Subhead: The four-month procurement freeze is over. The FAR Part 19 rewrite that took effect in the middle of it is not getting the attention it warrants.
Friends,
October 1, 2025. No appropriations in place. Federal contracting stopped.
The shutdown ran 43 days, from October 1 through November 12, when President Trump signed P.L. 119-37 at 10:24 PM, enacting full-year appropriations for Agriculture, Military Construction/VA, and Legislative Branch, plus a continuing resolution for all other agencies through January 30. Under a continuing resolution, the constraints are absolute. Agencies cannot start new programs, cannot exceed prior-year spending rates, cannot issue new contract actions above prior-year levels. Contracting officers were furloughed or operating under severe restrictions. Pipeline that your team was positioned on going into October did not advance. It waited.
A four-day partial shutdown followed January 31 through February 3. Homeland Security funding lapsed February 14 and that shutdown continues today.
Every other agency has full-year FY2026 funding through September 30, 2026.
The pipeline is open. Q3 runs April through June. Q4 runs July through September. In any normal federal contracting year, Q3 surges and Q4 peaks dramatically. FY2026 gives agencies six months to obligate a full year of spending. The solicitations deferred through the shutdown are releasing now. September 30 is the hard deadline.
The surge is real.
I've been sitting on the second part of this issue since October. The shutdown buried it. Most of the BD and capture teams I talk to have not seen it yet. You need to know it before the Q3 window closes.
Why the compression is worse than the shutdown math explains
On February 26, 2025, Executive Order 14222 directed every agency head to review all existing contracts and grants within 30 days and terminate or modify where appropriate. The DOGE contract review process installed dedicated team leads at every civilian agency. Contracting officers who had been awarding contracts were reassigned to process termination reviews, cost-benefit analyses, and payment justifications. The routine work stopped. Option year exercises. Modification processing. New award preparation. All of it waited while the review ran.
Small businesses reported two-month delays on option year exercises during the peak DOGE review period. The CO workload problem is real and documented independent of any dispute about DOGE's savings claims.
DOGE's public ledger claimed $65 billion in savings from contract terminations. GovSpend's review of FPDS data through August 2025 found $2.51 billion in actual deobligations. Politico's independent analysis of approximately 10,100 traceable terminations found $1.4 billion in recovered funds.
The methodology: DOGE counted ceiling values. Not obligated amounts. Not recovered dollars. The maximum possible payout over the theoretical life of a contract, most of which would never have been fully exercised.
Sixty-five billion claimed. One point four billion verified. Procurement experts across the political spectrum have called this a structural error. It is not a rounding difference.
For the federal health IT community: military health system contracts were in early stages of DOGE review through early 2026 and were largely insulated from the first termination wave. Civilian health programs at HHS and NIH saw the highest termination counts. The DoD review wave is expected to follow. When it does, the review criteria that drove civilian terminations (low utilization, administrative overlap, programs without clear lethality or readiness rationale) will be applied to DHA and MHS contracts by people who do not know the difference between a CDMRP research program and a help desk vehicle. Firms with active DHA programs should be building the readiness and mission impact case for every contract now, not when a DOGE team lead asks for it.
Teams with DHS pipeline are operating in the most uncertain environment. The DHS-specific shutdown continues. Congressional-level procurement integrity investigations are active. New Secretary Mullin revoked the Noem-era policy requiring headquarters sign-off on contracts above $100,000. Document everything.
The CO workforce that managed the shutdown, ran DOGE reviews, processed a continuing resolution, and is now executing a compressed Q3/Q4 obligation surge is the same workforce your BD team is trying to get in front of. They are behind. They are moving fast. They are awarding to teams they know.
What changed four days before the shutdown started
On September 26, 2025, four days before the government shut down, the FAR Council released its rewrite of FAR Part 19, the regulation that has governed small business access to federal contracting for decades. Budget negotiations consumed every GovCon conversation that week. The continuing resolution clock was running. The Federal Register published it on a Friday. Four days later the government closed. The deviation took effect November 3, 2025, while the shutdown was still running. Four months after that it reopened. The Rule of Two was already gone.
One change in that rewrite affects every firm planning to pursue the surge through task orders under GSA Schedules, OASIS+, SEWP, or any other multi-award vehicle.
The Rule of Two no longer applies to those orders.
What the Rule of Two was
For decades, the Rule of Two required a contracting officer to set aside an acquisition for small businesses when there was a reasonable expectation of competitive offers from at least two responsible small businesses at a fair market price. If two qualified small businesses could do the work, the agency had to give them the shot. It was the central competitive protection mechanism in federal small business contracting.
The FAR Part 19 rewrite preserved the Rule of Two for new standalone contract awards. It was not eliminated. For contracts above the Simplified Acquisition Threshold, the mandatory set-aside requirement remains, and the threshold for mandatory application was actually expanded.
For task and delivery orders under multiple-award contracts, the protection is gone.
In federal health IT, that protection has been the structural foundation of small business BD strategy for the better part of two decades. OASIS+ replaced OASIS as the primary professional services vehicle in 2024 with a small business pool and an other-than-small pool. Firms built their captures around qualifying for the small business pool precisely because the Rule of Two gave contracting officers a mandatory reason to keep task orders there. SEWP V, the primary commercial IT vehicle for health IT hardware and SaaS, has operated with a small business set-aside structure that firms priced into their multi-year growth models. SEWP V's ordering period runs through April 2026; SEWP VI, the successor vehicle, is currently being competed. The strategy was rational. The regulatory foundation it rested on changed last fall.
Contracting officers now have discretion, not an obligation, to set aside task orders for small businesses under GSA Schedules, OASIS+, SEWP, and any other multi-award IDIQ vehicle. If they choose not to set aside an order, that decision cannot be challenged at GAO. The FAR Part 19 rewrite made the non-set-aside decision expressly non-protestable.
The mandatory protection, on the majority of federal contract spending, is now optional. The optionality is unreviewable.
Where the money is, and what unreviewable means in practice
Over $420 billion in federal contract dollars flows through multi-award vehicles annually. GSA Schedules. OASIS+. SEWP. GWACs. IDIQs of every description. These are the vehicles where most federal health IT work lives: where DHA deploys task orders for IT services, where VA runs software and analytics competitions, where HHS procures clinical data infrastructure. That is the center of federal contracting.
Before the Part 19 rewrite, a small business passed over for a task order set-aside had a path to GAO. The bid protest system, whatever its limitations, provided a documented mechanism to challenge the contracting officer's determination. The effectiveness rate at GAO held at 52% in FY2025: more than half of firms that protested received some form of relief, either a sustained decision or voluntary agency corrective action. Corrective action does not guarantee re-award. It does force reevaluation.
That mechanism no longer exists for IDIQ task order set-aside decisions. A contracting officer can review the pool on OASIS+, determine discretionarily that the acquisition will not be set aside for small businesses, award to a large business, and that decision cannot be reviewed at GAO. The firm that believes it was wrongly excluded has no federal protest forum. The change is structural, not procedural. The protest window that existed for decades closed on November 3, 2025.
The firms that recognized this in October have had six months to adjust their positioning. The firms finding out now have the Q3 window. It is a real window. It is not a long one.
What else changed in Part 19
Order-level rerepresentation is gone. Under prior rules, small businesses certified their size at the task order level, creating a regular verification point. Under the rewrite, size is determined at the contract level only, locked in until specific contract events: novations, mergers, option exercises. An incumbent that has grown past the small business size standard can continue winning task orders under an IDIQ it won years earlier. The verification mechanism that would have flagged this no longer exists at the order level.
Incumbents benefit. Challengers do not.
The socioeconomic priority order is also eliminated. Previously, contracting officers were required to first consider 8(a) firms, service-disabled veteran-owned small businesses, and HUBZone firms before considering general small business set-asides. That mandatory sequence gave veteran-owned and economically disadvantaged firms a structural first-look advantage. It is gone. COs now apply discretion across all socioeconomic categories without a mandatory priority ordering.
One change works in the other direction. Follow-on 8(a) contracts may now transition into other socioeconomic set-asides (HUBZone, SDVOSB, WOSB) without SBA approval, creating new pathways for firms in those categories when an 8(a) program ends.
The American Small Business Chamber of Commerce modeled the full-implementation scenario and estimated that small business participation in federal contracting could fall from 26% to 16% of total spend, a potential $72 billion annual reduction in small business contract dollars. That is one advocacy organization's projection, not an established outcome. The directional logic is consistent with the mechanics of the change.
The federal health IT pipeline: what is active in the surge window
The majority of federal health IT contracting executes through multi-award vehicles. OASIS+ is the primary professional services vehicle for DHA and VA program support. SEWP V covers commercial IT. The consolidated IT Schedule carries a significant share of health IT software spend. The Part 19 rewrite affects all of them. The firms competing for the opportunities below carry no guarantee that the task orders under these vehicles will be set aside for small businesses. That is a new condition. Most of their prior capture assumptions are not.
DHA posted the HCDS Health IT Deployment IDIQ solicitation on April 7, with proposals due April 15 at noon ET. The one-year base plus four option year vehicle covers deployment, training, change management, and sustainment for DHMS platforms including MHS GENESIS and operational medicine environments. Designated government support contractors on this procurement include Boston Consulting Group, Swing Tide, Andrew Morgan Consulting, Greenlight Analytic, and Monterey Consultants. Offerors must identify and protect proprietary information accordingly. The $300 million vehicle is a multi-award IDIQ. Set-aside determinations on task orders under it are discretionary and non-protestable.
The MHS GENESIS recompete, formally the HCDS Electronic Health Record Follow-On, is the largest federal health IT procurement of FY2026 by known program scope and strategic significance at time of publication. The contract will govern MHS electronic health records for the next decade. Industry Day was March 31 in Arlington. SAM.gov lists the anticipated solicitation date as August 30, 2026, with award targeted Q4 FY2026. The planned scope covers EHR solutions, services, and program office support, with a bridge period for continuity with incumbent Oracle Health. Organizational Conflict of Interest provisions are actively being addressed in the contract strategy. Any firm with advisory or analytical roles in the current GENESIS program should be examining its OCI exposure before the solicitation drops, not after.
The VA's Federal EHR program restarted go-lives on April 11, deploying at 13 facilities in 2026 across Michigan, Ohio, Kentucky, Indiana, and Alaska. Accenture Federal Services won a 4.5-year EHRM program management contract in February 2026, serving as integration backbone and change management lead. Subcontract opportunities under the Accenture EHRM vehicle represent near-term pipeline for firms that cannot reach the prime level. The VA's FY2027 budget request signals the next wave: $4.2 billion for continued Oracle Health Federal EHR implementation, $47.8 million for Decision Intelligence and Automation (a 10.9% increase driven by AI infrastructure), and $130 million for AI adoption in VBA benefits processing. The combined $177.8 million AI investment, if enacted, is the next major vehicle competition. Firms inside the EHRM program now carry incumbency advantages into FY2027 AI competitions.
DHA's Data Governance solicitation, HT001126RE011, is a Women-Owned Small Business set-aside with an active RFP. At the contract level, the Rule of Two still applies. This is one of the few procurements in the current DHA cycle where the mandatory small business trigger remains in force.
The DHA expiring task wave is where the highest-probability pipeline sits for small and mid-tier firms. Two dozen task orders are expected to recompete in 2026. Five with the largest exposure: Systems Design, Integration and Sustainment at $172.3 million; DHA DHIT Engineering Support at $129.6 million; TBI Center of Excellence Research Support at $70.8 million; DMIX/DISS Interoperability Support Services at $64.4 million; and Senior Scientific Support Services at $22.1 million. These are standalone contract awards. The mandatory Rule of Two applies to all of them. For firms that lost the IDIQ task order set-aside protection they had been counting on, the expiring task recompetes are the most defensible pipeline in the current cycle. Monitor SAM.gov for solicitation releases through Q3.
Five adjustments before September 30
The FAR Part 10 rewrite compounds the Part 19 problem. The nine specific market research methods that previously required agencies to conduct structured industry outreach (industry days, RFIs, catalog reviews, database searches, and five others) have all been moved to a nonbinding guide. The regulatory machinery that required agencies to come to you is gone. You have to go to them. Every time. Before the solicitation. Before the Sources Sought. Before the market research notice. The window where showing up early makes a difference is the window you are in right now.
1. Audit your IDIQ pipeline against the new rules. For every task order your BD team is tracking under a multi-award vehicle, assume the set-aside is discretionary. Know which contracting officers on those vehicles have historically set aside orders and which have not. That historical pattern is now more predictive than the regulatory requirement ever was.
2. Respond to every relevant Sources Sought. If only one qualified small business responds to a Sources Sought notice, the contracting officer has justification to move the acquisition out of small business set-aside entirely. Non-response is not a neutral act. It is the mechanism by which you lose the set-aside before the solicitation ever publishes. The Sources Sought response is now one of the few pre-solicitation tools that creates a documented record of small business capacity in a specific domain. Use it.
3. Know the protest record. Then position accordingly.
GAO's FY2025 Annual Bid Protest Report: 1,688 cases filed, down 6%. Fifty-three sustains, the lowest count in over two decades. The 52% effectiveness rate holds: more than half of protesters received some form of relief, either a sustained decision or voluntary corrective action. Maintain detailed submission records. Evaluate protest viability whenever a proposal is rejected in circumstances that appear procedurally questionable.
The three most common grounds for sustained decisions were unreasonable technical evaluation, unreasonable cost or price evaluation, and, appearing as a top-three sustained ground for the first time in recent history, unreasonable rejection of proposals. My read: the third category is the compressed environment's direct signature. Contracting officers under DOGE workload and CR-era pressure are rejecting technically responsive proposals on procedural grounds that do not survive GAO scrutiny.
Unreasonable technical evaluation is still the leading sustained ground, as it has been for years. Evaluators apply unstated criteria, and the criteria applied most consistently favor companies whose capabilities are understood before scoring begins. The company that has briefed the program officer, responded to the Sources Sought, and submitted a white paper does not need the evaluator to fill in gaps. The company that shows up at draft RFP does. April through June is the window to become the company that does not need the gap filled.
4. Map OTA eligibility for software-defined health IT platforms. Defense Secretary Hegseth's March 2025 memo directed all DoD components to adopt the Software Acquisition Pathway as the preferred method for software development and to use Commercial Solutions Openings and Other Transactions as the default under that pathway. For health IT platforms that qualify (clinical decision support, interoperability middleware, data analytics) the CSO/OTA pathway into DHA programs is legitimate and active. The broader "general preference for OTA" was stripped from the final policy, per AEI analyst Bill Greenwalt's comparison of the draft and final memo. Map which specific programs are operating under the Software Acquisition Pathway before assuming OTA is available. OTA consortium membership at NSTXL, RCTC, AFWERX, or DIU is the access mechanism, not standard BD outreach.
5. Position now, not at draft RFP. The GENESIS recompete solicitation is anticipated August 30. The firms without active DHA acquisition team engagement face a structural disadvantage when technical scoring begins. Unreasonable technical evaluation is the top sustained protest ground in the GAO data. It costs money to address after award. It costs a relationship to address before. The positioning window is now.
The firm this changes
Somewhere in Northern Virginia or San Antonio or Colorado Springs, there is a service-disabled veteran running a small health IT firm. Former Army medic. Former Navy corpsman. Built the company on twenty years of understanding what breaks in military medicine.
The firm is on OASIS+. It has past performance. It has delivered on set-aside task orders and performed. The three-year business plan runs through the Q3/Q4 IDIQ pipeline.
That firm did not make a mistake. The rewrite published September 26, 2025. The government shut down four days later. The deviation took effect November 3, while the shutdown was still running. The DOGE review cycle was already running. The Rule of Two no longer protects access to the vehicle they are on. The priority ordering that gave their SDVOSB status a first-look advantage is gone. The size certification that would have flagged a graduated competitor no longer happens at the order level. The bid protest path that used to exist if a CO passed them over on a task order set-aside decision is closed.
The surge is real. The money is there. The window closes September 30.
The rules they built their pipeline around are not what they were.
Let's roll.
— Mary
Mission Meets Tech
The views expressed in this newsletter are my own and do not represent the official position of any organization. This content is for informational purposes only.
Sources
Sources verified as of April 14, 2026. Key claims fact-checked against primary federal sources including P.L. 119-37, Executive Order 14222, GSA class deviation RFO-2025-19, acquisition.gov, and the GAO FY2025 Annual Bid Protest Report. Shutdown dates and fiscal policy timelines verified against CRFB primary source documentation. DOGE deobligation figures sourced from GovSpend FPDS analysis through August 2025 and Politico's independent analysis of approximately 10,100 traceable contract terminations; DOGE's $65 billion claimed figure is drawn from its public ledger. FAR Part 19 analysis corroborated across Holland & Knight, PilieroMazza, and JD Supra client advisories. The $420 billion multi-award vehicle figure is drawn from JD Supra FAR Part 19 analysis. Pipeline data sourced from SAM.gov, GovConWire, GovTribe, SweetSpot, and OrangeSlices.ai SAM.gov analysis. VA EHRM and budget figures from VA digital.va.gov press releases, HITConsultant, NextGov, and the VA FY2027 budget request. GAO protest grounds analysis corroborated by Crowell & Moring FY2025 Annual Report analysis. Hegseth software acquisition memo sourced from DoD.gov and Wiley Rein analysis; the finding that "general preference for OTA" was removed from the final policy is attributed to Bill Greenwalt, AEI, as reported in Breaking Defense. The ASBCC projection of small business participation falling from 26% to 16% is a single-source advocacy organization estimate and is labeled as such in the body. The assessment of MHS GENESIS as the largest federal health IT procurement of FY2026 is an analytical judgment based on known program scope at time of publication, not a confirmed contract ceiling value.
