Regulatory & Compliance Assurance (HIPAA, GDPR, Buy American Act)

The contract requires strict adherence to HIPAA, GDPR, and the Buy American Act to ensure software and operational practices meet federal and international regulatory standards for data privacy, security, and domestic sourcing. All systems and processes must include comprehensive documentation of data handling procedures, clear disclosure of any foreign-sourced components or content, and verified cybersecurity protocols that safeguard protected health information and personal data of individuals across jurisdictions. Compliance must be demonstrated through auditable records and operational controls that align with the requirements of each regulation, with particular emphasis on data localization, access controls, and supply chain transparency. The work is scoped as a subcontract under the Department of Veterans Affairs through the Network Contract Office 19, with performance expected in Salt Lake City, Utah, at the zip code 84148. The solicitation is classified under NAICS code 541611, indicating the service involves management, scientific, and technical consulting activities relating to compliance and regulatory assurance. Interested parties must submit responses by the deadline of July 21, 2026, at 8:00 PM ET, and the opportunity is open without a specific set-aside designation, allowing qualified contractors to compete under general subcontracting rules.