RFI - Forensic Healthcare Program.pdf

Defense Health Agency Request for Information (RFI)

Forensic Healthcare Records Program

1.0 Description

THIS IS A REQUEST FOR INFORMATION (RFI) ONLY. This RFI is being issued solely for information and planning purposes to conduct market research. It does not constitute a Request for Proposal (RFP) or a promise to issue an RFP in the future. This request for information does not commit the U.S. Government to contract for any supply or service whatsoever. Further, the Defense Health Agency (DHA) is not at this time seeking quotes or proposals and will not accept unsolicited proposals.

Respondents are advised that the U.S. Government will not pay for any information or administrative costs incurred in response to this RFI; all costs associated with responding to this RFI will be solely at the interested party's expense. Not responding to this RFI does not preclude participation in any future RFP, if any is issued.

The results of this market research may contribute to determining the method of procurement.

2.0 Background

The current paper-based system for storing forensic healthcare records at Military Treatment Facilities (MTFs) presents significant legal, operational, and privacy risks. The lack of a secure, compliant, and centralized electronic platform hinders efficient record management, risks patient privacy, and impacts overall care coordination.

While forensic healthcare records are a subset of patient health records, Department of Defense Instruction (DoDI) 6040.45 (DoD Health Record Life Cycle Management) dictates that Sexual Assault Forensic Examination (SAFE) reports must not be integrated into any component of the standard DoD Electronic Health Record (EHR) (e.g., MHS Genesis). Furthermore, the DOJ National Protocol for Sexual Assault Medical Forensic Examinations (Third Edition, 2024) mandates that the complete medical forensic record be maintained separately to limit the disclosure of unrelated information and preserve strict confidentiality.

The primary objective is to acquire a secure, compliant Commercial Off-The-Shelf (COTS) solution that strictly segregates forensic records from the main DoD HER (MHS Genesis). The proposed solution must ensure adherence to all applicable federal and military legal mandates (including Federal Rules of Evidence Rules 705, 902(13), 902(14), and 28 CFR § 115.121) while streamlining the creation, storage, and retrieval of forensic documentation.

3.0 Requested Information

The Government is seeking respondents that possess a COTS software solution capable of supporting an estimated 400 worldwide users and the functional and technical requirements outlined below. The respondent must also demonstrate the capacity to provide personnel with the requisite expertise to meet the strict legal, technical, and cybersecurity requirements for the full implementation and sustainment of an electronic forensic record storage capability.

If your organization has the capacity to perform these services, please provide detailed documentation addressing how your proposed solution meets the following criteria:

3.1 System Functionality & Technical Requirements

• Forensic Workflow & Evidence Preservation:

• Provide the ability to legally document a forensic exam for court submission, including capturing high-quality images, digital annotations, and electronic patient consent forms via mobile tablet devices (e.g. iPad or similar) at the point of care.

• Ensure absolute evidence preservation by preventing any alteration to image file types and enforcing zero data compression.

• Maintain a robust, immutable chain-of-custody tracking system for secure documents prepared for law enforcement handoff.

• Implement an "electronic seal" that permanently locks the record from alteration once the final page is signed (users may only amend notes prior to finalization).

• Support custom data elements for forensic kits, native fillable PDF forms, and Optical Character Recognition (OCR) for scanned documents.

• Accurately time-stamp all forensic encounters synchronized to localized time zones.

• Incorporate a formal, auditable peer-review workflow prior to record finalization.

• Data Management & Interoperability:

• Demonstrate the capability to securely import relevant patient demographics via

Application Programming Interfaces (APIs) from the Defense Manpower Data Center (DMDC) / Defense Enrollment Eligibility Reporting System (DEERS).

• Assign unique, traceable identifiers for all file types within the system.

• Address the following: What data formats are supported for the data archive?

How is data structurally stored, and which formats can be natively viewed from within the application interface?

• Legacy Data Ingestion: Provide capabilities for secure, bulk data migration and ingestion of historical forensic records (e.g., digitized paper records, scanned PDFs).

• Data Validation & Decision Support:

• Provide Forensic Decision Support (FDS) integrated with established Practice

Guidelines (PG) to ensure standardized clinical practice.

• Implement mandatory system hard-stops to enforce completeness; the application must prevent file closure or screen advancement until specific mandated fields are populated.

• Records Management, Retention & Requests:

• Securely store and maintain items for a mandatory retention period of exactly 50 years.

• Provide automated capabilities to permanently purge/destroy files in accordance with NARA disposition schedule.

• Document and track all record requests initiated by victims, as well as those initiated by authorized system users.

• Reporting & Analytics:

• Support ad hoc, scheduled, and statistical reporting functions, including secure data export for external visualization.

• Track and report on administrative metrics such as provider competency requirements, exam volume per provider, user training completion, and inactive account status.

3.2 Implementation, Operations & Sustainment Support

The proposed solution is anticipated to be a one-year base contract with four optional one-year renewals that must include comprehensive lifecycle support. Please describe your ability to provide appropriately cleared personnel to execute the following:

• Environment Management: Stand up, integrate, and maintain servers across a minimum of five (5) distinct environments: Production, Continuity of Operations (COOP), Pre- Production/Test, Training, and Development.

• Deployment Support: Execute system installation, configuration, version upgrades, problem resolution, and configuration updates.

• System Updates & Change Management: Provide continuous engineering support, architectural optimization, performance tuning, and the testing/validation of routine security patches.

• Operations & Troubleshooting: Perform proactive system monitoring, manage trouble tickets (including coordination with the MHS Help Desk), conduct root cause analysis, execute database performance tuning, and maintain all system components.

• Test & Evaluation: Support Independent Test Teams and adhere strictly to Configuration Management processes for deploying application updates across all environments.

• Training: Develop comprehensive user documentation and facilitate training for initial deployments and subsequent major system upgrades.

• Data Migration Strategy & Execution: Describe your methodology for migrating existing legacy data into the Proposed Solution. This must include your approach for secure data extraction, transformation, and loading (ETL), while maintaining strict chain-of-custody, preserving historical metadata, and validating data integrity and completeness post-migration.

3.3 Cybersecurity, RMF & Compliance

Cybersecurity must be intrinsically built into the solution to achieve and maintain DHA accreditation. Please detail your ability to meet the following mandates:

• Data Protection & Segregation: Establish robust administrative, technical, and physical safeguards. Strictly segregate forensic records in compliance with DoDI 6040.45, DoDI 6495.02, DOJ National Protocols, and 28 CFR § 115.121.

• The Government requires the solution to be hosted in one of the following configurations:

• Commercial Cloud (SaaS): A Software as a Service (SaaS model that is strictly FedRAMP Certified and DoD Impact Level 4 (IL4) Compliant.

• Government Cloud: Hosted directly within a DHA-managed cloud environment.

• Risk Management Framework (RMF): Execute RMF for DoD Information Technology as defined in DoDI 8510.01. Implement Information Assurance (IA) controls per DoDI

8500.01 based on Confidentiality, Availability, and Integrity categorizations. Produce and maintain all required Authority to Operate (ATO) and cybersecurity documentation.

• Compliance Standards: Ensure all Operating Systems, Database Management Systems, and Web Applications strictly conform to DISA Security Technical Implementation Guides (STIGs), NIST standards, and NSA Security Configuration Guides.

• Vulnerability Management: Implement Information Assurance Vulnerability Management (IAVM) and adhere to U.S. Cyber Command issuances throughout the software lifecycle.

Support regular cybersecurity scanning, remediation, and annual Risk Assessments.

• Encryption & Auditing: Provide SSL FIPS 140-2 / FIPS 140-3 compliant encryption compliant encryption (both in transit and at rest). Comply with NIST 800-111, NARA retention schedules, and Federal Rules of Evidence (Rules 705, 902(13), and 902(14)) while generating immutable audit logs.

• Access Control: Assign and manage Role-Based Access Controls (RBAC) at local, network, and global levels, including native support for Common Access Card (CAC) single sign-on. Automate email alerts for inactive accounts and disable them according to configurable security policies.

3.4 Technical Maturity

Describe the current technical maturity of the proposed COTS products and capabilities, including current commercial deployments or existing federal footprint.

3.5 Data Inputs & Dependencies

Detail the required system inputs, mandatory data formats, and any external system dependencies necessary for the proposed solution to function optimally. Additionally, identify any specific data formatting or cleansing requirements the Government must perform on legacy records prior to migration.

3.6 Performance Metrics

Identify the standard performance metrics and Service Level Agreements (SLAs) your organization utilizes to assess system impact, uptime, and operational outcomes.

4.0 Responses

4.1 Submission Instructions

Responses must be submitted in Microsoft Word or PDF format and are due no later than 18 June 2026 at 1400 CDT.

Responses shall be limited to 10 pages and submitted via e-mail to the contract specialist, William Vallee at William.l.vallee.civ@health.mil and the contracting officer, Pamela Bryerton at pamela.j.bryerton.civ@health.mil. Please use the following title in your email subject line: “Third Party Software Support for CBIS Forensic Healthcare Record.”

Proprietary information, if any, should be minimized, MUST BE CLEARLY MARKED, and segregated from non-proprietary information to aid Government review. Please be advised that all submissions become Government property and will not be returned.

4.2 Administrative Information

Section 1 of your response shall provide administrative information, and must include the following at a minimum (this administrative data does not count towards the 10-page limit):

1. Name, mailing address, phone number, and e-mail of the designated point of contact.

2. Company Name.

3. Unique Entity ID (UEI).

4. CAGE Code.

5. Applicable NAICS Codes.

6. Business size status and date of last certification.

7. Applicable GSA Special Item Numbers (SINs), including a description of the SIN product/service classification.

8. All applicable existing Contract Numbers (e.g., GSA OASIS+, GSA Multiple Award

Schedules, CIO-SP3, NASA SEWP). Note: This information is for market research only and does not preclude a company without these vehicles from responding.

5.0 Summary

THIS IS A REQUEST FOR INFORMATION (RFI) ONLY to identify qualified sources capable of providing a secure, compliant commercial software solution for an Electronic Forensic Healthcare Record for the Military Health System. The information provided in this RFI is subject to change and is not binding on the Government. The Government has not made a commitment to procure any of the systems or services discussed, and the release of this RFI should not be construed as authorization to incur costs for which reimbursement would be sought. Telephone inquiries will not be accepted or acknowledged, and no customized feedback or evaluations will be provided to Respondents regarding their submissions.

mailto:William.l.vallee.civ@health.mil mailto:pamela.j.bryerton.civ@health.mil