TBLD-M RFI.pdf

Request for Information

Joint Operational Medicine Information System

Theater Blood Program

HT003824R0010

THIS IS A REQUEST FOR INFORMATION (RFI) ANNOUNCEMENT ONLY. This notice does not constitute a commitment by the Government. All information submitted in response to this announcement is voluntary, and the Government will not pay for information requested nor will it compensate any respondent for any cost incurred in developing information provided to the Government.

The Defense Health Agency Contracting Activity (DHACA) Defense Healthcare Management Systems Contracting Division (DHMS-CD), in support of Program Executive Office (PEO) Defense Healthcare Management Systems (DHMS), Joint Operational Medicine Information System (JOMIS) Program Office (PMO), is seeking potential sources with effective capabilities to continue development of the Theater Blood Application and support. The PEO DHMS is conducting market research to inform its strategy for a follow-on contract in support of the Theater Blood - Mobile (TBLD-M) program which includes continuation of development, deployment, testing and enhancement of an Operational Theater Blood application. TBLD-M will share Theater blood data with other Electronic Health Record (EHR) systems that align with the overall architecture of the JOMIS portfolio to provide electronic transmission and storage of blood data from one location to another throughout the Range of Military Operations (ROMO), supporting enterprise and Command decision making.

The primary mission of the Military Health System (MHS) is to ensure the Nation continuously has a healthy fighting force and the ability to support ROMO. In pursuit of this objective, Department of Defense (DOD) medical providers in operational environments require the capability to sort, type, receive, capture, store, forward, view, share, annotate, and archive blood related data in all common modalities.

Description of Need

The JOMIS PMO requires a deployable Theater Blood capability and management services in support of medical blood related data produced in operational environments and archived in a regional or other designated joint repository as designated.

The existing contract for this effort is ending on March 10, 2025, therefore information gathering and timing of obtaining options is critical. The existing Application uses a combination of Java Script and Python custom code and has not yet reached Minimum Viable Capability Release (MVCR) with initial limited deployment anticipated by December 2024. An Operational Assessment at the initial release site is planned for the January 2025 timeframe. The new contract will continue Agile development, sustainment, and application enhancements as well as Sprint level and operational testing support. A key requirement is the contractor’s ability to ingest the existing program code/data and quickly provide support. Contractors should, in their replies, outline how they intend to accomplish the transfer of the program including their approach to mitigate risks, timelines and which requirements are driving the risks. Alternate schemes may be considered to simplify the processes.

Request for Information (RFI) for JOMIS Deployable OpMed Theater Blood-Mobile Application

Overview

1. The TBLD-M capability for operational blood management will be used as an integral part of the blood system and health support capabilities employed during all military operations across the geographic combatant commands (CCMD) and during fleet forces operations. Blood operations span challenging environments where theater events and limited infrastructure make joint medical response, from first responder care to theater hospitalization capabilities, difficult to provide to all tri-Service members of the United States (US) Army, US Navy (including the US Marine Corps), and US Air Force. These blood support functions track the total life cycle of blood, from the point of origin/donor to the transfused patient or point of destruction, so that quality blood products are available for clinical services. However, in the operational environment, the blood community often works in medical support facilities that have disconnected, intermittent, or low-bandwidth (DIL) connectivity to Department of Defense (DoD) enterprise networks.

2. This is a shift from the legacy Theater Medical Data Store (TMDS) application that collects data, tracks, and reports on blood activity via a web browser; due to the lack of connectivity, intermittent data capture threatens the integrity of the blood asset supply chain. Blood operation management and communications must work offline in DIL environments, thus utilizing store and forward capabilities to send data as close to real-time as possible to avoid interrupting or compromising health care delivery, especially during emergency situations. The existing efforts have made an initial development of several applications which will need to be further developed, maintained, and expanded to meet evolving requirements and the total network implementation.

3. Most Theater settings lack the ability to reliably capture data electronically, maintain automated records at the local facility, and exchange data with the enterprise, thereby limiting global visibility of walking blood banking and blood inventory, consumption, and demand. TBLD-M supports walking blood bank activity.

4. TBLD-M will be the capability that provides visible blood inventory management operations in DIL environments across all echelons of care, including Roles 1-3 (first responder, forward resuscitative, and theater hospital care) and in coordination with Role 4/ continental United States (CONUS) or garrison donor centers. TBLD-M requires access to an integrated data environment with user-centered functionality to enable the timely completion of blood management activities, significant reduction in data entry errors and delays, and reduce lifecycle sustainment costs. The system goal is to minimize maintenance workload and improve the ability to rapidly develop and deploy updates in response to changing warfighter requirements. Unlike the current paper- or spreadsheet-based approach, all donation screening and acceptance, inventory oversight and management, and transfusion record data will need to be documented electronically and available to theater medical staff and to CCMD area operations for enterprise-level use and reporting. Near real-time global blood inventory is crucial for sustaining and projecting readiness of our military force for both anticipated and unanticipated events. Given that the TBLD-M solution operates outside the United States, it is not subject to certification by the Food and Drug Administration (FDA).

5. TBLD-M will operate in a DevSecOps pipeline in the Cloud One environment as well as on Windows desktops. The initial capability runs on various Windows 10 environments supplied by the Services. A transition to Windows 11 is expected.

To be provided by Government

Draft Performance Work Statement (PWS)

Security

Security controls in accordance with Committee on National Security Systems (CNSS) Instruction No. 1253, “Security Categorization and Control Selection for National Security Systems” as outlined within NIST SP 800-171.

DODI 8510.01, Risk Management Framework (RMF).

DODI 8500.01, Cybersecurity.

Security controls in accordance with NIST implementation and validation requirements specified in the NIST SP 800-37 Risk Management Framework (RMF).

Information system configuration in accordance with Defense Information Agency (DISA) security technical implementation guides (STIGs).

DODI 8551.01 “Ports, Protocols, and Services Management (PPSM)”.

DoDI 8520.03 “Identity Authentication for Information Systems” prior to granting access.

DODI 8582.01 “Security of Unclassified DOD Information on Non-DOD Information Systems” and “Cybersecurity” and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53/53a and NIST SP 800-37, “Risk Management Framework (RMF) Guide for Applying the Risk Management Framework to Federal Information Systems, as well as emerging DOD Cybersecurity policy designed to address evolving threats.

DODD 8140.01, Defense Federal Acquisition Regulation Supplement (DFARS) 252.239-7001 and DOD 8570.01-M baseline certifications required prior to beginning support services.

CNSSI 1253 Privacy Overlay for cloud services that contain Personally Identifiable Information (PII)/Protected Health Information (PHI).

Procedures that address final disposition of PHI and PII and/or the electronic media on which it is stored.

Compliance with requirements for Health Insurance Portability and Accountability Act of 1996 (HIPAA) (P.L. 104-191), Personnel Security, Electronic Security, and Physical Security. Data which contains PHI will be continuously protected from unauthorized access, use, modification, or disclosure.

FAR clause 52.224-1, “Privacy Act Notification” and FAR clause 52.224-2, “Privacy Act.”

FedRAMP Provisional Authorization (PA) to host Federal Government missions and DOD Provisional Authorization to Operate (P-ATO).

JOMIS operates with both RMF accreditation and must demonstrate Cyber Survivability and Cyber Resilience. JCIDS Manual 2021 and CSEIG v3.0. Any Red Team Testing or Penetration Testing conducted successfully against recommended products would support its Cyber Survivability Risk Posture (CSRP).

System Authority to Operate (ATO):

The current TBLD-M product has received its ATO. A current ATO must be maintained for TBLD-M throughout its lifecycle. Use of a new vendor may require a new ATO or a Risk Management Framework

(RMF) effort in place of a Risk Assessment to the existing ATO. For discussion purposes, vendors should address their familiarity with RMF, Security Technical Implementation Guides (STIG)/SRG testing and ATO requirements.

The product must demonstrate production-ready capabilities and be able to close any security concerns within STIG Requirements and Information Assurance Vulnerability Alert (IAVA) required periods and be continuously updated to address any issues.

Organization Conflict of Interest:

Please see FAR 9.5 and DFARS 209.5 for background information related to organizational conflicts of interest. PEO DHMS/JOMIS anticipates a relationship that will require the execution of corporate nondisclosure agreements and non-compete commitments, and any resulting contract(s) may require the execution of appropriate associate agreements with prime-mission product partners to gain access to technical data and other proprietary information generated during the performance of those contracts.

Additionally, respondents to this notice should be aware that PEO DHMS/JOMIS may use contractor support personnel from the below listed companies to review responses and information submitted.

SeKON Enterprise

• Boston Consulting Group (BCG) or its subcontractors

These companies and their individual employees are bound contractually by Organizational Conflict of Interest (OCI) and disclosure clauses with respect to proprietary information, and they will take all reasonable action necessary to preclude unauthorized use or disclosure of a respondent’s proprietary data. Request for Information responses must clearly state whether permission is granted allowing the program office support contractors identified below access to any proprietary information.

Feedback Requested (Maximum Page Limit: 10 Pages):

1. How would you address the transition of the current application software code for continued development and deployment to the field using Agile methodologies?

2. What can be done or what additional information can the Government provide to lower barriers to competition?

3. What challenges, risks and opportunities do you envision with this requirement?

4. The Government is considering using the Technical Challenge evaluation approach as defined in

FAR Part 15.1 What are your thoughts on using this approach for this requirement?

5. What type of performance metrics and contract incentives do you recommend to promote innovation and rapid delivery?

6. Are there any areas in the Draft PWS that require further clarity or additional information?

7. Do any requirements make implementation difficult or impossible?

8. Are you a small business and what are your approved Cage Codes and socio-economic status?

9. Does your firm possess an approved DCAA/DCMA accounting system?

10. Does your firm possess a Facility Clearance Level of Secret or higher?

11. Does your firm have contracts on any IDIQ or BOA? If so, what ones?

12. What are your firm’s capabilities to develop and maintain applications in a Cloud One and

DevSecOps environment? (Note the application utilizes Python, JavaScript, PostgreSQL, and

AWS in Cloud One. Windows components are written in JavaScript, Python and PostgreSQL)

13. What experience does your firm have with Agile development methodologies?

14. Do you have experience with Healthcare or related applications modules (can be Government or Commercial experience)?

15. Do you have experience with logistics or inventory management?

Data Rights

Please describe the recommended approach, ensuring the Government maintains full rights in technical data. Describe how this approach could be leveraged in other program management offices or organizations that use your capabilities.

Summary Instructions

DHMS-CD is issuing this RFI for the purpose of determining vendors capable of fulfilling JOMIS’ Theater Blood requirements.

Interested parties may submit a written response stating how they would effectively fulfill the requirement and include appropriate documentation describing how this is possible with acceptable performance risk. The written response should provide sufficient detail to allow for an assessment by the Government without the need for additional information. Written responses should not exceed 10 pages excluding the title page (eight by eleven inches) with the following formatting: margins with minimum of one (1) inch, Times New Roman size 12 font, single or multiple line spacing between 1.0 and

1.5. Responses to this RFI are not quotes upon which the DHMS-CD can issue a contract. Therefore, the Government does not intend to award a contract based on responses to this RFI.

Please send responses to Ms. Elizabeth Ruckwardt and Ms. Chelsea Menchak by Friday, 23 August 2024, no later than 1500 Eastern Time via email to elizabeth.m.ruckwardt.civ@health.mil and Chelsea.r.menchak.civ@health.mil.