Healthcare Government Contracting: VA, HHS & CMS Opportunities

The federal government is the largest healthcare buyer in America, spending over $100 billion annually on healthcare services, medical supplies, pharmaceuticals, IT systems, and research.

Market size and scope:

• $100B+ annually in healthcare-related federal contracts
• Department of Veterans Affairs (VA): $25B+ per year, largest integrated healthcare system
• Department of Health and Human Services (HHS): $40B+ including NIH research, CDC programs, FDA operations
• Centers for Medicare & Medicaid Services (CMS): Administers $1.4 trillion in healthcare payments, contracts for IT and program support
• Department of Defense (DoD): TRICARE contracts, military treatment facilities, medical research
• Other agencies: Indian Health Service, Federal Bureau of Prisons, State Department medical services

Types of healthcare contracts:

• Medical services — Direct patient care, specialty care, mental health, telehealth
• Medical supplies and equipment — Pharmaceuticals, devices, PPE, surgical supplies
• Healthcare IT — Electronic health records (EHR), health information exchange, data analytics
• Healthcare management — Claims processing, benefits administration, program management
• Research and development — Clinical trials, biomedical research, public health research
• Facilities management — Hospital operations, maintenance, environmental services
• Professional services — Healthcare consulting, policy analysis, program evaluation

Why healthcare contracting is attractive:

• Large, stable market — Healthcare spending continues regardless of political changes
• Recurring revenue — Many contracts are multi-year IDIQs or renewable services
• Multiple agencies — Diverse customers with different needs and procurement approaches
• Growing demand — Aging veteran population, Medicare expansion, COVID-19 aftermath increase needs
• Small business opportunities — Many contracts set aside for Service-Disabled Veteran-Owned Small Businesses (SDVOSBs)

Market challenges:

• Strict compliance — HIPAA, CMMC, FDA regulations, state licensing requirements
• Past performance barriers — Hard to break in without federal healthcare experience
• Competitive — Established primes (Leidos, Booz Allen, Accenture Federal) dominate large contracts
• Complex requirements — Clinical expertise + government contracting expertise required

The VA is the federal government's largest healthcare system, operating 1,255 facilities serving 9 million+ veterans annually. The VA is a massive contracting customer.

VA contracting overview:

• Budget: $280B+ total, $25B+ in contracts
• Facilities: 171 medical centers, 1,113 outpatient clinics nationwide
• Structure: 18 regional Veterans Integrated Service Networks (VISNs), each with procurement authority
• Opportunities: Both national contracts (VA-wide) and local contracts (individual medical centers)

Major VA contract categories:

Medical services:

• Community Care — VA pays private providers when VA facilities can't meet needs (largest category)
• Mental health services — PTSD treatment, substance abuse, counseling
• Specialty care — Cardiology, oncology, neurology from private sector
• Telehealth — Virtual care platforms and provider services
• Home healthcare — In-home nursing, therapy, personal care

Medical supplies and equipment:

• Pharmaceuticals — Medications through Federal Supply Schedules
• Medical devices — Surgical equipment, diagnostic tools, prosthetics
• Personal protective equipment (PPE) — Masks, gowns, gloves (expanded post-COVID)
• Durable medical equipment — Wheelchairs, walkers, hospital beds

Healthcare IT:

• Electronic Health Record (EHR) — VA uses Cerner/Oracle EHR (multi-billion program)
• Health data analytics — Population health, quality metrics, outcomes analysis
• Cybersecurity — Protecting patient data, CMMC compliance
• Telehealth platforms — Video visit technology, remote monitoring

Professional services:

• Healthcare consulting — Process improvement, Lean/Six Sigma, quality programs
• Program management — Support for major initiatives (EHR, Community Care)
• Research support — Clinical research, health services research

VA-specific considerations:

• Veterans preference — Service-Disabled Veteran-Owned Small Businesses (SDVOSBs) have significant advantages. See our SDVOSB guide.
• Decentralized procurement — Each VISN and medical center can issue contracts; must build local relationships
• Mission focus — Demonstrate understanding of veteran population and commitment to serving veterans
• Quality emphasis — VA faces scrutiny over care quality; emphasize quality outcomes in proposals

Key VA contract vehicles:

• T4NG (Transformation Twenty-One Total Technology Next Generation) — $22.3B IT IDIQ
• VECTOR — Vocational rehab and employment services
• FSS (Federal Supply Schedule) — Medical supplies through GSA (see GSA Schedule guide)
• Local VA medical center contracts — Opportunities posted on SAM.gov by individual facilities

Department of Health and Human Services (HHS) is the Cabinet-level agency responsible for public health, biomedical research, healthcare programs, and human services. It includes multiple sub-agencies with significant contracting budgets.

HHS structure and key agencies:

Centers for Medicare & Medicaid Services (CMS):

• Mission: Administer Medicare, Medicaid, CHIP, ACA marketplace
• Budget: $1.4 trillion in benefit payments, $5B+ in contracts
• Contracting focus: IT systems, claims processing, fraud prevention, program integrity, data analytics
• Major opportunities: Medicare claims processing, marketplace operations, data analysis, policy research

National Institutes of Health (NIH):

• Mission: Biomedical and public health research
• Budget: $47B+, much goes to research grants but $10B+ in contracts
• Contracting focus: Research support, laboratory services, clinical trials, data management, IT infrastructure
• Major opportunities: Clinical research support, bioinformatics, research data management

Centers for Disease Control and Prevention (CDC):

• Mission: Protect public health, disease prevention
• Budget: $15B+, significant contracting for emergency response
• Contracting focus: Public health surveillance, emergency preparedness, laboratory services, communications
• Major opportunities: Disease tracking systems, vaccine distribution, public health campaigns, data analytics

Food and Drug Administration (FDA):

• Mission: Protect public health by ensuring safety of food, drugs, medical devices
• Budget: $6B+
• Contracting focus: Laboratory testing, IT systems, regulatory science research, inspection support
• Major opportunities: Scientific review support, IT modernization, lab services

CMS contracting deep dive:

CMS is the single largest healthcare payer in America and has unique contracting needs:

Medicare Administrative Contractors (MACs):

• Process Medicare Part A and Part B claims
• 12 geographic jurisdictions, each with a MAC contract
• Multi-billion dollar, multi-year contracts
• Very difficult to break into (dominated by few large contractors)

Healthcare.gov and marketplace support:

• IT infrastructure for ACA marketplaces
• Customer service and call center operations
• Eligibility verification systems
• Data analytics and reporting

Program integrity and fraud prevention:

• Data analytics to detect fraud, waste, abuse
• Audit support for providers
• Recovery audit contractors (RACs)
• Medicaid integrity contractors

Quality measurement and reporting:

• Hospital quality reporting systems
• Medicare Star Ratings analytics
• Value-based care metrics

HHS-wide opportunities:

• Health IT modernization — Legacy system replacement, cloud migration, cybersecurity
• Data analytics and AI — Population health, predictive analytics, machine learning for fraud detection
• Public health emergencies — COVID-19 response created massive contracting (testing, vaccines, PPE, data tracking)
• Policy and program evaluation — Research contracts to evaluate programs, develop policy recommendations

NAICS codes classify your business and determine which contracts you're eligible to compete for. Healthcare contractors should register under relevant codes on SAM.gov.

Healthcare services NAICS codes:

621111 — Offices of Physicians (except Mental Health Specialists)

• Primary care, specialty care, physician services
• Use for: VA community care, direct patient care contracts

621112 — Offices of Physicians, Mental Health Specialists

• Psychiatrists, mental health physicians
• Use for: VA mental health, PTSD treatment, behavioral health

621210 — Offices of Dentists

• Dental services
• Use for: VA dental care, DoD dental contracts

621330 — Offices of Mental Health Practitioners (except Physicians)

• Psychologists, therapists, counselors
• Use for: VA counseling, substance abuse treatment

621399 — Offices of All Other Miscellaneous Health Practitioners

• Physical therapy, occupational therapy, other practitioners
• Use for: Rehabilitation services, specialty therapies

621610 — Home Health Care Services

• In-home nursing, personal care, therapy
• Use for: VA home-based primary care, aging in place programs

621910 — Ambulance Services

• Emergency transport, non-emergency medical transport
• Use for: VA medical transport contracts

621991 — Blood and Organ Banks

• Blood banking, tissue banks, organ procurement

621999 — All Other Miscellaneous Ambulatory Health Care Services

• Catch-all for other healthcare services
• Use for: Telehealth, mobile clinics, specialized services

622110 — General Medical and Surgical Hospitals

• Hospital operations (rarely contracted, but management services can be)

Medical supplies and equipment NAICS codes:

339112 — Surgical and Medical Instrument Manufacturing

• Surgical instruments, medical devices

339113 — Surgical Appliance and Supplies Manufacturing

• Prosthetics, surgical dressings, wheelchairs

339114 — Dental Equipment and Supplies Manufacturing

• Dental instruments and supplies

339115 — Ophthalmic Goods Manufacturing

• Eyeglasses, contact lenses, vision equipment

423450 — Medical, Dental, and Hospital Equipment and Supplies Merchant Wholesalers

• Distribution of medical equipment and supplies
• Use for: FSS (Federal Supply Schedule) contracts

Healthcare IT and management NAICS codes:

541511 — Custom Computer Programming Services

• Custom software development
• Use for: EHR customization, healthcare applications

541512 — Computer Systems Design Services

• IT infrastructure, systems integration
• Use for: Healthcare IT projects, system modernization

541519 — Other Computer Related Services

• IT consulting, cybersecurity
• Use for: CMMC compliance, security for health data

541611 — Administrative Management and General Management Consulting Services

• Healthcare consulting, management advisory
• Use for: Healthcare policy, program evaluation, process improvement

541690 — Other Scientific and Technical Consulting Services

• Clinical research, health services research
• Use for: NIH research support, public health consulting

561110 — Office Administrative Services

• Administrative support
• Use for: Claims processing support, call centers

How to choose your NAICS codes:

• Register under your primary NAICS (your main business activity)
• Add secondary NAICS codes for other capabilities
• Watch SBA size standards — different NAICS have different thresholds
• Search SAM.gov for contracts using specific NAICS to see opportunity volume

Healthcare contracting has strict compliance requirements to protect patient information and maintain quality standards.

HIPAA (Health Insurance Portability and Accountability Act):

HIPAA protects patient health information privacy. Any contractor handling Protected Health Information (PHI) must comply.

HIPAA requirements for contractors:

• Business Associate Agreement (BAA) — Legal agreement between covered entity (VA, CMS) and contractor
• Administrative safeguards — Security policies, workforce training, incident response plans
• Physical safeguards — Facility access controls, workstation security, device disposal procedures
• Technical safeguards — Access controls, encryption, audit logs, transmission security
• Breach notification — Report any PHI breach within 60 days

Implementing HIPAA compliance:

• Conduct HIPAA risk assessment
• Develop and document policies and procedures
• Train all staff who handle PHI
• Implement technical controls (encryption, access management)
• Establish incident response procedures
• Maintain compliance documentation

CMMC (Cybersecurity Maturity Model Certification):

DoD contracts (including TRICARE and military healthcare) increasingly require CMMC certification. While primarily for defense contractors, healthcare contractors working with DoD must comply.

CMMC levels for healthcare contractors:

• CMMC Level 1: Basic cyber hygiene (17 practices) — for contracts with Federal Contract Information (FCI)
• CMMC Level 2: Intermediate cybersecurity (110 practices from NIST SP 800-171) — for Controlled Unclassified Information (CUI)
• CMMC Level 3: Advanced/progressive (subset of NIST SP 800-172) — for highly sensitive CUI

Patient data in military healthcare often qualifies as CUI, requiring Level 2 certification.

State medical licensing:

Healthcare providers delivering care under federal contracts must:

• Hold appropriate state medical licenses
• Maintain professional liability insurance
• Meet credentialing requirements (for clinical contracts)
• Comply with state scope-of-practice laws

Quality and accreditation:

• Joint Commission accreditation — Often required or preferred for healthcare facilities
• NCQA (National Committee for Quality Assurance) — For managed care organizations
• CAP (College of American Pathologists) — For clinical laboratories
• CLIA (Clinical Laboratory Improvement Amendments) — For any lab performing patient testing

FDA regulations:

Medical device and pharmaceutical contractors must comply with FDA regulations:

• 21 CFR Part 820 — Quality System Regulation for medical devices
• FDA registration — Device manufacturers must register with FDA
• 510(k) clearance or PMA approval — For marketing medical devices
• GMP (Good Manufacturing Practice) — For pharmaceuticals

Research compliance (for NIH contracts):

• IRB approval — Institutional Review Board for human subjects research
• IACUC approval — Institutional Animal Care and Use Committee for animal research
• HIPAA Privacy Rule — Additional protections for research subjects
• Good Clinical Practice (GCP) — Standards for clinical trials

Compliance readiness checklist:

• HIPAA policies, BAA template, staff training documented
• CMMC assessment completed (if pursuing DoD healthcare)
• Professional licenses and credentials current
• Quality accreditation obtained
• Cybersecurity controls implemented and documented
• Incident response plan tested

Healthcare agencies use various contract vehicles and procurement methods. Understanding them helps you identify and pursue opportunities effectively.

Federal Supply Schedules (GSA Schedules):

The GSA Schedule is critical for healthcare contractors selling products or commodity services:

• Schedule 65: Medical Equipment and Supplies — Devices, equipment, pharmaceuticals
• Schedule 70: IT products and services — Healthcare IT systems, software
• Schedule 84: Facility management — Healthcare facility operations
• Benefits: Pre-negotiated pricing, simplified procurement for agencies, long-term contract (5 years + 3 option years)
• Getting on GSA Schedule: Application process takes 4-8 months, requires financial documentation, pricing justification

IDIQs (Indefinite Delivery, Indefinite Quantity):

IDIQ contracts are common for healthcare services:

• Structure: Master contract with multiple task orders over time
• Examples: T4NG (VA IT), SeaPort-NXG (Navy healthcare), CMS SPARC (program support)
• Benefits: Long-term relationship (5-10 years), recurring revenue, reduced proposal costs for task orders
• Challenges: Competitive onramps, must win task orders after getting on IDIQ

BPAs (Blanket Purchase Agreements):

BPAs off GSA Schedules streamline repeat purchases:

• Use case: Agency has recurring need for healthcare products/services
• Process: Mini-competition among Schedule holders to establish BPA
• Benefit: Preferred vendor status for specific customer

Full and open competition:

Traditional RFP process for large, complex healthcare contracts:

• Use case: Major IT systems, large service contracts, unique requirements
• Process: Detailed RFP, formal source selection, protests common
• Timeline: 6-18 months from RFP to award
• Investment: Significant capture and proposal costs

Set-asides for small businesses:

Many healthcare contracts are set aside for small businesses:

• SDVOSB (Service-Disabled Veteran-Owned Small Business) — Highly advantaged for VA contracts. See SDVOSB guide.
• 8(a) — Economically disadvantaged businesses. See 8(a) guide.
• HUBZone — Historically underutilized business zones
• WOSB/EDWOSB — Women-owned small businesses. See WOSB guide.

Learn more about set-asides and SBA certifications.

Procurement methods by contract size:

Micro-purchases (under $10,000):

• Government purchase card, minimal competition
• Opportunity: Local VA medical centers for small supply purchases

Simplified acquisition ($10K-$250K):

• Streamlined procedures, quotes rather than formal proposals
• Opportunity: Small services contracts, limited equipment purchases

Above simplified acquisition threshold ($250K+):

• Full FAR procedures, formal source selection
• Most healthcare services contracts fall here

Where to find healthcare opportunities:

• SAM.gov — All federal opportunities posted here. Search by NAICS code or keywords like "healthcare," "medical," "VA," "CMS"
• VA OAMM (Office of Acquisition and Materiel Management) — VA-specific forecast and opportunities
• HHS Acquisition Portal — HHS agency forecasts
• NIH acquisition website — Research support opportunities
• Our Expiring Contracts tool — Find contracts coming up for recompete at /tools/expiring-contracts

Breaking into federal healthcare contracting requires preparation, positioning, and persistence.

Step 1: Get your fundamentals in order

• Register on SAM.gov — Required for all federal contracts. See our SAM.gov registration guide.
• Select appropriate NAICS codes — Register under all relevant healthcare NAICS
• Obtain SBA certifications — If eligible, get SDVOSB, 8(a), WOSB, or HUBZone certification
• Develop capability statement — Healthcare-focused capability statement. See our capability statement guide.
• Get DUNS/UEI number — Required for SAM.gov registration

Step 2: Ensure compliance readiness

• HIPAA compliance — Implement policies, train staff, document controls
• Cybersecurity — Meet NIST 800-171 requirements if pursuing DoD healthcare
• Professional licenses — Ensure all clinical staff properly licensed
• Quality accreditation — Obtain Joint Commission, NCQA, or other relevant accreditation
• Insurance — Professional liability, general liability, cyber insurance

Step 3: Build past performance

Federal healthcare agencies require relevant past performance. If you lack federal experience:

• Start small — Pursue simplified acquisition contracts ($10K-$250K) to build federal track record
• Leverage commercial experience — Commercial healthcare work demonstrates capability even without federal contracts
• Subcontract — Work as subcontractor to prime with federal healthcare contracts, build experience and relationships
• GSA Schedule — Get on Schedule 65 or 70 to access opportunities more easily
• Local VA contracts — Individual medical centers issue smaller contracts; easier to break in than national contracts

Step 4: Identify target opportunities

• Research agencies — Which agencies buy what you offer? VA for clinical services? NIH for research? CMS for IT?
• Use our tools — Expiring contracts tool shows recompete opportunities
• Watch forecasts — Agencies publish procurement forecasts; monitor for upcoming opportunities
• Network at VA facilities — If targeting VA, visit local medical centers, attend vendor outreach events

Step 5: Develop customer relationships

• Industry days — Attend agency industry days to learn about upcoming procurements
• Small business offices — Every agency has Office of Small and Disadvantaged Business Utilization (OSDBU); they help small businesses navigate contracting
• Capability briefings — Request meetings to brief agencies on your capabilities (follow their rules for vendor communication)
• Conferences — Attend healthcare IT conferences (HIMSS), VA conferences, NIH events

Step 6: Consider teaming

Large healthcare contracts often require teaming:

• Partner for past performance — If you lack federal healthcare experience, partner with firm that has it
• Partner for scale — Large contracts may exceed your capacity; team with larger firm as subcontractor
• Partner for set-aside status — Large business may need SDVOSB partner for VA contracts
• Complementary capabilities — Clinical expertise + IT expertise partnerships common

Step 7: Write competitive proposals

• Emphasize healthcare expertise — Demonstrate deep understanding of clinical care, patient safety, quality metrics
• Address compliance — Show HIPAA compliance, quality processes, risk management
• Quantify outcomes — Use metrics (patient satisfaction scores, clinical outcomes, cost savings)
• Mission focus — Especially for VA, emphasize commitment to veteran care
• Follow RFP exactly — Healthcare RFPs are complex; use compliance matrix

Learn more in our Proposal Writing guide and RFP Response guide.

Common mistakes to avoid:

• Pursuing contracts you can't perform — Federal healthcare has serious consequences; only bid what you can deliver
• Ignoring compliance — HIPAA violations carry heavy penalties; be compliant before bidding
• Underestimating competition — Established healthcare contractors have strong past performance; differentiate clearly
• Weak pricing — Healthcare labor rates must be competitive; unrealistic pricing loses