Sources Sought: ONC Certified Health IT Product List (CHPL) Development, Maintenance, and Improvement

The Office of the National Coordinator for Health Information Technology under the Department of Health and Human Services is conducting market research through a small business sources sought notice to identify qualified small business vendors capable of supporting the continued maintenance, development, and improvement of the ONC Certified Health IT Product List (CHPL). This effort is critical to advancing health information interoperability, ensuring electronic health record certification aligns with federal standards, and enabling providers to meet meaningful use requirements under the HITECH Act of 2009. The contract, if awarded, will be a firm-fixed-price, severable services agreement with a base period of twelve months and two optional twelve-month extension periods, all governed by FAR Clause 52.217-9. The procurement is structured as a total small business set-aside under NAICS code 541512, with a size standard of $37.0 million, and seeks input from 8(a), SDVOSB, HUBZone, SDB, VOSB, and WOSB entities. All respondents must validate their small business status and provide detailed business information including DUNS number, contact details, and teaming or subcontractor certifications if applicable. The contractor will be responsible for delivering operational support including the development of a comprehensive work plan, weekly and monthly technical status reports, CHPL website and template updates, validation of regulatory compliance with evolving rulemaking, and implementation of usability enhancements to improve data access. Deliverables must conform to strict quality standards, being accurate, clear, concise, and presented in editable electronic and hard copy formats. All systems and services must comply with HHS digital accessibility standards, requiring submission of a fully completed Accessibility Conformance Report, and meet cybersecurity mandates such as FISMA, NIST SP 800-53, FedRAMP-compliant Authority to Operate, and the requirements of Public Law 115-232 for supply chain risk management. Encryption of PII and PHI must use FIPS 140-validated solutions, and public-facing interfaces must implement HTTPS with TLS and HSTS. Contractors must submit staff rosters, ensure HSPD-12/FIPS 201 compliance for personnel access, and adhere to strict submission guidelines: responses are limited to five pages in Times New Roman 12-point font, must be emailed by June 11, 2026, and must not include proprietary or classified information. This notice is purely for market research and does not constitute