6070 - S-44300-00017529 PDMP RFP.pdf

DAS Procurement Services, Version 4.5 March 31, 2023 Page 1 of 33

STATE OF OREGON

COVER PAGE

OREGON HEALTH AUTHORITY

Is issuing this Request For Proposals (RFP) under

OregonBuys Bid Number S-44300-00017529 for

PRESCRIPTION DRUG MONITORING DATABASE FOR

CONTROLLED SUBSTANCES TRACKING

Date of Issue: August 19, 2026

Opening Date and Time: September 21, 2026, 12:00pm

Single Point of Contact (SPC): Kirsten Udani, IT Procurement Manager

Address: 500 Summer Street, NE City, State, Zip Salem, Oregon 97301 Phone 503-798-2469 E-mail: Kirsten.udani@odhsoha.oregon.gov

The State of Oregon promotes equal opportunity for all individuals without regard to age, color, disability, marital status, national origin, race, religion or creed, sex or gender, sexual orientation, or veteran status.

DAS Procurement Services, Version 4.5 March 31, 2023 Page 2 of 33

TABLE OF CONTENTS

SECTION 1: GENERAL INFORMATION

1.1 INTRODUCTION

1.2 SCHEDULE

1.3 SINGLE POINT OF CONTACT (SPC)

SECTION 2: AUTHORITY, OVERVIEW, AND SCOPE

2.1 AUTHORITY AND METHOD

2.2 DEFINITION OF TERMS

2.3 OVERVIEW AND PURPOSE

2.4 SCOPE OF WORK/SPECIFICATIONS

SECTION 3: PROCUREMENT REQUIREMENTS

3.1 PROPOSAL SUBMISSIONS .................................................................... Error! Bookmark not defined.

3.2 PROPOSAL FORMAT AND QUANTITY ................................................. Error! Bookmark not defined.

3.3 AUTHORIZED REPRESENTATIVE .......................................................... Error! Bookmark not defined.

3.4 PROPOSAL REQUIREMENTS ……………………………………………..……………………11

SECTION 4: SOLICITATION PROCESS

4.1 PUBLIC NOTICE

4.2 PRE-PROPOSAL CONFERENCE

4.3 QUESTIONS / REQUESTS FOR CLARIFICATIONS

4.4 SOLICITATION PROTESTS

4.5 PROPOSAL DELIVERY OPTIONS

4.6 PROPOSAL MODIFICATION OR WITHDRAWAL

4.7 PROPOSAL DUE

4.8 PUBLIC OPENING

4.9 PROPOSAL REJECTION

4.10 EVALUATION PROCESS

4.11 POINT AND SCORE CALCULATIONS

4.12 RANKING OF PROPOSERS

4.13 NEXT STEP DETERMINATION

SECTION 5: AWARD AND NEGOTIATION

5.1 AWARD NOTIFICATION PROCESS

5.2 INTENT TO AWARD PROTEST

5.3 APPARENT SUCCESSFUL PROPOSER SUBMISSION REQUIREMENTS

5.4 CONTRACT NEGOTIATION

SECTION 6: ADDITIONAL INFORMATION

6.1 COMITTMENT TO DIVERSITY AND INCLUSION…………………………………………………………….32

6.2 CERTIFIED FIRM PARTICIPATION

6.3 GOVERNING LAWS AND REGULATIONS

6.4 OWNERSHIP/PERMISSION TO USE MATERIALS

6.5 CANCELLATION OF RFP; REJECTION OF PROPOSAL; NO DAMAGES

6.6 COST OF SUBMITTING A PROPOSAL

6.7 STATEWIDE E-WASTE/RECOVERY PROCEDURE

DAS Procurement Services, Version 4.5 March 31, 2023 Page 3 of 33

LIST OF ATTACHMENTS

ATTACHMENT A SAMPLE CONTRACT/PRICE AGREEMENT

ATTACHMENT B DISCLOSURE EXEMPTION AFFIDAVIT

ATTACHMENT C PROPOSER INFORMATION AND CERTIFICATION SHEET

ATTACHMENT D REFERENCE CHECK FORM

ATTACHMENT E PRICE PROPOSAL FORM

ATTACHMENT F CERTIFIED DISADVANTAGED BUSINESS OUTREACH PLAN

ATTACHMENT G RESPONSIBILITY INQUIRY

ATTACHMENT H ENHANCEMENTS AND HOURLY RATES

ATTACHMENT I SCOPE OR WORK

ATTACHMENT J DATA FLOWS AND INTERFACES

ATTACHMENT k SERVICE REQUIREMENTS

ATTACHMENT L SYSTEM REQUIREMENTS

ATTACHMENT M STATEWIDE INFORMATION SECURITY STANDARDS SPREADSHEET

DAS Procurement Services, Version 4.5 March 31, 2023 Page 4 of 33

SECTION 1: GENERAL INFORMATION

1.1 INTRODUCTION

The State of Oregon, acting by and through the Oregon Health Authority (OHA or Agency), is issuing this Request for Proposals (RFP) under ORS 279B.060 to procure a fully managed Software-as-a-Service (SaaS) solution for the Prescription Drug Monitoring Program system, including, hosting, maintenance, security, compliance, and enhancement services. The SaaS solution must meet all applicable federal and state requirements for data privacy, system availability, and interoperability with state systems.

The solution for the Prescription Drug Monitoring Program system must be a secure, statewide electronic system that collects and transmits data on controlled substance prescriptions dispensed in Oregon. It must support the programmatic goals of reducing misuse and improving prescribing practices, and provide the technical infrastructure needed to exchange data with healthcare providers, pharmacies, and interstate partners.

This RFP seeks qualified vendors to provide a comprehensive SaaS solution that includes hosting, maintenance, support, and enhancement services. The system must support secure data collection and storage, real-time access, peer comparison reports, and interstate data sharing. The contract resulting from this RFP will not fund integration of the PDMP into electronic health records but will support and bridge existing integrations and allow new connections completed by one or more third parties.

A separate contract or funding mechanism—outside the scope of this RFP—may be used by the State or its partners to develop or maintain integrations between the PDMP and EHR systems. The successful Proposer and its solution must support and maintain the PDMP system in a way that enables those integrations. Including:

Ensuring the system has open APIs or interfaces that third-party integrators can use, collaborating with third-party integrators as needed to troubleshoot or support connectivity, maintaining compatibility with existing integration points. Proposers should understand that while they are not responsible for building or funding EHR integrations, their system must be technically capable of supporting them and flexible enough to accommodate new connections initiated by others.

The awarded contract is anticipated to have an initial term of five years. At the sole discretion of the Oregon Health Authority (OHA), the Contract may be renewed for additional time subject to:

• Satisfactory performance by the contractor.

DAS Procurement Services, Version 4.5 March 31, 2023 Page 5 of 33

• Continued need for the services.

• Availability of funding.

• Agreement on any revised terms and conditions.

• Continued State of Oregon approvals (e.g., EIS).

1.2 SCHEDULE

The table below represents a tentative schedule of events. All times are listed in Pacific Time. All dates listed are subject to change. N/A denotes that event is not applicable to this RFP.

Event Date Time

Questions / Requests for Clarification Due August 28, 2026 5:00 pm

Answers to Questions / Requests for Clarification Issued (approx.)

September 10, 2026 4:00pm

Opening Proposal (Bid Opening Date) September 21, 2026, 9:00 am

Issuance of Notice of Intent to Award (approx.) October 5, 2026

Award Protest Period Ends 7 calendar days after Notice of Intent to Award

1.3 SINGLE POINT OF CONTACT (SPC)

The SPC for this RFP is identified on the Cover Page, along with the SPC’s contact information. Proposer shall direct all communications related to any provision of the RFP only to the SPC; technical requirements, contractual requirements, the RFP process, or any other provision.

SECTION 2: AUTHORITY, OVERVIEW, AND SCOPE

2.1 AUTHORITY AND METHOD

Agency is issuing this RFP under the authority of the Department of Administrative Services (DAS) delegation REQ-10000-00020921 (as amended), Amended Delegation Agreement.

Agency is using the Competitive Sealed Proposal method, pursuant to ORS 279B.060 and OAR 125-247-0260. Agency may use a combination of methods for Competitive Sealed Proposals, including optional procedures: a) Competitive Range; b) Discussions and Revised Proposals; c) Revised Rounds of Negotiations; d) Negotiations; e) Best and Final Offers; and f) Multistep Sealed Proposals.

DAS Procurement Services, Version 4.5 March 31, 2023 Page 6 of 33

2.2 DEFINITION OF TERMS

For the purposes of this RFP, capitalized words are defined in OAR 125-246-0110 or as defined below, or in the Sample Contract.

Authorized Users: Means individuals permitted by state law to access PDMP data, such as healthcare providers and pharmacists.

Controlled Substances: Means drugs and chemicals regulated by the government due to their potential for abuse or dependence, categorized into Schedules II–V based on their medical use and risk of misuse.

Data Sharing Interoperability: Means the ability of the PDMP system to communicate and share information with other systems, including interstate PDMPs, electronic health records (EHRs), health information exchanges (HIEs), and pharmacy systems.

Drug Diversion: Means the illegal distribution or use of prescription medications for purposes other than intended medical treatment.

Electronic Health Records (EHR) Integration: Means the process of incorporating PDMP data into healthcare providers' electronic patient records to streamline access and improve decision-making.

Health Information Exchange (HIE): Means a system that allows for the secure sharing of healthcare information among providers and organizations, improving care coordination.

Interstate Data Sharing Means ability to facilitate the sharing of PDMP data between states, enabling authorized users to view a patient's prescription history across multiple jurisdictions. This can be accomplished through either of the existing interstate data sharing platforms (PMP InterConnect/RxCheck).

Prescription Drug Monitoring Program (PDMP): Means A secure, statewide electronic database administered by the Oregon Health Authority that collects and monitors prescriptions for controlled substances to support appropriate prescribing, prevent misuse, and protect public health, in accordance with ORS 431A.865.

Peer Comparison Report: Means a system produced report comparing the prescribing practices of an individual prescriber to other similar prescribers based on criteria determined by the state. E.g. specialty of practice, license type.

Real-Time Data Retrieval: Means the capability of the PDMP system to provide up-to-date prescription information with minimal delays, enhancing the efficiency of healthcare providers.

DAS Procurement Services, Version 4.5 March 31, 2023 Page 7 of 33

Secure Web-Based Portal: Means a secure, user-friendly website where authorized users can access PDMP data for patient-specific reports.

Schedules II–V Substances: Means these are classes of controlled substances, with Schedule II substances having high potential for abuse and dependence (e.g., opioids), and Schedule V substances having a lower potential for abuse (e.g., certain anti-anxiety medications).

2.3 OVERVIEW AND PURPOSE

2.3.1 Agency Overview and Background

The Oregon Health Authority (OHA) is a state government agency dedicated to improving the health and well-being of Oregon residents. OHA’s Prescription Drug Monitoring Program (PDMP) is a key program promoting responsible prescribing practices, reducing drug misuse, and enhancing public health outcomes.

The PDMP was established under ORS 431A.855 to 431A.900, with specific authority granted in ORS 431A.865 and ORS 431A.870, which outline the program’s purpose, data collection requirements, and access provisions https://www.oregon.gov/oha/PH/PREVENTIONWELLNESS/SAFELIVING/PDMP/Pages/i ndex.aspx The PDMP system to be provided by the successful Proposer must support this program for prescription data for controlled substances (Schedules II–V) dispensed in or into Oregon. This secure and centralized technical system must enable authorized healthcare providers, including physicians, dentists, nurse practitioners, pharmacists, podiatrists, and physician associates, to query patient-specific reports to support clinical decision-making.

By identifying potential instances of drug diversion, overlapping prescriptions, or misuse, the PDMP system must provide valuable insights that improve patient care and support the goals of the PDMP program.

Access to the PDMP System must be strictly limited to authorized users, as required under ORS 431A.865. Authorized users include specified healthcare professionals.

OHA actively manages its program to monitor compliance with legal requirements, data security, and confidentiality, and the successful Proposer must engage with and ensure compliance with the regulatory regime.

Additionally, the PDMP is an essential component of Oregon's broader strategy to combat the opioid crisis and prevent prescription drug abuse. By supporting interstate data sharing via PMP InterConnect (PMPi) or RxCheck and integrating with electronic health records (EHRs) and health information exchanges (HIEs), the PDMP System must continue to serve as a cornerstone of modern healthcare delivery in Oregon.

Since its inception, the program has grown significantly, with over 34,000 distinct https://www.oregon.gov/oha/PH/PREVENTIONWELLNESS/SAFELIVING/PDMP/Pages/index.aspx https://www.oregon.gov/oha/PH/PREVENTIONWELLNESS/SAFELIVING/PDMP/Pages/index.aspx

DAS Procurement Services, Version 4.5 March 31, 2023 Page 8 of 33 users as of September 2025, with access to more than 21.4 million prescription records. This robust utilization underscores the importance and success of the PDMP System in addressing prescription drug misuse and promoting safe prescribing practices across the state.

2.4 Project Overview and Background

2.4.1 Purpose and Objectives

OHA is committed to advancing its PDMP to better serve healthcare providers, improve patient care, and strengthen its role in preventing prescription drug misuse.

Through this RFP, OHA seeks a qualified vendor to provide a fully managed Software-as-a-Service (SaaS) solution as the PDMP system. The contractor will be responsible for hosting, maintenance, security, compliance, and enhancement services. The solution must meet all applicable federal and state requirements for data privacy, system availability, and interoperability with state systems.

The successful Proposer is expected to provide the following as part of its solution, to support the related PDMP program objectives:

Enhance System Functionality: Maintain a secure, scalable, and centralized PDMP platform that supports current and future prescription data volumes, compatible with seamless integration to EHRs, HIEs, and pharmacy systems.

Strengthen Data Sharing: Enable interstate data exchange through PMP InterConnect (PMPi) or RxCheck to provide prescribers with a comprehensive view of patients’ prescription histories.

Improve Accessibility and User Experience: Deliver a user-friendly, web-based portal with real-time data access and intuitive interfaces for over 31,000 authorized users.

Support Public Health Goals: Empower healthcare providers with timely, accurate data to inform prescribing decisions and reduce opioid misuse and diversion.

Provide Self-Assessment Tool: Deliver a peer comparison report to system users that allows comparison between their prescribing practices and the relevant prescribing peers.

DAS Procurement Services, Version 4.5 March 31, 2023 Page 9 of 33

Leverage Technology for Efficiency: Implement robust data management, hosting, and security practices to ensure compliance with Oregon law and safeguard sensitive health information.

2.5 SCOPE OF WORK/SPECIFICATIONS

The Scope of Work in Attachment I outlines the core services and responsibilities expected of the successful Proposer. Additional details may be found in Attachment L, System Requirements, which specifies technical and functional expectations. The Sample Contract in Attachment A also reflects scope-related provisions and expected contractual responsibilities, such as deliverable review processes and performance standards.

2.6 AGENCY EXPERIENCE PREFERENCES

Proposer must have successfully provided at least three instances of services similar in scope and complexity to those described in this RFP. These engagements must demonstrate Proposer’s ability to implement, operate, and maintain SaaS that supports state-level PDMP programs, or comparable health information technology systems that involve:

• Secure handling of controlled substance prescription data.

• Integration with external systems such as Electronic Health Records (EHRs), pharmacy systems, and national data exchanges.

• Compliance with applicable state and federal regulations, including HIPAA and 42 CFR Part 2.

• High availability, performance, and data integrity standards.

Agency prefers Proposers with experience supporting public health or regulatory programs that require real-time data access, user authentication, and role-based access controls.

SECTION 3: PROCUREMENT REQUIREMENTS

3.1 Proposal Submissions

To be considered for evaluation, Proposal must contain each of the following elements (further detailed in Proposal Requirements section below):

• Executive Summary

• Administrative Proposal

DAS Procurement Services, Version 4.5 March 31, 2023 Page 10 of 33

• Technical Proposal

• Disclosure Exemption Affidavit (Attachment B)

• Proposer Information and Certification Sheet (Attachment C)

• Reference Check Form (Attachment D)

• Price Proposal Form (Attachment E)

• Oregon Certified Disadvantage Business Outreach Plan (Attachment F)

• Responsibility Inquiry (Attachment G)

• Service Requirements (Attachment K)

• System Requirements response (Attachment L)

• Oregon Statewide Security Standards statement (Attachment M)

• Key Persons and Resumes

3.2 PROPOSAL FORMAT AND QUANTITY

Proposal should follow the format and reference the sections listed in the Proposal Requirements section. Responses to each section and subsection should be labeled to indicate the item being addressed.

OregonBuys Electronic Response. Proposer should submit its Proposal electronically through OregonBuys. Proposer should follow the procedures outlined in this section for electronic submission.

The Price Proposal must be submitted as a separate electronic response file.

Proposer shall submit one copy of its Proposal and all other submittal requirements, with Attachment C - Proposer Information and Certification Sheet bearing the Proposer’s authorized representative’s Signature, in one of the following formats: Adobe Acrobat (pdf), Microsoft Word (docx), or Microsoft Excel (xlsx). If Proposer believes any of its Proposal is exempt from disclosure under Oregon Public Records Law (ORS 192.311 through 192.478), Proposer shall complete and submit the Disclosure Exemption Affidavit (Attachment B). Proposer shall also mark as “Confidential” in OregonBuys all attachments to its Proposal that Proposer believes are exempt from disclosure

The Proposer Information and Certification Sheet (Attachment C) must bear the Proposer’s authorized representative’s Signature.

3.3 AUTHORIZED REPRESENTATIVE

Failure of Proposer’s authorized representative to sign the Proposal may result in rejection of the Proposal by Agency.

3.4 PROPOSAL REQUIREMENTS

DAS Procurement Services, Version 4.5 March 31, 2023 Page 11 of 33

Proposal must address each of the items listed in this section and all other requirements set forth in this RFP. Proposer shall describe the Goods to be provided or the Services to be performed or both. A Proposal that merely offers to provide the goods or services as stated in this RFP may be considered non-Responsive to this RFP and will not be considered further.

Proposal should not include extensive artwork, unusual printing or other materials not essential to the utility and clarity of the Proposal. Do not include marketing or advertising material in the Proposal, unless requested. Proposal should be straightforward and address the requests of the RFP. Proposal containing unsolicited marketing or advertising material may receive a lower evaluation score if required information is difficult to locate.

3.4.1 Proposer Information and Certification Sheet

Proposer shall complete and submit the Proposer Information and Certification Sheet (Attachment C).

Failure to demonstrate compliance with Oregon Tax Laws and sign the Proposer Information and Certification Sheet may result in a finding of non-Responsibility.

3.4.2 References

Provide 3 references from current or former client firms for similar projects performed for any clients within the last 10 years. References must be able to verify the quality of previous, related Work.

Agency may check to determine if references provided support Proposer’s ability to comply with the requirements of this RFP. Agency may use references to obtain additional information, or verify any information needed. Agency may contact any reference (submitted or not) to verify Proposer’s qualifications.

Proposer shall send the Reference Check Form (Attachment D) to its references.

Reference forms must be completed by the reference, returned to the Proposer and submitted with the Proposal.

3.4.3 Pricing

a. Price Proposal

Provides instructions and a framework for Proposer to convey the proposed prices associated with its Services. Agency will review Proposer’s detailed Price Proposal (Attachment E) to ensure all the information required for the services is reflected.

b. Enhancement Rates

DAS Procurement Services, Version 4.5 March 31, 2023 Page 12 of 33

Attachment H, Enhancement and Hourly Rates, provides instructions for submitting pricing related to system enhancements that fall outside the base support scope, and hourly rates for additional work that may be requested by Agency during the contract term. Proposer must complete and submit Attachment H as part of its proposal. Attachment must include:

• A detailed rate schedule for enhancement work, categorized by role (e.g., developer, business analyst, project manager).

• Any tiered pricing, volume discounts, or fixed-price options for common enhancement types, if applicable.

A proposal for how enhancement work will be estimated, proposed, and authorized under the contract.

3.4.4 Key Persons and their Resumes

The Staffing Plan must describe how Proposer intends to organize and allocate resources to successfully deliver the PDMP system, including all services related to implementation, operation, and ongoing support described in this RFP. The plan must identify Key Persons who will serve as primary points of contact for Agency and who will be responsible for ensuring the fulfillment of all contractual obligations and performance standards.

For each Key Person, Proposer must provide a detailed resume that includes relevant experience, qualifications, certifications (if applicable), and prior work on similar projects, particularly in the areas of health IT, controlled substance monitoring, or public health data systems.

This section must also address the use of subcontractors or third-party vendors, if applicable. Proposer must clearly define the roles and responsibilities of all proposed third-party services and personnel and demonstrate how they will be integrated into the overall project team and management structure.

The following roles must be designated as Key Persons for the PDMP contract:

Project Manager – Responsible for overall project coordination, communication with Agency, and ensuring timely delivery of all milestones.

Service Manager – Oversees day-to-day operations, service delivery, and compliance with Service Level Agreements (SLAs).

Application Development Lead - Leads the design, development, and maintenance of the PDMP system, including user interface and backend functionality.

DAS Procurement Services, Version 4.5 March 31, 2023 Page 13 of 33

Interface Development Lead – Manages integration with external systems such as EHRs, pharmacy systems, and national data exchanges (e.g., PMP InterConnect, RxCheck).

Proposer is expected to assign Key Persons with demonstrated experience in managing and delivering complex, secure, and compliant health IT systems. The Staffing Plan must reflect Proposer’s ability to support the implementation, operation, and enhancement of the PDMP system, ensuring its performance, reliability, and alignment with state and federal requirements.

3.4.5 Technical Proposal

a. Approach to providing SaaS services

Describe in detail how Proposer will meet the requirements outlined in this RFP for Software-as-a-Service (SaaS) delivery, including configuration and ongoing operations . The response must include:

• A detailed description of the processes, tools, and methodologies Proposer will use to configure and support the PDMP system.

• Proposer’s approach to performance monitoring and reporting, including metrics, frequency, and escalation protocols.

• A description of proposed deliverables for the resulting contract’s Statement of Work (SOW), including:

• Deliverable name and description.

• Format (e.g., document, dashboard, report).

• Suggested minimum acceptance criteria.

In addition to references, Proposer must submit three or more relevant work samples that demonstrate its experience delivering and supporting similar SaaS systems in a regulated environment. These samples should reflect the Proposer’s ability to meet the technical, operational, and compliance requirements described in this RFP.

A detailed description of Proposer’s Software Development Lifecycle (SDLC), including how it supports secure, scalable, and compliant development and deployment practices.

A proposed Statement of Work (SOW) that clearly articulates how Proposer will meet Agency’s needs, addressing the scope and deliverables described in Section 2 of this RFP.

b. Engagement Proposal

A description of how proposer plans to collaborate and engage with:

DAS Procurement Services, Version 4.5 March 31, 2023 Page 14 of 33

• Agency

• Internal and external stakeholders and process participants

• Other contractors

Proposers should describe any experience maintaining or supporting systems hosted in Microsoft Azure or comparable cloud environments (e.g., AWS, Google Cloud), even if not directly responsible for managing the hosting infrastructure.

c. System Documentation Updates and Maintenance

Describe how Proposer will maintain and update PDMP system documentation. Include details regarding the review and update cycle and the processes that will be used to ensure accuracy and completeness.

d. Quality Assurance and Quality Control Processes

Describe Proposer’s quality assurance (QA) and quality control (QC) processes. How would those processes be applied to the services? How would Proposer report on the results and efficacy of those QA and QC processes?

e. Proposed Service Level Agreements (SLAs)

Proposer must provide proposed Service Level Agreements (SLAs including reasoning for each SLA and an explanation of how the proposed levels will deliver optima service to the Agency. The State’s preferred SLA targets are outlined in Attachment K, Service Requirements, Attachment L, System Requirements and Attachment B, Scope of Work. Proposers should review these expectations and either confirm alignment or propose alternatives with justification.

Proposer shall specifically describe its approach and proposed SLA(s) to resolve Incidents and Defects as defined in Attachment B, Scope of Work

f. Issue Escalation and Resolution

Describe Proposer’s approach to issue resolution and escalation in the context of a complex, multi-entity environment such as the Oregon Prescription Drug Monitoring Program (PDMP). The response must include:

The techniques, tools, and processes Proposer will use to identify, track, escalate, and resolve issues involving:

• State of Oregon staff (e.g., OHA, ODHS, OIS EIS, ODCS).

DAS Procurement Services, Version 4.5 March 31, 2023 Page 15 of 33

• Other contractors, vendors, and system integrators.

• External stakeholders (e.g., HIT Commons), if applicable.

A description of Proposer’s experience managing conflict and resolving issues in similarly complex environments, including:

• Engagement size and scope.

• Number and types of entities involved.

• Lessons learned and how those lessons have informed Proposer’s current practices.

Proposer’s approach to proactive communication and collaboration, including how its staff are trained or coached to:

• Communicate clearly and constructively.

• De-escalate conflict.

• Maintain professionalism and accountability across organizational boundaries.

Examples of Proposer’s experience with conflict management, negotiation, and multi-party collaboration, particularly in regulated or healthcare-related environments.

g. Service Requirements

Attachment K, Service Requirements, is a high-level list of baseline service expectations that Proposer must address in its response. These requirements are critical to the successful delivery and ongoing support of the Oregon Prescription Drug Monitoring Program (PDMP) system.

Each service requirement listed in Attachment must be clearly addressed by Proposer. Responses should demonstrate how Proposer will meet or exceed each requirement, including any relevant context, methodology, or tools used to ensure compliance.

Proposer must complete and submit Attachment K as part of its Proposal.

Additionally, Proposer must use Attachment K to indicate where in its Proposal each service requirement is addressed. This cross-reference will assist Agency in evaluating how well Proposer understands and can meet the operational and technical needs of the PDMP system.

3.4.6 Security Requirements Narrative

Proposer shall submit a statement addressing its capacity to meet State Information Technology Security Requirements.

DAS Procurement Services, Version 4.5 March 31, 2023 Page 16 of 33

The statement must reflect the information indicated in this section, and clearly demonstrate that if awarded a Contract:

a. Proposer understands and is capable of handling and protecting Agency Data classified as Level 3 Information under the State of Oregon’s Information Asset Classification policy available online at:

https://www.oregon.gov/das/Policies/107-004-050.pdf.

b. Proposer and Proposer's staff monitoring its systems who will have access to State systems, facilities, and confidential information shall submit to all security checks requested by the State, which may include any combination of fingerprinting, Oregon Law Enforcement Data Systems (“LEDS”) and Federal Bureau of Investigation Criminal Justice Information Services (“FBI CJIS”) background checks.

c. As necessary, Proposer shall sign a non-disclosure agreement regarding information received or processed on its equipment from the State of Oregon.

d. Proposer shall comply with Oregon’s Statewide IT Laws, Policies, Plans and Standards as follows:

• Oregon’s 2023 Statewide Information Technology Contol Standards found online at:

https://www.oregon.gov/eis/cyber-security-services/Documents/eis-css-statewide-information-technology(IT)-control-standards.pdf.

• The system and services being proposed must meet or exceed National Institute of Standards and Technology (“NIST”) Special Publication (SP) 800-53 R5 “Moderate” IT Security Control Requirements. Proposer may (but is not required to) demonstrate compliance with Oregon’s Statewide Information Technology Control Standards and NIST SP 800-53 R5 by presenting Proof of current GovRAMP Authorized status (Ready, Provisionally Authorized, or Authorized) in the form of a GovRAMP Letter, or a valid GovRAMP Security Snapshot Score.

• Oregon’s 2023 Statewide Information Security Program Plan found online at:

https://www.oregon.gov/das/Policies/107-004-050.pdf https://www.oregon.gov/eis/cyber-security-services/Documents/eis-css-statewide-information-technology(IT)-control-standards.pdf https://www.oregon.gov/eis/cyber-security-services/Documents/eis-css-statewide-information-technology(IT)-control-standards.pdf https://www.oregon.gov/eis/cyber-security-services/Documents/eis-css-statewide-information-technology(IT)-control-standards.pdf

DAS Procurement Services, Version 4.5 March 31, 2023 Page 17 of 33 https://www.oregon.gov/eis/cyber-security-services/Documents/eis-css-statewide-information-security-program-plan.pdf

• Statewide Cloud Computing policy found online at:

http://www.oregon.gov/das/policies/107-004-150.pdf

• Oregon’s Statewide Information Technology Policies found online at:

www.oregon.gov/das/Pages/policies.aspx#IT.

• Privileged Access Monitoring and Reporting found online at: https://www.oregon.gov/das/Policies/107- 004-140.pdf

e. Proposer shall comply with Oregon’s Statewide Policy on Cyber and Information Security, DAS Statewide Policy 107- 004-052, pertaining to State systems and security, including requirements applicable to any authorized offshore and foreign services. Policy can be found online at https://www.oregon.gov/das/Pages/policies.aspx#IT

f. Proposer’s response to this section must specifically address its capacity to meet the policy’s offshore and foreign services restrictions for the duration of the Contract and if fully compliant services and personnel are available, and part of the Proposal. If the Proposal includes optional or necessary offshore or foreign services, the Proposal must include a statement describing:

• The offshore and/or foreign services that Proposer intends to use.

• The geographic location of where services are to be performed.

• The benefit to the State of the offshore and/or foreign services.

• How Proposer will ensure it has systems and controls in place to protect Agency Data and State networks in the event offshore or foreign services are allowed, and what systems and controls Proposer will recommend the State have in place to support those efforts as well.

• Steps the Proposer is willing and able to take to fully meet policy restrictions on offshore and foreign resources along with descriptions of potential steps https://www.oregon.gov/eis/cyber-security-services/Documents/eis-css-statewide-information-security-program-plan.pdf https://www.oregon.gov/eis/cyber-security-services/Documents/eis-css-statewide-information-security-program-plan.pdf https://www.oregon.gov/eis/cyber-security-services/Documents/eis-css-statewide-information-security-program-plan.pdf https://www.oregon.gov/das/Policies/107-004-140.pdf https://www.oregon.gov/das/Policies/107-004-140.pdf https://www.oregon.gov/das/Pages/policies.aspx#IT

DAS Procurement Services, Version 4.5 March 31, 2023 Page 18 of 33

Agency would need to take and any additional costs that may be incurred.

g. Proposer will operate in partnership with the agency during system implementation to produce a System Security Plan particular to the system and services being provided.

SECTION 4: SOLICITATION PROCESS

4.1 PUBLIC NOTICE AND OREGON BUYS

The RFP and Attachments are published in the State of Oregon’s electronic procurement system OregonBuys at https://oregonbuys.gov/. Documents will not be mailed to prospective Proposers.

Modifications, if any, to this RFP will be made by written Amendment(s) published in OregonBuys. Prospective Proposer is solely responsible for checking OregonBuys to determine whether or not any Amendment(s) have been issued. Amendment(s) are incorporated into the RFP by this reference.

4.2 PRE-PROPOSAL CONFERENCE

A Pre-Proposal conference will not be held for this RFP.

4.3 QUESTIONS / REQUESTS FOR CLARIFICATIONS

All inquiries, whether relating to the RFP process, administration, deadline or method of award, or to the intent or technical aspects of the RFP must:

• Be delivered to the SPC via an OregonBuys submission, or email;

• Reference the OregonBuys bid number ;

• Identify Proposer’s name and contact information;

• Refer to the specific area of the RFP being questioned (i.e. page, section and paragraph number); and

• Be received by the due date and time for Questions/Requests for Clarification identified in the Schedule in Section 1.2.

4.4 SOLICITATION PROTESTS

4.4.1 Protests to RFP

Prospective Proposer may submit a Written protest of anything contained in this RFP, including but not limited to, the RFP process, Specifications, Scope of Work, https://oregonbuys.gov/

DAS Procurement Services, Version 4.5 March 31, 2023 Page 19 of 33 and the proposed Sample Contract. This is prospective Proposer’s only opportunity to protest the provisions of the RFP, except that Proposer may protest Amendment(s) as provided below and Proposer may take exception to the terms and conditions of the Sample Contract marked as negotiable as set forth in the Negotiations Section.

4.4.2 Protests to Amendment(s)

Prospective Proposer may submit a Written protest of anything contained in an Amendment. Protests to an Amendment, if issued, must be submitted by 5:00 p.m.

Pacific Time on the second Business Day following the issuance of the Amendment or the date/time specified in the Amendment, or they will not be considered.

Protests of matters not added or modified by the Amendment will not be considered.

4.4.3 Requirements for Protests

All protests must:

• Be delivered to the SPC via email;

• Reference the OregonBuys bid number;

• Identify prospective Proposer’s name and contact information;

• Be sent by an authorized representative;

• State the reason for the protest, including:

o the grounds that demonstrate how the Procurement Process is contrary to law, Unnecessarily Restrictive, legally flawed, or improperly specifies a brand name; and o evidence or documentation that supports the grounds on which the protest is based; and

• State the proposed changes to the RFP provisions or other relief sought.

Protests to the RFP must be received by the due date and time identified in the Schedule.

Protests to an Amendment must be received by the due date identified in the Amendment.

4.5 PROPOSAL DELIVERY OPTIONS

Proposer is solely responsible for ensuring its Proposal is received by the SPC in accordance with the RFP requirements before Opening. Agency is not responsible for any transmission errors or delays, or for any mis-delivery for any reason. A Proposal submitted by any means not authorized below will be rejected. The following delivery options are permitted for this RFP:

DAS Procurement Services, Version 4.5 March 31, 2023 Page 20 of 33

Delivery through OregonBuys

Proposal submission should be electronically through OregonBuys. at:

OregonBuys.gov

Detailed instructions on how to submit a Proposal can be found at OregonBuys Vendor Formal Solicitation Response.pdf

4.6 PROPOSAL MODIFICATION OR WITHDRAWAL

If a Proposer wishes to make modifications to a submitted Proposal, the Proposer must submit its modification in one of the authorized methods listed in Section 4.5 (Proposal Delivery Options). To be effective the modification must include the OregonBuys bid number and be submitted to the SPC prior to Opening.

If a Proposer wishes to withdraw a submitted Proposal, it must submit a Written notice signed by an authorized representative of its intent to withdraw to the SPC via email, , prior to the Opening in accordance with OAR 125-247-0440. To be effective the notice must include the OregonBuys bid number.

4.7 PROPOSAL DUE

A Proposal (including all required submittal items) must be received by the SPC on or before Opening. All Proposal modifications or withdrawals must also be received prior to Opening.

A Proposal received after Opening is considered LATE and will NOT be accepted for evaluation. A late Proposal will be returned to the Proposer or destroyed.

4.8 PROPOSAL REJECTION

Agency may reject a Proposal for any of the following reasons:

• Proposer fails to substantially comply with all prescribed RFP procedures and requirements, including but not limited to the requirement that Proposer’s authorized representative sign the Proposal.

• Proposer has liquidated and delinquent debt owed to the State or any department or agency of the State.

• Proposer fails to meet the responsibility requirements of ORS 279B.110.

• Proposer makes any contact regarding this RFP with State representatives such as

State employees or officials other than the SPC, or persons authorized by the SPC, or inappropriate contact with the SPC.

• Proposer attempts to influence a member of the Evaluation Committee.

• Proposal is conditioned on Agency’s acceptance of any other terms and conditions https://www.oregon.gov/das/ORBuys/Documents/OregonBuys%20Vendor%20Formal%20Solicitation%20Response.pdf https://www.oregon.gov/das/ORBuys/Documents/OregonBuys%20Vendor%20Formal%20Solicitation%20Response.pdf

DAS Procurement Services, Version 4.5 March 31, 2023 Page 21 of 33 or rights to negotiate any alternative terms and conditions that are not reasonably related to those expressly authorized for negotiation in the RFP or Amendment(s).

4.9 EVALUATION PROCESS

4.9.1 Responsiveness and Responsibility Determination

4.9.1.1 Responsiveness determination

A Proposal received prior to Opening will be reviewed to determine if it is Responsive to all RFP requirements including compliance with Section 3.1 (Minimum Qualifications) and Section 3.2 (Minimum Submission Requirements).

If the Proposal is unclear, the SPC may request clarification from Proposer.

However, clarifications may not be used to rehabilitate a non-Responsive proposal. If the SPC finds the Proposal non-Responsive, the Proposal may be rejected; however, Agency may waive mistakes in accordance with OAR 125- 247-0470.

4.9.1.2 Responsibility Determination

Agency will determine if an apparent successful Proposer is Responsible prior to award and execution of the Contract. Proposers shall submit a signed Responsibility Inquiry form (Attachment G) with Proposal.

At any time prior to award, Agency may reject a Proposer found to be not Responsible.

4.9.2 Evaluation Criteria

DAS Procurement Services, Version 4.5 March 31, 2023 Page 22 of 33

Each Proposal meeting all Responsiveness requirements will be independently evaluated by members of the Evaluation Committee. Evaluation Committee members may change, and Agency may have additional or fewer evaluators for optional rounds of competition. Evaluators will assign a score for each evaluation criterion listed below in this Section 4.10.2 up to the maximum points available as specified in Section 4.11 (Point and Score Calculation).

SPC may request further clarification to assist the Evaluation Committee in gaining additional understanding of a Proposal. A response to a clarification request may only clarify or explain portions of the already submitted Proposal and may not contain new information not included in the original Proposal.

4.9.2.1 Staffing Plan with Key Persons and Resumes

• Are résumés provided for all required Key Persons?

• Do the proposed Key Persons demonstrate relevant experience with SaaS implementations, healthcare data systems, or PDMP-like environments?

• Is there a clear connection between the Proposer’s organizational experience, the qualifications of Key Persons, and successful delivery of similar projects?

• Does the plan demonstrate adequate resourcing to support the PDMP

SCORE EXPLANATION

OUTSTANDING - Response meets all the requirements and has demonstrated in a clear and concise manner a thorough knowledge and understanding of the subject matter and project. The Proposer provides insight into its expertise, knowledge, and understanding of the subject matter.

6 – 9 VERY GOOD – Response provides useful information, while showing experience and knowledge within the category. Response demonstrates above average knowledge and ability with no apparent deficiencies noted.

ADEQUATE – Response meets all requirements in an adequate manner.

Response demonstrates an ability to comply with guidelines, parameters, and requirements with no additional information put forth by the Proposer.

1 – 4 FAIR – Proposer meets minimum requirements but does not demonstrate sufficient knowledge of the subject matter.

RESPONSE OF NO VALUE – An unacceptable response that does not meet the requirements set forth in the RFP. Proposer has not demonstrated knowledge of the subject matter.

PASS/

FAIL

Proposer response meets or does not meet the requirements stated.

DAS Procurement Services, Version 4.5 March 31, 2023 Page 23 of 33 system during both routine operations and peak periods?

• Are roles and responsibilities clearly defined, including interaction points with the Agency and other stakeholders?

4.9.2.2 Strategy and Planning for Knowledge Transfer

Period

• Is there a structured, realistic plan for knowledge transfer that reflects the complexity of the PDMP system?

• Are tasks, deliverables, and dependencies clearly defined? Is the timeline feasible for assuming operational control?

• Has the proposer demonstrated experience delivering services of similar scope, size, and complexity to the PDMP SaaS system, and provided evidence of relevant certifications?

• Has the Proposer successfully completed at least three (3) comparable engagements involving SaaS-based PDMP systems, healthcare data platforms, or similarly regulated environments?

• Does the Proposer apply recognized standards in system operations, data governance, privacy, security, and analytics? Are they familiar with PDMP-related programmatic rules and operational practices?

• Do the Proposer’s certifications (e.g., HITRUST, SOC 2 Type II, ISO 27001) align with the Agency’s expectations for security and compliance?

4.9.2.3 Approach to Providing Ongoing Operation Services

• Does Proposer demonstrate a clear understanding of the PDMP’s operational, technical, and compliance requirements?

• Are there detailed processes for monitoring, measuring, and reporting service performance? Are SLAs and corrective action mechanisms included?

• Are deliverables clearly defined by quality assurance procedures?

• Is the SDLC methodology structured, transparent, and aligned with

Agency expectations?

• Does Proposer describe a proactive and transparent approach to working with the Agency, contractors, and stakeholders?

4.9.2.4 Enhancement Methodology

• Is the enhancement methodology well-organized and aligned with the SDLC?

• Does the process include:

o Requirements gathering and analysis?

o Design and Development?

DAS Procurement Services, Version 4.5 March 31, 2023 Page 24 of 33 o Testing (unit, integration, UAT) o Implementation and validation

• Is there a collaborative prioritization process with Agency?

• Does the Proposer understand PDMP operational cycles and plan enhancement windows accordingly?

4.9.2.5 System Documentation Updates and Maintenance

• Is there a clear process for maintaining technical specs, user guides, and operational procedures?

• Are documentation updates integrated into the SDLC?

• Does the Proposer ensure outdated or inaccurate content is removed?

• Are there regular opportunities for Agency review and input?

• Is documentation written in both technical and plain language for diverse audiences?

4.9.2.6 Quality Assurance and Quality Control (QA/QC)

Processes

• Are the QA/QC processes clearly described and appropriate for a SaaS solution and the services expected for the Oregon PDMP system?

• Does Proposer explain how these processes are applied to ensure quality in deliverables and services?

• Is there a clear method for reporting QA/QC results to Agency?

• Are the described processes appropriate for the scope and complexity of the PDMP system?

4.9.2.7 Proposed Service Level Agreements (SLAs)

• Are the proposed SLAs clearly defined and relevant to the services described in the RFP?

• Does the proposer explain why the proposed SLAs are appropriate and how they will ensure high-quality service?

• Are the proposed SLAs realistic and achievable within the context of the PDMP system?

• Do the proposed SLAs align with the general performance expectations outlined in the Scope of Work (Attachment I)?

4.9.2.8 Issue Escalation and Resolution

• Is Proposer’s escalation and resolution process clearly described and appropriate for a multi-party environment?

DAS Procurement Services, Version 4.5 March 31, 2023 Page 25 of 33

• Does Proposer demonstrate experience managing issue resolution in similarly complex environments?

• Are roles, responsibilities, and escalation paths clearly defined?

• Does Proposer describe how they ensure timely and effective resolution of issues?

4.9.2.9 Service Requirements (Attachment K)

• Has Proposer completed Attachment K as instructed?

• Are the responses clear, complete, and easy to understand?

• Do the responses demonstrate Proposer’s ability to meet or exceed the service requirements?

• Are there any gaps or concerns?

4.9.2.10 Pricing Proposal (Attachment E)

• Has the proposer submitted a fully completed Attachment E?

• Are the pricing components clearly itemized and easy to understand?

• Does the pricing align with the services described in the RFP?

4.9.2.11 Enhancement Rates (Attachment H)

• Are the proposed rates reasonable and competitive for the roles listed?

• Do the proposed roles and rate structure reflect the types of enhancements likely to be requested (e.g., integrations, analytics, UI/UX)?

• Is the pricing model (e.g., fixed, tiered, hourly) clearly explained and appropriate for the scope of enhancement work?

• Does the proposer provide a clear and practical approach for estimating and authorizing enhancement work under the contract?

4.9.2.12 Security Requirements Narrative (Attachment M)

• Was a statement submitted addressing its capacity to meet State Information Technology Security Requirements?

• Does the statement reflect the information indicated in Attachment M?

PRICE EVALUATION

The SPC will conduct the price evaluation. The SPC will award a price score to each

DAS Procurement Services, Version 4.5 March 31, 2023 Page 26 of 33

Price Proposal based upon the percentage of the proposed price as compared to the lowest Proposer’s price using the following formula:

lowest price of all Proposers X price points possible = price score price being scored

4.9.4 PREFERENCES

4.9.4.1 Tiebreakers

If Agency receives Proposals identical in price, fitness, availability and quality and chooses to award a Contract, Agency shall award the Contract in accordance with the procedures outlined in OAR 137-046-0300.

4.10 POINT AND SCORE CALCULATIONS

Scores are the values (0 through 10) assigned by each evaluator.

Points are the total possible for each section as listed in the table below.

The SPC will average all scores for each evaluation criterion. The average score will be used as a percentage multiplier of the maximum possible points for that criterion.

1=10%, 5=50%, 7.2=72%, 9=90%, etc. Price points are calculated as stated in the Price Evaluation section.

EXAMPLE:

TOTAL POINTS POSSIBLE : 1050

POINTS POSSIBLE 40

4.10.2.1 Staffing Plan with Key Persons and Resumes 40

4.10.2.2 Strategy and Planning for Knowledge Transfer Period 85

4.10.2.3 Approach to Providing Ongoing Operation Services 150

4.10.2.4 Enhancement Methodology 150

4.10.2.5 System Documentation Updates and Maintenance 50

4.10.2.6 Quality Assurance and Quality Control (QA/QC) 50

4.10.2.7 Proposed Service Level Agreements 85

4.10.2.8 Issue Escalation and Resolution 50

4…