BAA for NASA’s Flight Medicine EHR Bridge: Scope, Requirements, and Submission Guide

BAA Overview and Purpose

The Broad Agency Announcement (BAA) for NASA’s Flight Medicine EHR Bridge invites innovative solutions that enable secure, reliable, and standards-based data exchange between NASA flight medicine systems and partner environments. The goal is to improve Electronic Health Record Interoperability while preserving clinical safety, privacy, and mission readiness.

This effort focuses on an integration “bridge” that translates, routes, and governs clinical and occupational health data across systems used by flight surgeons, occupational health providers, and operational teams. Proposals should emphasize measurable outcomes: fewer manual touches, faster data availability, traceable provenance, and robust auditability.

Key objectives

• Deliver a modular, extensible architecture that supports Health Level Seven International (HL7) standards, including HL7 v2.x and FHIR, for multi-directional data exchange.
• Harden the bridge for HIPAA-aligned privacy and security and for FISMA-driven federal information assurance.
• Reduce integration complexity through a canonical data model, terminology mapping, and reusable interface patterns.
• Enable operations in bandwidth-constrained or intermittent environments common to flight medicine settings.

Representative deliverables

• Concept of operations, reference architecture, and detailed interface control documents.
• Configurable adapters and transformations for common clinical workflows and data types.
• Verification and validation artifacts, interoperability test results, and user-focused runbooks.
• Security artifacts aligned to federal review, plus training and transition materials.

NASA Flight Medicine EHR System

NASA’s flight medicine environment supports routine care, aeromedical certification, occupational health, and mission-specific readiness. The EHR system must coordinate data such as examinations, waivers, labs, imaging, immunizations, and duty status while maintaining strict access controls and audit trails.

Integration points typically include scheduling, demographics, encounters, observations, procedures, and clinical documents. Solutions should respect NASA Technical Standards and the agency’s identity, credential, and access management approaches, ensuring role-appropriate, least-privilege access across centers and programs.

Operational context

• Hybrid connectivity across centers and clinics with segmented networks and controlled perimeters.
• Need for rapid retrieval of mission-relevant health data with complete provenance.
• Support for near-real-time events and asynchronous, store-and-forward exchanges.

Technical Specifications for the EHR Bridge

Data exchange and standards

• HL7 v2.x (e.g., ADT, ORU, ORM, SIU) for established clinical workflows and notifications.
• HL7 FHIR R4 for RESTful APIs, including core resources such as Patient, Practitioner, Encounter, Observation, Condition, Procedure, and MedicationRequest.
• C-CDA or FHIR Document support for care summaries; optional DICOM for imaging references.
• IHE profiles (e.g., PIX/PDQ for identity, XDS/MHD for document sharing) where appropriate.

APIs and integration patterns

• API-first design with OpenAPI-described endpoints, versioning, and idempotency.
• Event-driven messaging and durable queues for reliable, ordered delivery and replay.
• Canonical data model with configurable mappings to local data representations.
• Bulk import/export for historical migration and episodic synchronization.

Identity and access

• Standards-based authentication and authorization (OAuth 2.0/OIDC) with role- and attribute-based access controls.
• Fine-grained scopes, consent enforcement, and policy decisions logged for audits.
• Support for smart-on-EHR launch patterns and context passing where relevant.

Data quality, terminology, and provenance

• Terminology services for LOINC, SNOMED CT, RxNorm, ICD-10-CM, CPT, and UCUM units.
• Bidirectional mapping with validation, automated conformance checks, and clear error handling.
• Comprehensive provenance tags (who, what, when, where, how) on each transformation.

Resilience, performance, and observability

• Horizontal scalability, graceful degradation during outages, and resumable transfers.
• Low-latency paths for mission-critical events with backpressure control for bursts.
• Structured logging, metrics, and distributed tracing; auditable, immutable event trails.

DevSecOps and delivery

• Containerized deployment with infrastructure as code, environment parity, and automated rollbacks.
• Security by design with SAST/DAST, dependency scanning, SBOM generation, and signed artifacts.
• Test harnesses with synthetic data, negative testing, and HL7/FHIR validators.

Security and Compliance Standards

Because the EHR Bridge touches protected health information, proposals must align to the Health Insurance Portability and Accountability Act (HIPAA) and the Federal Information Security Management Act (FISMA). Solutions should reflect NASA Technical Standards and federal risk management practices from design through operations.

Governance and frameworks

• NIST Risk Management Framework with control baselines tailored to system categorization.
• NIST SP 800-53 controls, continuous monitoring, and plan of action and milestones management.
• FedRAMP-authorized services at an appropriate impact level when using cloud components.

Protection controls

• FIPS 140-3 validated cryptography; TLS 1.3 in transit and strong encryption at rest with managed keys or HSMs.
• Zero Trust Architecture principles, network segmentation, and micro-perimeters around sensitive services.
• Strict minimum-necessary access, comprehensive audit logs, and tamper-evident storage.

Operational security and privacy

• Incident response runbooks with defined SLAs, forensics, and breach notification workflows.
• Vulnerability and patch management tied to risk scoring and service-level remediation targets.
• De-identified or synthetic data for testing; data retention and disposal aligned with records policies.

Compliance deliverables

• System Security Plan, architecture diagrams, data flow maps, privacy impact assessment, and control evidence.
• Security assessment reports, penetration testing results, and supply chain risk documentation.
• Business associate agreements with downstream processors as required by HIPAA.

Integration and Interoperability Requirements

Interoperability is central to the BAA for NASA’s Flight Medicine EHR Bridge. Proposals should show how the bridge supports seamless, governed data movement without disrupting clinical workflows or compromising data integrity.

Identity and patient matching

• Enterprise Master Patient Index with probabilistic and deterministic matching strategies.
• IHE PIX/PDQ or FHIR-based patient identity services, with ongoing reconciliation and deduplication.

Clinical workflows and data domains

• Scheduling and encounters (HL7 SIU/FHIR Appointment), labs and observations, procedures, and imaging references.
• Care summaries and referrals using C-CDA or FHIR DocumentReference/Composition.
• Occupational health and flight-readiness data with clear status transitions and audit trails.

Interoperability assurance

• Conformance validation against HL7/FHIR implementation guides and profile constraints.
• Contract tests, simulated partner endpoints, and end-to-end scenario testing.
• Backwards-compatible changes, version negotiation, and deprecation policies.

Usability and accessibility

• Task-aligned user experiences for clinicians and administrators, minimizing swivel-chair work.
• Section 508-aligned accessibility for any user-facing components.

Proposal Submission Instructions

Submit all materials through the designated Proposal Submission Portal. Do not email proposals; only portal submissions will be accepted. Follow the BAA’s formatting, file type, and page-limit rules precisely to avoid administrative rejection.

Before you start

• Confirm organizational registrations and portal access for all contributors.
• Review eligibility, teaming, and data rights provisions in the Broad Agency Announcement.
• Use the portal Q&A feature for clarifications before the stated cutoff.

Required volumes and content

• Executive summary and technical volume with architecture, data standards, and implementation plan.
• Security and compliance plan addressing HIPAA, FISMA, NIST controls, and FedRAMP usage.
• Interoperability test plan, data mapping approach, and validation strategy.
• Management plan, staffing, resumes, past performance, risk register, and mitigation strategies.
• Schedule with major milestones, deliverables, and readiness for demonstrations.
• Cost volume with basis of estimate, pricing assumptions, and subcontractor details.
• Compliance matrix mapping requirements to proposal sections and artifacts.

Formatting and submission

• Adhere to page limits, section order, and file naming conventions specified in the portal.
• Lock files to PDF where required; verify readability and remove active content or macros.
• Upload early to allow time for integrity checks and portal confirmations.

Final pre-submit checklist

• All mandatory forms completed in the Proposal Submission Portal.
• All volumes present, internally consistent, and cross-referenced in the compliance matrix.
• Authorized representative has executed the final submission and received confirmation.

Evaluation Criteria and Timeline

Evaluation criteria

• Relevance and technical merit for flight medicine needs and Electronic Health Record Interoperability.
• Soundness of architecture, use of NASA Technical Standards, and adherence to HL7/FHIR.
• Security and compliance maturity under HIPAA and FISMA, including evidence-based controls.
• Feasibility, risk posture, schedule realism, and clarity of verification plans.
• Team qualifications, past performance, and effectiveness of program management.
• Cost realism and overall value to NASA.

Indicative timeline

• BAA release and portal opening, followed by a defined Q&A period.
• Optional notices of intent or white papers if specified.
• Full proposal due date at the time indicated in the Proposal Submission Portal.
• Evaluation period that may include orals, demonstrations, or clarifying questions.
• Selection notifications, negotiations, and anticipated award/period of performance start.

Conclusion

The BAA for NASA’s Flight Medicine EHR Bridge seeks practical, secure, and standards-forward solutions that simplify data exchange and strengthen clinical readiness. Center your proposal on measurable interoperability, built-in security, and operational resilience, and use the Proposal Submission Portal to align deliverables, timelines, and compliance artifacts with the announcement’s requirements.

FAQs

What is included in the scope of the NASA Flight Medicine EHR Bridge BAA?

Scope includes designing and delivering an integration bridge that translates, routes, and governs clinical and occupational health data across systems. It spans standards-based interfaces (HL7 v2.x, FHIR), terminology mapping, identity and consent enforcement, validation and testing, and security documentation. Replacing a core EHR platform or unrelated non-clinical IT is generally out of scope unless explicitly stated.

How should proposals address security requirements?

Provide a defense-in-depth strategy aligned to HIPAA and FISMA, referencing NIST controls, FedRAMP use for cloud components, and FIPS 140-3 cryptography. Include an SSP outline, control inheritance, continuous monitoring, incident response, vulnerability management, and a data minimization approach. Map specific controls to bridge components and provide evidence or plans for assessment.

What are the key deadlines for submission?

Exact dates are listed in the Broad Agency Announcement and the Proposal Submission Portal. Expect milestones such as a Q&A cutoff, optional notices of intent or white papers (if required), the full proposal deadline, potential orals/demos, and selection notifications. Build internal buffers and submit early to avoid portal-related delays.

How will proposals be evaluated?

Evaluations consider relevance and technical merit, the soundness of the architecture and standards alignment, security/compliance rigor, feasibility and risk, team qualifications, and cost realism. Reviewers may request clarifications or demonstrations to validate interoperability, security controls, and operational readiness.