What the DHA OBHAT BHAS RFI asks industry to do by October 26
The Defense Health Agency (DHA) wants industry to describe how it would host, integrate, secure, and sustain data for the OBHAT/BHAS program. Responses are due October 26, 2026 at 12:00 PM Eastern. The DHA OBHAT BHAS RFI is market research. It names no contract vehicle and discloses no dollar value, and DHA has issued no solicitation. One question may matter as much as hosting: what data-export and exit terms DHA should require.
Which revenue lever applies depends on what you hold. Say you are a small or mid-market health IT, cloud, or integration firm with no DHA position. The notice lists no set-aside, and on an RFI that means DHA has not decided yet. A response takes more than a summary. It is also a dated, documented way to reach the program office before DHA fixes a strategy. Some readers supply an application whose data DHA will host. For them, the RFI’s data-rights questions describe the terms DHA may measure the product against, whatever hosting model it picks.
| Field | Answer |
|---|---|
| Signal | DHA market research on hosting, integrating, securing, and sustaining data from vendor-developed and Department of Veterans Affairs (VA) applications |
| BD implication | A dated shaping window on a hosting and data-rights approach that DHA says it has not finalized |
| Customer | The Warfighter Readiness, Performance, and Brain Health Project Management Office, which prepared the characteristics table |
| Buyer | DHA contracting. The notice lists Frederick, Maryland as the place of performance |
| Funding | Not identified. No value, budget line, or ceiling is stated |
| Vehicle / path | Not identified. The RFI asks respondents to name vehicles available to DHA, if known |
| Incumbents / ecosystem | No incumbent is named. The RFI refers to incumbent vendors and vendor-owned applications without naming them |
| Access strategy | Prime hosting or integration response, subcontract to a hosting partner, or application vendor shaping its data terms |
| Timing | Responses due October 26, 2026. The notice goes inactive November 10, 2026 |
| Confidence | High on the notice, dates, and scope. None on value, vehicle, or incumbent |
| Pursuit posture | SHAPE for every segment. No application contract, incumbent, vehicle, or prime is named, so DEFEND and TEAM are not supported |
| Upgrade triggers | A presolicitation or solicitation, a named vehicle, a published value or funding line |
| Downgrade triggers | No follow-on notice within roughly two quarters, or DHA placing the data in an existing enterprise environment with no separate services buy |
DHA asks for an executive summary of two pages at most, a technical response to sections 4 through 7, and a notional architecture diagram. It also wants past-performance summaries, non-binding rough-order-of-magnitude cost ranges, and an implementation timeline. The characteristics table carries its own completion instructions.
DHA has not chosen a hosting model, and the RFI says so
DHA states that it “does not currently have a finalized enterprise strategy” for hosting, governing, integrating, accessing, retaining, and sustaining this data. The RFI’s scope section lists five models, and its background says the options are not limited to them:
- Government-managed hosting in an authorized Department of War environment.
- Commercial cloud authorized for Department of War use.
- Vendor-hosted software or platform as a service.
- Hybrid hosting.
- Federated access, in which data stays in an external system.
That list is a menu. Question 7.II asks when DHA should use a vendor-hosted model instead of a DHA-managed or enterprise-hosted one.
That changes your pitch. DHA asks which model fits best and also when each model fits. A one-model pitch with no conditions answers half of that. To answer both, state which model you would recommend, under which conditions, and what you give up by choosing it. I would pitch decision criteria, not a platform.
Every model faces the same cybersecurity questions. Section 4D asks each respondent to cover, among other items:
- The authorization approach and the split of responsibility between the hosting environment, the applications, the interfaces, and the data services.
- Identity and access management, role-based access, multifactor authentication, and privileged-access management.
- Encryption in transit and at rest, including key management.
- Audit logging, monitoring, incident response, and tenant isolation.
- Protection of sensitive health and personally identifiable information.
The RFI asks for the authorization approach and does not name FedRAMP. A FedRAMP-pursuing SaaS vendor, or one that already holds an authorization, should say so and assign each control to a responsible party.
The data-rights questions may matter as much as the hosting question
The RFI gives exit terms as much attention as hosting. It asks what DHA should require before it picks a model. Section 4C covers DHA access to raw data, normalized data, derived data, metadata, audit logs, and system documentation. It also covers export formats, transfer at contract transition or termination, and government purpose rights. Question 7.IV asks respondents what minimum data-rights, export, documentation, and transition-assistance provisions DHA should require from vendors.
The RFI says it does not establish legal positions or contract terms. It asks respondents to flag issues for government legal, privacy, security, and contracting review.
Government purpose rights is an existing Defense FAR Supplement license category for noncommercial technical data and computer software. Commercial software normally ships under the vendor’s own license. The RFI does not say which category, if any, would govern OBHAT/BHAS data. For an application vendor, the open question is whether DHA will ask for rights beyond its current license terms.
The characteristics table points the same way. Its desired level for Portability is complete, timely, usable export of data, metadata, audit records, interface documentation, and configuration information without undue proprietary dependency. For Sustainment it includes knowledge transfer to government personnel or a successor provider. For Transition it includes documented exit support.
I expect lock-in to follow whoever holds the only copy of normalized data and the rules that produced it. The RFI asks what documentation DHA should require, and it names business rules, transformations, and system configurations. Without that documentation, a hosting vendor would likely keep all three. Until a solicitation shows otherwise, I weigh the data-rights questions as heavily as the hosting question. No source-selection evaluation criteria exist, because DHA has issued no solicitation. The characteristics table calls itself an evaluation matrix, but it assigns no weights and sits inside market research. Draft your export, documentation, and transition position now.
Competitive Landscape: no company is named, and DHA’s own hosting is a competing path
The RFI and the notice name no company and no contract. Its questions point to three groups that are likely positioned, plus DHA’s own hosting as a competing path. These groups are inferences.
- Hosting providers. Firms with environments authorized for Department of War use, which is one of the models DHA lists.
- Systems integrators. Firms with Health Level Seven (HL7) and Fast Healthcare Interoperability Resources (FHIR) experience, record linkage, and multi-organization data exchange.
- Vendors of the current applications. They hold the data today. The RFI asks about risks in transitioning from incumbent vendors. It also asks about common failure points when government hosts data from vendor-owned applications.
- DHA itself. Government-managed hosting in an authorized Department of War environment is one of the listed models, so one outcome is no separate hosting contract.
The VA side is a separate acquisition environment. The RFI covers data from VA-connected or VA-originating applications. A DHA hosting requirement does not set VA’s buying, funding, or terms. Do not treat the two as one market. For positioning, pair a hosting provider with an integrator that has the interfaces. The RFI does not ask one respondent to cover every area.
Respond by October 26 if you can evidence one hosting or portability capability
I would respond only if you can evidence at least one hosting, integration, or portability capability DHA named. DHA asks respondents to state business size. It also asks them to name relevant contract vehicles or acquisition pathways available to DHA, if known. If you hold an acquisition vehicle DHA could use, say so. Work in the order below. The table comes first. Its 14 rows match the key parameters in section 6, which the technical response should address.
- Complete the characteristics table. Mark each row Minimum or Desired. Where you do not meet a minimum today, write the plan, the timeframe, and the resource dependencies the instructions request.
- Write the executive summary, two pages at most.
- Write the technical response to sections 4 through 7. Cover your recommended hosting model and when you would recommend another. Add your data-rights position (export formats, required documentation, transition assistance), a risk assessment, and answers to the ten questions for industry.
- Draw the notional architecture.
- Summarize past performance.
- Give cost ranges by category (implementation, migration, licensing, cloud consumption, operations, sustainment, transition support). Add major drivers, assumptions, and a recommended contracting structure, such as fixed price, labor hour, managed service, consumption-based cloud, or hybrid.
- State the implementation timeline and key dependencies.
Segment the next step by what you hold:
- Health IT and integration firms without a DHA position: pick the one capability you can document, such as FHIR interfaces or migration from a vendor-owned application, and lead with it.
- Vendors of OBHAT/BHAS applications: draft the export formats, documentation, and transition assistance you would accept in a contract, and compare them with your current terms.
- Small businesses (state your size under the size standard for NAICS 518210): decide whether you can cover hosting, integration, security, and operations alone, and name a partner only for the part you cannot evidence.
- Anyone with VA experience: describe the connectivity dependencies in detail, because question 7.VII asks for them.
A solicitation would turn this shaping window into a pursuit
I treat the DHA OBHAT BHAS RFI as a shaping window, so the posture is SHAPE for every reader. There is no solicitation to bid, no award to defend, and no value to size. DHA says responses only inform a future data-hosting strategy. For an application vendor, shaping means getting your data terms in front of DHA before it writes them. For everyone else it means positioning.
Three events change that. A presolicitation or solicitation for hosting and sustainment would move it to pursuit. A named vehicle with a set-aside decision would tell small businesses whether to prime or team. Treat it as a watch item if no follow-on notice appears within roughly two quarters of the October 26 close. The same applies if DHA places the data in an existing enterprise environment with no separate services buy. Either way, keep the response on file.
FAQ
Is this a solicitation, and does it carry a set-aside or contract value?
No. The RFI states it is not a solicitation, request for proposal, commitment to procure, or authorization to incur costs. The notice lists no set-aside, and no value appears anywhere. DHA will not reimburse response costs.
Which part of DHA owns this work?
The Warfighter Readiness, Performance, and Brain Health Project Management Office prepared the characteristics table. The notice lists Frederick, Maryland as the place of performance. The RFI does not name the office that would fund a hosting contract.
Do I need HL7 and FHIR experience to respond?
No. The RFI asks for HL7 and FHIR support “where relevant,” and the characteristics table’s Integration row lists them alongside APIs, batch, secure file transfer, and event streaming. Describe the patterns you actually support.
How does the VA connection change the work?
It adds dependencies DHA cannot settle alone. The RFI asks for known limitations when integrating with VA applications and data, and for approvals and interconnection agreements. VA is a separate organization, so a response should state what it assumes VA provides.
What would show this reading is wrong?
Suppose a solicitation fixes a hosting environment and says little about export, documentation, or transition. That would show the data-rights questions did not carry equal weight. A decision to host in an existing enterprise environment with no separate services buy would end the opportunity.
