IT Support Services for GE Muse Application

New Jersey seeks IT support services for the GE Muse application, including maintenance, updates, and user support for a cardiology clinic.

Provide comprehensive support services for GE Muse systems
Maintain and optimize HL7 and DICOM interfaces
Manage databases and data storage solutions
Ensure operational integrity of servers and computers
Provide all necessary tools, equipment, technical information, and personnel
Offer email and phone technical support
Provide latest GE Muse software updates and upgrades
Offer installation support and clinical education for software upgrades
Ensure technical support representatives are qualified and experienced
Notify VA Program Manager, Contract Specialist, and Contracting Officer of arrivals and departures
Perform work during specified hours (8:00 AM - 4:30 PM weekdays, unless coordinated)
Be responsible for damage caused during delivery, installation, and removal
Comply with Section 508 accessibility standards (E205, E204, E206, E207, E208)
Ensure compatibility with assistive technology
Demonstrate Section 508 Compliance upon delivery
Comply with energy-efficient product requirements (ENERGY STAR, FEMP, EPEAT)
Comply with VA OIT Technical Reference Model (VA TRM)
Implement VA Critical Security Controls by July 1st, 2025
Support Social Security Number (SSN) reduction by using Integrated Control Number (ICN) as the primary identifier
Integrate with VA Master Person Index (MPI)
Support IPv6-Only and dual stack (IPv6 / IPv4) connectivity
Provide all software licenses and associated maintenance for the contract life
Meet Trusted Internet Connection (TIC) requirements (OMB M-19-26, VA Directive 6513, TIC 3.0)
Use VA information only for specified contract purposes
Do not co-mingle VA information with other data
Comply with Federal and VA data protection, encryption, segregation, and sanitization requirements
Allow VA to conduct audits, assessments, or investigations of IT resources
Store and transmit VA sensitive information using VA-approved FIPS 140-2 and NIST 800-52 encryption tools
Meet or exceed VA’s minimum firewall and web services security controls
Refer all requests for VA information to the VA Contracting Officer
Protect and secure VA information per VA Directive 6500 and IAM Security processes
Destroy VA data in accordance with NARA requirements and NIST 800-88
Return un-destroyable media to VA
Request logical or physical access to VA information systems only as necessary
Sign the VA Information Security Rule of Behavior (ROB)
Comply with security investigative and clearance requirements per VA Directive and Handbook 0710
Comply with VAAR 852.204-71(d) regarding Contractor operations in the United States
Notify COR/CO within 24 hours of personnel separation or other access-affecting causes
Immediately revoke access and return VA-issued property upon contract fulfillment or termination
Complete VA Privacy and Information Security Awareness and Rules of Behavior course (TMS #10176) annually
Complete any additional role-based cybersecurity or privacy training
Provide training certificates and ROB acknowledgment to COR/CO
Report suspected security/privacy incidents to VA OIT’s Enterprise Service Desk within one hour
Provide detailed incident summaries and cooperate with investigations
Follow VA Handbook 6500 for Incident Response Plan
Report criminal activity to appropriate law enforcement entities
Comply with VA Handbook 6500.2 for breaches involving sensitive personal information
Comply with Federal law, regulations, and VA policies for information systems designed or developed for VA
Comply with VA Assessment and Authorization (A&A) processes to obtain Authority to Operate (ATO)
Comply with OMB M-22-18 and M-23-16 for third-party software
Provide self-attestation of secure software development practices (EO14028, NIST Guidance)
Ensure applications/systems are compliant with HSPD 12 and VA Identity and Access Management (IAM) requirements
Ensure applications/systems provide user authentication services compliant with VA Handbook 6500, IAM, and NIST 800-63
Use VA authorized technical security baseline configurations
Perform testing of all updates and patching prior to implementation on VA systems
Ensure applications run in standard user context without elevated privileges
Ensure solutions reside on VA approved operating systems
Design, develop, and implement security and privacy controls per NIST 800-37, VA Directive and Handbook 6500, and VA Handbook 6517
Comply with Privacy Act of 1974 and FAR 52.224-2
Ensure security of all procured or developed information systems throughout the contract life
Apply security fixes within specified timeframes
Comply with Federal laws, regulations, and VA policies for information systems hosted, operated, maintained, or used at non-VA facilities
Comply with FedRAMP and VA Directive 6517 for cloud computing systems
Ensure external internet connections to VA network comply with VA Trusted Internet Connection (TIC) Reference Architecture
Allow periodic, announced, or unannounced assessments by VA officials
Conduct annual privacy and security self-assessment
Prohibit installation and use of personally owned or Contractor-owned equipment/software on VA information systems unless approved
Notify COR/CO within one hour of vulnerability disclosure or successful exploits
Remediate material defects or vulnerabilities impacting products and services
Provide copies of cybersecurity framework policies, procedures, and reports upon request
Allow VA or its designee to perform audits and security/penetration tests
Comply with CFR Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”
Purchase equipment from Original Equipment Manufacturer (OEM) or authorized reseller
Establish, implement, and document risk management practices for supply chain delivery
Provide a software bill of materials (SBOM)
Use trusted channels and tamper-evident packaging for shipping
Demonstrate capability for detecting unauthorized access (tampering)
Ensure all provided software and patches are free of viruses and/or malware
Warrant no malicious virus and/or malware code inserted into software or patches
Provide technical justification for 'false positive' anti-virus hits
Not upload any virus, worm, malware, or harmful content onto VA systems
Document how cryptographic systems protect confidentiality, data integrity, authentication, and non-repudiation
Use only FIPS 140-2 and NIST 800-52 approved cryptographic methods
Provide automated remote key-establishment method
Ensure emergency re-keying of all devices can be remotely performed within 30 business days
Provide method for updating cryptographic primitives or algorithms
Provide documentation detailing patch management, vulnerability management, mitigation, and update processes
Verify and document all procured products have appropriate updates and patches installed prior to delivery
Provide software and firmware updates to remediate newly discovered vulnerabilities within 30 days (7 business days for critical/emergent)
Comply with FDA Premarket Submission and Postmarket Management of Cybersecurity in Medical Devices
Design devices capable of accepting all applicable security patches
Provide devices able to install and maintain VA-approved antivirus capabilities or whitelisting
Verify embedded software does not contain known viruses or malware before delivery
Return devices with media removed, provide spare drive, or sanitize media non-destructively
Ensure VA network access complies with VA Directive 6500 and IAM security processes
Ensure network infrastructure and data availability per VA information system business continuity procedures
Ensure internet or external network connections occur through managed interfaces utilizing VA approved boundary protection devices
Encrypt all traffic across the Wide Area Network (WAN) segment managed by the Contractor
Secure access from Local Area Networks (LANs) at co-located sites per VA TIC Reference Architecture

$500,000 – $2,500,000

The Product Description is dated March 4th, 2026. The contract will consist of a 12-month base period and four 12-month option periods. VA Critical Security Controls must be implemented by July 1st, 2025.

Department of Veterans Affairs

Organization overview and procurement intelligence available on paid plans.

A government authority in New Jersey seeks IT support services focused on the GE Muse application, which is essential for communication and data exchange between healthcare systems. The required support services encompass interface maintenance and optimization, database management, data storage solutions, and comprehensive application support for the GE Muse platform.

Vendors will be responsible for supporting the GE Muse Server, Web Client, and related software components. The scope includes software upgrades, quality and workflow services, and ensuring the implementation and clinical education for each software upgrade. Installation support is also expected as part of the engagement. The GE Muse software is primarily used by a cardiology clinic, requiring high reliability and expertise in both IT and clinical environments.

Overall, this RFI aims to identify qualified vendors capable of maintaining, updating, and optimizing a critical healthcare application.

IT Support Services for GE Muse Application

Overview

Fit Score

SUMMARY

KEY REQUIREMENTS

BUDGET

CONTRACT DURATION

TIMELINE

Issuing Agency

DESCRIPTION

Similar RFPs