The Layers Under the Dollar.

Capture Corner is the premium BD intelligence companion to Mission Meets Tech. Public-record sourced. Independent analysis. Not a recommendation, not vendor advocacy, not capture material. Built for federal health BD, capture, and proposal leaders who need analytical depth, not headlines.

This issue is the companion to "The Government Bought Frontier AI for a Dollar," published this week. The public issue argues that the frontier model commoditized at the point of federal entry and the value moved down-stack. This brief maps the four lanes that move opened, with the live IDs, the incumbents to team with or displace, the set-aside signals, and the dated windows. Three of the four are buyable now. The fourth is a gate you run before you bid the other three.

---

1. The four lanes at a glance

None of these maps to a single NAICS or vehicle. Lanes 1 through 3 are pursuits. Lane 4 is a diligence gate that sits on every AI-bearing bid you write. Every ID below is confirmed against a primary source or flagged for re-check at the noted posting.

Lane	The opening	Buyer	Route	Set-aside signal
1. MHS GENESIS integrator unwind	Leidos LSI role ending; services layers competed full-and-open	DHA CD-DHMS / PEO DHMS	DHMSM IDIQ successor scopes, 541512	Services TBD; SDVOSB viable on discrete sustainment
2. VA AI governance and audit	OIG mandated risk mechanism, April 2027 target, no RFP yet	VA (VHA + OIT), TAC as buyer	Shape-the-requirement, 541512 / 541519 / 518210	Strong SDVOSB (Rise8 precedent)
3. PQC-to-HIPAA migration	Dated PQC mandates, zero HHS/OCR HIPAA guidance	Civilian health agencies	GSA HACS 54151HACS / Health IT 54151HEAL / VETS 2	8(a) STARS III and VETS 2 both live
4. Vendor use-policy diligence	Anthropic excluded from DoW classified clearance	Your own capture team	Teaming due-diligence checklist	n/a

---

2. Lane 1: The MHS GENESIS integrator unwind

Confidence: High (live SAM.gov notice plus trade confirmation).

This is the largest open window on the board, and its irony is that the biggest AI-era health opening has nothing to do with AI. DHA is ending Leidos's role as lead systems integrator for MHS GENESIS, a seat Leidos has held since 2015. It is moving the five platform providers to sole-source, firm-fixed-price, outcome-based contracts, pulling integration in-house, and competing the services layers full-and-open. The stated reason on the notice is to eliminate the legacy integrator's pass-through costs.

The platform seats are effectively spoken for and go other-than-full-and-open: Oracle Health for the core record, Philips for tele-critical care and remote monitoring, Amwell for virtual care, Henry Schein for dental, Solventum for clinical documentation and coding. The money you can actually chase is the layer that was buried under the Leidos prime for a decade: program-management support, product management, deployment, training, test, data analytics, cyber, and help desk.

IDs to watch. Sole-source notice opp 8eab9996b3eb4632ace81014f963c351, procurement HT003826CEXXX1. Incumbent DHMSM IDIQ N0003915D0044. The cloud and integration IDIQ HT0038-24-R-0004 (roughly $1.131B plus a $263.34M option) is the vehicle that shows how DHA has been buying the integration work. Leidos enterprise-level-services bridge task orders HT003825F0007, F0008, and F0012 (about $570M combined) show what the sustainment scope is worth in current dollars. NAICS 541512, PSC DA10.

Timing. Philips and Amwell transition by end of July 2026. Oracle by November 2026. Henry Schein and Solventum by July 2027. Services performance begins no later than July 2027, firm-fixed-price and outcome-based, with periods of performance capped at five years. The services J&A is the document to watch for; the window to shape it is now, before it posts.

Competitors and teaming. Accenture Federal Services is the continuity favorite. It was the original DHMSM partner and it is the VA EHRM integrator, which gives it a both-departments story no one else can match. Leidos is displaced as prime but still winning sole-source bridge tasks, so it stays in the picture. On the services layer, the VA analog went to an SDVOSB, which is the template: a discrete sustainment or deployment scope is where a small prime has room, with a GRC or MLOps specialist as a teammate.

First move. Pick one platform lane, map your past performance to it, and open the teaming conversation before the services J&A posts. Chasing all five dilutes the bid. The set-aside posture on the services layer is not yet fixed, so an SDVOSB with a clean sustainment past-performance record should position now, while the requirement is still being written.

---

3. Lane 2: The VA AI governance and audit market

Confidence: High on the OIG findings; Analytical on the market (no RFP posted).

The VA OIG created this market by documenting the gap. Its review found VHA running 367 AI use cases, including the department's own VA GPT and Microsoft 365 Copilot Chat in clinical settings, with no formal mechanism to identify, track, or resolve the risks those tools introduce. The final report issued three recommendations. The Under Secretary for Health concurred, with a target completion date of April 2027.

Attribute the recommendations to the June 2026 final report, not the January preliminary memo. The January memo carries the finding and zero recommendations. The three recommendations and the April 2027 date live in the final report. The recommendations, trade-summarized because verbatim text is not yet public, run to: review and define permissible clinical generative-AI use, evaluate applying high-impact safeguards to chat tools, and integrate AI-risk monitoring into patient-safety programs.

That is a written, dated requirement for audit logging, model monitoring, consent and notification workflows, and post-deployment reporting. It is greenfield. VA GPT is VA-built, out of the National AI Institute and OIT, so there is no incumbent governance wrapper to displace. Copilot is Microsoft. The production-services precedent is the SDVOSB that holds the ambient-scribe rollout through the VA Technology Acquisition Center on contract 36C10B26C0025, which tells you the buyer and the set-aside posture both favor a small prime.

Competitors and teaming. Rise8 holds the adjacent production work and knows the TAC. Microsoft owns the Copilot surface. Accenture Federal Services owns the EHRM platform underneath. For a small prime, the wedge is a governance-and-assurance offering built with a GRC or model-monitoring specialist of the Credo AI, Fiddler, or Arize class as a teammate. NAICS 541512, 541519, 541611, and 518210 all live here, with a strong SDVOSB signal.

First move. Build a one-page brief mapped to the three recommendations and the April 2027 date, and sell it as risk closure, not innovation. VA has to show the OIG it fixed the finding. That is a compliance purchase with a deadline, which is a very different sale from a capability pitch, and it rewards whoever frames it as the former first. No dedicated RFP has posted, so this is a shape-the-requirement window, not a proposal window.

---

4. Lane 3: The PQC-to-HIPAA gap

Confidence: High on the mandates; Analytical on the health-market timing (first-mover, no incumbent).

This is the highest-margin greenfield of the four because no health-IT competitor is yet framing it. The mandates are live and dated. EO 14412 (June 22, 2026) sets key establishment by the end of 2030, digital signatures by the end of 2031, a FAR rule within 180 days requiring covered contractors to meet NIST's post-quantum standards, and a NIST pilot no later than December 31, 2027. OMB M-26-15 (June 24, 2026) requires agency migration plans within roughly 120 days, so around October 2026. NIST finalized FIPS 203, 204, and 205 in August 2024. The government's civilian migration estimate is about $7.1 billion through 2035.

The health wedge is the gap on top of the mandate. There is no HHS or OCR guidance linking post-quantum cryptography to HIPAA, and the proposed HIPAA Security Rule that would make ePHI encryption mandatory missed its targeted May 2026 finalization and remains a proposal. A health system that rebuilds encryption to satisfy the coming HIPAA mandate without planning for the post-quantum deadline pays for the migration twice. The sales frame is migrate once, satisfy both, anchored on harvest-now-decrypt-later against records that stay sensitive for a veteran's lifetime.

How it buys. There is no standalone PQC BPA. The routes are GSA HACS SIN 54151HACS, IT Professional Services 54151S, Health IT 54151HEAL, plus 8(a) STARS III, Alliant 2, and VETS 2 for the SDVOSB path. NAICS 541512, 541519, 541690. The precedent award to watch is the DISA PQC work that went to SandboxAQ, teamed with Microsoft and Deloitte, which is the shape a large civilian-health migration will take.

Competitors. SandboxAQ leads on precedent, with AQtive Guard reaching FedRAMP Ready in December 2025 and the DISA award behind it. Microsoft and Deloitte team on the same. The large HACS and GWAC cyber integrators of the Booz Allen, SAIC, and Leidos class will chase the agency-plan work once the M-26-15 plans land in the fall.

First move. Publish the migrate-once framing before a competitor does, and offer a fixed-fee cryptographic inventory as the land-and-expand. The inventory is a small, defensible first sale that positions you for the migration engineering behind it. The clock that makes this urgent is the October 2026 agency-plan deadline, which is when buyers start needing outside help to write plans they do not yet have the staff to write.

---

5. Lane 4: Vendor use-policy diligence

Confidence: High (public clearance record).

Lane 4 is a gate rather than a pursuit: you run it before you name a model in any AI-bearing proposal, and the event that made it a gate is on the public record. When the Department of War cleared eight firms to run their AI on classified networks on May 1, 2026, Anthropic was excluded after declining to accept "any lawful use" terms. The instructive part is the inversion: Anthropic's civilian authorization, FedRAMP High plus Impact Level 5, exceeds OpenAI's FedRAMP Moderate. The vendor with the stronger civilian accreditation was the one kept off the classified network, because a vendor's own acceptable-use policy can be the disqualifier even when the authorization clears.

The matrix, as a three-item check before you write a model into a bid. Read authorization level, DoW Impact Level, and published acceptable-use terms together, because any one of the three can decide whether your solution can run where the contract requires.

Vendor	FedRAMP	DoW Impact Level	Note
Microsoft	High	IL6 (Azure OpenAI)	Cleared May 1
Google	High	IL6 (air-gapped GDC)	Cleared May 1
Oracle	High	IL6 / Top Secret	Cleared May 1
AWS	High	IL2-5 plus Secret/TS	Cleared May 1
OpenAI	Moderate	Cleared for classified	Lower civilian authorization than Anthropic
Anthropic (Claude for Gov)	High	IL5	Excluded from classified clearance; DoW supply-chain flag noted
NVIDIA / SpaceX / Reflection	n.a.	Cleared May 1	Authorization detail not confirmed

The rule. For a civilian VA, CMS, or HHS pursuit, Anthropic's High-plus-IL5 posture is fully usable and arguably the stronger civilian choice. For a DoW classified pursuit, it is currently disqualifying. Confirm the model can legally run where your contract requires before you write it into a proposal, not after. This is a public-record observation about authorization and terms, not a judgment on any vendor.

---

6. Timeline

Dates from SAM.gov notices, executive orders, OMB memoranda, and official forecasts. Forecast and transition dates amend frequently. Confirm on SAM.gov before acting.

Milestone	Window	Confidence
DHA platform transition: Philips, Amwell	End of July 2026	High (notice)
PQC agency migration plans due (OMB M-26-15)	~October 2026	High (memo)
DHA platform transition: Oracle	November 2026	High (notice)
NIST PQC pilot deadline (EO 14412)	December 31, 2027	High (EO)
DHA services layers begin	No later than July 2027	High (notice)
DHA platform transition: Henry Schein, Solventum	July 2027	High (notice)
VA AI governance recommendations close	April 2027	High (OIG)
PQC FAR rule for covered contractors proposed	Within 180 days of EO 14412	High (EO)
PQC key establishment deadline	December 31, 2030	High (EO)
PQC signatures deadline	December 31, 2031	High (EO)

---

7. What to do this week

1. If you want the DHA services work, pick one platform lane, map your past performance to it, and start teaming before the services J&A posts. The window to shape the requirement closes when it does. Set a SAM.gov watch on 8eab9996b3eb4632ace81014f963c351.
2. If you are an SDVOSB on the DHA side, the services set-aside posture is unfixed and the VA analog went SDVOSB. Position a discrete sustainment or deployment scope now, while the set-aside decision is still open.
3. If you are chasing the VA governance market, build the one-page brief against the three OIG recommendations and the April 2027 date, and sell it as risk closure. There is no RFP yet, so this is a shape-the-requirement move, and the buyer to reach is the Technology Acquisition Center.
4. If you want the PQC lane, publish the migrate-once framing before a competitor and lead with a fixed-fee cryptographic inventory. The October 2026 agency-plan deadline is your urgency anchor. Route through HACS 54151HACS or VETS 2, and study the SandboxAQ DISA award as the template.
5. If you write AI into proposals, add the three-item vendor gate to your teaming checklist: FedRAMP level, DoW Impact Level, and published acceptable-use terms. Confirm the model can run where the contract requires before you name it.
6. Everyone: re-confirm the DHA notice IDs and the cloud IDIQ figures at SAM.gov and FPDS before using any dollar amount in a deliverable. Several of the integration-vehicle figures are drawn from trade reporting and should be verified against the primary record.

---

Editorial discipline note

Capture Corner is built to be useful, not provocative. It does not name preferred vendors. It does not recommend awards. It does not characterize incumbent performance beyond what public records support. It does not reveal nonpublic information. It does not advocate for any specific offeror's win.

The incumbents and teammates named here come from public award records and company announcements. The government individuals listed on the DHA notice are not reproduced here; the notice ID points a capture lead to them directly. The DHA integration-vehicle dollar figures and the SandboxAQ precedent are drawn in part from trade reporting and are flagged for re-confirmation at SAM.gov and FPDS. The Anthropic exclusion and the FedRAMP and Impact Level entries are public-record facts about authorization and terms, cited as competitive context, not as a judgment on any vendor.

---

Mary

Mission Meets Tech Premium

---

Next Capture Corner: scheduled for the next major federal health or defense-health opportunity in active capture. Subscribers will receive an alert when the next issue publishes.

Capture Corner is an independent intelligence product. It is not affiliated with the Defense Health Agency, the Department of Veterans Affairs, HHS, GSA, the Department of War, or any contractor named here, and it is not connected to any offeror's bid strategy. Premium subscription includes access to the standing intelligence sidebar plus the searchable archive.

---

Sources

[CC1] DHA MHS GENESIS integrator unwind: Leidos lead-systems-integrator role (held since 2015) ending; five sole-source, firm-fixed-price, outcome-based platform awards (Oracle Health, Philips, Amwell, Henry Schein, Solventum) with transition dates July 2026 through July 2027; services layers competed full-and-open to eliminate legacy integrator pass-through costs (Washington Technology, June 2026; SAM.gov). Sole-source notice opp 8eab9996b3eb4632ace81014f963c351, procurement HT003826CEXXX1 (SAM.gov).

[CC2] DHMSM vehicles: incumbent IDIQ N0003915D0044; cloud and integration IDIQ HT0038-24-R-0004, ~$1.131B plus $263.34M option (DefenseScoop, Oct. 2024); Leidos enterprise-level-services bridge task orders HT003825F0007 / F0008 / F0012, ~$570M combined (orangeslices.ai; HigherGov). NAICS 541512, PSC DA10. Trade-sourced vehicle figures flagged for FPDS re-confirmation.

[CC3] MHS GENESIS baseline for scale: DHMSM award to Leidos $4.3B (2015), $5.5B after 2018 modification, lifecycle ~$9B–$10.5B (GAO-22-104521; DODIG-2016-094).

[CC4] VA OIG: preliminary advisory memorandum 26-00182-42 (Jan. 15, 2026), finding only, zero recommendations; final report 26-00182-140 (June 2026), three recommendations, USH concurred, April 2027 target completion (vaoig.gov; FedScoop). Recommendations trade-summarized; verbatim text not yet public.

[CC5] VA AI inventory: 367 AI use cases including VA GPT (VA-built, National AI Institute + OIT) and Microsoft 365 Copilot Chat (department.va.gov/ai). Production-services precedent: Rise8 (SDVOSB) ambient-scribe rollout, contract 36C10B26C0025, via VA Technology Acquisition Center (HigherGov). NAICS 541512 / 541519 / 541611 / 518210.

[CC6] PQC mandates: EO 14412 (June 22, 2026), key establishment by Dec. 31, 2030, signatures by Dec. 31, 2031, FAR rule within 180 days for covered contractors, NIST pilot by Dec. 31, 2027 (whitehouse.gov). OMB M-26-15 (June 24, 2026), agency plans within ~120 days (whitehouse.gov). NIST FIPS 203/204/205 finalized Aug. 13, 2024 (csrc.nist.gov). Civilian migration estimate ~$7.1B, 2025–2035 (White House July 2024 report).

[CC7] PQC-to-HIPAA gap: no HHS/OCR guidance links PQC to HIPAA as of mid-2026 (documented absence); HIPAA Security Rule NPRM (90 FR 898, Jan. 6, 2025) mandating ePHI encryption missed targeted May 2026 finalization, remains proposed.

[CC8] PQC buying routes: GSA HACS SIN 54151HACS, IT Professional Services 54151S, Health IT 54151HEAL; 8(a) STARS III, Alliant 2, VETS 2 (GSA PQC Buyer's Guide). NAICS 541512 / 541519 / 541690. DISA precedent award to SandboxAQ (with Microsoft, Deloitte); AQtive Guard FedRAMP Ready Dec. 2025.

[CC9] Vendor federal-use clearance: DoW cleared eight firms (AWS, Google, Microsoft, OpenAI, SpaceX, NVIDIA, Reflection, Oracle) for classified networks May 1, 2026; Anthropic excluded on "any lawful use" grounds (Breaking Defense; DefenseScoop). FedRAMP and Impact Level matrix: Microsoft High/IL6, Google High/IL6, Oracle High/IL6/TS, AWS High/IL2-5+Secret/TS, OpenAI Moderate, Anthropic Claude for Government High/IL5 with DoW supply-chain flag (Nextgov; OpenAI; Claude for Government FAQ).