Enterprise Dose Monitoring

This federal solicitation (SF 1449, Solicitation No. HT942726RE017) is issued by the Defense Health Agency (DHA) Medical R&D Contracting Division 2 to acquire a single, enterprise-wide Dose Monitoring System. The procurement is set aside 100% for Small Businesses under NAICS code 513210 (Software Publishers) with a size standard of $47 million. The scope of work is split into two primary firm-fixed-price line items: CLIN 0001 for the enterprise software license, installation, and virtual applications training for up to 100 users across 12 designated Picture Archiving and Communication System (PACS) Hubs; and CLIN 0002 for a five-year software maintenance agreement. Contractors must meet 40 Minimum Essential Characteristics (MECs). Key requirements include support for all ionizing modalities, bi-directional DICOM integration with DHA PACS, and strict adherence to Department of Defense (DoD) Cybersecurity and Risk Management Framework (RMF) standards to achieve and maintain an Authority to Operate (ATO). Offerors must also submit detailed Hardware and Software Bills of Materials (HBOM/SBOM) and demonstrate secure development practices. Proposals are due by August 24, 2026, at 10:00 AM Local Time. Submissions must be split into Volume I (Technical Proposal, limited to 20 pages) and Volume II (Business Proposal, no page limit). The scheduled delivery date for CLIN 0001 is September 15, 2027, with final maintenance services extending through September 15, 2031.

This Department of Defense (DoW) Defense Health Agency (DHA) document outlines the mandatory cybersecurity, Risk Management Framework (RMF), and Supply Chain Risk Management (SCRM) contracting requirements for all Medical Device and Equipment (MDE) acquisitions. Its primary purpose is to establish minimum security standards to protect the DHA Information Network from emerging threats and foreign adversary compromises. Under these requirements, vendors must certify that no hardware, software, or firmware is sourced from foreign adversary countries, including China, Russia, North Korea, Iran, and Venezuela. Vendors must provide comprehensive Hardware and Software Bills of Material (HBOM/SBOM) at the time of the award and update them within 15 days of any subsequent changes. To achieve an Authority to Operate (ATO), vendors must submit critical artifacts within 30 days of award—including system architecture diagrams, completed DHA security questionnaires, and Nessus vulnerability scans—and must resolve all High and Moderate severity vulnerabilities. Furthermore, vendors must proactively monitor for vulnerabilities, reporting any high-severity risks within 72 hours. To maintain network access, vendor personnel requiring administrative privileges must obtain professional baseline certifications, complete mandatory federal training, and utilize DHA’s secure Business-to-Business (B2B) gateway. These rigorous requirements persist throughout the product life cycle, mandating continuous monitoring, patch management, and reauthorization support under subsequent Service Maintenance Agreements (SMAs). Failure to meet these timelines or maintain a compliant security posture can result in order termination and award ineligibility.

This document is the Medical Device and Equipment Risk Assessment (MDERA) Version 7.0, dated May 27, 2026. It is a mandatory pre-procurement questionnaire issued by the Defense Health Agency (DHA) Medical Devices and Equipment PMO Cybersecurity division. It is used as a selection tool to evaluate the cybersecurity compliance of both regulated and non-regulated medical systems and devices with United States Federal Government (USFG), Department of War (DoW), and DHA policies. Completion of the MDERA is required for commercial vendors participating in the Request for Information (RFI) or Request for Offer (RFO) process to support Risk Management Framework (RMF) Authorization. Vendors must disclose detailed technical specifications and are required to submit Hardware and Software Bills of Materials (HBOM/SBOM) alongside the assessment. The questionnaire collects critical technical details across four main areas: - **System Identification:** Product models, FDA certifications, software lifecycle (EOL) dates, network connection methods, and cloud service utilization. - **Technical Information:** Hardware configurations, operating systems, installed applications, user accounts, endpoint security (antivirus/whitelisting), vulnerability scanning/patching policies, remote access, and wireless capabilities. - **Data Processing:** Handling of Electronic Protected Health Information (ePHI) and Personally Identifiable Information (PII), data-at-rest/in-transit encryption, and artificial intelligence/machine learning (AI/ML) integrations. - **Compliance and Monitoring:** Adherence to Federal Information Processing Standards (FIPS), telecommunications restrictions (FAR/DFAR), and capabilities for DHA-managed network monitoring and Zero Trust integration. Failure to provide accurate, complete information will disqualify the system or result in breach of contract.

This document is an Organizational Conflict of Interest (OCI) Certification form (RFQ Attachment 4/5) for a federal solicitation. It outlines the responsibilities, rules, and procedures under FAR Part 9.5 to identify, evaluate, and resolve potential OCIs, aiming to prevent biased judgment and unfair competitive advantages. Contractors must notify the Contracting Officer (CO) of any potential OCI and submit an avoidance or mitigation plan for approval. Failure to provide an acceptable plan can result in contract termination or disqualification. The document details specific OCI restrictions and multi-year prohibitions for contractors performing systems engineering, preparing specifications or work statements, providing technical evaluations, or accessing proprietary third-party data. Additionally, contractors must sign Non-Disclosure Agreements, flow these OCI requirements down to all subcontractors, and provide timely OCI training to personnel upon award. The form includes a self-assessment checklist to help offerors identify conflicts related to unequal access to information, impaired objectivity, or biased ground rules. To submit a compliant quote, the offeror must sign the certification, indicating either that no OCI exists or that an appropriate mitigation plan is attached.

This document is a Defense Health Agency (DHA) Contractor Non-Disclosure Agreement (Form 49, Attachment 5). It is a legally binding agreement required for contract employees and subcontractors who may access sensitive, proprietary, or source selection information during their work under a DHA contract. The agreement prohibits the unauthorized disclosure of protected information, including proprietary business data, trade secrets, cost estimates, and Protected Health Information (PHI). Signees acknowledge that unauthorized release of this information could cause irreparable harm and that the U.S. Government may pursue legal remedies, including court orders and the assessment of attorney fees. Key terms of the agreement include: - **Annual Renewal:** Contractors must sign a new non-disclosure agreement annually to maintain access to protected information. - **Indefinite Obligation:** The obligation of non-disclosure continues indefinitely, even after the contract ends or the employee leaves their position. - **Exclusions:** The agreement does not apply to information that is already public, approved for release by a contracting officer, independently developed, or court-ordered for disclosure. - **Future Employment:** Contractors must disclose these ongoing obligations to potential future employers. This document must be signed and witnessed by the contractor employee, a business representative, and a witness.

This vendor submission form outlines the Department of Defense (DoD) and Defense Health Agency (DHA) cybersecurity and Risk Management Framework (RMF) requirements for medical devices and IT solutions. To achieve and maintain an Authority to Operate (ATO), vendors must comply with strict Information Assurance (IA) terms. Key requirements include submitting a completed Joint Medical Device Equipment Risk Assessment Questionnaire (MDERA) for all systems and third-party components, alongside credentialed Nessus vulnerability scans completed within 30 days of submission. Operating systems and major software applications must have at least 36 months of support remaining before commercial End of Life. Systems must utilize FIPS 140-2 encryption for sensitive data, provide time-specific audit trails, and support DoD password complexity. The document strictly prohibits sourcing hardware, software, or firmware from foreign adversaries or entities on the FCC’s Covered List. Vendors must provide comprehensive Hardware and Software Bills of Materials (HBOM/SBOM) and adhere to secure software development practices (NIST SP 800-218). Post-award, vendors are responsible for continuous monitoring, reporting critical vulnerabilities within 72 hours, and notifying the government of any HBOM/SBOM changes. Within 30 days of award, vendors must submit system architecture diagrams, a completed DHA Security Questionnaire, and Nessus scans to support RMF validation. These requirements must also flow down to all subcontractors.