PWS eNotifications 4.27.26.pdf

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Health Data Management (HDM)

Integrated eNotifications Service Pilot via Direct Secure Messaging

(DSM)

Date: April 27, 2026

VA-26-00049664

PWS Version Number: 2.0

Contents

1.0 BACKGROUND .................................................... Error! Bookmark not defined.

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

4.2 PLACE OF PERFORMANCE

4.3 TRAVEL

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN .... Error! Bookmark not defined.

5.1.2 PRIVACY AND HIPAA TRAINING .............. Error! Bookmark not defined.

5.1.3 KICKOFF MEETING

5.1.4 REPORTING REQUIREMENTS ................. Error! Bookmark not defined.

5.2 ADMISSIONS, DISCHARGE AND TRANSFER (ADT) ELECTRONIC

NOTIFICATION SERVICE

5.2.1 ADT SERVICE REQUIREMENTS

5.2.2 SAAS FEDRAMP REQUIREMENTS ........... Error! Bookmark not defined.

5.2.3 SECURE FILE TRANSFER PROTOCOL (SFTP)

5.2.4 MONITORING, TECHNICAL SUPPORT AND MAINTENANCE

5.3 OPTIONAL TASK 1 – ADDITIONAL PATIENTS Error! Bookmark not defined.

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 VA TECHNICAL REFERENCE MODEL

6.1.2 ZERO TRUST – VA CRITICAL SECURITY CONTROLS

6.1.3 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT

(FICAM)

6.1.4 INTERNET PROTOCOL VERSION 6 (IPv6)

6.1.5 TRUSTED INTERNET CONNECTION (TIC)

6.1.6 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT

LINE MANAGEMENT (PLM)

6.1.7 PROCESS ASSET LIBRARY (PAL)

6.1.8 AUTHORITATIVE DATA SOURCES

6.1.9 SOCIAL SECURITY NUMBER (SSN) REDUCTION

6.1.10 SOFTWARE AND LICENSING REQUIREMENTS

6.2 SECURITY AND PRIVACY REQUIREMENTS

6.2.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

6.2.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

6.3 METHOD AND DISTRIBUTION OF DELIVERABLES

6.4 PERFORMANCE METRICS

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM SECURITY/

PRIVACY LANGUAGE

1.0 BACKGROUND

The Department of Veterans Affairs (VA), Veterans Health Administration (VHA), Office of Mental Health and Suicide Prevention (OMHSP), in coordination with the Office of Information & Technology (OIT) Health Data Management portfolio is pursuing enhanced capabilities to support care coordination and suicide prevention efforts for Veterans receiving care in community settings. This effort aligns with legislative priorities including Elizabeth Dole 21st Century Veterans Healthcare and Benefits Improvement Act, which emphasizes improved care coordination, timely access to information, and enhanced support for Veterans at risk.

VHA has identified a gap in timely visibility into care events occurring outside of VA facilities, particularly for Veterans receiving treatment in community hospitals, emergency departments, and post-acute care settings. Without timely notification of these events, VA care teams may be delayed in coordinating follow-up care, which is especially critical for Veterans identified as high-risk. Improving awareness of these events is essential to enabling proactive outreach and prevention.

To address this gap, VA is exploring the use of electronic notification (eNotification) services that provide near real-time alerts for Admission, Discharge, and Transfer (ADT) events occurring in community settings. Market research conducted by VA indicates that no single vendor provides sufficient national coverage across all relevant care settings. As a result, a solution that leverages multiple notification networks is necessary to achieve targeted/adequate coverage and ensure comprehensive visibility into Veteran care events.

This pilot will support up to six (6) VA Medical Centers (VAMCs) and a defined population of Veterans identified as high-risk. VA will provide a Veteran attribution list, that will be updated periodically, to enable targeted notification delivery. Notifications will be transmitted via Direct Secure Messaging (DSM) infrastructure, through the Oracle Health’s Health Information Service Provider (HISP), into VA Direct Secure Messaging (DSM) inboxes, leveraging existing infrastructure without requiring direct integration with VA clinical systems. The objective of the pilot is to assess the effectiveness, timeliness, and operational impact of eNotification services in improving care coordination and supporting suicide prevention efforts.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act (FISMA) of 2014”

2. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended

3. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

4. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R.

Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

5. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

6. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

7. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

8. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

9. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

10. OIT Process Asset Library (PAL), OIT Process Asset Library.

11. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

12. VA Directive 6508, “Implementation of Privacy Threshold Analysis and

Privacy Impact Assessment,” October 15, 2014

13. VA Directive 6510, “VA Identity, Credential and Access Management,”

September 3, 2024

14. VA Handbook 6510, “VA Identity, Credential and Access Management,”

September 27, 2024

15. VA Directive and Handbook 6513, “Secure External Connections,” October

12, 2017

16. VA Directive 6300, “Records and Information Management,” September 21,

17. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

18. NIST SP 800-37 Rev 2, “Risk Management Framework for Information

Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

19. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020) https://digital.va.gov/process-asset-library/ https://www.va.gov/trm/TRMHomePage.aspx

20. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

21. Social Security Number (SSN) Fraud Prevention Act of 2017

22. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23,

23. Executive Order 14028, “Executive Order on Improving the Nation's

Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

24. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

25. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

26. Health Level 7 (HL7) version 2.x Messaging Standard, Health Level Seven International https://www.hl7.org/implement/standards/index.cfm?ref=nav

27. Direct Project, Applicability Statement for Secure Health Transport https://directtrust.org/standards/the-direct-standard/versions

28. DirectTrust, Security and Trust Framework https://accreditation.directtrust.org/

29. Federal Risk and Authorization Management Program (FedRAMP), Security Assessment Framework https://www.fedramp.gov/frameworks/

30. Federal Risk and Authorization Management Program (FedRAMP), Baseline Security Controls https://fedramp.gov/baselines

31. VA Enterprise Cloud (VA EC), Cloud Computing Guidance https://www.oit.va.gov/services/cloud

3.0 SCOPE OF WORK

The Contractor shall provide and implement an Admissions, Discharge, and Transfer (ADT) eNotifications Software as a Service (SaaS) utilizing multiple existing provider networks already in place to support a VA-defined population of Veterans identified as at-risk across up to six (6) VA Medical Center (VAMCs). The Contractor shall support a VA-defined population of up to approximately 82,000 patients, with attribution data provided and maintained by VA and updated on a quarterly basis. The Contractor shall provide implementation support including configuration, testing, and deployment of the SaaS solution and enable filtering of notifications based on VA-defined criteria, including Veteran/patient association with a home VAMC.

The Contractor shall support the ingestion, processing, and delivery of real-time ADT eNotifications associated with the VA-defined patient population and relevant treatment-related events. The Contractor shall support the secure transmission of eNotifications, using Direct Secure Messaging through VA-approved Health Information Service Provider (HISP) or other VA-approved mechanisms to securely exchange Veteran/patient attribution data with VA. The Contractor shall support coordination https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks https://www.hl7.org/implement/standards/index.cfm?ref=nav https://directtrust.org/standards/the-direct-standard/versions https://accreditation.directtrust.org/ https://www.fedramp.gov/frameworks/ https://fedramp.gov/baselines https://www.oit.va.gov/services/cloud across multiple provider networks to maximize coverage of relevant community care encounters and provide ongoing technical support and systems maintenance throughout the period of performance. The Contractor shall support VA security and privacy requirements, including provision of documentation and activities necessary to achieve and maintain an appropriate security authorization in accordance with VA policies and procedures. This effort is a pilot and shall support evaluation of notifications coverage, timeliness, and effectiveness to inform potential future expansion.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The Period of Performance shall be 12 months from the date of award with one optional task.

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

4.3 TRAVEL

The Government does not anticipate any travel under this effort to perform the tasks associated with the effort. Any required meetings will be held remotely/virtually.

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall provide and perform the following:

5.1 PROJECT MANAGEMENT

5.1.1 KICKOFF MEETING

The Contractor shall conduct a kickoff meeting within five business days after award.

The Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and implementation schedule. The Contractor shall provide an agenda at least two business days prior to the kickoff meeting and minutes within two business days following the meeting. The Contractor shall invite the Contracting Officer (CO), Contract Specialist (CS), Contracting Officer’s Representative (COR), VA Program Manager and others to be identified post-award. Subsequent weekly meetings will be held until the service is ‘turned on’ then bi-weekly three weeks following enablement.

Deliverables:

A. Kickoff Meeting Agenda B. Kickoff Meeting Minutes

5.2 ADMISSIONS, DISCHARGE AND TRANSFER (ADT) ELECTRONIC

NOTIFICATION SERVICE

5.2.1 ADT SERVICE REQUIREMENTS

The Contractor shall provide and implement a SaaS solution for Admissions, Discharge and Transfer (ADT) eNotifications. The eNotification SaaS shall include functionalities related to admissions, discharges, transfers, real-time alerts, and data synchronization.

The eNotification SaaS shall provide real-time notifications to the patient’s respective VAMC ensuring seamless data exchange and communication between the different healthcare entities. This eNotification SaaS shall also include the ability to set up rules and filters to manage the flow of data and ensure that only relevant notifications are sent.

This is a pilot program that includes up to six (6) VAMC’s- Charles George VA Medical Center (Asheville, NC), Columbus VA Health Care System, West Texas VA Health Care System (Big Spring, TX), Texas Valley Costal Bend Health Care System (Harlingen, TX), Jesse Brown VA Medical Center (Chicago, IL), Northern Arizona VA Health Care System (Prescott, AZ) – and a VA-defined Veteran population of up to approximately 82,000 patients (NTE 82K). The Contractor shall provide automated notifications for events associated with the VA-defined patient population, including but not limited to emergency department visits, inpatient admissions, discharges, and transitions of care.

On a quarterly basis or as needed, VA COR will securely provide a Patient Roster (e.g.

spreadsheet) for a selected group of Veterans from each of the above named VAMC’s.

The Patient Roster shall include Identifying information, home VAMC assignment, and Direct Messaging addresses associated with the VA designated endpoints. VA retains full ownership of all data, including data provided in the Patient Roster and any data generated through the use of the eNotification SaaS.

The Contractor shall ingest and maintain VA-provided Patient Roster within the SaaS solution and utilize it to perform patient matching and attribution against incoming notification data using industry standard matching techniques. The Contractor shall apply VA-defined filtering criteria to ensure that only notifications relevance to the authorized veteran population and defined use cases are transmitted. The Contractor shall ensure that notifications are formatted in a consistent and usable manner to support VA operational workflows. The Contractor shall not transmit notifications unrelated to the VA defines patient cohort or outside the defined event criteria. The Contractor shall support ingestion and coordination of notification data from multiple provider networks to maximize coverage of relevant healthcare encounters for patients at risk. The Contractor shall perform deduplication of notifications across all data sources and provider networks prior to delivery to VA designated endpoints.

The Contractor shall support the secure transmission of eNotifications, using Direct Secure Messaging through VA-approved HISP services to VA's Direct Messaging System (DSM). The Contractor shall ensure that notification volume, frequency, and formatting are managed to prevent overload of the VA DSM endpoints.

The Contractor shall support the secure exchange of Patient Roster data using VA-approved mechanisms, including DSM or Secured File Transfer Protocol (SFTP), as directed by VA based on data size and operational considerations. The Contractor shall ensure all data exchanges comply with applicable privacy and security requirements, including HIPAA, to include encryption of Data-in-Transit (DIT) and Data-at-Rest (DAR) and maintain audit logs of the data access and modification.

The Contractor shall configure notification rules, filtering, and routing based on VA-defined criteria and VAMC-specific requirements and shall update configurations at the request of the VA Project Manager (PM).

The Contractor shall provide an Implementation Plan. This plan shall include detailed requirements analysis, identification of required data elements, a plan and timeline for deployment, the verification plan for successful deployment, documented Incident Response Plan (IRP) in the event of a data breach, and procedures for secure data retention and disposal. The Contractor shall be responsible for the processing and delivery of notifications to VA-designated endpoints and for ensuring successful transmission to those endpoints in accordance with the requirements of this PWS.

Deliverable:

A. ADT Notification Service supporting up to 82,000 patients across participating VAMCs

B. Implementation Plan

5.2.2 SAAS SECURITY AND AUTHORIZATION REQUIREMENTS

The Contractor shall demonstrate, at time of award, existing security authorization or comparable evidence of compliance with Federal and VA security requirements sufficient to support deployment within the period of performance. Acceptable evidence may include an active FedRAMP authorization, an VA Authority to Operate (ATO), or equivalent security documentation and controls demonstrating alignment with VA security requirements. Solutions that require substantial development of security authorization artifacts or initiation of a new authorization process after award may be deemed unacceptable.

5.2.2.1 If the solution is not FedRAMP authorized:

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA).

2. The Contractor shall comply with FedRAMP requirements HIGH as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The Contractor shall provide a SaaS product as defined by the following criteria:

Software as a Service (SaaS) is an application delivery model in which the application is hosted on a cloud infrastructure outside the security boundary of VA and is provided to the Cloud Service Customer (CSC) over the internet. The CSC uses the SaaS offering via a thin-client interface, such as a web-browser or a program interface. The CSC subscribes to the SaaS offering and is only responsible for minor in-app customizations. The Cloud Service Provider (CSP) offering the application is responsible for management of the application, safeguarding of data stored or processed by the application, and all elements of the underlying infrastructure. Additionally, the CSP is responsible for all on-going compliance.

In order to qualify as SaaS for use at VA, and to align with Federal Risk and Authorization Management Program (FedRAMP) requirements, the hosting for the offering must conform to the NIST 800-145 definition of Cloud Computing and thus contain following key characteristics:

• On-Demand Self-Service: The CSP fully automates the provisioning of both the customer interface and the underlying cloud components of the SaaS offering. In https://www.fedramp.gov/agency-authorization/ https://www.fedramp.gov/agency-authorization/ some cases, to the CSP may provision internal resources manually, while providing the CSC an automated interface to request and track the service.

• Broad Network Access: The SaaS capabilities are available over the internet or over a network that is available from all access points the CSC requires. The SaaS offering is accessible through common platforms (e.g., mobile phones, tablets, laptops, and workstations).

• Resource Pooling: The computing infrastructure supporting the SaaS offering is shared among more than one CSC using a multi-tenant model, and resources are dynamically assigned depending on customer demand.

• Rapid Elasticity: Computing capabilities are automatically provisioned and released in a manner that scales with customer demand. In some cases, the scaling of resources may not be fully automated, but it should be fast enough to support the needs of the CSC, which the CSC would have to define.

• Measured Service: Resource usage, such as storage, processing, bandwidth, and user activity are measured and reported on in a manner that is relevant to the SaaS offering.

4. Following guidance from the Federal CIO, VA will utilize existing JAB ATO or agency

ATO issued by another agency as a starting point for FedRAMP requirements. If neither of those exist, VA will sponsor The Cloud Service Provider for a FedRAMP Authorization. VA will be using the FedRAMP baselines as a starting point, since they are specifically tailored for cloud services.

5. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application at the impact level required by VA to utilize the product. For this solution the required impact level is: HIGH

6. The Contractor shall comply with FedRAMP requirements surrounding data location within the Continental United States. FedRAMP specifies data location requirements in the High Baseline as part of control SA-9 (5); however, FedRAMP does not provide or specify data location requirements for other baselines.

7. The Contractor shall complete a FedRAMP System Security Plan (SSP) and supporting documentation including required attachments within 94 calendar days after contract award.

8. The Contractor shall work with a VA DTC Subject Matter Expert to develop a specific system boundary diagram including any integration and connectivity components for VA use. This will be known as the VA Implementation Diagram (VAID) and will demonstrate the proposed implementation of this system at VA. The Contractor shall complete this deliverable with VA within 10 calendar days of contract award.

9. The Contractor shall complete a Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) within 113 calendar days after contract award.

10. The Contractor shall complete a 3PAO Security Assessment Report (SAR) within

113 calendar days after the SSP is accepted by VA.

11. The Contractor shall work with VA Subject Matter Experts to test the validity of the Incident Response Plan (IRP) and ensure proper troubleshooting of issues that may arise. This should be completed within 30 calendar days of the SSP being delivered.

12. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases.

13. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with Addendum B, VA Information, and Information System Security/Privacy Language.

14. The Contractor shall comply with data management requirements.

15. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

16. The Contractor shall participate in FedRAMP Continuous Monitoring activities as outlined by FedRAMP’s Continuous Monitoring Strategy Guide found on the FedRAMP website.

17. The Contractor shall participate in monthly Agency and FedRAMP Sustainment meetings following the granting of a VA ATO.

18. The Contractor shall provide continuous monitoring activities including, but not limited to scans, security artifacts, and monthly Plan of Action and Milestones (POAM) reports as outlined by VA and FedRAMP requirements.

19. The Contractor shall provide a monthly inventory report of VA sites currently utilizing the cloud product post ATO award. The inventory report will include the number of licenses being utilized and the specific VA site.

Deliverables:

A. FedRAMP System Security Plan (SSP) and required Attachments B. VA Implementation Diagram C. 3PAO Security Assessment Plan (SAP) D. 3PAO Security Assessment Report (SAR)

E. Plan of Action and Milestones Monthly Reports.

F. Monthly Inventory Report

5.2.2.2 IF THE SOLUTION IS FedRAMP AUTHORIZED BUT NOT VA AUTHORIZED:

Federal Information Security Management Act (FISMA)

2. The Contractor shall remain in compliance with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The system must be FedRAMP Authorized at no less than the HIGH

4. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application.

5. The Contractor shall provide confirmation of the completion of its FedRAMP

System Security Plan (SSP) and supporting documentation by providing, to the VA PM, COR, and DTC, its repository ID number and associated link for VA to download the SSP and all required artifacts within five calendar days of contract award.

6. The Contractor shall work with a VA DTC Subject Matter Expert to develop and provide a VA specific system boundary diagram including any integration and connectivity components for VA use. This will be known as the VA Implementation Diagram (VAID) and will demonstrate the proposed implementation of this system at VA.

7. The Contractor shall provide the results of their most recent Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP).

8. The Contractor shall complete a 3PAO Security Assessment Report (SAR).

9. The Contractor shall provide VA with the most recent monthly scans for the production environment within the authorization boundary and their scan upload schedule for FedRAMP within 30 calendar days of contract award.

10. The Contractor shall provide their availability to participate in monthly continuous monitoring meetings to be scheduled following successful VA ATO within 30 calendar days of contract award.

11. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall bring the situation to the attention of the other party within one hour in accordance with Addendum B, VA Information and Information System Security/Privacy Language.

12. The Contractor shall comply with FedRAMP data management requirements.

13. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

14. The Contractor shall participate in FedRAMP Continuous Monitoring activities as

15. outlined by FedRAMP’s Continuous Monitoring Strategy.

16. The Contractor shall participate in monthly Agency and FedRAMP Sustainment meetings following the granting of a VA ATO.

17. The Contractor shall provide continuous monitoring activities including, but not limited to scans, security artifacts, and provide Continuous Monitoring Monthly Scans and monthly Plan of Action and Milestones (POAM) reports as outlined by VA and FedRAMP requirements.

18. The Contractor shall provide a Monthly VA License Report of VA sites currently utilizing the cloud product post ATO award. The license report shall include the number of subscription licenses being utilized and the specific VA site where they’re in use.

A. VA Implementation Diagram B. 3PAO Security Assessment Plan (SAP) C. 3PAO Security Assessment Report (SAR) D. Plan of Action and Milestones Reports E. Monthly VA License Report

5.2.2.3 IF THE SOLUTION IS FedRAMP AUTHORIZED AND VA AUTHORIZED:

Federal Information Security Management Act (FISMA) and have a current VA authorization.

2. The Contractor shall remain in compliance with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The FedRAMP Authorization level and existing VA ATO should be no less than the level required for this use case which has been defined as HIGH

4. The Contractor shall, where applicable, assist with the VA ATO Sustainment Process to help maintain health and quality of agency authorization of the cloud service or migrated application.

5. The Contractor shall exclusively provide subscription licenses to FedRAMP authorized and VA authorized environments.

6. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall bring the situation to the attention of the other party within one hour in accordance with Addendum B, VA Information and Information System Security/Privacy Language. VA Privacy and Security deliverables as directed by the VA System owner.

7. The Contractor shall comply with FedRAMP data management requirements.

8. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

9. The Contractor shall participate in FedRAMP Continuous Monitoring activities as outlined by FedRAMP’s Continuous Monitoring Strategy Guide found on the FedRAMP Website.

10. The Contractor shall provide continuous monitoring activities including, but not limited to, scans, security artifacts, and provide Continuous Monitoring Monthly Scans and monthly Plan of Action and Milestones (POAM) reports as outlined by FedRAMP requirements.

11. The Contractor shall participate in monthly Agency and FedRAMP Sustainment meetings following the granting of a VA ATO.

12. The Contractor shall provide a Monthly VA License report of VA sites currently utilizing the cloud product post ATO award. The license report shall include the number of subscription licenses being utilized and the specific VA site where they’re in use.

A. Continuous Monitoring Monthly Scans B. Plan of Action and Milestones Reports.

C. Monthly VA License Report

5.2.3 SECURE FILE TRANSFER PROTOCOL (SFTP)

The Contractor shall provide Secure File Transfer Protocol (SFTP) and support other VA approved secure data exchange mechanisms, including Direct Secure Messaging (DSM), for sharing of the patient roster and securely exchanging patient information between the VA and other entities, as directed by VA. This process ensures that sensitive data is transferred in a secure, encrypted manner, minimizing the risk of data breaches or unauthorized access.

All secure data exchange mechanisms utilized under this contract for the exchange of VA information shall employ strong encryption standards (e.g., AES-256), for both data in transit and at rest, in compliance with all regulations and standards, such as HIPAA, VA data security guidelines, and latest Federal Information Processing Standards (FIPS) 140-3, detailed in Section 2.0 of this PWS. The solution shall maintain comprehensive audit trails logging all file transfer activities, including user access to VA data, data transmission, and any modifications, as applicable to the exchange method.

The SFTP service must maintain availability of 99.9% uptime to ensure continuous data exchange and be compatible with existing VA systems and workflows. The Contractor shall coordinate with VA to establish, test, validate, and maintain secure data exchange capabilities prior to operational use.

Deliverable:

1. Data Exchange Validation Confirmation

5.2.4 MONITORING, TECHNICAL SUPPORT AND MAINTENANCE

The Contractor shall provide ongoing monitoring, technical support and maintenance for the ADT eNotification Service to ensure reliable and effective operation.

The Contractor shall regularly monitor the performance of the ADT eNotification service to ensure it meets the needs of the VAMCs and identifying any areas for improvement.

Status and recommendations shall be included in the Monthly Report from Section 5.1.4 of this PWS.

The Contractor shall track and provide metrics of performance in an ADT System Metrics Report and shall report metrics related to messages sent to VA by community provider, message type, and VAMC location. The Contractor shall also track and report on message delivery status, including successful transmissions, delays, and failures, as well as overall system performance and availability. The Contractor shall also provide metrics related to the effectiveness of filtering and deduplication processes, including identification of duplicate messages prevented and filtering outcomes based on VA-defined criteria.

This report shall be in a spreadsheet format or similar existing reports formats and shall be filterable with the following criteria:

• Number of messages sent to VA by VAMC (including time/date, patient identifier)

• Number of messages sent by message type (i.e., admission, discharge) with time/date

• Messages sent to VAMC by partner name/domain name

• Message delivery status (e.g. successful, delayed, failed)

All metrics shall include a summary and detailed information per patient (e.g., VAMC, partner name, event type, and timestamp). This report shall be delivered weekly for the first 90 days after implementation has been initiated with the option to transition to biweekly or monthly thereafter, as determined by VA. If patient information is included in the report, the report will be shared using VA-approved secure data exchange mechanisms.

The Contractor shall provide technical support and maintenance to the VAMC’s and the

PM. Any technical issues or interruptions in service reported by the VA PM shall be acknowledged within 1 hour and resolved in accordance with mutually agreed-upon service levels based on severity. The Contractor shall notify VA of any system outages, degradation in performance, or data exchange issues that may impact operations.

The Contractor shall also perform regular maintenance including software updates, patches, and security updates, to ensure continued performance and compliance. All maintenance performed and technical issues shall be detailed in the Monthly Report from Section 5.1.4 of this PWS.

Deliverables

ADT System Metrics Report

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 VA TECHNICAL REFERENCE MODEL

The Contractor shall comply with the VA OIT Technical Reference Model (VA TRM).

Compliance with the VA TRM is achieved by using only technologies and standards that are listed as approved for use in the VA TRM. The Contractor shall provide all necessary information requested by VA to ensure TRM approval is obtained prior to use on VA’s network.

ALT. The Contractor shall ensure that any components or technologies that interface directly with VA systems or are deployed within the VA network environment comply with VA OIT Technical Reference Model (VA TRM), as applicable. The Contractor shall provide information, as requested by VA, to support review of technologies interacting with VA systems.

6.1.2 ZERO TRUST – VA CRITICAL SECURITY CONTROLS

VA has established minimum mandatory security requirements and requires that any network connected software system or service must meet the VA Critical Security Controls as outlined in the VA Memorandum, “VA Security Controls”, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010. VA Critical Security Controls identify the minimum mandatory requirements that must be implemented across all VA enterprise infrastructure, cloud computing environments, information systems, networks, and specialized devices (medical devices/systems, special-purpose systems, and research scientific computing devices) that process, store, and/or transmit VA data. Effective July 1, 2025, the Contractor shall implement these VA Critical Security Controls, within any network connected software system or service prior to being authorized for use in the VA. This functional requirement is not negotiable, and Plan of Action & Milestones (POAM) will not be accepted in the event these controls cannot be implemented for new systems. Critical Security Controls are intended to increase VA’s security posture and provide security and privacy risk visibility into the VA network and is not a new requirement. The Contractor’s failure to maintain these VA Critical Controls after implementation will result in VA discontinuing the use of the system.

The Contractor shall support VA Zero Trust and security requirements as applicable to systems that process, store, or transmit VA data. Fr any components that directly connect to or operate within the VA network environment, th Contractor shall comply with applicable VA Critical Security Controls as outlined in the VA Memorandum, “VA Security Controls.”

For externally hosted SaaS solutions, the Contractor shall implement security controls and practices that provide equivalent protection of VA data and support VA security requirements for external connections and data exchanges. The Contractor shall cooperate with VA to demonstrate implementation of applicable security controls as required for authorization and ongoing operation.

6.1.3 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT

(FICAM)

https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Architecture (EA), and VA Identity and Access Management (IAM) approved Enterprise Technology Guidelines (ETG). The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in Executive Order 14028, VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program, CISA Binding Operational Directive 23- 01, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500, and VA IAM enterprise requirements for direct, assertion-based authentication, and/or trust based authentication, as determined by the ETGs. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-05-24, M-19-17, M-22-09, and NIST Federal Information Processing Standard (FIPS) 201-3. Contractor delivered applications and systems shall be on the FIPS 201 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Person Index (MPI) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable Technology Guideline as outlined in VA ETG.

https://www.ea.oit.va.gov/ https://www.ea.oit.va.gov/ https://digital.va.gov/office-of-information-and-technology/reference-library/enterprise-technology-guidelines/ https://digital.va.gov/office-of-information-and-technology/reference-library/enterprise-technology-guidelines/ https://bidenwhitehouse.archives.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2005/m05-24.pdf https://bidenwhitehouse.archives.gov/wp-content/uploads/2019/05/M-19-17.pdf https://bidenwhitehouse.archives.gov/wp-content/uploads/2022/01/M-22-09.pdf

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion-based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

10. Role Based Access Control.

11. Auditing and reporting capabilities.

12. Compliance with VIEWS 00155984, PIV Logical Access Policy Clarification https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896.

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

6.1.4 INTERNET PROTOCOL VERSION 6 (IPv6)

The Contactor Solution shall be capable of supporting applicable Internet Protocol

Version 6 (IPv6) requirements in alignment with Office of Management and Budget

(OMB) memorandum M-21-07 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf) and related Federal guidance, including the NIST

USGv6 program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1) as well as NIST Special Publication 500-267B Revision 1

(https://doi.org/10.6028/NIST.SP.500-267Br1) and NIST SP 800-119 “Guidelines for the

Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119). For any

Contractor delivered applications interfaces or services that directly connect or are accessed through VA network environments, this solution shall not preclude future operation in IPv6-only or dual stack IPv6/IPv4 environments, as directed by VA. For externally hosted SAS components, IPv6 capability shall be supported for applicable public-facing access points and integrated interfaces when required for VA implementation. The Contractor shall provide information upon request regarding the solution’s IPv6 readiness and any dependencies necessary to support future VA transition planning.

6.1.5 TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 “Secure External Connections”, and shall comply with the TIC 3.0 Core Guidance Documents as applicable to the solution architecture and external connectivity model. The Contractor shall cooperate with VA in documenting and implementing secure external connection patterns necessary to support the service.

https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1 https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1 https://doi.org/10.6028/NIST.SP.500-267Br1 https://doi.org/10.6028/NIST.SP.800-119 https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf

6.1.6 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT

LINE MANAGEMENT (PLM)

The Contractor shall support VA governance, oversight, reporting, and delivery activities in accordance with the Veteran-Focused Integration Process (VIP) Guide and applicable Product Line Management practices including https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946. The Contractor shall provide timely information by VA related to schedule, risk, dependencies, milestones, deliverables, and operational readiness to support VA governance and reporting requirements. The Contractor shall coordinate with VA product line leadership, program management, and other designated stakeholders to support successful planning, implementation, and sustainment of the service.

6.1.7 PROCESS ASSET LIBRARY (PAL)

The Contractor shall perform their duties consistent with the processes defined in the OIT Process Asset Library (PAL). The PAL includes a spectrum of OIT functions and activities, such as project management, operations, service delivery, communications, acquisition, and resource management. PAL serves as an authoritative and informative repository of searchable processes, activities or tasks, roles, artifacts, tools and applicable standards and guides to assist the OIT workforce, Government and Contractor personnel. OIT utilizes PAL processes to ensure compliance with policies and regulations and to meet VA quality standards. The PAL includes the contractor onboarding process consistent with Section 6.2.2 and can be found at process_CONB_ext.docx (live.com). The main PAL can be accessed at www.va.gov/process.

6.1.8 AUTHORITATIVE DATA SOURCES

The VA Enterprise Architecture Repository (VEAR) is one component within the overall EA that establishes the common framework for data taxonomy for describing the data architecture used to develop, operate, and maintain enterprise applications. The Contractor shall comply with the department’s Authoritative Data Source (ADS) requirement that VA systems, services, and processes throughout the enterprise shall access VA data solely through official VA ADSs where applicable, see below. The Information Classes which compose each ADS are located in the VEAR, in the Data & Information domain. The Contractor shall ensure that all delivered applications and system solutions support:

1. Interfacing with VA’s Master Person Index (MPI) (formerly the Master Veteran Index (MVI)) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946 https://view.officeapps.live.com/op/view.aspx?src=https%3A%2F%2Fdigital.va.gov%2Fprocess-asset-library%2Fwp-content%2Fuploads%2Fsites%2F16%2F2024%2F04%2Fprocess_CONB_ext.docx&wdOrigin=BROWSELINK http://www.va.gov/process

2. Interfacing with Capital Asset Inventory (CAI) to conduct real property record management actions, if the solution relies on real property records data. CAI is the authoritative source for VA real property record management data.

3. Interfacing with electronic Contract Management System (eCMS) for access to contract, contract line item, purchase requisition, offering vendor, and solicitation information above the micro-purchase threshold, if the solution relies on procurement data. ECMS is the authoritative source for VA procurement actions data.

4. Interfacing with HRSmart Human Resources Information System to conduct personnel action processing, on-boarding, benefits management, and compensation management, if the solution relies on personnel data. HRSmart is the authoritative source for VA personnel information data.

5. Interfacing with VA Profile to access personal contact information, if the solution relies on VA Veteran personal contact information data. VA Profile is the authoritative source for VA Veteran Personal Contact Data.

6. Interfacing with VA/Department of Defense (DoD) Identity Repository (VADIR) for determining eligibility for VA benefits under Title 38, if the solution relies on qualifying active duty military service data. VADIR is the authoritative source for qualifying active duty military service in VA.

7. Interfacing with VA Systems Inventory (VASI) to access VA systems information, if the solution relies on VA system information. VASI is the authoritative source for VA Information Technology systems.

8. Interfacing with Enterprise Mission Assurance Support Service (eMASS) to access the Authority to Operate (ATO) status of all VA Information Systems.

eMASS contains the official Authority to Operate (ATO) status of all VA Information Systems.

6.1.9 SOCIAL SECURITY NUMBER (SSN) REDUCTION

The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail.