13-IEHP-RFP-25-06921Final.pdf

Request for Proposal Rev. 09-24-2025

Request for Proposal #25-06921

Consent and Preference Management Software

10801 6th Street Rancho Cucamonga, CA 91730

This RFP and any ensuing Addenda are available at the following link:

http://iehp.bonfirehub.com

NOTE: BIDDERS ARE RESPONSIBLE TO READ ALL INFORMATION THAT IS STATED IN THIS

REQUEST FOR PROPOSAL AND PROVIDE A RESPONSE AS REQUIRED

http://iehp.bonfirehub.com/

Timeline

1. The following timeline is based on IEHP’s requirements and will be strictly adhered to unless modified by written addendum:

Date: Description:

2/03/2026 RFP release date 2/24/26 Bidder Questions Due (2:00 p.m. PT) 3/5/2026 Bidder’s Proposals Due (2:00 p.m. PT) 4/15/26 - 4/22/26

Bidder Demonstrations

IEHP anticipates holding Bidder Presentations/Demonstrations as indicated in the RFP Timeline above. IEHP may choose to hold presentations/demonstrations with all, some or no Bidders, at its sole discretion, pursuant to this RFP.

2. The period of performance anticipated for this RFP shall be for an initial term of one

(1) year. At the end of the initial term, IEHP shall have the option to renew the Agreement for up to 4 additional one (1) year period(s), upon written notice. This RFP does not commit IEHP to award a contract, and there is no obligation by IEHP to purchase any specified amount of goods or services. IEHP will award a contract, if any, in its best interest and based on a proposal that best meets its needs as set forth herein.

3. IEHP reserves the right to award to multiple Bidders, based on IEHP’s needs, at IEHP’s sole discretion.

TABLE OF CONTENTS

A. SOLICITATION INTRODUCTION

1. Background of IEHP

2. Key Principles

3. Primary Goals

4. Program Objectives

5. Key Selection Criteria

6. Program Outcomes

7. Target Population/Historical Information

B. PROPOSAL COMPONENTS

Instructions Proposal Guidelines Bidder Acknowledgements Required Documents Required Data Company Profile Company Evaluation Criteria Scope of Services Demonstration Cost Proposal/Pricing Narrative Security Questionnaires Exhibit A: RFP Bidder Terms and Conditions Exhibit B: IEHP Standard Contract Terms Exhibit C: IT Security Documents

A. Solicitation Introduction

1. Background of IEHP

Inland Empire Health Plan (IEHP) is a local public entity of the State of California and is a rapidly growing Medi-Cal and IEHP DualChoice (HMO D-SNP [Dual Eligible Special Needs Plans]) health plan in California. Since September of 1996, IEHP has consistently focused on our mission: “We heal and inspire the human spirit”. As a result of the Healthcare Reform and participation in the California Coordinated Care Initiatives, IEHP grew to over 1 million members. With a provider network of over 7,500 providers and more than 3,200 employees, we now serve more than 1.5 million residents of the Riverside and San Bernardino counties who are enrolled in Medi-Cal, D-SNP, or Covered California.

IEHP’s Membership totals as of January 2026 are listed in the table below:

Line of Business Member Count Medi-Cal 1,423,080

D-SNP 39,028

Covered California 55,291 Total Membership 1,517,399

2. Key Principles

This RFP contains a list of requirements for Consent and Preference Management Software on behalf of IEHP. IEHP’s Procurement Department is soliciting responses from qualified vendors to address the stated requirements of this RFP. A “Qualified Bidder”, for the purpose of this RFP, is one that can reliably and independently provide the required services to IEHP for the entire term of the agreement.

3. Primary Goals

The primary goals of the Consent and Preference Management Software is to contract with a vendor in an effort to centralize and unify consent and cookie management across IEHP platforms, Automate – enable automatic detection, classification, and tracking, to integrate – connect with existing CMP, Azure AD, and IEHP systems, to comply and ensure adherence to HIPAA, CCPA, GDPR, and internal policies, analyze – provide real-time reporting and consent analytics, to scale and support IEHP’s growing user base and digital footprint, to secure and protect user data with robust authentication and encryption, and to empower and give users control over their data preferences.

4. Program Objectives

The objectives of contracting with a vendor for Consent and Preference Management Software is to enhance IEHP’s privacy compliance posture, reduce manual consent tracking, and provide a seamless, transparent experience for users managing their data preferences.

5. Key Selection Criteria

At the discretion of the Evaluation Team, 65 points will be allocated between the scope and company scores, 30 points will be assigned to price, and 5 points will be given for local preference. If demos are held, an additional 10 points will be allocated to demo scores. IEHP reserves the right, at its sole discretion, to award the contract to the responsive, responsible Bidder whose Proposal is most advantageous to IEHP;

price, delivery, and other factors considered. Additional information on evaluation criteria can be found in Exhibit A (RFP Bidder Terms and Conditions).

6. Program Outcomes

The outcome expectation of the successful program/project is this should be a fully operational, internally managed platform that ensures real-time consent visibility, reduces compliance risk, and improves user trust through transparent and consistent consent practices.

7. Target Population/Historical Information

IEHP serves over 1.5 million members annually through its digital platforms. The platform must support this scale across multiple environments and domains, with high availability and performance.

8. FDR Status - No

The services outlined in this RFP are classified as non-delegated administrative or healthcare services. The contractor will not be recognized as a first-tier, downstream, and related entity (FDR) vendor, and therefore is not subject to the associated requirements. However, if the status changes, as determined by IEHP, the contractor will be required to comply with all relevant FDR requirements.

9. Piggyback Provision

Other public agencies, municipalities, and government entities within the State of California may, at their discretion and with the awarded vendor’s consent, utilize this Request for Proposal (RFP) and any resulting agreement. Any such use shall be arranged directly between the vendor and the participating entity, independent of IEHP. IEHP does not assume any responsibility or liability for contracts entered into by other entities under this provision.

B. Proposal Guidelines

Instructions:

10. This document is provided to Bidders as a reference. Bidders are not required to enter answers to Bidder questions in this document. All required questions will be found under the associated solicitation number on the Bonfire website at http://iehp.bonfirehub.com.

a. All requested documents from each section shall be uploaded to their corresponding document slot at http://iehp.bonfirehub.com.

b. All questions from each section shall be answered by Bidders in the corresponding questionnaire and/or bid table located at

11. Follow the instructions in each section of this RFP.

12. All Proposals must include a detailed description of each proposed service to be provided.

13. Responses that do not comply with submission instructions may be delayed or not accepted for review.

14. Bidders that do not follow the bid instructions found in the Bidder Terms and Conditions document, attached hereto as Exhibit A, may be found to be “non-responsive” and disqualified from the bid process, at the sole discretion of IEHP.

15. A duly authorized officer of the organization must sign your RFP response.

16. IEHP reserves the right to modify or terminate the RFP process at any time. IEHP may amend or modify the project scope of services prior to the award of contract, as necessity may dictate, reject any and all proposals submitted (and rebid, if necessary), accept any or all proposals submitted, negotiate with any qualified source, or cancel, in part or in its entirety, this RFP if it is in the best interest of IEHP.

17. IEHP may keep submissions and negotiations confidential until the Governing Board approves the final contract and/or a contract is issued. Proposals may contain financial statements or other information which constitute a trade secret. In order to protect such data from disclosure, please identify the pages by clearly marking the applicable pages as confidential.

18. Upon receipt of this RFP, recipients are expected to read and understand the service priorities and requirements that have been defined by IEHP. Opportunity will be given to ask questions and receive clarification. The character and operating principles of the successful vendor are important to IEHP. The following sections ask questions about the history and purpose of the vendor’s company. Please answer the specific questions. If additional information would be informative to IEHP, please add it to the http://iehp.bonfirehub.com/ https://iehp.bonfirehub.com/ last question in each question set.

19. Each proposal will be reviewed by IEHP’s Procurement team to determine if the proposal is responsive to the submission requirements outlined in the RFP. A responsive proposal, for the purpose of this RFP, is one which follows the requirements of this RFP, includes all documentation, is submitted in the format specified in this RFP document, is submitted on time, and has the appropriate signatures required on each document. Failure to comply with these requirements may result in the proposal being deemed non-responsive and, therefore, rejected, at the sole discretion of IEHP.

20. An Evaluation Committee comprised of IEHP stakeholders will review each bidder’s responses to the questions contained in this RFP. If the respondent cannot represent and warrant the business requirements listed herein, the proposal may be rejected, at the sole discretion of IEHP.

21. The Evaluation Committee will review, evaluate, and score the proposals. The best response(s) may be recommended for another round of evaluation at IEHP’s sole discretion. IEHP reserves the right to conduct as many rounds of evaluations as it deems to be reasonable or necessary in the public interest. Each round of evaluation may result in modification of scores, further clarification or addenda being issued, and changes in the RFP process.

22. Upon evaluation of the criteria and the rating and ranking, the Evaluation Committee may choose to conduct an oral presentation/demonstration with any bidder(s). Upon completion of the oral presentations/demonstrations, the Evaluation Committee members may re-evaluate, re-score and/or re-rank the proposals remaining in consideration.

23. The price proposal will be evaluated relative to the combination of the technical proposal, including an evaluation of how well it matches the bidder’s understanding of IEHP’s needs described in this Solicitation, the bidder’s assumptions, and the value of the proposed solution and/or services. The pricing evaluation is used as part of the evaluation process to determine the bidder that will provide the best overall value to

IEHP.

24. IEHP may direct negotiations with its first-choice bidder, negotiations with multiple

Bidders, and/or may request for best and final offers. The discussions may include price and conditions attendant to price. This RFP includes IEHP’s standard, required contract terms, attached hereto as Exhibit B, which IEHP expects to be incorporated into a final contract form together with other terms and conditions. Failure to accept IEHP’s standard terms may result in the Bidder being removed from consideration.

25. Notwithstanding the foregoing, if IEHP believes IEHP and the said bidder(s) cannot reach agreement on a contract, IEHP shall exercise its right to terminate or suspend negotiations and may begin negotiations with the other bidder(s). This process may continue until a contract acceptable to IEHP has been executed or all proposals are rejected. No bidder shall have any rights against the IEHP arising from such negotiations or termination thereof.

26. A Bidder’s protest of any IEHP decision to eliminate the Bidder from further consideration for an award, or to award a contract to another Bidder, shall be made in writing and submitted to IEHP by 5:00 p.m. on the fifth (5th) day following notice to the Bidder or award of the contract, whichever occurs first. The written protest shall be submitted to procurement@iehp.org The written protest shall fully describe each and every basis for protest and shall describe the manner in which IEHP failed to act within its discretion or abused its discretion. For avoidance of doubt, IEHP’s intent is to reserve its discretion under this RFP to maximum amount allowed by law, and this RFP shall be construed in favor of reserving IEHP’s discretion in all circumstances. Failure to timely and completely submit a protest shall constitute a final and conclusive waiver of any and all rights to bring a legal action to challenge an award of a contract pursuant to this RFP. IEHP will not consider untimely protests or protests where the Bidder failed to timely object pursuant to Section 1 of the Bidder Acknowledgements below. All Bidders expressly acknowledge that IEHP may proceed with awarding and implementing a contract pursuant to this RFP while any protest, or legal action related to a protest, is pending.

1. Clarifications, Exceptions, or Deviations

a. All Bidders shall describe any exception or deviation from the requirements of the RFP in Question Set 1 of Questionnaire Q-07GU. Each clarification, exception, or deviation must be clearly identified. If your firm has no clarifications, exceptions, or deviations, a statement to that effect shall be included. IEHP’s standard contract terms are discussed in the RFP Bidder Terms and Conditions document incorporated herein by this reference, and attached hereto as Exhibit A.

b. Any objection by a Bidder to the prescribed procedures, terms, conditions or requirements set forth in this RFP or any of its component documents must be submitted to IEHP as part of, or contemporaneously, with the Bidder’s proposal. Failure to timely submit an objection, or failure to submit a proposal, shall constitute a final and conclusive waiver of any and all rights to thereafter such objection for any purpose including, without limitation, any protest or legal action to challenge an award of a contract pursuant to this

RFP.

c. All Bidders must specify any additional documents that IEHP will need to sign along with the standard Agreement (e.g., appendices, requirements documents, third-party agreements, service level agreements, compliance certifications, etc.) in Question Set 1 of Questionnaire Q-07GU. These documents must also be uploaded to the “Bidder Attachments” document slot.

d. All Bidders must specify any additional costs that IEHP will be required to pay outside of the standard agreement (e.g., third-party fees) in Question Set 1 of Questionnaire Q-07GU. These costs should also be included in Bid Table BT-

BT-18TZ

2. Evidence of Insurability/Business Licenses

All Bidders shall submit evidence of all required insurance in the corresponding document slot on the Bonfire website. An Acord cover page will suffice and if awarded the contract the bidder has ten (10) calendar days to produce the required insurances, including a certified endorsement naming IEHP as additionally insured.

The bidder shall certify to the possession of any and all current required licenses or certifications. Do not purchase additional insurance until this bid has been awarded.

Provide a copy of current business license or other applicable licenses. Failure to provide the required document may be grounds for disqualification of bidder from the RFP process, at IEHP's discretion.

3. IEHP General Compliance Requirements for Contractors

If the services provided pursuant to this RFP are designated as delegated administrative or healthcare services, the contractor will be considered a First-Tier, Bidder Acknowledgements

Downstream, and Related Entity (FDR) vendor. IEHP will require all temporary FDR staff and contractors to participate in General Compliance Training as required by State and Federal regulations. The training is followed by a quiz designed to check the bidder’s knowledge about compliance topics. This is a mandatory training which includes the following objectives: understand the purpose of a Compliance Program and its functions; learn the 7 Elements of an Effective Compliance Program; and learn about IEHP’s Fraud, Waste and Abuse and HIPAA Programs, including reporting requirements and how to report suspected non-compliance.

4. IEHP Background Check Requirements for Bidders

IEHP may require all individuals assigned to provide services to IEHP pursuant to this RFP, to undergo a background check prior to commencement of performance, at the Contractor’s expense, to include any and all background checks required by law.

5. Out of Country Services Notice

a. IEHP will only consider service offerings within the continental United States, defined as the 49 States including Alaska and the District of Columbia: excluding Hawaii.

b. Proposed solutions that create, transmit, receive and/or maintain IEHP data must always reside within the United States.

c. IEHP’s data must always remain in the United States.

d. All persons, electronic processes, information systems, and computer devices accessing IEHP’s information systems and/or data in any capacity as part of the proposed solution must be physically located in the United States.

6. Executive Order N-6-22 – Russia Sanctions

On March 4, 2022, California Governor Gavin Newsom issued Executive Order N-6- 22 (the EO) regarding Economic Sanctions against Russia and Russian entities and individuals. “Economic Sanctions” refers to sanctions imposed by the U.S.

government in response to Russia’s actions in Ukraine, as well as any sanctions imposed under state law. The EO directs all California state agencies and departments to terminate contracts with, and to refrain from entering any new contracts with, individuals or entities that are determined to be a target of Economic Sanctions. All contractors and grantees are obligated to comply with the Economic Sanctions. Accordingly, should the State of California (the State) or IEHP determine Contractor is a target of Economic Sanctions or is conducting prohibited transactions with sanctioned individuals or entities, that shall be grounds for termination of this Agreement. Contractor shall be provided with advance written notice of such termination, allowing Contractor at least thirty (30) calendar days to provide a written response. Termination shall be at the sole discretion of the State or

IEHP.

All required documents listed below shall be uploaded to their corresponding document slot in the Requested Information section at http://iehp.bonfirehub.com.

Note: Failure to provide the required documents listed below at time of bid may be grounds for disqualification of bidder from the RFP process, at IEHP's sole discretion.

1. Principal Certification Binding Bidder’s Response (IEHP-provided form)

2. Certification of Non-Debarment (IEHP-provided form)

3. Non-Collusion Declaration (IEHP-provided form)

4. Local Preference Affidavit (If applicable – IEHP-provided form)

5. Contractor’s Certificate Regarding Workers’ Compensation (IEHP-Provided form)

6. Acknowledgment of Non-Negotiable Contract Terms (IEHP-Provided form)

7. Company W-9 Form listing company’s Tax Identification Number (TIN)

8. Evidence of Insurability (ACORD Certificate of Insurance)

9. Business License(s)

10. Proof of Registration: Documentation verifying corporate registration with the

California Secretary of State or if not a corporation, proof of tax registration with the California Franchise Tax Board.

11. Credentials/Certifications/Licenses Document

12. Account Management Narrative

13. List of three (3) contracts of similar value awarded to your company in the past three

(3) years. Include the year, type of services, dollar amounts, services provided, location, contracting company, contact name, and phone number.

14. Policy and Procedures document detailing Bidder’s background checking procedures and the name of any external company utilized to perform this service.

15. Pricing Narrative

16. Redacted Pricing Narrative

17. IEHP Security Risk Assessment

18. Data Sharing Assessment

19. Vendor Security Documents Checklist

20. Bidder’s Security Documents

21. Sample Standard Reports

22. Sample Proposed Document

23. Annual Report for publicly traded companies, or if privately held, details of financial stability.

24. Bidder’s Standard Agreement Template, including detailed pricing and Scope of

Work (for consideration). If not available, include a detailed proposal on Bidder’s letterhead including detailed pricing and Scope of Work (for consideration).

25. References Questionnaire Q-12GO

26. Cost Proposal Bid Table BT-18TZ

27. Company Profile and Evaluation Criteria Questionnaire Q-28DF

28. Bidder Response Questions Questionnaire Q-07GU

29. Screenshots/Descriptions of Admin UI for Bulk cookie/provider management, policy configuration, and consent rule authoring

Required Documents

30. High-Level Architecture Diagram.

31. SOC 2 Type II, ISO 27001, or HITRUST Certifications.

32. Sample Strings and Language List.

33. Pre-Recorded Demo (Optional)

All required data listed below shall be answered in the Requested Information section at

Note: Failure to provide the required data listed below at time of bid may be grounds for disqualification of bidder from the RFP process, at IEHP's sole discretion.

1. IEHP is a public agency with a Board of Directors composed of elected officials and public members. The elected officials are restricted from voting on any action concerning a contract whose owners have made a campaign contribution of $250 or more in the previous 12 months. To assist them in their decision-making process, please indicate the owners of the company, and if any contributions were made to the Elected Officials.

2. In accordance with 42 C.F.R. 438.610, 422.503 (b)(4)(vi)(F), 423.504 (b)(4)(vi)(F) and California Welfare and Institutions Code, §§ 14043.6 and 14123, IEHP is prohibited from employing, contracting, or issuing payments to an individual or entity that is excluded, ineligible, or terminated from participation in State and Federal health care programs. Contract awards are contingent upon the bidder, its principals’ and subcontractors’, eligibility to participate in State and Federal health care programs.

Bidders must certify that it or any of its subcontractors do not appear on State and Federal exclusionary lists in the Requested Data section of their response on Bonfire.

3. Bidder’s DUNS Number

Required Data

Company Profile

This section of the proposal is designed to establish the Bidder as an entity with the ability and experience to operate the program or provide goods and/or services as specified in the RFP. The Company Profile should be concise and clear, including descriptive information regarding service delivery. All Bidders shall answer these questions in Question Set 2 of Questionnaire Q-28DF, unless specifically stated otherwise below. Questions that also require the upload of a (Required Document) to the associated document slot are noted.

Questions that require an answer in the form of (Required Data) are also noted.

2.1 Company Name and Corporate Structure:

2.1.1 Business name and legal business status (i.e., partnership, corporation, etc.).

2.2 Company overview related to RFP services or activities performed, including:

2.2.1 Company hierarchy (President, Vice President, Company Officers, etc.) and an organizational chart. The organizational chart shall clearly identify all staff members that will provide services under this contract. Upload this document to the corresponding document slot on Bonfire.

2.2.2 Number of years in business under the present business name, as well as prior business names, and the number of years of experience providing the proposed, equivalent, or related services.

2.2.3 Location of the office from which the work under this contract will be provided, and the staff allocation at that office.

2.3 Provision of Services:

2.3.1 Please provide a detailed response discussing how Bidder plans on providing the services requested in this RFP; specifically, whether services will be provided by Bidder’s own forces, subcontractors.

2.4 Financial Interests:

2.4.1 Please indicate whether the Bidder holds controlling or interests in any other organization or is owned or controlled by any other person or organization. If none, please state N/A. Governmental agencies are exempt from this requirement.

2.4.2 Provide any financial interests in any other business. Individuals who are personally performing the contracted services and governmental agencies are exempt from this requirement.

2.4.3 Please indicate if the Bidder is privately or publicly held. If private, please provide details of financial stability. If public, please provide ticker symbol and copy of your most recent annual report.

2.5 Company Structure/Staffing:

2.5.1 Please describe any organizational changes (mergers, acquisitions, divestitures) that have occurred in the past five (5) years.

2.5.2 Please indicate whether Bidder has organizational changes (mergers, acquisitions, divestitures) planned within the next five (5) years.

2.5.3 Please indicate whether Bidder has any layoffs, or personnel expansions planned within the next five (5) years.

2.6 Legal:

2.6.1 Provide a detailed explanation of any litigation involving the Bidder or any principal officers thereof in connection with any contract within the last five (5) years. Is your firm, or the principals corresponding with your firm, under investigation, being sued, suing, or affiliated in any lawsuit or alternative dispute resolution with any governmental agency? If none, state N/A.

2.6.2 Has your company ever been or are you currently subject to any federal or state regulatory enforcement action including but not limited to exclusion and/or suspension from participation in a federal program?

2.6.3 List the officers of your organization who are authorized to negotiate the agreement with IEHP if awarded, and their positions within your organization.

2.6.4 Provide details of any failure or refusal to complete a contract. If none, that must be stated.

2.6.5 Has your company ever been or are you currently subject to any federal or state regulatory enforcement action including but not limited to exclusion and/or suspension from participation in a federal program?

2.6.6 State whether your company, or the principals corresponding with your company, are under investigation, being sued, suing, or affiliated in any lawsuit or alternative dispute resolution with any governmental agency. If so, please provide details.

2.7 Certification of Non-Debarment: (Required Document)

2.7.1 IEHP receives Federal and State funds. All Bidders must sign and submit the Certification of Non-Debarment document provided by IEHP in Bonfire that verifies that the bidder is not listed on any of the exclusion lists notated in the section below.

If awarded a contract, awarded vendor must notify IEHP immediately if debarred at any time during the contract period.

a. The Department of Health & Human Services (DHHS), Office of Inspector General (OIG), and List of Excluded Individuals and Entities (LEIE). Please visit https://exclusions.oig.hhs.gov.

b. General Services Administration (GSA), and the System for Award Management (SAM.gov). Please visit https://www.sam.gov.

c. California Department of Health Care Services (DHCS), and Medi-Cal Suspended and Ineligible Provider List (S&I List). Please visit https://mcweb.apps.prd.cammis.medi-cal.ca.gov/references/sandi.

d. Medicare Opt-Out List. Please visit https://data.cms.gov/tools/provider-opt-out-affidavits-look-up-tool.

2.8 Financial Stability:

2.8.1 Please detail your insurance coverage, including the name of the carrier and coverage level for General Liability.

2.8.2 Please detail your insurance coverage, including the name of the carrier and coverage level for Tech Errors & Omissions (E&O).

2.8.3 Please detail your insurance coverage, including the name of the carrier and coverage level for Cyber Crime Insurance

2.8.4 Please provide your revenue for last five (5) fiscal years.

2.8.5 Please provide your profit/(loss) for last five (5) fiscal years.

2.8.6 Please provide your company ratings (i.e., A.M. Best, Better Business Bureau, etc.).

2.8.7 Please provide your annual R&D budget for the last five (5) fiscal years (break out by product offerings).

2.8.8 Explain how your company is planning to meet the increase in demand for your product (including implementation, training, and support) over the next five (5) years.

2.9 Eligibility to Participate in Federal and State Health Care Programs (Required Data)

2.9.1 In accordance with 42 C.F.R. 438.610, 422.503 (b)(4)(vi)(F), 423.504 (b)(4)(vi)(F) and California Welfare and Institutions Code, §§ 14043.6 and 14123, IEHP is prohibited from employing, contracting, or issuing payments to an individual or entity that is excluded, ineligible, or terminated from participation in State and Federal health care https://exclusions.oig.hhs.gov/ https://www.sam.gov/ https://mcweb.apps.prd.cammis.medi-cal.ca.gov/references/sandi https://data.cms.gov/tools/provider-opt-out-affidavits-look-up-tool programs. Contract awards are contingent upon the bidder, its principals’ and subcontractors’, eligibility to participate in State and Federal health care programs.

Bidders must certify that it or any of its subcontractors do not appear on State and Federal exclusionary lists in the Requested Data section of their response on Bonfire.

Company Evaluation Criteria

This section of the proposal is designed to further establish the Bidder as an entity with the ability and experience to operate the program or provide goods and/or services as specified in the RFP. The Company Profile should be concise and clear, including descriptive information regarding service delivery. All Bidders shall answer these questions in Question Set 3 of Questionnaire Q-28DF, unless specifically stated otherwise below. Questions that also require the upload of a (Required Document) to the associated document slot are noted.

3.1 Differentiators

3.1.1 What do you consider to be your company’s strengths, and how do you see your company as differentiated from other Bidders?

3.1.2 Is there any other information you would like IEHP to know about your company including value-added services?

3.2. Account Management Team (Required Document)

3.2.1 In the corresponding document slot on Bonfire, please provide the name(s) and general background(s) of each member of your account management team that will be assigned to IEHP. Include the information below:

• Functional area to which each person reports

• Years of service with your organization

• Total years of experience with commercial product implementation and operations

• Number of public entity accounts currently handled

• General size of the accounts (in terms of number of employees)

3.3 Organizational Information:

3.3.1 Provide a summary of the work plan and/or methodology and physical resources (staff and equipment) your company will commit to ensure successful services are provided pursuant to this RFP.

3.3.2 Will IEHP have a dedicated team assigned throughout the implementation? If so, who? Provide the organizational structure and experience for each team member, if not outlined above.

3.3.3 How would the account service team be structured after the implementation?

3.3.4 What is your company’s Mission Statement?

3.3.5 Summarize your company’s billing procedures.

3.3.6 What office will support IEHP?

3.3.7 Please indicate your company’s total number of employees this year and last year.

3.4 Administration:

3.4.1 Describe any customer and/or member services available on-line.

3.4.2 Could IEHP link their website to your website?

3.4.3 Do you have a customer service department? If so, what is the phone number, and the hours of operation?

3.4.4 Please describe how your customer service department is organized. Would IEHP receive a dedicated team?

3.5 Experience:

3.5.1 Describe your company’s experience/history with providing the services requested in this RFP.

3.5.2 Describe your company’s experience with Health Maintenance Organizations.

3.5.3 Describe your company’s relationship/experience with governmental regulators (e.g., Department of Health Services, Department of Managed Healthcare, and the Centers for Medicare and Medicaid Services).

3.6.1 Credentials/Resumes/Certifications/Licenses: (Required Document)

In the corresponding document slot on Bonfire, please provide information for all employees/subcontractors responsible for administering or providing services.

Provide a summary list of the organizational personnel that will actively participate and contribute their skills to this project. Include in this list:

• Name

• Job title

• Work location and

• Responsibilities

• Qualifications/Experience

• Relevant experience in projects of similar size and complexity. (Responses may be one page per individual.)

• Education

• Certifications/licenses, if applicable

• Years of service with your organization

• Total years of experience

• List other pertinent information that will assist in evaluating Bidder’s qualifications.

3.7 Awarded Contracts: (Required Document)

3.7.1 In the corresponding document slot, provide a list of three (3) contracts of similar value awarded to your company in the past three (3) years. Include the year, type of services, dollar amounts, services provided, location, contracting company, contact name, and phone number.

Scope of Services

1.0 Bidder Response Questions (Questions in this section must be answered in Questionnaire Q-07GU, unless specifically stated otherwise)

1. Requirements

1.0 Platform Capabilities

1.01 Describe how your platform manages consent creation, updates, withdrawals, and historical audit trails across web and mobile. Include data model, event logging, and reconciliation.

1.02 Explain your automated cookie/tracker/pixel detection capabilities, classification taxonomy (e.g., Strictly Necessary, Analytics, Advertising), and false positive/negative handling.

1.03 Confirm support for multiple environments (public website(s), member portal(s), mobile apps). Describe any SDKs or tags required.

1.04 Provide screenshots/descriptions of admin UI for bulk cookie/provider management, policy configuration, and consent rule authoring. Attach screenshots to Bonfire Requested Documents.

2.0 Integration & Architecture

2.01 Provide REST API specs for consent retrieval/write, cookie inventory, reporting exports. Include auth, rate limits, and versioning strategy.

2.02 Confirm support for Azure Active Directory authentication (OIDC/SAML).

Detail RBAC, groups/claims mapping, and SCIM (if supported).

2.03 Describe integration approach with existing CMP and IEHP privacy/cookie policies (e.g., policy versioning and propagation).

2.04 Outline platform architecture (microservices, containers, orchestration).

Include HA/DR patterns and fault tolerance. Attach high-level architecture diagram to Bonfire Requested Documents.

3.0 Security & Compliance

3.01 Describe how the platform supports compliance with HIPAA and CCPA, including consent records. Do Not Sell/Share purpose/legitimate interest.

Please attach SOC 2 Type II, ISO 27001, or HITRUST certifications.

3.02 Detail encryption in transit (TLS 1.2+) and at rest (AES-256), key management, audit logs, and tamper-evidence.

3.03 Explain RBAC, least privilege, admin action auditing, and support for break-glass procedures.

3.04 Describe support for Data Subject Requests (access/rectify/delete), consent withdrawal, and record retention/expiration configurations.

4.0 Privacy Controls & UX

4.01 Provide examples of end-user consent banners, preference centers, granular toggles, and layered notices (mobile & web).

4.02 Confirm WCAG 2.1 AA compliance for all user-facing components and describe testing approach and assistive tech compatibility.

4.03 Describe localization/i18n support (languages, right-to-left, locale-specific regulatory text). Attach sample strings and language list.

5.0 Reporting & Analytics

5.01 Describe built-in dashboards (consent opt-in rates, declines, pending, trends), drill-downs, and export formats (CSV/JSON).

5.02 Explain audit log coverage (admin actions, policy changes, versioning) and retention configuration.

5.03 Provide query/report capabilities for individual user consent history with timestamps and prior states.

2. PRE- RECORDED DEMO: (OPTIONAL)

The Bidder’s Pre-Recorded Demo should not exceed 30-minutes in duration and address (at a minimum) the following:

A. A comprehensive view of the solution as listed below:

• Dashboard overview

• High level features and benefits of the software solution

• Describe customer support overview

Upload to the corresponding document slot at http://iehp.bonfirehub.com.

*PLEASE NOTE: Bonfire has a maximum file size of ~1000MB (1 GB), please provide an external link from a video hosting platform of your choice, such as from YouTube or Vimeo, for example: https://youtu.be/4bCGSQeqa3c. or https://vimeo.com/442270079.

https://vimeo.com/442270079

Demonstration

Bidder Solution Demonstration Agenda

RFP #25-06921

CONSENT AND PRFERENCE MANAGEMENT

Vendor Name

Thank you for responding to IEHP’s solicitation for Request for Proposal #25-06921 Consent and Preference Management Software. You have been scheduled to demonstrate your proposed solution during the following date and time:

Date: TBD Time: TBD Location: Virtual – Microsoft Teams Schedule: TBD

CONSENT AND PREFERENCE MANAGEMENT PROJECT BIDDER DEMONSTRATIONS

The intent of the demonstrations is for bidders to display Consent and Preference Management Software solutions/system and business features as they relate to Use Cases provided by IEHP’s Evaluation Committee. During the demonstration, each bidder will be evaluated on how well their solution addresses the Consent and Preference Management Software needs of IEHP. The Evaluation Committee, which consists of three IEHP Team Members, will be in attendance during assigned times determined by their area(s) of expertise.

IEHP expects the bidders to demonstrate the criteria listed in the RFP for Consent and Preference Management Software. While bidders have some degree of freedom to demonstrate the features that they find appropriate, IEHP expects demonstrations that follow a workflow sequence as represented in the Use Cases below. In addition, particular features and business requirements listed in the RFP should be shown.

The demonstration session will start and end on time, and consist of the following:

Schedule and Topics

Topic for Discussion Description Allotted Time Consent Banner & Preference Center UX (Web

+ Mobile)

Demonstrate initial consent banner, granular toggles, layered notices, and preference center for both web and mobile. Show opt-in/opt-out flows, withdrawal, and persistence across sessions/devices.

20 minutes

Cookie/Tracker Detection & Scan Report

Run automated crawler/scan, show classification taxonomy, review sample scan report, and demonstrate proposing configuration changes with admin approval workflow.

15 minutes

Admin Bulk Management & Policy Versioning

Show bulk add/edit of cookies/providers, policy versioning (effective dates, rollback), multi-domain governance, and audit trails for admin actions.

15 minutes

Azure AD SSO & RBAC

Demonstrate login with Azure AD, role-based access control (admin/viewer), groups/claims mapping, and session management.

10 minutes

API Integration & Data Export

Walk through REST APIs for consent read/write, cookie inventory, and reporting exports (CSV/JSON).

Include rate limits and versioning strategy.

Reporting & Analytics

Present dashboards (opt-in/decline rates, trends, drill-downs), consent history search by user, and scheduled report exports.

Accessibility & Localization

Validate WCAG 2.1 AA compliance features, keyboard navigation, screen-reader labels, and language switching with localized policy text.

Reliability & Release Management

Review HA/DR architecture, uptime history, incident dashboards, release cadence, patching process, and backwards compatibility/deprecation policies.

Cost Proposal/Budget Narrative

In Bid Table BT-18TZ, please submit pricing for the services requested in this RFP. Cost Proposals will be disclosed to the evaluators after the evaluation of the technical proposals has been completed. IEHP reserves the right to negotiate final fees with the selected Bidder(s). Proposals must fully describe all costs of charges to IEHP as part of this service/project. As stated in the Cost Proposal, Bidders must provide fully inclusive blended rates, which are all-encompassing of the Bidder’s project-related or supported expenses, including travel expenses. Bidders may also include any other documents as information to further explain the proposed costs. Any special government rates or considerations should be included in Bidder’s quotation.

Cost proposal must be all-inclusive and include, but not be limited to, administration, travel, training and related costs.

Cost Proposal

SERVICE

YEAR

ANNUAL FEE

OTHER FEES

(IF APPLICABLE)

OTHER FEES

(IF

APPLICABLE)

OTHER FEES

(IF

APPLICABLE)

TOTAL

COST

YEAR 1

YEAR 2

YEAR 3

YEAR 4

YEAR 5

TOTAL

COST

*BONFIRE WILL ALLOW FOR UP TO THREE (3) COLUMNS FOR “OTHER FEES” (IF APPLICABLE)

PRICING NARRATIVE (Upload EACH to its corresponding document slot)

1. Pricing Narrative (WITH PRICING):

In a separate document, provide a timeline with major milestones up to implementation.

Define your proposed method of reimbursement for services at each stage of this project provided through your company and elaborate on the costs provided within the Bid Table submission. IEHP customarily prefers itemized billing on a project basis (or as major milestones are accomplished for very large projects) with specific deadlines identified in the proposal.

Include a description of any additional costs that may be incurred in completion of this project and the circumstances that would trigger those costs. Please include the pricing for these additional costs in the Bid Table, not in the pricing narrative.

2. Pricing Narrative (WITH REDACTED PRICING):

Upload a copy of the above requirement with all pricing redacted.

IT Security Documents

As part of the requirements related to services that will be provided under this Request for Proposal (RFP), Bidders must complete a detailed Security Risk Assessment. This assessment is provided in the form of a spreadsheet with five distinct tabs, each covering different aspects of IT security.

Bidders are required to thoroughly answer all questions in each tab.

In addition to the Security Risk Assessment, Bidders must also complete a Data Sharing Assessment. This assessment addresses what data will be shared and with whom it will be shared, the security measures in place to protect the data, and compliance with relevant data protection regulations.

Furthermore, Bidders must review a checklist of security documents. This checklist outlines the required security artifacts that Bidders shall upload to the associated document slot along with their proposal response.

All completed documents, including the Security Risk Assessment spreadsheet, Data Sharing Assessment, and security documents must be submitted along with the proposal response. Failure to include any of these documents may result in disqualification from the bidding process.

Exhibit A

Terms and Conditions

NOTE: BIDDERS ARE RESPONSIBLE TO READ ALL INFORMATION THAT

IS STATED IN THIS DOCUMENT

TABLE OF CONTENTS

A. INSTRUCTIONS AND CONDITIONS

1. Bidder Instructions

2. Definitions

3. Preparation of Responses

4. Inquiries by Bidders

5. Modifications/Amendment

6. Cancellation or Modification of Procurement

7. Withdrawal of Bids

8. Submitting Proposals

9. Evaluation Process

10. Proposal Selection and Contract Negotiations

11. HIPAA Business Associate Agreement (if applicable)

B. ATTACHMENTS

Attachment A: Principal Certification Binding Bidder’s Response Attachment B: Certification of Non-Debarment Attachment C: Non-Collusion Declaration Attachment D: Local Preference Affidavit Attachment E: Contractor’s Certificate Regarding Workers’ Compensation

1. Bidder Instructions

a. Bonfire is a third-party web-based e-Procurement service provider utilized by IEHP for solicitations. Registering takes just a few minutes and is completely free.

For future bidding, opportunities please also register online at

b. Format – Use the electronic format provided by http://iehp.bonfirehub.com. If submitting more than one bid, separate the bid documents.

c. Return of Bid/Closing Date/Return – All proposals shall be submitted electronically to http://iehp.bonfirehub.com no later than 2:00 p.m. Pacific Time (PT) on the closing date listed in the Timeline Section of the Request for Proposal, unless otherwise stated in the Request for Proposal. Bid responses not received by IEHP Procurement on or before the closing date and time will not be accepted.

IEHP will not be responsible for, and will not accept, late bids due to slow internet connection, or incomplete transmissions. If the Bidder cannot upload the bid response to the http://iehp.bonfirehub.com website, delivery of the bid response is accepted at Inland Empire Health Plan, 10801 Sixth Street, Rancho Cucamonga, CA 91730, by 2:00 p.m. on or before the bid closing date and time.

d. Pricing/Delivery/Terms/Tax – All pricing shall be quoted F.O.B. Destination, (e.g., cash terms less than 20 days should be considered net) excluding applicable tax, which is a separate line item. IEHP reserves the right to designate method of freight. IEHP is exempt from Federal Excise tax but pays California Sales Tax. In the event of an extension error, the unit price shall prevail.

e. Other Terms and Conditions – The terms and conditions as indicated in this document and/or attached are hereby included with full force and like effect as if set forth herein.

f. Period of Firm Pricing – unless stated otherwise elsewhere in this document, prices shall be firm for 120 days after the closing date, and prior to an award being made. IEHP reserves the right to ask for an extension of firm pricing if conducting active proposal evaluations.

g. Specification/Changes – Whenever brand names are used, the words "or equal" shall be considered to appear and be a part of the specification. If quoting another make or model, state this and replace IEHP’s nomenclature with that which you are proposing. If no make or model is stipulated, insert yours. Attach applicable specifications and/or brochures. Variations in manufacturers, design, etc., may be acceptable. Bidders are encouraged to offer alternatives. However, IEHP reserves the right to reject those alternatives as nonresponsive.

h. Recycled Material – Wherever possible, IEHP is looking for items made from, or containing in part, recycled material. Bidders are encouraged to bid items containing recycled material as an alternative for the items specified. However, IEHP reserves the right to reject those alternatives as nonresponsive.

i. Bidders must submit their questions online at http://iehp.bonfirehub.com and must be in written format. All responses to Bidder’s questions will be posted online at http://iehp.bonfirehub.com

2. Definitions

a. As used herein, “Addendum” refers to an amendment or modification to the Request for Proposal (RFP).

b. As used herein, “ARMC” means “Arrowhead Regional Medical Center”

c. As used herein “Bid” refers to the proposal submitted by a Bidder on the Bid Form consistent with the Instructions to Bidders, to complete the Work for a specified sum of money and within a specified period.

d. As used herein, “Bidder” refers to an individual, firm, partnership or corporation that submits a qualified Bid for the Work, either directly or through a duly authorized representative.

e. As used herein “Board” refers to IEHP’s Governing Board.

f. As used herein, “CCA” means “Covered California”

g. As used herein, “Contractor” refers to any employee, agent, or representative of the contract company used in conjunction with the performance of the contract.

For the purposes of this RFP, Contractor, Vendor, Bidder and Respondent are used interchangeably.

h. As used herein, “DHCS” means California’s “Department of Health Care Services.”

i. As used herein, "FDR” means “First-Tier, Downstream and Related Entities”

j. As used herein, “HFP” means “Healthy Families Program”.

k. As used herein, “HIPAA” means the Health Insurance Portability and Accountability Act of 1996, Public Law 104-91, enacted August 21, 1996, and the regulations promulgated thereto.

l. As used herein, “HITECH” means the Health Information Technology for Economic and Clinical Health Act provisions of the American Recovery and Reinvestment Act of 2009, Public Law 111-5, enacted February 17, 2009.

m. As used herein, “IEHP” means “Inland Empire Health Plan”.

n. As used herein, “IPA” means “Independent Practice Associations”.

o. As used herein, “JPA” means “Joint Powers Agency” specifically for the counties of San Bernardino and Riverside.

p. As used herein, “MQs” refers to minimum qualifications.

q. As used herein, “RUHS” means “Riverside University Health System”

r. As used herein, “RFP” means “Request for Proposal”.

s. As used herein, “PT” means “Pacific Time”

3. Preparation of Responses

Before submitting a Proposal, each Bidder is expected to thoroughly examine the specifications in the solicitation, and all other related contractual documents included in this RFP, including subsequent amendments to the RFP. Failure to do so will be at the Bidder’s risk and may bar the Bidder’s performance if a contract is awarded pursuant to this RFP.

Each Bidder shall review and complete all Required Documents according to their instructions and submit them as part of the Proposal.

Each Bidder must be satisfied by personal examination and by such other means as it may prefer, as to the actual conditions and requirements under which…