Data Security & Privacy Compliance (HIPAA, TLS, U.S. Hosting)

The contract requires the implementation and maintenance of robust data security controls to ensure compliance with HIPAA and IHS security policies, including the mandatory use of TLS 1.2 or higher encryption for all data transmissions and hosting all systems and data exclusively within the United States. The contractor must establish and sustain these security measures to protect sensitive health information and demonstrate ongoing adherence to federal privacy and security standards. A comprehensive Security Plan detailing the architecture, protocols, and procedures in place must be made available upon request to validate compliance. This subcontract, issued by the Department of Health and Human Services under the Division of Acquisitions Policy, is classified under NAICS code 541611 for management consulting services and is tied to a performance location in Rockville. The solicitation was posted on May 13, 2026, with a response deadline of May 28, 2026, at 9:00 PM Eastern Time. There are no set-aside provisions specified, and while no point of contact is listed, the contract is accessible through the SAM.gov portal for interested parties seeking to submit a proposal.