Forensic Health Program

The Defense Health Agency is seeking a Commercial Off-The-Shelf software solution to replace the current paper-based system for managing forensic healthcare records at Military Treatment Facilities, addressing critical legal, operational, and privacy concerns arising from the lack of a secure, centralized digital platform. This solution must strictly segregate Sexual Assault Forensic Examination (SAFE) records from the Department of Defense’s standard Electronic Health Record system, MHS Genesis, in full compliance with DoDI 6040.45, DoDI 6495.02, the DOJ National Protocol for Sexual Assault Medical Forensic Examinations, and 28 CFR § 115.121, ensuring that confidential forensic data is isolated to prevent inadvertent disclosure. The software must support mobile data collection via tablet devices with high-quality image capture and digital annotations, enforce zero data compression and file integrity preservation, and implement an immutable chain-of-custody tracking system with an electronic seal that permanently locks records after final signature. All records must be accurately time-stamped to localized time zones, support custom forensic kit data elements, native fillable PDF forms, and Optical Character Recognition, while adhering to Federal Rules of Evidence 705, 902(13), and 902(14) to maintain forensic integrity in legal proceedings. The solution must be hosted in a FedRAMP Certified and DoD Impact Level 4 compliant Commercial Cloud (SaaS) environment or within a DHA-managed Government Cloud, meeting all Risk Management Framework requirements under DoDI 8510.01 and Information Assurance controls per DoDI 8500.01, including maintaining Authority to Operate documentation. The system must enforce Role-Based Access Controls with Common Access Card single sign-on, generate immutable audit logs compliant with NIST 800-111 and NARA retention schedules, and employ FIPS 140-2/140-3 encryption for data at rest and in transit. All technology components must conform to DISA STIGs, NIST standards, and NSA Security Configuration Guides, while supporting robust reporting on provider competency, exam volume, user training, and inactive accounts. Vendors must demonstrate the ability to provide cleared personnel, support approximately 400 global users, and comply with cybersecurity vulnerability management protocols including IAVM and U.S. Cyber Command requirements. Though this is a Request for Information issued solely for market research with no binding obligation to award a contract, the