Enterprise Cloud Fax Service (ECFax) discussion with Mr. Frank Joy Jr., and Mr. Robert Kately

In this episode of the Department of Veterans Affairs (VA) Technology Acquisition Center’s (TAC) podcast, TAC Talks, we discuss the Enterprise Cloud Fax Service (ECFax), a highly secure Cloud-based electronic faxing service. It is designed to increase efficiency and decrease time from a slow and costly manual/semi-automated faxing process to a more universal electronic faxing service.

To address these topics and more, host Chuck Ross is joined by a fantastic panel of VA Office of Information and Technology and TAC Contracting personnel who collectively have decades of experience. This panel includes:

Mr. Frank Joy Jr., Sr. Enterprise Infrastructure Architect for the Office of Information and Technology
Mr. Robert Kately, VA Technology Acquisition Center, Contracting Officer

What is TAC Talks?

Come for a peek behind the federal acquisition curtain as we gain insights from acquisition professionals at the US Department of Veterans Affairs and dissect varying relevant topics. In this five-episode series we will explore topics such as proposal evaluations, innovation, debriefs, and more!

TAC Talks is premiering Tuesday, September 29th!

The Department of Veterans Affairs does not endorse or officially sanction any entities that may be discussed in this podcast, nor any media, products or services they may provide.

[Music]
Chuck Ross: Welcome to the Technology Acquisition Center Podcast, which we affectionately call TAC Talks. Join us as we discuss highly relevant and compelling acquisition topics with highly esteemed industry professionals and attempt to share information with you, the 1102 workforce, program officials and our contractor friends. We hope that you find these topics and discussions helpful. So turn up the volume on your earbuds, and get ready for TAC Talks.
[Music]
Chuck Ross: Hello Friends and thank you for joining me today for our next episode of TAC Talks. My name is Chuck Ross, a Service Director at the Department of Veterans Affairs Technology Acquisition Center. Today�s episode will feature VA�s Enterprise Cloud Fax service program. Which is a service designed to enable the VA�s migration from slow and costly manual and semi-automated faxing processes and electronic faxing solutions from multiple vendors. To a more universal service establishing a managed cloud hosted electronic faxing service. Believe it or not faxing remains one of the primary methods of information transfers across facilities for many reasons within the VA. The validity of some legal documents such as those relating to pharmaceuticals and healthcare is extremely essential and must be provided in hard copy. The Veterans Health Administration and the Veterans Benefits Administration are prime examples of just how cumbersome and labored intensively manually faxing has become to the VA. The records department within these organizations are frequently required to manually print medical files, then place them in a scanning device and fax the copies to civilian doctors, hospitals, and attorneys. In addition, there are many Veterans and beneficiaries who still prefer to use the fax documents rather than relay on email and other digital methods. This has led to many reports of heavy burdens on staff members responsible for manually faxing physical documents from locations without electronic or cloud fax management capabilities. Manual faxing also comes with the added security burden of how to properly protect the Veterans personally identifying information and protected health information. To properly address this issue in September of 2021, the VA TAC awarded the T4NG Task Order for Enterprise Cloud Fax services. This consisted of a one-year base period with nine option years. The ECFAX software as a service allows for increased efficiency and security. Thus, decreasing the time and cost associated with VA staff manually processing these documents designed to transform the VA�s abilities to support delivery of vital services and benefits to the nations Veterans. ECFAX will also increase efficiencies and security enterprise wide. ECFAX allows VA personnel to fax remotely from their work laptops, iPhones, or other devices and from the existing printers and copiers in their facilities. Files are delivered to anywhere in the VA, while also so interfacing with the current Microsoft Outlook email system, with VA�s new Electronic Health record, with multi-function devices, and across other work streams for maximum ease of use. So, I'm here today with Mr. Frank Joy, Senior Enterprise Infrastructure Architect for the Office of Information and Technology, and Mr. Robert Kately, Contracting Officer at the Technology Acquisition Center. Thank you both for joining me today.
Frank Joy: Appreciate the opportunity.
(CR): So, we'll start off with a question here for Frank. So, can you just tell us a little bit in layman's term what ECFAX is all about?
(FJ): Sure, ECFax is just that. It's a large scale, robust faxing capability delivered via a highly secure modern cloud-based software as a service application. It's about supporting VAs efforts towards digital transformation. It fits right into that modality to provide additional tools, techniques to deliver ever more reliable and ever more secure methods of doing business on behalf of our nation's Veterans. Again, traditional faxing is just still one of the primary methods by which we receive, process and orchestrate delivery of care and benefits to our Veterans. So modernizing, securing and standardizing this common service represents a real opportunity to, as our President says, build back better not just for the Department of Veterans Affairs, but, in the mode we're going to deliver, for other federal agencies that might want to utilize this same service � this common core secure faxing service -- to deliver services to not just Veterans, but to all government citizens that might have a need for it.
(CR): And �EC� stands for �Enterprise Cloud.�
(FJ): Yes.
(CR): So which cloud platform are you guys utilizing?
(FJ): For this particular service, it's going to be hosted in the AWS GovCloud community and it will be run at what's known as a high classification, and that's in order to ensure that we protect this valuable information because it could include an incredibly wide gamut of information that Veterans may provide to the VA on their behalf to obtain benefits and care. It can also include VA communications with providers into the community so they can get care and benefits. It could be legal matters. It could be security matters, operational, strategic matters, anything that we might fax, this service is going to protect at the highest level we can possibly do so. It's all about safeguarding that information.
(CR): Right, and that leads me into my next question. So there's a number of different standards, I'm assuming, that you could reasonably tell Veterans that their information is going to be safe because it's adhering to those standards. Is that right?
(FJ): Yes, absolutely. This service will, and is required to, use the most current federal National Institute of Standards approved government encryption tools and systems. Again, to ensure that when from the point that that fax is transmitted to the VA and when it's transmitted outward to the Veteran or other VA partner, community care partner or whatever, it is protected regardless of whether that fax is actually transmitting through the process or it's sitting somewhere in the service at some point like it's received at the VA, stored somewhere for action and processing, it's going to be protected from one end to the other in a continuous stream of encryption and protection. It's all going to be built to operate at the highest level of security that we can possibly provide for this using all the types of controls and processes available to protect that vital information. Again, whether it's a Veteran asking for a claim, for benefits, medical records, community care services, other you know, I'm applying for a home loan guarantee and I want to I choose to do that by, you know, signing a document and, faxing it. We're gonna make sure that that is protected. The entire service not only uses those modern to most modern government requirements for encryption and protection. It is also going to be closely monitored, we have ongoing monitoring of the service throughout its life cycle if there's any kind of an incident concern issue that will be immediately addressed by a very high qualified team of dedicated security experts that have one job and one job only protect that service, make sure it works. Make sure that information is protected. I'm a Veteran too, so I would be a benefit of having knowing that there is this kind of capability and the kind of security that's put into place to protect that information.
(CR): Right, much more secure than the old fashioned, you know, Fax machines sitting on the table and you know the papers are rolling in and they might sit there until, you know, somebody happens to walk by and and picks them up and and moves on.
(FJ): Yep, exactly. Well within the within the VA for anything like that. So it's just delivery to multifunction device we already have in conjunction working with our our, our teammates and other areas like printer security requirements to make sure that when that something has to be delivered that way, it is delivered in a way that only the intended recipient can go access that system and pull that print out. So we don't have that issue where something gets faxed to the VA and it shows up on the machine just sitting on a tray. We can't do that. That is just not smart.
(CR): Right.
(FJ): And it's not good business, just as it doesn't meet security requirements. So we do that. But in lieu of that, instead of delivering it to a bunch of machines, we can deliver it directly to a user in a storage location, we can deliver it to your email, we can deliver it to other kinds of modalities that provide and enhance the security of that of that service and that outcome.
(CR): Very good. So if I'm a VA employee listening to our podcast today, is there a mobile app that they might be able to be used to use now or in the future to utilize this service?
(FJ): Absolutely. We are engaged with our contractor who's going to provide a service. There is going to be and there will be at one stage of our release work and there will be a mobile app that will be in your VA App Store that you will be able to download. It will tie into your account in the service and you will be able to do basic, grab a document, grab a screen shot and you will be able to securely fax that as well and you will be able to monitor your account remotely as someone sends a let's say you have a direct number assigned to you for faxing purposes, which there's quite a few people in the field to do that if it's sent to you and you don't have access to, you know, the way your desktop, you will be able to see that comes into your account for delivery purposes through your mobile app as well respond to it.
(CR): And this is a relatively young program. I mean, I think the contract was awarded at the end of last year, so has has it gone into full production yet or you're still working to get all the necessary approvals, certifications, and things of that nature?
(FJ): Yes, we are in the process of working through our getting, obtaining our authority to operate and obtaining our Fed ramp authorization, it's a lot of work. We have one of the most aggressive schedules you can imagine to try to achieve that state. To get, the goal is just don't. The technology is understandable, but making it secure in the kind of environment we want it to operate in. Uh, with all the bells and whistles, as you would say, just secure it, protect it, monitor it and track it. It takes a little bit of time to do that, but uh that is part of the reason why we got the contract as we designed it, working with Robert to set it up for the length of time we have to give us the time to build it, secure it, stabilize it and then we can, ah you know, spreading it across the VA is rapidly and as quickly as we can.
(CR): And and have you have you had any limited testing of it and if so, have you seen any ah increased capabilities that you're excited about?
(FJ): Uh, we're starting to work with some of the DEV test environments. We haven't really done our transmission. We're working out all the back end technical details, making sure that if you send it through any of the means, whether it's email, through a small desktop app that you'll be able to use or through the web portal, we want to make sure that we get. But we're in the process of building all the test cases for that right now. We've already identified a number of initial operating capability sites that will be our early ah sort of our starting point. We have early adopters and we even have full plans for full operational capability shortly after that and we're going to launch it across the VA. But right now I'm seeing that we're gonna provide something much more universal, much more ambiguous. Ah, you will be able to fax from just about any place from anyone, everywhere you need inside of the VA, if that's what your business requirements drive you to do.
(CR): So now we're going to turn to the Contracting Officer, Robert Kately and because we are an acquisition podcast and we want to take a peek behind the acquisition curtain. Ah Rob, we're going to maybe ask you some questions on a how we got to the contract award. Um, so first off, maybe if you could share with our listening audience some of the challenges / set backs that you might have faced as you work toward this contract award and how are they resolved?
Rob Kately: Sure. Thanks, Chuck. The main issue was probably how to handle the requirements for FedRamp certification. As Frank said, FedRamp certification in this case was a firm VA requirement and this was my first rodeo with FedRamp certification being such a firm fundamental requirement and you know like Frank alluded to, we weren't just talking about FedRamp low certification, but the highest possible level, FedRamp high. So, I had to do some research on that and talk to folks from office of General Counsel on their experience handling such things. And um long story short, we didn't want to�actually, maybe I should say we we couldn't limit acceptable proposals to only products that were already Fedramp high certified. So we had to set up the solicitation and price schedules which offerors would propose to allow for solutions that were either already Fedramp, high certified, possibly. Or solutions that would have to obtain that certification during the contract. So, how do we do that? We put all of the Fedramp requirements under a CLIN (contract line item number) titled EC Fax Security support and for the key milestones across the Fedramp certification process. We had sub line item numbers (SLINs) that the vendor could be paid for upon reaching each milestone. So for example, the first milestone was for completion of all Fed ramp system security plan documentation upon which the vendor would be paid 10% of that overall value of the EC fax Security support plan. The next milestone was completion of the three PAO, That's the third party assessment organization assessment plan. Then the vendor would be paid another 10% and then finally. The remaining amount of that CLIN would be paid upon being granted FEDramp certification. Now, if a vendor/offeror was already fed Ramp high certified at the time of submitting their proposal, we weren't sure whether or not that would happen. They could Simply put a price of $0.00 in these CLINS and SLINS and therefore have an inherent advantage in terms of not just price but also schedule because I don't know what it is now, but at the time I think we anticipated up to a nine-month process or so, to obtain Fedramp high certification. Ultimately this, you know, methodology worked for us and it's my understanding that this is now like a VA best practice for how to maximize competition when there's requirements for Fed ramp certification. Not saying we were the first to do it this way. But perhaps one of the bigger more visible requirements to do it this way successfully.
(CR): Yeah. Great. So this is obviously a large investment that the VA is putting into this technology and I noticed that I think your period performance is 10 years for that. Could you just give us a little bit of the insight into why you went with the ten year task order vice the traditional 5?
(RK): Yeah, good question. So in accordance with FAR 17.204-E, unless otherwise, approved, a contracts total period of performance, including the base and option periods shall not exceed five years in the case of services. But however, that section of the FAR also states that this limitation does not apply to information technology contracts. So, you know, one might think, I did at first, that if this is IT, we don't need a special higher level approval to go beyond five years. But that turned out to not be the case. Per VA Directive 6008, SaaS solutions, where SaaS is software as a service, those are deemed non IT services. So we had to obtain approval from the head of contracting activity before awarding a non-IT contract that went beyond the five year limit specified in the FAR. Some of the things we considered in this determination, like Frank mentioned, the fundamental requirement here is to migrate from a slow and costly manual or semi-automated faxing process, with locally based multiple vendor electronic faxing solutions, to a more universal service and requirements for such services are currently being contracted for locally, so not very efficient and in addition to that, the government is driving towards cloud first and cloud smart strategies, so this represented a critical opportunity to improve and simplify a vital VA communications requirement, while at the same time reducing the physical footprint and capital expenditures cost to VA so the use of an enterprise wide cloud based faxing solution, is anticipated to improve data security with respect to PII and PHI, also response times for critical care, quality of care, and other services to Veterans. And secondly OIT subject matter experts from VA anticipated the migration itself from existing faxing solutions to the enterprise wide cloud based solution---The migration itself may take up to five years due to things like yearly funding limitations, the diversity of business processes across VA and the time required for a national rollout. And in addition, as mentioned earlier, it was anticipated to be at least a nine month process just to get the FEDRAMP high authorization, so before that happens, we can't even begin to deploy anything. So, maintaining continuity of services while it's being deployed was deemed critical to meet our needs and in summary a contract exceeding five years would allow for that uninterrupted continuity. And finally, you have the lead time and administrative costs of conducting a follow on acquisition would be extensive and perhaps also include another FEDRAMP high authorization if a different vendor was selected, so it wasn't really logical to award a separate contract after five years for the identical services that would have been provided by five more option periods.
(CR): I guess now I just like to open it up to either of you. If there's anything else you want to share, what our listening audience as it relates to the EC fax capabilities.
(FJ): Again, I think Robert did a great job summarizing why we're doing this as much as the technical aspects of what we're going to be doing. It's really all about transforming how we do even something as simple as faxing to make more modern, more secure, and much more reliable and robust to meet our business needs as we increasingly work with our community partners to send Veterans care outside VA , we always want them to choose VA obviously.
(FJ): But we know that they may not do that or may not have the ability to do so, that we want to make sure that that kind of that process that's associated with that is done in the most seamless, most integrated, most secure fashion possible, there is. There's a lot of business. Uh, that goes on there and it doesn't matter to me. In the end, it's can the Veteran get what they need can we work with our partners to get what that Veteran needs? If we could do that, then we've done our job again. And it's also about, you know, just doing something simple, better making it more functional, more capable, more robust to meet our ongoing,
(CR): Right. Building a better mouse trap.
(FJ): Building a better building, a better mousetrap. Absolutely. It's as I tell people affectionately, it doesn't seem like a very sexy thing, but we do an awful lot of it in our business environment and support and we want to make sure that we have the capacity, the capability and reliability to do that within a seamless in a seamless unified enterprise way.
(CR): That's very good. And you know I for our listening audience, I've had the pleasure of working with Frank Joy on previous projects. And I can tell you, you know he's a Veteran and he's passionate about what he does and he's passionate about providing innovative solutions that allow our caregivers to better serve the Veterans within the VA and he has a track record of doing that. And equally Rob Kately contracting officer, he's equally as passionate about negotiating a good deal, making sure that we are spending these tax dollars wisely to better enhance the services here at VA. So it's been an honor to have both of them on this podcast today and I hope our listening audience found this information valuable and stay tuned because you're going to be seeing, EC Fax if you're an employee, you're going to be seeing, EC Fax coming to an App Store near you and we hope that you have a good experience with that. So thank you again gentlemen for being here and that'll be all for TAC Talks episode number 3
(FJ): Thank you for the opportunity and our motto is every page every time always secure, thank you.
(CR): I like that.
(RK): Thank you, Chuck.
[Music]
(CR): As always, we must remind you the Department of Veterans Affairs does not endorse or officially sanction any entities that may be discussed in this podcast, nor any media, products, or services that they may be providing. We thank you for listening to this episode of TAC Talks and hope you found it helpful as well as enjoyable. You may direct any questions or feedback to me, Chuck Ross at [e-mail]. And remember, if you are passionate about government acquisition, are a continuous learner and enjoy fruitful dialogue then keep tuning into TAC Talks.
[Music]