSR) ii.

iii. Radiopharmaceutical Radiation Dose Structured Report (R-RDSR) DICOM

iv. Secondary Screen Capture DICOM .

v. Original DICOM Image, including localizer images (CT)

vi. Dose page, read by Optical Character Recognition (OCR)

Data shall be capable of being grouped to avoid local procedure naming issues. All data shall be capable of aggregation at both the local and enterprise levels, ensuring consistency despite variations in local procedure naming conventions.

SYSTEM REPORTING

The Contractor shall deliver a system that disseminates pertinent data to individual VAMCs, VISN Coordinators, and National Program Offices.

The Contractor’s system shall encompass the following capabilities:

a. Categorize Fluoroscopy data by the service/section in which the procedure was performed.

b. Integrate and transmit data to other information systems, including but not limited to VISTA/CPRS, OH Millennium, Voice Dictation Systems (e.g., PowerScribe), Cardiovascular Assessment, Reporting, and Tracking - Cath Lab (CART-CL), and American College of Radiology Data Integrity and Reporting (ACR DIR).

c. Provide summary data for CT and other imaging modalities, sorted by protocol, to facilitate comparisons with published Diagnostic Reference Levels (DRLs) and achievable doses across VA facilities.

d. Develop VHA-specific DRL and achievable doses.

e. Monitor and report data on individual examinations that exceed specified sentinel values.

f. Generate warning notifications when dose levels exceed prescribed thresholds.

g. Enable users to generate custom reports.

h. Capable of generating a comprehensive suite of reports and dashboards derived from available DICOM metadata and associated clinical data.

· Support the generation of standard radiation dose tracking reports, such as:

· Modality-specific dose summaries

· Protocol compliance

· Outlier detection

· Patient cumulative dose (effective dose equivalent)

· Permit the creation of custom reports and dashboards to address evolving clinical, operational, and regulatory requirements.

· Tools or interfaces that enable authorized users to define, schedule, and export reports without necessitating vendor intervention.

· Specific Reporting

· Fluoroscopy Reports

· Cumulative dose 6-month interval, individual patient

· Fluoroscope skin dose map

· Alert system when a dose metrics from a procedure exceed a Substantial Radiation Dose Level as defined by VHA Directive 1105.04 provided to the facility.

· Peak Skin Dose (PSD) calculation

· Dose delivery parameters including Fluoroscopy Mode Type: (Pulsed or Continuous)

· Ability to compare & Track PSD at the Local, Regional and National Level

· CT Reports

· For each protocol on each CT, provided to the facility

· Median CTDIvol

· Mean CTDIvol (achievable dose)

· 75th percentile

· Enterprise level Custom Alerts for CT Exposure with Notifications.

· MRI Reports

· Specific Absorption Rate (SAR)

· General Reports

· The ability to group similar exams into common procedure names.

· Standard report templates across the enterprise

· Enterprise level Custom Alerts & Notifications.

· IV Contrast dose tracking

i. Provide reports with clearly identified titles and scope of data (ex: entire facility, single radiologist, entire VISN, etc.)

j. Permits reports and analytics to be restricted by role.

k. Provide a variety of Data Reports and Exports on demand. Additionally, the end user shall be able to pull reports on their necessary timelines. The system shall be able to pull reports over a specified timeframe (ex: monthly, quarterly, any duration required). The reports shall be comprehensive, accurate, and capable of supporting VA's clinical and administrative needs and include:

1. Summary Reports:

· Monthly and Quarterly Dose Summary Reports

· Annual Dose Summary Reports

2. Detailed Dose Reports

· Individual Patient Dose Report

· Procedure-Specific Dose Report

3. Comparison Reports

· Machine and Protocol Comparison Reports

· Facility Comparison Reports

4. Compliance and Safety Reports

· Dose Alert Reports

· Radiation Safety Compliance Reports

5. Quality Assurance and Performance Reports

· A. Quality Control Reports

· B. Performance Improvement Reports

6. Operational and Utilization Reports

· A. Modality Utilization Reports

· B. Technologist Performance Reports

7. Custom and Ad-hoc Reports

· A. Custom Reports

· B. Ad-hoc Reports

8. Data Exports

· A. Standardized Data Exports

· B. Automated Data Exports

9. Visual Dashboards and Analytics

· A. Interactive Dashboards

· B. Advanced Analytics

QUALITY ASSURANCE (QA) AND QUALITY COMPLIANCE (QC)

The Contractor's system shall include Quality Assurance (QA) and Quality Compliance (QC) capabilities that enable VA staff to independently perform necessary case corrections and maintain data integrity and accuracy without requiring Contractor assistance. This includes ensuring the system is user-friendly, configurable, and supportive of VA's quality management processes. The system shall provide the following capabilities:

1. Patient Demographics - Tools for the VA staff to update and correct patient demographic information, such as name, date of birth, gender, and contact information.

2. Exam Demographics - Enables the correction and update of exam-related demographics, including exam type, date, time, performed by, and associated clinical information.

3. End user customizable reports - A reporting module that allows end users to create, modify, and generate custom reports. This shall be a user-friendly interface for defining report criteria, selecting data fields, applying filters, and formatting output.

4. Dashboard and reports - A configurable dashboard that provides real-time insights and status updates. The dashboard should be customizable to meet the specific needs of different users, allowing them to monitor Key Performance Indicators (KPIs), track compliance metrics, and access detailed reports.

5. Device management - Capabilities for managing and monitoring medical imaging devices. This includes tracking device usage, performance, calibration status, and maintenance schedules. The system should alert staff to any device issues or required maintenance to ensure continuous operation and compliance with safety standards.

The Contractor shall provide a Quality Assurance and Compliance reporting in the Monthly Progress Report from section 5.1.2. The reporting shall include system performance including usage statistics, system uptime, and data quality metrics; utilization information, issues/resolutions and continuous reporting updates.

LEGACY DATABASE PATIENT IDENTIFIER CONVERSION S

The Legacy Database Patient Identifier Conversion focuses on updating the patient identifiers in the legacy database from Social Security Numbers (SSNs) to Electronic Data Interchange Personal Identifiers (EDIPIs). This one-time conversion shall ensure patient data integrity and compliance with modern data standards. The Contractor shall execute this conversion in close coordination with VHA. The Contractor shall:

1. Provide support services for a one-time patient merge event to move/downgrade primary Medical Record Number (MRN) (Patient Identifier) that is currently SSN to a secondary Patient Identifier if possible and insert corresponding Electronic Data Interchange Personal Identifier (EDIPI) (New Patient Identifier) into the primary MRN field or status.

2. Gather and provide a Master List of patient names and SSNs – Legacy Patient records from the PRDT database and provide it to VHA as an Excel or Text document on the PRDT production server. The document should include as many of the patient attributes as the system/application has available to aid with the matching process, including Last Name, First Name, Date of Birth, Sex, and SSN.

3. Change the primary identifier to EDIPI and set the SSN to secondary status in the legacy database if possible, once VHA has reconciled the SSN to EDIPI and returned the list to the Contractor.

4. Provide a Delta List of patient names and SSNs including the patients added to the patient database between the time of the initial master list and go-live. VHA will again provide a reconciled list, and the Contractor will perform the delta patient identifier change.

5. Test EDIPI as the primary patient identifier in PRDT and rectify any identified issues to resolution with VHA Healthcare Technology Management (HTM) staff approval.

6. Develop a detailed Conversion Schedule with the approval of the Enterprise-level COR. This Conversion Schedule shall outline the specific timelines, milestones, and phases for carrying out the conversion within the PoP.

Deliverables:

A. Master List B. Delta Patient List C. Conversion Schedule

VHA EHR INTEGRATION:

The integration of the PRDT system with VHA EHR systems provides interoperability and efficient data management across the VA healthcare network. The Contractor shall establish robust and reliable HL7 interfaces that support the exchange of clinical orders and results, enhancing the accuracy and timeliness of patient data access. The Contractor shall implement, test, and support the necessary interfaces to facilitate this integration, ensuring that the PRDT system can operate effectively within the EHR environments at the various VAMCs.

The Contractor shall:

A. Implement an HL7 orders (ORM) and HL7 results (ORU) interface between VA's PRDT system and both VA’s Electronic Medical Records (EMR) (VistA CPRS and Federal EHR (FEHR) [Oracle Health EHR]). Depending on project schedule, the Contractor shall integrate PRDT at the facility either with VistA CPRS or FEHR depending on whichever EHR the facility is using at the time of go live.

B. Execute the following related to testing and go live of interface with Federal EHR:

1. Documentation of VA Enterprise Risk Assessment (ERA) specific to interface with FEHR

2. Connectivity testing and smoke testing between PRDT and FEHR

3. Installation and configuring of HL7 interface on the PRDT test and production systems

4. Attend and support Interface Solution Testing (IST) sessions with VA and Oracle

5. Attend and support planning activities in advance of the cutover (e.g. Dry Run/Tabletop activities)

6. Execute cutover of FEHR interface to production (cutover will occur outside normal business hours)

7. Provide end user training for any workflows specific to the FEHR interface

C. Implement the interface defined in attached VA document entitled “Standardized Radiology Imaging Integration Interface Control Document” for the connection between PRDT and the Federal EHR. The Contractor shall develop a VA Vendor Integration Document (VID) in coordination with VA and Oracle Health. The VID shall document any deviations from “Standardized Radiology Imaging Integration Interface Control Document” for the PRDT system.

Deliverable:

A. VA Vendor Integration Document

CUSTOMER TRAINING

The Contractor shall provide virtual training for the following users: Clinical, PACS Administrator, and Biomedical Engineer as specified below. The Contractor shall provide User Manuals, Training Materials and a Quick Reference Guide for the PRDT System. The User Manual shall include detailed information for all end-users explaining how to use the system, including logging in, navigating the interface, and performing core functions. The Training Materials shall be tailored to different user roles, including step-by-step instructions, exercises, and use-case scenarios. The Quick Reference Guide shall include concise cheat sheets and quick guides that provide a summary of key functions and shortcuts.

Deliverables:

A. User Manuals B. Training Materials C. Quick Reference Materials

CLINICAL USER TRAINING

The Contractor shall provide Clinical User Training on the PRDT system and its operation. Clinical users of the Contractor’s PRDT system shall include, but are not limited to:

1. Radiology technologist

2. Radiologist

3. Radiation Safety Officers

4. System-Wide Clinical Administrators

5. Nuclear Medicine Technologists

The Clinical User Training shall include:

1. System Overview

2. User Interface Navigation

3. Patient Record Management

4. Imaging Data Integration

5. Radiation Dose Tracking and Reporting

6. Exam Demographics Device Management

7. Custom Reports Generation

8. Troubleshooting and Support

SYSTEM ADMINISTRATOR TRAINING

The Contractor shall provide power-user and system administrator training for operational support of the Patient Radiation Dose Tracking System system.

The System administrator training shall include:

1. Local Super User for Clinical Users

2. Local Trainer for Clinical Users

3. Resolving Common User Questions

4. User Account Management

5. Client Application Installation and Configuration

6. System Utilization Monitoring

7. Day-to-Day System Management

8. Voice Recognition/Dictation System Integration

BIOMEDICAL ENGINEER TRAINING

The Contractor shall provide biomedical engineer training for implementation and operational support for the Patient Radiation Dose Tracking system.

The Contractor shall provide comprehensive training for biomedical engineering staff regarding the implementation and operational support of the PDRT system.

The training for biomedical engineers shall include:

1. System Overview and Components

2. System Operation

3. System Initialization and Service Management

4. Application Logs

5. Client Application Installation and Configuration

6. System Maintenance and Updates

7. Backup and Recovery Procedures

8. Monitoring and Optimization

9. Troubleshooting Common Issues and Performance

CUSTOMER SUPPORT

The Contractor shall provide comprehensive customer technical support 24 hours a day, seven days a week (24/7). This support includes remote technical and clinical applications support addressing software obsolescence, implementing major upgrades, revisions, patches, application updates, database updates, system vulnerabilities and fixes to maintain optimal system performance.

The Contractor shall utilize the VA national site-to-site Virtual Private Network (VPN) to provide secure and reliable connectivity. The Contractor shall support the ongoing workflow and integration changes as VA incrementally adds additional sites to the PRDT system to ensure seamless integration and continuous operation across all locations.

Contractors with an existing approved Memorandum of Understanding (MOU) and Interconnection Security Agreement (ISA) shall provide remote system support and adhere to all stipulated requirements within these agreements.

The Contractor technical support team shall respond within 60 minutes of notification for any technical or operational issues and resolve issues within 3…