DAS Procurement Services, Version 4.5 March 31, 2023- IT modified- 11-6-25 er Page 1 of 2

STATE OF OREGON

COVER PAGE

Oregon Health Authority Is issuing this Request For Proposals (RFP) under OregonBuys Bid

Number S-44300-00017134 for

OREGON PUBLIC HEALTH EPIDEMIOLOGIST’ USER

SYSTEM (ORPHEUS) SUPPORT AND MAINTENANCE

Date of Issue: June 4th, 2026 Opening Date and Time: June 5th, 2026: 8:00am

Single Point of Contact (SPC): Elvis Howard, Procurement & Contract Specialist 3

Address: 500 Summer St SE City, State, Zip Salem, OR 97301 Phone (voice) 503-871-3074 E-mail: elvis.r.howard@odhsoha.oregon.gov

The State of Oregon promotes equal opportunity for all individuals without regard to age, color, disability, marital status, national origin, race, religion or creed, sex or gender, sexual orientation, or veteran status. You can get this document in other languages, large print, braille, or a format you prefer free of charge. Contact the Single Point of Contact (SPC) at the contact information found above. We accept all relay calls.

DAS Procurement Services, Version 4.5 March 31, 2023- IT modified- 11-6-25 er Page 2 of 3

TABLE OF CONTENTS

SECTION 1: GENERAL INFORMATION

1.1 INTRODUCTION

1.2 SCHEDULE

1.3 SINGLE POINT OF CONTACT (SPC)

SECTION 2: AUTHORITY, OVERVIEW, AND SCOPE

2.1 AUTHORITY AND METHOD

2.2 DEFINITION OF TERMS

2.3 OVERVIEW AND PURPOSE

2.4 SCOPE OF WORK/SPECIFICATIONS

SECTION 3: PROCUREMENT REQUIREMENTS

3.1 MINIMUM QUALIFICATIONS

3.2 MINIMUM SUBMISSION REQUIREMENTS

3.3 PROPOSAL REQUIREMENTS

SECTION 4: SOLICITATION PROCESS

4.1 PUBLIC NOTICE

4.2 OREGONBUYS

4.3 QUESTIONS / REQUESTS FOR CLARIFICATIONS

4.4 SOLICITATION PROTESTS

4.5 PROPOSAL DELIVERY OPTIONS

4.6 PROPOSAL MODIFICATION OR WITHDRAWAL

4.7 PROPOSAL DUE

4.8 PUBLIC OPENING

4.9 PROPOSAL REJECTION

4.10 EVALUATION PROCESS

4.11 POINT AND SCORE CALCULATIONS

4.12 NEXT STEP DETERMINATION

SECTION 5: AWARD AND NEGOTIATION

5.1 AWARD NOTIFICATION PROCESS

5.2 INTENT TO AWARD PROTEST

5.3 APPARENT SUCCESSFUL PROPOSER SUBMISSION REQUIREMENTS

5.4 CONTRACT NEGOTIATION

SECTION 6: ADDITIONAL INFORMATION

6.1 ALL INTERESTED BUSINESSES ARE ENCOURAGED TO SUBMIT PROPOSALS FOR THIS

CONTRACTING OPPORTUNITY

6.2 CERTIFIED FIRM PARTICIPATION

6.3 GOVERNING LAWS AND REGULATIONS

6.4 OWNERSHIP/PERMISSION TO USE MATERIALS

6.5 CANCELLATION OF RFP; REJECTION OF PROPOSAL; NO DAMAGES

6.6 COST OF SUBMITTING A PROPOSAL

DAS Procurement Services, Version 4.5 March 31, 2023- IT modified- 11-6-25 er Page 3 of 4

LIST OF ATTACHMENTS (sample)

ATTACHMENT A: SAMPLE CONTRACT

O EXHIBIT A: STATEMENT OF WORK

O EXHIBIT B: SERVICE LEVEL AGREEMENTS

O EXHIBIT C: INSURANCE

O EXHIBIT D: CONTRACTOR’S PERSONNEL EXHIBIT E: CONTRACTOR’S

PERSONNEL

O EXHIBIT E: AGENCY’S PERSONNEL

O EXHIBIT F: RESERVED

O EXHIBIT G: RESERVED

O EXHIBIT H: PAYMENT SCHEDULE

O EXHIBIT I: FEDERAL TERMS AND CONDITIONS

O EXHIBIT J: REQUIREMENTS

O EXHIBIT K: SECURITY AND HOSTING REQUIREMENTS

ATTACHMENT B: DISCLOSURE EXEMPTION AFFIDAVIT

ATTACHMENT C: PROPOSER INFORMATION AND CERTIFICATION SHEET

ATTACHMENT D: REFERENCE CHECK FORM

ATTACHMENT E: PRICE PROPOSAL

ATTACHMENT F: CERTIFIED DISADVANTAGED BUSINESS OUTREACH PLAN

ATTACHMENT G: RESPONSIBILITY INQUIRY

ATTACHMENT H: SOLUTION REQUIREMENTS

ATTACHMENT I: STATEWIDE SECURITY STANDARDS

DAS Procurement Services, Version 4.5 March 31, 2023- IT modified- 11-6-25 er Page 4 of 5

SECTION 1: GENERAL INFORMATION

1.1 INTRODUCTION

The State of Oregon, acting by and through the Oregon Health Authority (OHA) - Public Health Division (PHD) – Center of Public Health Practice (CPHP) – Acute and Communicable Disease Prevention Section (ACDP), (“Agency”), is issuing this Request for Proposal under the provisions of ORS 279B.060 for supporting the ongoing maintenance, enhancement, and operational stability of the Oregon Public Health Epidemiology User System (Orpheus).

Orpheus is the statewide disease surveillance system used by nearly 400 state, local, and Tribal public health professionals for the investigation, analysis, and reporting of Oregon’s reportable diseases. The System operates 24 hours a day, 365 days per year, and supports Oregon’s statutory and administrative responsibilities to detect, monitor, and respond to communicable diseases and emerging public health threats.

The Orpheus application is a mission‑critical public health information system developed by the Oregon Health Authority and hosted in the State of Oregon’s secure Enterprise Technology Services (ETS) environment. The System contains sensitive public health and demographic data and requires continuous availability, security, and technical support.

This RFP seeks proposals from qualified vendors with a proven track record in maintaining and enhancing complex, relational database‑driven public health or clinical information systems. Services to be performed under the resulting contract will include system support, maintenance, and enhancements needed to meet evolving programmatic, technical, and reporting requirements. A detailed description of the required Services is provided in the Scope of Work (Attachment A).

Additional details on the Scope of the goods or services or both are included in the Scope of Work/Specifications section.

Agency anticipates the award of one Contract from this RFP.

Vendors should review the full RFP to determine their interest and capacity to provide the requested Services.

The initial term of the Contract is anticipated to be two (2) years with options to renew up to a cumulative maximum of four (4) years.

DAS Procurement Services, Version 4.5 March 31, 2023- IT modified- 11-6-25 er Page 5 of 6

1.2 SCHEDULE

The table below represents a tentative schedule of events. All times are listed in Pacific Time. All dates listed are subject to change. N/A denotes that event is not applicable to this RFP.

Event Date Time

Questions / Requests for Clarification Due June 15, 2026 3:00 PM PR

Answers to Questions / Requests for Clarification Issued (approx.) June 19, 2026

RFP Protest Period Ends

7 calendar days prior to RFP Opening

Opening (Proposal Due) June 26, 2026

Opening of Proposal June 29, 2026 3:00 PM PT

Presentations, Demonstrations, or Interviews (if requested) July 6, 2026

Issuance of Notice of Intent to Award (approx.) July 13, 2026

Award Protest Period Ends July 20, 2026

1.3 SINGLE POINT OF CONTACT (SPC)

The SPC for this RFP is identified on the Cover Page, along with the SPC’s contact information. Proposer shall direct all communications related to any provision of the RFP only to the SPC, whether about the technical requirements of the RFP, contractual requirements, the RFP process, or any other provision.

SECTION 2: AUTHORITY, OVERVIEW, AND SCOPE

2.1 AUTHORITY AND METHOD

Agency is issuing this RFP under the authority of the Department of Administrative Services (DAS) delegation REQ-1000-00020921 (as amended), (Cooperative Procurements and Information Technology).

Agency is using the Competitive Sealed Proposal method, pursuant to ORS 279B.060 and OAR 125-247-0260. Agency may use a combination of the methods for

DAS Procurement Services, Version 4.5 March 31, 2023- IT modified- 11-6-25 er Page 6 of 7

Competitive Sealed Proposals, including optional procedures: a) Competitive Range; b) Discussions and Revised Proposals; c) Revised Rounds of Negotiations; d) Negotiations; e) Best and Final Offers; and f) Multistep Sealed Proposals.

2.2 DEFINITION OF TERMS

For the purposes of this RFP, capitalized words are defined in OAR 125-246-0110 or as defined below.

Terminology specific to the OregonBuys system may be found at: OregonBuys

“Deliverables” means all items that Contractor is required to provide to Agency under this Contract, including Work Product.

“DOJ” means the Oregon Department of Justice.

“Evaluation Committee” or “Committee” means the Evaluation Committee composed of selected individuals to evaluate and score Proposals.

“Single Point of Contact (SPC)” means the Single Point of Contact Proposers shall direct all communications related to this RFP.

2.3 OVERVIEW AND PURPOSE

2.3.1 Agency Overview and Background

Oregon Health Authority (OHA) OHA leads statewide efforts to improve health outcomes, contain health care costs, and expand access to quality, affordable care. Guided by the Oregon Health Policy Board, OHA is responsible for most state health services and the implementation of health reform authorized by House Bill 2009. OHA’s mission is to help people and communities achieve optimal physical, mental, and social well‑being. Its work centers on three goals: improving lifelong health for all Oregonians, increasing the quality and reliability of care, and keeping the cost of care affordable. OHA’s core values are service excellence, leadership, integrity, health equity, and partnership.

Oregon Public Health Division (PHD) PHD advances OHA’s mission by promoting health, preventing disease and injury, and strengthening Oregon’s public health system. PHD’s vision is lifelong health for all people in Oregon. Its mission is to promote health and prevent the leading causes of death, disease, and injury. Key goals include reducing tobacco use, obesity, suicide, heart disease, stroke, and family violence; strengthening community resilience; and transforming Oregon’s public health system through accreditation, improved surveillance, and integration of health considerations into policymaking.

https://oregonbuys.gov/bso/

DAS Procurement Services, Version 4.5 March 31, 2023- IT modified- 11-6-25 er Page 7 of 8

Center for Public Health Practice (CPHP) CPHP provides statewide services to prevent and control disease, monitor vital events, and ensure the quality and effectiveness of Oregon’s public health system. The Center collaborates closely with local and tribal health departments and community partners.

Major functions include communicable disease prevention, epidemiology, laboratory testing, newborn screening, and analysis of vital records to track health trends. CPHP also supports planning, consultation, and accreditation activities to maintain a strong statewide public health infrastructure.

Acute and Communicable Disease Prevention (ACDP) Section ACDP works to prevent the spread of communicable diseases in Oregon through surveillance, epidemiologic investigations, education, and prevention strategies. The Section serves all Oregonians and partners with local health departments, health care providers, other PHD programs, and state and federal agencies.

2.3.2 Project Overview and Background

The Oregon Public Health Epidemiology User System (Orpheus) is the statewide platform used by state, local, and Tribal public health partners to investigate, analyze, and report Oregon’s reportable diseases and other conditions of public health importance. Orpheus is a mission‑critical application that enables OHA to carry out its statutory responsibilities under ORS 443.004 and related administrative rules (OAR 333‑018 and 333‑019), as well as federal reporting obligations to the Centers for Disease Control and Prevention. The system operates continuously and houses sensitive public health information subject to stringent confidentiality, integrity, and availability requirements under statewide information security policies.

Since the last competitive procurement in 2017, Orpheus has expanded significantly in data volume, reporting complexity, and operational demands. During the COVID‑19 pandemic, the system supported an unprecedented increase in electronic laboratory and case report processing and required sustained contingency and emergency maintenance activities. As a result, many planned enhancements and modernization activities were deferred. Contract amendments were authorized during the public health emergency; however, the current contract will reach the end of its allowable term on July 31, 2026, and must be replaced through competitive solicitation in accordance with state procurement rules governing contract duration and amendment thresholds.

The Orpheus user base has remained relatively stable, but the complexity and volume of data managed by the system have continued to grow. The system must support

DAS Procurement Services, Version 4.5 March 31, 2023- IT modified- 11-6-25 er Page 8 of 9 timely, accurate, and complete data to enable rapid case creation, deduplication, and linkage, and must be capable of adapting quickly to emerging or novel public health threats. Recent statewide directives require mission‑critical applications to have formal modernization plans. OHA has identified the need to strengthen Orpheus’s scalability, resiliency, and long‑term sustainability, informed in part by lessons learned during the pandemic response.

2.3.3 Purpose

OHA is issuing this RFP to establish a new contract for ongoing maintenance, defect correction, enhancement, and support services necessary to ensure the stability and continued operation of the Orpheus system. The Agency seeks a qualified contractor capable of sustaining 24/7/365 system availability, supporting complex and sensitive public health data workflows, and providing the technical expertise required to maintain and enhance an established FileMaker-based relational application.

The purpose of this procurement is to ensure operational continuity beyond the expiration of the current contract and to position Orpheus for incremental modernization over the next several years. During the forthcoming contract period, OHA anticipates evaluating the feasibility of transitioning from the current on-premises hosting environment to a vendor-managed cloud implementation to improve performance, resiliency, scalability, and analytics capabilities. The contract will also support system improvements needed to meet evolving reporting requirements, integrate new data sources, and respond rapidly to emerging public health events.

The beneficiaries of the resulting contract include OHA programs, Local Public Health Authorities, and Tribal health partners who rely on Orpheus for timely and accurate surveillance data essential to Oregon’s disease investigation and response activities.

The contract will support ongoing, repetitive services as well as prioritized system enhancements.

2.4 SCOPE OF WORK/SPECIFICATIONS

The scope of services for this RFP includes ongoing maintenance, enhancement, modernization, and support of the Oregon Public Health Epidemiology User System (Orpheus). The Contractor shall provide services necessary to sustain 24/7/365 system availability, maintain the stability and performance of this mission‑critical public health application, and support the Agency’s evolving programmatic and reporting requirements.

DAS Procurement Services, Version 4.5 March 31, 2023- IT modified- 11-6-25 er Page 9 of 10

The scope of services includes the following categories of work:

1. Administrative and Project Support Services Services may include project management, documentation, meeting participation, communication with Agency staff, billing and reporting activities, and other administrative tasks necessary for effective coordination and contract oversight.

2. Standard Maintenance and Enhancement Services Services may include routine software maintenance, version upgrades, security updates, performance tuning, database optimization, refinement of existing functionality, minor feature enhancements, and other activities required to maintain system stability, reliability, and usability.

3. Break/Fix and Defect Correction Services Services may include troubleshooting, diagnosis, and correction of system defects, errors, and performance issues. Activities may extend to remediation of unplanned disruptions, vulnerabilities, or operational issues that affect the availability or integrity of the system.

4. Modernization and Scalability Support Services may include analysis, planning, and implementation support for modernization activities to improve the system’s scalability, resiliency, interoperability, and long‑term sustainability. This may include evaluating options for transitioning from the current on‑premises hosting model to a vendor‑supported or cloud‑based environment, enhancing reporting and analytics capabilities, and supporting Agency‑led data modernization initiatives.

5. Contingency and Rapid Response Development Services may include development, modification, or rapid deployment of new or updated system functionality to support emerging or novel public health conditions, changes in reporting requirements, regulatory updates, or urgent operational needs.

The Contractor must be capable of adjusting priorities to support these activities when directed by the Agency.

6. Continuity of Operations and Resilience Planning Services may include planning and development activities that support continuity of operations, data protection, and operational resiliency, including options for secure fallback environments, temporary contingency workflows, or other mechanisms to maintain core public health reporting capabilities during disruptions.

DAS Procurement Services, Version 4.5 March 31, 2023- IT modified- 11-6-25 er Page 10 of 11

7. Specialized Technical Expertise The Contractor shall provide personnel with expertise in maintaining and enhancing complex relational database applications, including experience with the FileMaker platform, secure data workflows, and sensitive public health surveillance systems.

The assigned contract’s detailed requirements, activities, deliverables, and performance expectations will be defined in the Statement of Work (Attachment A).

The Scope of Work described in this section establishes the parameters of services that may be incorporated into or amended within the resulting contract.

SECTION 3: PROCUREMENT REQUIREMENTS

3.1 MINIMUM QUALIFICATIONS

To be considered for evaluation, Proposal must demonstrate how Proposer meets all requirements of this section:

3.1.1 Licensing Requirements

Proposer must be duly licensed to conduct business in the State of Oregon or must certify the ability to obtain such licensing prior to Contract execution. If using subcontractors, subcontractors must also hold all licenses necessary to perform their respective portions of the work.

3.1.2 Certification Requirements

Proposer’s Key Personnel performing system architecture, database development, or core application development must include at least one individual who is a FileMaker® Certified Developer, version 20 or later. Certification must be current and verifiable at the time of Proposal submission.

3.1.3 Licensing/Registration Requirements

Proposer and any subcontractors must meet all requirements of a “Responsible Proposer” as defined in OAR 137-047-0640(1)(c)(F), including but not limited to:

• possessing the financial, material, equipment, facility, personnel resources, and expertise (or the ability to obtain them) to meet all contractual responsibilities;

• maintaining a satisfactory record of integrity;

DAS Procurement Services, Version 4.5 March 31, 2023- IT modified- 11-6-25 er Page 11 of 12

• maintaining a satisfactory record of past contract performance.

Proposer must certify that it has been continuously operating for a minimum of three

(3) years providing services comparable in scale and complexity to the services described in this RFP.

3.1.4 Key Person Requirements

Proposer must designate at least the following Key Persons and must certify on the Proposer Information Sheet (Attachment C) that each individual meets the corresponding requirements. Key Persons may not be replaced without prior Agency approval.

A. Senior Developer

The Senior Developer must:

1. Be a FileMaker® Certified Developer (version 20 or later).

2. Have a minimum of ten (10) years of experience developing and maintaining complex FileMaker-based relational systems.

3. Have experience supporting mission-critical health, public health, or other regulated data systems, including systems subject to HIPAA or comparable privacy and security requirements.

4. Demonstrate familiarity with secure authentication workflows such as Active Directory, multifactor authentication, and remote access via secure gateways.

B. Project Manager

The Project Manager must:

1. Have a minimum of five (5) years of experience managing software development, maintenance, or enhancement projects of similar size and complexity.

2. Have experience supporting projects involving sensitive or regulated health data, public health workflows, or comparable information systems.

3. Demonstrate experience coordinating between technical teams, program staff, and stakeholders.

4. Be responsible for project planning, schedule management, risk mitigation, and communication.

3.1.5 Other Requirements:

DAS Procurement Services, Version 4.5 March 31, 2023- IT modified- 11-6-25 er Page 12 of 13

Proposer must submit statements affirming the following:

A. Security and Background Checks If awarded a Contract, Proposer personnel performing Services will submit to all required security checks, which may include fingerprinting and Oregon LEDS checks, and will comply with:

• State Policy 107-027-010 (Privileged Access Monitoring and Reporting)

• DAS ETS Information Security Standards

• OHA Information Technology Standards

• OHA Information Security Policies and Procedures

• HIPAA Security Rule requirements

• Orpheus Security Policies and Procedures

B. Confidentiality Proposer agrees to sign the Non-Disclosure Agreement (Attachment A) and to protect all Agency sensitive information, including but not limited to personally identifiable information (PII), protected health information (PHI), and other Level 3 “Restricted” information.

C. Experience with Public Health or Comparable Workflows Proposer must demonstrate organizational experience supporting public health, healthcare, disease reporting, surveillance systems, or other mission-critical regulated data environments requiring strict confidentiality, data integrity, and continuous system availability.

D. Operational Capability Proposer must demonstrate the capability to support 24/7/365 operations, provide rapid response when system stability is affected, and deliver services in a manner consistent with the requirements of a mission-critical public health surveillance system.

3.2 MINIMUM SUBMISSION REQUIREMENTS

3.2.1 Proposal Submissions

To be considered for evaluation, Proposal must contain each of the following elements (further detailed in Proposal Requirements section below):

• Proposer Information and Certification Sheet (Attachment C) http://www.oregon.gov/DAS/OP/docs/policy/state/107-027-010_05.10.11.pdf http://www.oregon.oregon.gov.das/CIO/ESO/pub/infosecuritystandards_2009_12_final.pdf http://www.oregon.gov/OHA/OIS/pages/about_us.aspx http://www.oregon.gov/oha/OIS/ispo/Pages/policies.aspx http://www.hhs.gov/ocr/privacy/hipaa/administrative%20/securityrule/index.html https://www.oregon.gov/oha/PH/DISEASESCONDITIONS/COMMUNICABLEDISEASE/REPORTINGCOMMUNICABLEDISEASE/Documents/Orpheus/OrpheusSecurity/OrpheusPoliciesandProcedures.pdf https://www.oregon.gov/das/Policies/107-004-050.pdf

DAS Procurement Services, Version 4.5 March 31, 2023- IT modified- 11-6-25 er Page 13 of 14

• Executive Summary

• Proposer’s Organization Profile

• Experience and Capabilities

• Reference Check Forms (Attachment D)

• Key Persons, Organizational Chart, Subcontractors, and Resumes

• Solution Requirements (Attachment H)

• Scope of Services

• Security Statement

• Performance Metrics and Service Level Agreements (SLAs)

• Price Proposal Form (Attachment E) (submitted simultaneously but as a separate electronic response file)

• Underlying Agreements

• Disclosure Exemption Affidavit (Attachment B) – submit 1 copy only

• COBID Certification / Outreach Plan (Attachment F)

• Responsibility Inquiry (Attachment G)

3.2.2 Proposal Format and Quantity

Proposal should follow the format and reference the sections listed in the Proposal Requirements section. Responses to each section and subsection should be labeled to indicate the item being addressed.

OregonBuys Electronic Response. Proposer must submit its Proposal electronically through OregonBuys. Proposer should follow the procedures outlined in Section 4.6 for electronic submission.

Proposer shall submit one copy of its Proposal and all other submittal requirements, with Attachment C, Proposer Information and Certification Sheet bearing the Proposer’s authorized representative’s Signature, in one of the following formats: Adobe Acrobat (pdf), Microsoft Word (docx), or Microsoft Excel (xlsx). If Proposer believes any of its Proposal is exempt from disclosure under Oregon Public Records Law (ORS 192.311 through 192.478), Proposer shall complete and submit the Disclosure Exemption Affidavit (Attachment B). Proposer shall also mark as “Confidential” in OregonBuys all attachments to its Proposal that Proposer believes are exempt from disclosure.

3.2.3 Authorized Representative

Failure of Proposer’s authorized representative to sign the Proposal may result in rejection of the Proposal by Agency.

3.3 PROPOSAL REQUIREMENTS

DAS Procurement Services, Version 4.5 March 31, 2023- IT modified- 11-6-25 er Page 14 of 15

Proposal must address each of the items listed in this section and all other requirements set forth in this RFP. Proposer shall describe the Goods to be provided or the Services to be performed. A Proposal that merely offers to provide the goods or services as stated in this RFP may be considered non-Responsive to this RFP and will not be considered further.

Proposal should not include extensive artwork, unusual printing or other materials not essential to the utility and clarity of the Proposal. Do not include marketing or advertising material in the Proposal, unless requested. Proposal should be straightforward and address the requests of the RFP. Proposal containing unsolicited marketing or advertising material may receive a lower evaluation score if required information is difficult to locate.

3.3.1 Proposer Information and Certification Sheet (Not Scored)

Proposer shall complete and submit the Proposer Information and Certification Sheet (Attachment C).

Failure to demonstrate compliance with Oregon Tax Laws and sign the Proposer Information and Certification Sheet may result in a finding of non-Responsibility.

3.3.2 Executive Summary (Not Scored)

Proposer shall submit a comprehensive, yet succinct Executive Summary, not to exceed three pages, that summarizes the proposed Solution, its distinctive features, and how it will fulfill the State’s requirements. The Executive Summary may also contain a high-level “block” diagram of the proposed Solution in addition to the three pages. Proposer’s response shall delineate any potential single points of failure in the proposed Solution.

3.3.3 Proposer’s Organization Profile (Scored)

Proposer must provide a profile of its organization. This is Proposer’s opportunity to give an overview of its organization, describe the structure of its business, and discuss how the organization can effectively deliver the Services described in this RFP. The Profile must include:

• Ownership. If incorporated, the state in which the organization is incorporated and the date of the incorporation;

• Location of the organization’s offices (headquarters and branches);

• Location of the office from which employees will be assigned to work on the Project for the Agencies;

• Number of employees located in the Pacific Northwest, nationally, and internationally;

DAS Procurement Services, Version 4.5 March 31, 2023- IT modified- 11-6-25 er Page 15 of 16

• Established business relationships with proposed subcontractors (e.g., data conversion contractor); and

• Organization’s client base.

3.3.4 Experience and Capabilities (Scored)

Proposer must demonstrate Proposer has the following experiences and capabilities:

• Proposer must have at least 3 years of experience designing and implementing Cloud-based solutions utilizing an agile methodology.

• Proposer must have at least 3 years of experience working with governmental entities.

• Proposer must be familiar with current Center for Medicare and Medicaid Services rules, policies, and procedures.

• Proposer must have experience with designing and implementing solutions that can easily adapt to and incorporate new rules and standards on a regular basis.

• Proposer must have at least one (1) Solution successfully implemented in the past three (3) years of similar scope and size.

Proposer shall submit work samples for two (2) projects within the last five (5) years that are similar to the scope of this RFP.

3.3.5 References (Not Scored)

Provide three (3) references from current or former client firms for similar projects performed for any clients within the last five (5) years. References must be able to verify the quality of previous, related Work.

Agency may check to determine if references provided support Proposer’s ability to comply with the requirements of this RFP. Agency may use references to obtain additional information, or verify any information needed. Agency may contact any reference (submitted or not) to verify Proposer’s qualifications.

Proposer shall send the Reference Check Form (Attachment D) to its references.

Reference forms must be completed by the reference, returned to the Proposer and submitted with the Proposal.

3.3.6 Key Persons, Organizational Chart, and Subcontractors (Scored)

Specify key persons to be assigned to this project and include a current resume (not to exceed two pages each) for each key person that demonstrates the

DAS Procurement Services, Version 4.5 March 31, 2023- IT modified- 11-6-25 er Page 16 of 17 person’s qualifications and experience for the Work described in this RFP.

3.3.7 Solution Requirements (Scored)

Proposer will submit a narrative describing how the proposed system addresses the high-level requirements set forth in Section 2.4.1. The proposed Solution must fully address the following:

• Solution Requirements, including software, network requirements and capability, selective routing, and databases and database services, security requirements, service levels and service level requirements.

Proposer shall also complete and submit Attachment H, Solution Requirements.

Instructions on how to properly complete this form are contained in an instructions tab on the Attachment.

3.3.8 Scope of Services (Scored)

Proposer must submit a narrative Scope of Services including project timeline, using the information provided in Section 2.4.2, Scope of Services and the Tasks and Deliverables described therein. The proposed Solution must fully address the following:

• Services, including but not limited to: project management, project plan and schedule, data gathering, network design meeting all system requirements, implementation, data migration and training.

• Ongoing Services, including, but not limited to: network management, monitoring, reporting, maintenance and repair, and customer services/help desk.

The Scope of Services may include any additional services or deliverables that Proposer believes are necessary to fully deliver this Solution. Each service or deliverable addressed in the narrative response must be called out by title, and identify the pricing provided for each service or deliverable addressed included in Attachment E.

3.3.9 Security Statement (Not Scored)

Proposer must provide a narrative statement that attests to whether the Proposer currently meets or can in the future meet the following protections:

• Proposer understands and has the capability of handling and protecting Agency Data that has been classified as Level 3 Information under the State of Oregon’s Information Asset Classification policy, available online at https://www.oregon.gov/das/Policies/107-004-050.pdf.

• Proposer and its employees, contractors, and agents shall comply with all applicable state and federal laws and regulations, and State of Oregon https://www.oregon.gov/das/Policies/107-004-050.pdf

DAS Procurement Services, Version 4.5 March 31, 2023- IT modified- 11-6-25 er Page 17 of 18 policies governing Agency Data and its use and disclosure, including as those laws, regulations, and policies may be updated from time to time, including:

o Oregon’s Statewide Information Security Standards, found online at: https://www.oregon.gov/eis/cyber-security-services/Pages/guidance-for-state-agencies.aspx including security controls that meet or exceed “Moderate” security controls in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53.

o Oregon’s Statewide Information Security Plan, found online at:

https://www.oregon.gov/eis/cyber-security-services/Pages/guidance-for-state-agencies.aspx.

o Statewide Cloud Computing policy:

http://www.oregon.gov/das/policies/107-004-150.pdf.

o Oregon’s Statewide Information Technology Policies:

www.oregon.gov/das/Pages/policies.aspx#IT.

o Privileged Access Monitoring and Reporting viewable at:

https://www.oregon.gov/das/Policies/107-004-140.pdf.

Attachment J, Statewide Information and Cyber Security Standards, is provided to Proposers as a reference for what minimum security requirements will be.

Proposers are not required to complete the Attachment J spreadsheet in Round 1.

3.3.10 Performance Metrics and Service Levels (SLAs) (Scored)

Proposer shall submit its performance metrics and service level agreement(s).

3.3.11 Price Proposal (Scored)

Proposer shall complete and submit the Price Proposal (Attachment E).

3.3.12 Underlying Agreements (Not Scored)

Proposer will submit any additional documents required for this project (e.g., End User License Agreement (EULA), Maintenance Agreement, etc.).

3.3.13 Value Added Services (Not Scored)

If Proposer is proposing any value-added services, Proposer shall include a statement describing these services. Proposer may submit services including solution engineering, installation, configuration, training and maintenance/support, the corresponding prices, and subcontractors and/or resellers available to provide said services.

https://www.oregon.gov/eis/cyber-security-services/Pages/guidance-for-state-agencies.aspx https://www.oregon.gov/eis/cyber-security-services/Pages/guidance-for-state-agencies.aspx https://www.oregon.gov/eis/cyber-security-services/Pages/guidance-for-state-agencies.aspx https://www.oregon.gov/eis/cyber-security-services/Pages/guidance-for-state-agencies.aspx http://www.oregon.gov/das/policies/107-004-150.pdf http://www.oregon.gov/das/Pages/policies.aspx#IT https://www.oregon.gov/das/Policies/107-004-140.pdf

DAS Procurement Services, Version 4.5 March 31, 2023- IT modified- 11-6-25 er Page 18 of 19

3.3.14 Disclosure Exemption Affidavit (Not Scored)

Proposer shall complete and submit the Disclosure Exemption Affidavit (Attachment B) as part of the Proposal. Submission is required even if Proposer is not identifying confidential or proprietary information and data for nondisclosure. If Proposer is identifying items for nondisclosure as confidential or proprietary, Proposer must specify the reason for the exemption.

Redacted Proposal. If Proposer is identifying items for nondisclosure, Proposer must provide an appropriately redacted copy of the complete, original Round 1 Proposal submissions.

3.3.15 Certified Disadvantaged Business Outreach Plan (Not Scored)

Proposer shall complete and submit Certified Disadvantaged Business Outreach Plan (Attachment F).

3.3.16 Responsibility Inquiry (Not Scored)

Proposer shall complete and submit Responsibility Inquiry (Attachment G).

Agency must find that Proposer is Responsible in order to award a Contract.

Agency may, at any time, find a Proposer to be not Responsible and excuse the Proposer from further participation in the RFP process.

SECTION 4: SOLICITATION PROCESS

4.1 PUBLIC NOTICE

The RFP and attachments are published in the State of Oregon’s electronic procurement system OregonBuys at https://oregonbuys.gov/. Documents will not be mailed to prospective Proposers.

Modifications, if any, to this RFP will be made by written Amendment(s) published in OregonBuys. Prospective Proposer is solely responsible for checking OregonBuys to determine whether or not any Amendment(s) have been issued. Amendment(s) are incorporated into the RFP by this reference.

4.2 OREGONBUYS

All Proposers must be registered in OregonBuys to do business with the State.

Registration is free. To create a vendor account, click the blue “Register” button in the top right corner of the OregonBuys website: https://oregonbuys.gov/bso. For registration assistance, see vendor registration guidance.

PROPOSER IS SOLELY RESPONSIBLE FOR ENSURING THEIR VENDOR INFORMATION IS

https://oregonbuys.gov/ https://oregonbuys.gov/bso

DAS Procurement Services, Version 4.5 March 31, 2023- IT modified- 11-6-25 er Page 19 of 20

CURRENT AND CORRECT IN OREGONBUYS. AGENCY WILL ACCEPT NO RESPONSIBILITY

FOR MISSING OR INCORRECT VENDOR INFORMATION OR ALTERNATIVE

ACCESSIBILITY TO AMENDMENT(S), ATTACHMENTS, AND EXHIBITS.

OregonBuys Assistance. Parties needing assistance with OregonBuys may contact the OregonBuys Helpdesk by telephone at (855) 800-5046 or by email at support.oregonbuys@oregon.gov.

4.3 QUESTIONS / REQUESTS FOR CLARIFICATIONS

All inquiries, whether relating to the RFP process, administration, deadline or method of award, or to the intent or technical aspects of the RFP must:

• Be delivered to the SPC via an OregonBuys submission;

• Reference the OregonBuys bid number ;

• Identify Proposer’s name and contact information;

• Refer to the specific area of the RFP being questioned (i.e. page, section and paragraph number); and

• Be received by the due date and time for Questions/Requests for Clarification identified in the Schedule in Section 1.2.

4.4 SOLICITATION PROTESTS

4.4.1 Protests to RFP

Prospective Proposer may submit a Written protest of anything contained in this RFP, including but not limited to, the RFP process, Specifications, Scope of Work, and the proposed Sample Contract. This is prospective Proposer’s only opportunity to protest the provisions of the RFP, except that Proposer may protest Amendment(s) as provided below and Proposer may take exception to the terms and conditions of the Sample Contract marked as negotiable as set forth in the Negotiations Section.

4.4.2 Protests to Amendment(s)

Prospective Proposer may submit a Written protest of anything contained in an Amendment. Protests to an Amendment, if issued, must be submitted by 5:00 p.m.

Pacific Time on the second Business Day following the issuance of the Amendment or the date/time specified in the Amendment, or they will not be considered.

Protests of matters not added or modified by the Amendment will not be considered.

4.4.3 Requirements for Protests

mailto:support.oregonbuys@oregon.gov

DAS Procurement Services, Version 4.5 March 31, 2023- IT modified- 11-6-25 er Page 20 of 21

All protests must:

• Be delivered to the SPC via email;

• Reference the OregonBuys bid number;

• Identify prospective Proposer’s name and contact information;

• Be sent by an authorized representative;

• State the reason for the protest, including:

o the grounds that demonstrate how the Procurement Process is contrary to law, Unnecessarily Restrictive, legally flawed, or improperly specifies a brand name; and o evidence or documentation that supports the grounds on which the protest is based; and

• State the proposed changes to the RFP provisions or other relief sought.

Protests to the RFP must be received by the due date and time identified in the Schedule.

Protests to an Amendment must be received by the due date identified in the Amendment.

4.5 PROPOSAL DELIVERY OPTIONS

Proposer is solely responsible for ensuring its Proposal is received by the SPC in accordance with the RFP requirements before Opening. Agency is not responsible for any delays in mail or by common carriers or by transmission errors or delays, or for any mis-delivery for any reason. A Proposal submitted by any means not authorized below will be rejected. The following delivery options are permitted for this RFP:

Delivery through OregonBuys

Proposal submission should be electronically through OregonBuys at:

OregonBuys.gov

Detailed instructions on how to submit a Proposal can be found at OregonBuys Vendor Formal Solicitation Response.pdf

4.6 PROPOSAL MODIFICATION OR WITHDRAWAL

If a Proposer wishes to make modifications to a submitted Proposal, the Proposer must submit its modification in one of the authorized methods listed in Section 4.5 (Proposal Delivery Options). To be effective the modification must include the OregonBuys bid number and be submitted to the SPC prior to Opening.

If a Proposer wishes to withdraw a submitted Proposal, it must submit a Written notice https://www.oregon.gov/das/ORBuys/Documents/OregonBuys%20Vendor%20Formal%20Solicitation%20Response.pdf https://www.oregon.gov/das/ORBuys/Documents/OregonBuys%20Vendor%20Formal%20Solicitation%20Response.pdf

DAS Procurement Services, Version 4.5 March 31, 2023- IT modified- 11-6-25 er Page 21 of 22 signed by an authorized representative of its intent to withdraw to the SPC via email prior to the Opening in accordance with OAR 125-247-0440. To be effective the notice must include the OregonBuys bid number.

4.7 PROPOSAL DUE

A Proposal (including all required submittal items) must be received by the SPC on or before Opening. All Proposal modifications or withdrawals must also be received prior to Opening.

A Proposal received after Opening is considered LATE and will NOT be accepted for evaluation. A late Proposal will be returned to the Proposer or destroyed.

4.8 PUBLIC OPENING

There will be no public Opening of Proposals. Proposals received will not be available for inspection until after the evaluation process has been completed and the notice of Intent to Award is issued pursuant to OAR 125-247-0630. However, Agency will record and make available the identity of all Proposers after Opening.

4.9 PROPOSAL REJECTION

Agency may reject a Proposal for any of the following reasons:

• Proposer fails to substantially comply with all prescribed RFP procedures and requirements, including but not limited to the requirement that Proposer’s authorized representative sign the Proposal.

• Proposer has liquidated and delinquent debt owed to the State or any department or agency of the State.

• Proposer fails to meet the responsibility requirements of ORS 279B.110.

• Proposer makes any contact regarding this RFP with State representatives such as

State employees or officials other than the SPC or persons authorized by the SPC, or inappropriate contact with the SPC.

• Proposer attempts to influence a member of the Evaluation Committee.

• Proposal is conditioned on Agency’s acceptance of any other terms and conditions or rights to negotiate any alternative terms and conditions that are not reasonably related to those expressly authorized for negotiation in the RFP or Amendment(s).

4.10 EVALUATION PROCESS

4.10.1 Responsiveness and Responsibility Determination

4.10.1.1 Responsiveness determination

A Proposal received prior to Opening will be reviewed to determine if it is

DAS Procurement Services, Version 4.5 March 31, 2023- IT modified- 11-6-25 er Page 22 of 23

Responsive to all RFP requirements including compliance with Section 3.1 (Minimum Qualifications) and Section 3.2 (Minimum Submission Requirements). If the Proposal is unclear, the SPC may request clarification from Proposer. However, clarifications may not be used to rehabilitate a non- Responsive proposal. If the SPC finds the Proposal non-Responsive, the Proposal may be rejected; however, Agency may waive mistakes in accordance with OAR 125-247-0470.

4.10.1.2 Responsibility Determination

Agency will determine if an apparent successful Proposer is Responsible prior to award and execution of the Contract. Proposers shall submit a signed Responsibility Inquiry form (Attachment G) with Proposal.

At any time prior to award, Agency may reject a Proposer found to be not Responsible.

4.10.2 Evaluation Criteria

Scoring Explanation Table

Score Explanation

90 – 100 OUTSTANDING - Proposal meets submittal requirements, demonstrates exceptional knowledge of the subject matter, and demonstrates excellent ability to deliver the requested service and achieve the desired goals and objectives of the project as defined in this RFP.

61 – 89 GOOD TO VERY GOOD – Response meets submittal requirements, demonstrates thorough knowledge of the subject matter, and demonstrates an ability to successfully deliver the requested service and support the project in achieving its goals and objectives as defined in this

RFP.

50 – 60 SATISFACTORY – Response meets submittal requirements, demonstrates basic knowledge of the subject matter, and demonstrates an ability to minimally deliver the requested service. Would not meet or support the achievement of all the desired goals and objectives of the project as defined in this RFP.

DAS Procurement Services, Version 4.5 March 31, 2023- IT modified- 11-6-25 er Page 23 of 24

1 – 49 POOR TO FAIR – Response meets submittal requirements but does not demonstrate satisfactory knowledge of the subject matter or does not demonstrate an ability to deliver requested service or support the program in achieving its desired goals and objectives as defined in this RFP.

Each Proposal meeting all Responsiveness requirements will be independently evaluated by members of an Evaluation Committee. Evaluation Committee members may change and Agency may have additional or fewer evaluators for optional rounds of competition. Evaluators will assign a score for each evaluation criterion listed below in this Sections following 4.10.2.1 up to the maximum points available as specified in Section 4.11 (Point and Score Calculation).

After any applicable preference has been applied, the SPC will determine the rank of each Proposal, with the highest score receiving the highest rank, and successive rank order determined by the next highest score.

Agency may, in Agency’s sole discretion, determine an apparent successful Proposer with no additional rounds of competition. If additional rounds are conducted, Agency will rank advancing Proposers at the conclusion of each subsequent round and may determine an apparent successful Proposer at any time during the solicitation process

SPC may request further clarification to assist the Evaluation Committee in gaining additional understanding of a Proposal. A response to a clarification request may only clarify or explain portions of the already submitted Proposal and may not contain new information not included in the original Proposal.

The Proposals will be scored as follows for Round 1:

4.10.2.1 Proposer Organizational Profile (10 Points)

Degree to which Proposer demonstrates how the organization can effectively deliver the Services described in this RFP.

• How well the Proposal demonstrates a clear organizational structure capable of delivering the Services.

• How well the Proposal describes the Proposer’s business history, ownership, locations, staffing levels, and geographic distribution.

• How well the Proposal demonstrates experience supporting clients of similar size, complexity, and mission‑criticality.

• How well the described organizational resources support the ability to meet the requirements of this RFP.

DAS Procurement Services, Version 4.5 March 31, 2023- IT modified- 11-6-25 er Page 24 of 25

4.10.2.2 Experience and Capabilities (30 Points)

Degree to which to Proposer demonstrates sufficient experience in providing the Services and Capabilities.

• How well the Proposal demonstrates relevant experience in developing, maintaining, or supporting systems of comparable scope, sensitivity, and complexity.

• How well the Proposal demonstrates the required minimum years of experience and the applicability of past projects to the Solution required under this RFP.

• How well the Proposal’s work samples illustrate capability, quality, and successful outcomes.

• How well the Proposal demonstrates familiarity with regulated health or public health data systems or comparable domains.

• How well the Proposer’s capabilities align with the Statement of Work, including modernization, maintenance, and rapid‑response work.

4.10.2.3 Key Persons, Organizational Chart and Subcontractors (25 Points)

Degree to which Proposer describes Key Persons qualified by experience, credentials, and capabilities to deliver the requested services.

• How well each Key Person’s resume demonstrates required qualifications, certifications, and experience.

• How well the proposed Senior Developer and Project Manager meet the Minimum Requirements.

• How well the organizational chart demonstrates reporting relationships, team structure, and roles.

• How well any subcontractor relationships support delivery of the required Services.

• How well the proposed staffing plan supports the ability to meet the project’s needs and timelines.

4.10.2.4 Scope of Services (25 Points)

The degree to which Proposer demonstrates a clear understanding of the Solution and the services requested in this RFP, and the business and technical resources that equip Proposer to consistently deliver superior service.

DAS Procurement Services, Version 4.5 March 31, 2023- IT modified- 11-6-25 er Page 25 of 26

• How well the proposed Scope of Services aligns with the required tasks and deliverables in Section 2.4.2.

• How well the Proposal presents a clear project plan, timeline, and approach to managing the work.

• How well the services address both implementation and ongoing operational needs.

• How well the Proposal demonstrates understanding of mission‑critical public health systems, continuous availability requirements, and rapid response needs.

• How clearly each service and deliverable is tied to the pricing information in Attachment E.

• How well optional or value‑added services support OHA’s needs without introducing risk.

4.10.2.5 Performance Metrics and SLAs (5 Points)

Degree to which Proposer provides desirable and relevant performance metrics and service level agreements.

• How well the proposed performance metrics and service level agreements support reliability, availability, responsiveness, and quality.

• How well SLAs align with the needs of a mission‑critical system requiring 24/7/365 operations.

• How well the SLAs address defect resolution, response times, planned outages, and continuous monitoring.

• How clearly the Proposer…