Addendum 1 Questions and Answers.pdf

COLORADO DEPARTMENT OF PUBLIC HEALTH AND ENVIRONMENT

SOLICITATION QUESTIONS AND ANSWERS

Solicitation #: RFP 2027000001 Solicitation Name: CO Health Systems Directory

Vendor Question #1: Conflicting technology stack - RFP Section 2.1 vs. Section 2.4(6) RFP Section 2.1 states the integration tool utilizes Microsoft BizTalk Server 2020 CU7, with the database on SQL Server 2022, Windows Server 2019, and .NET 4.8. RFP Section 2.4(6), a mandatory pass/fail personnel requirement, instead requires Microsoft certification in BizTalk demonstrating ability to manage a system running BizTalk Server 2016 R2, Windows Server 2019, SQL Server 2016, and .NET 4.7. Exhibit B, PA #1 Sub-Activity 2 references only "SQL, BizTalk, IIS" with no versions.

● Which stack reflects the current production environment as of contract start?

● Which version does the State intend to govern the mandatory certification evaluation under

Section 2.4(6), and will a certification on the 2020 platform be accepted as meeting or exceeding that requirement?

● If both are present (for example, a 2016 environment mid-migration to 2020), will the State confirm whether an in-flight version upgrade is within scope and priced under this contract?

CDPHE Answer #1:

1. The following stack reflects the current production environment: Microsoft BizTalk Server 2020 CU7, with the database on SQL Server 2022, Windows Server 2019, and .NET 4.8.

2. The version used to govern the mandatory certification evaluation under Section 2.4(6) is the current production environment as identified in CDPHE Answer 1.1.

3. The current production environment is Microsoft BizTalk Server 2020 CU7, with the database on SQL Server 2022, Windows Server 2019, and .NET 4.8. Upgrades from a 2016 environment will not be funded under this RFP.

Vendor Question #2: Conflicting data volume and field-count parameters - RFP Section 2.11.A vs.

Exhibit B PA #2 RFP Section 2.11.A sizes new data sources at 1,000 to over 4,000,000 rows, up to 250 fields. Exhibit B, PA #2 Sub-Activity 1.a.ii-iii sizes the same work at 1,000 to over 1,000,000 rows and states each source may contain over 250 fields. These are materially different for effort and cost estimation.

● Which figures should Proposers use to size the ETL and integration effort?

● How many new data sources per contract year should be assumed for pricing purposes?

CDPHE Answer #2:

1. The correct size for new data sources is 1,000 to over 4,000,000 rows.

2. For pricing purposes, assume between 2-4 new data sources per contract year.

Vendor Question #3: Survey data management tools appear only in the RFP - RFP Section 2.11.E RFP Section 2.11.E requires the Contractor to "implement new tools for the management of survey data." Exhibit B contains no corresponding activity, sub-activity, deliverable, or definition relating to survey data anywhere in the Work Plan.

● Is survey data management in scope for the resulting contract?

● If so, will the State describe the survey instruments, data volumes, frequency, and whether any tooling exists today, so this can be priced?

CDPHE Answer #3:

1. Survey data management identified in RFP Section 2.11.E is part of Exhibit B Statement of Work as part of PA #3.

2. Survey data management is done annually for up to 30,000 using existing templates for importation into the Colorado Health Systems Directory.

Vendor Question #4: “Maintain" vs. net-new development - Exhibit B vs. RFP Section 2.11.D and Section 2.13.A.d Exhibit B consistently uses "maintain" and "maintain existing" for reporting, GUI, and validation tooling.

The RFP requires the Contractor to deliver "better reviewer tools" (Section 2.11.D) and to "develop and implement improved data extraction tools" (Section 2.13.A.d).

● Are these net-new development items or maintenance of existing functionality?

● What are the acceptance criteria for "better" and "improved," and will the State provide the current baseline so Proposers can scope and price the delta?

CDPHE Answer #4:

1. The work being solicited under this RFP is to “maintain” and “maintain existing” tooling and functionality. While the State does expect new data imports to be created, the reference to “maintain” and “maintaining existing” does not mean create new.

2. The current baseline for tooling is one (1) to three (3) minutes on average and one (1) to two

(2) percent ends up in review tables. Acceptance criteria for “better” and “improved” is above the current baseline.

Vendor Question #5: FedRAMP and StateRAMP obligation in a State-owned Azure tenant - RFP Section 1.16, Section 2.10.1.C, Section 2.15.B vs. Exhibit B PA #1.3 and Deliverable 2 Both documents require compliance with FedRAMP, and RFP Section 1.16.1 additionally lists StateRAMP and a SOC 2 Type II. However, Exhibit B PA #1 Sub-Activity 1 places the environment inside an existing Microsoft Azure tenant, and Exhibit B Deliverable 2 states Azure is "acquired under a separate agreement," that is, not held by the Contractor.

● Is the Contractor expected to hold its own FedRAMP and/or StateRAMP authorization, or to inherit the authorization boundary of the State's existing Azure tenant?

● Is a SOC 2 Type II report on the Contractor's own operations sufficient to satisfy Section 1.16.1(a) and Section 2.13(b)(iv)?

● Who is the accountable party for the System Security Plan (Attachment 4) where the hosting agreement sits with the State?

CDPHE Answer #5:

1. The successful offeror is not expected to hold its own FedRAMP and/or StateRAMP authorization. The State environment is in compliance.

2. Yes, the SOC 2 Type II report on the Offeror’s own operations is sufficient.

3. For purposes of this solicitation, Offeror shall complete Attachment 4 using the guidance provided in RFP 2.13. The accountable party for the System Security Plan is TBD.

Vendor Question #6: 24/7/365 availability, 1-hour RTO and hourly RPO are absent from Exhibit B - RFP Section 2.13(b)(iii) RFP Section 2.13(b)(iii) requires hourly RPO, 24/7/365 system availability, and a one-hour RTO, with the Proposer leading the DR plan. Exhibit B, Draft Statement of Work, contains no availability, uptime, service level, incident response, on-call, or disaster recovery obligation of any kind, and its only deliverables are two monthly reports.

● Will the executed Statement of Work incorporate these RPO, RTO, and availability requirements, and if so, will the State add corresponding service levels to Exhibit B?

● Is 24/7/365 on-call coverage expected of the Contractor, or is the Contractor's obligation limited to Business Days as defined in Section 2.9(4)?

● Does the State's existing Azure and OIT infrastructure currently meet the one-hour RTO and hourly RPO, or is remediation to achieve them within this scope and price?

CDPHE Answer #6:

1. There is no expectation that the successful Offeror provides 24/7/365 system availability.

2. The successful offeror is not expected to provide 24/7/365 coverage. The expected coverage level is 7 AM to 7 PM 7 days a week.

3. The State’s existing Azure currently meets these requirements; however, the Office of

Information Technology does not currently meet these requirements. There is no available funding for remediation.

Vendor Question #7: Patient-level claims (APCD and Medicaid) scope and timing - RFP Section 2.14 and Exhibit B PA #5 vs. RFP Section 2.6 RFP Section 2.6, the Statement of Work Summary, lists only three activity areas (database management and security, data integration and quality control, data structures and entity management). It does not mention patient-level claims integration, the analytical dashboard, or the SSRS reporting build, yet these appear as substantive scope in RFP Sections 2.13 and 2.14 and Exhibit B PA #4 and PA #5, and as separate scored evaluation categories in Section 4.1.

● Is patient-level claims integration in scope for the initial one-year term, or is it contingent on option years and additional funding?

● Which party obtains the APCD and Medicaid data use agreements, and by what date will data and specifications be available to the Contractor?

● Will PHI be stored in the CHSD, and is the existing environment currently authorized for PHI at that classification?

CDPHE Answer #7:

1. Patient-level claims integration is in the statement of work (SOW) for all five years of the RFP.

Options to renew after year one are subject to available funding.

2. The State obtains the APCD and Medicaid data use agreements. Data and specifications will be available to the successful Offeror once the RFP is awarded.

3. PHI is stored in the CHSD. The existing environment is currently authorized for PHI.

Vendor Question #8: "No onboarding or transition period" vs. contract start and pre-performance meeting - RFP Section 2.3(d), Section 2.8, Section 2.16 RFP Section 2.3(d) is a mandatory pass/fail requirement that the Proposer provide "seamless access to the existing CHSD system upon execution of the contract... as there will be no onboarding or transition period." RFP Section 2.8 sets the anticipated start at 7/1/2027, roughly nine months after the 10/1/2026 proposal deadline, and Section 2.16 provides for a Pre-Performance Meeting after execution.

● For a Proposer that is not the incumbent, how does the State intend this requirement to be satisfied, and what knowledge transfer, documentation, credentials, source code, and environment access will the State or the incumbent provide, and on what schedule?

● Is any transition, knowledge-transfer, or ramp-up labor allowable and billable under the contract, or must it be absorbed?

● Given the nine-month gap between proposal submission and contract start, will the State confirm the environment (versions per Question 1) expected at 7/1/2027?

CDPHE Answer #8:

1. The successful Offeror will need to be able to be fully functioning in the environment within 90 days of contract execution.

2. There is no funding available for transition, knowledge-transfer, or ramp-up labor.

3. The expectation is that the current environment will be functional at the start of this five-year cycle (7.1.27)

Vendor Question #9: EGC gating and IV&V obligations are not reflected in the Exhibit B deliverables

- RFP Section 2.19 vs. Exhibit B Section V RFP Section 2.19 requires compliance with the State's Executive Governance Committee project gating methodology, inclusion of all EGC gating items in the project plan, and cooperation with a State-engaged IV&V vendor. Exhibit B's Deliverable Schedule contains only two items, both monthly reports due by the 15th.

● Which EGC gates apply to a maintenance and enhancement contract of this type, and what gating artifacts and review cadence are expected?

● What level of Contractor effort should be assumed for IV&V support, EGC documentation, and project management, so it can be priced?

● Will the State add these to the executed Statement of Work deliverable schedule?

CDPHE Answer #9:

1. All gating is already current and compliant.

2. The successful Offeror is not expected to perform work on gating. All gating is already current and compliant.

3. These items will not be added to the executed Statement of Work deliverables schedule. All gating is already current and compliant.

Vendor Question #10: Third-party licenses and the "all costs included" rule - RFP Section 1.10, Section 2.13(a), Section 2.14 vs. Exhibit B PA #2.3 and Deliverable 2 RFP Section 1.10 requires prices to be firm and to include all related costs, and Section 2.13(a) and Section 2.14 state that any additional costs added later "will be disallowed." At the same time, Exhibit B contemplates a commercial data validation system and a "state-selected validation system vendor" (PA #2 Sub-Activity 3.a and 3.d), and Azure "acquired under a separate agreement" (Deliverable 2).

The BizTalk, SQL Server, SSRS, and Power BI licenses are likewise not addressed.

● Please confirm which of the following are State-furnished and excluded from the Proposer's price: Azure consumption; BizTalk, SQL Server, and Windows Server licensing; SSRS and Power BI licensing; the commercial data validation service subscription and its per-transaction or per-lookup fees.

● If any are the Contractor's responsibility, will the State provide current annual consumption and volume figures so a firm price can be offered?

● Given the disallowance language, how should Proposers price validation-service volumes that scale with State-directed new data sources?

CDPHE Answer #10:

1. Offeror does not need to include pricing related to Azure consumption; BizTalk, SQL Server, and Windows Server licensing; SSRS and Power BI licensing; the commercial data validation service subscription and its per-transaction or per-lookup fees. These items are State-furnished.

2. Since these items are furnished by the State, there is no need for Offeror to factor in these costs. Offeror is expected to efficiently manage API call credits provided by the State.

3. Offeror should make their best estimate. The existing infrastructure allows for flexibility of import sizes of files. The Offeror is expected to utilize existing templates, where feasible. The State will ensure that price-validation service volumes do not exceed purchased limits.

Vendor Question #11: Budget figures do not reconcile - RFP Section 2.7 vs. Section 2.8 and Signature Page (cost clarification) RFP Section 2.7 states the budget is approximately $1,000,000 for the first two years and $500,000 for option years two through five, with a five-year total not to exceed $3,500,000. The contract term, however, is a one-year initial term plus up to four one-year options (Signature Page; Section 2.8). The stated components total $3,000,000, not $3,500,000, and "option years two through five" appears to overlap "the first two years."

● Please confirm the intended annual not-to-exceed amounts by contract year, Year 1 through Year 5.

● Does "the first two years" mean the initial one-year term plus the first option year?

● Should Proposers price to the $3,500,000 five-year ceiling or to the $3,000,000 implied by the component figures, and should Attachment 2 be completed for all five years or the initial term only?

CDPHE Answer #11:

1. The expected budget is as follows and contingent upon available funding:

a. Year 1: $1,000,000

b. Year 2: $1,000,000

c. Year 3: $500,000

d. Year 4: $500,000

e. Year 5: $500,000

2. The first two years are defined as Year 1 and Year 2 as detailed in CDPHE Answer 1.1.a and

1.1.b.

3. Offerors should submit budgets for the full five-year project cycle.

Vendor Question #12: Pricing structure and contract vehicle (cost clarification) - RFP Section 1.10, Section 2.9, Section 2.11.A.e, Section 2.15 RFP Section 2.9 defines the resulting contract as an OIT Enterprise Agreement under C.R.S. 25-37.5- 105 under which "various entities may access the good or services... at the same prices," and defines "Order," "Purchase Order," "Delivery Schedule," "Authorized Purchaser," and "MSP." RFP Section 2.11.A.e separately requires the Contractor to provide cost estimates for incorporating unique data sources. Exhibit B, by contrast, is a fixed scope with monthly reporting deliverables only.

● Should Attachment 2 be priced as a firm fixed monthly or annual fee, as labor rates against an estimated level of effort, or as a hybrid with a fixed maintenance fee plus rate-card-based work orders?

● Are entities other than CDPHE expected to place Orders under this Enterprise Agreement, and if so, is that volume within the $3,500,000 ceiling?

● Are new data source integrations and State-directed enhancements funded from the base price, or authorized and funded through separate Orders at the rates proposed?

● Will payment be monthly in arrears against the Section V monthly reports, or milestone and deliverable-based per the "Delivery Schedule" definition in Section 2.9(7)?

CDPHE Answer #12:

1. Offeror should price work per primary activity as stated in Attachment 2. Payments are made monthly on a cost reimbursement basis.

2. CDPHE is the only entity placing Orders under this proposal.

3. Yes, new data source integrations and State-directed enhancements are funded from the base price per year.

4. Payments are made monthly on a cost-reimbursement basis. Offeror should price out the budget based on each Primary Activity as identified in Attachment 2 Budget Template.