Hi. Is ePHI from patients (in- or outpatient) of the VA considered CUI - and therefore is SP800-171 implementation compliance applicable to the commercial company that is performing the medical service for the VA ? In such a case might CMMC also be applicable, or is that strictly only relevant to DoD contracts. Thanks!