VHA Bulk Print Requirements 06.24.26.pdf

Veterans Health Administration (VHA) Print & Mail Requirements

1. Program Objectives

• Establish a compliant, efficient bulk print-and-mail solution for VHA, based on Veterans Integrated Service Networks (VISNs) and stations.

• Support the Oracle Health bulk printing to process Portable Document Format (PDF) letters and metadata outputs.

• Provide a scalable framework for national rollout across multiple VISNs.

• Ensure regulatory compliance, including the Cures Act and Department of Veterans Affairs (VA) security requirements.

• Commercial Off-The-Shelf/Government Off-The-Shelf/Managed Print/Mail as a Service product to consume manifest metadata files and PDF letters to print and mail to customers.

• Custom Development solutions, minimally for integration efforts (e.g., Application Programming Interface (API))

• Solution can be on or off-site.

• Meet VHA Policy 1088 requirements and Service-Level Agreements (SLAs) for print and mail delivery.

• Projections for economies of scale.

• The Contractor shall provide all necessary resources to ensure compliant, reliable, scalable, and auditable services in support of Veteran communications (mailing and printing).

2. Technical Integration Requirements

• Ability to integrate with the Veterans Affairs Enterprise Cloud (VAEC) and VISNs.

• Support for APIs, Amazon Web Services (AWS)/Azure File Storage, and secure system interfaces.

• Provide development, test, staging, and production environments.

• Provide integration test plans, data, and results.

• Nightly automated data transfer of print and mail metrics to VHA Data Warehouses.

• Provide a complete and updated data dictionary when appropriate.

• Use secure connectivity compliant with VA security and governance policies. VA Handbook 6500 – Risk Management Framework for VA Information Systems.

• VA handbook 6500.6 for Protected Health Information (PHI) & Personally Identifiable Information (PII) security handling and compliance.

• Transfer data via AWS S3 between VAEC and contractor Federal Risk and Authorization Management (FedRAMP) type / GovCloud West account.

• Support either account-to-account permissions or keys/secrets for secure transfer.

• VHA deposits letters twice daily (5am & 5pm Central Time)

– Each batch has a single consolidated Extensible Markup Language (XML) manifest text file that has metadata for all the letters in that batch

– Each batch has a separate PDF for each letter that needs to be printed

• The Contractor must consume XML metadata to generate coversheets.

• Support two monitoring models:

– AWS S3/Azure Storage object-creation event notifications to contractor Simple

Queue Service; or

– Contractor polling the bucket at the scheduled times

• Automate deletion of letters from VHA VAEC AWS/Azure Storage immediately after contractor pulls them.

• Automated management of letter lifecycle, including but not limited to intake, printing, mailing, archiving, and deleting.

• The Contractor deletes letters and metadata from their own bucket after 60 days, unless otherwise directed:

– The Contractor shall securely destroy retained files after the retention period

– The Contractor shall provide certificates of destruction upon request

– The Contractor shall support legal hold requirements when directed by VA

• Support both PDF-to-PDF (current) and text-to-PDF (future) workflows.

• Validate file transfer, parsing, and printing workflows against Oracle Health output.

• Establish discrepancy handling for manifest mismatches (reporting or email).

• Full continuity of operations (COOP) and disaster recovery plans, capabilities, and periodic testing:

– The Contractor shall support geographically redundant operations and secondary print capabilities

– Recovery Time Objective shall not exceed four hours

– Recovery Point Objective shall not exceed fifteen minutes

– The Contractor shall conduct annual failover and restoration testing

• The Contractor solution shall comply with the following frameworks and directives:

– VA Directive 6502 – Enterprise Privacy Program

– VHA Directive 1605.01 – Privacy and Release of Information

– Federal Information Security Modernization Act requirements

– Federal Information Processing Standards 140-2 (or successor) encryption requirements

– Section 508 accessibility requirements

– Role-based access control and multifactor authentication

3. Printing Requirements

• Daily capacity to process black-and-white letter print jobs/day, scaling from 50,000 to millions per month per VISN, equating to over 11,000,000 per month for all clinical bulk printing needs.

• Surge support for print and mail events that will increase by a Rough Order of Magnitude.

• High volume print production with commercial-grade output quality.

• Support letters – pages on standard 8.5x11 paper.

• Large letters supporting up to 25 pages or greater.

• Generate a templated cover page compatible with window envelopes.

• Printed pages must include barcode margins to support insertion accuracy.

• The Contractor shall comply with applicable Government Publishing Office (GPO) Quality Assurance Through Attributes Program standards, including current versions of GPO Publications 310.1 and 310.2, or approved equivalent commercial print-quality standards acceptable to VHA.

• Automated folding, insertion, envelope preparation.

• Print accuracy SLA of 99.7% or higher.

4. Mailing Requirements

• Provide envelopes and all mailing supplies.

• Provide First-Class mail services using VISN/station existing postage account o Domestic and Foreign mailings

• Implement pre-sorting to optimize postage cost and delivery time.

• Include VA-provided Quick Response codes on coversheets directing Veterans to

MyHealtheVet.

• Process mail according to United States Postal Service (USPS) National Change of Address (NCOA) rules.

• The Contractor shall notify VA whenever a National Change of Address (NCOA) update is identified. The Contractor shall not change the mailing address on its own. Unless VA provides confirmation or updated address instructions, the Contractor must mail each letter to the address exactly as printed on the original VA-provided correspondence.

• 99.7% mailing accuracy SLA.

• The Contractor shall support USPS Intelligent Mail Barcode standards and USPS Informed Visibility tracking integration.

5. Reporting & Audit Requirements

• Provide full-lifecycle status transparency for all letters. Lifecycle statuses shall include at a minimum: Received, Validated, Queued, Printed, Inserted, Mailed, USPS Accepted, Archived, Deleted, and Failed.

• Monthly and annual cost summaries aligned to volume projections.

• Reports must include delivery tracking, volume statistics, and processing timelines

– End to end tracking for every letter

• Support for barcode/unique identifier tracking.

• Timestamp capture for:

– Received jobs

– Processed jobs

– Printed jobs

– Mailed jobs

– Failures/exceptions

– Trends over time

– Breakdown by VISN and Facility Codes

– Letter Type

– Mail transmission

– USPS handoff

• Status updates returned to originating system.

• Nightly automated data transfer or report metrics to VHA Data Warehouse.

• The Contractor shall provide automated rejects for failed prints, failed mailings, manifest mismatches, and operational exceptions --

– Daily alerts for failure of letters to print of mail (format to be jointly determined by

VHA and contractor)

– Report missing/extra files based on manifests

– Alerts to VISN/Station for mailing failures requiring reprint or remail

• Provide VHA access to contractor’s internal reporting system.

• Support real-time tracking using barcodes and USPS’s Informed Visibility API.

• Graphical self-service reporting dashboard for 500+ authorized users.

• The Contractor shall provide ad hoc reporting capabilities.

• The Contractor shall support audit logging for all administrative and operational actions.

• The Contractor shall retain audit logs for a minimum of seven years unless otherwise directed by VA.

• The Contractor shall notify VA of security incidents within one hour of discovery.

6. Testing & Pilot Requirements

• Conduct comprehensive mock testing using VA-provided sample datasets.

• Validate workflows, tracking, and connectivity before production.

• No production PHI or PII shall be used in non-production environments unless expressly authorized.

7. Deliverables

• Plan for scaling when needed.

• Completed secure AWS transfer configuration.

• Pilot test report, test plans, test scripts, expected results, and test evidence validating workflows and connectivity.

• Automated daily operational print-and-mail status reports.

• Automated monthly operational and cost reports per VISN.

• Reporting must be grouped and filterable by VISN, Station ID, Zip Codes, States, Countries, Letter statuses.

• Postage cost reports per VISN.

• System architecture documentation.

• Interface control documentation and XML schema definitions.

• Security documentation supporting Authority to Operate (ATO) activities.

• Disaster Recovery and COOP documentation.

8. Security, Privacy, & Compliance

• Ability to obtain and maintain ATO/Interim ATO per VA Handbook 6500.

• Must meet National Institute of Standards and Technology Special Publication 800 53 Rev5 Moderate baseline controls.

• FedRAMP compliance for cloud-hosted systems.

• Encrypted transfer and storage of all PHI/PII/ Controlled Unclassified Information (CUI). All PHI, PII, and CUI shall be encrypted in transit and at rest.

• All contractor staff must complete annual VA security/privacy training.

• Support VA audits, vulnerability scanning, and penetration tests.

• Print facilities must meet all VA contract and privacy standards and be open to VA inspections by VA Security teams.

• Health Insurance Portability and Accountability Act of 1196 Privacy, Security, and Breach Notification Rules (45 CFR Parts 160 and 164).

9. Assumptions & Constraints

• Both VHA and contractor operate in AWS GovCloud us-gov-west.

• Both parties provide required AWS access and sample test data.

• The Contractor must meet VA policies, FedRAMP, and Cures Act standards.

• VISN/Station postage account used for mailing; costs managed via each VISN.

• The Contractor must send letters to the printer twice daily — aligning to the morning and evening deposit cycles — and both batches must meet the established cutoff times.

Letters must be mailed immediately upon receipt to meet the 7-calendar day delivery requirement.

• VHA deposits letters seven days per week.

• Each letter has a unique Event ID.

• Each address must contain at least two lines or be rejected.

• No international letters unless country fields are added.

• No portfolio PDFs (no embedded files).

10. Governance and Operational Support

• The Contractor shall provide designated program management and escalation contacts.

• The Contractor shall maintain documented incident management and change management processes.

• The Contractor shall provide operational support during all approved production processing windows.

• The Contractor shall support recurring governance meetings with VA stakeholders.

11. SLAs

• System availability shall be 99.9% monthly, excluding approved maintenance windows.

• Critical incidents shall receive an initial response within 30 minutes.

• Letters received before established processing cutoff times shall be printed and inducted into USPS within agreed operational windows.

• The Contractor shall support reprint and remail workflows for failed correspondence.

12. Optional Features

• Color printing and the capacity to bind folios or magazine type booklets and patient education materials, posters and flyers. Also, both front and back printing for A4 letter and post cards, and the capacity to send inserts like community announcements.