3650--IVX Workflow Management

The Department of Veterans Affairs, through its Network Contracting Office 6 in Hampton, Virginia, is seeking bids for IVX Workflow Management under solicitation number 36C24626Q0604, with a response deadline of July 2, 2026, at 12:00 PM Eastern Time. The requirement calls for four IV Workflow Management Devices, along with all associated supplies, services, and peripheral equipment necessary for deployment, and is classified under NAICS code 325412 as a commercial acquisition under FAR Part 12. The place of performance is the Richmond VA Medical Center at 1201 Broad Rock Blvd, Richmond, VA 23249. All offerors must maintain an active registration in the System for Award Management (SAM) to be eligible, and proposals must be submitted electronically to Contract Specialist Robert Morgan at robert.morgan@va.gov. Technical requirements are stringent and aligned with VA Handbook 6500, NIST 800-63 for digital identity, and FIPS 140-2 for cryptographic modules, mandating Public Key Infrastructure (PKI)-based authentication using PIV or CAC credentials. Contractors are required to provide a Software Bill of Materials (SBOM) as defined by the NTIA, ensure all software and firmware patches are applied within 30 days of discovery (seven business days for critical vulnerabilities), and procure hardware exclusively from Original Equipment Manufacturers or authorized resellers, with FIPS-compliant hash verification. Security protocols enforce data segregation, prohibit co-mingling of VA data with other systems, mandate compliance with NISPOM, and require adherence to CFR Title 15 Part 7 to prevent ICTS transactions involving foreign adversaries. Personnel must meet VA Directive and Handbook 0710 suitability standards, and those accessing classified systems must hold appropriate security clearances verified by HRA/OSP. Contractors must be permanently located within U.S. jurisdiction or its territories as per VAAR 852.204-71(d). The VA retains broad audit and investigative rights over contractor IT systems, including access for its Office of Inspector General and the Government Accountability Office, and requires documentation of supply chain risk management practices for all delivered hardware, software, and firmware. No pricing, delivery schedule, or period of performance details are provided, as this is a pre-solicitation notice, and specific CLINs or evaluation factors have not yet been issued.