National Provider Directory (NPD) Data Sourcing, Aggregation, and Quality Assurance Services

The National Provider Directory (NPD) Data Sourcing, Aggregation, and Quality Assurance Services contract, solicited under number 75FCMC26R0063, is a five-year potential engagement with a base period of one year and four one-year option periods, running from September 25, 2026, through September 24, 2031. Operated by the Office of Acquisition and Grants Management within the Centers for Medicare & Medicaid Services (CMS), the contract aims to establish and maintain an accurate, comprehensive, and interoperable national directory of healthcare providers by sourcing, aggregating, validating, and correcting provider data from systems such as NPPES, PECOS, and state licensing boards. Work is to be performed using an agile delivery model with program increments, employing CMS tools including Confluence, Jira, and GitHub, and requires full compliance with Section 508 accessibility standards, FedRAMP authorization, and HIPAA Business Associate obligations. The scope includes delivering corrected data files, metadata-rich documentation, validation tools, dashboard configurations, and licensing agreements—all submitted electronically in accessible formats and governed by a detailed Quality Assurance Surveillance Plan (QASP) with strict performance metrics for timeliness, accuracy, and completeness. The solicitation mandates proposals be submitted via email only by 12:00 p.m. Eastern Time on August 12, 2026, in specific Microsoft Office or Adobe Acrobat formats, with strict page limits for the corporate experience narrative and requirements for transparent, formula-visible Excel pricing templates. Evaluation is non-price based, prioritizing corporate experience, proposed approach to the Performance Work Statement and QASP, and oral presentations, with award determined by best value rather than lowest price and with no numerical weighting assigned to factors. Key special requirements include mandatory background investigations for all personnel under HSPD-12 and FIPS 201, full compliance with federal data handling standards including NIST SP 800-88 for media sanitization, CMS-specific non-disclosure agreements, and annual scope and pricing reviews for option periods. The contract includes unique clauses such as HHSAR 352.239-71 for IT security, prohibitions on Kaspersky, ByteDance, and other covered entities, and requirements for whistleblower protections, small business subcontracting, accelerated payments to small business subcontractors, and fair labor standards including minimum wage enforcement under Executive Order 14026. Performance is to