2026HCA13-FSIPAP.pdf

Washington State Health Care Authority

Page 1 of 14 RFI 2026HCA13

FSIPAP

STATE OF WASHINGTON

HEALTH CARE AUTHORITY

REQUEST FOR INFORMATION (RFI)

RFI NO. 2026HCA13

NOTE: If you download this RFI from the Health Care Authority website, you are responsible for sending your name, address, e-mail address, and telephone number to the RFI Coordinator in order for your organization to receive any RFI amendments or vendor questions/agency answers. HCA is not responsible for any failure of your organization to send the information or for any repercussions that may result to your organization because of any such failure.

SCOPE TITLE: Federal & State Interoperability and Prior Authorization Project (FSIPAP)

RFI RELEASE DATE: July 15, 2026

SUBMISSION DUE DATE: August 19, 2026, by 5:00 PM Pacific Time, Olympia, Washington, USA.

RFI RESPONSE: Please limit your entire RFI response to 20 pages, excluding cover page, table of contents, and attachments. See Section 4.4 for a listing of all items requiring a response to this RFI. Only e-mailed submissions will be accepted.

RFI COORDINATOR: Jack Kent; Jack.Kent@hca.wa.gov mailto:Jack.Kent@hca.wa.gov

Page 2 of 14 RFI 2026HCA13

Table of Contents

1. Goals and Objectives

2. Background

2.1. HCA Technical Environment

2.2. Policy Environment

2.3. Federal Regulatory Initiatives

3. Statement of Need

4. Administrative Terms and Conditions

4.1. RFI Coordinator

4.2. RFI Schedule of Activities

4.3. Submission Requirements

4.4. Sections requiring a response

4.5. Cost of Response

4.6. Response Property of HCA

4.7. Public Records and Proprietary Information

4.8. Revisions to the RFI

4.9. No Obligation to Buy or Issue Solicitation

5. Response Content and Strategic Context

5.1. General Response

5.2. Solution Overview – Specific Content Requested

5.2.1. High-Level Description

5.2.2. Solution Architecture & Deployment

5.2.3. System Reliability & Operations

5.3. Functional Capabilities

5.3.1. APIs and Directory Services

5.3.2. Policy Transformation

5.4. Security & Privacy

Page 3 of 14 RFI 2026HCA13

5.5. Reporting & Analytics

5.6. Implementation, Testing, & Timeline

5.7. Pricing & Delivery Model

5.8. Experience & References

Page 4 of 14 RFI 2026HCA13

1. Goals and Objectives The Washington State Health Care Authority (HCA) is issuing this Request for Information (RFI) to identify qualified vendors capable of delivering technical solutions to satisfy interoperability requirements to comply with the Centers for Medicare & Medicaid Services (CMS) Interoperability and Prior Authorization Final Rule (CMS-0057- F). HCA is interested in proposed solutions to develop, implement, and maintain required interoperability Application Programming Interfaces (API(s)) and to transform existing unstructured policy content into standards-based, machine-readable artifacts utilizing HL7 FHIR and Da Vinci Implementation Guides.

The specific objectives of these efforts are to:

Inform o HCA is currently gathering information for possible procurement of technology solutions to meet the requirements of CMS-0057-F. With this RFI, HCA hopes to inform the vendor community about a prospective procurement to include development of APIs, capture and management of client consent, and tools to facilitate functional policy information exchange.

Learn o HCA aims to use this RFI to learn from the vendor community about:

Available technology to satisfy the interoperability and policy needs Cost estimates for budget planning related to the scope of interoperability requirements Approaches for the design and implementation of systems to meet the requirements of CMS-0057-F, and Associated design, development, and implementation timeframes.

Guide o HCA hopes to use this RFI to accelerate efforts to design, procure, and implement needed systems to meet the requirements of CMS-0057-F in the following ways:

Determine the most effective approach and technology needed to achieve desired interoperability.

Distinguish appropriate procurement avenues and determine overall procurement needs for HCA.

Page 5 of 14 RFI 2026HCA13

Use the information from the responses of potential vendors to accelerate efforts in the procurement and selection of a technology solutions vendor for the CMS-0057-F requirements.

Responses to this RFI may inform subsequent formal solicitations and are not binding on either party.

2. Background

2.1.HCA Technical Environment In 2021, HCA implemented and is currently supporting the Patient Access and Provider Directory APIs that were required as part of the CMS-9115-F rule effective January 1, 2021. As part of that solution, HCA maintains a Fast Healthcare Interoperability Resources (FHIR) server as part of its ProviderOne Medicaid Management Information System (MMIS) architecture. Any API solution will need to integrate with the ProviderOne system to allow the ingestion and extraction of data needed to meet the requirements of the rule. The request from HCA is to build the new APIs required in CMS-0057-F to connect to our existing FHIR server.

HCA’s FHIR server receives regular extracts from the MMIS Online Transaction Processing (OLTP) database needed to populate the Patient Access and Provider Directory APIs implemented as part of HCA’s 9115-F solution. Either the MMIS OLTP or FHIR server will hold all of the required Medicaid data needed for the APIs mandated as part of CMS-0057-F:

- Client

- Claims

- Provider

- Prior Authorization

- Payer (Managed Care Organizations)

The proposed solution for CMS-0057-F must be able to interoperate smoothly and seamlessly with HCA’s MMIS. That will include both the current FHIR server, and possibly other API endpoints to allow extraction and ingestion of the data needed to facilitate the 0057 APIs. These API endpoints will be the secured using standard

Page 6 of 14 RFI 2026HCA13 protocols and will require working with both HCA and our MMIS vendor, Acentra Health, to grant the necessary access.

HCA’s ProviderOne MMIS is hosted in Acentra Health’s Amazon Web Services (AWS) environment, and utilizes various AWS infrastructure and other microservices that a potential 0057-F solution will need to interact and interoperate with.

Summary for the API implementation guides: https://www.cms.gov/newsroom/fact-sheets/cms-interoperability-prior-authorization-final-rule-cms-0057-f

2.2.Policy Environment The HCA disseminates clinical policy to the public through its website (https://www.hca.wa.gov). Specific program resources (billing guides and fee schedules) are available for each clinical program service area that HCA defines.

Program area billing guides, the vehicle through which policy and program requirements are communicated, contain detailed information on service requirements and qualifications. Billing guides are available in PDF format.

The HCA policy environment requires providers to manually explore program requirements for the services being performed to ensure coverage. Internal management of policies is also largely a manual process. The lack of structured, computable information limits HCA’s ability to exchange policy information easily and limits functional policy management capabilities. Most important, the technical limitations impede the organization’s ability to readily achieve CMS-0057-F compliance.

2.3.Federal Regulatory Initiatives To enhance interoperability and improve the prior authorization process, the Centers for Medicare and Medicaid Services issued Final Rule CMS-0057-F in January 2024. The rule requires Medicaid and Children’s Health Insurance Program (CHIP) Fee-For Service programs to comply with certain interoperability requirements. Amongst these requirements, the HCA is charged with developing three APIs and enhancing one existing API:

• Patient Access API – enhancement to existing API include delivery of prior authorization data https://www.cms.gov/newsroom/fact-sheets/cms-interoperability-prior-authorization-final-rule-cms-0057-f https://www.cms.gov/newsroom/fact-sheets/cms-interoperability-prior-authorization-final-rule-cms-0057-f https://www.hca.wa.gov/

Page 7 of 14 RFI 2026HCA13

• Provider Access API – development of new API

• Payer-to-Payer API – development of new API

• Prior Authorization API – development of new API

3. Statement of Need HCA needs to develop the prescribed interoperability to achieve compliance with CMS- 0057-F requirements. The HCA is specifically seeking information on what is needed to:

• Implement required DaVinci FHIR-based APIs that support secure data exchange between payers, providers, patients, and authorized third parties.

• Establish a scalable architecture that supports future CMS interoperability requirements and evolving Da Vinci standards.

• Ability to capture consent or integrate with a consent solution to facilitate exchange of the Provider Access (opt out) or Payer-to-Payer (opt in) APIs.

• Convert existing policy, utilization management, and coverage determination content from unstructured formats into Da Vinci FHIR-compliant resources.

4. Administrative Terms and Conditions

4.1.RFI Coordinator

• Please submit responses to the RFI Coordinator at the following email:

Name Jack Kent

E-Mail Address Jack.Kent@hca.wa.gov

• Please be sure to include the RFI Number 2026HCA13 in the subject line of any emails.

4.2.RFI Schedule of Activities Release RFI 07/15/2026

Questions Due Round #1 07/22/2026 by 5:00 p.m. PT mailto:Jack.Kent@hca.wa.gov

Page 8 of 14 RFI 2026HCA13

Answers Distributed Round #1 07/29/2026 by 5:00 p.m. PT

Questions Due Round #2 08/05/2026 by 5:00 p.m. PT

Answers Distributed Round #2 08/12/2026 by 5:00 p.m. PT

RFI Written Responses Due 08/19/2026 by 5:00 p.m. PT

4.3.Submission Requirements All responses to this RFI should be submitted only in electronic format such as MS Word or Adobe Acrobat PDF. Submissions should not exceed 20 pages in length (excluding the cover page, table of contents, and attachments).

All files should be named using the following structure: RFI 2026HCA13_Company Name.

Vendors must include in their submission email a listing of all files in their submission and a description of the content of each file submission.

Please note: HCA will not accept zipped or compressed files in connection with this RFI. HCA will not open any such file. If individual files to a response are too large, please send multiple emails instead of compressing files.

4.4.Sections requiring a response Review Section 5.1, General Response below for more information about submitting a partial or a complete response to this RFI’s requirements.

Vendors’ responses to this RFI should address the following sections and must signpost their responses using the same headings and in the same order as stated below:

o Section 5.2, Solution Overview

5.2.1 High-Level Description

5.2.2 Solution Architecture & Deployment

5.2.3 System Reliability & Operations

o Section 5.3, Functional Capabilities

5.3.1 APIs and Directory Services

5.3.2 Policy Transformation

Page 9 of 14 RFI 2026HCA13 o Section 5.4, Security & Privacy o Section 5.5, Reporting & Analytics o Section 5.6, Implementation, Testing, & Timeline o Section 5.7, Pricing & Delivery Model o Section 5.8 Experience & References

4.5.Cost of Response No reimbursement will be provided for any costs associated with preparing or presenting any response to this RFI.

4.6.Response Property of HCA All materials submitted in response to this RFI become the property of HCA. HCA has the right to use any of the ideas presented in any response to the RFI.

4.7.Public Records and Proprietary Information Any information contained in the response that is proprietary or confidential must be clearly designated as such. The page and the particular exception(s) from disclosure must be identified. Each page claimed to be exempt from disclosure must be clearly identified by the word “confidential” printed on the lower right-hand corner of the page. Marking the entire response as confidential will be neither accepted nor honored and may result in disclosure of the entire response.

To the extent consistent with Chapter 42.56 RCW, the Public Records Act, HCA will maintain confidentiality of your information marked confidential or proprietary. If a request is made to view your proprietary information, HCA will notify you of the request and of the date that the records will be released to the requester unless you obtain a court order enjoining that disclosure. If you fail to obtain the court order enjoining disclosure, HCA will release the requested information on the date specified in its notice to you.

HCA’s sole responsibility will be limited to maintaining the above data in a secure area and to notify you of any request(s) for disclosure for so long as HCA retains your information in HCA records. Failure to label such materials, or failure to timely respond https://apps.leg.wa.gov/rcw/default.aspx?cite=42.56

Page 10 of 14 RFI 2026HCA13 after notice of request for public records has been given, will be deemed a waiver by you of any claim that such materials are exempt from disclosure.

4.8.Revisions to the RFI HCA reserves the right to amend this RFI at any time. In the event it becomes necessary to revise any part of this RFI, addenda will be provided via e-mail to all individuals who have made the RFI Coordinator aware of their interest. Addenda will also be published on Washington’s Electronic Bid System (WEBS). The website can be located at https://fortress.wa.gov/ga/webs/. For this purpose, the published questions and answers and any other pertinent information will be provided as an addendum to the RFI and will not be placed on the website.

HCA reserves the right to cancel or reissue this RFI at any time, without obligation or liability.

4.9.No Obligation to Buy or Issue Solicitation HCA will not contract with any vendor as a result of this RFI. While HCA may use responses to this RFI to draft a competitive solicitation for the subject of these services, issuing this RFI does not compel HCA to do so.

Responding to this RFI will not be a requirement of future solicitations. Responses and information provided in response to this RFI will not be considered when evaluating bidders responding to any future solicitation.

HCA will post any and all competitive solicitations on WEBS.

5. Response Content and Strategic Context

5.1.General Response HCA invites vendors to respond to this RFI as a complete or partial solution.

Responders have the option of providing a response for either or all proposed components. For those responses that provide a partial solution, the solution should address either 1) API development work or 2) policy transformation components. In all https://fortress.wa.gov/ga/webs/

Page 11 of 14 RFI 2026HCA13 cases, HCA requests that vendors offer a comprehensive response for the solution(s) being proposed.

An indication should be made prior to the document narrative as to the extent of the solution that is being addressed (please see section 5.2.1 and 5.3). We also encourage vendors to submit artifacts that would help the state understand the vendor’s proposed solution(s). Detailed architectural, content, and exchange standards will be required through any future applicable Request for Proposal (RFP) process.

5.2.Solution Overview – Specific Content Requested

5.2.1. High-Level Description

• An indication of whether the response is a complete or partial solution o If it is a partial solution, please indicate which sections are included in the response.

• Provide a high-level description of your proposed solution.

• Indicate whether the solution is currently implemented, in development, or planned.

• Describe any AI integration or AI-enabled components.

5.2.2. Solution Architecture & Deployment

• Confirm whether the solution is offered as SaaS.

• Describe available hosting models (cloud, on-premises, hybrid).

• Provide information on scalability, future-proofing, and performance benchmarks.

• Describe your solution’s data model.

• Provide details on possible Service Level Agreements (SLAs) that might be required for your solution.

5.2.3. System Reliability & Operations

• Describe your uptime monitoring processes.

• Describe error-handling processes.

• Provide information about disaster recovery (DR) and failover capabilities.

Page 12 of 14 RFI 2026HCA13

5.3.Functional Capabilities Based on whether the response is partial or complete, respond to 5.3.1, 5.3.2, or both.

Please describe your understanding of the following and explain how your solution satisfies the requirements.

5.3.1. APIs and Directory Services

• Payer-to-Payer API

• Provider Access API

• Prior Authorization APIs:

o DTR (Documentation Templates & Rules) o CRD (Clinical Requirements Documentation)

Describe the process for creating CRD.

o PAS (Prior Authorization Support)

• Patient Access API

• Provider Directory Services

5.3.2. Policy Transformation

• Transform existing unstructured policy environment into a digitally referential structured environment.

• Define what technology solutions are required to implement CMS-0057-F interoperability components and electronic policy delivery, including conversion of existing policy, utilization management, and coverage determination content from unstructured formats into Da Vinci FHIR-compliant resources.

5.4.Security & Privacy Describe how your solution meets Washington State security requirements (https://watech.wa.gov/policies), including:

• Compliance with OAuth2

• Patient identity matching, including integration with a Master Patient Index (MPI)

• Consent management capabilities https://watech.wa.gov/policies

Page 13 of 14 RFI 2026HCA13 o Opt-out for Provider Access o Opt-in for Payer-to-Payer o Consent revocation/management o Potential integration with an existing consent management solution or how the proposed solution provides consent management capabilities

• Audit logging capabilities

• HIPAA compliance

• Any additional relevant state-specific security requirements

5.5.Reporting & Analytics Describe how your solution can address the following needed reporting and analytics capabilities including:

• Dashboards

• API usage reporting

• Prior authorization turnaround reporting

• Denial metrics

• Ability to generate CMS-required reports

• Alerting and notification functionality

5.6.Implementation, Testing, & Timeline

• Describe the time typically required to gather requirements and information from HCA subject matter experts during implementation.

• Provide a sample implementation timeline with major milestones.

• Provide a sample work plan, including any data migration that might be required for any consent management solutions or policy environments.

• Include architectural models, workflows, and data flow diagrams (if available).

Page 14 of 14 RFI 2026HCA13

5.7.Pricing & Delivery Model Provide information regarding your pricing approach, including:

• Pricing model description

• DDI (Design, Development, and Implementation) costs

• Ongoing Operations & Maintenance (O&M) costs

• Any assumptions or cost drivers

• Information about integration and partnership with other vendors

5.8.Experience & References Please include a description of the following items:

• Experience supporting Medicaid FFS and managed care plans, or any other health care related experience

• Experience working with HIPAA or other legally protected health care data

• Previous CMS or other health care interoperability initiatives

• Prior Da Vinci FHIR implementation experience

• Experience implementing Patient Access, Provider Access, Prior Authorization, and Payer-to-Payer APIs

• Experience transforming policy content into structured FHIR artifacts

• Relevant references and case studies

• A description of contracting vehicles that would afford ease of contracting with the HCA (e.g. DES statewide contract, NASPO contract, etc.)

• Any state Medicaid or other state government references

END OF RFI