Notice of Intent to Sole Source Development and Implementation of FHIR Infrastructure

The Centers for Disease Control and Prevention, through its Office of Acquisition Services within the Department of Health and Human Services, intends to award a sole-source firm fixed price purchase order to Vachi Info Tech Inc for the development and implementation of a Fast Healthcare Interoperability Resources (FHIR) infrastructure to support electronic health records data collection for the National Health Care Surveys. This effort aims to build a scalable FHIR-based system within the National Center for Health Statistics to enable testing of interoperability in hospital and ambulatory care settings, with three selected ambulatory provider groups from the National Health Care Surveys Registry tasked with sending test FHIR data. The acquisition falls under FAR 12.102 and is justified as sole source because Vachi Info Tech Inc is uniquely qualified to deliver the required highly specialized FHIR capabilities, with no other sources capable of meeting the technical and operational demands at the necessary quality level. The contract falls under NAICS code 541511 and is identified by solicitation number 98554, with responses due by June 30, 2026, before 10 a.m. EST, submitted via email to kpz5@cdc.gov. The contractor is responsible for designing, developing, and operating the HEHR Cloud on CDC’s Azure-based EDAV platform, managing the full lifecycle from system architecture to final data delivery to NCHS. Key deliverables include project documentation such as the Project Management Plan, System Security Plan, Privacy Impact Analysis, and Authority to Operate, along with technical assets like API specifications, SOPs, and all custom-developed source code, which must be delivered to a CDC-approved repository. Performance must adhere to CDC’s Enterprise Project Life Cycle standards, and the contractor will provide training on FHIR standards, endpoint operations, and Bulk Data API usage. The work may be performed remotely or on-site at the NCHS facility in Hyattsville, Maryland, with occasional on-site meeting requirements. Security and compliance obligations are stringent, requiring adherence to FISMA, NIST SP 800-53, OMB Circular A-130, HSPD-12, and HHS ICT accessibility standards, including WCAG 2.0 Level AA. The contractor must also implement secure TLS configurations, comply with Public Law 115-232 Section 889, and follow NIST SP 800-88 for media sanitization. Accessibility compliance is mandatory, requiring