National Provider Directory (NPD) Data Sourcing, Aggregation, and Quality Assurance Services

The Centers for Medicare and Medicaid Services seeks a single contractor to source, aggregate, and perform quality assurance on National Provider Directory data across two work areas, with Phase One proposals due August 12, 2026 at 12:00 p.m. Eastern Time and Phase Two proposals due August 28, 2026. This is an unrestricted procurement with no set-aside.

Place of performance is Windsor Mill/Milford Mill, Maryland. The contractor must establish and maintain independent licensing agreements with authoritative data sources for six required datasets: clinician licensure (national and supplemental state boards), physician board certification, multi-payer provider network participation data, pharmacy identification, and hospital/facility data. Work Area E requires data quality assessments, corrections, and enrichments delivered via CMS-designated storage or API write-back, with all work operating within an Agile framework organized into six-week Program Increments. The Initial Operating Capability milestone requires delivery from at least five qualifying authoritative sources. The contract runs from September 25, 2026 through September 24, 2031 (base period plus four option periods) across 15 contract line items. CLIN 0001 and CLIN 0002 are Firm Fixed Price; CLIN 0003 (data licensing and upstream processing) is Time and Materials with a not-to-exceed ceiling in the base year, converting to Firm Fixed Price in option years. Offerors must submit pricing for all periods in initial proposals.

Evaluation uses a tradeoff methodology with non-price factors significantly more important than price. Phase One evaluates Corporate Experience (Mission Focused) on four dimensions: data source access and license-free output capability, production-scale data quality improvement, closed-loop feedback integration, and objectivity with independent verifiability. Phase Two evaluates the Performance Work Statement (30-page limit) and Quality Assurance Surveillance Plan (5-page limit), oral presentations (interview-style, one hour, five-person team maximum), and price. Offerors must demonstrate corporate experience within the past five years with similar work for federal, state, local, or commercial clients via a six-page Phase One narrative plus artifacts. Section 508 accessibility compliance (VPAT required) and Conflict of Interest disclosures are evaluated for the apparent successful offeror prior to award. Written questions are due August 3, 2026 at 12:00 p.m. Eastern Time. The NAICS code is 541519 (Other Computer Related Services); PSC is DA01 (IT and Telecom—Business Application/Application Development Support Services, Labor). Contracting Officer: Alex Jarema; Contract Specialist: Walker Hare. Contractor personnel must hold current background investigations, complete HHS/CMS information security and privacy training before performance, and comply with HIPAA Business Associate requirements, FedRAMP/FISMA controls at Moderate impact level, FIPS 140 encryption for data in transit and at rest, incident reporting within one hour of discovery, and Personal Identity Verification credentialing. All government information must be sanitized per NIST SP 800-88 and returned or destroyed upon contract expiration. Amendments 0001 and 0002 released Phase 1 and Phase 2 Q&A responses; refer to the Consolidated Q&A Excel sheets for clarifications on contract structure, data requirements, pricing conversion mechanics, and performance metrics.