Two buyers, one badge
The Department of Veterans Affairs runs the largest integrated health system in the United States: roughly 170 medical centers and more than 1,100 outpatient sites, organized into 18 Veterans Integrated Service Networks, serving about nine million enrolled Veterans. When a technology firm says it wants to sell to VA, it usually has not yet decided which of two very different customers it is talking to. Getting that wrong costs a year.
The Office of Information and Technology (OIT) owns the enterprise. It runs the network, the data centers, the VA Enterprise Cloud, identity, VA.gov, and the security authorization process. Any software that touches a VA network becomes OIT's problem whether or not OIT bought it. Most enterprise IT competitions run through VA's Technology Acquisition Center, with offices in Eatontown, New Jersey and Austin, Texas.
The Veterans Health Administration (VHA) owns the clinical mission and the medical care appropriation, which dwarfs the IT accounts. VHA buys clinical services, medical devices, research support, and a large volume of local goods and services through medical-center and network contracting offices inside each VISN. VHA has real appetite for software, and that appetite regularly collides with OIT's authority. A VISN can want a tool badly and still be unable to install it.
The working rule: if the deliverable runs on a VA network or handles VA data, OIT decides whether it lives. If it changes clinical workflow, VHA decides whether it matters. Pursuits that have only one of those two sponsors stall, and they usually stall late, after the demo has gone well.
Where the money sits
For fiscal 2026, Congress funded VA's Information Technology Systems account at about $5.9 billion and the Electronic Health Record Modernization account at about $3.4 billion, a large step up from the prior year as deployments restarted. Those two lines are the enterprise technology budget. They sit beside a medical care appropriation of well over $100 billion, some of which buys software indirectly inside clinical and administrative services contracts.
Note what is absent. VA does not run an SBIR program. Its research budget is largely intramural, funding VA investigators through the Office of Research and Development rather than extramural awards, so the set-aside at 15 U.S.C. § 638 does not create a VA door for small R&D firms. Companies that go looking for a VA equivalent of an open-innovation call spend months searching for something that is not there. VA's front door is procurement.
Entry-path viability — small technology firm at VA
Editorial weighting from public procurement data and practitioner reading. Illustrative, not a measured statistic.
Veterans First reorders everything
The single rule that governs VA contracting is the Veterans First Contracting Program, created by Public Law 109-461 and codified at 38 U.S.C. §§ 8127 and 8128. Section 8127(d) says a VA contracting officer shall restrict competition to service-disabled veteran-owned small businesses or veteran-owned small businesses when there is a reasonable expectation that two or more such firms will bid and award can be made at a fair and reasonable price. That is VA's Rule of Two, and it bites harder than the FAR small-business version at FAR 19.502-2.
In Kingdomware Technologies v. United States, 579 U.S. 162 (2016), a unanimous Supreme Court held that "shall" means shall. VA must apply the Rule of Two even when it is already exceeding its contracting goals, and it applies to orders placed against the Federal Supply Schedule. That decision is why VA's set-aside rates look nothing like the rest of government.
VAAR subpart 819.70 puts the order of priority in writing: SDVOSB first, then VOSB, then the other socioeconomic programs, including 8(a) and HUBZone. At most agencies an 8(a) sole-source award is the fastest route for a small firm. At VA it sits behind two veteran categories that have to be cleared first.
The spending follows the statute. VA reports awarding roughly $10 billion to service-disabled veteran-owned small businesses in fiscal 2025, better than one prime contract dollar in five, against a government-wide statutory floor of 3 percent at 15 U.S.C. § 644(g). Certification is no longer a VA function. Since 1 January 2023, SDVOSB and VOSB status has been certified by the Small Business Administration under 13 CFR part 128 through the VetCert program, a change made by section 862 of the FY2021 National Defense Authorization Act. Self-certification for set-aside awards ended government-wide.
What this means for a firm that is not veteran-owned
A large share of VA technology work is set aside, and a firm without SDVOSB or VOSB certification cannot prime it. That is not a wall. It is a routing instruction, and the routing is written down.
The limitation on subcontracting at 13 CFR 125.6 is the operative number. On a set-aside services contract, the prime may not pay more than 50 percent of the amount it receives to firms that are not similarly situated. "Similarly situated" means the subcontractor holds the same certification the set-aside required; work done by such a sub counts toward the prime's own half. Everyone else comes out of the remaining 50 percent.
So the arithmetic tells a non-veteran-owned technology firm exactly what it is competing for: up to half the labor dollars on every SDVOSB set-aside task order at VA, plus the whole of the technical credibility if it is the shop that can actually build the thing. VA polices the rule. VAAR 852.219-75 requires the offeror to certify compliance at proposal time and states plainly that a false certification exposes the firm to the False Claims Act and to referral for debarment. Teams that plan a token split with the certified partner as a pass-through get caught, and the penalty lands on both companies.
VAAR subpart 819.71 also runs a VA Mentor-Protégé Program, pairing an established contractor with an eligible small business and giving the mentor evaluation credit on VA source selections. It moves slower than a teaming agreement and lasts longer.
The vehicles that carry the work
| Channel | What it carries | How a small firm gets on it |
|---|---|---|
| T4NG2 | VA's primary IT services IDIQ. $60.7 billion ceiling, five-year base plus a five-year option, multiple-award. Successor to T4NG, which was awarded in 2016 with a $22.3 billion ceiling. | Subcontract. The prime roster is closed until VA opens an on-ramp. |
| GSA MAS | Software and IT services task orders under SIN 54151S. VA is a heavy user, and Kingdomware reaches these orders. | Hold your own MAS contract or sit under a partner's as a contractor teaming arrangement. |
| NASA SEWP / NITAAC | Hardware, software licenses, and IT services. Common for cloud and tooling buys. | Reseller and subcontract arrangements with existing holders. |
| VA Federal Supply Schedules | Medical equipment, pharmaceuticals, and healthcare products, run by the National Acquisition Center in Hines, Illinois. Not the IT path. | Only relevant if the product is a clinical device or supply. |
| VISN-level simplified acquisitions | Buys under the $250,000 simplified acquisition threshold at FAR 2.101, and micro-purchases under $10,000. | Direct award. Frequently the fastest first VA contract a small firm can win. |
| Mentor-Protégé (VAAR 819.71) | Not a vehicle. A relationship that produces vehicle access and evaluation credit. | Apply through VA OSDBU with a willing mentor. |
Three acquisition shops, three cultures. The Technology Acquisition Center runs enterprise IT. The Strategic Acquisition Center in Fredericksburg, Virginia handles large non-IT enterprise buys. Network contracting offices handle VISN-level work and are far more approachable. VA's Office of Small and Disadvantaged Business Utilization publishes a forecast of contracting opportunities, and reading it against award history on USAspending tells you who the incumbent is before you spend a dollar on capture.
The health record program is the weather
VA has run VistA since the 1980s. It is a MUMPS-based system with roughly 130 separate instances and decades of site-level customization, and it still holds the record of care for most enrolled Veterans. The replacement, the federal Oracle Health platform shared with the Military Health System, first went live at Mann-Grandstaff in Spokane in October 2020, was paused in 2023 after a hard run of deployments, and has since restarted.
Where the program stands in mid-2026 matters to anyone selling clinical software. VA resumed go-lives in April 2026 at four Michigan medical centers, Ann Arbor, Battle Creek, Detroit and Saginaw, with additional sites scheduled through the rest of the calendar year and a stated goal of finishing all 164 medical centers as early as 2031.
Read the consequence carefully. For years to come VA is a two-record health system. Any product that reads clinical data has to work against VistA at some sites and Oracle Health at others, often for the same Veteran, and has to reconcile the two. That is a data engineering problem before it is a clinical one: patient identity resolution across two record systems, terminology mapping between local VistA files and standard code sets, and a defensible answer to which source wins when they disagree. Firms that arrive with a single-integration story are describing half a system, and the program offices know it.
The API surface is public. VA's Lighthouse program at developer.va.gov publishes FHIR R4 health APIs, benefits intake, facility, and Veteran verification endpoints, with sandbox access available before production credentials. Building in that sandbox costs nothing and produces the one artifact a VA program office reacts to: a working demonstration against VA's own interfaces rather than a slide about capability.
Data rules that go past HIPAA
A confidentiality statute stricter than HIPAA
Records relating to substance use disorder treatment, HIV, and sickle cell anemia carry a statutory protection above HIPAA, and disclosure generally requires specific written consent. A model that ingests undifferentiated VA clinical text will ingest these records. Segregation has to be designed into the pipeline, not filtered on the way out.
Two other rules shape any VA data build. 38 U.S.C. § 5701 makes VA claimant records confidential and privileged, reaching further than the Privacy Act alone. And VA Handbook 6500.6, Appendix C, is attached to essentially every VA IT contract; it carries the security and privacy requirements, the contractor security control assessment obligation, and the training and background-investigation terms that apply to every person who touches the data. Price those terms into the bid, because they are labor.
Then there is the VA Technical Reference Model. Software that is not listed on the TRM, at an approved version and with its constraints decided, does not get installed on a VA network. Entering a product takes time and a VA sponsor willing to shepherd it. Teams that discover the TRM after award lose a quarter to it.
Section 508 is a delivery gate
Section 508 of the Rehabilitation Act, 29 U.S.C. § 794d, requires federal agencies to make electronic and information technology accessible to people with disabilities. The Access Board's Revised 508 Standards at 36 CFR part 1194 incorporate WCAG 2.0 Level AA by reference for web content, software, and electronic documents, and FAR subpart 39.2 pushes the requirement into the contract.
Every agency is bound. VA enforces it harder than most, for a reason that should be obvious: a large share of VA's users have vision, hearing, motor, or cognitive impairments, and serving them is the point of the department. VA runs its own Section 508 office inside OIT, tests delivered software against its own conformance process, and expects an Accessibility Conformance Report in the ITI VPAT format for commercial products. Findings come back as contract defects, and remediation is normally at the contractor's expense.
- Keyboard-only operation of every function, with a visible focus indicator and no traps
- Programmatic name, role, value and state on every control, custom components included
- Text alternatives for images, charts, and anything conveyed by color alone
- Contrast of at least 4.5:1 for body text, 3:1 for large text and interface components
- Captions and audio description for video; accessible PDF and Office deliverables
- An Accessibility Conformance Report that matches what the build actually does
- Automated scanning plus manual screen-reader testing on JAWS, NVDA and VoiceOver
The trap specific to AI products: generated output is content, and content has to conform. A chat interface that streams tokens into a live region without managing announcements will flood a screen reader with partial words. A model that returns a table as monospaced text returns something a screen reader cannot navigate. A confidence value shown only as a colored bar fails the use-of-color criterion outright. These are decisions made in week two of a build and expensive to reverse in week forty. Our engineers design the accessible path first for exactly that reason, and it costs less than retrofitting.
A realistic entry sequence
First VA contract — the sequence that works
What VA program offices respond to
Three things, consistently. A demonstration against VA's own interfaces instead of a description of capability. A named engineer who has built the same thing in a health system before and can be reached by phone. And a plain statement of what the system will not do, which is the sentence that separates an engineer from a vendor in a room full of clinicians who have been sold to many times.
The fourth thing, and the one most firms skip, is the accreditation path. A sponsor who likes the product still has to get it authorized to operate. Arriving with the security documentation drafted against Handbook 6500.6 Appendix C, the TRM entry already started, and the accessibility conformance report already written moves a schedule by months. We treat those three as build tasks with the same standing as the model and the interface, because at VA they decide whether anything ships.
Bottom line
VA is buyable. It has more enterprise technology money than most cabinet departments, unusual openness to small business, a public API program, and a modernization program that guarantees integration work for the rest of the decade. It also has the strictest set-aside preference in the federal government, an accessibility standard that rejects deliverables, a confidentiality statute stricter than HIPAA, and an approved-software list most vendors have never heard of. Firms that treat those four as design inputs do well there. Firms that treat them as paperwork discover them at the worst possible moment.
Common questions on the Veterans First rules
Does the Rule of Two apply to GSA Schedule orders at VA?
Yes. That was the specific holding in Kingdomware Technologies v. United States (2016). The Court read 38 U.S.C. § 8127(d) as mandatory and applied it to orders placed against the Federal Supply Schedule, not only to open-market contracts.
Can a firm that is not veteran-owned prime VA work at all?
Yes. When market research does not find two capable certified firms at a fair and reasonable price, the requirement goes to a small-business set-aside or to full and open competition. Plenty of specialized technical work lands there. The realistic first move for a new entrant is still a subcontract position, because past performance at VA is what opens the prime lane.
How much of the work can a subcontractor actually perform?
On a services set-aside, firms that are not similarly situated may receive no more than 50 percent of the amount paid to the prime, under 13 CFR 125.6. VAAR 852.219-75 makes the prime certify compliance with its offer, and a false certification carries False Claims Act exposure. Structure the split honestly and document who does what.
Is VA subject to the FAR?
Yes, plus the VA Acquisition Regulation at 48 CFR chapter 8. The VAAR is where the veteran priority, the subcontracting-limitation certificates, and the mentor-protégé program live. Read VAAR part 819 before bidding anything at VA.
Frequently asked questions
The Office of Information and Technology owns anything that runs on a VA network, and its enterprise competitions run largely through the Technology Acquisition Center. The Veterans Health Administration owns clinical workflow and buys through network contracting offices in each of the 18 VISNs. Most successful pursuits have a sponsor in both.
No. VA's research budget is largely intramural, so the SBIR set-aside under 15 U.S.C. § 638 does not create a VA solicitation stream. The entry paths at VA are procurement vehicles, subcontracting, simplified acquisitions, and a small number of innovation programs such as the Diffusion Marketplace.
T4NG2, the successor to T4NG, with a $60.7 billion ceiling over a five-year base and a five-year option. It carries the bulk of VA's IT services task orders. The prime roster is fixed until VA opens an on-ramp, which makes subcontracting the practical route onto it.
Strict enough to stop delivery. VA runs its own conformance testing inside OIT, expects an Accessibility Conformance Report for commercial products, and treats findings as contract defects normally remediated at the contractor's cost. The governing standards are 29 U.S.C. § 794d and 36 CFR part 1194, which adopt WCAG 2.0 Level AA.
Two record systems during the modernization period, VistA and the federal Oracle Health platform, plus confidentiality rules above HIPAA at 38 U.S.C. §§ 5701 and 7332, plus the security terms in VA Handbook 6500.6 Appendix C, plus TRM approval before installation. Each one is manageable; together they reward teams that have handled them before.