SSN-PSC347827 FedHealth IT Software Licencing and Operation Maintenance Svcs_03032026.pdf

SSN#PSC347827 1

FedHealth IT Software Licensing and Operation Maintenance Services Federal Occupation of Health (FOH)

SOURCES SOUGHT NOTICE

Date: 03/03/2026

Title: FedHealth IT Software Licensing and Operation Maintenance Services

This is a Sources Sought Notice (SSN) and is for market research purposes only. This is NOT a solicitation for proposals, proposal abstracts, or quotations. The government is seeking capability statements to obtain knowledge and information on potential vendor capability, capacity, and interest for project planning purposes. This is for informational purposes only. No questions will be answered.

Purpose

The FedHealth Occupational Health Management System (OHMS) IT Software Licensing and Operation Maintenance Services requires user licenses and Operations and Maintenance (O&M) services for supporting FedHealth. FedHealth is a customized occupational health system built upon the commercial off-the-shelf (COTS), Enterprise Health products. FedHealth is utilized to manage select functionalities within the occupational healthysystem, such as patient scheduling, patient charting, as well as administrative modules such as agreements tracking and billing. The contractor will be required to provide necessary enterprise software licenses for FedHealth, essential for FOH's utilization of the system, and perform operations and maintenance support, including system design, software enhancement, software upgrades, bug fixes, coding, and system configuration. for the FedHealth OHMS. Therefore, the FedHealth OHMS IT Software Licensing and Operation Maintenance Services Contract requires the contractor provide user access, maintain, and modify the system as required by FOH.

As such, the Government is looking for Capability Statements from both small and large businesses, who are interested and, capable of providing the necessary licenses, services, and support.

The contractor shall be able to provide the following licenses, support, and services:

1) Provide Enterprise Health software enterprise user licenses, initially for up to 1,000 system users, but requiring flexibility and scalability across the FOH enterprise.

2) .Ensure compliance and uninterrupted service for the FedHealth system.

3) Provide operational and maintenance services, including system updates, and potential modifications.

Please see the draft statement of work (SOW) on pages 4-12 and the technical questions on page 13.

SSN#PSC347827 2

Federal Occupation of Health (FOH)

The anticipated period of performance (POP) for the requirement is expected to be a base period of 12 months with four 12-month option periods, for a total of five years of service.

Capability Statement Inquiries/Submission Instructions

The technical questions on page 13 of this SSN shall be answered on the attached spreadsheet and returned as an attachment to the Capability Statement. The technical questions spreadsheet will not be included as part of the page count.

The Capability Statement shall be limited to 15 double-spaced pages total. The pages will have 1-inch margins, and using not less than 12-point font, Times New Roman. Tables and figures can be Times New Roman and no smaller than 9-point font. Tables and figures will not be a part of the page count, but the total number of tables and figures shall be limited to 12. The Cover Letter, Tables of Contents, and Technical Appendix are also not included in the page count.

No phone calls or questions will be accepted.

Capability Statements shall be submitted via email to the Contract Specialist, Ginger Lease at:

ginger.lease@hhs.gov, by 10:00am ET on Tuesday, 03/17/2026.

Disclaimer and Important Notes

This notice does not obligate the Government to award a contract or otherwise pay for the information provided in response. The Government reserves the right to use information provided by the respondents for any purpose deemed necessary and legally appropriate. Any organization responding to this notice should ensure that its response is complete and sufficiently detailed. Information provided will be used to assess tradeoffs and alternatives available for the potential requirement and may lead to the development of a solicitation.

Respondents are advised that the Government is under no obligation to acknowledge receipt of the information received or provide feedback to respondents with respect to any information submitted. Any solicitation resulting from the analysis of information obtained will be announced to the public in System for Award Management (SAM) in accordance with FAR Part

5. However, responses to this notice will not be considered adequate responses to a solicitation.

SSN#PSC347827 3

Federal Occupation of Health (FOH)

Confidentiality

No proprietary, classified, confidential, or sensitive information should be included in your response. The Government reserves the right to use any technical information received in response to this Sources Sought Notice in any resultant solicitation(s).

Statement of Work - DRAFT

FedHealth Occupational Health Management System (OHMS) IT Software Licensing and Operation Maintenance Services

C.1 Purpose

The FedHealth Occupational Health Management System (OHMS) IT Software Licensing and Operation Maintenance Services Contract requires user licenses and Operations and Maintenance (O&M) services for supporting FedHealth. FedHealth is a customized occupational health system built upon the commercial off-the-shelf (COTS), Enterprise Health products.

FedHealth is utilized to manage select functionalities within the occupational healthysystem, such as patient scheduling, patient charting, as well as administrative modules such as agreements tracking and billing. The contractor will be required to provide necessary enterprise software licenses for FedHealth, essential for FOH's utilization of the system, and perform operations and maintenance support, including system design, software enhancement, software upgrades, bug fixes, coding, and system configuration. for the FedHealth OHMS. Therefore, the FedHealth OHMS IT Software Licensing and Operation Maintenance Services Contract requires the contractor provide user access, maintain, and modify the system as required by FOH. As such, the contractor shall:

1) Provide Enterprise Health software enterprise user licenses, initially for up to 1,000 system users, but requiring flexibility and scalability across the FOH enterprise.

2) .Ensure compliance and uninterrupted service for the FedHealth system.

3) Provide operational and maintenance services, including system updates, and potential modifications.

C.2 Program Description and Background

The mission of Federal Occupational Health (FOH), a component of the Program Support Center (PSC), within the U.S. Department of Health and Human Services (HHS), is to improve the health, safety, and productivity of the Federal workforce. Granted authority under 5 USC § 7901, FOH promotes and maintains the physical and mental fitness of federal employees of HHS and other federal agencies by providing occupational health programs and services, including clinical services delivery, expert medical consultation tailored to a particular federal agency’s occupational health service needs, wellness and health promotion services, behavioral health services, and environmental health and safety services.

FOH provides occupational health programs and services as centralized services through the HHS Service and Supply Fund (SSF) authorized at 42 USC 231. The Continuing Appropriations Act, 2021, and Other Extensions Act, Pub. L. No. 116-159, div. C, title I, sec. 2107 (Oct 1, 2020) states that the SSF Statute “shall be applied with respect to any fiscal year as though the phrase ‘central services’ referred to central services for any Federal agency.” This provides specific transfer authority for the provision of occupational health services under 5 USC §7901 for both HHS employees and employees of another federal agency.

FOH provides such occupational health services to federal customer agencies exclusively through Interagency Agreements (IAAs). FOH is the largest provider of occupational health services in the Federal Government. FOH negotiates IAAs with federal departments, agencies' national headquarters, and their regional/local components for occupational health and consultation services. FOH maintains sole responsibility for consulting with its federal departments and federal agency customers.

FOH comprehensive services include:

(a) Clinical Health Services (CHS) - Occupational medicine services, medical employability and fitness for duty services that focus on assessing the ability of the employee to meet immediate job demands, increase employee productivity and improve employee performance

(b) Environmental Health and Safety (EHS) - ensures a safe working environment through site assessments, environmental health oversight of all FOH occupied spaces, emergency preparedness and emergency response

(c) Wellness and Health Promotion Services (WHPS) - services to assist employees in achieving and maintaining good health so that they can sustain peak performance

(d) Behavioral Health Services (BHS) – Employee Assistance Program, Work/Life and other behavioral health services designed to promote emotional well-being and a healthy life balance through stress management, financial and legal counseling, and professional referrals.

Additional background information about FOH may be found at https://www.hhs.gov/about/agencies/asa/foh/index.html.

C.3. Scope

The Contractor shall provide software licenses and perform operations and maintenance support, to include system design, software enhancement support, and software upgrades for the FedHealth OHMS.

FOH partners with vendors for Contractor-owned/ Contractor-operated (COCO) Platform-as-a- Service (PaaS) and Software-as-a-Service (SaaS) to execute our operational service. The Contractor shall work with HHS, third-party vendors, and other stakeholders to support FedHealth OHMS as directed by the Government in accordance with the contract.

https://www.hhs.gov/about/agencies/asa/foh/index.html

C.4. Current Environment Description

Non-sensitive information for the FedHealth environment is described within this section. Within scope upgrades to services and platforms may be required in accordance with FOH operational and security requirements. The Government will disclose sensitive details post award.

(a) FedHealth is a web-based system that is accessible by all authorized FOH personnel.

FedHealth is built upon the commercial off- the-shelf (COTS), Enterprise Health products.

(b) FedHealth is hosted as PaaS in the HHS Cloud Managed Application Hosting Center (C-MAHC) operated by HHS Office of the Chief Information Officer (OCIO).

(c) Users access the system using an internet browser, using a TLS/SSL connection. The use of TLS/SSL helps ensure that data transmitted between the browser and the web server is not susceptible to interception.

(d) The browsers running the web application connect to the scalable web server farm operating with Apache web services and in-turn to the database servers.

(e) Maria database in RHEL provides database technology for the applications. The Maria DB servers are scalable. Currently there is a core database server; a cloned server for reporting;

and one is dedicated for queued reports. Each server may be scaled with additional processors, memory, and/or storage devices as needed.

(f) The web servers are hosted on the Secure Subnet; this area of the network is isolated from the Internet by the External Firewall within the C-MAHC.

(g) The data system contains PII on the database server on the Secure LAN. The Secure LAN is an area that is isolated from the FOH LAN/WAN by an Internal Firewall.

(h) The RHEL based Apache provides an application hosting platform for the FedHealth WebChart based application. Note: the system is designed so that if traffic gets to be excessive for one web server to support, it will be possible to scale to multiple web servers.

(i) End users can send and receive large or numerous files that would not be practical via OCIO provided methods and allow for simple retrieval by recipients. Files are sent via HHS File Sharing Platform built on Box secure cloud content management.

(j) Authentication services for systems accessed from remote sites are managed by the HHS Access Management Services (AMS) service utilized for FedHealth

(k) AMS is an Identity Assurance Level Three (IAL3) Authenticator Assurance Level Three (AAL3) identity provider that is a separate page with a consistent interface that controls access to FedHealth

(l) FedHealth OHMS is on virtual machines with production and staging environments on HHS hosted Amazon Web Services (AWS) instances. The production and support environments (staging, quality assurance (QA)) are Amazon AWS EC2 (Elastic Compute) instances that are managed by an outside cloud vendor. All systems RedHat Enterprise Linux. Each instance is set up with internal and external configurations to control access depending on use case.

When RDS is stood up, it will act as a serverless solution.

(m) Development environments are also hosted on HHS managed AWS hosts. There is no fail-over environment.

(n) Backups are performed by HHS via a ComVault solution in the C-MAHC.

(o) Corporate Anti-Virus protection, a Zenoss solution, is supported by HHS in the C-MAHC.

(p) Patch management and configuration compliance is the shared responsibility of FOH IT and

HHS OCIO. FOH IT provides for the Application layer up, while HHS OCIO manages everything below the Application layer, including the OS layer.

(q) FOH assets reside on the HHS general support network managed by OCIO. FOH asset security is the shared responsibility of OCIO and FOH IT.

(r) Tenable Security Center OCIO- managed is used to analyze security vulnerabilities in both instances. This system identifies known and zero-day vulnerabilities, plus provides security risk assessments, enabling security best practices, policy enforcement, and regulatory audits.

C.4.1 Software Licenses

The Contractor shall provide licensing for approximately up to 1000 users, functional module/ component, user type, and/or physical site location.

C.4.2 Operations and Maintenance Support

C.4.2.1 Operational and Application Support

The Contractor shall provide operations support for FedHealth OHMS to include but not limited to:

(a) Provide the Government with incident response, troubleshooting, and problem resolution support for FedHealth.

(b) Assist the Government to execute upgrades, apply bug fixes, and implement software enhancements.

(c) Design and deliver new functionality, as approved by the Government.

(d) Modify code and implement code, as approved by the Government, ensuring proper functionality of FedHealth.

(e) Update existing reports or build new reports as requested

(f) Use industry best practices to reduce the number and severity of incidents and problems associated with FedHealth and associated environments, as appropriate.

(g) Implement a proactive process that identifies and resolves problems before incidents occur.

(h) Provide targeted support through defined processes including review of internal issues reported related to fixes, upgrades, etc.

(i) Identify and advise the government of recommendations to mitigate potential challenges.

(j) Notify the Government and provide relevant information upon issue identification.

(k) Provide the Government with the ability to report issues electronically and track their progress electronically.

(l) Provide the Government with the ability to generate reports.

(m) Report all management activities related to tracking, reporting on and resolving issues escalated by the Government.

C.4.2.2 System Maintenance

The Government reserves the right to manage and/or maintain the system in its entirety or assist in any component of its management or maintenance that does not breach Contractor software licensing agreement(s).

The Contractor shall perform systems maintenance activities to include but not limited to:

(a) Provide the Government with regular software updates to ensure that FedHealth OHMS remains within two versions of the current COTS release

(b) Provide the government with support to maintain production to QA data sync to ensure accurate testing.

(c) Develop and test in their environment prior to release.

(d) Provide the Government with hotfix files / patches.

(e) Assist in the implementation of changes in the staging environment for user acceptance testing (UAT) and validation.

(f) Validate changes in staging for any potential impacts prior to production release.

(g) Support patching, maintenance and upgrades as needed and requested by the Government.

The Contractor shall also provide release notes for all changes.

(h) Provide support to proactively identify and resolve vulnerabilities

C.4.2.3 Configuration and Change Management:

The Contractor shall perform configuration and change management activities to include but not limited to:

(a) Assist the Government in maintaining the FedHealth Occupational Health Management System (OHMS) and all associated environments by utilizing industry-recognized best practices and methodologies.

(b) Provide comprehensive technical documentation to support effective system operation and continuity.

(c) Assist the Government in implementing approved changes within the FedHealth environment, including Development, Quality Assurance, Staging, and Production by performing maintenance and management of existing configurations.

(d) Assist the Government to execute upgrades, apply bug fixes, implement enhancements, and deliver new functionality, as approved by the Government.

(e) Provide necessary updates to the commercial-off-the-shelf (COTS) product as they become available

(f) Provide the Government with information about its testing and development environments.

(g) Assist the Government to implement the necessary updates to FedHealth specific products to keep them compatible with upgraded COTS solutions

(h) Provide technical documentation for review and validation.

(i) When the Government submits a support request, the Contractor shall assess the

Governments’ requests and propose approaches for fulfillment

(j) Develop and implement the changes in the staging environment for user acceptance testing

(UAT) and validation.

(k) If changes are approved by the Government for deployment, the Contractor shall batch configuration components into a JSON file for import into Production and advise the Government on which components to export from Staging for migration to Production.

(l) Provide necessary updates to the COTS solution and assist the Government to implement changes to FedHealth specific products to maintain compatibility with changes to dependent software, systems and security updates including resolution to security vulnerabilities

(m) The Contractor shall report all change management activities related to tracking, reporting on and resolving issues escalated from the Government.

(n) Assist the Government in developing and implementing a Configuration Management Plan (CMP) for any changes to be implemented in the system. The CMP shall include, at a minimum. the following components for each change:

1) Documentation that clearly captures and defines the required changes and enables the Government to understand the components of any requested change, including bug fixes, new functionality or enhancements, and management of existing system configurations.

2) Processes based on governance structure that is transparent to its users include steps that validate the need for changes, as well as how changes may affect/impact the system and its current users.

3) Changes shall be released in a controlled and reproducible manner that would allow rollback if unforeseen problems occurred during the release.

4) Changes should be developed in a development environment (not in production).

5) Functional and integration testing shall be performed prior to release.

6) Changes should be installed in staging environment for review and validation.

7) User notification

8) System changes scheduled within approved maintenance windows as to not affect the required availability of the system.

9) The Contract shall report all change management activities related to tracking, reporting on and resolving issues escalated from the Government.

C.4.2.4 System Compliance

The Contractor shall assist the Government in maintaining the technical specifications related to the FedHealth environment.

C.4.2.5 Security Standards

The Contractor shall assist the Government to ensure that FedHealth environments meet the current HHS security controls and standards to maintain the Authorization to Operate (ATO) from the HHS Office of the Chief Information Officer (OCIO).

C.4.2.6 Training

The Contractor shall provide the Government with training, documentation and lessons learned for new modules, enhancements and software upgrades.

The contractor should maintain a library of technical documentation including and provide government access.

C.4.2.7 Reporting

The Contractor shall be responsible for reporting all change management related tracking, reporting on, and resolving issues originating from the Government.

(a) Weekly Reports

The Contractor shall provide a weekly report of all issues that were opened or worked on during the past week to the Government. At a minimum, this report must contain the following information:

1) Name of person reporting issues or submitting request

2) Identification of name and number of users who are affected by this issue

3) Identified Priority of the issue

4) Date and time of contact

5) Description of the issue

6) Initial estimated level of effort (LOE) (hours)

7) Updated estimated LOE (as needed)

8) Actual level of LOE

9) Time until completion

10) Assigned resource(s)

11) Status of resolution

12) Notes on the planned resolution

13) Notes on the progress to resolve the issue

14) Closeout date/time

15) Identification of who accepted close out

(b) Monthly Reports

The Contractor shall provide a monthly report of all issues that were opened or worked on during the past month to the Government. The report must contain the following information:

1) Name of person reporting issues or submitting request

2) Identification of name and number of users who were affected by this issue

3) Identified Priority of the issue

4) Date and time of contact

5) Description of the issue

6) Initial estimated level of effort (LOE) (hours)

7) Updated estimated LOE (as needed)

8) Actual level of LOE

9) Status of resolution

10) Notes on the planned resolution

11) Notes on the progress to resolve the issue

12) Closeout date/time

13) Identification of who accepted close out

C.3.2.8 Service Level Response and Resolution Times

(a) The Contractor shall respond within thirty (30) minutes and provide the necessary resources needed to assist the Government in resolving the issue within twenty-four (24) hours for any outage. An outage is any time more than five (5) people are unable to utilize the system as intended.

(b) The Contractor shall respond within sixty (60) minutes and assist the Government in resolving the issue within seventy-two (72) hours for a significant impairment to end users’ ability to perform work or if a mandated regulatory issue is identified.

(c) The Contractor shall respond within twenty-four (24) hours and assist the Government in resolving within five (5) business days issues that do not impair end users.

C.3.2.9 Enterprise Performance Lifecycle

The Contractor shall develop, review and advise on the IT system, design, planning, and implementation requirements according to the HHS EPLC process. The Contractor shall provide support throughout implementation and maintenance of the system, FOH The Government shall manage EPLC documentation over the lifecycle of the system with support from the Contractor, as appropriate. The Government or designee shall notify the Contractor of any required revisions and recommendations identified during the review process that require changes to the documentation or affect the management and/or direction of the program over the life cycle of the system. The

Government shall manage, review, and provide final approval on all Contractor furnished content supporting the EPLC.

C.3.3 Transition Placeholder C.4. ITAR Language Placeholder

1. Can your company provide licensing for the product outlined in the SOW?

2.

If so, does your company offer enterprise licensing for the product outlined in the SOW?

3.

If enterprise licensing is unavailable, can your company provide per person software licensing for the product outlined in the SOW? If so, please specify the enterprise threshold.

4.

Does your company have the capability to perform all required services as detailed in the draft SOW?

5. Will any areas of the SOW require subcontracting from your company?

6.

In your estimation, what proportion of this requirement would need to be subcontracted to other firms?

7.

Does your company have similar or prior experience with the type of work described in the draft SOW?

8.

Is your company capable of providing personnel with the necessary security clearances?

9. Can your company meet the requested period of performance schedule?

10.

Please elaborate on your ability to provide seamless support services as identified in the SOW.

11.

What is a realistic response time for preparing an RFQ for this type of solicitation?

12.

How much lead time will your company require from notification of award to commencement of work?

13.

Does your company possess the expertise to ensure a successful contract transition within 30 days of award?

Capabilities Statement Information

1. Customer Name

2. Customer POC/Client Email

3. Total Contract Value

4. Period of Performance

5. Brief Description of Services Provided

6. Is there a CPARS available, yes or no?

Please do not provide general capabilities statements. Only provide relevant information related to this requirement.

Sources Sought Notice - Technical Questions

Capabilities Statements should include relevant experience, relevant experience are projects that are similar to the described requirements that have occurred in the past 5 years. Please include at most 3 relevant projects and the following information in the Capability Statement

SSN#PSC347827

FedHealth IT Software Licensing and Operation Maintenance Services Federal Occupation of Health (FOH)

AnswersTechnical Questions