Addendum 1, Questions and Answers.pdf

COLORADO DEPARTMENT OF PUBLIC HEALTH AND ENVIRONMENT

SOLICITATION QUESTIONS AND ANSWERS

Solicitation #: RFP 2027000072 Solicitation Name: Data Validation for CHSD

Vendor Question #1: Subcontracted CASS provider (Sections 2.3, 2.15). Will the State accept a prime contractor that uses a USPS CASS-certified data provider as a named subcontractor, with the CASS certification held by that subcontractor?

CDPHE Answer #1: The prime contractor and any subcontractors performing work under this RFP are required to hold CASS certification.

Vendor Question #2: Demographic fields and sources (Section 2.9, Exhibit B). Section 2.9 lists gender and country of origin, but Exhibit B does not. Are both required? Does “country of origin” mean country of birth, citizenship or professional education? Will the State share DORA licensure data for validation, or should the proposer supply all sources?

CDPHE Answer #2: Both the gender and country of origin are required. Country of origin is defined for purposes of this RFP as “the country of origin of birth.” The State of Colorado will provide all raw data to be validated by the successful proposer.

Vendor Question #3: Volumes (Section 2.10.1). Please provide estimated annual record volumes for address and demographic validation, and the largest expected single batch.

CDPHE Answer #3: The estimated annual record volumes for address and demographic validation is approximately 25 million. The largest expected single batch is 8 million.

Vendor Question #4: Integration (Section 2.10.1, Exhibit B). Will the CDPHE PCO Database Contractor build the CHSD side of the integration (sending records and loading results), or should the proposer price that work?

CDPHE Answer #4: The current integration is built to a specific vendor. Any changes of requirements will be completed by the CDPHE PCO Database Contractor with data definitions and fields requested from the service contract.

Vendor Question #5: Pricing (Attachment 2). Does a “call” mean one record or one API request? Is a fixed annual subscription acceptable in place of per-call pricing?

CDPHE Answer #5: For purposes of this RFP, a “call” is defined as one API request, which is one record. A fixed annual subscription is acceptable in place of per-call pricing.

Vendor Question #6: Hosting (Section 2.11). Is FedRAMP or StateRAMP authorization required, or will a SOC 2 Type II report satisfy the requirement?

CDPHE Answer #6: Please refer to the Request for Proposals Section 1.16 Information Security and 1.16.1. Additional OIT Security Conditions/Compliance for requirements specific to this question.

Vendor Question #7: Section 2.9 (Demographic Data): Does the State expect the Proposer to source and append demographic data (gender, sex, age/DOB, email, country of origin, education level) from third-party authoritative sources, or to validate and standardize demographic data already present in CHSD records? If third-party sources are expected, are there sources the State requires or prohibits?

CDPHE Answer #7: The State expects the Proposer to source and append demographic data (gender, sex, age/DOB, email country of origin, education level) from third-party authoritative sources. The State expects the Proposer to validate and standardize demographic data already present in CHSD records.

All third-party sources must adhere to requirements identified in the Request for Proposals Section 1.16 Information Security and 1.16.1. Additional OIT Security Conditions/Compliance.

Vendor Question #8: Section 2.10.1 (a), (b) and (d): Can the State share the CHSD database platform (e.g., Microsoft SQL Server), its hosting environment (OIT on-premises or cloud), and a sample schema or de-identified sample records? When volumes reach "millions of records," is that per file load or per day, and is a batch endpoint acceptable alongside a real-time API?

CDPHE Answer #8: The State cannot share the platform, hosting environment, sample schema, or de-identified sample records. The service provider Proposer will share the template that the State will ensure is used for submitted data. For purposes of this RFP, millions of records are defined as per file load. A batch endpoint is acceptable alongside a real-time API.

Vendor Question #9: Sections 2.10.2 and 2.10.3 (User Interface and Authentication):

Since the core service is an API, what user-facing interface does the State expect (e.g., an administrative console for monitoring, configuration and reporting)? Which directory service should authentication integrate with (e.g., Microsoft Entra ID / ADFS via SAML)?

CDPHE Answer #9: The State expects a user-facing interface for testing, validation and monitoring of usage with standard web service architecture for integration.

Vendor Question #10: Section 2.4(3) and Section 2.15 (Experience and Subcontractors): If the Proposer acts as Prime Contractor and uses a CASS-certified address engine provided by a subcontractor, may the subcontractor's projects and references count toward the three projects of similar size and scope?

CDPHE Answer #10: The prime contractor and any subcontractors performing work under this RFP are required to hold CASS certification.

Vendor Question #11: Section 2.11(b)(iv) (Third-Party Certification): The Proposer's solution is hosted on Amazon Web Services (AWS), which maintains SOC 2 Type II reports and FedRAMP authorizations for its infrastructure. Will the State accept AWS's infrastructure-level reports together with the Proposer's agreement to security audits and penetration testing by OIT or its designee for the application layer, in lieu of a Proposer-specific SOC 2 Type II report? If a Proposer-specific report is required, must it be in place at proposal submission or prior to contract execution?

CDPHE Answer #11: The State will accept AWS’s infrastructure-level reports together with the Proposer’s agreement to security audits and penetration testing by OIT or its designee for the application layer in lieu of a Proposer-specific SOC 2 Type II report.

Vendor Question #12: Section 1.21 (Artificial Intelligence): If a Proposer discloses use of AI or machine learning for record matching and confidence scoring (not a High-Risk use case), is that acceptable, and what level of documentation does the State expect in the proposal?

CDPHE Answer #12: The use of Artificial Intelligence (AI) or machine learning for record matching and confidence scoring is not acceptable for work performed under this Request for Proposals.

Vendor Question #13: Section 2.17 (EGC / IV&V): Will the State engage and pay the IV&V vendor directly, or should Proposers include IV&V-related costs in Attachment 2?

CDPHE Answer #13: The State will engage and pay the IV&V vendor directly. No IV&V-related costs should be included in Attachment 2.

Vendor Question #14: Attachment 2 (Budget / Price Sheet): Is per-record or tiered transaction pricing acceptable, or does the State prefer a fixed annual subscription price?

CDPHE Answer #14: The preferred pricing is per 10,000 records; however, the State will accept a fixed annual subscription price.

Vendor Question #15: Gender, sex, country of origin and education level have no authoritative reference source. Does “validation” mean format and consistency checks, or matching against a third-party dataset? If the latter, which sources are acceptable?

CDPHE Answer #15: For purposes of this RFP, validation is defined as matching to a third-party data set. All third-party sources must adhere to requirements identified in the Request for Proposals Section 1.16 Information Security and 1.16.1. Additional OIT Security Conditions/Compliance.

Vendor Question #16: Must the proposer hold its own CASS certification, or can it use a licensed USPS CASS-certified engine through a subcontractor under the prime/sub rules in 2.15?

CDPHE Answer #16: The prime contractor and any subcontractors performing work under this RFP are required to hold CASS certification.

Vendor Question #17: Section 2.10.1(b) requires the API to be “blind to the format, source and structure of the data.” To estimate effort and price accurately, please provide the list of input data formats (e.g., JSON, XML, CSV, PNG, JPG etc.,) and the input schemas (field names, data types, lengths, and required vs. optional fields) that the API must support for the address and demographic elements in Section 2.9.

CDPHE Answer #17: The State cannot share the platform, hosting environment, sample schema, or de-identified sample records. The service provider proposer provided the input data format and input data types and lengths the State adheres to. Please refer to the Request for Proposals Section 2.9 Detailed Definition of Work for required data elements.

Vendor Question #18: How should unmatched PO boxes, addresses be handled?

CDPHE Answer #18: If the data is unmatched and unmapped, the State expects an error code to be returned in response, reflecting that error.

Vendor Question #19: What are the average and peak records per day, the expected annual total? Is the API called synchronously per record, in batches, or both?

CDPHE Answer #19: An average daily call rate on business days is up to 125,000. A typical peak call rate is 4 million, but may reach 8 million in unusual instances. An average of 4 million calls per day is possible during data record drops, but not consistently at this volume due to the cyclical nature of this work.

Peak records are one-half million per hour. The expected annual total is 25 million records.

The API should have the capacity to do both per record and in batches.

Vendor Question #20: Can the State provide a sample output schema, the CHSD data dictionary, or sample records (de-identified if needed), such as those in Exhibit E (Master Data Inventory), so proposers can size and price the work?

CDPHE Answer #20: The State cannot share the platform, hosting environment, sample schema, or de-identified sample records. The service provider proposer provided the input data format and input data types and lengths the State adheres to. Please refer to the Request for Proposals Section 2.9 Detailed Definition of Work for required data elements.

Vendor Question #21: Fields and verification (RFP §2.9–2.10, physical pp.19–21;

Attachment 2; Exhibit B, Program Area 2): Which demographic fields are mandatory? The RFP/budget includes gender, sex, age/date of birth, email, country of origin and education; the SOW lists sex, DOB, email and education. What verification evidence, precision, confidence threshold and handling of unavailable/contradictory values are acceptable? Is month-only DOB sufficient? We would not treat inferred gender as verified sex or a postal country as a person's country of origin.

CDPHE Answer #21: All demographic fields are mandatory where the data exists. Month and year DOB is acceptable for verification evidence. All third-party sources must adhere to requirements identified in the Request for Proposals Section 1.16 Information Security and

1.16.1. Additional OIT Security Conditions/Compliance.

Vendor Question 22: Volumes and pricing units (RFP §2.6 and §2.13, physical pp.14,23;

Attachment 2): Please provide annual/peak volumes separately for address and demographic processing, repeated records/retries, and the billable definition of one call in the per-10,000-call budget. Does a call mean a request, record, successful match or field transaction? How should annual license minimums and startup/platform costs be presented in Additional costs without assuming guaranteed volume

CDPHE Answer #22: For address, the annual is 25 million and the peak volume is 8 million.

For demographic processing, the annual is 1 million and the peak volume is 250,000. The volume for repeated records/retries is included in these counts for both address and demographic processing. For purposes of this RFP, the billable definition is one single API request. A call is defined as a request. The proposer can present additional costs as “other costs” in the budget; however, the State expects a solution to be fully available on Day 1 of the project.

Vendor Question #23: Rooftop results (RFP §2.9–2.10, physical pp.19–21; Attachment 2;

Exhibit B address requirements): Please reconcile six-digit precision required/nine preferred in the main RFP/budget with nine required in the SOW. What positional accuracy, coverage, census vintage and apartment-append evidence are required? We distinguish coordinate precision from demonstrated accuracy.

CDPHE Answer #23:

The request is for rooftop-level geocoding. For all returns not meeting rooftop-level accuracy, an error code should be annotated with the best available code. Positional accuracy should be set to rooftop, geographic coverage to CONUS, census vintage to 2020, and apartment append to rooftop.

Vendor Question #24: Assurance scope and timing (RFP §1.16.1, physical p.10; §2.11, physical pp.22–23; Exhibit C IT exhibit §5(D)(i), physical p.52; Attachment 4 SSP): Does the prime's custom API/integration require its own annual SOC 2 Type II report, or what ISO/OIT-approved alternative and timing are acceptable? How may certified-provider/hosting reports support their own boundary? Which SSP and assurance evidence is due with the proposal versus contract execution or go-live?

CDPHE Answer #24: The proposer guarantees the boundary of the platform operated by the proposer. The State retains full responsibility for identity management. The SSP will be due during the contract negotiation process. Please refer to the Request for Proposals Section

1.16 Information Security and 1.16.1. Additional OIT Security Conditions/Compliance for requirements specific to this question

Vendor Question #25: Data rights (Exhibit B General Standards and Requirements;

Attachment 5 DUA §§E–I, physical p.2; RFP §2.10.7/§2.11): Please confirm permitted provider/subprocessor access and State retention of returned attributes after subscription expiry, while honoring the no-enrichment/commingling/AI-training restriction. How should destruction/return coexist with security/audit logs retained for six years?

CDPHE Answer #25: The State retains all rights and ownership of all data post-normalization.

The proposer should not persist the data (save data so it can be retrieved and used later, even after the application has closed) sent by the State in its call following the return response.

Vendor Question #26: Forms and DUA timing (Attachments 1, 3 and 4; Exhibit B General Standards and Requirements and Deliverable Schedule, first deliverable row): Please provide corrected solicitation identifiers/contacts: Attachment 1 has an older RFP/contact, Attachment 3 says RFP20270000413, and Attachment 4 says RFP202700043.

Please confirm the designated inquiry contact and reconcile 30 business days versus 30 days for DUA execution.

CDPHE Answer #26: The correct solicitation number for this Request for Proposals is 2027000072. Please reference this RFP number in all required attachments. The Data Use Agreement (Attachment 5) provided as part of this RFP is for the Proposer’s review. The Data Use Agreement will be completed by the successful Proposer during contract negotiation.

Vendor Question #27: Demographic validation (RFP Section 2.9, page 18; Section 2.10.5(3), page 20; Exhibit B, Section III(F) and Primary Activity #2). For the required demographic fields, does the State expect the service to verify values already present in CHSD, append missing values from reference sources, or both? Are estimated or inferred demographic values acceptable if clearly identified, and if so, for which fields? Please also specify any minimum accuracy or match-coverage requirements.

CDPHE Answer #27: The State expects both verification of values already present in the CHSD and append missing values from reference sources. Estimated or inferred demographic values are acceptable for all demographic fields as long as these are clearly identified. A minimum accuracy of at least 90% is expected for standard localized datasets.

Vendor Question #28: Clinician matching inputs (RFP Section 2.10.1, pages 18–19; Exhibit B, Section II). What identifying fields will CHSD provide with individual clinician records sent to the validation API, such as name, National Provider Identifier (NPI), date of birth, email address and telephone number? Will addresses be professional practice addresses, residential addresses, or both? If available fields vary by data source, please describe the typical combinations the service should support.

CDPHE Answer #28: No additional fields are sent along with the data to be validated. All addresses will need to be identified by the Proposer as residential, practice, etc. Available fields will not vary by data source.

Vendor Question #29: Reference-data matching under the DUA (Attachment 5, Attachment B, page 4, fifth checkbox; Exhibit B, General Standards and Requirements, items 10–11). The confidentiality agreement prohibits attempts to deduce a subject’s identity and gives linkage to named records in another dataset as an example. Please clarify how this restriction applies to comparing already identified clinician records against external reference datasets solely to perform the contracted validation.

CDPHE Answer #29: It is unrelated. The confidentiality agreement does not allow attempts to deduce the subject's identity if they are deidentified.

Vendor Question #30: Geocoding requirements (RFP Section 2.9, page 18; Attachment 2 footnote; Exhibit B, Primary Activity #1). Please clarify whether “six digit” and “nine digit” describe the number of decimal places in the returned latitude/longitude coordinates or postal-code-based geocoding levels. Please also reconcile whether nine-digit output is required, as stated in Exhibit B, or preferred, as stated in the main RFP and Attachment 2.

CDPHE Answer #30: “Six digit” and “nine digit” describe the number of decimal places in the returned latitude/longitude coordinates. Nine digits is preferred, but six is required.

Vendor Question #31: Is SAM.gov registration or a UEI required of the awarded contractor?

CDPHE Answer #31:

The successful proposer will be required to register with SAM.gov and obtain a UEI before the formal contracts negotiation process commences.

http://sam.gov/

Vendor Question #32: For the requirement of three projects of similar size and scope within the past five years, may projects completed by the proposer's principal before the entity was formed count toward it? Ananyata Systems LLC was formed in July 2026, and its founder has led comparable data validation and healthcare operations work before that.

CDPHE Answer #32: The State is buying a service from a proposer and not a skill from a particular principal. Projects completed by a specific principal prior to an entity’s formation may not be used toward the required three projects.

Vendor Question #33: Contacting clinicians (Attachment 5, Data User Obligation C). The Data Use Agreement prohibits contacting the subject of the information or the subject's provider. Does that restriction apply to this work, so that demographic data such as email address and education level must be validated only against reference sources and never by contacting the clinician or practice?

CDPHE Answer 33: As per the Data Use Agreement, the restriction applies to this work.

Vendor Question #34: Volumes for pricing (2.10.1 d, Attachment 2). Attachment 2 prices per 10,000 calls. Can the State provide the number of records currently in the CHSD, the expected annual number of address and demographic validation calls, and the size and frequency of the largest expected batch?

CDPHE Answer #34: The estimated annual volume is approximately 25 million and the largest single batch is 8 million.

Vendor Question #35: Records in scope. Exhibit B describes the CHSD as licensed clinicians and health care sites. Will all records sent for validation be clinicians and sites, or will other individuals be included?

CDPHE Answer #35: All records sent for validation will not necessarily be clinicians or health care sites.

Vendor Question #36: Meaning of "validated demographic data" (2.9, Exhibit B PA #2). Is the Contractor expected to (a) confirm demographic values the State sends, (b) supply or append values that are missing from the CHSD from the Contractor's own reference sources, or both? Which reference sources would the State consider acceptable for each field?

CDPHE Answer #36: The Contractor is expected to confirm the demographic values the State sends and supply or append values missing from the CHSD from the Contractor’s own reference sources. All third-party sources must adhere to requirements identified in the Request for Proposals Section 1.16 Information Security and 1.16.1. Additional OIT Security Conditions/Compliance.

Vendor Question #37: Demographic fields. Section 2.9 and Attachment 2 list gender, sex, age and/or date of birth, email address, country of origin and education level. Exhibit B PA #2 lists sex, date of birth, email address and education level only. Which list governs?

Should gender and country of origin be priced?

CDPHE Answer #37: Both gender and country of origin should be priced.

Vendor Question #38: Geocoding precision (2.9 item 9, Exhibit B PA #1). Please define "six (6) digit" and "nine (9) digit" geocoding, for example decimal places of latitude and longitude. Section 2.9 and Attachment 2 call nine-digit "preferred," while Exhibit B calls both "required." Which governs?

CDPHE Answer #38: 6 digit is required and 9 digit is preferred.

Vendor Question #39: Census geography. Which census vintage (for example, 2020 census tracts and blocks) should be returned?

CDPHE Answer #39: The proposer should use the 2020 census.

Vendor Question #40: CASS certification (2.5, 2.10.1 c). May the Proposer deliver CASS-certified processing through a CASS-certified engine or service licensed from a third party, identified as a subcontractor under 2.15, or must the Proposer hold CASS certification itself?

CDPHE Answer #40: The prime contractor and any subcontractors performing work under this RFP are required to hold CASS certification.

Vendor Question #41: User interface requirements (2.10.2 items 2 to 4, 2.10.3, 2.12).

The work is described as system-to-system validation via API. Is a user-facing interface required? If so, who are its users and what would they do in it? Does "Directory and cross-domain authentication" mean integration with the State's identity provider (for example, ADFS/SAML)?

CDPHE Answer #41: A user-facing interface for testing and validation and monitoring of usage is required. A standard web service architecture for integration. There is no integration with the State’s identity provider.

Vendor Question #42: Availability and recovery (2.11 b iii, Exhibit B). Exhibit B asks for at least 99% uptime, while 2.11 asks for 24/7/365 availability with an hourly RPO and one-hour RTO. Which applies to this service? If the Contractor does not retain State data after a validation call is returned, how should the RPO requirement be addressed?

CDPHE Answer #42: 24/7/365 applies to this service. The State expects the successful Proposer to respond to all requests and return all data. There is no RPO requirement since there is no expectation by the State, nor does the State want the successful Proposer to retain ANY data. The expectation under this RFP is that the Proposer provides a service for data validation and normalization, not data retention from the service provider.

Vendor Question #43: Data retention. Does the State expect the Contractor to store State records after returning validated results? Section 2.11 b ii asks for log retention of not less than six years. Should those logs contain record content, or only transaction metadata?

CDPHE Answer 43: There is no expectation that the Contractor stores State records after returning validated results. Logs should only contain transaction metadata.

Vendor Question #44: Environments (2.10.2 item 1, 2.10.3 item 1). For an API service, would a production endpoint plus one non-production test endpoint satisfy the production, test, training and development environment requirement?

CDPHE Answer #44: For purposes of this RFP, for an API service, a production endpoint plus one non-production test endpoint satisfies the production, test, training, and development environment requirement.

Vendor Question #45: EGC gating and IV&V (2.17). Will this project be subject to EGC gating and third-party IV&V? If so, should Proposers include time for IV&V cooperation in their price, and is the IV&V vendor paid by the State?

CDPHE Answer #45: The State will engage and pay the IV&V vendor directly. No IV&V-related costs should be included in Attachment 2.

Vendor Question #46: Similar projects (2.4 items 1, 3 and 4). What counts as "similar size and scope"? For example, would provider directory, address standardization or data validation work for health plans, provider groups or other non-government clients qualify?

CDPHE Answer #46: For purposes of this RFP, provider directory, address standardization or data validation work for health plans, provider groups or other non-government clients qualify as “projects of similar size and scope.”

Vendor Question #47: Security assurance timing (1.16.1 a, 2.11 b iv). Is the SOC 2 Type II report required with the proposal or at contract execution? If the current report does not cover all three of Security, Confidentiality and Availability, would the State accept a plan to add them or the alternative described in 2.11 b iv?

CDPHE Answer #47: The SOC 2 Type II report will be required from the successful Proposer at the time of contract negotiation and must be in place before a contract will be fully executed. All three - Security, Confidentiality, and Availability - are required.

Vendor Question #48: Artificial intelligence (1.21, Exhibit B). Would rules-based or statistical matching used to standardize and score records count as AI that must be disclosed? Is AI permitted for this work as long as State data is not used to train or improve models, as Exhibit B states?

CDPHE Answer #48: The use of Artificial Intelligence (AI) or machine learning for record matching and confidence scoring is not acceptable for work performed under this Request for Proposals.

Vendor Question #49: Integration and current state (Exhibit B). Who is the "CDPHE PCO Database Contractor" that the Contractor will coordinate with? Does the CHSD use a validation service today, and if so, is it being replaced?

CDPHE Answer #49: The CDPHE PCO Database Contractor is to be determined based on the selection of a successful proposer under a separate RFP. The CHSD currently uses a validation service that is out for bid under this RFP.

Vendor Question #50: Pricing structure (1.10, Attachment 2). May Proposers include a one-time implementation fee and annual price adjustments for the optional extension years on Attachment 2? Is the approximately $100,000 annual budget in 2.6 inclusive of implementation?

CDPHE Answer #50: Proposers may include on Attachment 2 a one-time implementation fee and annual price adjustments. The $100,000 annual budget is inclusive of implementation.

Vendor Question #51: Schedule (2.7). The contract starts July 1, 2027. When does the State expect to issue the Notice of Intent to Award, and is integration and testing expected to be complete by July 1, 2027?

CDPHE Answer #51: For purposes of this RFP, the State expects an executed contract in place on July 1, 2027. The State expects the service to be available and fully functioning as of the execution date.

Vendor Question #52: Insurance (Exhibit C, Section 10). Cyber liability limits are tiered by the number of records held by the Contractor. If State records are processed and returned but not stored, which tier applies? Is crime insurance (Section 10 F) required for this service?

CDPHE Answer #52: State records processed and returned but not stored are Tier 3 (Repeatable). repeatable. The successful proposer is required to obtain, maintain and ensure that all subcontractors performing work under this RFP obtain and maintain insurance as specified in Exhibit C, State of Colorado Information Technology Contract, Section 10, Insurance.

Vendor Question #53: Document references. Attachment 1 shows RFP # 2027000043 and Darla Wear as the inquiry contact, and Attachment 3 shows RFP 20270000413. Please confirm that the RFP number to use on all returned documents and file names is 2027000072, and that Allan Smith is the sole point of contact.

CDPHE Answer 53: The correct solicitation number for this Request for Proposals is 2027000072. The sole point of contact for this solicitation is Allan Smith, Purchasing Unit Supervisor.

Vendor Question #54: Measuring accuracy (2.1, Exhibit B Measurement of Expected Results). How will the State measure "accurate" address and demographic validations, for example by sampling against a reference, against the Contractor's documented validation rules, or against a target rate? Is a documented "unable to verify" result for a value with no reference source counted as an accurate validation?

CDPHE Answer #54: Accuracy is measured in alignment with CASS certification returns. A documented “unable to verify” result for a value with no reference source is counted as an accurate validation provided the correct error code is returned.

Vendor Question #55: Optional additional data (2.9 item 11, Attachment 2 "Other requests"). May Proposers offer optional data elements beyond those listed, for example independent confirmation that a clinician practices at a given address based on multiple reference sources, priced separately on Attachment 2 and used only if the State elects them?

CDPHE Answer #55: No, costs should be identified as one cost for each call.

Vendor Question #56: State reference data. Will the State provide, or facilitate access to, reference data it already holds or licenses, such as licensure data from the Division of Professions and Occupations or the Colorado All Payer Claims Database, for use in validation under the Data Use Agreement?

CDPHE Answer #56: The State will not provide nor facilitate access to reference data or licenses already held.

Vendor Question #57: Please provide the estimated annual number of records and API transactions, anticipated peak batch size and transactions per second, expected growth, and whether repeat submissions of the same record are included in the volume estimate.

CDPHE Answer #57: For address, the annual is 25 million and the peak volume is 8 million.

For demographic processing, the annual is 1 million and the peak volume is 250,000. The volume for repeated records/retries is included in these counts for both address and demographic processing

Vendor Question #58: For gender, sex, age/date of birth, email address, country of origin, and education level, please clarify which fields are mandatory at initial go-live, what CDPHE means by “validated,” and which authoritative sources, match-confidence thresholds, and accuracy measures will be accepted.

CDPHE Answer #58: All demographic fields are mandatory where the data exists. Month and year DOB is acceptable for verification evidence. All third-party sources must adhere to requirements identified in the Request for Proposals Section 1.16 Information Security and

1.16.1. Additional OIT Security Conditions/Compliance.

Vendor Question #59: Regarding the requirement that the API be blind to data format, source, and structure, will CHSD transform source records into an agreed vendor API schema, or must the awarded vendor accept multiple arbitrary schemas and perform source-specific mapping? Please also identify the expected protocols, payload formats, authentication method, and batch versus synchronous processing patterns.

CDPHE Answer #59: There will be one (1) agreed-upon schema. The service provider proposer provided the input data format and input data types and lengths the State adheres to. The current expected protocols are SOAP/REST. Expected payload format is XML. Authentication method: SOAP/Rest and both batch and synchronous processing patterns.

Vendor Question #60: Please identify the expected classification of data transmitted to the solution, whether PHI will be processed, which security frameworks listed in Sections

1.16 and 2.11 are applicable, and whether a current SOC 2 Type II, FedRAMP, or StateRAMP authorization is mandatory for award or contract execution.

CDPHE Answer #60: No PHI will be processed. Please refer to the Request for Proposals Section 1.16 Information Security and 1.16.1. Additional OIT Security Conditions/Compliance for requirements specific to this question

Vendor Question #61: Please confirm whether production, test, training, and development must be separately hosted environments or may be logically isolated workspaces within one SaaS tenant, and provide the required uptime percentage, planned-maintenance treatment, service-credit expectations, and acceptance-testing criteria.

CDPHE Answer #61: For purposes of this RFP, the State expects the vendor services at a production endpoint plus one non-production test endpoint that satisfies the production, test, training, and development environment requirement.

The required uptime is 365/7 with advanced notification of a minimum of seven (7) days for planned maintenance. Service-credit expectations are 25 million per year and records validated in CHSD from a previous vendor.

Vendor Question #62: Sections 2.10.1 and 2.9 – Business Requirements: The RFP indicates that validation volumes may range from hundreds to millions of records. Can CDPHE provide estimated annual transaction volumes, anticipated peak batch sizes, and the expected distribution between address validation and demographic validation?

Additionally, should vendors anticipate processing the entire existing CHSD dataset during initial implementation, followed by incremental validation?

CDPHE Answer #62: An average daily call rate on business days is up to 125,000. A typical peak call rate is 4 million, but may reach 8 million in unusual instances. An average of 4 million calls per day is possible during data record drops, but not consistently at this volume due to the cyclical nature of this work. The expected annual total is 25 million records. The API has the capacity to do both per record and in batches. Proposers should not anticipate processing the entire existing CHSD dataset during initial implementation.

Vendor Question #63: Sections 2.5 and 2.10.1 – Statement of Work and Business Requirements: Can CDPHE clarify the division of responsibilities between CDPHE/OIT and the selected contractor for integrating the validation service with CHSD? Specifically, will CDPHE/OIT develop and maintain the components that extract records from the SQL database, invoke the vendor's APIs, and update CHSD with validated results, or is the contractor expected to design, develop, and maintain these integration components?

CDPHE Answer #63: The CDPHE PCO Database Contractor is expected to complete the integration with the CHSD. The State/ CDPHE PCO Database Contractor will maintain the components that extract records, call the vendor's API and update the CHSD with the validated results. This RFP contractor is expected to supply the API to make those calls and provide the validated data as results returned.

Vendor Question #64: Sections 2.6, 2.10.4, and 2.11 – Budget, SLAs, and Security: CDPHE identifies an annual budget of approximately $100,000 and requires 24/7/365 availability, a one-hour RTO, and an hourly RPO. Can CDPHE clarify whether these service-level requirements apply specifically to the vendor-hosted validation service or to the complete CHSD integration workflow? Additionally, is the annual budget intended to cover initial implementation, API transaction fees, licensing, security compliance, and ongoing support?

CDPHE Answer #64: 24/7/365 applies to this service. The State expects the successful Proposer to respond to all requests and return all data. There is no RPO requirement since there is no expectation by the State, nor does the State want the successful Proposer to retain ANY data. The expectation under this RFP is that the Proposer provides a service for data validation and normalization, not data retention from the service provider. The budget is intended to cover all costs.

Vendor Question #65: Demographic data sources Question: Will the State provide or arrange access to all reference data sources for demographic validation, or should Proposers expect to supply their own?

CDPHE Answer #65: Proposers should expect to supply their own reference data sources for demographic validation.

Vendor Question #66: Question: Will the State provide (a) current CHSD record counts for clinicians and health care sites, (b) estimated annual records to be validated, (c) expected peak daily volume, and (d) whether an initial full-database validation is expected before ongoing updates.

CDPHE Answer #66: The State will not request that the successful Proposal conduct an initial full-database validation of the CHSD prior to ongoing updates performed under this RFP. An average daily call rate on business days is up to 125,000. A typical peak call rate is 4 million, but may reach 8 million in unusual instances. An average of 4 million calls per day is possible during data record drops, but not consistently at this volume due to the cyclical nature of this work. The expected annual total is 25 million records.

Vendor Question #67: How many users are expected, in what roles, and what tasks will they perform (for example, usage monitoring, reporting, or reviewing and editing records)? Will members of the public access the solution? The RFP describes user interface features, while Exhibit B describes only an API.

CDPHE Answer #67: For purposes of this RFP, a multi-threaded environment able to handle multiple API calls simultaneously. Only one user needs to monitor usage and calls and reviewer errors. Members of the public will not access the solution.

Vendor Question #68: Solution Approach / COTS-SaaS – RFP §§2.1–2.3; pp. 12–13 Does CDPHE prefer or require an existing commercial off-the-shelf (COTS) or SaaS data-validation product, or will a solution that combines a qualified third-party validation service with a contractor-managed API/integration layer be acceptable, provided all functional, security, uptime, and reporting requirements are met?

CDPHE Answer #68: CDPHE prefers an existing commercial off-the-shelf (COTS) or SaaS data-validation product with a track record of providing service for a minimum of three years.

Vendor Question #69: CASS Certification – RFP §2.3; p. 12; Exhibit B, General Standards For the required CASS-certified address standardization and correction capability, must the prime contractor itself hold or own the CASS-certified product, or may the requirement be met through a named subcontractor/API provider? What evidence of current certification and API coverage should be included with the proposal?

CDPHE Answer #69: The prime contractor and any subcontractors performing work under this RFP are required to hold CASS certification. Proposers should provide evidence of current certification and API coverage currently in place.

Vendor Question #70: Address Validation / Geocoding – RFP §2.5; p. 13; Exhibit B, Work Plan Could CDPHE clarify the expected validation behavior for each address element, including ZIP+4, unit/suite, county, census tract/block, rooftop geocoding, and latitude/longitude? In particular, is six-digit rooftop-geocoding precision the minimum acceptance threshold, with nine-digit precision treated as preferred where available?

CDPHE Answer #70: 6 digit is required and 9 digit is preferred.

Vendor Question #71: Healthcare / Public Health Experience – RFP §2.4; p. 12. For the requirement to demonstrate at least three similar projects completed within the past five years, must those projects involve healthcare or public-health data validation specifically, or will comparable API-based address/demographic validation and data-quality engagements in other sectors be considered? Is healthcare-domain experience mandatory, preferred, or an evaluation advantage?

CDPHE Answer #71: There is no advantage to healthcare domain experience. Comparable API-based address/demographic validation and data-quality engagements in other sectors is acceptable.

Vendor Question #72: API / CHSD Integration – RFP §§2.1–2.2; p. 12; Exhibit B. Could CDPHE or the PCO Database Contractor provide the current CHSD API specifications, data schemas, authentication requirements, endpoint documentation, rate limits, error codes, and integration test environment? Please also clarify the respective responsibilities of CDPHE, the CHSD/PCO Database Contractor, and the selected vendor for interface changes and integration testing.

CDPHE Answer #72: The State cannot share the current CHSD API specifications, data schemas, authentication requirements, endpoint documentation, rate limits, error codes, and integration test environment. The service provider Proposer will share the template that the State will ensure is used for submitted data. CDPHE and the PCO Database Contractor will be responsible for integration and testing of this service.

Vendor Question #73: Validation Transaction Pattern / Performance – Exhibit B, Work Plan Are validations expected to occur synchronously for individual records, through batch processing, or through both patterns? Please provide expected response-time, throughput, concurrency, and peak-load requirements, if established, so the proposed architecture and service capacity can be sized appropriately.

CDPHE Answer #73: Both; validations are expected to occur synchronously for individual records or through batch processing. The expected response time is subsecond. The average records per day is up to 4 million. Peak records are one-half million per hour. The expected annual total is 25 million records. The service provider Proposer will share the template that the State will ensure is used for submitted data.

Vendor Question #74: API Call Volumes and Pricing – Budget Template; RFP §2.6 Could CDPHE provide estimated monthly and annual call volumes separately for address validation and demographic validation, including expected growth? For pricing per 10,000 calls, how should unsuccessful, duplicate, retried, partial-result, and multi-field validation calls be counted?

CDPHE Answer #74: The average records per day is up to 4 million. Peak records are one-half million per hour. The expected annual total is 25 million records.

Vendor Question #75: Usage Monitoring and Reporting – Exhibit B, General Standards The work plan requires API access to a usage system for monthly call monitoring and reporting of accurate validations. Could CDPHE define the required usage-report fields, reporting format, retention period, access roles, and whether the State requires a dashboard, downloadable report, or API-only access?

CDPHE Answer #75: For purposes of this RFP, a user-facing interface for testing and validation and monitoring of usage with standard web service architecture for integration. There is no integration with the State’s identity provider. The service provider proposer will share the template on which the State will ensure data is submitted.

Vendor Question #76: Accuracy / No-Match Handling – Exhibit B, Expected Results / Measurement What acceptance criteria or target accuracy levels apply to each address and demographic field? How should the service handle conflicting, stale, unavailable, or unverifiable data, and should responses distinguish between validated, corrected, no-match, and unable-to-verify outcomes rather than overwriting source values?

CDPHE Answer #76: If the data is unmatched and unmapped the State expects an error code to be returned in response, reflecting that error.

Vendor Question #77: Delivery Location / Onshore-Offshore-Nearshore – State IT Contract;

Security Plan Are onshore, offshore, or nearshore personnel permitted to develop, operate, support, or administer the service? Please clarify any requirements concerning personnel location, State data access from outside the United States, subcontractor approval, background checks, and disclosure of delivery locations.

CDPHE Answer #77: The proposer must be physically located in the United States. All personnel performing work awarded under this RFP must be physically located in the United States.

Vendor Question #78: Security / Data Use / AI-ML Restrictions – System Security Plan; Data Use Agreement; State IT Contract,Could CDPHE identify the minimum security controls and evidence expected at proposal time versus post-award, including encryption, access control, audit logging, incident notification, vulnerability management, and data deletion/return? Please also confirm whether the selected provider and its sub processors are subject to the same prohibition on using State data or derived data to train or improve AI/ML models.

CDPHE Answer #78: SOAP/REST are required upon contract execution. Minimum security controls including the SSP will be due during the contract negotiation process. Access control: Only one user needs to monitor usage and calls and reviewer errors. Audit logging There is no expectation that the Contractor stores State records after returning validated results. Logs should only contain transaction metadata.

Incident notification/ vulnerability and data deletion/ return: There is no RPO requirement since there is no expectation by the State, nor does the State want the successful Proposer to retain ANY data. The expectation under this RFP is that the Proposer provides a service for data validation and normalization, not data retention from the service provider.

For purposes of this RFP, the successful proposer and any subcontractors performing work under the awarded contract are subject to prohibitions on the use of State/derived data. The successful proposer and any subcontractors are not allowed to use data from this project to train or improve AI/ML models.

Vendor Question #79: Additional Data Fields / Change Control – Exhibit B, General Standards; Budget Template The scope allows CDPHE to request CASS-certified validation or demographic validation for additional data points. Could CDPHE clarify how such requests will be authorized, prioritized, tested, and priced, and whether additional fields will be handled through pre-agreed unit rates, a change order, or a separate work authorization?

CDPHE Answer #79: Any additional data points will be handled via quote for the additional work. The executed contract will be amended to reflect the additional data points.

Vendor Question #80: Monitoring of External Sources – Exhibit B, General Standards The contractor is required to monitor CDPHE and non-CDPHE websites or electronic documents for relevant changes. Could CDPHE identify the expected source list or source categories, monitoring frequency, required notification/reporting format, and whether the contractor is expected to assess regulatory impact or only identify and report relevant changes?

CDPHE Answer #80: All information related to monitoring will be included in the executed Exhibit B Statement of Work and contract.

Vendor Question #81: Contract Term / Renewal and Annual Cost – RFP §§2.6–2.7; p. 13 For the initial one-year term and potential annual extensions, should pricing remain fixed for the full potential five-year period, or may the vendor propose renewal-year adjustments for third-party API usage, data-source subscriptions, or other pass-through costs? If adjustments are permitted, what limits or approval processes apply?

CDPHE Answer #81: The proposer has the flexibility to propose renewal-year adjustments as they choose provided the price remains under $100,000 per year.