RFI_DRAFT_PWS_PATS-R.docx

Patient Advocate Tracking System – Replacement (PATS-R) Enhancement and Sustainment Contract

VA-27-00003376

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology (OIT) Product Delivery Service (PDS) Veteran Experience Services (VES)

Patient Advocate Tracking System – Replacement (PATS-R) Enhancement and Sustainment Contract

Date: July 17, 2026

VA-27-00003376

PWS Version Number: 1.0

Contents

BACKGROUND

The Patient Advocate Tracking System – Replacement (PATS‑R) is a mission‑critical Veteran Health Administration (VHA) case management and patient experience system that supports the Department of Veterans Affairs (VA) in addressing, tracking, and resolving inquiries, complaints, and compliments submitted by Veterans and their families. PATS‑R plays a central role in ensuring that Veterans receive timely assistance and resolution of concerns across all VA medical facilities, consistent with statutory requirements under the Patient Advocate Tracker Act (2022) and other governing public laws and VHA directives.

PROGRAM OVERVIEW

PATS‑R is a Microsoft Dynamics 365–based Platform‑as‑a‑Service / Software‑as‑a‑Service (PaaS/SaaS) solution operated within the VA‑managed cloud architecture and supported by the Office of Information & Technology (OIT), Product Delivery Service (PDS). The platform is managed and hosted by the OIT Digital Transformation Center (DTC), which provides the shared delivery infrastructure for Dynamics applications across VA.

PATS‑R serves more than 28,000 Patient Advocates and clinical/service line staff across more than 150 VA Medical Centers (VAMCs) and Community‑Based Outpatient Clinics (CBOCs). The system is used to capture, document, and manage Veteran‑submitted concerns received through multiple entry points, including in‑person engagement, telephone, email, secure messaging, internet submissions, mail, and congressional inquiries. It enables Patient Advocates to route cases, coordinate care, communicate with Veterans, document actions taken, and ensure issues are resolved in a timely, transparent, and accountable manner.

PATS‑R is classified as a high‑visibility, enterprise‑wide operational system central to VA’s ability to deliver effective patient advocacy services. As a system of record for VHA case management activities, PATS‑R requires high availability to prevent delays in addressing critical Veteran concerns—particularly those related to communication breakdowns, missed appointments, care coordination, and community care issues. Unplanned downtime or system failures directly impede the VA’s ability to meet mandated timeframes and can result in unmet medical needs for individual Veterans.

The PATS‑R solution is fully integrated with several enterprise VA systems that supply identity, demographic, eligibility, clinical, and communications data, including Veterans Experience Integration Solution (VEIS) middleware, Master Person Index (MPI), VA Profile, Health Data Repository (HDR), Joint Electronic Health Record System (JEHRS)/(Oracle Health), Enrollment System Redesign (ESR), AskVA (AVA), CommCare, the VA Hotline/Customer Experience Service Recovery Platform (CX SRP), V‑Signals, Patient Centered Management (PCMM), and the Customer Experience Data Warehouse (CXDM) as part of the Summit data ecosystem.

The PATS‑R program leverages Agile and DevSecOps practices, enabling iterative delivery, rapid feedback loops, and continuous security integration throughout development and operations. A lean, incremental approach allows the system to evolve responsively based on user needs, regulatory requirements, and emerging mission priorities. These modern engineering practices support continuous improvement, operational stability, and reduced deployment risk for a platform essential to timely Veteran issue resolution.

This effort requires Contractor support for ongoing Operations and Maintenance (O&M), sustainment, and continuous application enhancements to ensure uninterrupted availability and the continued modernization of the PATS‑R system.

PROBLEM WE ARE TRYING TO SOLVE

The PATS‑R system is essential for providing rapid, accurate, and coordinated responses to Veteran concerns across all Veterans Integrated Service Network (VISNs). Each delayed, stuck, or missed case has a direct, real‑world impact on Veterans’ access to care and services. This effort will strengthen program stability and reduce operational risk by providing continuous, dedicated support for the PATS‑R case management platform. The Contractor will ensure system reliability, maintain integrations, address defects, support ongoing modernization, and enable VHA Patient Advocates to effectively meet mandated timelines and service expectations.

ADDITIONAL CONSIDERATIONS IN THE PROBLEM SPACE

Given PATS‑R’s role in supporting VA’s patient advocacy mission, several factors must inform the Contractor’s approach:

· Sensitive Veteran data and high visibility of case outcomes require disciplined change management with minimal downtime tolerance.

· System reliability is critical because each unresolved case represents a Veteran with an unmet medical, administrative, or care‑coordination need.

· PATS‑R must integrate seamlessly with multiple enterprise systems for identity, clinical, and communication data.

· The application must support continuous DevSecOps delivery and comply with multiple governing public laws, including the Mission Act, Patient Advocate Tracker Act, and relevant VHA directives.

· User experience is critical given a nationwide base of more than 28,000 Patient Advocates and clinical users operating in fast‑paced care environments.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

3. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

4. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022

6. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and Information Technology Act of 2006, as amended, Title IX, Information Security Matters

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

10. VA Directive 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/index.cfm

11. VA Handbook 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/index.cfm

12. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

13. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended

14. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

15. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”, as amended

16. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

17. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”, VA Notice 25-16, dated September 15, 2025, “Amending VA Handbook 6500 to Replace Enterprise Mission Assurance Support Services Tool With Office of Information Technology Governance Risk Compliance Tool, and VA Notice 25-17, dated September 22, 2025, “Rescission Of Office Of Information Security (OIS) Deputy Assistant Secretary (DAS) Memorandum – Requirements of Proper Plan of Action and Milestones (POA&M) Completion)

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

24. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

25. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018 (see VA NOTICE 25-10, dated June 9, 2025, “Use of Personally Owned Mobile Devices Policy Amendment of Department of Veterans Affairs Handbook 6500.10”, and VA Notice 25-15, dated August 22, 2025, “Update to VA Handbook 6500.10 Mobile Device Security Policy”)

26. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

27. OIT Process Asset Library (PAL), OIT Process Asset Library.

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

30. VA Directive 6510, “VA Identity, Credential and Access Management,” September 3, 2024

31. VA Handbook 6510, “VA Identity, Credential and Access Management,” September 27, 2024

32. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

33. VA Directive 6300, “Records and Information Management,” September 21, 2018

34. VA Handbook, 6300.1, “Records Management Procedures, “ March 24, 2010

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access, “ June 2018

44. NIST SP 800-63 Rev 4, 800-63A-4, 800-63B-4, 800-63C-4, “Digital Identity Guidelines,” August 1, 2025

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

47. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

49. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

50. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

51. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

52. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L. 110–140), December 19, 2007

53. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005

54. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

55. Executive Order 14148, “Initial Rescissions of Harmful Executive Orders and Actions,” dated January 20, 2025

56. VA Directive 0057, “VA Environmental Management Program,” October 25, 2022

57. OIS VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

58. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

59. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

60. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

61. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

62. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

63. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

64. Social Security Number (SSN) Fraud Prevention Act of 2017

65. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

66. C.F.R Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”, as amended

67. Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

68. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

69. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

70. OMB M-26-05, “Adopting a Risk-based Approach to Software and Hardware Security,” January 23, 2026

71. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27, 2021

72. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December 2014

73. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02: Vulnerability Remediation Requirements for Internet-Accessible Systems | CISA

74. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

75. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

76. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

77. E.O. 13960, “Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government,” December 3, 2020

78. E.O. 14319, “Preventing Woke AI in the Federal Government,” July 23, 2025

79. OMB Memorandum M-25-21, “Accelerating Federal Use of AI through Innovation, Governance, and Public Trust,” April 3, 2025

80. OMB Memorandum M-25-22, “Driving Efficient Acquisition of Artificial Intelligence in Government,” April 3, 2025

81. OMB Memorandum M-26-04, “Increasing Public Trust in Artificial Intelligence (AI) Through Unbiased AI Principles,” December 11, 2025

SCOPE OF WORK

OVERVIEW

This requirement is for Contractor support for the ongoing operations, maintenance, and modernization of PATS‑R. The Contractor shall provide one unified delivery team responsible for both application development and Operations & Maintenance (O&M). The team shall be proficient in Microsoft Dynamics 365 platform technologies and skilled in Scaled Agile Framework (SAFe), lean delivery, and DevSecOps practices.

The unified team will perform all product development, enhancements, testing, User Experience / Human-Centered Design (UX/HCD) activities, integration support, modernization efforts, and Tier 4 O&M sustainment, ensuring uninterrupted case management operations and rapid response to production issues. All specific tasks and deliverables are defined in Section 5.0.

DEVELOPMENT METHODOLOGY AND WORKING PRINCIPLES

The Contractor’s work shall align with Agile, Lean, and DevSecOps principles and the Digital Services Playbook (https://playbook.cio.gov). All processes, engineering practices, and delivery approaches shall support rapid, iterative, and secure deployment of high‑quality digital services using Continuous Integration / Continuous Delivery (CI/CD) pipelines and automated testing.

The Contractor shall:

1. Deliver high‑quality, functional products based on continuous user feedback, research, and operational insights from Patient Advocates and VHA stakeholders.

2. Use Agile delivery practices, including sprint planning, daily stand‑ups, sprint reviews, retrospectives, backlog refinement, and estimation.

3. Engage users early and often, incorporating Human‑Centered Design (HCD) methods such as personas, journey maps, prototypes, workflow design, and usability testing.

4. Maintain a consistent, accessible, modern user experience using the VA Design System and VA Content Style Guide.

5. Support personalized and Veteran‑centric service delivery, consistent with federal customer experience policies.

6. Ensure accessible solutions meeting 508 and Web Content Accessibility Guideline (WCAG) standards.

7. Protect Veteran data through embedded DevSecOps security controls, automated scans, and secure development practices.

8. Use CI/CD and DevOps pipelines across development, staging, and production environments to enable rapid, reliable releases.

9. Employ automated testing frameworks for unit, integration, functional, performance, and accessibility testing.

10. Store no sensitive configuration or credentials in code, using encrypted VA‑approved credential management solutions.

11. Deliver all non‑sensitive source code to an open‑source repository consistent with OMB M‑16‑21.

DESIRED OUTCOMES

The success of this effort is measured by PATS‑R’s ability to support timely, coordinated, and accurate resolution of Veteran concerns across all VA facilities.

Desired outcomes:

· PATS‑R is reliable and available at all times for Patient Advocates nationwide.

· Workflows are intuitive, efficient, and reduce administrative friction.

· Enhancements reflect actual user needs, informed by continuous research and feedback.

· Veterans receive timely resolution and effective communication, regardless of issue type or entry channel.

· Existing integrations (MPI, VA Profile, HDR, ESR, JEHRS/Oracle Health, AVA, CommCare, CX SRP, V‑Signals, CXDM, PCMM, etc.) and any new integrations remain stable, accurate, and secure.

Undesired outcomes:

· System outages or performance issues impede case resolution.

· Confusing workflows or system limitations force workarounds.

· Changes are deployed without adequate input from PATS‑R business owner.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The Period of Performance (PoP) shall be 12 months with four 12-month option periods and one optional task. The optional task may be exercised during the base and/or option periods; the overall Period of Performance shall not exceed 60 months.

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

HOURS OF WORK

The Contractor shall be required to attend meetings with Government personnel between standard east coast work hours (typically 8 a.m.-6 p.m. Eastern Time (ET)). Additionally, monitoring and support for production systems shall be required between 7 a.m.-9 p.m. ET, with a 24/7 on-call escalation process codified for urgent issues, as applicable.

PLACE OF PERFORMANCE

Efforts under this TO shall be performed at Contractor facilities, at any location within the United States. All work locations must be able to accommodate the Hours of Work specified in Section 4.2.

TRAVEL

The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Include all estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government.

The total estimated number of trips in support of the program related meetings for this effort is 5 per year, and 25 over the course of this contract. It is expected that up to 8 Contractor team members will participate in each trip. Anticipated locations include the following, estimated at 5 days in duration (accounting for a 4-night stay at the location):

1. Washington D.C.

2. Atlanta, GA

3. Tampa, FL

4. Austin, TX

SECURITY AND PRIVACY

All requirements in Section 6.0 of the PATS-R PWS apply to this effort. Specific TO requirements relating to Addendum B, Section B4.0 paragraphs j and k supersede the corresponding PATS-R PWS paragraphs, and are as follows:

1. The vendor shall notify VA within 24 hours of the discovery or disclosure of successful exploits of the vulnerability which can compromise the security of the Systems (including the confidentiality or integrity of its data and operations, or the availability of the system). Such issues shall be remediated as quickly as is practical, but in no longer than two days.

2. When the Security Fixes involve installing third party patches (such as Microsoft OS patches or Adobe Acrobat), the vendor will provide written notice to VA that the patch has been validated as not affecting the Systems within 10 working days. When the vendor is responsible for operations or maintenance of the Systems, they shall apply the Security Fixes within two days.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall provide one unified cross‑functional team supporting the ongoing modernization, configuration, development, testing, integration, and sustainment of PATS-R. The team shall be proficient in Microsoft Dynamics 365, Power Platform components, Azure cloud services, Agile/SAFe methodologies, Lean practices, and DevSecOps delivery.

All work shall align with VA’s enterprise digital modernization strategy, support reusable service‑based components, and leverage low‑code/no‑code (LCNC) Microsoft tools consistent with PATS‑R’s architecture and OIT PaaS/SaaS standards.

The Contractor shall provide one (1) cross‑functional team responsible for all development and sustainment functions, including:

· Dynamics 365 custom application development

· UI/UX improvements using Human‑Centered Design (HCD)

· Requirements elaboration and system analysis

· Manual and automated testing, including 508 compliance

· Integration development and ongoing integration support

· CI/CD pipeline support and release management

· Defect resolution and backlog refinement

· Application monitoring, diagnostics, and performance optimization

· PATS‑R architecture, configuration, and documentation

· Modernization, optimization, and new capability development

· Proofs of Concept (POCs) and exploration/implementation of AI capabilities

· Participation in Scrum and SAFe Program Increment ceremonies

· Collaboration with DTC, platform partners, vendors, and business stakeholders

· Data migration, data quality, and data management tasks

· Performance testing for major releases and upgrades

· Support, coordination, and assistance User Acceptance Testing (UAT) and Production Validation Testing (PVT)

· Testing support with integration partners and middleware testing

· Continuous improvements to workflows, system usability, reliability, and scalability

The unified team shall also provide Tier 4 support, including:

· Incident triage, investigation, and resolution

· Support during High‑Priority and Critical Priority Incidents (HPI/CPI)

· Coordination with DTC platform support and vendors for production issues

· Release deployment support and environment readiness

· User issue troubleshooting

· Preventive maintenance, monitoring, and incident avoidance

· Any additional PATS‑R sustainment tasks required

All work shall be executed using two‑week Agile sprint iterations. Prior to each sprint, the Contractor shall propose sprint goal(s) that describe the specific work items planned for completion during that iteration. Sprint goal(s) shall be informed by a continuously prioritized backlog and must be approved by the Product Owner before the sprint begins. At the conclusion of each sprint, the Product Manager and Business Owner will assess whether the sprint goal(s) have been met.

PROJECT MANAGEMENT

The Contractor shall provide program management support to ensure all PATS‑R outcomes are achieved. This includes oversight of all delivery activities performed by the unified application development and O&M team, coordination with VA stakeholders, and adherence to VA enterprise policies, governance processes, and compliance requirements.

The Contractor shall provide proactive management of the Microsoft Dynamics 365 SaaS environment used by PATS‑R, including planning, resource alignment, schedule management, risk and issue tracking, dependency management, and cross‑functional coordination with the DTC, OIT Product Delivery Service (PDS), business owners, platform teams, and partner systems.

The Contractor shall ensure compliance with all VA privacy policies, data handling requirements, cybersecurity controls, and security certification processes, including support for Authority to Operate (ATO) activities, audits, continuous monitoring, and remediation of identified findings. Program management shall ensure transparency, timely reporting, and effective communication with Government leadership on progress, risks, and operational impacts throughout the lifecycle of the task order.

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) within 60 days of award that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The Contractor shall update and maintain the VA Product Manager (PM) approved CPMP throughout the PoP.

Deliverables:

A. Contractor Project Management Plan, due within 60 days of award

REPORTING REQUIREMENTS

The Contractor shall provide the PM and Contact Officer Representative (COR) with Monthly Status Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding Month.

The Monthly Status Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue The Monthly Status Report shall also include an itemized list of all documents and electronic deliverables. The Contractor shall monitor performance against the CPMP and report any deviations in the next Monthly Status Report. The Contractor shall ensure regular communication with the VA PM so that issues that arise are transparent to both parties to prevent escalation of outstanding issues. The Contractor shall also provide the data and reporting content to the VA PM to support management level reporting.

Deliverables:

A. Monthly Status Report

PROJECT REPORTING AND STAKEHOLDER ENGAGEMENT ACTIVITIES

The Contractor shall provide a Weekly Status Report to include the Program Brief. The Contractor shall support structured project reporting and recurring stakeholder engagement activities to ensure transparency, alignment, and timely communication of project status, risks, and upcoming work. These activities include the Weekly PATS‑R Status Report Meeting, the Weekly Solutions Modeling Meeting, and other ad hoc coordination sessions as required.

The Contractor shall conduct a weekly PATS‑R Status Report meeting with PATS‑R stakeholders. The purpose of this meeting is to provide insights into the PATS‑R application and address any questions from the Business concerning project progress. Following each meeting, the Contractor shall prepare and distribute the PATS‑R Status Report via email. The report typically includes the PATS‑R development team roster, an overview of overall project status, a review of the PATS‑R project plan, program increment tracking for the current sprint, a summary of epics currently being worked, a description of any large epics in progress, an overview of the backlog, a review of integration errors, a summary of updates to the Risk Register, and comparisons or screenshots of relevant fiscal year reports. These elements may be adjusted at the direction of the VA Program Manager (PM) or Business Owner. This meeting and associated report serve as the basis for the weekly status. The Weekly Status Report shall also include the Program Brief and shall describe all risks and dependencies identified during the previous week, any newly discovered risks or dependencies, and updates on risks and dependencies that were previously documented. Any new risk or dependency must be communicated to the PM within twenty‑four hours of discovery.

The Contractor shall facilitate a weekly Solutions Modeling Meeting to break down key system functionality into actionable and well‑defined user stories. This workshop supports alignment between stakeholders and the development team and ensures that user stories are ready for inclusion in future development cycles. The meeting generally includes a review of high‑level product goals and features, discussion to define the required user stories, prioritization of those user stories based on business and user value, clarification of questions, and identification of next steps. The objectives of this meeting are to create well‑defined user stories with clear acceptance criteria, to ensure stakeholder and development team alignment, and to establish priority sequencing based on business impact and feasibility.

The Contractor may participate in additional ad hoc meetings, including coordination with integration partners and other stakeholders. These meetings support communication and issue resolution as needed. No standard deliverables are associated with these meetings unless specifically directed by the VA PM.

Deliverables:

A. Weekly PATS‑R Status Report

TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after contract award. The Contractor shall coordinate the date, time, and location (can be virtual) with the CO, the VA PM, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft Kickoff Meeting Agenda (via email) to the CO, CS, COR, and VA PM at least five calendar days prior to the meeting. Upon Government approval of the final Kickoff Meeting Agenda, the Contractor shall distribute to all meeting attendees (via email). During the kickoff-meeting, the Contractor shall present Kickoff Meeting Power Point Presentation for review and approval by the Government. The presentation shall include details of the intended approach, work plan, and project schedule for each effort. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting. The Contractor shall submit the final updated Kickoff Meeting Power Point Presentation to the VA PM, CO, CS, and COR for review three calendar days after the meeting. The Contractor shall prepare and distribute the Kickoff Meeting Minutes to the VA PM, CO, CS, COR and all attendees within three calendar days after the meeting.

Deliverables:

A. Kickoff Meeting Agenda B. Kickoff Meeting Power Point Presentation C. Kickoff Meeting Minutes

TRAINING

PRIVACY AND HIPAA TRAINING

The Contractor shall submit Talent Management System (TMS) Training Certificates of completion for VA Privacy and Information Security Awareness and Rules of Behavior and provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”.

Training requirements for elevated permissions are established by VA Handbook 6500.6 and the Electronic Permissions Access System (ePAS).

The Contractor shall ensure that all personnel requesting elevated access complete the mandatory annual TMS Elevated Privileges course (TMS 3867205 – Training for Elevated Privileges for System Access). Personnel must also complete one VA‑approved Role Based Security Training course annually, selected according to the individual’s job role.

Acceptable Role Based Training courses include:

· TMS 1016925 – Information Security Role Based Training for Software Developers

· TMS 1357076 – Information Security & Privacy Role Based Training for System Administrators

· TMS 1357084 – Information Security Role Based Training for Data Managers

· TMS 3197 – Information Security Role Based Training for IT Specialists

· TMS 64899 – Information Security Role Based Training for IT Project Managers

The Contractor shall provide documentation of completed Elevated Permissions training to the COR and shall submit the required training certificates in ePAS when requesting elevated permissions. Elevated permissions will not be granted or maintained without validated completion of both the Elevated Privileges course and the applicable Role Based Security Training. Failure to complete required courses annually will result in expiration of ePAS elevated access.

In addition, the Contractor shall ensure that all personnel complete HIPAA training prior to performing any duties that involve handling, accessing, transmitting, or supporting systems containing Protected Health Information (PHI). HIPAA training shall cover obligations for safeguarding PHI, permitted uses and disclosures, breach prevention and reporting expectations, and the responsibilities of individuals supporting VA systems in accordance with federal privacy regulations and VA policy.

The Contractor shall track the status of training for all individuals engaged on each Level of Effort (LOE) under the contract to include the initial dates of training, and the next required training date. This information shall be submitted as part of the Contractor’s CPMP. The training referenced above is required to be renewed annually.

Deliverable:

A. TMS Training Certificates of Completion for VA Privacy and Information Security Awareness and Rules of Behavior B. TMS Training Certificates of Completion for Elevated Permissions (including TMS 3867205 and the applicable Role Based Security Training certificate) C. TMS Training Certificates of Completion for Privacy and HIPAA Training

SOFTWARE LICENSES MANAGEMENT

The Contractor shall agree that the Government has Unlimited Rights in intellectual property first produced and delivered in the performance of this contract in accordance with FAR 52.227-14, Rights In Data-General (DEC 2007). These unlimited rights include all rights to source code and all documentation created in support of it. The Contractor shall agree that any license rights in any Commercial Computer Software shall be governed by FAR 52.227-19, Commercial Computer Software.

The MS D365 platform and software licenses shall be procured, managed, migrated, modified, and terminated by VA OIT for the PATS-R system project. The Contractor shall coordinate with OIT, other contractors, and vendors as necessary to leverage these software licenses for the benefit of VA and the PATS-R system project.

ONBOARDING

The Contractor shall manage the onboarding of its staff. Onboarding shall include steps to obtain a VA network and email account, complete training, initiate background investigations, and gain physical and logical access, which may include elevated privileges to the necessary development and test environments for the various systems to be enhanced.

A single Contractor Onboarding POC shall be designated by the Contractor who tracks the onboarding status of all Contractor personnel. The Contractor Onboarding POC shall be responsible for accurate and timely submission of all required VA onboarding paperwork to the COR or his/her onboarding designee. The Contractor shall be responsible for tracking the status of all its staff’s onboarding activities.

PRODUCT MANAGEMENT AND OVERSIGHT/KEY PERSONNEL

The Contractor shall provide resources that have the requisite skills and experience required to perform the tasks within the PWS. The Contractor agrees that the personnel identified below, as key to supporting this effort, shall not be removed from the effort, replaced or added without a compelling reason and without written notification to the CO.

The Contractor shall provide Contractor support personnel and subcontractors who have the required educational background, experience, security clearance, and access authorization or combination thereof to meet the labor category descriptions for the required PWS tasks.

If any change to the Key Personnel assigned to the labor categories identified below becomes necessary (initial staffing, substitutions, or additions), the Contractor shall immediately notify the Contracting Office (CO)/Contracting Specialist (CS)/Contracting Officer Representative (COR)/Program Manager (PM) in writing. The proposed replacement personnel shall be of at least substantially equal ability and qualifications as the individual(s) currently performing in that category and that the proposed replacement meets or exceeds the qualifications designated for that Key Personnel position. The substitution or replacement of the personnel shall not occur within the first six months after the date of award.

The Contractor agrees that it has a contractual obligation to mitigate the consequences of the loss of Key Personnel and shall promptly secure any necessary replacements in accordance with (IAW) this PWS section. Failure to replace a member of the Key Personnel pursuant to this clause and without a break in performance of the labor category at issue shall be considered a condition endangering contract performance and may provide grounds for termination for default.

All Contractor team members shall possess demonstrated proficiency in the architecture, interoperability, integration, product delivery, and customization utilizing modern VA tools such as but not limited to Slack, Zenhub, Jira, Confluence, Salesforce, Pega, Fortify, App Insights, Copado, Jenkins, Prometheus, Microsoft Dynamics, Microsoft Power Platform, PagerDuty, and GitHub.

The labor categories below are identified as Key Personnel. Key Personnel must meet the corresponding requirements identified in the Labor Description column below but not limited to (See Independent Government Cost Estimate (IGCE) for full list of personnel needed for enhancements/operations & maintenance work):

• Experience managing full lifecycle IT projects including planning, execution, risk management, dependencies, and delivery.

• Demonstrated ability to manage multi-disciplinary agile teams of at least 10 personnel.

• Expertise in stakeholder communication, reporting, sprint planning, resource allocation, and contract deliverables.

• Communication and coordination of activities between all teams, external and internal clients, and contract stakeholders pertaining to team products and product delivery to end‐users.

• Experience managing projects of at least $1M in size.

• Facilitating Agile ceremonies, backlog refinement, team velocity monitoring, and removing blockers.

• Demonstrated experience coaching development teams on Agile practices.

• Experience working with Jira, Azure DevOps, or equivalent tools.

• Experience implementing scaled Agile frameworks is preferred.

• Experience designing and implementing machine learning models and data pipelines.

• Knowledge of Python ML frameworks (e.g., TensorFlow, PyTorch, Scikit-learn).

• Experience integrating AI components into cloud-based applications.

CAPABILITY DELIVERY LIFECYCLE MANAGEMENT

The Contractor shall follow the core functions of Software Development Lifecycle Management (SDLC) utilizing established agile frameworks, such as the Scaled Agile Framework and other emerging innovative frameworks, in order to deliver a broad range of solutions. The Contractor shall follow a modular software design methodology to provide systems and software engineering, web services development, and software release and change management services. The Contractor shall continuously improve all new and existing solutions by implementing continual configurations, capabilities and enhancements, bug fixes, monitoring, testing and evaluation, business intelligence and application performance monitoring analytics, and support activities, while collaborating closely with the PM throughout the development process and solution delivery lifecycle. The Contractor shall configure, develop, maintain, test, and deploy business and technology feature releases. The Contractor shall adjust deliverables and repository tool updates to match the nature of the capability and/or SDLC frameworks.

The Contractor shall adhere to core design principles, including minimizing custom code; leveraging modular software design; maximizing re-usability, and adherence to VA Policies and standards and governance.

HUMAN CENTERED DESIGN (HCD)

The Contractor shall utilize HCD principles as part of all product development and operations efforts. While engaging in the following HCD activities, the Contractor shall:

1. Follow the United States Digital Service value: “Design with users, not for them.”;

2. Provide expert guidance on UX design direction and strategy; and

3. Create and maintain documentation for all activities, recommendations, and decisions.

User Research

As part of user research, the Contractor shall A. Facilitate discovery activities, to include generative research with users and business stakeholders, an assessment of current related features, a content review, an information architecture review, an accessibility review, a business process review; and collection of any available data and analytics and provide in a User Research Checklist. The following Checklist provides additional details on these requirements: (https://department-of-veterans-affairs.github.io/va-digital-service-handbook/delivery/research-and-discovery/checklist) B. Partner with other VA Product Teams to ensure that the new tool or service fits into the existing structure.

C. Conduct formative and contextually relevant user research studies to understand users’ goals, needs, journeys, and pain points with respect to PATS-R. Apply insights from user research studies to define minimum viable product (MVP) functionality, including epics and user stories, as well as operational, business, functional, technical, data, and integration requirements.

D. As part of the overall product test strategy, conduct routine, iterative usability testing on PATS-R to continually improve the user experience and to inform content, information architecture, design, functionality, and accessibility. Iteratively apply insights gathered to inform design and development.

E. Before releasing to production, conduct user acceptance testing on new features, content reviews of existing PATS-R content, Information Architecture (IA) reviews for global navigation and design reviews of existing patterns and User Interface (UI) elements to identify and make modifications to accommodate the modifications to PATS-R, while maintaining a positive user experience.

F. The Contractor shall document a UX Research Plan and Summary for each user research study, which shall include a research write-up documenting research questions, hypotheses, methodology, recruiting needs, synthesis, and next steps.

G. The Contractor will ensure that all research findings for any studies conducted are socialized among appropriate VA stakeholders and provided in a format that is machine readable and accessible without requiring the original research reports.

Content &…