Contracting Hub
Vehicles, set-asides, procurement references, and how the work actually gets bought.
Start with the Basics
If you are new to federal acquisition, these five patterns explain how most health IT work gets bought.
Open Competition
Any qualified company can bid. The government publishes requirements on SAM.gov, evaluates proposals, and awards to the best value or lowest price. This is the default.
IDIQ
Indefinite Delivery/Indefinite Quantity. The government awards a contract vehicle to multiple companies, then issues task orders for specific work. You compete twice: once for the vehicle, again for each task order.
BPA
Blanket Purchase Agreement. A simplified ordering mechanism for recurring needs. Agencies set up BPAs under existing contracts (like GSA MAS) to buy faster without full competition each time.
GWAC
Government-Wide Acquisition Contract. IT-specific vehicles that any federal agency can use. SEWP, Alliant 3, and Polaris are the major ones now that the NITAAC GWACs stop taking new orders on October 29, 2026. High barrier to win, but they open doors everywhere.
Set-Asides
Contracts restricted to specific business categories: small business, SDVOSB, 8(a), WOSB, HUBZone. The government is required to meet small business contracting goals, so set-asides are common.
Vehicle Library
The contract vehicles that matter most for federal health IT. Click any card for detailed analysis.
CIO-SP3
Sunsetting (last new order Oct 29, 2026)NITAAC's primary IT GWAC for over a decade. New orders end October 29, 2026, and orders awarded on or after June 8, 2026 cannot run past December 31, 2028.
Originally awarded in 2012 with a $40B ceiling, CIO-SP3 was extended several times while CIO-SP4 stalled. On June 9, 2026 NITAAC published the end of the road: every NITAAC GWAC (CIO-SP3, CIO-SP3 Small Business, CIO-CS) sunsets on October 29, 2026, the last day to award new orders, and all NITAAC program functions cease December 31, 2028.
Why it matters: DHA, VA, and HHS agencies routed a large share of health IT task orders through CIO-SP3 for years. Every one of those buyers now has to land the recompete somewhere else, and the orders already placed keep running to their own end dates, no later than December 31, 2028 for anything awarded on or after June 8, 2026.
Current dynamics: There is no successor. If you hold a CIO-SP3 seat, the recompete path is Alliant 3, Polaris, or GSA MAS, and the buyer relationships move to the GSA program offices. Watch the last orders placed before October 29, 2026 for who is bridging what.
NAICS: 541512, 541511, 541519, 518210, 611420
CIO-SP4
Cancelled (Jan 30, 2026)Was the $50B successor to CIO-SP3. Years of protests killed it.
After years of bid protests, legal challenges, and multiple re-evaluations, NITAAC cancelled the solicitation on January 30, 2026 (Court of Federal Claims filing; SAM.gov Amendment 0017 on RFP 75N98121R00001).
What happened: The tiered evaluation approach drew sustained protests from firms excluded in early rounds. GAO sustained multiple protests. NITAAC attempted corrective actions but could not resolve the structural issues.
Impact: Firms that invested heavily face sunk costs with no vehicle. Agencies are moving task orders to GSA vehicles (Alliant 3, Polaris, MAS) and SEWP, because CIO-SP3 itself stops taking new orders on October 29, 2026.
What to watch: NITAAC's June 9, 2026 notice closed the question: no rebid. All NITAAC GWACs sunset October 29, 2026 and program functions end December 31, 2028, so GSA and NASA SEWP absorb the demand.
OASIS+
ActiveGSA's next-generation professional services vehicle. Unlimited ceiling. Covers IT consulting, PMO, advisory.
OASIS+ replaces OASIS and covers management consulting, scientific, engineering, logistics, and IT services.
Health IT relevance: Increasingly used for health IT consulting, program management, and advisory services at DHA and VA. Not an IT product vehicle, but where health IT strategy and implementation oversight work lands.
Small business: OASIS+ has dedicated small business domains. With the NITAAC GWACs sunsetting, more health IT-adjacent work may flow through OASIS+ small business pools.
Key differentiator: Unlimited ceiling and broad scope make OASIS+ the default for professional services. If the work is not pure IT product/infrastructure, it likely fits here.
T4NG2
ActiveVA's primary IT services IDIQ, awarded in 2026 as the follow-on to the $22.3B T4NG. Where most VA health IT task orders land.
T4NG2 covers IT infrastructure, cybersecurity, software development, cloud, and health IT modernization. The roster settled at 33 primes after the Court of Federal Claims denied the remaining protests in late March 2026.
Health IT relevance: This is where VA's biggest health IT task orders land -- EHR-adjacent work, clinical systems integration, data analytics, and telehealth infrastructure.
SDVOSB dynamics: VA has strong SDVOSB set-aside requirements. Many T4NG2 task orders are set aside for verified SDVOSBs or require significant SDVOSB subcontracting. JVs between large primes and SDVOSBs are common.
NAICS: 541512, 541511, 541519, 518210, 541513
MHS EITS
ActiveDHA's enterprise IT infrastructure contract. The plumbing beneath MHS GENESIS.
Covers network operations, end-user support, cybersecurity, data center management, and the IT backbone for all MHS clinical and administrative systems.
Health IT relevance: MHS EITS is the plumbing beneath MHS GENESIS. The EHR cannot function without the network, endpoint, and security infrastructure this contract provides.
Competitive landscape: Large defense IT primes dominate. Subcontracting opportunities exist in clinical device integration, cybersecurity monitoring, and network optimization at MTFs.
Key risk: EITS performance has been scrutinized when MHS GENESIS deployment issues trace back to infrastructure readiness. Expect continued oversight pressure.
MQS2-NG
Pre-solicitationDHA's vehicle for medical quality, patient safety, and clinical decision support IT.
Follow-on to DHA's MQS2 contract for clinical quality, patient safety IT systems, and clinical decision support. Currently in pre-solicitation.
Health IT relevance: Covers adverse event tracking, quality metrics dashboards, clinical decision support tools, and patient safety reporting.
Opportunity: Pre-solicitation status means requirements are still being shaped. Monitor RFI/Sources Sought notices on SAM.gov for DHACA releases.
What to watch: Set-aside decisions and whether DHA bundles this with other clinical support contracts or keeps it standalone.
VHA IHT 2.0
ActiveVA's vehicle for health technology services -- clinical systems, telehealth, mobile health.
Specifically scoped for health technology, not general IT. Task orders cover VistA integration, connected care platforms, clinical workflow tools, and health data exchange.
SDVOSB focus: Significant SDVOSB set-aside requirements, creating opportunities for verified small businesses with health technology expertise.
Strategic note: As VA navigates EHR modernization challenges, IHT 2.0 task orders for integration, interoperability, and connected care are likely to increase.
GSA MAS Health IT
ActiveGSA Schedule with Health IT Special Item Numbers. Entry-level vehicle for health IT products.
Covers EHR products, health data analytics, telehealth platforms, medical device integration, and clinical IT services.
How agencies use it: DHA and VA use GSA MAS for commercial health IT products, particularly when the requirement is well-defined and competitive pricing is available through GSA Advantage or eBuy.
Key SINs: 54151S (IT Professional Services), 54151HEAL (Health IT Services), 518210C (Cloud), OLM (Order-Level Materials)
Set-Aside Types
Federal agencies are required to meet small business contracting goals. These categories determine which contracts you are eligible for.
SDVOSB
Service-Disabled Veteran-Owned Small Business
Required for many VA and some DHA contracts. VA has specific SDVOSB verification through SBA. If you are an SDVOSB and not pursuing VA health IT work, you are leaving money on the table.
WOSB
Women-Owned Small Business
Eligible for set-asides in underrepresented industries. Certification through SBA. Health IT qualifies under several NAICS codes with WOSB set-aside eligibility.
8(a) Business Development
SBA Disadvantaged Small Business Program
SBA program for disadvantaged small businesses. Sole-source authority up to $4.5M for services. The 8(a) sole-source path is one of the fastest ways to win federal work.
HUBZone
Historically Underutilized Business Zones
Price evaluation preference and sole-source authority for firms in designated areas. Less common in health IT but worth checking if your principal office qualifies.
Key Acquisition Portals
The external sites you will actually use. Bookmark these.
Where all federal opportunities are posted
Past award data for competitive intelligence
DHA's contracting office -- your buyer for DoD health IT
Federal Procurement Data System
Track where federal dollars go
NIH IT Acquisition and Assessment Center
RFQ portal for GSA Schedule holders
Defense Acquisition University -- training and references
Related MMT Coverage
Track active contracts and read our analysis of vehicle changes.
Score Your Proposal Before You Submit
ProposalPulse uses AI to score federal proposals against evaluation criteria. Upload your deck, get a scorecard with specific fixes. First assessment free.
Try ProposalPulse