VA DataCommons JA redacted.pdf

Control Number VA-21-00020277

JUSTIFICATION FOR OTHER THAN FULL AND OPEN COMPETITION

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition, and Logistics

Technology Acquisition Center 23 Christopher Way Eatontown, New Jersey 07724

2. Description of Action: The proposed sole source action is for a hybrid time and material (T&M) and firm-fixed price (FFP) procurement, for a research cloud based Data Commons software-as-a-service platform with the University of Chicago (U of C), 5801 South Ellis Avenue Chicago, Illinois 60637-5418.

3. Description of Supplies or Services: The proposed action is for U of C to provide a fully designed, developed and operational Gen-3 based Data Commons software-as-a service platform, defined as co-located data with computing infrastructure and commonly used software services, tools, and apps for managing, analyzing, and sharing data, to create an interoperable resource for the Veterans Health Administration (VHA) research community – supporting research using electronic medical record and genomic data for federal agencies and non-profit organizations, including the Bionimbus Data Commons and the Genomic Data Commons.

Specifically, to accomplish the mission of VHA Office of Research and Development, to improve the lives of Veterans and all Americans through health care discovery and innovation, VA reviews and makes available to VA-approved Recipient Researchers certain data for ethically conducted research that is scientifically meritorious and of a sound research design. This process requires VA to support and maintain:

a) a database that includes electronic medical record data, administrative and demographic information, genetic test and sequence data, imaging, benefit and cemetery information, patient reported data, and other data linked to the Veteran population. These contain data from different sources either collected or received during provided clinical or administrative services to Veterans, or collected or received as part of clinical trials or other research studies;

b) a library of tools for exploring, visualizing, and analyzing data from the database;

c) a computational infrastructure that facilitates secure, approved access to VA

Data and the library of tools that can scale to thousands of simultaneous users from across the country; and

d) a set of support services to review and approve access to VA Data, provide education and training to VA-approved Recipient Researchers, and otherwise facilitate the proper understanding and use of VA Data to translate genetic and other research discoveries into meaningful clinical care for Veterans.

VA currently has limited storage space and computing power on premise (Austin Information and Technology Center via the VA Informatics and Computing Infrastructure and GenISIS) for conducting approved scientific activities. To realize

Veterans Health Administration Data Commons Control Number VA-21-00020277 the full potential of the substantial investment in collecting and providing VA Data for research, VA needs to expand data access to many qualified researchers within and outside of the VA who can yield scientific value from the data. Thus, VA has identified U of C the key resource with the necessary expertise and technology to, access and conduct research on VA Data in a secure environment by a broader and larger group of researchers. In addition, VA must maintain sufficient access control processes and infrastructure to ensure that data access is limited to approved researchers.

The contractor shall ensure that the system is fully developed, is end-user friendly, as well as consistent and supportive of the VHA and Office of Information Technology regulatory framework needed to securely transfer, store, and use VA data within the VA Data Commons. The contractor shall ensure the final product meets VA technical requirements and supports software applications necessary to conduct common research functions within the VA Data Commons.

4. Statutory Authority: The statutory authority permitting other than full and open competition is 41 U.S.C. 3304(a)(3) as implemented by the Federal Acquisition Regulation (FAR) 6.302-3 (a)(2)(ii) entitled, “To establish or maintain an essential engineering, research, or development capability to be provided by an educational or other nonprofit institution or a federally funded research and development center.”

5. Rationale Supporting Use of Authority Cited Above: Based on the current limitations of VA to fulfill its mission within its current infrastructure, VA must partner with U of C’s Center for Translational Data Science to meet the requirements stated above. U of C has designed, developed, and operates many similar Data Commons with other Government entities including the National Institute of Health.

Further, U of C operates a Commons Services Operations Center (CSOC) to manage the operations of multiple Data Commons on both private and public clouds, including the security and compliance related procedures and controls. Additionally, although the VHA Gen-3 Data Commons is built on open source software, it includes custom software and security services required to operate the platform proprietary to U of C. This proprietary software product is custom designed to deliver and meet the Federal Information Security Modernization Act (FISMA)/Federal Risk and Authorization Management Program (FEDRAMP) security required by VHA’s data security specifications. This instance of the Gen3 software integrated with this proprietary operating platform is the only one available that can provide the required Gen3 performance and security enhancements.

The Gen3 platform is essential as it is responsible for providing and managing the most common functions of a research community. U of C’s solution is proprietary, and they have no resellers, nor do they allow other vendors to provide access or support for their Data Commons solution.

The U of C Data Commons prototype was an expansion on a minimal viable product chosen during a VHA held industry day. The University of Chicago’s Gen3 Data Commons was chosen as the best candidate over market leaders from SevenBridges, DNAnexus, and Terra to support VHA’s data commons effort. A cooperative research and development agreement (CRADA) was then established to continue to configure and expand the solution to support the full set of requirements for the VA Data Commons. This process has taken in excess of two years and the participation of a significant number of stakeholders within the Office of Information Technology, U of C and VHA.

Specifically, U of C has collaborated with the VA to customize their environment and software to meet the specific data analysis, security, and privacy requirements of VA policy. This includes the integration of Postgres relational database system to their environment to host Genetic Research Data from the Million Veterans Program (MVP) and VA Clinical Data configured for the Observable Medical Outcomes Partnership (OMOP) data platform. They have also installed and configured Observational Health Data Sciences and Informatics (OHDSI’s) ATLAS software interface, which will allow VA users to define and characterize the patient cohort for each project in ways not possible previously in on prem hardware. They further customized the platform to allow VA researchers to use ATLAS for cohort definition in advance of beginning a genome-wide association study (GWAS). Additionally, U of C integrated their solution with VA’s Active Directory Federation Services (ADFS) to authenticate VA users as a part of the login process; thereby, allowing VA users to use the familiar PIV card authentication to login to the VA Data Commons. U of C has also tested the environment and software with a VA synthetic dataset in preparation for the actual VA data. The testing successfully loaded VA’s synthetic dataset in their environment and demonstrated ATLAS functionality. They also successfully completed ADFS login process, which was a pre-requisite to obtaining the required Authority to Operation (ATO). Although a permanent ATO is still pending approval, U of C has worked closely with the VA in providing extensive information on the computing environment and software for the VA Data Commons in support of receiving the ATO. After multiple rounds of reviews of this information by the VA’s Project Special Forces team and Cloud Security Team, lasting over a year, VA has granted the project a temporary ATO. U of C has paid for an independent security assessment of their system and is in the process of obtaining FedRAMP certification, which will pave the way for an extended ATO. The FedRAMP process, which U of C has nearly completed, by itself takes six to twelve months to complete at a significant cost.

Lastly, U of C and VA have gone through numerous work sessions to define and setup appropriate work flows. These efforts have spanned over a year in time.

Specifically, U of C has added a specific workflow to guide the pre-GWAS process through the cohort definition and validation process and are working closely with VA in adding a project authorization workflow to ensure each user is only able to access and work with project(s) they have been approved for by VA.

Even if another vendor could provide a Gen-3 based SaaS product, VA would lose benefit of the past two years of collaboration with U of C and investment into system development and enterprise system approval leading to the issuance of the current ATO. To date, VHA has invested roughly $1M and 23 months of time in setup and University of Chicago has also invested $2M. Pursuing a similar course of action with another vendor would cause at minimum 24 months of delay and roughly $3M in additional capital investment to redo the work that’s already been completed with U of C. This could potentially cause VA to delay important and potentially lifesaving research in support of our nation’s Veterans.

Although U of C was willing to provide several million dollars in direct funding, it is not guaranteed another university would do so and thus the entire cost could potentially fall on VA. U of C has confirmed they are the only vendor that can provide subscriptions to the required SaaS platform and access to the application’s code base necessary to maintain the solution throughout the PoP.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in the market research section of this document. This effort did not yield any additional sources that can meet the Government’s requirements. There is no competition anticipated for this acquisition. Additionally, the proposed action will be synopsized on the Federal Business Opportunities Page in accordance with FAR

5.201. Any proposals that are received shall be evaluated.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the market place that would enable future actions to be competed.

8. Market Research: Market research was conducted in April 2021 to ascertain if any other products could meet the interoperability, security, and configuration requirements described in paragraph 5 above. Market research conducted by comparison of similar products available both commercially and by not for profit institutions, including universities and educational institutions, included within the data commons universe. Commercial products from SevenBridges, DNAnexus were evaluated, along with Terra, a subsidiary of Broad, which is a not-for-profit, affiliated with Harvard and the Massachusetts Institute of Technology, did not provide any additional sources that could meet VA’s requirements. Specifically, none of the solutions indicate a current integration with ADFS, demonstrated usage of OMOP Tools and ATLAS functionality, facilitating the workflows necessary to support VA’s data security or controlled access requirement, an active and valid VA ATO, or the ability to avoid the duplicative costs and delays outlined in Section 5. VA contacted U of C on June 14, 2021 to verify that there were no resellers of the required Data Commons SaaS platform. In their response, U of C confirmed that their solution is proprietary, and they have no resellers, nor do they allow other vendors to provide access or support for their Data Commons solution.

9. Other Facts: None