VA Launches Biometric Pilot to Enhance Healthcare Access Security

The U.S. Department of Veterans Affairs (VA) has initiated a pilot program aimed at transforming how healthcare staff access secured areas and sensitive information. This initiative, known as the Biometric Authentication Proof of Concept (POC), will explore the use of facial and iris recognition technology as potential replacements for traditional access control methods. The project evolved from an earlier request for information into a focused solicitation for small businesses, indicating a strategic shift towards competitive procurement.

This week, the VA clarified that the Biometric Authentication Pilot will proceed as a small business set-aside, allowing smaller firms to compete for what is expected to be a highly technical federal contract. This approach aligns with the VA’s practice of transitioning from exploratory requests to targeted acquisition efforts, seeking to engage a broader range of participants. Industry analysts regard this biometric pilot as one of the most intricate federal proofs of concept in recent years, particularly due to its alignment with stringent federal cybersecurity standards, including FIPS 201-3 and directives from the National Institute of Standards and Technology (NIST).

The pilot’s framework emphasizes strict controls over data usage. The VA has mandated that no veterans’ health information or data from non-participating individuals may be collected. This commitment aims to address ongoing concerns regarding privacy in biometric applications within healthcare contexts. Should the pilot prove successful, the VA plans to expand the system across various facilities, potentially extending its application from physical access to digital access for IT systems and clinical workstations.

The VA’s Technology Acquisition Center in Eatontown, New Jersey, confirmed that the project will be managed through the General Services Administration’s eBuy platform. The original request for information was designed to gather insights from the industry rather than solicit bids. Vendors were invited to demonstrate their experience with large-scale biometric systems and provide preliminary cost estimates for the necessary hardware and software.

A draft Performance Work Statement (PWS) issued in May outlines the VA’s expectations from the selected contractor. The initiative aims to enhance efficiency for healthcare staff, streamline access in sterile environments, and strengthen security through multi-factor authentication resistant to phishing attacks. The PWS specifies that contractors must deliver a comprehensive solution that integrates front-end capture devices and back-end matching systems with the VA’s existing Physical Access Control Systems (PACS).

The pilot is scheduled to last for a base period of 12 months, with an option for an additional year. Implementation will occur at either a healthcare training facility or an active VA hospital. Core requirements include a one-to-many biometric match system for enrolled staff, hands-free access to restricted areas, and on-premises storage of biometric data, strictly limited to enrolled VA personnel.

To mitigate potential disruptions, the pilot will run concurrently with existing badge-based access methods. The contractor will also be responsible for the enrollment process, operator training, user support, and the removal of the system if it does not meet performance expectations. The VA has underscored the necessity for comprehensive solutions, rejecting proposals that suggest partial or software-only approaches.

The VA explicitly stated its preference for a complete implementation managed by a single contractor, although it encouraged partnerships to create integrated solutions. Optional tasks within the PWS include the possibility of migrating the biometric solution to the VA’s Enterprise Cloud and expanding its deployment across numerous facilities. Conversely, should significant issues related to performance, privacy, or user satisfaction arise, the program will be halted, with findings documented for future reference.

As the VA transitions from idea gathering to evaluating formal proposals, industry responses are being directed through the Technology Acquisition Center. The agency’s decision to advance its biometric authentication pilot highlights both the potential of biometrics in federal healthcare and the need for careful oversight and accountability throughout the implementation process. The success of small businesses in addressing these challenges could not only redefine access management at VA facilities but also set important precedents for biometric technology adoption across the broader federal healthcare landscape.