VAERS Monitoring, Analytics, Reporting and Automation Enhancement

The Indian Health Service seeks design, development, and implementation of an automated vaccine safety monitoring system leveraging CDC Vaccine Adverse Event Reporting System (VAERS) data, with quotes due September 11, 2026 at 12:00 PM Eastern Time. This is a 100% Indian Small Business Economic Enterprise (ISBEE) set-aside under the Buy Indian Act; only eligible Indian Economic Enterprises that are also small business concerns qualify to submit.

Place of performance is contractor off-site facility; no travel is required. Work encompasses automated data ingestion, signal detection, analytical framework development, and operational dashboards using Power BI or Qlik. The Government will provide three standard environments (development, test, and production), with contractor access requiring 30–60 calendar days post-award; IHS will furnish SAS and/or Qlik licenses, SQL Server, and Power BI. The contractor must supply all development environment, database/data platform, and related technical infrastructure costs within the firm fixed price. The NAICS code is 541690, Other Scientific and Technical Consulting Services, with SBA size standard of $19 million.

Period of performance runs September 21, 2026 through July 31, 2027. Task deliverables are due November 20, 2026 (Task 1); February 12, 2027 (Task 2); April 30, 2027 (Tasks 3–4); and July 16, 2027 (Tasks 5–6). Payment is milestone-based upon Government acceptance: Task 1 at 15%, Task 2 at 25%, Tasks 3–4 at 40%, Tasks 5–6 at 20%; invoices must be submitted within 60 days after July 31, 2027.

Evaluation uses streamlined FAR Part 12 procedures with comparative best-value; non-price factors are significantly more important than price. Technical quotes are limited to 10 pages (excluding cover letter, cover page, and table of contents/resumes). The Government retains unlimited rights to all deliverables including source code, scripts, configurations, dashboards, and documentation. Amendment 0002, effective September 9, adds requirements for malicious code prevention and confidentiality/nondisclosure clauses; questions and answers have been posted addressing infrastructure provision, licensing, data delivery, and Service Contract Act applicability.