Statement of Need_Security Innovation IT Operations.pdf

Statement of Need for Security, Innovation and IT Operations (SIO)

Background

The Centers for Medicare & Medicaid Services (CMS) is a federal agency within the Department of Health and Human Services (HHS) responsible for administering key healthcare programs, including Medicare, Medicaid, CHIP, and the Health Insurance Marketplace. CMS also leads efforts to promote value-based care, clinical quality, and the adoption of modern data standards in healthcare.

The Center for Clinical Standards and Quality (CCSQ) plays a critical role in ensuring the quality and safety of care delivered to millions of beneficiaries. CCSQ relies on an interconnected set of systems and services to manage clinical quality reporting, certification processes, and regulatory oversight. As the healthcare ecosystem shifts toward greater interoperability and real-time data exchange, CCSQ’s mission increasingly depends on modern, efficient, secure, and standards-based technical infrastructure, that leverages, where appropriate, the use if AI and promotes an interoperability framework by introducing and expanding the use of FHIR-based APIs. In an effort to optimize and reduce the cost of IT services, CMS/CCSQ is proactively reviewing all contracts for embedded IT components. This initiative will include a comprehensive scan of current contracts (led by CMS), identification and management of corrective actions, targeted communications, process refinement, and an educational campaign to prevent future occurrences. CMS anticipates needing architectural, security, and project management support as part of this effort.

Problem

As CCSQ’s technical environment evolves, so do the challenges of maintaining architectural coherence, security, and system-wide alignment. Specific challenges include:

• Fragmented architectural design and limited interoperability, particularly in relation to emerging FHIR standards and secure API implementation for clinical data exchange.

• A lack of centralized oversight and guidance across systems handling CMS data.

• Inconsistent adoption of modern data standards, impeding interoperability across CMS and external partners.

• Limited bandwidth to coordinate system planning, manage cross-program dependencies, and communicate updates effectively to users and stakeholders.

• Inadequate support for strategic intake, leading to delays and misalignment in how CCSQ manages technical services.

• Gaps in budget visibility, making it difficult to track and categorize work and costs across distributed teams and programs.

Desired Results

To address these challenges, CMS requires contractor support that delivers the following outcomes:

• Provide architectural leadership to support federal decision-making that is unbiased yet informed by existing services and tools. Examples:

o FHIR and healthcare data interoperability, with guidance on implementing standards-compliant APIs and secure data exchange frameworks.

o Also includes the integration of AI to enhance service delivery and advance

CCSQ’s mission.

• Support includes participation in and facilitation of governance review boards, as well as preparation and coordination for governance-related activities.

• Release Train Engineering (RTE) support to coordinate delivery planning across programs, manage dependencies, and ensure alignment with evolving interoperability goals.

• Security operations and risk management services to support system hardening, incident response, and oversight of environments that process CMS data.

• Independent architecture analysis and recommendations, particularly in areas involving standards adoption, AI, data exchange, and platform scalability.

• Technology scanning and applied research, enabling CMS to stay ahead of relevant innovations, tools, and frameworks in healthcare IT.

• Communication and stakeholder coordination, including targeted outreach to end users regarding system updates and cross-team alignment within the QualityNet environment.

• RPA development to streamline recurring, rules-based workflows.

• PRA compliance support, to ensure data collection changes align with federal requirements.

• Strategic intake and budget visibility tools, supporting better prioritization, cost tracking, and decision-making across the CCSQ IT landscape.

To preserve objectivity, the selected contractor will not be eligible to bid on any other CCSQ work during the period of performance.

Vendor Response Questions. NOTE: Responses must be made via the Microsoft Forms link provided in this RFI.

1. Describe your experience architecting FHIR-based solutions, implementing APIs for healthcare data exchange, or supporting interoperability initiatives in a federal or healthcare environment.

2. Describe your experience leading and organizing SAFe agile value streams.

3. How have you provided architectural guidance across systems or programs, particularly in support of standards adoption and platform scalability?

4. Describe your experience coordinating technical releases and engaging end users regarding system changes across multiple teams or systems.

5. How have you supported strategy development and work intake planning in complex IT environments, particularly in support of regulatory or standards-driven outcomes?

6. What methods have you used to assign costs and categorize technical work across distributed programs to support accurate budgeting and oversight?

7. Provide an example of how you’ve supported acquisition modernization aligned with technology trends such as FHIR, API-first architecture, or cloud-native services.

8. Describe your previous work with CMS or CCSQ. What insights has your team gained from that experience that would be valuable in supporting this effort?

9. Describe your experience supporting federal FISMA application/system security.

10. Describe your experience assisting federal agencies with identifying and aligning IT systems that may have been developed or deployed outside traditional governance or compliance frameworks. How did you support the integration of those systems into the agency’s enterprise risk management or cybersecurity boundary structures?