30-270047-DMH_Addendum 1 Questions_09 03 2026.pdf

North Carolina Solicitation Addendum Version Date: 11/2021

Page | 1

Office of Procurement Contracts and Grants

SOLICITATION ADDENDUM

1. THIS ADDENDUM DOES NOT NEED TO BE RETURNED WITH THE

VENDOR’S SUBMISSION.

2. THE FOLLOWING ARE QUESTIONS RECEIVED FOR THE REQUEST FOR

INFORMATION (RFI) AND THE STATE’S RESPONSE TO THE QUESTIONS.

Q #

DOCUMENT

SECTION

VENDOR QUESTION RESPONSE

Section 1.4 (c)(4)

[Security], Page 5

Section 1.4 states that GovRAMP is required. What GovRAMP authorization level or status will be required, and must that status be held at proposal submission, contract award, or production go-live?

Effective April 1, 2027 GovRAMP is required, see the below link for more details. At offer submission, if the vendor does not currently hold a validated GovRAMP status, the GovRAMP security snapshot should be submitted. Depending on the data classification, the vendor must achieve the GovRAMP status for the specified classification or will have an interim time period to achieve from the effective date.

https://it.nc.gov/programs/cybersecurity-risk-management/esrmo-initiatives/govramp-adoption

Section 1.2 (d) [Performance

Requirements], Does the requirement to integrate search functionality into all EHR/EMR systems contemplate direct vendor-by-vendor interfaces, integration through NC HealthConnex or an established PDMP gateway, or a combination? Please provide the currently supported EHR vendors, interface methods, and approximate annual query volume.

Section 1.2(d) [Performance Requirements] requests respondents to describe the capability of their solution to integrate searching into electronic health or medical record workflows of all vendors (emphasis added).

Issuing Agency: Department of Health and Human Services

Solicitation Number: 30-270047-DMH

Solicitation Description: Controlled Substance Reporting System - IFB

Solicitation Opening Date and Time:

September 21, 2026 at 5:00 PM ET

Addendum Number: 1

Addendum Date: September 3, 2026

Purchasing Agent: Kathryn Brown https://it.nc.gov/programs/cybersecurity-risk-management/esrmo-initiatives/govramp-adoption https://it.nc.gov/programs/cybersecurity-risk-management/esrmo-initiatives/govramp-adoption https://it.nc.gov/programs/cybersecurity-risk-management/esrmo-initiatives/govramp-adoption

RFI 30-270047-DMH

ADDENDUM NUMBER: 1

North Carolina Solicitation Addendum

Page | 2

Q #

DOCUMENT

SECTION

VENDOR QUESTION RESPONSE

3 General

Please provide planning metrics for the current environment, including daily prescription records received, historical record count and retention period, peak concurrent users, daily searches, number of reporting entities, and the volume and format of data expected to be migrated.

Publicly available statistics on dispensation trends are published on the Department's website in a document known as the NC CSRS Annual Report, www.ncdhhs.gov

Section 1.3 (b)(2)

[Operations], The Executive Summary states that the Department requires a third-party-hosted solution, while Section 1.3 requests both vendor-hosted and state-hosted options. Should respondents treat vendor hosting as the required future production model, or is state hosting also a viable acquisition option?

Section 1.3(b)(2) [Operations] says: Describe all hosting options for the solution including whether the system can be vendor hosted or state hosted. For vendor hosted options, describe how the hosting environment will be maintained by the vendor. (Emphasis added).

Section 1.0 (5)

[Executive Summary]

Please clarify whether the one-hour recovery requirement is a response, service-restoration, or full-resolution target; identify the incident severity levels to which it applies; and provide current monthly helpdesk ticket volumes and required support channels.

Please refer to Section 1.2 Performance Requirements (Page 4) for more detail on how the Department is requesting respondents to provide information on the one-hour recovery bullet point listed in the Executive Summary.

Section 1.0 [Executive

Summary], Page 3

Can the Department identify the primary business, operational, technical, or compliance challenges it seeks to address through a future PDMP procurement?

The purpose of this Request for Information (RFI) is to survey the market for information and recommendations for a Controlled Substance Reporting System solution.

Section 1.4 (b)(4) and 1.4 (c)(4) [Security], Page 5

Please clarify the required GovRAMP status and baseline (Low, Moderate, or High). Must the awarded vendor already hold GovRAMP authorization at the time of RFI/RFP response, or is authorization by contract award or go-live acceptable?

See answer to item 1

Section 1.0 (3)

[Executive Summary], Page 3

Can the Department provide the current number of active dispenser/reporting entities?

See answer to item 3

Section 2.0 (A), [RFI Procedures], Can the Department provide its anticipated timeline for any future procurement activities related to this RFI, including estimated RFP issuance and desired implementation timeframe?

At this time the Department is gathering information for future planning. Any anticipated RFP for this system would be issued within a 12 to 24 month timeframe.

http://www.ncdhhs.gov/

RFI 30-270047-DMH

ADDENDUM NUMBER: 1

North Carolina Solicitation Addendum

Page | 3

Q #

DOCUMENT

SECTION

VENDOR QUESTION RESPONSE

Section 1.2(a)(3) [Performance

Requirements], Beyond maintaining the current integration with NC HealthConnex, what additional capabilities or outcomes would the Department like a future PDMP platform to achieve through its integration with the

HIE?

At this time the Department is gathering information for future planning.