S02 36C10B25Q0531.pdf

PAGE 1 OF 1. REQUISITION NO.

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NO. 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

a. NAME b. TELEPHONE NO. (No Collect Calls) 8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY CODE 10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE: % FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ IFB RFP

15. DELIVER TO CODE 16. ADMINISTERED BY CODE

17a. CONTRACTOR/OFFEROR CODE FACILITY CODE 18a. PAYMENT WILL BE MADE BY CODE

TELEPHONE NO. UEI: EFT:

PHONE: FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19. 20. 21. 22. 23. 24.

ITEM NO. SCHEDULE OF SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________ 29. AWARD OF CONTRACT: REF. ___________________________________ OFFER COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DATED ________________________________. YOUR OFFER ON SOLICITATION DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY (BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION (REV. NOV 2021)

PREVIOUS EDITION IS NOT USABLE Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

36C10B25Q0531 9-04-2025

Daniel Renna 848 377 5048 09-10-2025

10AM EDT

36C10B Department of Veterans Affairs Technology Acquisition Center Procurement Services E 23 Christopher Way Eatontown NJ 07724

X 100

X

541519

$34 Million

N/A

X

See Delivery Schedule

36C10B

Department of Veterans Affairs Technology Acquisition Center Procurement Services E 23 Christopher Way Eatontown NJ 07724

0QKQ5

SGL360, LLC

521 C ST STE 105

QUANTICO VA 22134-3438

EBYRG618XQ87

36C10A

Department of Veterans Affairs Technology Acquisition Center Financial Services Center PO Box 149971 Austin TX 78714-8971

Artificial Intelligence (AI) Clinical Decision Support (CDS) Summarizations

This is a sole source contract to SGL 360, LLC under the authority of 41 U.S.C. 3304(a)(5), “Authorized or Required by Statute”, as implemented by FAR 6.302-5.

X X

Heather Utt Contracting Officer

36C10B25Q0531

Table of Contents

SECTION A

A.1 SF 1449 SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS

AND COMMERCIAL SERVICES

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 GOVERNING LAW CLAUSE

B.2 CONTRACT ADMINISTRATION DATA

B.3 PRICE/DELIVERY SCHEDULE

B.4 PRODUCT DESCRIPTION

SECTION C - CONTRACT CLAUSES

C.1 FAR 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

C.2 FAR 52.204-21 BASIC SAFEGUARDING OF COVERED CONTRACTOR

INFORMATION SYSTEMS (NOV 2021)

C.3 FAR 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO

IMPLEMENT STATUTES OR EXECUTIVE ORDERS—COMMERCIAL PRODUCTS

AND COMMERCIAL SERVICES (JAN 2025) (DEVIATION FEB 2025)

C.4 FAR 52.217-7 OPTION FOR INCREASED QUANTITY—SEPARATELY PRICED

LINE ITEM (MAR 1989)

C.5 FAR 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000)

C.6 VAAR 852.204-71 INFORMATION AND INFORMATION SYSTEMS SECURITY

(FEB 2023)

C.7 VAAR 852.211-76 LIQUIDATED DAMAGES – REIMBURSEMENT FOR DATA

BREACH COSTS (FEB 2023)

C.8 VAAR 852.219-73 VA NOTICE OF TOTAL SET-ASIDE FOR CERTIFIED SERVICE-

DISABLED VETERAN-OWNED SMALL BUSINESSES (JAN 2023) (DEVIATION)

C.9 VAAR 852.219-75 VA NOTICE OF LIMITATIONS ON SUBCONTRACTING—

CERTIFICATE OF COMPLIANCE FOR SERVICES AND CONSTRUCTION (JAN 2023)

(DEVIATION)

C.10 VAAR 852.239-76 INFORMATION AND COMMUNICATION TECHNOLOGY

ACCESSIBILITY (FEB 2023)

C.11 VAAR 852.242-71 ADMINISTRATIVE CONTRACTING OFFICER (OCT 2020)

SECTION D - CONTRACT DOCUMENTS, EXHIBITS, OR ATTACHMENTS

SECTION E - SOLICITATION PROVISIONS

E.1 FAR 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE

(FEB 1998)

E.2 FAR 52.204-24 REPRESENTATION REGARDING CERTAIN

TELECOMMUNICATIONS AND VIDEO SURVEILLANCE SERVICES OR EQUIPMENT

(NOV 2021)

E.3 FAR 52.204-29 FEDERAL ACQUISITION SUPPLY CHAIN SECURITY ACT

ORDERS—REPRESENTATION AND DISCLOSURES (DEC 2023)

E.4 FAR 52.209-7 INFORMATION REGARDING RESPONSIBILITY MATTERS (OCT

2018)

E.5 FAR 52.212-3 OFFEROR REPRESENATIONS AND CERTIFICATIONS-

COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES (MAY 2024) (DEVIATION

FEB 2025)

E.6 FAR 52.216-1 TYPE OF CONTRACT (APR 1984)

E.7 FAR 52.233-2 SERVICE OF PROTEST (SEP 2006)

E.8 BASIS FOR AWARD

E.9 ADDENDUM to FAR 52.212-1 INSTRUCTIONS TO OFFERORS-COMMERCIAL

ITEMS

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 GOVERNING LAW CLAUSE

Federal law and regulations, including the Federal Acquisition Regulations (FAR), shall govern this Contract/Order. Commercial license agreements may be made a part of this Contract/Order but only if both parties expressly make them an addendum hereto. If the commercial license agreement is not made an addendum, it shall not apply, govern, be a part of or have any effect whatsoever on the Contract/Order; this includes, but is not limited to, any agreement embedded in the computer software (clickwrap), any agreement that is otherwise delivered with or provided to the Government with the commercial computer software or documentation (shrinkwrap), or any other license agreement otherwise referred to in any document. If a commercial license agreement is made an addendum, only those provisions addressing data rights regarding the Government’s use, duplication and disclosure of data (e.g., restricted computer software) are included and made a part of this Contract/Order, and only to the extent that those provisions are not duplicative or inconsistent with Federal law, Federal regulation, the incorporated FAR clauses and the provisions of this Contract/Order;

those provisions in the commercial license agreement that do not address data rights regarding the Government’s use, duplication and disclosure of data shall not be included or made a part of the Contract/Order. Federal law and regulation including, without limitation, the Contract Disputes Act (41 U.S.C. § 7101 et seq.), the Anti- Deficiency Act (31 U.S.C. § 1341 et seq.), the Competition in Contracting Act (41 U.S.C.

§ 3301 et seq.), the Prompt Payment Act (31 U.S.C. §3901 et seq.), Contracts for Data Processing or Maintenance (38 U.S.C. § 5725), and FAR clauses 52.212-4, 52.227-14, 52.227-19 shall supersede, control, and render ineffective any inconsistent, conflicting, or duplicative provision in any commercial license agreement. In the event of conflict between this Clause and any provision in the Contract/Order or the commercial license agreement or elsewhere, the terms of this Clause shall prevail. Claims of patent or copyright infringement brought against the Government as a party shall be defended by the U.S. Department of Justice (DOJ). 28 U.S.C. § 516. At the discretion of DOJ, the Contractor may be allowed reasonable participation in the defense of the litigation. Any additional changes to the Contract/Order must be made by contract/order modification (Standard Form 30) and shall only be effected by a warranted Contracting Officer.

Nothing in this Contract/Order or any commercial license agreement shall be construed as a waiver of sovereign immunity.

B.2 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR: Attn: Alfredo Versoza/aversoza@sentinelgrpllc.com

SGL360, LLC

521 C St. Ste 105 Quantico, VA 22134-3438

b. GOVERNMENT: Heather Utt/Heather.Utt@va.gov Contracting Officer 36C10B Department of Veterans Affairs Technology Acquisition Center 23 Christopher Way Eatontown NJ 07724

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

[X] 52.232-33, Payment by Electronic Funds Transfer—System For Award Management, or

[] 52.232-36, Payment by Third Party

3. INVOICES: Invoices shall be submitted in arrears:

a. Quarterly []

b. Semi-Annually []

c. Other [X] In accordance with Section B.3

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

5. ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

AMENDMENT NO DATE

6. ARM Approval: 196230

B.3 PRICE/DELIVERY SCHEDULE

Inspection/Acceptance/F.O.B: Destination

BASE PERIOD

The Period of Performance shall be

September 30, 2025 through September 29, 2026 Contract Line-Item Number (CLIN)

Description Qty Unit Unit Price Total Price

0001 AI CDS Summarizations in accordance with (IAW) Performance Work Statement (PWS) paragraph(s) 5.1 and 5.2, inclusive of all subparagraphs.

This Firm Fixed Price (FFP) CLIN includes all labor and deliverables required for the successful completion of the services detailed in PWS paragraph(s) 5.1 and 5.2, inclusive of all subparagraphs.

Inspection: Destination Acceptance: Destination

Quantity of one (1) EA equals one (1), two (2)-week iteration.

Product Service Code (PSC): DA01

24 EACH

(EA)

0001AA Contractor Staff Roster IAW PWS paragraph 6.2.2.

Inspection: Destination Acceptance: Destination

Delivered electronically to Contracting Officer Representative (COR) within three

(3) business days after award.

Product Service Code (PSC): DA01

1 LO Not Separately Priced

(NSP)

NSP

BASE PERIOD TOTAL $

OPTION PERIOD ONE

This option may be exercised by the Government IAW FAR 52.217-9 Option to Extend the Term of the Contract (MAR 2000). Work shall not commence until, and unless, a formal modification is issued by the

Contracting Officer. If exercised, this option shall commence immediately after expiration of the Base Period.

The Period of Performance shall be September 30, 2026 through March 30, 2027

Contract Line-Item Number (CLIN)

Description Qty Unit Unit Price Total Price

1001 AI CDS Summarizations IAW PWS paragraph(s) 5.1 and 5.2, inclusive of all subparagraphs.

This FFP CLIN includes all labor and deliverables required for the successful completion of the services detailed in PWS paragraph(s) 5.1 and 5.2, inclusive of all subparagraphs.

Inspection: Destination Acceptance: Destination

Quantity of one (1) EA equals one (1), two (2)-week iteration.

PSC: DA01

13 EA $ $

1001AA Contractor Staff Roster IAW PWS paragraph 6.2.2.

Inspection: Destination Acceptance: Destination

Delivered electronically to COR within three

(3) business days after start of Option Period One.

Product Service Code (PSC): DA01

1 LO NSP NSP

OPTION PERIOD ONE TOTAL $

OPTION PERIOD TWO

This option may be exercised by the Government IAW FAR 52.217-9 Option to Extend the Term of the Contract (MAR 2000). Work shall not commence until, and unless, a formal modification is issued by the

Contracting Officer. If exercised, this option shall commence immediately after expiration of Option Period One.

The Period of Performance shall be March 31, 2027 through September 30, 2027

Contract Line-Item Number (CLIN)

Description Qty Unit Unit Price Total Price

2001 AI CDS Summarizations IAW PWS paragraph(s) 5.1 and 5.2, inclusive of all subparagraphs.

This FFP CLIN includes all labor and deliverables required for the successful completion of the services detailed in PWS paragraph(s) 5.1 and 5.2, inclusive of all subparagraphs.

13 EA $ $

Inspection: Destination Acceptance: Destination

Quantity of one (1) EA equals one (1), two (2)-week iteration.

PSC: DA01

2001AA Contractor Staff Roster IAW PWS paragraph 6.2.2.

Inspection: Destination Acceptance: Destination

Delivered electronically to COR within three

(3) business days after start of Option Period Two.

Product Service Code (PSC): DA01

1 LO NSP NSP

OPTION PERIOD TWO TOTAL $

OPTIONAL TASK ONE

This optional task may be exercised by the Government IAW FAR 52.217-7 Option for Increased Quantity – Separately Priced Line Item (MAR 1989). Work shall not commence until, and unless, a formal modification is issued by the Contracting Officer.

This optional task shall be exercised multiple times up to the Not to Exceed (NTE) amount at the Government’s discretion at any time during the Period of Performance.

Contract Line-Item Number (CLIN)

Description Qty Unit Unit Price Total Price

3001 AI CDS Summarizations IAW PWS paragraph 5.3.

This FFP CLIN includes all labor and deliverables required for the successful completion of the services detailed in PWS paragraph 5.3. The Government may exercise this Optional Task at any time during the Period of Performance up to the Not to Exceed (NTE) amount.

Inspection: Destination Acceptance: Destination

Quantity of one (1) EA equals one (1), two (2)-week iteration.

PSC: DA01

NTE

EA $ $

OPTIONAL TASK TOTAL $

TOTAL BASE + OPTIONS $

B.4 PRODUCT DESCRIPTION

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information and Technology Office of the Chief Technology Officer

Artificial Intelligence (AI) Clinical Decision Support (CDS) Summarizations

Date: 8/28/2025

VA-25-00097498

PWS Version Number: 1.0

1.0 BACKGROUND

1.1 MISSION OF THE REQUESTING BUSINESS OFFICE

The Office of the CTO (OCTO) serves the Department of Veterans Affairs Office of Information Technology’s (VA OIT) mission to deliver world-class IT products and services to VA and Veterans. OCTO works closely with core program portfolios across VA to examine the short and long-term needs of the Department, and to identify and fill gaps in VA’s technology portfolio. OCTO takes an approach to problem-solving, teamwork, and leadership that is built on agile development and results in ongoing improvement.

OCTO now serves a dual purpose as the VA Office of the Chief Artificial Intelligence Officer (OCAIO). The mission of OCAIO is to deliver world-class AI-enabled IT products and services to VA and Veterans in a 1) purposeful, 2) effective and safe, 3) secure and private, 4) fair and equitable, 5) transparent and explainable, and 6) accountable and monitored fashion. These six pillars comprise the VA Framework for Trustworthy AI.

AI instituted in a responsible manner has enormous potential to benefit Veterans, VA healthcare providers, and VA employees. Our vision is for VA to be a national leader in responsible use of AI to reduce healthcare provider burnout, improve Veteran and VA employee experience, and provide higher quality care for Veterans.

1.1.1 PROBLEM WE ARE TRYING TO RESOLVE

Reviewing information about a patient prior to an upcoming encounter is an important way that clinicians prepare for an effective visit. Clinicians will view information in the patient’s record to:

1. Review the patient’s clinical context and prepare an agenda for the visit

2. Review notes from encounters with other clinicians to understand changes to the patient’s clinical condition since their last visit

3. Review labs and interpret any relevant lab work since last visit

4. Review radiology reports and analyze any results since last visit

5. Review for notes on surgical or other procedures since last visit

6. Check medications and note any expired, discontinued, or due for renewal medications

7. Check consults for any discontinued, canceled, pending, or ongoing consults to follow up on

8. Update problem list if any changes are noted based on review of the record

9. Check for immunizations and other preventive measures that are due, etc.

Clinicians are challenged to effectively complete this review prior to patient encounters, given time constraints and the manual effort required to navigate electronic health record systems to seek the information. This results in lowered visit effectiveness and increased clinician burnout.

There is a significant opportunity for AI-powered search and summarization of clinical information to assist clinicians with efficiently and effectively reviewing a patient’s record prior to an encounter.

1.2 ADDITIONAL CONSIDERATION ON THE PROBLEM SPACE

This work directly supports E.O. 14179, dated January 23, 2025, Removing Barriers to American Leadership in Artificial Intelligence, and OMB Memo M-25-21, dated April 3, 2025, Accelerating Federal Use of AI through Innovation, Governance, and Public Trust, by promoting responsible and forward-leaning AI innovation within Veterans Affairs to significantly enhance the experiences of Veterans, their family members and caregivers, and VA employees.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. The U.S. Digital Services Playbook (https://playbook.cio.gov/)

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements For Cryptographic Modules”

4. FIPS Pub 199. Standards for Security Categorization of Federal Information and Information Systems, February 2004

5. FIPS Pub 200, Minimum Security Requirements for Federal Information and Information Systems, March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

8. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

9. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

10. VA Handbook 6500.5, “Incorporating Security and Privacy in System Development Lifecycle”, March 22, 2010

11. VA Handbook 6500.6, VA Information and Information System Security/Privacy Language, including all Appendices, dated April 22, 2024

12. “Completing the Transition to Internet Protocol Version 6 (IPv6):

https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf

13. USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1)

14. NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1)

15. NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119)

16. Office of Management and Budget Memorandum (OMB) M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (9- 26.pdf"https://www.whitehouse.gov/wp- content/uploads/2019/09/M-19-26.pdf),

17. VA Directive 6513 “Secure External Connections”

18. TIC 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

3.0 SCOPE OF WORK

3.1 OVERVIEW OF WORK

OCTO seeks a team to build an AI-powered clinical documentation search and summarization solution to reduce clinician burden, increase care team efficiency, and improve quality of care for Veterans. It is anticipated that the solution will leverage VA’s existing Clinical Decision Support Console (CDSC) and access to GPT models through Azure OpenAI.

3.2 DEVELOPMENT METHODOLOGY AND WORKING PRINCIPLES

The contractor’s support and solutions shall follow the practices described in the Digital Services Playbook (https://playbook.cio.gov). The Contractor shall be thoroughly familiar with the concepts in each play and implement them in its approaches and support. The Contractor shall design, develop, configure, customize, and deploy solutions to some of VA’s most pressing challenges. Once deployed, the Contractor shall provide production support of the solution as required. The Contractor shall provide support to projects that are building brand new systems as well as projects that are building on top of, or replacing, existing systems. The Contractor shall be thoroughly familiar with current and emerging technologies, Software-as-a-Service products, services, various programming languages and processes required to deliver high-quality products.

When applicable to the current effort, the Contractor shall:

General

1. Deliver high-quality, usable, functional products that help users accomplish their tasks.

2. Follow the Digital Services Playbook (https://playbook.cio.gov).

3. Cultivate positive, trusting, and cooperative working relationships with all persons supporting the work, including government employees and other vendors.

4. Participate in Communities of Practice activities for Product, Design, Engineering, and Data where applicable.

Product

5. Work in self-contained, cross-functional teams capable of delivering complete products, including research, design, architecture, engineering, support, and documentation.

6. Incorporate agile practices and ceremonies into all work, such as sprint planning, daily standups, sprint review, retrospective, user stories/epics, backlog grooming, and estimating activities.

7. Establish goals, objectives, key performance metrics, and make bets to improve user outcomes. Bets are hypotheses that could impact established metrics and they encourage acceptance of uncertainty in the software development process.

8. Push new features and incremental improvements to production early and often, applying phased release practices with product health and performance targets.

9. Build applications and platforms with the intent of enhancing and sustaining that application until relieved by the Government or another team.

10. Collect customer feedback, hold product impact reviews, provide or support tiered troubleshooting and on-call operations, and complete postmortem incident reports.

11. Measure and improve performance against DevOps Research and Assessment metrics including deployment frequency, lead time for changes, change failure rate, and time to restore service.

Design

12. Understand the users' entire experience. Create personas, customer journeys, service blueprints, problem space definitions, affinity maps, and flow diagrams (as appropriate) to ensure the digital service is cohesive with the offline experience.

13. Actively involve users in the design of digital solutions by incorporating best practices for design, user research, and usability testing.

14. Personalize solutions for the user by leveraging known information to create a seamless, tailored user experience.

15. Optimize for mobile-first and ensure all solutions are equally available on both mobile and desktop.

16. Follow all user interface design and content guidelines and standards defined in the VA Design System and VA Content Style Guide (https://design.va.gov/) including the use of plain language to maintain a consistent look, feel, and voice across public facing sites and services.

17. Incorporate robust accessibility principles into design, development, and testing for all web applications to deliver high-quality digital experiences to all users that meet or exceed current W3C Web Content and Accessibility Guidelines (WCAG).

Engineering

18. Use widely adopted or industry-standard programming languages and frameworks.

19. Follow software development best practices including peer review, test coverage, portability, and clear documentation.

20. Run unit tests, integration tests, functional tests, load tests, and accessibility tests on 100% of functionality delivered.

21. Leverage cloud-based infrastructure, platforms, and services to improve scalability, reliability, performance, and maintainability.

22. Continuously integrate code from development teams, run automated testing, promote code through multiple environments, and automate high frequency deployments.

23. Monitor infrastructure health, application performance, and user outcomes.

Ensure observability of the system/application/service status and leverage alerting integrations.

24. Maintain the confidentiality, integrity, and availability of sensitive information, including user information by following widely accepted or industry-standard methods, including Zero Trust security principles.

25. Ensure configuration and sensitive data, including data the VA defines as sensitive, are not present in source code.

26. Deliver all code not containing configuration or sensitive data to an open-source repository. Share your documentation, development processes, and lessons learned publicly.

27. Use established VA internal tools including source code management, team communication, developer toolkits, and analytics products.

28. Make use of existing platforms to build and deploy software, such as the VA.gov Platform and Lighthouse Delivery Infrastructure, wherever possible.

29. Adopt and follow VA Application Programming Interface (API) standards contained in the Lighthouse Hub (https://hub.lighthouse.va.gov/docs/default/component/lighthouse-api-standards/).

30. Make application data available for use across the VA enterprise with versioned RESTful APIs and discoverability in the Lighthouse API hub (https://hub.lighthouse.va/catalog https://developer.va.gov/) to meet Fast Healthcare Interoperability Resources standards where applicable.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The period of performance (PoP) shall be one 12-month Base Period, with two (2) 6-month Option Periods, to be exercised at the Government’s discretion. This effort also includes an Optional Task for six (6) additional iterations to be exercised at any time within the period of performance at the Government's discretion.

The contractor shall set their own work hours. However, contractors may be required to attend meetings with Government personnel between standard east coast work hours (typically 9am – 5pm ET). In the event of a security incident or technical outage, the team may be expected to provide on-call support or additional working hours 24/7.

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

4.3 TRAVEL

Travel is anticipated for this contract. The full Contractor team will be expected to travel one time within the 12-month Base Period PoP, within the continental United States, for an all-hands meeting. All travel costs shall be included in the Offeror’s firm fixed price.

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 OBJECTIVES (BASE + OPTION PERIODS)

5.1.1 PRODUCT VISION

Clinician outcomes:

Reduced administrative burden: Decrease time spent on pre-encounter documentation review. Preliminary data suggest current time spent is up to 30 min per visit.

Reduced clinician burnout: Improvement in clinician burnout measures, e.g. from All Employee Survey (AES).

Veteran outcomes:

Improved quality of care: E.g. increased adherence to preventive care guidelines, improved continuity of care, reduced duplication of labs/exams

Improved access to care: Increased clinician efficiency may result in downstream improved access to care/appointments

5.1.2 DESIRED BUSINESS OUTCOMES

Potential business outcomes include:

Improved access to care: Increased clinician bandwidth can result in improved access to care for Veterans.

Improved quality of care: E.g. increased adherence to preventive care guidelines, improved continuity of care, reduced duplication of labs/exams

Clinician retention: Increased clinician satisfaction and decreased burnout can result in increased employee retention of VA clinicians.

5.1.3 OUTCOMES WE WANT TO AVOID

Outcomes to avoid include:

Decreased quality of care due to inaccurate information surfaced by the AI summarization solution.

Adding a new solution to clinicians’ workflow that is not well integrated with existing solutions and workflows.

5.1.4 POTENTIAL MINIMUM VIABLE PRODUCT FEATURES AND EPICS

The proposed solution will:

Ingest structured and unstructured clinical data from VistA via Remote Procedure Call (RPC) and other data connectors.

Use a VA-approved Large Language Model (LLM) environment to generate pre-encounter summaries.

Output structured summaries in standard formats for downstream use (e.g.

encounter documentation, care coordination, patient-facing summaries, referrals, etc.)

Integrate with clinician workflow via VA’s existing Clinical Decision Support Console.

Support human in the loop review of output and adhere to VA trustworthy AI principles.

5.2 PERFORMANCE DETAILS

The Contractor shall provide VA with 2-week iterations of agile software delivery. The agile delivery iterations shall be supported by multi-disciplinary teams with appropriate skillsets to support the following services: product and delivery management, systems architecture/infrastructure, systems security, systems monitoring, software development, shared front-end and other code libraries, shared tooling, support services, user research, user experience strategy, information architecture, interaction and visual design, content writing, DevSecOps, data analytics, and platform operations and management.

Before each 2-week iteration, during iteration/sprint planning and continuously throughout the period of performance, the contractor shall propose a “definition of done” for the upcoming sprint which details the specific work items and deliverables to be completed during the sprint and shall gain approval on each “definition of done” from the Product Owner (PO) and Contracting Officer’s Representative (COR) prior to the start of each sprint. The “definition of done” defined during sprint planning will be informed by a continuously prioritized backlog of work items towards the goals and outcomes listed in the PWS. The contractor’s invoice for that sprint will be certified when the definition of done has been approved by the PO and COR. Any item(s) that were initially included in the definition of done, but not delivered, must be discussed with the PO/COR to ensure their removal from the definition of done was appropriate and justified, prior to the invoice being certified.

The Base PoP shall be for 12 months and consists of 24 iterations. The PoP for Option Periods One and Two shall be for 6 months each and consist of 13 iterations each.

Additional Information

SCRUM teams will be considered acceptable when they can effectively work. This may include some resources that are staffed, but not cleared. This will be on a case-by-case basis and worked out with the COR. For the initial team to be deemed ready to work, all members of the team will have a Personal Security Adjudication Center letter in order to obtain access to working tools such as GitHub and Slack that do not require VA network access. Access to Amazon Web Services requires Electronic Questionnaires for Investigations Processing release date.

5.3 OPTIONAL TASK 1: ADDITIONAL ITERATIONS

This Optional Task provides additional two-week iterations to fulfill the scope of work described in the base tasks. Because the Base Period consists of 24 iterations (PWS 5.2), the Government may exercise this Optional Task to address any gaps between iterations and Period of Performance dates. Optional Task may be exercised at any time during the Period of Performance up to the NTE amount of six (6) as specified in the Price Schedule. Since each of the six (6)-month option periods has the appropriate number of 13 iterations, if this Optional Task is exercised in either of those periods, the PoP will be extended as appropriate.

The anticipated LoE for this Optional Task is equivalent to the base task.

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 VA TECHNICAL REFERENCE MODEL

The Contractor shall comply with the VA OIT Technical Reference Model (VA TRM).

Compliance with the VA TRM is achieved by using only technologies and standards that are listed as approved for use in the VA TRM. The Contractor shall provide all necessary information requested by VA to ensure TRM approval is obtained prior to use on VA’s network.

6.1.2 ZERO TRUST – VA CRITICAL SECURITY CONTROLS

VA has established minimum mandatory security requirements and requires that any network connected software system or service must meet the VA Critical Security Controls as outlined in the VA Memorandum, “VA Security Controls”, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010. VA Critical Security Controls identify the minimum mandatory requirements that must be implemented across all VA enterprise infrastructure, cloud computing environments, information systems, networks, and specialized devices (medical devices/systems, special-purpose systems, and research scientific computing devices) that process, store, and/or transmit

VA data. Effective July 1, 2025, the Contractor shall implement these VA Critical Security Controls, within any network connected software system or service prior to being authorized for use in the VA. This functional requirement is not negotiable, and Plan of Action & Milestones (POAM) will not be accepted in the event these controls cannot be implemented for new systems. Critical Security Controls are intended to increase VA’s security posture and provide security and privacy risk visibility into the VA network and is not a new requirement. The Contractor’s failure to maintain these VA Critical Controls after implementation will result in VA discontinuing the use of the system.

6.1.3 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Architecture (EA), and VA Identity and Access Management (IAM) approved Enterprise Technology Guidelines (ETG). The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in Executive Order 14028, VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program, CISA Binding Operational Directive 23- 01, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500, and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the ETGs. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-05-24, M-19-17, M-22-09, and NIST Federal Information Processing Standard (FIPS) 201-3. Contractor delivered applications and systems shall be on the FIPS 201 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Person Index (MPI) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable Technology Guideline as outlined in VA ETG.

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion-based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

10. Role Based Access Control.

11. Auditing and reporting capabilities.

12. Compliance with VIEWS 00155984, PIV Logical Access Policy Clarification https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896.

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

6.1.4 INTERNET PROTOCOL VERSION 6 (IPv6)

The Contractor solution shall support IPv6-Only based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). Which defines IPv6-only as the state of an operational system or service when IPv4 protocol functions (addressing, packet forwarding) are not in use. The NIST USGv6 profile defines technical requirements for a product to be capable of operating in IPv6-Only environments. IPv6-Only technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices, applications, and systems shall support all applicable functionality on native IPv6-Only as well as dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g., web, email, DNS, ISP services, etc.) shall support native IPv6-Only and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall support using native IPv6-Only and dual stack (IPv6 / IPv4) for all functionality and operations.

6.1.5 TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 “Secure External Connections”, and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the Cybersecurity & Infrastructure Security Agency (CISA) (https://www.cisa.gov/publication/tic-30-core-guidance-documents).

6.1.6 STANDARD COMPUTER CONFIGURATION

The Contractor IT end user solution that is developed for use on standard VA computers shall be compatible with and be supported on the standard VA operating system, Windows 10 (64bit) and Windows 11, Edge (Chromium based), and 365 Apps for enterprise. Applications delivered to VA and intended to be deployed to Windows 10 and or Windows 11 workstations shall be delivered as a signed .msi package with switches for silent and unattended installation and updates shall be delivered in signed .msp file formats for easy deployment using Microsoft Endpoint Configuration Manager (CM) VA’s current desktop application deployment tool. Signing of the software code shall be through a vendor provided certificate that is trusted by VA using a code signing authority such as Verizon/Cybertrust or Symantec/VeriSign. The Contractor shall also ensure and certify that their solution functions as expected when used from a standard VA computer, with non-admin, standard user rights that have been configured using the Defense Information Systems Agency (DISA) Secure Technical Implementation Guide (STIG) specific to the particular client operating system being used.

6.1.7 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT LINE

MANAGEMENT (PLM)

The Contractor shall support VA efforts IAW the Veteran-Focused Integration Process (VIP) Guide and Product Line Management (PLM) Playbook. The major focus of VIP is on Enterprise Oversight, Governance, reporting, and establishing practices that focus on outcomes and continuously delivering sustainable IT capabilities to benefit the Veteran. PLM is a framework that focuses on delivering functional products that provide the highest priority work to customers while delivering simplified, reliable, and practical solutions to the business, medical staff, and our Veterans. The VIP Guide is a companion guide to the PLM Transformation Playbook and can be found at:

https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 and the PLM Transformation Playbook can be found at https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946. VIP and PLM are the authoritative processes that IT projects must follow to ensure development and delivery of IT products.

The VIP Guide provides guidance for transitioning from project-centric to product-centric delivery. The VIP guide applies to all OIT Office of Management and Budget (OMB) reportable products that are required to collect and report costs, schedules, risks, and other valuable information in VA PARS (whether products are procured or developed by VA) and any VA Information Technology project effort in Software Product Management (SPM) and Infrastructure Operations (IO), or their successors, that touch the VA network regardless of IT organizational alignment (whether it spends government funding from VA's Congressional IT Appropriation or any other appropriation).

The PLM Transformation Playbook details how OIT leadership expects Product Lines (PLs) to implement PLM, DevOps, and Lean-Agile principles, methods, practices, and techniques through levels of maturity. The PLM Transformation Playbook applies to all Information Technology (IT) products aligned to PLs in the Software Product Management, Infrastructure Operations and Product Engineering organizations within the OIT organization.

Others outside the referenced groups or organizations may use the VIP Guide and PLM Transformation Playbook for situational awareness as needed.

6.1.8 PROCESS ASSET LIBRARY (PAL)

The Contractor shall perform their duties consistent with the processes defined in the OIT Process Asset Library (PAL). The PAL includes a spectrum of OIT functions and activities, such as project management, operations, service delivery, communications, acquisition, and resource management. PAL serves as an authoritative and informative repository of searchable processes, activities or tasks, roles, artifacts, tools and applicable standards and guides to assist the OIT workforce, Government and Contractor personnel. OIT utilizes PAL processes to ensure compliance with policies and regulations and to meet VA quality standards. The PAL includes the contractor onboarding process consistent with Section 6.2.2 and can be found at process_CONB_ext.docx (live.com). The main PAL can be accessed at www.va.gov/process.

6.1.9 AUTHORITATIVE DATA SOURCES

The VA Enterprise Architecture Repository (VEAR) is one component within the overall EA that establishes the common framework for data taxonomy for describing the data architecture used to develop, operate, and maintain enterprise applications. The Contractor shall comply with the department’s Authoritative Data Source (ADS) requirement that VA systems, services, and processes throughout the enterprise shall access VA data solely through official VA ADSs where applicable, see below. The Information Classes which compose each ADS are located in the VEAR, in the Data & Information domain. The Contractor shall ensure that all delivered applications and system solutions support:

1. Interfacing with VA’s Master Person Index (MPI) (formerly the Master Veteran Index (MVI)) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

2. Interfacing with Capital Asset Inventory (CAI) to conduct real property record management actions, if the solution relies on real property records data. CAI is the authoritative source for VA real property record management data.

3. Interfacing with electronic Contract Management System (eCMS) for access to contract, contract line item, purchase requisition, offering vendor, and solicitation information above the micro-purchase threshold, if the solution relies on procurement data. ECMS is the authoritative source for VA procurement actions data.

4. Interfacing with HRSmart Human Resources Information System to conduct personnel action processing, on-boarding, benefits management, and compensation management, if the solution relies on personnel data. HRSmart is the authoritative source for VA personnel information data.

5. Interfacing with VA Profile to access personal contact information, if the solution relies on VA Veteran personal contact information data. VA Profile is the authoritative source for VA Veteran Personal Contact Data.

6. Interfacing with VA/Department of Defense (DoD) Identity Repository (VADIR) for determining eligibility for VA benefits under Title 38, if the solution relies on qualifying active duty military service data. VADIR is the authoritative source for qualifying active duty military service in VA.

7. Interfacing with VA Systems Inventory (VASI) to access VA systems information, if the solution relies on VA system information. VASI is the authoritative source for VA Information Technology systems.

8. Interfacing with Enterprise Mission Assurance Support Service (eMASS) to access the Authority to Operate (ATO) status of all VA Information Systems.

eMASS contains the official Authority to Operate (ATO) status of all VA Information Systems.

6.1.10 SOCIAL SECURITY NUMBER (SSN) REDUCTION

The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN with the ICN in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA MPI for identity traits to include the use of the ICN as the Primary Identifier. The Contractor solution may only use a Social Security Number to identify an individual in an information system if and only if the use of such number is required to obtain information VA requires from an information system that is not under the jurisdiction of

VA.

6.1.11 SOFTWARE AND LICENSING REQUIREMENTS

6.2 SECURITY AND PRIVACY REQUIREMENTS

It has been determined that protected health information may be disclosed or accessed and a signed Business Associate Agreement (BAA) shall be required. The Contractor shall adhere to the requirements set forth within the BAA, referenced in Section D of the contract, and shall comply with VA Directive 6066.

6.2.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Position Sensitivity and Background Investigation Requirements by Task Task Number Tier1 / Low Risk Tier 2 / Moderate

Risk Tier 4 / High Risk

5.1 ☐ ☒ ☐

5.2 ☐ ☒ ☐

5.3 ☐ ☒ ☐

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

6.2.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

Contractor Responsibilities:

a. The Contractor shall prescreen all personnel requiring access to the computer…