Secure HPC Enclave for Regulated Research Data

Empire AI is requesting proposals for design, supply, installation, and integration of a secure, isolated high-performance computing enclave for regulated research data including protected health information (PHI) subject to HIPAA compliance, with proposals due October 2, 2026 and written questions due September 18, 2026. MBE and WBE contracting goals are 6.00% each.

The enclave will host multiple member institutions as independent tenants on shared physical infrastructure and must satisfy both HIPAA Security and Privacy Rules and establish a defensible NIST 800-234 baseline with technical isolation controls. Two equally weighted objectives govern the design: isolation enforced by technical controls rather than administrative policy alone, and high-performance computing capability without material security control–related performance degradation — specifically, controls that degrade tightly coupled GPU training, RDMA data movement, or high-IOPS storage access are not acceptable.

The scope encompasses eight HGX nodes equipped with 64 NVIDIA H200 SXM 141GB GPUs with NDR 400G connectivity, infrastructure-as-code delivery, multi-tenant storage platforms, network perimeter security, workload orchestration, identity and access management, and comprehensive audit logging. The RFP deliberately leaves several architectural decisions open: storage sourcing (reallocation versus new procurement of VAST Data and DDN Lustre systems), network perimeter architecture (dedicated appliances, dedicated top-of-rack switches, or peer access into existing aggregation), workload orchestration model (container platform versus HPC scheduler), and GPU allocation strategies. Bidders are expected to assess these options and recommend an approach. Proposals must include a completed compliance matrix, technical architecture diagrams, NIST 800-234 and HIPAA control mappings, measured performance figures, failure-domain analysis, infrastructure-as-code deliverables, and comprehensive acceptance test plans. Pricing must itemize hardware, software, licensing, installation, professional services, and support, with separate pricing for optional items including zero-standing-privilege access, de-identification tooling, expansion hardware, and managed operations. Pricing must remain valid for 90 days; the vendor must execute a Business Associate Agreement and provide one-year continuous go-live support plus optional three-year technical support. Target readiness for the first regulated workload is January 4, 2027. Evaluation criteria include quality of design reasoning, compliance with mandatory isolation requirements, credibility of performance figures, audit evidence completeness, infrastructure-as-code quality, deliverability against the January 4, 2027 target, total five-year cost of ownership, and demonstrated experience with regulated data in research computing environments.