JOFOC_PROTECT_Huron.pdf

[Last updated 8/17/2026.]

Justification for Other than Full and Open Competition (JOFOC) FAR 12.102(b)

Justification for Other than Full and Open Competition (JOFOC) FAR 12.102(b)12.201-112.201-212.001(c)FAR 12.102(b) & 12.201-1

1. Acquisition Title: Continued Software Subscription, Maintenance, and Technical Support for the NIH PROTECT eIRB Environment and Custom REST API

Division: Office of Human Subjects Research Protections (OHSRP), Office of Intramural Research (OIR), Office of the Director (OD), NIH

Contracting Activity: HHS/ASFR/OMAS

Author: Nicole Grant, Acting Director, OHSRP

Basis for approval: Individual

2. Nature and/or Description of the Action being Approved:

The Office of Human Subjects Research Protections (OHSRP) requests approval for a firm-fixed-price follow-on contract with Huron Consulting Services LLC for continued software subscription, maintenance, and technical support services for the existing NIH PROTECT electronic Institutional Review Board (eIRB) environment and custom REST API. The Government projects award in September 2026 for a 12-month period of performance from September 30, 2026 through September 29, 2027, using fiscal year 2026 funds.

The proposed acquisition will provide continued subscription and support for the existing proprietary PROTECT environment, including Huron IRB, Huron Radiation Safety Committee, Huron Safety for Scientific Review Committee, Huron Portal for Ancillaries, and the Huron REST API used to integrate PROTECT with internal NIH systems. The acquisition also includes product-level technical support, software updates and upgrades, critical system-outage support, and the enhanced response and remediation services required to meet NIH timelines for identified software security vulnerabilities.

This action is not an acquisition to select or implement a new eIRB platform. NIH currently operates the proprietary Huron PROTECT environment, and the purpose of this acquisition is to obtain the continued subscription, software maintenance, updates and upgrades, and product-level support required to maintain that existing operational environment.

is therefore peculiar to the existing Huron product in the sense that NIH is acquiring the subscription, updates, upgrades, maintenance, and product-level support for software that NIH already operates. This is not a brand-name preference in an acquisition to select a new eIRB product. NIH is not specifying Huron in lieu of considering functionally equivalent eIRB products for a new implementation; rather, the Government is acquiring the proprietary product-level services necessary to continue operating its existing PROTECT environment and custom Huron REST API.

4. Statutory Authority Cited and Rationale:

FAR 12.201-1This sole source acquisition is being conducted under FAR 12.201-1 simplified procedures

The contracting officer has determined that only one source is reasonably available based on the following rationale:

Huron Consulting Services LLC is the developer and proprietary source of the PROTECT software currently deployed at NIH. The existing NIH environment consists of the Huron Research Suite IRB, integrated Huron safety and ancillary modules, and a custom Huron REST API developed to interface with internal NIH IT systems. As the developer of the system, Huron possesses the product-specific expertise and access necessary to provide the proprietary software subscription, product updates and upgrades, maintenance, and product-level technical support required under this acquisition.

In FY25, this requirement went through a competitive procurement, and Huron Consulting Services LLC was selected as the winner. Offerors were evaluated on: experience supporting PROTECT; availability of in-house personnel with system expertise; demonstrated access and ability to deliver software upgrades; demonstrated ability to respond to security vulnerabilities within required timeframes; and cost. The FY25 technical evaluation found that Huron, as system developer, had the demonstrated expertise, access, and responsiveness needed to provide upgrades, support, and timely vulnerability remediation. Accordingly, the prior competition confirmed that Huron is the source with demonstrated capability to perform the complete requirement.

Huron's unique qualification derives from its role as developer and proprietary source of the existing PROTECT system and its demonstrated product-specific expertise and access to deliver the subscription, upgrades, maintenance, vulnerability-response, and support services being acquired. This sole-source basis reflects the proprietary nature of the software and Huron's demonstrated capability.

5. Special Considerations for Certain Contract Extensions or Bridge Contracts:

Not applicable. Not a contract extension/bridge contract.

6. Actions to Increase Competition:

a. FAR subpart 5.1 FAR 12.202 FAR 5.201(b) In accordance with FAR subpart 5.1, a notice of Intent was posted on SAM.Gov on September 23, 2026 – RFQ 7571TE26Q00388 with a response date of September 24, 2026 by 4:00pm and stated all responsible sources may submit a capability statement, which will be considered by the Contracting Officer Representative (COR).

b. Responses Were received:

As a result of this 7571TE26Q00388 notice of intent, two (2) capability statements were received. The COR reviewed the capability statements and provided an assessment of each statement, which is saved to Tab B of the contract file. Neither Big Data Consultants (BDC) nor Care On Demand Technologies Enterprise (CODTE) demonstrated capability to meet the PROTECT SOW: BDC's capability statement showed only general data/cloud experience with no Huron-specific access, authorization, or relevant past performance, while CODTE candidly admitted it lacks the proprietary rights to deliver the core Huron services and instead proposed to act as a management intermediary contingent on an unexecuted authorization agreement with Huron. In both cases, the vendors either failed to show any pathway to the proprietary product-level services NIH requires (BDC) or explicitly confirmed that pathway doesn't yet exist (CODTE) — so neither is a capable source for the requirement as currently defined.

c. Sources Expressing Interest:

Big Data Consultants Inc. (BDC): BDC's capability statement describes general data engineering, analytics, cloud/AI, and application-development experience but shows no experience with Huron PROTECT or a comparable eIRB platform, and no demonstrated access, authorization, or subcontractor relationship through which it could obtain the proprietary Huron software, updates, REST API support, or vulnerability remediation the SOW requires. Its only federal past performance — subcontract work on CDC's NEDSS system — is described too generally to establish relevant experience, and it offers no technical approach explaining how it would perform the work, so BDC does not demonstrate capability to meet the PROTECT requirement.

Care On Demand Technologies Enterprise, LLC (CODTE): CODTE openly acknowledges it lacks the proprietary rights to provide the Huron subscription, updates, API support, or vulnerability remediation at the core of the SOW, proposing instead to act as a prime-contract intermediary handling coordination, administration, and oversight while Huron or another authorized source performs the actual proprietary work. This arrangement is explicitly contingent on a commercial authorization agreement with Huron that CODTE confirms has not been executed, so CODTE has not demonstrated an existing pathway to deliver the proprietary services NIH requires and is not a capable source under the SOW as written.

d. Actions to Foster Competition for Future, Similar Requirements:

OHSRP tested the market through an open competition in FY25 and, for this action, conducted additional market research reviewing current capability statements from Big Data Consultants Inc. and Care On Demand Technologies Enterprise, LLC. Neither vendor demonstrated existing access to, or authorization for, the proprietary Huron product-level services required under this acquisition. Before any future acquisition of similar services, OHSRP will continue to monitor the marketplace to determine whether licensing arrangements, authorized reseller relationships, or other conditions have changed sufficiently to permit competition. The current restriction results from the proprietary nature of the existing PROTECT software and the need for product-level subscription, updates, upgrades, maintenance, and support. If NIH determines in the future to replace the existing eIRB platform, that would be planned as a separate system-replacement acquisition, requiring consideration of data migration, system configuration and validation, user retraining, integrations, and continuity of operations.

7. Market Research:

OHSRP conducted market research to assess the availability of sources capable of meeting the requirement for continued software subscription, maintenance, and technical support of the existing PROTECT eIRB system, including review of the operational requirement and prior acquisition history, consultation with program and technical personnel, the FY25 competitive procurement, publication of a notice of intent to award sole source, and current Huron technical and pricing information.

The commercial marketplace includes firms offering eIRB, research-administration, IT, and software-support services generally. However, this requirement is specific to continued subscription and product-level support of the existing proprietary PROTECT environment, including Huron IRB, Huron safety and ancillary modules, the custom REST API, updates/upgrades, and vulnerability-response services. The FY25 competitive procurement for this requirement resulted in Huron being selected as the winner based on its demonstrated experience, expertise, and access to support PROTECT and provide upgrades.

OHSRP published notice of intent 7571TE26Q00388 to award sole source to Huron. Two capability statements were received in response, from Big Data Consultants Inc. (BDC) and Care On Demand Technologies Enterprise, LLC (CODTE); the COR's assessment of each is saved to Tab B of the contract file. Neither vendor demonstrated capability to meet the PROTECT SOW: BDC showed only general data/cloud experience with no Huron-specific access or relevant past performance, and CODTE acknowledged it lacks the proprietary rights to deliver the core Huron services, proposing instead to act as a management intermediary contingent on an unexecuted authorization agreement with Huron.

Market research identified no other source with the product-specific experience, expertise, and access necessary to provide the complete proprietary subscription, upgrades, maintenance, API support, and