← Back to agency guides

How to Sell to HHS

The Department of Health and Human Services is the largest civilian federal contracting customer and one of the most diverse buying environments in government. HHS contracts through operating divisions like NIH (research), CMS (Medicare/Medicaid), CDC (public health), FDA (regulation), HRSA (health workforce), and IHS (Indian health). Each operates with significant procurement autonomy and distinct buying patterns.

This guide covers HHS's structure, the operating divisions most relevant to small contractors, major contract vehicles, NAICS where spending concentrates, and how to target specific HHS operating divisions effectively.

HHS's operating division structure

HHS is organized around operating divisions (OPDIVs) rather than a unified procurement function:

Research:

  • NIH (National Institutes of Health) — biomedical research, the largest federal research funder
  • AHRQ (Agency for Healthcare Research and Quality) — health services research

Payment systems:

  • CMS (Centers for Medicare & Medicaid Services) — administers Medicare, Medicaid, and the ACA marketplaces. Largest HHS OPDIV by contract spend.

Public health:

  • CDC (Centers for Disease Control and Prevention) — disease surveillance, public health programs
  • HRSA (Health Resources and Services Administration) — health workforce, rural health
  • SAMHSA — behavioral health and substance abuse
  • IHS (Indian Health Service) — tribal health programs

Regulatory:

  • FDA (Food and Drug Administration) — food, drug, device regulation

Children and families:

  • ACF (Administration for Children and Families) — family services, foster care, child care
  • ACL (Administration for Community Living) — aging and disability services

For small contractors, NIH, CMS, and CDC are the largest buying OPDIVs. Each has distinct patterns worth understanding separately.

NIH — research-heavy procurement

NIH runs 27 institutes and centers (NCI, NIAID, NIMH, etc.), each with its own extramural research programs. NIH contracts extensively for:

  • Research support services — clinical trial support, laboratory operations, protocol development
  • Data management and bioinformatics
  • IT services for NIH infrastructure and research computing
  • Biomedical research under specific institute contracts
  • Scientific conference support, editorial services, technical writing

Key vehicles:

  • CIO-SP3/CIO-SP4 (administered by NIH, used government-wide for IT services)
  • Institute-specific IDIQs (varies by institute)
  • SBIR/STTR programs for small business innovation research — significant funding for qualifying small research firms

NAICS concentration:

  • 541715: Research and Development in Physical, Engineering, Life Sciences
  • 541714: Biotech R&D
  • 541512, 541519: IT services (CIO-SP vehicle)
  • 541690: Technical consulting

If your firm does applied research, bioinformatics, or specialized IT supporting biomedical research, NIH is a natural target.

CMS — largest HHS contract spend

CMS administers Medicare, Medicaid, CHIP, and the ACA marketplaces. The agency contracts heavily for:

  • IT systems — massive systems modernization, cloud migration, data analytics
  • Actuarial and financial consulting — Medicare Trust Fund actuarial work, cost modeling
  • Program integrity — fraud, waste, and abuse detection services
  • Contact center operations — 1-800-MEDICARE and related beneficiary support
  • Medicare Administrative Contractors (MACs) — major private contractors processing Medicare claims regionally

Key vehicles:

  • SPARC (Strategic Partners Acquisition Readiness Contract) — multi-award IDIQ for CMS IT
  • MIDAS (Medicare & Medicaid Integrity Decision Support) — fraud detection analytics
  • Multiple IDIQs specific to health program integrity

NAICS concentration:

  • 541511, 541512, 541519: IT services (heavy spend)
  • 541214: Payroll services adjacent to claims processing
  • 541611: Management consulting for CMS programs
  • 561422: Contact centers (Medicare beneficiary support)

CMS is an IT-heavy procurement environment. Firms with strong IT modernization, data analytics, or health systems integration capabilities see high CMS demand.

CDC — public health contracting

CDC contracts for disease surveillance, laboratory services, emergency preparedness, and public health program support. Post-COVID, CDC's contracting footprint has expanded significantly.

Key vehicles:

  • CIO-SP3 (NIH-administered but CDC is a user)
  • CDC-specific IDIQs for laboratory services and public health program support

NAICS concentration:

  • 541715: R&D (public health research)
  • 541380: Testing laboratories
  • 541512, 541519: IT services (disease surveillance systems)
  • 541611: Management consulting for public health programs

CDC works with state and local health departments extensively. Contractors with state public health experience often find CDC a natural federal extension.

FDA — regulatory and review support

FDA contracts for review support, inspection services, IT modernization, and specialized regulatory consulting. Smaller contracting footprint than NIH or CMS but focused spend.

Key vehicles:

  • CIO-SP3/CIO-SP4 for IT services
  • Specialized IDIQs for scientific and regulatory support

NAICS concentration:

  • 541380: Testing laboratories
  • 541715: R&D
  • 541690: Scientific and technical consulting
  • 541611: Management consulting for regulatory programs

Set-aside patterns at HHS

HHS hits its small business goals consistently. The department has strong small business program infrastructure across OPDIVs.

8(a) set-asides drive significant HHS small business volume, particularly for IT services, management consulting, and specialized research support.

SDVOSB set-asides are common across HHS OPDIVs. NIH specifically has strong SDVOSB contracting activity.

WOSB set-asides see meaningful activity in healthcare consulting, research support, and public health program services.

HUBZone set-asides appear across HHS, particularly at CDC facilities and IHS rural operations.

STARS III (the 8(a) vehicle) sees heavy HHS usage.

Common entry paths

1. Target a specific OPDIV. "Selling to HHS" is too broad. Pick NIH, CMS, CDC, or another OPDIV where your capabilities align and build component-specific relationships.

2. Get on CIO-SP3/CIO-SP4. For IT services, NIH-administered CIO-SP is the primary vehicle used by HHS and many other agencies. Even subcontracting to an existing CIO-SP prime builds HHS past performance.

3. SBIR/STTR for research firms. Small Business Innovation Research and Small Business Technology Transfer programs at NIH fund early-stage research. Eligible small firms can access $2-3M in non-dilutive research funding through these programs. Different from traditional contracting — grant-like structure.

4. CMS Integrator positioning. CMS's IT modernization has created demand for firms that can integrate across legacy and modern systems. Firms with specific health IT integration experience have consistent CMS opportunity flow.

5. Attend NIH Small Business Conference. Annual event specific to small business contracting at NIH. High-signal venue for building NIH-specific relationships.

Common mistakes at HHS

Generic healthcare positioning. HHS buyers are subject-matter experts in their specific domains (clinical research, claims processing, public health surveillance). Generic "we do healthcare" positioning doesn't win. Specific expertise in the buyer's actual domain does.

Ignoring SBIR/STTR for eligible research firms. Research-oriented small firms that could qualify for SBIR often don't pursue it because they're focused on traditional contracts. SBIR is significant non-dilutive funding that also builds federal research relationships.

Missing the OPDIV distinction in capability statements. A capability statement positioned for NIH reads differently than one for CMS. NIH wants research capability; CMS wants IT modernization and actuarial depth. Having a single HHS capability statement that tries to cover both produces weak positioning for both.

Underestimating HIPAA and security compliance overhead. Health contracts often require HIPAA-compliant infrastructure, FedRAMP authorization for cloud services, and specific security certifications. Plan the compliance investment alongside the contracting investment.

Assuming all HHS operates on NIH's rhythm. NIH has a distinct research contracting rhythm. CMS operates more like other IT-heavy civilian agencies. CDC has its own public health cadence. Understand the specific OPDIV you're targeting.

Next steps

Map your services to HHS OPDIV demand using the NAICS recommender. Healthcare services firms see NAICS codes for medical services. IT firms targeting CMS see NAICS codes for IT services. Research firms see NAICS codes for R&D.

If you hold small business certifications, the set-aside programs overview covers how they apply at HHS. Build an OPDIV-specific capability statement with the capability statement builder.

For help targeting specific HHS OPDIVs, evaluating SBIR/STTR eligibility, or navigating CIO-SP vehicle positioning, schedule a 15-minute consultation.