Home / Sectors / Federal Health
Health data carries the hardest authorization boundary in federal.
Clinical imaging, real-time media, encounter documentation and agency EHR interconnections all cross the line at once. Traverge has carried these systems through FISMA, RMF and FedRAMP for the VA, NIH and the Defense Health Agency.
What we have actually done
Traverge leadership has managed the FISMA authorization lifecycle across the Department of Veterans Affairs, the National Institutes of Health and the Defense Health Agency, including compliance portfolio management across multiple interconnected systems of record. The NIH infrastructure backbone was recertified under that work, and authorization continuity was maintained for live health data environments throughout.
On the clinical side, we have carried a telemedicine platform through a DHA RMF ATO and a telehealth provider through the DISA connection approval process. Both are narrower and less forgiving than a standard FedRAMP path, and both are where most commercial health platforms discover their boundary was drawn wrong.
Boundary before controls
Most readiness efforts fail because they start with a control checklist. A boundary drawn wrong invalidates every downstream control statement. For a health platform the contested edges are predictable:
- Point-of-care diagnostic equipment inside the facility
- Clinician endpoints, and who actually owns them
- Real-time media carrying video and clinical imaging
- Interfaces and interconnections to an agency EHR
Where commercial health platforms fail assessment
These are the findings we write at the start, which are the findings a 3PAO writes at the end.
- FIPS-validated cryptography. Most commercial real-time media stacks are not built on CMVP-validated modules. CMVP now issues 140-3 certificates while older policy still cites 140-2. Caught early this is a design decision. Caught at assessment it is a schedule slip.
- Phishing-resistant MFA. Required under OMB M-22-09. SMS and push factors will not survive assessment.
- Record-level audit. Agencies expect to see who viewed which patient record and when, not only who authenticated.
- Agency overlays. PTA and PIA, Rules of Behavior, personnel suitability, HSPD-12 credentialing, ISAs, media sanitization, Section 508 and incident reporting windows shorter than the federal default. None of it is difficult. All of it is routinely missed until after award.
Control inheritance is not the whole baseline
A FedRAMP-certified IaaS typically covers roughly a third of the Class C baseline at the infrastructure and physical layers. The remaining application-layer controls are where the authorization is won or lost, so we produce the Customer Responsibility Matrix early, while engineering can still act on it.
Choosing a path
Under CR26, an authorization is three choices rather than one.
The combination matters more than any single element, and the wrong combination produces an authorization your agency customer cannot consume.
| Dimension | Options | What decides it |
|---|---|---|
| Type | Rev5 or 20x | What the agency can consume today. Rev5 produces an SSP-based package and periodic ConMon reporting. 20x produces continuous machine-readable KSI evidence. |
| Path | Agency or Program | Agency sponsorship and ATO issuance, or direct FedRAMP review. The Program path removed the sponsor bottleneck. The Agency path is legacy and Rev5 only. |
| Class | A, B, C or D | FIPS 199 categorization. Class B replaces Low, C replaces Moderate, D replaces High. Federal health data typically falls under Class C. |
Our usual recommendation for health platforms
Pursue Rev5 Class C, engineered to 20x KSI evidence standards from the first sprint.
A KSI evidence pipeline is far harder to retrofit than to instrument from the start. Built this way, the 20x move changes what you publish and how often, not how you produce it.