ATTACHMENT C: SCOPE OF WORK

INTRODUCTION

The Utah Division of Professional Licensing (DOPL), a division within the Department of Commerce, is issuing this Request for Proposals (RFP) to secure an electronic health (eHealth) compliance monitoring, tracking, and toxicology testing platform. The objective of this procurement is to establish a continuous service framework that maintains uninterrupted public safety oversight and compliance tracking workflows.

BACKGROUND

DOPL is responsible for the licensure and regulation of multiple occupations and professions in the state. As a part of the Department of Commerce, the Division contributes to the success of Utah businesses, professionals, and consumers by supporting a favorable economic and regulatory environment. This goal is accomplished by establishing and enforcing fair standards, facilitating compliance with government requirements, and providing consumers with current information.

The statutory mandate of the Division is to safeguard the public by regulating occupational and professional licensing. The Division must ensure that licensed professionals possess a minimum level of competence as measured by education, examination, and/or experience/training. In collaboration with the respective licensing boards, the Division also creates and maintains standards of conduct by which licensees must govern their practice.

To fulfill regulatory obligations, the Division relies on an electronic health compliance monitoring system to monitor adherence to program contracts and stipulations for participants involved in the Utah Professionals Health Program (UPHP) and other licensee probation monitoring. This secure, web-enabled application is the primary tool Division staff rely on to manage daily compliance operations, track random testing schedules, and coordinate ongoing workflows. The system provides separate, secure portal interfaces for Division staff, program participants, and approved third-party stakeholders such as employers and therapists. It should be noted that this system will be revenue neutral to the State of Utah.

DETAILED SCOPE OF WORK

NOTE: All deliverables or descriptions of how the Vendor is proposing to meet the requirement for the deliverable must be submitted with the proposal. If the Vendor’s proposed solution is unable to meet the requirement it must be noted.

GENERAL

This section outlines the general terms and conditions that will apply to the overall relationship between DOPL and the Vendor.

Task 01-01:

The Vendor shall provide the services at no cost to the State of Utah. Services shall be funded by testing fees, and other applicable fees from program participants. All revisions to the Fee Schedule shall be subject to Division approval.

Deliverable: Fee Schedule detailing the costs of services to include at a minimum: drug testing software and analysis fees, program participation fees, and estimated or average third-party collection site fees across the Vendor’s proposed Utah network, and any or all other applicable fees.

Task 01-02:

The Vendor shall submit a performance bond for a minimum $1,000,000 to ensure re-payment of participant fees and program operational costs should Vendor fail to meet the agreed upon responsibilities outlined in their proposal.

Deliverable: Performance bond must be submitted to the Division no later than the time of contract execution.

Task 01-03:

The Vendor shall identify a specific contract manager assigned to provide direct support to Division personnel. The contract manager shall be available by phone and/or email during DOPL's normal hours of operation: Weekdays between 0700 to 1800 MST. The Contract Manager, or a designated backup manager, must acknowledge and respond to urgent phone calls or email inquiries from Division personnel within a maximum of two (2) business hours of initial contact.

Deliverable: Job description of the contract manager, including identification of the number of participants in the programs, besides Utah, for which the manager will be responsible, and a detailed explanation of the process to be followed to obtain assistance and support from the manager, including phone numbers and email addresses.

Task 01-04:

The Vendor shall provide quality customer service and responsive technical support to both the Division and program participants. Technical support for Division personnel must be available by telephone at a minimum during DOPL’s normal hours of operation (Weekdays between 0700 to 1800 MST). Because program participants are required to perform early morning, weekend, and holiday check-ins, the Vendor must provide live customer service and technical support to participants via telephone seven (7) days a week, including holidays, between the hours of 0430 to 1800 MST on weekdays, and 0700 to 1500 MST on weekends. The automated system itself must support participant check-ins daily starting no later than 0400 MST.

Deliverable: Policy and procedure outlining how technical support and customer service problems / complaints would be handled. The documentation must explicitly detail separate hours of operation and contact channels for Division staff and program participants. To ensure participant compliance is not hindered by technical delays, the documentation must commit to a maximum acceptable support response time of fifteen (15) minutes or less for inbound participant telephone calls and online helpdesk messages during all operational windows. The documentation must also include clear escalation procedures.

Task 01-05:

Except as otherwise specified by the Division, test results, comments, documentation and other data entered into the Vendor’s supplied systems shall become the property of the State of Utah.

Deliverable: Attestation with this requirement.

Task 01-06:

The Vendor shall develop, maintain, and distribute upon request user guides for all current participants and Division staff. The user guides shall be approved by the Division prior to use or dissemination. All guides must be readily accessible via a public website. In addition to written text manuals, the Vendor must provide a built-in, on-screen eLearning library within the platform featuring short, easy-to-follow "How-To" video tutorials covering core system navigation, check-ins, and report submissions.

Deliverable: Samples of existing documentation or video training outlines from similar programs already in effect, submitted to the Division for approval no later than the time of contract execution

Task 01-07:

The Vendor and all testing facilities utilized by the Vendor shall comply with applicable requirements of Public Law 101-336, the “Americans with Disabilities Act,” and any other applicable local, state, or federal law and regulation or rule.

Deliverable: Policy and procedure by which a participant may request an accommodation and a list of accommodations that can be made available by the Vendor.

Task 01-08:

Participant data shall be maintained in an electronic format that can be imported into the Division’s licensure database and network. Preference may be given to the Vendor with the electronic knowledge and capability to import and export testing and tracking data, including but not limited to, demographic information, registration and test scheduling, test results, comments and other documentation stored in the Vendor’s system.

Deliverable: Documentation describing basic file formats, transmission methods and security protocols used for importing and exporting data.

Task 01-09:

Data and Record Series: All information processed by this system constitutes official records of the State of Utah under Utah Code 63A-12-105 and is the exclusive property of the State of Utah. The Department of Commerce retains full ownership and control over the data. Upon request, the vendor must securely destroy records/data in accordance with Utah Code 63G-2-604 and provide a formal Certificate of Destruction or Data Destruction Attestation as validation.

Deliverable: Policy and procedure addressing this requirement.

Task 01-10:

Network and Data Flow Diagrams:

The vendor agrees to provide Network and Data Flow Diagrams prior to this system processing State Data. These diagrams will be securely stored in the State of Utah’s Governance, Risk and Compliance (GRC) system as required by DTS Policy 5000-0002 and per best practice in NIST 800-53 Rev 5 control SA-5 System Documentation.

Deliverable: Vendor must provide system documentation, to include Network and Data Flow Diagrams.

Task 01-11:

Privacy Impact Assessment:

For IT Systems that process personal data, the vendor agrees to assist the Department of Commerce, and provide substantiating documentation, to complete an IT System Privacy Impact Assessment (PIA) per DTS Policy 5000-0002 (2.4.3.1) and NIST 800-53 Rev 5 control RA-8 Privacy Impact Assessments.

Deliverable: Policy and procedure addressing this requirement.

Task 01-12:

The Vendor shall provide, at no cost to DOPL, all required supporting data required for the defense of tests and testing procedures when needed to support a contested test. Should there be a need for onsite representation it will be provided at reasonable out-of-pocket expenses only.

Deliverable: Policy and procedure addressing this requirement.

Task 01-13:

The Vendor shall comply with all applicable requirements of the Utah Code Annotated, (1953), as amended, (“U.C.A.”), and the Utah Administrative Code.

Deliverable: Attestation agreeing to this requirement.

Task 01-14:

The Vendor shall, at no cost to DOPL, migrate current and historical data from the current vendor, Affinity to populate the Vendor’s application or database.

Deliverable: Methodology and timing for converting the current and historical data.

Task 01-15:

The Vendor shall provide guarantees of cooperation with any new vendor or State of Utah’s Department of Technology Services in future migration of data to their application.

Deliverable: Guarantees of cooperation as indicated and a description how the Vendor would fulfill this requirement.

Task 01-16:

The Vendor shall supply references for five (5) existing professional health monitoring programs that have utilized all significant portions of the Vendor's proposed solution in a continuous and meaningful manner for at least three (3) consecutive years.

Deliverable: Five references as indicated, including contact name, address, phone and e-mail address.

Task 01-17:

The Vendor shall provide ongoing application improvement program focused on adopting and implementing new industry standards and needs of the Division as they arise.

Deliverable: Ongoing product improvement plan. Documentation shall address what types of improvements would be implemented at no additional cost, and what types of improvements would be implemented through and an increased participant fee schedule approved by the Division. . A fee schedule for DOPL specific changes must be included in the Vendor’s response.

Task 01-18:

The Vendor shall be prepared to demonstrate the complete range of features and functions proposed within 30 days of the date their proposal, if they are selected as a finalist.

Deliverable: Demonstration as indicated if selected as a finalist.

Task 01-19:

The Vendor shall train Division staff on the administration and use of their proposed system.

Deliverable: Recommended training approach and methods for initial training and recurrent training with an estimate of the time required for Division staff to complete the training.

PARTICIPANT MANAGEMENT

The monitoring and tracking of participants and the unique requirements of their Diversion Agreement, Stipulation and Order or Memorandum of Understanding and Order (MOU) is critical to the success of the program. This section outlines the requirements for the Vendors proposed solution to assist Division staff in their monitoring and tracking of all participants regardless as to their participation in the biological specimen monitor processes.

Task 02-01:

The Vendor’s application shall provide an online or web based feature that allows Division staff to add participants to the system and update participant information, including resetting passwords and user names. Participants shall have their own unique user name and password which can be changed whenever desired after logging into the system. It would be preferred if basic demographic information could be directly imported from the Division’s existing application currently used to track all licensees. At minimum the Vendor’s application must be able to capture the following information about each participant:

- name;

- SSN;

- license number;

- profession and license type;

- address, city, state, zip;

- e-mail address;

- work, home, FAX and cell phone numbers;

- current prescriptions including drug, date filled and quantity;

- participants drugs of choice;

- third party relationships;

- testing schedule; and

- user-ID and password for access to the online system.

Deliverable: Documentation showing methods and mechanisms for participant entry.

Task 02-02:

The Vendor’s application shall provide an online entry for one or more optional third party relationships for each participant, including the Participant’s:

- employer, including employer/company name, mailing address, email addresses, phone number and supervisor or employer point of contact;

- therapist, including, therapist name, employer or company, mailing and email addresses, work, home, FAX and cell phone numbers; and

- at least five other user definable entitles containing entity name, entity employer/company name, mailing address, email addresses, phone number, and point of contact.

Deliverable: Documentation showing methods and mechanisms for relationship entry.

Task 02-03:

The Vendor’s application shall provide an online or web based feature that will allow the Division staff to enter calendar-based information for due dates of scheduled reports from third parties.

Deliverable: Documentation showing methods and mechanisms for entry of due dates of scheduled reports from third parties.

Task 02-04:

The Vendor’s application shall contain a feature that presents, in calendar format, all of the reports that are due for a participant and due dates of the reports.

Deliverable: Documentation showing methods and mechanisms for this feature.

Task 02-05:

The Vendor’s application must support either internal electronic program communications or an interface to DOPL’s email system to allow communications to and from participants and Division staff.

Task 02-06:

The Vendor’s application shall allow for notes to be input by Division staff. The historical notes must be differentiated into UA result change notes, UA schedule change notes, meeting notes, internal mail indicator notes and miscellaneous notes. All notes must be capable of being arranged by type of note, chronologically or simply all notes chronologically. Division staff shall have the capacity to enter notes for any reason at any time.

Deliverable: Documentation showing methods and mechanisms for this feature

Task 02-07:

The Vendor’s system shall provide a “Dashboard” for Division staff that allows easy navigation of the site as well as providing notifications of “Critical Events” as determined by DOPL.

Task 02-08:

The Vendor’s system shall have the ability to “host” form letters into which demographic information can be imported from the Vendor’s database for ease of either emailing or regular mailing (Participant’s choice as indicated on their account) to a participant or therapist or other submitter who has an account in the system. The letters may need to be customized, so this ability shall be built into the system. The letters will, by default, be automatically signed off by the Division staff whose account has generated the letter, but the signature must be capable of being edited if needed. The system must provide for occasional customized mass mailings to a given Division staff member’s case load or to all participants via email or regular mail.

Task 02-09:

The Vendor’s system shall allow Division staff to search notes by types to be specified by DOPL.

Task 02-10:

It is desirable that the Vendor’s system provides for scanning of paper documents and direct fax receipt of documents into the system.

Task 02-11:

The Vendor’s system shall provide for a “Summary Report” to be generated for a given period of time as determined by Division staff that prints all documents, notes, call logs and specimen test results.

Deliverable: Documentation showing methods and mechanisms for this feature.

Task 02-12:

The Vendor’s system shall provide for “Read Only” access to Licensee Probation participant information stored in the Vendors system for the various bureau managers with in DOPL. As bureau managers they are the primary interface with the boards and commissions that have licensing responsibility for licensees. Participants in the UPHP program will not be visible to the bureau managers.

Deliverable: Documentation showing methods and mechanisms for this feature.

Task 02-13:

The Vendor’s system shall provide mechanism to keep records of participants in UPHP separate from participants involved in public discipline.

Deliverable: Documentation showing methods and mechanisms for this feature.

3. ONLINE BIOLOGICAL SPECIMEN MONITORING

Task 03-01:

The Vendor’s application shall provide for random generation of testing dates up to five years in advance.

Task 03-02:

The Vendor’s application shall provide for randomizing of the drug testing schedules based on parameters set by DOPL, with the ability to modify the schedule by Division staff manually in a calendar view format.

Task 03-03:

The Vendor’s application shall have the capability to customize each participant’s testing program, with up to four different testing panels that may be chosen for a participant using a percentage system for each. The application shall have the capability to allow the percentages to be changed at any time for individual participants.

Task 03-04:

The Vendor’s application shall provide both a web-based and telephone “check-in” capability to notify participants of the need to submit a specimen collection in any given period of time as determined by DOPL.

Task 03-05:

The Vendor’s system shall track all calls/online connections by logging the following for each call/connection:

· date and time of the call/connection;

· call/connection duration; and

· phone number/IP address The system shall provide a confirmation number for the completed call to the participant for their records.

Deliverable: Documentation showing methods and mechanisms for this feature including sample reports.

Task 03-06:

The Vendor’s system shall have a call in feature that is available 365 days a year, with daily time frames of operation as determined by the Division, up to 24 hours a day.

Task 03-07:

The Vendor shall establish relationships with testing sites such that samples can be taken 365 days a year in locations positioned so that no participant in cities within the State of Utah with a population base of more than 5,000 has to travel more than one hour each way in order to test.

Deliverable: Documentation showing compliance with this requirement.

Task 03-08:

The Vendor shall establish relationships with testing sites such that samples can be taken 365 days per year in cities within the State of Utah with a population base of 20,000 or more.

Deliverable: Documentation showing compliance with this requirement.

Task 03-09:

The Vendor shall provide a web directory of its multiple testing sites in Utah and surrounding states.

Deliverable: Web Directory of Vendor’s multiple testing sites in Utah and surrounding states.

Task 03-10:

The Vendor shall not suspend functionality of the system to schedule or perform biological specimen testing and monitoring for a participant due to a participant’s failure to pay for UA testing or other associated costs. Testing results may be withheld until payment is received by the Vendor, but the UA collection and transport to the lab or other forensic holding arrangement must take place.

Task 03-11:

The Vendor shall administer test panels that are essentially identical to the test panels currently in use by the Division. Three example panels are identified in Appendix A.

Deliverable: Documentation identifying of the “Cost of Collection” and “Cost of Analysis” or lab services for the three panels shown in Appendix A.”

Task 03-12:

The Vendor shall provide testing using urinalysis, blood, and hair samples with other biological sample monitoring, such as sweat or saliva, being available as might be individually arranged.

Task 03-13:

The Vendor shall have the capability to provide modified and additional testing panels or methods not listed in Appendix A as specified by the Division, with fee schedule adjustments as may be necessary and are approved by the Division. The Division prefers a Vendor with the operational flexibility to allow third-party data results from auxiliary testing provider, such as forensic DNA-verified urine testing or advanced remote blood-spot testing, to be integrated into the centralized participant compliance profile at no additional cost to the State or the participant. These alternative collection methods are highly desired as options to resolve participant hurdles including:

· Rural Access: Minimizing travel times and eliminating drives exceeding one (1) hour each way for participants residing in geographically isolated areas.

· Availability & Staffing Limitations: Bypassing localized collection clinic issues, such as early facility closures or temporary shortages of mandatory male or female physical observers.

· Time Savings: Minimizing professional workplace disruptions by allowing secure, home- or office-based voluntary self-collections.

Deliverable: Documentation showing methods and mechanisms for this feature, including system document ingestion workflows used to add or modify alternative testing panels and external data results. Additionally, the Vendor must provide a transparent, line-item fee schedule breakdown for any alternative or remote testing methods they provide, explicitly itemizing all associated participant costs including individual collection kit provisioning fees, initial forensic DNA reference sample collection materials, and prepaid return laboratory shipping or courier logistics.

ONLINE COMPLIANCE MANAGEMENT

Task 04-01:

The Vendor’s application shall provide a secure online or web enabled feature that will allow participants, employer, therapist, and other third parties entities to enter updated information about the participant’s progress and participation using DOPL defined forms. Third parties shall be able to see information which they have previously entered, but shall not be allowed to modify the information.

Deliverable: Documentation showing methods and mechanisms for third party entry.

Task 04-02:

The Vendor’s secure online or web enabled system shall contain a “Participant Dashboard” that will alert the participant for important program information such as missed calls, missed tests, or other critical events such as due dates for therapist reports, employer reports, self-reports, other third party reports or notification of a positive UA. Any Participant financial accounts involving the Vendor shall be accessible to the participant via their individual accounts. Immediate payment of any past due amounts shall be available online and by telephone.

Deliverable: Documentation showing methods and mechanisms for this feature including sample screen shots.

Task 04-03:

The Vendor’s application shall provide a secure online or web enabled feature that will allow the Division’s Compliance Unit staff to create and maintain third party logins for participants. Logins for third parties will have limited ability to view and update information about the participants for which they have established relationships.

Deliverable: Documentation showing methods and mechanisms for entry, access and security.

Task 04-04:

The Vendor’s application shall allow a third party upon logging into their account to access a list of all participants that are tied to their account and the status of the participant’s required reports for which the submitter is responsible and the option to submit an unscheduled report. The application shall show what reports have been submitted, when reports are due, which reports are overdue.

Deliverable: Documentation showing methods and mechanisms for this feature including sample screen shots.

Task 04-05:

The Vendor's application shall feature an automated, real-time alert system designed to instantly notify assigned Division personnel of non-compliance events. The platform must push notification alerts immediately upon the closure of a compliance tracking window or receipt of laboratory data. These critical event triggers must include but are not limited to: missed reports, missed daily participant check-ins, failed or skipped scheduled collection windows, out-of-range specimen validity markers (dilutes, adulterations, or substitutions), and positive laboratory drug/alcohol test results.

Deliverable: Documentation showing methods and mechanisms for this feature including sample screen shots.

Task 04-06:

The Vendor's application shall provide a built-in compliance reporting engine allowing Division staff to generate and run aggregate caseload reports. The reporting interface must provide filtering parameters by profession, individual case manager, and specific monitoring periods. The engine must support the extraction of compliance summaries, active caseload counts, and testing summary results.

Deliverable: Documentation showing methods and mechanisms for this feature including sample screen shots.

Task 04-08:

The vendor’s platform must possess operational flexibility to support both traditional paper-based Chain-of-Custody (COC) tracking workflows and digital electronic COC check-ins.

Deliverable: Documentation showing methods and mechanisms for this feature including sample screen shots.

Appendix A Typical Drug Testing Panels

1. Panel Profile: Urine Matrix

· Panel Identifier: UPHP (D-764204) - MedPro A + EtG(250) + Fentanyl

· Panel Type: Urine

· Test Drugs: Amphetamine, Barbiturate, Benzodiazepines, Cannabinoid, Cocaine, Codeine, Ethanol Urine (UAL), Ethyl Glucuronide (EtG), Ethyl Sulfate (EtS), Fentanyl, Hydrocodone, Hydromorphone, Meperidine, Methadone, Morphine, Opiates, Oxycodone, Phencyclidine (PCP), Propoxyphene, Tramadol.

· Mandatory Specimen Validity Testing (SVT): Creatinine, Nitrite, pH, Specific Gravity.

2. Panel Profile: Nail Matrix

· Panel Identifier: NailStat 12 Drug Panel

· Panel Type: Nail

· Test Drugs: Cannabinoid, Carboxy THC, Cocaine, Methamphetamine, Opiates, Oxycodone, Phencyclidine (PCP), Propoxyphene, Tramadol.

· Tracked Metabolites & Analytes: 6-Acetylmorphine (6-MAM), Alprazolam, Amobarbital, Amphetamine, Barbiturate, Benzodiazepines, Benzoylecgonine, Butalbital, Cocaethylene, Codeine, Diazepam, EDDP, Hydrocodone, Hydromorphone, MDA, MDEA, MDMA, Meperidine, Methadone, Midazolam, Morphine, Norcocaine, Nordiazepam, Norhydrocodone, Normeperidine, Noroxycodone, Norpropoxyphene, Oxazepam, Oxymorphone, Pentobarbital, Phenobarbital, Secobarbital, Temazepam.

3. Panel Profile: Blood Matrix

· Panel Identifier: PEthStat (Blood Draw)

· Panel Type: Blood

· Test Drugs: Phosphatidyl Ethanol (PEth)

GOVRAMP

· In compliance with the Utah terms and conditions, where the product does not already have a FedRAMP or GovRAMP authorization status the following provisions apply:

. At the time of contract execution, the product must be enrolled in the GovRAMP Progressing Snapshot Program and remain in the program until a verified status is achieved.

. For nonsensitive data the following must be added: The product must achieve a verified status of GovRAMP Core no later than 12 months after the date of contract execution and maintain that status.

. For sensitive data the following must be added: The product must achieve a verified status of GovRAMP Core no later than 12 months after the date of contract execution and achieve a verified status of GovRAMP Moderate Authorized no later than 24 months after the date of contract execution.

. If the Contractor fails to maintain or achieve the security requirements outlined above, the using department may reevaluate the terms of the contract and determine whether the failure to comply justifies contract termination.