Inside the bipartisan backlash to the $27 billion VA-Oracle EHRM contract blindsiding Congress

Overview

The VA’s electronic health record modernization (EHRM) contract with Oracle Health has reportedly grown from $10 billion to $27 billion, with total program cost through 2031 estimated at $48 billion. That increase — and reported congressional surprise, bipartisan backlash, and subpoenas for Oracle executives — has prompted threats by Congress to withhold $3.4 billion in FY2027 funding. For contractors, this is a high-severity event: it can change funding flows, oversight intensity, subcontracting opportunities, and compliance scrutiny across federal health IT and enterprise software workstreams. Action is needed now to reassess risk on current task orders, preserve audit trails, validate security and privacy posture for health data, and prepare for heightened congressional oversight or procurement re-scoping. Monitor developments closely and position your capture and proposal teams to react quickly to follow-on opportunities or changes to the VA EHRM Contract.

Immediate Actions (This Week)

• [ ] Inventory and map all current and proposed work related to the VA EHRM Contract, including task orders, subcontract roles, and dependencies on Oracle deliverables.
• [ ] Freeze or preserve relevant program records, change requests, modification documentation, communications with prime/subs, and system logs that could be required in oversight inquiries.
• [ ] Conduct an immediate compliance and privacy gap check focused on the named compliance surfaces (FISMA, HIPAA, FedRAMP (Federal Risk and Authorization Management Program), NIST 800-53) for any systems and services supporting the EHRM work; document findings and mitigation steps.

Short-Term Actions (30 Days)

• [ ] Engage primes, teaming partners, and subcontractors to confirm program continuity plans, projected funding exposure, and contingency staffing plans if congressional funding is reduced or delayed.
• [ ] Prepare an oversight-response package template (roles, contact points, summaries of deliverables, security posture statements) so your contracts, security, and legal teams can respond rapidly to subpoenas, information requests, or VA/Congressional inquiries.

Long-Term Actions (90+ Days)

• [ ] Re-evaluate capture and pipeline priorities using revised risk and opportunity assumptions for the VA EHRM Contract; update bid/no-bid decisions and staffing forecasts accordingly.
• [ ] Strengthen sustained compliance and sustainment transition planning (operations, support SLAs, audit and reporting automation) to demonstrate value and reduce program risk in the event of re-scoping or increased oversight.

Compliance Checklist

• [ ] FISMA: Review system security plans (SSPs), incident response procedures, and continuous monitoring evidence for systems in-scope.
• [ ] HIPAA: Verify protected health information handling controls, Business Associate Agreements (BAAs), and breach notification readiness for any PHI touched by your services.
• [ ] FedRAMP: Confirm cloud service authorizations or provisional authorizations for cloud components that support the EHRM work; document authority-to-operate status and any FedRAMP POA&Ms.
• [ ] NIST 800-53: Validate implemented control baselines and the status of corrective action plans for controls tied to the EHRM mission systems.

(Compliance scope TBD — re-evaluate when official guidance or contract modifications are published.)

Resources

• VA — monitor official VA communications and program office notices for contract modification language and guidance.
• Congress — monitor congressional oversight releases and committee statements for subpoenas and funding actions.

Related reading:

• Winning Federal Contracts Guide (/insights/winning-federal-contracts)
• CMMC (Cybersecurity Maturity Model Certification) Compliance Guide (/insights/cmmc-compliance-guide)
• CUI (Controlled Unclassified Information)-Safe CRM Guide (/insights/cui-safe-crm-guide)

How Cabrillo Club Automates This

Cabrillo Signals War Room — Already detected this event and delivered this briefing within minutes. War Room continuously monitors federal sources and will push real-time alerts if VA posts contract modifications, if congressional committees issue subpoenas or requests, or if funding language changes. Use War Room alerts to trigger preservation and incident-response workflows without waiting for manual monitoring.

Cabrillo Signals Match Engine — When this event shifts program funding, partner alignment, or competitive dynamics, the Match Engine automatically rescoring your opportunity pipeline. It updates match scores, keyword relevance, and agency alignment so your capture team sees which of your existing opportunities are most affected and which emergent opportunities (task orders, recompetes, sustainment roles) rise in priority.

Cabrillo Signals Intelligence Hub — Intelligence Hub tracks the affected agencies, the named contract vehicle profile, and the NAICS/market segments in this event. Configure saved searches and alerts to notify you when follow-on solicitations, contract modifications, or VA procurement notices matching this EHRM profile appear on SAM.gov (System for Award Management) or VA portals. Use the hub to maintain a centralized record of affected task orders and partner roles.

Proposal Studio (Proposal OS) — Proposal Studio generates compliance matrices, first-draft technical approaches, and win-theme libraries tailored to the EHRM profile using your past performance and captured intelligence. It can produce ready-to-review responses for task-order amendments or re-compete scenarios and embed the event-driven risk narrative (funding uncertainty, oversight scrutiny, enhanced PHI requirements) into your proposal artifacts.

Proposal Studio Workflow Tracker — The Workflow Tracker enforces a 9-gate capture process from opportunity identification through post-submission. For this event it will automatically route compliance reviews to security and legal, track supplier certifications (FedRAMP authorization evidence, HIPAA BAAs), and assemble audit-ready documentation packages to support oversight responses or contract mod negotiations.

Call to action: use your Cabrillo dashboard to pin this briefing, enable War Room escalation rules for VA EHRM updates, and run an immediate Match Engine rescore to reprioritize capture efforts.