2024-1600-0249 --1624-020 RFP - Amendment #5.pdf

STATE OF ALASKA

Department of Health Division of Finance and Management Services

State of Alaska National Electronic Disease Surveillance System Base System (NBS) Interface, Application, and Development Support

RFP 2024-1600-0249/1624-020

Amendment No. Five

November 15, 2024

This amendment is being issued to provide answers to inquiries.

Important Note to Offerors: You must sign and return this page of the amendment document with your proposal. Failure to do so may result in the rejection of your proposal. Only the RFP terms and conditions referenced in this amendment are being changed. All other terms and conditions of the RFP remain the same.

Anneliese Zlitni, Procurement Officer

COMPANY SUBMITTING PROPOSAL

Email: anneliese.zlitni@alaska.gov

AUTHORIZED SIGNATURE

DATE

The following inquiries are here presented and answered:

Question 1a: [Re: Section 3.02 – Scope of Work:] The RFP mentions the state’s intent to ‘pilot’ NBS 7X in the CDC Azure cloud. We are aware there is a CDC pilot contract that states must sign to be part of this. Has AK already executed this agreement, or do you intend to?

Answer 1a: Alaska is in discussions with CDC with the intent to formalize an agreement to host.

Question 1b: Will this contract be made available to the NBS support vendor given obligations and work effort that could be required by the vendor?

Answer 1b: The substance of the agreements will be shared with the vendor.

Question 1c: Further, does this contract create obligations for the vendor to any specific CDC deliverables?

Answer 1c: No.

Question 2: [Re: Section 3.02 – Scope of Work:] Many of the IT contract requirements within the RFP cannot be answered by [Company A] given [Company A] would [not] be the hosting vendor. Will the CDC be answering these requirements and providing that information to the state and vendor to ensure compliance?

Answer 2: We anticipate respondents will provide two responses to the RFP: one where the main NBS application is hosted in the single-tenant CDC Azure cloud, and the other where the main NBS application is hosted in a third-party cloud in a SaaS model. We believe that the majority of IT contract requirements will be achievable through the new NBS 7 Application Programming Interface (APIs). We acknowledge that there will be some IT requirements where a ticket may need to be entered with the CDC team with direct access to the database.

Question 3: [Re: Section 3.02 – Scope of Work:] [Company A] has communicated with the CDC around the topic of vendor access and the ability for a vendor like [Company A] to support a CDC Azure hosted NBS STLT. Bottom line, [Company A] (or any vendor) will NOT have anything other than front-end application access. Neither the state nor a vendor will have the ability to support, maintain, or troubleshoot any process or part of the NBS that requires access beyond front-end application access. At present, a large portion of the work [Company A] performs for Alaska does require backend or enhanced NBS access beyond just application access. Has the state considered this or spoken to the CDC around this topic? As it stands, Alaska will lose services they currently depend on day to day and week to week. CDC has made it clear they will ONLY serve as a hosting solution and will not be providing other services. How does Alaska plan to fill this gap and does the state understand that vendor support and services will be scaled back and considerably reduced in the CDC Azure cloud?

Answer 3: The Authority to Operate (ATO) for NBS in the CDC Azure environment was just recently approved, and thus the CDC was able to provide a clearer description of the landscape of CDC hosting. Per the terms of the ATO, non-CDC-onboarded contractors will not have direct access to the database. Respondents, as SOA contractors, will not have direct access to the NBS database. However, the NBS 7 application provides several APIs that we believe will allow most IT contract requirements to be achieved. As stated in a previous answer, there may be an anticipated, limited number of IT requirements where a ticket will need to be entered with the CDC team that has direct access to the database. APIs in NBS 7 include those for inbound ingestion and outbound notifications. The CDC team can replicate the reporting data base (RDB), which can then be hosted outside of the CDC Azure cloud. Any integrations, i.e., Rhapsody, will need to be hosted outside of the CDC Azure cloud.

Question 4: [Re: Section 3.02 – Scope of Work:] Related to question 3 above, has the state requested from the CDC an outline of what specific access they will provide to vendor given the state’s needed support?

Answer 4: In order to access CDC networks, a vendor must be a CDC-onboarded contractor. If a company is a vendor to a state, but is not a vendor to the CDC, they will not be able to administer CDC-managed infrastructure. This would not prevent vendors from asking the CDC to provide troubleshooting information or make changes on behalf of a state.

Question 5: [Re: Section 3.02 – Scope of Work:] There are several sections in this RFP that cannot be actioned, completed, or delivered by a vendor given hosting will be in the CDC Azure cloud. Are these sections still to be answered by a vendor? Or should they only be answered as it relates to a potential vendor hosted cloud solution?

Answer 5: As noted in an above question, we anticipate respondents will provide two responses to the RFP: one where the main NBS application is hosted in the single-tenant CDC Azure cloud, and the other where the main NBS application is hosted in a third-party cloud in an SaaS model. We believe that the majority of IT contract requirement will be achievable through the new NBS 7 APIs. We acknowledge that there will be some IT requirements where a ticket may need to be entered with the CDC team with direct access to the database.

Question 6: [Re: Section 3.02 – Scope of Work:] Per the CDC, pieces of Page Builder assistance, MMG onboarding, application tuning, and more – will now be handled via support tickets to the CDC Help Desk and not by a vendor. Has the state considered this in relation to the requirements and scope of this RFP? Is the intent of the state for the vendor to be the go-between for the state and the CDC?

Answer 6: It is our understanding that MMG onboarding can be achieved in the front end of NBS 7.

Most application tuning requiring the database is implemented once and not often changed. As stated in previous answers, there may be an anticipated limited number of IT requirements where a ticket will need to be entered with the CDC team that has direct access to the database. The intent of SOA is that the vendor will be the go-between.

Question 7: [Re: Section 3.02 – Scope of Work:] If the CDC cannot or will not provide the vendor access to their Azure cloud, how do the expectations of the state to the vendor change for support of services?

Answer 7: This has been answered in previous questions. (See above.)

Question 8: [Re: Section 3.02 – Scope of Work:] Has AK requested a copy of any and all exceptions to security requirements that CDC is requesting in order to obtain their ATO on the Azure cloud to ensure alignment with AK IT Security standards?

Answer 8: This can be requested and shared with a vendor.

Question 9: [Re: Section 3.02 – Scope of Work:] Please confirm that any lift-and-shift and NBS7 version upgrade to the CDC Azure cloud will be performed by the CDC and is not part of this RFP and vendor responsibilities.

Deliverable 4 Migrations mentions part of this would be the responsibility of the vendor, however; only CDC could complete these tasks. This goes back to all IT and security related requirements. All of these would be the responsibility of the CDC as the hosting solution, not the services vendor. Please confirm.

Answer 9: The future vendor would be working closely with the current vendor, the CDC/CDC partners as the cloud-hosting entity, and the State to ensure coordinated management.

Question 10: Per the uncertainty and ongoing discussions with the CDC regarding vendor access to the Azure cloud which would be required to best complete specific requirements within the State’s RFP and the upcoming submission deadline for the state’s RFP as of November 20th, 2024, would the state be amenable to a 2-week extension for RFP submissions from the date answers to vendor questions are provided by the state?

Answer 10: Yes. Reference table in RFP Amendment No. 4, Change to the RFP, for new set of dates.

Question 11a: [On Submittal Form F,] Question 8 requests resumes for all proposed principal staff. These are also requested in Submittal Form B, page 22 of the solicitation. Are they required in this section as well, and will they count towards page limits for this section?

Answer 11a: Requirement No. 8 on Submittal Form F – Mandatory Requirements is one of the mandatory requirements that contributes toward an offeror’s technical proposal being considered responsive and responsible. Regarding the page limitation inquiry within Question 11 above, reference RFP Section 4.04 – Experience and Qualifications, “Letters of reference and resumes will not count against maximum page limitations.”

Question 11b: The requirement [No. 8 on Submittal Form F] also seems to be incomplete at the end, are there additional requirements for this section which should be met? “Offerors must provide resumes for all proposed principal staff resumes. All personnel” Answer 11b: Reference RFP Amendment No. 4, Change to RFP Attachment.

Question 12: [Re: Submittal Form H – DOH IT Contractual requirements – SaaS Solutions (v241004), p]lease confirm that these requirements pertain to supporting applications and services only, and not the NBS application itself.

Answer 12: The responding vendor will be the responsible party to comply with the IT contractual requirements.

They will need to collaborate with CDC.

Question 13: What if any customization have been made to the NBS system for the State of Alaska Answer 13: There have not been any customizations that have impacted the core code. Some custom tables have been built in the reporting database.

Question 14: Aside from Rhapsody, is there additional integrations the SOA is expecting to add.

Answer 14: Not at this time.

Question 15: Does the State have a roadmap for this project after the RFP has been initiated and implemented?

(i.e. Data Analytics) Answer 15: The focus of this RFP is on the surveillance system; analytics capacity and displays are out of scope.

Question 16: If the CDC hosted environment is suitable but NBS v7 is not ready, does Alaska expect the vendor to host NBS v6.x in the CDC hosted environment or an alternate location?

Answer 16: NBS versions 6.x cannot be hosted in the CDC environment. Our intent is to move to NBS 7.x. NBS 7.x is built on top of NBS 6 and can be separated if a rollback is needed.

Question 17: How many notifiable conditions are in the system Answer 17: We have 116 nationally notifiable conditions in our NBS instance. Many of these conditions have no cases under them (have not been used) as they are low prevalence. Generally, our nationally notifiable condition list matches with those listed here: https://ndc.services.cdc.gov/. In total, there 172 conditions active in NBS, which include environmental conditions (such as lead and other heavy metal poisoning) and conditions that exist in for workflow purposes only.

For additional reference, these are the infectious conditions reportable by Health Care Providers and Laboratories in Alaska:

https://health.alaska.gov/dph/Epi/Documents/pubs/conditions/ConditionsReportable_HCP.pdf https://health.alaska.gov/dph/Epi/Documents/pubs/conditions/ConditionsReportable_LABS.pdf

Question 18: How many additional questions have been configured for the default conditions Answer 18: Many of our published pages do not deviate from the CDC NBS page templates. The notable exceptions to this are the 4 pages used for hepatitis B and C. These pages contain about 5-10 custom questions each, some of which are used across multiple of the pages. Our COVID-19 page also contains about 5-10 custom questions. Our salmonellosis page was borrowed from another state, as there has not yet been a page template released by the CDC NBS team. Many conditions in our NBS are using the genV2 page template without any customizations.

Question 19: How many staff members does the SOA have maintaining Rhapsody.

Answer 19: Rhapsody has been maintained by our NBS vendor and is not internal to SOA.

https://ndc.services.cdc.gov/ https://health.alaska.gov/dph/Epi/Documents/pubs/conditions/ConditionsReportable_HCP.pdf https://health.alaska.gov/dph/Epi/Documents/pubs/conditions/ConditionsReportable_LABS.pdf

Question 20: What pain points does the SOA currently have with the Rhapsody integration.

Answer 20: We have not explored our Rhapsody routes closely enough to understand pain points, although we believe that we could be utilizing Rhapsody in more strategic ways to improve data and workflow in our NBS.

More collaboration in this area is important to us.

Question 21: Is there a current statewide SSO that this will be integrated with, or will there be a new SSO integration for this project.

Answer 21: NBS 7 includes a standard identity provider (IDP), Keycloak, which integrates to standard SSO via SAML, OAuth, or OpenIDConnect to SOA's preference.

End of Amendment