6525--VHA Enterprise Mammography Tracking System (VA-26-00046145) New Action

Amendment / Modification

This amendment provides the Government's official responses to vendor questions submitted on April 19, 2026, regarding the solicitation.

Key clarifications include:

• Patient Lay Summary Letters: VA requires national standardization of lay summary letters, specifically utilizing FDA breast density statements.
• Disaster Recovery & Backup: VA IT is responsible for executing, scheduling, and monitoring system backups and restorations. The contractor must provide a comprehensive plan and technical guidance.
• Patching Responsibilities: VA IT handles OS-level patching. The contractor's role is limited to application-layer and database updates for the Patient Hub software, providing technical guidance, and compatibility validation for OS patches.
• Security Incident Reporting: The one-hour notification clock for suspected security/privacy incidents begins upon suspicion, not confirmation. VA recommends not changing this standard language.
• Definition of "Suspected Security / Privacy Incident": An incident is defined as an occurrence that jeopardizes confidentiality, integrity, or availability of information systems, or violates policies. Specific reporting criteria vary by system.
• System Isolation: VA IT is responsible for system isolation upon disclosure of a vulnerability. The contractor must provide technical support and timely notice.
• Annual Self-Assessment and Audit Rights: VA will review vendor self-assessment documentation; VA-specific assessments may be required if insufficient. Penetration testing will be coordinated in advance.
• Cybersecurity Vulnerability Notification: The one-hour notification clock begins upon suspicion.
• Data Destruction: VA is responsible for destroying data on VA-owned infrastructure. The vendor's obligation is limited to data transferred or processed within vendor-controlled environments.
• Personnel Roster and Background Investigation: Tier 1 / Low Risk is confirmed as the investigation level. A POC will be identified to meet the timeline for background investigations.
• Patch Notification Cadence: This requirement applies to application-layer and database patches. Routine validated patches may be reported in the Monthly Progress Report, with specific notification requirements for incompatible patches.

This amendment addresses questions related to various sections of the Performance Work Statement (PWS), including Sections 5.2.8.B, 5.3, 5.12.F, Addendum B Sections B5.a, B6.n, B7.i, B7.g, B8.a, B8.b, B8.c, B2.n, B2.o, B7.c, and PWS Section 6.2.2.b.

The response date and time of May 4, 2026, 1:00pm ET remain unchanged.

Amendment / Modification

• Extends the response time and date for the Sources Sought notice.

• The new response date is May 4, 2026.

• The new response time is 1:00 PM Eastern Time.

• Item 11: This item only applies to amendments of solicitations.

• Item 14: Description of Amendment/Modification.

• The deadline for submitting offers or responses has been extended to May 4, 2026, at 1:00 PM Eastern Time.

Performance Work Statement (PWS)

To procure an enterprise-level Mammography Tracking and Reporting System (MTRS) for the Department of Veterans Affairs (VA), Veterans Health Administration (VHA) National Radiology Program. The system aims to enhance the management and monitoring of VHA mammography programs, ensuring efficient workflow, accurate data exchange, and comprehensive patient care management.

• Provide an enterprise-level MTRS software license, installation, technical services, training, system maintenance, and data migration.

• Support all VHA facilities offering in-house mammography services, including the National Teleradiology Program and the National Radiology Program Office.

• The system must integrate with existing VHA systems like VistA and FEHR via HL7.

• Key functionalities include clinical operations support (breast examination management, patient tracking, reporting), technical functionality (system administration, interfaces, disaster recovery), enterprise licensing, imaging orders and reports, data migration, system performance monitoring, user/group management, HL7 and DICOM integration, and comprehensive training.

• Specific clinical functionalities include support for various breast examinations (MRI, Ultrasound, Mammography, etc.), risk assessment modules, and patient lay summary letter generation.

• Technical requirements include non-developmental (COTS) software, adherence to VA IT frameworks (TRM, Zero Trust, FICAM, IPv6, TIC), and support for Generative AI requirements if applicable.

• Minimum uptime guarantee of 99% (excluding scheduled maintenance and VA network-caused outages).

• Adherence to specific response and restoration times for critical, high, moderate, and low severity customer support issues.

• Compliance with VA security, privacy, and accessibility (Section 508) standards.

• Period of Performance (PoP): 12 months from award, with four 12-month option periods, for a potential total of 60 months.

• Place of Performance: 88 in-house Mammography Programs across 56 VAMC/Healthcare Systems, National Teleradiology Program, and National Radiology Program Office. Work may also be performed at remote locations with COR concurrence.

• Contractor Project Management Plan (CPMP) required.

• Monthly Progress Reports are mandatory.

• Data migration of at least the last five years of data is required.

• Personnel security requirements include background investigations and adherence to VA security protocols.

• Compliance with extensive VA IT and cybersecurity policies (e.g., Zero Trust, FICAM, IPv6, TIC, Section 508, HIPAA).

• Specific requirements for AI systems, including adherence to trustworthiness, security, and unbiased principles, with detailed documentation and monitoring.

Sources Sought / Market Research

The Department of Veterans Affairs (VA), Technology Acquisition Center (TAC), is conducting market research to identify potential sources for an Enterprise Mammography Tracking & Reporting System. This system is intended to provide radiologists and clinical staff with enhanced tools for managing and monitoring VHA mammography programs.

• Enterprise Mammography Tracking and Reporting System software licenses

• Installation and technical services

• Training

• Anticipated 12 months from date of award, with four 12-month option periods.

• Four Optional Tasks may be exercised anytime during performance.

• 6525 (Product Service Code)

• 541511 (NAICS Code)

• Submit a capability statement limited to 10 pages (excluding transmittal page).

• Include Company Information (name, address, email, phone, CAGE/UEI).

• Identify Point of Contact.

• Indicate business size, socioeconomic status, and certifications (SDB, 8(a), HUBZone, SDVOSB, WOSB, etc.).

• Specify if recommending a socioeconomic category for set-aside.

• Confirm ability to comply with relevant FAR and VAAR clauses regarding small business subcontracting and set-asides (e.g., RFO 52.219-6, 13 CFR 125.6, VAAR 852.219-73).

• Identify if OEM or reseller, and any available resellers.

• List existing contract vehicles that could be used.

• Provide a brief summary of the company's approach to meeting requirements.

• Respond to specific questions regarding the draft Performance Work Statement (PWS) and provide technical/functional comments or recommendations.

• Provide commercially available list pricing or a Rough Order of Magnitude (ROM) with anticipated costs.

• Special attention for Service-Disabled Veteran-owned small businesses (SDVOSBs) or Veteran-owned small businesses (VOSBs).

• Respondents must include intent and ability to meet set-aside requirements (at least 50% performance by eligible SDVOSB/VOSB concerns) and be listed in the SBA database.

• Questions Due: April 20, 2026, 10:00 AM EST

• Responses Due: April 27, 2026, 10:00 AM EST

• This is a Sources Sought notice for information and planning purposes only; it is not an Invitation for Bid, RFQ, or RFP.

• No proposals should be submitted at this time.

• The Government will not reimburse costs incurred in responding.

• All responses and questions must be submitted via email to Terricia.Lloyd@va.gov.

• A DRAFT Performance Work Statement (PWS) is attached and referenced for specific requirements.