Sources Sought: ONC Certified Health IT Product List (CHPL) Development, Maintenance, and Improvement

The Office of the National Coordinator for Health Information Technology (ONC), procured through the Department of Health and Human Services Office of Mission Acquisition Solutions, is conducting a sources sought notice for continued maintenance, development, and improvement of the ONC Certified Health IT Product List (CHPL) under a total small business set-aside, with responses due by June 11, 2026.

This is market research only and does not constitute a solicitation or obligate award. Work shall be performed at the contractor's site. The requirement falls under NAICS 541512 (Computer Systems Design Services) with a small business size standard of $37.0 million in annual revenue.

The statement of work describes a Firm-Fixed Price contract for severable services with a base period of 12 months (July 15, 2026 through July 14, 2027) and two optional 12-month extension periods. Mandatory tasks include Task Order Management (management plans, project work plans, weekly and monthly status reports, virtual meetings, collaboration activities); ONC CHPL Development, Maintenance, and Updates (back-end and front-end development, data integrity, customer service, regulatory alignment); and ONC CHPL Specific Development Items (public usage analysis, UI improvements, user guidance). An optional Task 4 addresses CMS EHR Certification ID generation and management.

Security requirements are extensive: FISMA, NIST standards, FedRAMP compliance, FIPS 140 encryption, Privacy Act and E-Government Act compliance, CUI handling, incident response with one-hour reporting, vulnerability remediation timelines (15 days critical, 30 days high), continuous monitoring, annual penetration testing, and Section 508 digital accessibility. All contractor personnel require background investigations commensurate with position sensitivity and annual mandatory training in information security awareness, privacy, and records management.

Responses must not exceed five pages (excluding cover page), submitted in Microsoft Word or PDF, Times New Roman 12-point font, single-spaced, 8.5 by 11 inches. Submit to Joseph.Kozar@hhs.gov with subject line "7571TE26Q00034_SourcesSought."