2026HCA4-ExhibitE-DataSecurityAttestation.docx

This is an Exhibit E Data Security Attestation document from the Washington State Health Care Authority supporting RFP 2026HCA4 for an External Quality Review Organization contract serving the Washington Apple Health Medicaid Integrated Managed Care and Integrated Foster-Care programs. The exhibit requires bidders to complete two critical security attestations. The first attestation mandates that bidders commit to completing and passing a Security Design Review (SDR) within six months of procurement of State-supported Common Information Environment (CIE) Technology. The SDR process requires completion of a comprehensive Data Security Questionnaire (Exhibit F), submission of supporting documentation including bidder policies, procedures, and third-party SOC 2 Type 2 assessment reports, participation in collaboration meetings with HCA, and final review with the Office of Cyber Security. The second attestation requires bidders to implement access authentication for end users and State agency staff in compliance with Section 6 of the Data Security Questionnaire, specifically mandating Enterprise Active Directory or MS Entra Active Directory for State agency staff and Secure Access Washington for end users, with support for SAML 2.0 and multiple identity providers in accordance with WaTech Security requirements.

Both attestations require bidders to confirm their commitment and capability to meet these security and authentication requirements by selecting "YES" or "NO" responses. These mandatory attestations represent core technical and security compliance obligations that bidders must acknowledge prior to contract award. Failure to commit to either attestation would substantially limit a bidder's eligibility for the External Quality Review Organization contract.