RFI 30-270047-DMH Page 1 of 8 Rev 2017/02/27

STATE OF NORTH CAROLINA

Department of Health and Human Services

REQUEST FOR INFORMATION NO. 30-270047-DMH

Refer ALL Inquiries to:

Kathryn Brown

Contract Specialist

(919) 855-4093 kathryn.brown@dhhs.nc.gov

Due Date: September 21, 2026 at 5pm ET

Issue Date: August 24, 2026

Commodity: 811620 – Cloud-based software as a service

Using Agency Name:

NC Department of Health and Human Services, Division of Mental Health, Developmental Disabilities and Substance Use Services (DMH/DD/SUS)

PURPOSE: The purpose of this Request for Information (RFI) is to survey the market for information and recommendations for a Controlled Substance Reporting System solution. See Executive Summary below for additional details.

QUESTIONS

Submit written questions via the Ariba Sourcing Tool by August 31, 2026 by 5:00pm Eastern Time. See Section 2.B for complete instructions for submitting clarification questions.

DELIVERY INSTRUCTIONS: Submit one (1) signed, original Request for Information (RFI) via the Ariba Sourcing Module. If confidential and proprietary information is contained in your RFI response, submit one (1) signed, redacted copy and label the attached file “RFI–30-270047-DMH Vendor Name – REDACTED”. The RFI response must be submitted prior to the RFI due date provided above. It is the responsibility of the vendor to have their RFI submitted by the specified date and time. See Section 2.C for complete response instructions.

NOTICE TO VENDOR:

Submission of a response does not create an offer, and no contract award will result by submitting a response. The State of North Carolina shall not be liable for any costs incurred by respondents in developing or submitting a response to this RFI. No information gathered from this RFI will result in the issuance of a Request for Quote (RFQ).

EXECUTION

VENDOR NAME: E-MAIL:

STREET ADDRESS: P.O. BOX: ZIP:

CITY & STATE: TELEPHONE NUMBER: TOLL FREE TEL. NO:

TYPE OR PRINT NAME & TITLE OF PERSON SIGNING: FAX NUMBER:

AUTHORIZED SIGNATURE:

DATE:

RFI 30-270047-DMH Page 2 of 8 Rev 2017/02/27

Contents

1.0 EXECUTIVE SUMMARY

1.1 Acronyms & Definitions

1.2 Performance Requirements:

1.3 Operations

1.4 Security

1.5 Financial / Total Cost of Ownership

1.6 Confidential Information

2.0 RFI PROCEDURES

A. Schedule B. Clarification Questions C. Response

RFI 30-270047-DMH Page 3 of 8 Rev 2017/02/27

1.0 EXECUTIVE SUMMARY

North Carolina Department of Health and Human Services (NC DHHS), in collaboration with our partners, protects the health and safety of North Carolinians and provides essential human services. NC DHHS is one of the largest, most complex agencies in the state of North Carolina, having approximately 18,000 employees. The Department is responsible for providing human services support for special populations including individuals who are deaf, blind, developmentally disabled and mentally ill, and helping poor North Carolinians achieve economic independence.

NC DHHS administers the Prescription Drug Monitoring Program (PDMP) to perform its duties under Chapter 90 Article 5e Controlled Substances Reporting System Act. The PDMP is known as the North Carolina Controlled Substances Reporting System (NC CSRS). The Department requires a third party-hosted solution to track dispensed prescriptions for Schedule II-V drugs and drugs of concern, to assist licensed health professionals in making informed pharmaceutical treatment decisions, and aid authorized regulatory bodies in identifying possible over prescribing, over dispensing, and drug diversion. These services are provided by DHHS on behalf of persons and entities subject to the provisions of NCGS Article 5E, Chapter 90, § 90-113.71 et. seq.

NC DHHS, Division of Mental Health, Developmental Disabilities and Substance Use Services (DMH/DD/SUS) is in the process of developing plans to purchase a Controlled Substances Reporting System solution.

This Request for Information (RFI) is intended to collect information and recommendations regarding:

The vendor’s capacity and cost to provide the following:

1. Solution should be cloud based and a Software as a Service (SaaS).

2. Solution should be scalable for the capability to add modules, incorporate North Carolina specific modifications or integrate with state and/or external systems. Capable of maintaining integrations with the following interfaces:

a. American Society for Automation in Pharmacy (ASAP) Version 4.2 up to 5.0 and any future versions within one year of their release

b. National Association of Boards of Pharmacy: Prescription Monitoring Program (PMP)

InterConnect

c. NC Health Information Exchange Authority: NC HealthConnex.

3. Solution should be capable of receiving, ingesting, and maintaining a large data set with new records reported daily by system users; the solution must maintain 99% data quality through system functionality.

4. Solution should be capable of delivering data to the Department on a daily, weekly, monthly or quarterly reporting cadence including the capability of data transfer via Secure File Transfer Protocol (SFTP).

5. Provide a system with 99.5% availability, operating 24 hours/day; except during scheduled maintenance, and capable of recovering from issues within 1 hour. Helpdesk support should be available 24x7.

6. Solution should be capable of integrating its search function into all electronic health record and electronic medical record systems, support interstate interoperability, and ensure a robust audit trail of access and activity.

7. Provide a secure digital environment that provides access to over 95,000 registered users and complies with all applicable federal, State, and departmental regulations, policies, standards and guidelines, including but not limited to:

a. The North Carolina Controlled Substances Reporting System Act, Chapter 90, Article 5E

b. The Health Insurance Portability Accountability Act of 1996 (HIPAA), the Health Information

Technology for Economic and Clinical Health Act of 2009 (HITECH) and subsequent additions

c. 42 CFR Part 2, Confidentiality of Substance Use Disorder Patient Records regulation

d. The North Carolina Identity Theft Protection Act

e. NC DHHS Privacy & Security Policy

f. 42 USC 1396w-3a: Requirements relating to qualified prescription drug monitoring programs and prescribing certain controlled substances

The State requests detailed point-by-point responses showing how your firm would address the items in the following sections of this RFI:

Section: 1.0 through 1.6

RFI 30-270047-DMH Page 4 of 8 Rev 2017/02/27

1.1 Acronyms & Definitions

• CFR: Code of Federal Regulations

• CSRS: Controlled Substances Reporting System

• Department: North Carolina Department of Health and Human Services

• NC DHHS: North Carolina Department of Health and Human Services

• NC eVP: North Carolina electronic Vendor Portal located at https://evp.nc.gov/ – the North Carolina system to connect vendors with state government organizations that purchase goods and services.

• NCAC: North Carolina Administrative Code at http://reports.oah.state.nc.us/ncac.asp

• NCGS: North Carolina General Statutes at https://www.ncleg.gov/Laws/GeneralStatutesTOC - the official North Carolina legal code, a collection of the statewide laws in force at the time of publication.

• PDMP: Prescription Drug Monitoring Program

• PHI: Protected Health Information

• PII: Personally Identifiable Information

• PMP: Prescription Monitoring Program

• RFI: Request for Information

• RFP: Request for Proposal

• SaaS: Software as a Service

• SFTP: Secure File Transfer Protocol

1.2 Performance Requirements:

Respondents should provide detailed information regarding their solution and associated capabilities. Include detailed descriptions of the specifications in the following areas:

a. Scalability of the solution to add modules, incorporate North Carolina specific modifications or integrate with state and/or external systems. Describe the capability of the solution to maintain integrations with the following interfaces:

1. American Society for Automation in Pharmacy (ASAP) Version 4.2 up to 5.0 and any future versions within one year of their release

2. National Association of Boards of Pharmacy: Prescription Monitoring Program (PMP) InterConnect

3. NC Health Information Exchange Authority: NC HealthConnex

b. Describe the ability of the solution to maintain a large dataset with daily record ingestion and how it will maintain data quality.

c. Describe the reporting capabilities to provide reports to the Department via SFTP daily, weekly, monthly or quarterly.

d. Describe the capability of the solution to audit user access and activity; and its capability to integrate searching into electronic health or medical record workflows with all vendors.

e. Describe the ability of the solution to handle over 95,000 registered users.

f. Describe the ability to comply with Section 1944(b) Section 5042 – Medicaid PARTNERSHIP Act CMS

FAQs-SUPPORT for Patients and Communities Act (42 USC 1396w-3a): Requirements relating to qualified prescription drug monitoring programs and prescribing certain controlled substances.

g. Describe the solution’s uptime availability, average planned downtime per month and response to issues.

h. Describe the availability of helpdesk support and priority response times.

i. Provide any License Agreements or Service Level Agreements (SLA) for the solution.

https://evp.nc.gov/ http://reports.oah.state.nc.us/ncac.asp https://www.ncleg.gov/Laws/GeneralStatutesTOC

RFI 30-270047-DMH Page 5 of 8 Rev 2017/02/27

1.3 Operations

a. Describe the level of business resources the Department would need to implement, support, and maintain Respondent’s solution.

b. Describe the level of IT resources the Department would need to implement, operate, maintain, and support the Respondent’s solution.

1. Describe what portion of the system can be supported by state IT staff.

2. Describe all hosting options for the solution including whether the system can be vendor hosted or state hosted. For vendor hosted options, describe how the hosting environment will be maintained by the vendor.

3. Describe how the system can be configured by the vendor.

c. The State prefers cloud-based Solutions that can be operated and maintained either by the state or the vendor.

d. Describe the Respondent’s capability to provide issue or defect resolution.

1.4 Security

a. Describe if the solution provides a portal for end user access and, if so, how the Department and end users would access the solution while maintaining security measures.

b. Describe the security features to protect Personally Identifiable Information (PII) and Protected Health

Information (PHI).

1. Describe the solution’s compliance with NCGS Article 5E, Chapter 90, § 90-113.71 et. seq.

https://www.ncleg.net/EnactedLegislation/Statutes/HTML/ByArticle/Chapter_90/Article_5E.html

2. Describe the solution’s compliance with HIPAA regulations. https://www.hhs.gov/hipaa/for-professionals/privacy/index.html

3. Describe the solution’s compliance with 42 CFR Part 2. https://www.ecfr.gov/current/title-

42/chapter-I/subchapter-A/part-2

4. Describe the solution’s compliance with GovRAMP. https://programs.govramp.org/the-state-of-north-carolina/

c. Describe the Respondent’s approach to comply with privacy and security terms and conditions.

1. Annual assessment for compliance with HIPAA privacy and security rules.

2. Annual Security and HIPAA training.

3. Ongoing vulnerability assessments and penetration testing.

4. Annual third-party assessment (GovRAMP is required). List all third-party assessments performed annually for the solution.

d. Describe how the proposed solution complies with applicable security standards identified by the State:

The Department’s Confidentiality, Privacy and Security policies and other applicable regulatory requirements:

NC DHHS Privacy Manual and Security Manual, both located here:

https://policies.ncdhhs.gov/departmental/policies-manuals/section-viii-privacy-and-security

NC Statewide Information Security policies, located here:

https://it.nc.gov/statewide-information-security-policies

e. Describe the Respondent’s disaster recovery process that includes back-up data and disaster recovery location.

f. Describe the type and frequency of testing.

1.5 Financial / Total Cost of Ownership

The Department understands that any time or cost information in the Vendor's response does not constitute a quote and is only a representation of average project timelines, costs, and ongoing annual license and support costs. Respondents will not be held to pricing estimates provided in response to this RFI should the

Department decide to proceed with a competitive solicitation.

https://www.ncleg.net/EnactedLegislation/Statutes/HTML/ByArticle/Chapter_90/Article_5E.html https://www.hhs.gov/hipaa/for-professionals/privacy/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/index.html https://www.ecfr.gov/current/title-42/chapter-I/subchapter-A/part-2 https://www.ecfr.gov/current/title-42/chapter-I/subchapter-A/part-2 https://programs.govramp.org/the-state-of-north-carolina/ https://programs.govramp.org/the-state-of-north-carolina/ https://policies.ncdhhs.gov/departmental/policies-manuals/section-viii-privacy-and-security https://it.nc.gov/statewide-information-security-policies

RFI 30-270047-DMH Page 6 of 8 Rev 2017/02/27

a. Respondents are asked to provide information regarding estimated costs to purchase, install, and operate a Controlled Substances Reporting System as described in this RFI. This information will help the Department understand acquisition and on-going costs and be used to support budget development and funding requests.

b. Respondents are asked to provide cost information in the format of their choosing and, to the extent possible, include the following:

1. An estimated cost model or likely range of costs to purchase, implement, and operate the described solution; and

2. If pricing information is limited or unavailable, describe Respondent’s preferred pricing model or structure, including unit costs based on key variables.

3. An average project cost range to implement the solution, to include implementation services and product pricing.

4. Describe the license model and pricing for the solution.

5. The average annual cost for ongoing support.

c. Describe, on average, a typical solution implementation timeline.

1.6 Confidential Information

In accordance with 09 NCAC 06B.0103 the State may maintain confidentiality of certain types of information described in N.C. Gen. Stat. 132-1 et. seq. Such information may include trades secrets defined by N.C. Gen.

Stat. 132-1.2. Respondents may designate appropriate portions of its response confidential, consistent with and to the extent permitted under the Rules and Statutes set forth above, by marking the pages containing confidential information with boldface type at the top and bottom of each such page stating “CONFIDENTIAL.” By so marking any page, the Respondent warrants that it has formed a good faith opinion, having received such necessary or proper review by counsel and other knowledgeable advisers that the portions marked confidential meet the requirements of the Rules and Statutes set forth above. The State may serve as custodian of Respondent’s confidential information and not as an arbiter of claims against Respondent’s assertion of confidentiality. If an action is brought pursuant to N.C. Gen. Stat. 132-9 to compel the State to disclose information marked confidential, the Respondent agrees that it will intervene in the action through its counsel and participate in defending the State, including any public official(s) or public employee(s). The Respondent agrees that it shall hold the State and any official(s) and individual(s) harmless from any and all damages, costs, and attorney’s fees awarded against the State or official or individual in the action. The State agrees to promptly notify the Respondent in writing of any action seeking to compel disclosure of Respondent’s confidential information. The State shall have the right, at its option and expense, to participate in the defense of the action through its counsel.

The State shall have no liability to Respondent with respect to the disclosure of Respondent’s confidential information ordered by a court of competent jurisdiction pursuant to N.C. Gen. Stat. 132-9 or other applicable law.

All information received in response to the RFI that is marked Confidential will be handled accordingly. The Department shall not be liable for or suffer any consequential damages for any proprietary information submitted and not properly identified. Proprietary information will be safeguarded in accordance with the applicable state regulations.

2.0 RFI PROCEDURES

A. Schedule

Respondents will have four weeks to prepare their submissions to this RFI. Responses must be received by the date, time and the location specified on the cover sheet of this RFI. Respondents may also be invited to present and discuss their submissions to DHHS Headquarters either in person or virtually. Respondents will be notified of the specific date and time at least two weeks in advance of their presentation.

B. Clarification Questions

Clarification questions will be accepted until August 31, 2026 at 5:00pm Eastern Time submitted via the Ariba Sourcing Tool by the date and time specified above. All questions must be submitted in writing. Vendors should submit questions with the subject “Questions-30-270047-DMH. An addendum containing any general clarification questions and their answers will be issued as an addendum to this RFI on the NC Electronic Vendor Portal (eVP) with the responses.

RFI 30-270047-DMH Page 7 of 8 Rev 2017/02/27

The questions should be submitted in an editable MS Excel file in the following format using as many rows as needed.

# SOW Page # / Section Vendor Questions

C. Response

The State recognizes that considerable effort will be required in preparing a response to this RFI. However, please note this is a request for information only, and not a request for services. The Vendor shall bear all costs for preparing this RFI.

1. Content and Format

The State expects concise, detailed, point-by-point responses to each of the RFI response items identified in Sections 1.0 through 1.6 of this RFI. The State is not interested in brochures or “boilerplate” responses.

Instead, responses should clearly define how the vendor’s proposed solution(s) would meet the State’s business requirements. Any issues or exceptions to the State’s requirements should also be identified and explained.

The response should also include annotated network drawings showing where each of the pieces of equipment in the proposed solution would be located and how those devices would be interconnected.

The response should define all services that would be required by the proposed solution. The response should also include:

• The vendor’s understanding of the project and services by addressing the State’s business requirements;

• An estimated total cost of ownership for the solution including continued compliance with emerging industry standards.

• The proposed solution’s ability to expand and evolve to serve other State's sites either inside the Raleigh area or in other county locations and also meet all of the service and performance requirements identified in this RFI.

2. Include the following in the RFI response:

a) Transmittal Letter in the form of a standard business letter and should be signed by a respondent-authorized individual. It should note the following:

• A statement that deviations are included, if applicable

• A statement that proprietary information is included, if applicable

b) General Information

• Name of Company

• Contact Person

• Address, Phone Number, Email address

c) Information about Respondent

• Overview of company’s history, scope of products and services offered, and locations of operation;

• Describe their experience in providing solutions similar in size and scope to the solution desired;

• Primary customer base or market;

• List of States or Agencies which utilize the Respondent’s solution in a manner that is the same or similar to those required by this RFI. Response to include state/agency name, most recent implementation, contract start and end date, description of scope of work, the duration of any contracts, and the termination dates;

• Lessons learned from working with other States or Agencies to implement a solution of similar size, scope and with requirements the same or similar to those required by the Department.

RFI 30-270047-DMH Page 8 of 8 Rev 2017/02/27

3. Instructions for Submitting Responses

Due Date: September 21, 2026

Time: 5:00PM Eastern Time

Responses, subject to the conditions made a part hereof, will be received until 5:00pm Eastern Time on the day of opening and then opened.

a) Submit one (1) signed, original electronic offer through the Ariba Sourcing Module.

b) The Ariba Sourcing Module document number is: Doc2365935872.

c) All File names should start with the Vendor name first, in order to easily determine all the files to be included as part of the vendor’s response. For example, files should be named as follows: Vendor Name-your file name.

d) File contents SHALL NOT be password protected, the file formats must be in .PDF, .JPEG, .DOC or .XLS format, and shall be capable of being copied to other sources.

e) If the vendor’s response contains any confidential information, then the vendor must provide one (1) signed, original electronic response and one (1) redacted electronic copy.

For Vendor training on how to use the Ariba Sourcing Tool to view solicitations, submit questions, develop responses, upload documents, and submit responses to the State, Vendors should go to the following site:

https://eprocurement.nc.gov/training/vendor-training

Questions or issues related to using the Ariba Sourcing Tool itself can be directed to the North Carolina eProcurement Help Desk at 888-211-7440, Option 2. Help Desk representatives are available Monday through Friday from 7:30 AM EST to 5:00 PM EST

When submitting a response, include all pages of the RFI, with the EXECUTION section on the cover page of this RFI completed and signed.

4. Multiple Responses

Multiple responses will be accepted from a single vendor provided that each response is comprehensive, meets all of the state’s requirements, and is truly unique. Submit multiple responses separately and label the file as “Response #1, Response #2, etc. after the “Vendor Name” as applicable.

REMAINDER OF PAGE INTENTIONALLY LEFT BLANK

https://eprocurement.nc.gov/training/vendor-training