The Requirement With No Program

Capture Corner is the premium BD intelligence companion to Mission Meets Tech. Public-record sourced. Independent analysis. Not a recommendation, not vendor advocacy, not capture material. Built for federal health BD, capture, and proposal leaders who need analytical depth, not headlines.

This issue is the companion to "A Question From the Floor," published this week. The public piece reads DoD Instruction 6040.48 against what the departments built and unbuilt since 2018. This one works the requirement underneath it: a policy eight years old with implementation duties assigned by name and no program of record, a section that already permits commercial personal health record systems and has never been operationalized, a post-separation access clock that is an identity requirement in disguise, a VA function retired in June 2025 with a partial replacement, the TEFCA individual access schedule that is the nearest thing to a build plan, and every dated event from this week's myAuth switch through the executive order's last deadline. The September 18 Capture Corner covered Executive Order 14426's contract review clause in detail; this issue references it and does not repeat it.

---

1. The picture at a glance

Field	Detail
Governing policy	DoDI 6040.48, "Personal Health Records (PHR) and Patient-Controlled Data," October 23, 2018, approved by Stephanie Barna performing the duties of USD(P&R); cleared for public release; oversight assigned to the Deputy Assistant Secretary of Defense for Health Services Policy and Oversight [CC1]
The policy sentence	MHS "will provide, for individuals whose medical records it maintains, the opportunity to create an electronically accessed and stored PHR"; patient-controlled data includes copies from the DoD Health Record, patient-generated data, and other sources [CC1]
Duties assigned to Director, DHA	Procedural guidance on (1) eligibility by age and category, (2) data standards for DoW and external sources including home devices, (3) exchange standards, (4) breach responsibilities, (5) maintenance, use, and access, (6) disposition; plus provider-responsibility guidance for patient-initiated sharing [CC1]
Guidance located	None. DHA-PM 6025.02, Volume 1, lists 6040.48 as reference (j); no DHA-PI or DHA-PM implementing section 2.2 was found on health.mil as of this analysis [CC2]
Statutory layer	FY2020 NDAA section 715: FEHRM purposes include patient ownership and control, prevention of exclusive contractor control, lifetime longitudinal PHR, open APIs and FHIR; 715(h) strategy requirement [CC3]
Last public program record	November 2020 DHA article on the DoD/VA Patient Engagement Work Group's "single, lifetime, personal health data space"; November 2021 FEHRM presentation listing the "DOD/VA Joint Personal Health Record Initiative (Digital Patient Engagement Platform)" among 27 initiatives [CC4][CC5]
Current VA state	VA.gov front door at ~1.7 million logins a month; app at 3 million downloads and 1.4 million monthly active users; one portal since May 29, 2026; self-entry PHR function ended June 4, 2025; Share My Health Data requires VA enrollment [CC30][CC32][CC8][CC6][CC7]
Current DoW state	MHS GENESIS Patient Portal: current MTF record only, immediate results since January 20, 2026, myAuth login from September 23, 2026; TOL portal and its Download My Data export decommissioned April 1, 2025, legacy records not transferred; "My STR" portal described in testing with no go-live date, stated at the September 15 summit, no public document located [CC9][CC10][CC33][CC11]
Prior DoW front-door program	DIU Digital Front Door: solicited April 2024, four OTA prototypes December 2024, not moved to production per MMT January 2026 reporting; no public closure notice [CC35][CC36][CC38]
Nearest build schedule	TEFCA IAS SOP v3 effective August 3, 2026, staged requirements October 1, 2026, January 1, 2027, July 1, 2027; FEHRM preparing to connect through Oracle Health Information Network [CC12][CC13]
Executive order clocks	EO 14426: 30 days (October 8, 2026), 120 days contract review (January 6, 2027), 180 days systems, tools, and TAP (March 7, 2027); subject to appropriations [CC14]

Confidence: High on the instruction text, the statute, the VA and DHA product pages, the SOP, and the executive order, all read from the primary documents. Medium on the absence of DHA implementing guidance, which rests on a search of health.mil's policy library and the procedures manual's reference list; an internal or unpublished DHA-PI could exist. Medium on the November 2021 initiative listing and its disposition, which rests on one FEHRM presentation and the absence of any later public statement. Medium on statements made at the September 15 summit session: the author attended and the quotations are accurate, but they are spoken statements by program staff, not published positions, and no document corroborates them.

The lead finding for a capture team: DoW has carried a personal health record requirement in policy since October 2018, assigned six implementing products to the DHA Director by name, and no public record shows any of them delivered, no program of record carries the requirement, and the section of the instruction that would let a commercial PHR be the DoW-permitted system has never been turned into a registration process. The requirement is unowned. The nearest dated schedule that touches it belongs to TEFCA, and the nearest funded event that could pick it up is the contract review the executive order requires by January 6, 2027.

---

2. Six deliverables with a named owner and no public record

Confidence: High on what the instruction assigns. Medium on the absence, for the reason above.

Section 2.2.a of the instruction directs the Director, DHA to develop and distribute procedural instructions or guidance covering six things, and section 2.2.d adds a seventh: guidance specifying MHS provider responsibilities for patient-initiated communications, including data shared to and from a PHR. [CC1] Section 2.2.b requires the Director to confirm that PHR systems provided comply with the instruction and with DoW cybersecurity, privacy, and health-information security policy under DoDI 8500.01, 8580.02, and 6025.18. [CC1] Section 2.2.c directs coordination with DISA for any PHR component that relies on DISA support. [CC1]

Read as a statement of work, that is a policy and standards task: an eligibility matrix, a data standards profile for device and external inputs, an exchange standards profile, a breach procedure that reconciles the HITECH and FTC split in section 3.9, an access and maintenance instruction, a disposition schedule approved by the DHA Privacy Office and published before any PHR system goes live, and a provider guidance update to whatever DHA already issues on secure messaging. [CC1] Section 3.8 says the disposition schedule must be published prior to implementation, which means the disposition product is a gate, and a PHR system that launched before it would be out of sequence with its own policy. [CC1]

None of it is visible. DHA's procedures manual for DoD Health Record life cycle management cites 6040.48 as a reference and handles the official record, which the instruction explicitly says the PHR is not. [CC2][CC1] The instruction's originating component is the Office of the USD(P&R), and its oversight sits with the Deputy Assistant Secretary for Health Services Policy and Oversight, so the compliance question can be asked at two addresses: the DASD office that monitors compliance and the DHA Director who owes the products. [CC1]

The capture reading is that the products are small, policy-shaped, and unassigned. They fit inside an existing health policy or health IT support vehicle as a modification, and the firm that drafts them shapes the standards profile every later PHR capability must meet. Whoever writes the data standards under 2.2.a(2) and the exchange standards under 2.2.a(3) decides which device formats and which FHIR profiles count, and that is the requirement the next solicitation will inherit.

---

3. Section 3.2 is an authorization pathway, and the door has not been built

Confidence: High on the instruction text and the CMS model. Medium on the inference that DoW has no app registration process, which rests on absence from public DHA and TRICARE pages.

Section 3.2 says patients "may choose to access or manage a PHR in a system offered by DoD or they may choose to use a non-DoD provided system." [CC1] Section 3.6 attaches the consequence: information copied to a non-DoW system is no longer DoW's responsibility to secure and is not an MHS certified copy. [CC1] Section 3.9 assigns the FTC breach rule to PHRs maintained by neither a covered entity nor a vendor on its behalf. [CC1] The instruction already contemplates a commercial PHR as the patient's system and already tells the patient what changes when they use one.

CMS built the thing DoW described, and the market signed on. On July 30, 2025 more than 60 companies, Epic, Oracle Health, Apple, Google, Microsoft, Amazon, and OpenAI among them, pledged at the White House to deliver patient-centered data exchange and apps by the end of March 2026; 21 networks pledged to the CMS Interoperability Framework, seven EHR vendors committed to "kill the clipboard," and by January 2026 the pledge carried more than 600 organizations. [CC45][CC46] The federal EHR's own vendor is on the list, which means the technical objection raised on September 15, that outside data waits on the joint HIE, is not one Oracle Health is making in its civilian business. [CC46] Its health technology ecosystem, launched in April with tools from more than 50 companies, admits apps to the Medicare app library on review by DiMe or DirectTrust and permits direct network access or access through a PHR. [CC15] The summit questioner tied the DoDI directly to that effort, and the DoW answer did not engage it. [CC11] The federal side of the door is an app registration process with published criteria, an identity handoff from myAuth, and a FHIR endpoint the app can call. Two of the three exist in parts: myAuth is live across TRICARE platforms and reached the portal on September 23, and the Oracle Health platform beneath MHS GENESIS supports patient-facing FHIR APIs in commercial deployments, though I have located no DoW document that says a beneficiary-selected app can call one against the federal EHR today. [CC9][CC10]

Three implications.

A registration process is a smaller buy than a platform, and it is the buy that would satisfy the instruction fastest. It needs criteria, a review contractor or a reliance decision on DiMe and DirectTrust, an authorization boundary decision for the endpoint, and a terms-of-use notice that section 3.10 already requires. [CC1] That is a policy, security, and identity task, and the firms that hold DHA's cybersecurity, privacy, and identity support work are positioned to write it.

The commercial PHR vendor's route in is through this section, and the case to make is compliance with an existing instruction, with the capability described in the instruction's own terms. A vendor with a DiMe or DirectTrust review, an FTC breach rule posture, and a documented export in the standard formats section 3.8 names is describing the section 3.2 system the instruction permits. [CC1][CC15]

The identity handoff is the seam. DS Logon sunsets by the end of FY2026, myAuth is a DMDC product, and the executive order's 180-day digital tools clause points at a single benefits source. [CC9][CC14] A PHR app that authenticates a separated service member after the CAC is gone needs a durable non-CAC identity, and Okta Verify under myAuth is the first public answer to that. [CC10] The September 18 Capture Corner mapped the DEERS, VADIR, and MPI reconciliation gap that no incumbent owns; this is that gap seen from the patient's side.

---

4. The front door competition DHA already ran

Confidence: High on the solicitation and the awards. Medium on the termination, which rests on MMT's January reporting and the absence of any DHA or DIU statement since; no public closure notice has been located.

The DIU solicitation of April 18, 2024 asked for "a 'digital front door' that successfully integrates with or replaces our current architecture," data centric, platform agnostic, with beneficiary self-scheduling, provider search, and secure messaging, under a December 2023 department memo to add MTF capacity and win beneficiaries back. [CC35] More than 220 companies responded. In December 2024 DIU issued four other transaction prototype awards, to BDR Solutions, Bluestaq, Clearstep, and Ernst & Young, for a twelve-month pilot across five MTFs and about 260,000 beneficiaries, with scale to 9.5 million as the stated prize; EY's scope was the beneficiary application itself, native iOS and Android with middleware into the MHS Information Platform, and Bluestaq's was a data fabric over MIP. [CC36][CC37] MMT reported in January 2026 that the prototypes would not move to production, and nothing published since contradicts that. [CC38] DHA is left with the Oracle portal; VA retired its copy of the same portal in May and consolidated onto My HealtheVet. [CC8]

The program had a care-model predecessor. DHA launched My Military Health at the same five sites in March 2024, and by May 2025 reported new patient appointments up 61 percent at Eglin and mental health waits cut from about thirty days to one week; as of August 21, 2026 the beneficiary page for that model returns Page Not Found and the program is absent from DHA's topic index. [CC40][CC41][CC42] The result DHA itself published is the proof point a proposal can cite, and the missing page is the status.

Five capture readings.

The proposal shape is VA's, and it is cheap. VA's Health Connect runs as a module on a platform the department had already authorized, and its vendor reports more than 40.6 million calls; My HealtheVet consolidated onto VA.gov the same way. [CC43][CC44] A DoW concept written to that shape, one beneficiary-facing layer on an enterprise platform DHA already holds and has accredited, the patient's copy and export behind it, a section 3.2 registration path beside it, carries no new authority to operate and no new accreditation timeline, which is the objection that ended every larger version.

The requirement survived the program. The solicitation's own language, integrate with or replace the current architecture, is the front-door thesis the VA presenter restated on September 15, and section 3.2 of the instruction is the policy hook a successor proposal can cite that the 2024 solicitation never did. [CC35][CC1][CC11]

The vehicle changed. DIU's OTA was the 2024 door; the enterprise Commercial Solutions Opening HT003826SC005 and the Medical Digital Solutions portfolio, covered in the September 4 Capture Corner, are the 2026 door, with phase-gated white papers and fixed-price outcomes. A front-door or patient-record concept re-entering DHA goes through that CSO, and the prototype-to-production gap that ended DFD is the risk a white paper has to answer in its first page.

Congress has written a dated hook. Section 721 of the Senate Armed Services Committee's FY2027 bill directs a capability prototype on secure access to health records for members of the Armed Forces, interoperable with the EHR, with a briefing due April 1, 2027. [CC39] Not law yet, and the House print has no equivalent, but it is the first congressional deadline that names a beneficiary-facing records prototype since section 715, and it lands three weeks after the executive order's last clock.

The DFD awardees are the market map. Four firms hold OTA past performance on exactly this scope and no production contract; a prime building a section 3.2 or section 721 concept has four candidate teammates whose prototypes were funded and never fielded, and whose data rights under the OTA terms are the first question to ask.

5. The twelve-month clock is an identity and export requirement

Confidence: High on the instruction. Medium on the operational reading.

Section 3.8 says a separating patient will have post-separation access to a DoW-offered PHR for at least twelve months, and that the access "must preserve the ability for the patient to share data with other health care systems and providers in the standard formats used by DoD." [CC1] The section also says DoW is not responsible for information a patient copies into a non-DoW system, and that disposition of a DoW-supported PHR no longer used follows a schedule the DHA Privacy Office approves and publishes before implementation. [CC1]

Operationally that is four requirements: an identity that survives the CAC, an access clock with a defined start, an export in named formats, and a published disposition schedule. The first is the hardest and the most current. The portal moved to myAuth on September 23, and myAuth's non-CAC option exists, but the beneficiary-status change at separation is a DEERS event, and how portal entitlement behaves across that event is undocumented on the public pages. [CC9][CC10] The export requirement has a partial answer in the portal's existing view-and-download function and TRICARE's SF-180 route for a complete service treatment record copy, neither of which is scoped to the twelve-month window. [CC10][CC16]

The export requirement has a precedent DoW already ran. The TRICARE Online Patient Portal's "Download My Data" function let a beneficiary pick the person, data types, date range, and format and pull a PDF or a continuity of care document, which TRICARE's own notice said could be used to populate a personal health record; that is section 3.4's capability, fielded, before the instruction existed. [CC33] DoW decommissioned it April 1, 2025. Legacy records did not transfer to the MHS GENESIS portal, the post-deadline route is an in-person request at the records office, secure messages under the separate vendor did not carry over, and beneficiaries who moved between a TOL site and a GENESIS site hold "gap" records they can no longer log in to see. [CC33][CC34] The GENESIS portal shows the current MTF record; the DoW presenter on September 15 described it as a commercial product on which DoW-specific changes are not always easy, with appointment locations still shown as DMIS codes and result-publishing delays removed only in January 2026. [CC11][CC10]

Three capture readings. The TOL export is the functional baseline a proposal can cite by name, with its formats, its per-person and date-range selection, and its parental access rules for minors, which the notice spells out. [CC33] The legacy-record gap is a live records-management workload at every MTF, handled by paper request, and a digitized self-service path for pre-GENESIS records is a bounded task an EHR sustainment or records vehicle could absorb. The portal's COTS constraint is the argument for the section 3.2 app path: a capability DoW cannot easily change inside Oracle's product can be delivered outside it, against an authorized endpoint, without a change request to the EHR vendor.

Two more gaps sit in the same MTF eligibility flyers. First, a separated, non-retired member kept DS Logon, and therefore the portal, for six months after leaving under the January 2024 guidance; the instruction says at least twelve, and no public document reconciles the two under myAuth. [CC47][CC1] Second, beneficiaries aged 13 to 17 have no portal account at all, parents see only appointments, messaging, immunizations, and allergies, and anything else is a DD Form 2870 and up to 30 business days. [CC47] Section 3.3 of the instruction provides for family-member PHRs and says parental-access guidance "will be developed"; that is chore one, eligibility by age, and it is the beneficiary-facing gap a proposal can quantify: five years of every military child's record with no self-service path for the child or the parent. [CC1]

The working export at separation is not the portal at all. As described to the author by a retiree who went through it, the transition briefing sends the member to the MTF records office for a CD of the full record, the veterans service officer builds the VBA claim from that disc, no step involves a portal download, and the service officer does not accept paper. A capture team should treat the records-office CD as the incumbent export process, the VSO as the downstream customer of the export format, and the executive order's 180-day sharing requirement as the thing that would replace the disc. [CC14]

The Transition Assistance Program is where the clock could be made real. EO 14426 gives the Secretary of War 180 days, to March 7, 2027, to update TAP and connect every separating member to jobs, training, and benefits representatives. [CC14] A records export at the TAP touchpoint is the smallest deliverable the update could carry, and the TAP support contracts are the vehicles that would carry it. A firm holding TAP curriculum or delivery work can propose the export step as a modification inside the order's window without waiting for a PHR program that does not exist.

---

6. VA's front door is the platform, and one function is missing from it

Confidence: High on the VA product pages, usage figures, and PIAs. Medium on who holds the platform work, which I have not located in an award record.

The hub case, made in this week's public issue, is that VA build the record, and the reason is the platform VA already runs. VA.gov relaunched in November 2018 and has carried nearly 1.7 million logins a month since, per USDS; sign-in is consolidated to Login.gov and ID.me, with the My HealtheVet password removed March 5, 2025 and DS Logon removed November 18, 2025; the VA Health and Benefits app passed 3 million downloads and 1.4 million monthly active users in June 2025; and as of May 29, 2026 VA runs one portal across its legacy and federal EHR sites. [CC30][CC31][CC32][CC8] That is the delivery model to write to: national feature releases on an existing platform with a proven identity layer, feature by feature, not facility by facility, and which VA has executed twice in eighteen months with the sign-in consolidation and the portal consolidation. A PHR capability proposed to VA is a feature on that platform, and a proposal that describes a separate system is competing against VA's own stated design principle that important information sits in the record the care team can see. [CC6]

VA's June 4, 2025 move of My HealtheVet onto VA.gov ended the ability to enter and store health information outside the electronic health record; historical self-entered data remains downloadable as a report. [CC6][CC17] The FY2026 My HealtheVet platform PIA still describes self-entry and storage, a documentation conflict with the current FAQ that a capture team should read as the FAQ being current and the PIA being stale. [CC18] VA retired My VA Health on May 29, 2026 and consolidated onto the single My HealtheVet experience; Clipboard questionnaires did not migrate. [CC8] VA's legacy My HealtheVet site redirects at the end of this month. [CC19]

The replacement is Share My Health Data, which accepts Fitbit, Garmin, Apple, and compatible Bluetooth readings plus manual vitals, sends them to the VA care team, requires VA health care enrollment and a supported login, and does not allow connected-device readings to be deleted through the app. [CC7] Behind it is VA's FHIR-based patient-generated health data infrastructure, which a 2025 study reported at more than 130 million observations from more than 25,000 patients, with documented data quality and selection limits. [CC20] VA's Lighthouse Patient Health API is read-only, consent-based, and retains no longitudinal store inside its boundary. [CC21]

Side by side, the gap is one feature wide. Lighthouse retrieves the institution's data for an approved app. Share My Health Data sends the patient's data into the institution. Neither is a durable store the veteran controls, and the function that was, self-entry in My HealtheVet, ended fifteen months ago. [CC6][CC7][CC21] For a vendor, the opening is a portable workspace that reads through Lighthouse, writes through the PGHD pathway, and holds the copy the veteran owns, which is the architecture the instruction's section 3.4 describes for DoW. [CC1] For a services firm, the opening is the migration map VA has not published: what moved, what did not, and what a veteran can export from the app. VA's digital product and Connected Care organizations own that question, and the contract vehicles carrying VA.gov platform and mobile app work are where it would be answered. I have not located the specific award records for that work and will not name incumbents from memory.

---

7. TEFCA IAS is the nearest thing to a build schedule

Confidence: High on the SOP dates and the reporting. Medium on what federal participation will look like at each date.

The Individual Access Services standard operating procedure, version 3, took effect August 3, 2026, and section 4.9 stages its requirements: token provisions on October 1, 2026, a demographic double-check on January 1, 2027, and specified FHIR support on July 1, 2027. [CC12] The RCE described IAS responsiveness as "suboptimal" in its February 17, 2026 information call. [CC22] The American Hospital Association's April 24 comments on the draft procedure raised matching, authority and consent, state-law compatibility, and accountability concerns, some of which the final SOP addresses through the staged requirements. [CC23]

On the federal side, FEHRM's FY2025 Q3 interoperability report documents QHIN analysis, and Nextgov reported September 3 that FEHRM's chief technology officer said the office is preparing to connect through Oracle Health Information Network, with 14 organizations looking to join the federal EHR program. [CC24][CC13] Preparation and a reported connection choice are not a completed patient-facing IAS, and eHealth Exchange membership does not establish TEFCA participation on its own. [CC25]

For capture, IAS is the schedule the PHR requirement has been missing. The three dates are the milestones a patient-directed retrieval capability against the federal EHR would have to meet, and Oracle Health Information Network is the QHIN whose IAS implementation federal beneficiaries will use if the reported choice holds. A firm proposing any patient-facing exchange capability to DHA or VA should write its technical approach to the July 1, 2027 FHIR requirement and treat the January 1 demographic check as the identity milestone that ties back to section 5 above. The match error rate, retrieval completeness, and provenance coverage are the metrics, and the AHA comments are the list of what a hospital counterparty will object to.

---

8. What was said at the summit, held at its weight

Confidence: Medium. Spoken statements at a recorded session the author attended; speakers not named; no corroborating document located.

Four statements from the September 15 session bear on capture, and each is held at the weight of a spoken statement by program staff. First, a DoW participant said a "My STR" portal for retiring and separating service members, letting them see all clinical care while still on active duty, is in testing with no estimated go-live. [CC11] No DoW document describing that product was located; TRICARE's records page still routes a complete STR copy through SF-180. [CC16] Second, the same participant read the DoDI as centered on care obtained outside the federal government, which the instruction's sections 1.2 and 3.4 do not support; that reading, if it is the program's working reading, means the DoW copy of the record is not being scoped into whatever is built. [CC11][CC1] The same participant said that assembling outside records "comes back to the joint HIE" and waits on a federally mandated share that is "not there yet"; the information blocking rule has applied since 2021 and the IAS SOP carries dates, so a proposal should treat that view as the program's current position, not the legal state. [CC11][CC12] Third, the DoW presenter who had held the portal role said the portal is very different from a PHR and knew of no other effort, which is consistent with the absence of a public record after 2021 and not proof of it. [CC11][CC5] Fourth, the VA presenter said that portals are evolving into digital front doors needing an end-to-end path, reached through the VA Health and Benefits app and VA.gov. [CC11] For a proposal, the fourth statement is the one to write to: a patient-held record positioned as a front-door feature matches VA's stated direction, and a record positioned as "a different thing" from the portal matches the answer that closed the question.

The session's telehealth half also described a new remote patient monitoring vendor interface, and VA's FY2026 PIA for the DrKumo remote patient monitoring and home telehealth system documents the system boundary and its VA Enterprise Cloud architecture. [CC26] Dates and organizational details from the session's slides are restricted-distribution and are not used here.

---

9. Money and funding routes

Confidence: High on the budget lines cited. Medium on the reading that no PHR line exists, which rests on the absence of one in the FY2027 justification narrative.

No line in the FY2027 Military Health System justification is labeled for a personal health record, and the DHMSM request of $491,174 thousand and the DMIX/EIDS request of $137,248 thousand fund the federal EHR and the secondary data broker respectively, with EIDS carrying the only stated completion date in the portfolio, the end of FY2027. [CC27] The executive order is explicit that it is subject to appropriations and creates no enforceable right. [CC14]

The Joint Incentive Fund is the joint seed-funding precedent, and its January 2026 guide excludes certain major health IT investments over $250,000 under the identified acquisition and program authority as well as systems with appropriated funding, requires sustainment planning, and requires completion within two years. [CC28] A bounded workflow demonstration, such as a transition-cohort export test, could merit an eligibility review; a platform could not, and nothing in this record establishes an award, a vehicle, or a committed budget for either.

The money reading is therefore that the requirement will be funded, if at all, as a modification inside vehicles that already exist: the federal EHR sustainment work for the portal and its APIs, DHA's cybersecurity and privacy support for the section 2.2 products, TAP delivery contracts for the export step, and VA's platform and mobile work for the retired function's replacement. The order's January 6 contract review is the one dated event where a modification to add a patient-facing requirement has executive cover, and the September 18 Capture Corner covers how a requirement enters a live vehicle and who prices it.

---

10. Calendar

Date	Event	Source
September 23, 2026	MHS GENESIS Patient Portal switched from DS Logon to myAuth (complete)	[CC9]
September 30, 2026	Legacy My HealtheVet site redirects to VA.gov; DS Logon sunset by end of FY2026	[CC19][CC29]
October 1, 2026	TEFCA IAS SOP v3 token provisions take effect	[CC12]
October 8, 2026	EO 14426 30-day requirement: immediate STR and health record sharing at discharge	[CC14]
January 1, 2027	IAS demographic double-check requirement	[CC12]
January 6, 2027	EO 14426 120-day contract review and modification deadline	[CC14]
March 7, 2027	EO 14426 180-day deadline: permanent sharing systems, digital tools, TAP update	[CC14]
April 1, 2027	SASC FY2027 sec. 721 briefing on a secure health-record access prototype for service members, if enacted	[CC39]
April 2027	Remote patient monitoring vendor interface forecast, restricted-slide sourced, not published	withheld
July 1, 2027	IAS specified FHIR support requirement	[CC12]
End of FY2027	EIDS data transition completion, per FY2027 justification	[CC27]

Dates calculated from the September 8 order are subject to agency interpretation.

---

11. The counterargument, stated fairly

Confidence: Medium. Analysis, not a document finding.

The strongest case against treating 6040.48 as a live requirement is that policy without a program, a budget line, or a congressional deadline does not move money, and an eight-year-old instruction with no implementing guidance is evidence that the Department decided, by inattention or by choice, that the portal satisfies the intent. On that reading, the capture move is to sell into the portal and its APIs and ignore the PHR framing. The answer is that the statute in section 715 still lists the lifetime PHR among FEHRM's purposes, the November 2020 and 2021 records show the departments treated it as a program, and the executive order has just reopened every relevant contract for review. [CC3][CC4][CC5][CC14] Dormant is a fair description. Retired is not supported.

The second case is that TEFCA and the CMS ecosystem will deliver the patient's record from the commercial side and the federal role reduces to a QHIN connection. That is the most likely path, and it is why section 7 treats IAS as the schedule. The answer is that a QHIN connection delivers retrieval, and the instruction's requirements on copying from the DoD Health Record, the twelve-month clock, the disposition schedule, and the terms-of-use notice are DoW's alone. [CC1] Nothing in the SOP writes them.

The third case is the public issue's argument in reverse: that VA should build the record and offer it universally. The counter is that VA just retired the closest thing it had, its current app requires enrollment, and a universal benefit for veterans who never use VHA has no eligibility basis in the current product pages. [CC6][CC7] A universal VA build is an advocacy position, and the record does not show it funded, approved, or scoped.

The fourth case is that the requirement is small and the money is small, and that BD attention belongs on the federal EHR, the interoperability contract review, and the identity reconciliation seam. Agreed on dollars. The PHR requirement matters because it is the patient-facing acceptance test for all three, and a firm that can demonstrate the export end to end has an answer the others cannot.

---

12. What to do in the next ninety days

Ask the compliance question in writing, at both addresses. The DASD for Health Services Policy and Oversight monitors compliance with 6040.48; the DHA Director owes the section 2.2 products. Ask whether implementing guidance exists, and if so where. If the answer is no, the products are a task without an owner and a firm can offer to draft them. [CC1]

Write the section 3.2 registration process as an unsolicited concept. Criteria, DiMe or DirectTrust reliance, endpoint authorization boundary, myAuth handoff, terms-of-use notice. Model it on the CMS app library requirements and cite the instruction section by section. [CC1][CC15]

Build the export test and put it in front of FEHRM before January 6. Two unaffiliated providers, one device feed, source and date and units preserved, gaps visible, export in DoW standard formats. Propose it as an acceptance test the contract review can attach to any interoperability requirement it adds. [CC1][CC14]

Write the technical approach to the IAS dates. October 1 tokens, January 1 demographics, July 1 FHIR. Treat Oracle Health Information Network as the federal QHIN until a FEHRM document says otherwise, and instrument match error rate, retrieval completeness, and provenance coverage from the first demonstration. [CC12][CC13]

Position the TAP export step. TAP support contracts are the vehicle for a records export at separation, and the order's March 7 update is the window. [CC14]

Track the VA migration question. Ask VA's digital product and Connected Care organizations, through the market research channel, whether a migration map for the retired self-entry function will be published and whether Share My Health Data supports export. [CC6][CC7]

Hold the summit statements at their weight. "My STR," the April 2027 interface date, and any presenter's reading of the instruction are spoken statements, not published positions; cite the instruction and the public pages in a capture document and attribute the rest to the session. [CC11]

Watch for a FEHRM statement on the 2021 initiative. If the next quarterly report or the summit summary says what became of the joint PHR initiative, that statement is the requirement's current owner or its formal closure, and either one changes every item above. [CC5][CC24]

---

Mary

Mission Meets Tech Premium

---

Next Capture Corner: scheduled for the next major federal health or defense-health opportunity in active capture. Subscribers will receive an alert when the next issue publishes.

Capture Corner is an independent intelligence product. It is not affiliated with the Defense Health Agency, the Department of War, the Department of Veterans Affairs, the FEHRM office, or any company named here, and it is not connected to any offeror's bid strategy. Premium subscription includes access to the standing intelligence sidebar plus the searchable archive.

---

Sources

[CC1] Department of Defense Instruction 6040.48, "Personal Health Records (PHR) and Patient-Controlled Data," October 23, 2018. Source for the policy statement, the section 2.2 responsibilities, and sections 3.1 through 3.10. https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/604048p.pdf?ver=2018-10-23-092823-430

[CC2] Defense Health Agency, DHA-PM 6025.02, "DoD Health Record Life Cycle Management," Volume 1. Source for the reference listing of DoDI 6040.48; no implementing DHA-PI located on health.mil as of September 22, 2026. https://health.mil/-/media/Files/MHS/Policy-Files/DHAPM602502DoDHealthRecordVol1.ashx

[CC3] Public Law 116-92, National Defense Authorization Act for Fiscal Year 2020, Section 715, December 20, 2019. https://www.congress.gov/116/plaws/publ92/PLAW-116publ92.pdf

[CC4] DVIDS, Defense Health Agency, Capt. Hae Kyung (Amy) Park, Ph.D., "DoD/VA Personal Health Record is key to increasing patient engagement and military readiness," November 23, 2020. https://www.dvidshub.net/news/printable/383686

[CC5] Federal Electronic Health Record Modernization office, presentation to the HITAC Interoperability Standards Workgroup, November 10, 2021, page 6. Source for the joint PHR initiative listing. https://healthit.gov/wp-content/uploads/2022/01/2021-11-10_DOD-VA_Interoperability_Modernization_Strategy_508.pdf

[CC6] Department of Veterans Affairs, "My HealtheVet on VA.gov: What to know." Source for the end of the self-entry PHR function. https://www.va.gov/resources/my-healthevet-on-vagov-what-to-know/

[CC7] Department of Veterans Affairs, VA Mobile, "Share My Health Data." Source for supported devices, enrollment requirement, sharing, and deletion limits. https://mobile.va.gov/app/share-my-health-data

[CC8] Veterans Health Administration, GovDelivery bulletin on the retirement of My VA Health, 2026. Source for the May 29 retirement and the Clipboard migration note. https://content.govdelivery.com/accounts/USVHA/bulletins/416770f

[CC9] TRICARE Newsroom, "MHS GENESIS Patient Portal transitioning to myAuth login Sept. 23," September 2026; Defense Health Agency, "TRICARE logins transitioning to myAuth in 2026," May 5, 2026. Source for the September 23 switch, DS Logon sunset by end of FY2026, and non-CAC login options. https://newsroom.tricare.mil/News/TRICARE-News/Article/4604059/mhs-genesis-patient-portal-transitioning-to-myauth-login-sept-23 and https://dha.mil/News/2026/05/05/17/10/TRICARE-logins-transitioning-to-myAuth-in-2026

[CC10] Defense Health Agency, "MHS GENESIS Patient Portal," and "Get your health results faster in 2026," January 14, 2026. Source for portal functions and immediate results from January 20, 2026. https://dha.mil/For-Beneficiaries/MHS-GENESIS and https://www.dha.mil/News/2026/01/14/18/23/Get-your-health-results-faster-in-2026

[CC11] FEHRM Annual Summit, telehealth and patient portal breakout session, September 15, 2026, attended by the author; recording and transcript in the author's possession. Speakers are not named.

[CC12] The Sequoia Project, RCE, "TEFCA SOP: Individual Access Services Exchange Purpose," version 3, effective August 3, 2026, section 4.9. https://rce.sequoiaproject.org/wp-content/uploads/2026/07/SOP-IAS-XP-v3_June2026_Clean_-5081.pdf

[CC13] Nextgov/FCW, "14 organizations are looking to join the federal electronic health record program," September 3, 2026. https://www.nextgov.com/digital-government/2026/09/14-organizations-are-looking-join-federal-electronic-health-record-program/415801/

[CC14] Executive Order 14426, "Accelerating Access to Veterans' Benefits and Employment Opportunities," September 8, 2026, 91 FR 58003. https://www.federalregister.gov/documents/2026/09/11/2026-18738/accelerating-access-to-veterans-benefits-and-employment-opportunities

[CC15] Centers for Medicare & Medicaid Services, "CMS Launches First Wave of Health Tech Ecosystem Tools," April 2026, and Medicare app library requirements. https://www.cms.gov/newsroom/press-releases/cms-launches-first-wave-healthtech-ecosystem-tools-fast-tracking-fully-digital-patient-centered and https://www.cms.gov/initiatives/health-technology-ecosystem/overview/submit-your-app/requirements-medicare-app-library

[CC16] TRICARE, "Medical Records." Source for portal download and the SF-180 route. https://www.tricare.mil/records

[CC17] Department of Veterans Affairs, "About reviewing medical records online." Source for the self-entered health information report. https://www.va.gov/resources/about-reviewing-medical-records-online/

[CC18] Department of Veterans Affairs, "FY26 My HealtheVet Platform Privacy Impact Assessment," June 2026, sections 1.2 and 2.2. Source for the self-entry description that conflicts with the current FAQ. https://department.va.gov/privacy/wp-content/uploads/sites/5/2026/06/FY26MHVPlatformPIA.pdf

[CC19] Department of Veterans Affairs, legacy My HealtheVet home page notice on the September 30 redirect. https://www.myhealthevet.va.gov/mhv-portal-web/web/myhealthevet/home

[CC20] Implementation study of VA's unsolicited patient-generated health data infrastructure, JMIR, June 6, 2025. https://pmc.ncbi.nlm.nih.gov/articles/PMC12165444/

[CC21] Department of Veterans Affairs, "FY25 Lighthouse FHIR API Privacy Impact Assessment," February 2025. https://department.va.gov/privacy/wp-content/uploads/sites/5/2025/02/FY25LighthouseFastHealthcareInteroperabilityResourcesAPIPIA.pdf

[CC22] The Sequoia Project, RCE information call slides, February 17, 2026. https://rce.sequoiaproject.org/wp-content/uploads/2026/01/2.17.26-RCE-Info-Call-FINAL.pdf

[CC23] American Hospital Association, comments on the TEFCA Individual Access Services procedure, April 24, 2026. https://www.aha.org/lettercomment/2026-04-24-aha-comments-tefca-individual-access-procedure

[CC24] Federal Electronic Health Record Modernization office, "FY2025 Q3 Quarterly Interoperability Report." https://www.fehrm.gov/images/fy2025_q3_quarterly_interoperability_report_final_508.pdf

[CC25] eHealth Exchange, "TEFCA FAQs." https://ehealthexchange.org/tefca-faqs/

[CC26] Department of Veterans Affairs, "FY26 Remote Patient Monitoring Home Telehealth (DrKumo) Privacy Impact Assessment," April 2026. https://department.va.gov/privacy/wp-content/uploads/sites/5/2026/04/FY26RemotePatientMonitoringHomeTelehealthDrKumoPIA.pdf

[CC27] Department of War, Office of the Under Secretary of War (Comptroller), "Military Health System, Fiscal Year 2027 Budget Estimates, Volume 1," April 2026. Source for the DHMSM and DMIX/EIDS lines and the EIDS completion date. https://comptroller.war.gov/Portals/45/Documents/defbudget/FY2027/budget_justification/pdfs/09_Military_Health_System/MHS_PB27_J-Book-Vol1-COMP_PSCP.pdf

[CC28] Department of Veterans Affairs and Department of War, "Joint Incentive Fund Guide," January 2026, pages 5, 6, 8, and 11 through 13. https://www.va.gov/VADODHEALTH/docs/JIF_Guide_2026.pdf

[CC29] Defense Health Agency, "TRICARE logins transitioning to myAuth in 2026," May 5, 2026. Source for DS Logon sunset by end of FY2026. https://dha.mil/News/2026/05/05/17/10/TRICARE-logins-transitioning-to-myAuth-in-2026

[CC30] U.S. Digital Service, "Simplifying Veteran-facing services through VA.gov." Source for the November 2018 relaunch and nearly 1.7 million logins a month. https://www.usds.gov/projects/va-dot-gov

[CC31] Department of Veterans Affairs, "Prepare for sign-in changes." Source for the two sign-in options and the March 5 and November 18, 2025 removals. https://www.va.gov/initiatives/prepare-for-vas-secure-sign-in-changes/

[CC32] Department of Veterans Affairs, "VA health and benefits app reaches 3 million downloads," June 6, 2025. Source for 3 million downloads and 1.4 million monthly active users. https://news.va.gov/press-room/va-health-and-benefits-app-reaches-3-million-downloads/

[CC33] TRICARE Newsroom, "TRICARE Online Patient Portal Decommissioning: Download Your Health Records Now," January 22, 2025. Source for the April 1, 2025 decommissioning, Download My Data formats and selection, non-transfer of legacy records, the in-person request route, gap records, and parental access rules. https://newsroom.tricare.mil/News/TRICARE-News/Article/4036730/tricare-online-patient-portal-decommissioning-download-your-health-records-now

[CC34] Captain James A. Lovell Federal Health Care Center, "Electronic Health Record Modernization (EHRM)," TRICARE beneficiary page. Source for TOL Secure Messaging under a separate vendor and non-transfer of messages. https://www.va.gov/lovell-federal-health-care-tricare/programs/electronic-health-record-modernization-ehrm/

[CC35] Nextgov/FCW, "DHA looks to contract a 'digital front door' to modernize its health system," April 19, 2024. https://www.nextgov.com/modernization/2024/04/dha-looks-contract-digital-front-door-modernize-its-health-system/395924/

[CC36] Defense Innovation Unit, "DIU, Defense Health Agency Announce First Awards for Digital Front Door Program," December 10, 2024. Source for the four awardees, 220-plus applicants, twelve-month pilot, venture sites, and 260,000 beneficiaries; the 9.5 million scale statement is from the awardees' releases. https://www.diu.mil/latest/diu-defense-health-agency-announce-first-awards-for-digital-front-door

[CC37] ExecutiveGov, "EY Books DHA Contract to Prototype Military Healthcare Tool," December 12, 2024, and Bluestaq, "Bluestaq Awarded First Healthcare Contract," December 10, 2024. Source for the EY and Bluestaq prototype scopes. https://executivegov.com/2024/12/military-healthcare-technology-upgrade/ and https://www.bluestaq.com/newsroom/2024/12/11/bluestaq-awarded-first-healthcare-contract

[CC38] Mission Meets Tech, "The MHS Triad," January 2026, and "The Trillion Dollar Pivot," May 1, 2026. Source for the report that the Digital Front Door prototypes would not move to production. No DHA or DIU closure notice located.

[CC39] Senate Armed Services Committee, report language accompanying the FY2027 NDAA, committee filing version, section 721. https://www.armed-services.senate.gov/imo/media/doc/fy27_ndaa_report_language_committee_filing_version.pdf

[CC40] Defense Health Agency, "Defense Health Agency Launches New Digital Health Care Tools at Five Military Hospitals," March 23, 2024. https://health.mil/News/Dvids-Articles/2024/03/23/news466862

[CC41] Defense Health Agency, "My Military Health: Improving Mental Health Access and Readiness," May 30, 2025. Source for the Eglin appointment and wait-time figures. https://dha.mil/News/2025/05/30/12/18/My-Military-Health-Improving-Mental-Health-Access-and-Readiness

[CC42] Defense Health Agency, dha.mil site structure as of August 21, 2026; /For-Beneficiaries/My-Military-Health returns Page Not Found and the program is absent from DHA Topics A-Z. https://www.dha.mil/DHA-Topics-A-Z

[CC43] Department of Veterans Affairs, "VA Health Connect Customer Relationship Management Privacy Impact Assessment," FY2025. Source for Health Connect as a virtual front door operating as a module on VA's already authorized platform. https://department.va.gov/privacy/wp-content/uploads/sites/5/2025/08/FY25VAHealthConnectCustomerRelationshipManagementPIAV2.pdf

[CC44] Salesforce, "VA Awards Salesforce $1.6B Contract to Transform Veteran Care and Services," July 24, 2026. Vendor announcement; source for the 40.6 million call figure. https://www.salesforce.com/news/press-releases/2026/07/24/missionforce-transforms-veteran-care/

[CC45] Centers for Medicare & Medicaid Services, "White House, Tech Leaders Commit to Create Patient-Centric Healthcare Ecosystem," July 30, 2025, and Fierce Healthcare, January 23, 2026, on the pledge reaching more than 600 organizations. https://www.cms.gov/newsroom/press-releases/white-house-tech-leaders-commit-create-patient-centric-healthcare-ecosystem and https://www.fiercehealthcare.com/ai-and-machine-learning/cms-trying-speed-tech-innovation-and-ai-patients-major-goalposts-set-2026

[CC46] Nextgov/FCW, "White House launches digital health initiative backed by leading tech firms," July 30, 2025. Source for Oracle Health and other named signatories. https://www.nextgov.com/digital-government/2025/07/white-house-launches-digital-health-initiative-backed-leading-tech-firms/407119/

[CC47] Ireland Army Health Clinic, "Records Request and Patient Portal Eligibility/Information," MHS GENESIS flyer, January 2024; corroborated by the Womack Army Medical Center eligibility flyer. Source for the 13-to-17 access rule, the parents' limited view, the DD Form 2870 process and 30 business days, and the six-month DS Logon grace period. https://ireland.tricare.mil/Portals/66/IRAHC%20MHS%20GENESIS%20RECORDS%20REQUEST-PATIENT%20PORTAL%20ELIGIBILITY.pdf

Sources verified as of September 24, 2026.