AHCA ITN 012-23.24 - Addendum No.1.pdf

RON DESANTIS

GOVERNOR

JASON WEIDA

SECRETARY

Facebook.com /AHCA Flor ida Twit ter .com/AHCA_FL

2727 Mahan Dr ive • Mai l Stop # 15 Ta l lahassee , FL 32308 AHCA.MyFlor i da .com

June 4, 2024

Prospective Vendor(s):

Subject: Solicitation Number: AHCA ITN 012-23/24, Addendum No. 1

Title: Statewide Health Information Exchange (HIE) Service

This addendum to the subject solicitation provides the Agency’s responses to written questions and modifies ITN requirements and exhibits.

All other terms and conditions of the solicitation remain in effect.

Section 120.57(3)(b), Florida Statutes, and section 28-110.003, Florida Administrative Code, require that a Notice of Protest of the solicitation documents shall be made within seventy-two hours after the posting of the solicitation. Failure to file a protest within the time prescribed in section 120.57(3), Florida Statutes, or failure to post the bond or other security required by law within the time allowed for filing a bond shall constitute a waiver of proceedings under chapter 120, Florida Statutes.

Sincerely, Weston McKain Procurement Officer Bureau of Purchasing and Contract Administration

Enclosures:

Addendum No. 1 Exhibit A-4-V2 Questions and Answers

REMAINDER OF PAGE INTENTIONALLY LEFT BLANK

AHCA ITN 012-23/24

ADDENDUM NO. 1

AHCA ITN 012-23/24, Addendum No. 1, Page 1 of 1

ITEM 1

Attachment A, Exhibit A-4, Submission Requirements and Evaluation Criteria Components (Technical Response), is hereby deleted in its entirety and replaced with Exhibit A-4-V2, Submission Requirements and Evaluation Criteria Components (Technical Response), which is available for respondents to download on the Vendor Information Portal (VIP).

All references in the ITN to Exhibit A-4 shall hereafter refer to Exhibit A-4-V2.

NOTE: Only Exhibit A-4-V2 will be accepted by the Agency. Respondents that submit the incorrect version of this exhibit with their response shall be deemed non-responsive.

https://vendor.myfloridamarketplace.com/search/bids/detail/8969

EXHIBIT A-4-V2

SUBMISSION REQUIREMENTS AND EVALUATION CRITERIA

COMPONENTS (TECHNICAL RESPONSE)

AHCA ITN 012-23/24, Attachment A, Exhibit A-4-V2, Page 1 of 16

Table of Contents

INSTRUCTIONS TO RESPONDENTS FOR COMPLETING EXHIBIT A-4-V2

CATEGORY 1: GENERAL DOCUMENTATION

SRC# 1 – EXECUTIVE SUMMARY

CATEGORY 2: ORGANIZATIONAL STRUCTURE AND INFORMATION TECHNOLOGY

REQUIREMENTS

SRC# 2: ORGANIZATIONAL STRUCTURE AND HISTORY

CATEGORY 3: RESPONDENT QUALIFICATIONS

SRC# 3: VENDOR STAFFING

SRC# 4: PAST AND CURRENT HEALTH INFORMATION EXCHANGE ACTIVITY

EXPERIENCE

SRC# 5: SANCTIONS

CATEGORY 4: IMPLEMENTATION PLAN AND ACTIVITIES

SRC# 6: PROJECT MANAGEMENT AND SERVICE DELIVERY APPROACH

SRC# 7: RELATED SERVICES AND ENHANCEMENTS

CATEGORY 5: SYSTEMS SECURITY AND DISASTER RECOVERY

SRC# 8: HEALTH INFORMATION EXCHANGE (HIE) SYSTEMS SECURITY

SRC# 9: SECURITY RATING SCORE REQUIREMENTS

SRC# 10: DISASTER RECOVERY REQUIREMENTS

AHCA ITN 012-23/24, Attachment A, Exhibit A-4-V2, Page 2 of 16

INSTRUCTIONS TO RESPONDENTS FOR COMPLETING EXHIBIT A-4-V2

All Respondents to this solicitation shall utilize Exhibit A-4-V2, Submission Requirements and Evaluation Criteria Components (Technical Response), for submission of its response and shall adhere to the instructions below for each Submission Requirement Component (SRC).

Respondents shall not include website links, embedded links and/or cross references between SRCs.

Each SRC contains form fields. Population of the form fields with text will allow the form field to expand and cross pages. There is no character limit.

Attachments are acceptable for any SRC but must be referenced in the form field for the respective SRC and located behind each respective SRC response. Respondents shall name and label attachments to refer to respective SRCs by SRC identifier number.

Note: In addition to the complete, electronic PDF copy of this Exhibit, the Respondent should submit its response to each SRC in a separate electronic folder that is labeled with the SRC number. The electronic folder for each SRC response should contain the response to the SRC along with all attachments applicable to the SRC.

Agency evaluators will be instructed to evaluate the responses based on the narrative contained in the SRC form fields and the associated attachment(s), if applicable.

Each response will be independently evaluated and awarded points based on the criteria and points scale using the Standard Evaluation Criteria Scale below unless otherwise identified in each SRC contained within Exhibit A-4-V2.

The SRCs in Exhibit A-4-V2 may not be retyped and/or modified and must be submitted in the original format.

Failure to submit, Exhibit A-4-V2, may result in the rejection of response.

STANDARD EVALUATION CRITERIA SCALE

Point Score Evaluation

0 The component was not addressed anywhere in the response submission.

1 The component is unsatisfactory. It contained significant deficiencies and omissions and lacked meaningful detail.

2 The component is poor. It met some of the minimum requirements but did not address all elements requested.

3 The component is adequate. It met the minimum requirements with minimal content and detail.

4 The component is good. It exceeded the minimum requirements and contained good content and detail.

5 The component is excellent. It exceeded the minimum requirements and contained exceptional content and detail.

AHCA ITN 012-23/24, Attachment A, Exhibit A-4-V2, Page 3 of 16

Respondent Name:

CATEGORY 1: GENERAL DOCUMENTATION

SRC# 1 – EXECUTIVE SUMMARY

The Respondent shall include an Executive Summary, which demonstrates its overall understanding of the services described in this ITN and describes the prominent features of its Technical Response.

Response:

Score: No points will be awarded for the Executive Summary.

AHCA ITN 012-23/24, Attachment A, Exhibit A-4-V2, Page 4 of 16

CATEGORY 2: ORGANIZATIONAL STRUCTURE AND INFORMATION

TECHNOLOGY REQUIREMENTS

SRC# 2: ORGANIZATIONAL STRUCTURE AND HISTORY

The Respondent shall demonstrate its capability to provide the services specified in this ITN by describing its organizational structure, history, and what uniquely qualifies the Respondent for this project. For responses including the use of proposed subcontractors, provide a complete list of all proposed subcontractors with the same descriptions of organizational structure and history. At a minimum the description shall include:

1. The Respondent’s, and its proposed subcontractor’s, organizational structure, ownership, affiliations, and location(s).

2. The Respondent’s, and its proposed subcontractor’s, organizational chart and a depiction of where the services specified in this ITN fall within the organizational structure.

3. Background information on the Respondent’s organization, and on its proposed subcontractor’s organization(s), the size, and resources to include:

a. Name of Respondent and any subcontractor(s)

b. Date established

c. Ownership (public company, partnership, subsidiary, etc.)

Note: If the organization is owned or controlled by a parent company, the name, main office address, and parent company’s tax identification number should be provided in the response.

d. Organization’s Federal Employer's Identification Number (FEIN) and Florida

Corporate Charter Number

e. Organization’s primary line of business

f. Total number of employees

g. Number of personnel engaged in the services specified in this ITN, including the names and brief biography of senior managers and partners assigned to the project, including certifications/accreditations

AHCA ITN 012-23/24, Attachment A, Exhibit A-4-V2, Page 5 of 16

Attachments are limited to the following:

• Organizational chart of the Respondent and its subcontractor(s)

• List of the Respondent’s, and its proposed subcontractor’s, physical location(s)

Evaluation Criteria:

1. The adequacy of the Respondent’s description of its organizational structure, ownership, affiliations, and location(s), as well as the organizational structure, ownership, affiliations, and location(s) of any proposed subcontractors.

2. The adequacy of the Respondent’s organizational chart, including where the services described in this ITN fall within the organizational structure, as well as the organizational chart of any proposed subcontractor(s), including where the services described in this ITN fall within the organizational structure.

3. The adequacy of the Respondent’s description of the organization’s background, size, and resources, as well as the description of the background, size, and resources of any proposed subcontractors.

Score: This Section is worth a maximum of 15 raw points with each of the above components being worth a maximum of 5 points each.

AHCA ITN 012-23/24, Attachment A, Exhibit A-4-V2, Page 6 of 16

CATEGORY 3: RESPONDENT QUALIFICATIONS

SRC# 3: VENDOR STAFFING

The Respondent shall identify its proposed team, including key staff members, and describe how its team will implement and support the services specified in Attachment B, Scope of Services.

Key staff, at a minimum, shall include the positions described in Attachment B, Scope of Services, Section II., Manner of Service(s) Provisions, Sub-section B, Services Provided by the Vendor, Item 12:

1. Project Director – Responsible for coordinating all activities between the Agency and the

Vendor, managing the Florida HIE project at the strategic level, managing resources, and overseeing finances to ensure that the project progresses on time and cost effectively.

2. Technical and Operations Director – Responsible for the technical operations of the services of the Florida HIE.

3. Marketing and Outreach Manager – Responsible for deployment of the Marketing and

Outreach Strategy outlined in the Project Management Plan, Florida HIE business development activities, research and development of marketing opportunities and plans, and implementation of those plans.

The Respondent shall describe the qualifications of key staff members and include their resumes, demonstrating applicable education and experience to provide the services specified in this ITN.

The Respondent shall provide a detailed description of proposed staff, including proposed subcontractor’s staff, by type/credentials, including the number (total and full-time equivalent), qualifications, locations, and project functions of staff.

1. The adequacy of the qualifications of the proposed team, key staff, and subcontractor(s).

Score: This Section is worth a maximum of 5 raw points.

AHCA ITN 012-23/24, Attachment A, Exhibit A-4-V2, Page 7 of 16

SRC# 4: PAST AND CURRENT HEALTH INFORMATION EXCHANGE

ACTIVITY EXPERIENCE

The Respondent shall demonstrate its capability to provide the services in Attachment B, Scope of Services, by describing its relevant experience with health information exchange activities. For responses that include a subcontractor(s), the same description of experience shall be provided.

1. The Respondent shall submit a list of current and previous contracts for which it is/was the lead Vendor on any projects that are similar in size, scope, and complexity as the services specified in this ITN.

For each identified contract, the following information shall be provided:

• The name and address of the client

• The name of the Project

• The time period of the Project

• A brief narrative describing the role of the Respondent and scope of the work performed, including services provided

• The scheduled and actual completion dates for development and implementation.

The description shall include any barriers encountered that hindered implementation, as applicable and the Respondent’s resolution for overcoming them

• Significant accomplishments and achievements

• The use of any subcontractor(s), their scope of work, and the percentage of the work completed by subcontractors

2. A detailed description of the Respondent’s experience working with creating and maintaining health information exchange technologies.

3. A detailed description of the Respondent’s experience handling health care data and following the Health Information Portability and Accountability Act (HIPAA).

4. A detailed description of the Respondent’s experience working with Government entities related to health information exchange activities.

1. The adequacy of the Respondent’s capability to provide services based on evidenced experience.

AHCA ITN 012-23/24, Attachment A, Exhibit A-4-V2, Page 8 of 16

SRC# 5: SANCTIONS

The Respondent shall list and describe any sanctions levied against the Respondent, its affiliates, its subsidiaries, its parent company, the affiliates and subsidiaries of its parent company, its affiliate’s subsidiaries, and subcontractors (handling subcontracts related to consultant services when the subcontracts are for $250,000.00 or more annually), within the five (5) years preceding the date of its response to this ITN. Sanctions shall include those imposed by a state or federal entity in relation to a contract under which the Respondent provided health care system implementation and operations services or government services contracts in excess of one million dollars ($1,000,000.00). Sanctions shall include financial consequences, damages, liquidated damages, or other amounts paid by the Respondent in a settlement of a contract dispute.

Information requested for each sanction shall be provided by the Respondent for administrative and non-administrative sanctions. An administrative sanction means the issue pertains to timeliness or the use of an incorrect format (i.e., report, deliverable, or another required item submitted late or submitted in the wrong format). A non-administrative sanction means the issue pertains to performance in accordance with the contract scope of services (i.e., incomplete, or inaccurate deliverable or services).

1. The extent to which sanctions were due to issues with performance (non-administrative) in accordance with the contract scope of services, versus administrative issues.

2. The severity of the sanction(s) from minor (dollar amounts less than $10,000.00 or resolution time less than 90 calendar days) to significant ((dollar amounts above $10,000.00 or resolution time longer than 90 calendar days or numerous sanctions (more than one sanction among two or more contracts)).

Score: This Section is worth a maximum of 10 raw points with each the above component being worth a maximum of 5 points.

For Item 1:

a. 5 points if no sanctions.

b. 4 points if sanction(s) were related only to administrative issues.

c. 3 points if non-administrative sanction(s) were all minor and there were fewer than four (4) incidents.

d. 2 points if non-administrative sanctions were all minor but four (4) or more incidents.

e. 1 point if any significant administrative sanction.

AHCA ITN 012-23/24, Attachment A, Exhibit A-4-V2, Page 9 of 16

f. 0 points if any significant non-administrative sanction.

For Item 2:

a. 5 points if no sanctions.

b. 4 points if sanction(s) were minor and there were fewer than four (4) incidents.

c. 3 points if sanctions were all minor but four (4) or more incidents.

d. 2 points if up to two (2) significant sanction(s); or more than two (2) contracts with multiple sanctions.

e. 1 point if more than two (2) significant sanctions but fewer than five (5); or more than two (2) but fewer than five (5) contracts with multiple sanctions.

f. 0 points if performance falls below the above limits.

AHCA ITN 012-23/24, Attachment A, Exhibit A-4-V2, Page 10 of 16

CATEGORY 4: IMPLEMENTATION PLAN AND ACTIVITIES

SRC# 6: PROJECT MANAGEMENT AND SERVICE DELIVERY

APPROACH

The Respondent shall provide its project management and service delivery approach and explain how it reflects industry best practices. The Respondent shall demonstrate its capabilities in working with a variety of stakeholders described in Attachment B, Scope of Services.

The Respondent shall describe its proposed approach to PD-1: Project Management Plan for the services described in Attachment B, Scope of Services, Section II., Manner of Service(s)

Provision, Sub-section B, Services Provided by the Vendor. As part of the proposed approach, the Respondent must include a draft implementation plan inclusive of the following:

1. Necessary steps to achieve activities.

2. Timeline for completing services and requirements.

3. Milestones for exchange activities to be completed.

The proposed project approach and implementation plan must demonstrate a thorough understanding of the scope of work and the capability to successfully deliver the services in this

ITN.

The Respondent shall demonstrate the following:

1. Approach to following project management best practices, including but not limited to:

• Scope Management

• Requirements Management

• Schedule Management

• Resource Management

• Stakeholder Management

• Communications Management

• Cost Management

• Quality Management

• Risk and Issue Management

• Change Management

2. Knowledge The Office of the National Coordinator for Health Information Technology

(ONC) standards (such as the Trusted Exchange Framework and Common Agreement

[TEFCA]).

AHCA ITN 012-23/24, Attachment A, Exhibit A-4-V2, Page 11 of 16

3. Experience implementing the Project Management Life Cycle for health information exchange solutions.

4. Experience with, and approach to, successful delivery of services and solutions involving multiple vendors, government agencies, and health care entities.

5. Ability to implement and provide services and solutions to support the Agency’s health information exchange initiatives outlined in Attachment B, Scope of Services, Section I., Service(s) to be Provided, Sub-section B., Overview/Purpose.

1. The adequacy of the Respondent’s proposed approach to project management and service delivery, and its alignment with ONC standards, including demonstrated understanding and approach to the Project Management Life Cycle for health information exchange solutions.

2. The adequacy of the Respondent’s draft implementation plan to demonstrate successful management and capability to deliver the services.

3. The adequacy of the Respondent’s experience and demonstrated ability to successfully deliver services and solutions involving multiple vendors, government agencies, and health care entities.

Score: This Section is worth a maximum of 15 raw points with each of the above components being worth a maximum of 5 points.

AHCA ITN 012-23/24, Attachment A, Exhibit A-4-V2, Page 12 of 16

SRC# 7: RELATED SERVICES AND ENHANCEMENTS

The Respondent shall provide a description of how its proposed implementation plan (from SRC# 6 - Project Management and Service Delivery Approach) is adaptable to rapidly changing health information technology, technical standards, and market conditions at the state and national levels.

The Respondent shall describe its process for recommending future innovations and enhancements. The proposed process shall detail how it plans to handle need identification, stakeholder input, governance, and implementation of potential innovations and/or enhancements.

1. The adequacy of the Respondent’s capability to provide adaptability and innovative solutions to a changing HIE landscape and market conditions.

AHCA ITN 012-23/24, Attachment A, Exhibit A-4-V2, Page 13 of 16

CATEGORY 5: SYSTEMS SECURITY AND DISASTER RECOVERY

SRC# 8: HEALTH INFORMATION EXCHANGE (HIE) SYSTEMS

SECURITY

The Respondent shall describe its protocols for ensuring system security and confidentiality of patient identifiable data as noted in Attachment B, Scope of Services Section VIII., System Functionality.

The Respondent’s response for this SRC may include attachments, as prescribed herein.

Attachments may include, but are not limited to, protocol, security certifications, and a copy of the most recent security audit report.

The Respondent shall describe its knowledge and experience related to current national standards and certifications for health information exchange, including but not limited to HITRUST certification, as described in Attachment B, Scope of Services, Section II, Manner of Service(s) Provision, Sub-section B, Services Provided by the Vendor, Item 20.

1. The adequacy of the Respondent’s security protocols based on documentation.

2. The adequacy of the Respondent’s knowledge and experience related to current national standards and certifications for health information exchange.

Score: This Section is worth a maximum of 10 raw points with each of the above components being worth a maximum of 5 points.

AHCA ITN 012-23/24, Attachment A, Exhibit A-4-V2, Page 14 of 16

SRC# 9: SECURITY RATING SCORE REQUIREMENTS

In accordance with Attachment B, Scope or Services, Section IX., Information Technology, Sub-section T., the Agency shall conduct an initial IT security risk score scan on the Respondent, as well as periodic or continuous security monitoring through an information security rating service, at the Agency's expense, to enable the Agency to effectively measure and mitigate the successful respondent’s security risks. The Respondent will work with the Agency’s Security Rating Score Provider to define the relevant Respondent assets providing Agency services.

1. The adequacy of the Respondent’s security rating score by determining whether the

Respondent has received:

a. A score in the top 90-100% of submitters;

b. A score in the top 80-89% of submitters;

c. A score in the top 70-79% of submitters;

d. A score in the top 60-69% of submitters;

e. A score in the top 50-59% of submitters; or

f. A score in the lower 0-49% of submitters.

Score: This Section is worth a maximum of 5 raw points as outlined below:

a. 5 points for a score in the top 90-100% of submitters;

b. 4 points for a score in the top 80-89% of submitters;

c. 3 points for a score in the top 70-79% of submitters;

d. 2 points for a score in the top 60-69% of submitters;

e. 1 point for a score in the top 50-59% of submitters; or

f. 0 points for a score in the lower 0-49% of submitters.

AHCA ITN 012-23/24, Attachment A, Exhibit A-4-V2, Page 15 of 16

SRC# 10: DISASTER RECOVERY REQUIREMENTS

The Respondent shall demonstrate its capability and approach to meet the requirements described in Attachment B, Scope of Services, Section X., Disaster Recovery.

1. The adequacy of the Respondent’s proposed approach and capability to develop and maintain a disaster recovery plan for restoring the application of software and current master files and for hardware backup in the event the production systems are disabled or destroyed.

2. The adequacy of the Respondent’s proposed approach and capability to ensure the disaster recovery plan limits service interruption to a period of twenty-four (24) clock hours and ensures compliance with all requirements under the resulting Contract.

3. The adequacy of the Respondent’s proposed approach and capability to ensure the records backup standards and a comprehensive disaster recovery plan shall be developed and maintained by the Vendor for the entire period of the resulting Contract and submitted for review annually by the anniversary date of the resulting Contract.

4. The adequacy of the Respondent’s proposed approach and capability to ensure it maintains a disaster recovery plan for restoring day-to-day operations including alternative locations for the Vendor to conduct the requirements of the resulting Contract.

5. The adequacy of the Respondent’s proposed approach and capability to ensure it maintains database backups in a manner that shall eliminate disruption of service or loss of data due to system or program failures or destruction.

6. The adequacy of the Respondent’s proposed approach and capability to ensure the disaster recovery plan is finalized no later than thirty (30) calendar days prior to the resulting Contract effective date.

7. The adequacy of the Respondent’s proposed approach and capability to ensure it amends or updates its disaster recovery plan in accordance with the best interests of the Agency and at no additional cost to the Agency.

8. The adequacy of the Respondent’s proposed approach and capability to ensure it makes all aspects of the disaster recovery plan available to the Agency at all times.

9. The adequacy of the Respondent’s proposed approach and capability to ensure it conducts an annual Disaster Recovery Plan test and submits the results for review to the Agency.

AHCA ITN 012-23/24, Attachment A, Exhibit A-4-V2, Page 16 of 16

Score: This Section is worth a maximum of 45 raw points with each of the above components being worth a maximum of 5 points each.

EXHIBIT A-1

QUESTIONS AND ANSWERS

VENDOR NAME

ATTACHMENT

IDENTIFIER

SECTION

IDENTIFIER

SUB-SECTION

REFERENCE

ITEM

REFERENCE

ATTACHMENT

EXHIBIT

PAGE

NUMBER QUESTION ANSWER

1 Verato B: Scope of

Services

II. Manner of

Service(s)

Provision

B: Services by the Vendor

1. The vendor shall provide

Florida HIE services, including:

Attachment B

Scope of

Services

How many unique identities will be managed in the MPI? Vendor defines identities as equal to a person, an identity can have multiple linked source records under it. Please also provide an estimate on year over year growth to the unique identity count.

As of February 2024, the MPI contained 18,488,958 unique IDs.

Growth rate based on unique identities is not available.

2 Verato B: Scope of

Services

XIV. Definitions and Acronyms A Definitions Interoperablity

Attachment B

Scope of

Services

Interoperability for the MPI, is ther integration to systems at the government? If yes, can you provide details on those integrations prefered hosting/cloud.

No.

3 Nagarro Inc Attachment B Scope of services

Manner of service(s) provision

Scope requirements and assumptions

NA 2 of 33

As per the information available in Florida HIE website, the DNS, Direct messaging & Patient Record Exchange are available in the current HIE solution. Is the intention of this RFP is to replace the current HIE platform & its services or implement the specified requirements as an enhancement to the current set of services?

The current infrastructure was provided as an example, but the

Agency will consider all potential solutions.

4 Nagarro Inc Attachment B Scope of services

Service(s) to be provided Overview/purpose NA 2 of 33

As per the information available in Florida HIE website, nearly 770 data sources are already integrated - Will these integration points remain as-is or the vendor is expected to initiate contracts with participants to design mechanisms to collect, aggregate, process (deduplication, standardization, MPI), encrypt and store the patient data. Please confirm

The awarded vendor will be responsible for contracting with participants and providing solutions to allow sharing of data.

5 Nagarro Inc Attachment B Scope of services

Service(s) to be provided Overview/purpose NA 2 of 33

Could you please help us understand the key technology, functional & operational challenges that are faced in the current HIE platform?

Rapidly changing health information technology, technical standards, and market conditions at the state and national levels.

6 Nagarro Inc Attachment B Scope of services

Service(s) to be provided Overview/purpose NA 2 of 33

Is there any scope for data migration involved as a part of this engagement? If yes, kindly share the volume, sources & type of data

(files/DB etc.) that needs to be migrated

This can be addressed with respondents invited to negotiations.

7 Nagarro Inc Attachment B Scope of services

Manner of service(s) provision

Scope requirements and assumptions

NA 15 of 33

In which other formats ADT data are provided apart from EHR integration & user interface?

CSV files and Direct messaging.

8 Nagarro Inc Attachment B Scope of services

Manner of service(s) provision

Reporting NA 18 of 33

Kindly share the list/count of adhoc reports that may be requested along with the format of the report

Please refer to Attachment B, Scope of Services, Section II., Manner of Service(s) Provision, Sub-section E., Reporting.

9 Nagarro Inc Attachment B Scope of services

Manner of service(s) provision

Reporting NA 18 of 33

Does the agency have any licensed tool/software that needs to be incorporated in the solution (PowerBI, Oracle etc.)?

No, not at this time.

10 Nagarro Inc Attachment B Scope of services

Manner of service(s) provision

Service(s) to be provided NA 10 of 33

We undertand that the Agency requires the vendor to support its

Emergency Patient Look-Up System (E-PLUS) - kindly share more details about the system, techstack & the type of support that the

Agency requires. Also, kindly provide the list of other systems that may come under the scope of the vendor support

The awarded vendor must share Admit, Discharge, Transfer (ADT) data with the E-PLUS vendor.

11 Nagarro Inc Attachment B Scope of services

Information technology

Development requirements NA 28 of 33

What is the anticipated peak load usage of each service? The Agency does not have this information.

12 Nagarro Inc Attachment B Scope of services

Manner of service(s) provision

Service(s) to be provided NA 4 of 33

How many months/years should the data be archived/retained in the

HIE platform?

The data is only temporarily held for operational purposes, but the

Agency will consider all potential solutions.

13 Nagarro Inc Attachment B Scope of services

Manner of service(s) provision

Scope requirements and assumptions

NA 16 of 33

Kindly share the Agency participants to which the vendor is supposed to deliver data for public health initiatives

Please refer to Attachment B, Scope of Services, Section B., Services Provided by the Vendor.

14 Nagarro Inc Attachment B Scope of services

Manner of service(s) provision

Scope requirements and assumptions

NA 16 of 33

How are the data for public health initiatives delivered to the various state Agency participants?

Data provided to state agencies is done by csv file through a SFTP and through a user interface.

15 Nagarro Inc Attachment B Scope of services

Information technology

Development requirements NA 28 of 33

We understand that the Agency requires the vendor to provide IT help desk support teams. Kindly share the support model that is required for the L1/L2 support team? (24*7, 8*5 etc.)

Normal business hours: Monday - Friday, 8:00am -5:00pm ET.

16 Accenture Can AHCA provide the existing Enterprise Architecture for the Health

Information Exchange?

No, the current vendor claims the current Enterprise Architecture is proprietary.

17 Accenture Does AHCA hold the licenses for the current technology or is it provided as a managed service?

It is provided as a managed service.

18 Accenture Can AHCA provide the historical subscription data over the past 3 years?

Yes, this can be shared with respondents invited to negotiations.

19 Centralis Health Attachment B Table 2 15

To meet the states transition timeline the new vendor will be heavily reliant on hospital, skilled nursing and behavioral health response time to complete integrations. How will the state assist new vendor during the transition process to ensure timely transition of hospital, skilled nursing and behavioral health interface redirects and contracting?

The Agency provides health information exchange outreach to

Florida HIE participants and interested parties.

20 Centralis Health Attachment B Table 2 15 Can Florida provide a total number of interfaces broken down by

EMR/EHR type?

No, the EMR/EHR systems are frequently changing based on provider needs.

21 Centralis Health Attachment B Table 2 15

Can Florida provide a total number of ENS subscribers and how they are currently receiving notifications? (Florida HIE Services SFTP, Subscriber SFTP, PROMPT, Direct Messaging)

As of April 2024, the total number of ENS subscribers was approximately 300. They receive notifications in all of the ways noted, but the Agency is unable to provide a breakout of each one.

AHCA ITN 012-23/24 Attachment A, Exhibit A-1, Page 1 of 6

VENDOR NAME

ATTACHMENT

IDENTIFIER

SECTION

IDENTIFIER

SUB-SECTION

REFERENCE

ITEM

REFERENCE

ATTACHMENT

EXHIBIT

PAGE

NUMBER QUESTION ANSWER

22 Centralis Health General

Can Florida provide a break down of organization types subscribed to

ENS (hospital, provider, ACO, payer, etc.)

As of April 2024, there were the following organization types:

provider, accountable care organization, hospital, federally qualified health center, hospice, skilled nursing facility, behavioral health, home health, state agency, and health plan.

23 Centralis Health General Can Florida provide the average number of support ticket sumitted monthly?

No, the Agency is unable to provide this information.

24 Centralis Health General Can Florida provide the number of active users leveraging PROMPT? As of November 2022, 220 subscribers had just over 2500

PROMPT accounts.

25 Centralis Health General

Can Florida provide a break down of Patient Panel sending methods by type? (Florida HIE Services SFTP, Subscriber SFTP, Direct messaging, Other Methods)

Florida HIE Service SFTP, Subscriber or third-party SFTP, Direct messaging, automated panel based off patient discharge.

26 Centralis Health Attachment B Scope of

Services

II.B #18 96

System changes are required to be from 10:00 PM - 6:00 AM, preceded by a notice of at least 12 hours. In the event of an emergency - for example, Microsoft announces an urgent security exploit has been found and releases a fix - can this 12 hour notice ever be waived?

Any Vendor response to unforeseen events must be coordinated with the Agency.

27 Centralis Health General Can Florida provide average daily/monthly received message volume? The Agency does not have this information.

28 Centralis Health General Can Florida provide the average daily/monthly notification volume sent? In April 2024, the notification volume was over 10.9 million.

29 Centralis Health General How many VPN's, Mutual TLS (certificate based) or JWT authentication connections are there by type?

The Agency does not have this information.

30 ELLKAY Attachment A Response

Preparation

Mandatory

Response

Content

2C A 8

We are very interested in responding to the State of Florida's RFP [RFP

Number] and believe that our proposal can deliver significant value.

However, we seek clarification regarding the requirement for an Original

Proposal Guarantee of $1,745,000.00.

Given the substantial amount, we would like to explore if there are alternative methods or a reduced guarantee that would still demonstrate our firm commitment to fulfilling the contractual obligations upon acceptance. We are prepared to provide other forms of financial assurance or performance bonds to support our proposal.

The Agency will not accept an alternative to an Original Proposal

Guarantee.

31 ELLKAY Attachment B

Manner of

Service(s)

Provision

Services

Provided by the

Vendor

1C B 90 or 4

For the Automatic Retrieval of Clinical Health e-Records (ARCHER), is it expected for comprehensive clinical records to be after patient discharge or simply an encounter based clinical patient record.

The Agency is open to all responses and potential solutions.

32 Velatura HIE Corporation Attachment A A.1 Instructions

13. Type and

Amount of

Contract

Contemplated

13.a 6

What policies or mandates exist to promote adoption of FL HIE

Services?

Section 408.051, Florida Statutes (2024), requires hospitals with certified, electronic health records to make available admit, discharge, and transfer data to the Agency's Florida Health

Information Exchange program for the purpose of supporting public health data registries and patient care coordination.

The Agency contracts with Medicaid Managed Care Plans - FP058

(Florida Community Care), FP059 (Humana Medical Plan), FP060

(Sunshine State Health Plan), FP067 (Aetna Better Health of

Florida), FP068 (Simply Healthcare Plans), FP069

(UnitedHealthcare of Florida), FP070 (AmeriHealth Caritas Florida), FP071 (South Florida Community Care Network, LLC dba

Community Care Plan), FP072 (Molina Healthcare of Florida). The contracts include the following language in ATTACHMENT II;

EXHIBIT II-A – MANAGED MEDICAL ASSISTANCE (MMA)

PROGRAM; Section VI. Coverage and Authorization of Services; A.

Required MMA Benefits; 1. Specific MMA Services to be Provided;

(9) Hospital Services; (l) The Managed Care Plan shall enroll and participate in the Florida Health Information Exchange Event

Notification Service as directed by the Agency.

These contracts can be viewed in the Florida Accountability

Contract Tracking System (FACTS), which can be accessed at the following website:

https://facts.fldfs.com/Search/ContractSearch.aspx.

33 Velatura HIE Corporation Attachment B

II. Manner of

Service(s)

Provision

B. Services

Provided by the

Vendor

B.2.a 4

Please describe how FL HIE services support Florida Department of

Health syndromic surveillance, public health registries, emergency medical services, and county health department programs today?

The Florida HIE supports the Florida Department of Health by working with various health programs including Emergency Medical

Services, Syndromic Surveillance, Brain & Spinal Cord Injury, and

Stroke Registry by providing encounter data specific to their needs.

34 Velatura HIE Corporation Attachment B

II. Manner of

Service(s)

Provision

B. Services

Provided by the

Vendor

B.2.a 4

Please describe the data flow of a bridge alert? Subscribers send data back to a data source at the time a patient is having an encounter at a specified data source facility.

AHCA ITN 012-23/24 Attachment A, Exhibit A-1, Page 2 of 6

VENDOR NAME

ATTACHMENT

IDENTIFIER

SECTION

IDENTIFIER

SUB-SECTION

REFERENCE

ITEM

REFERENCE

ATTACHMENT

EXHIBIT

PAGE

NUMBER QUESTION ANSWER

35 Velatura HIE Corporation Attachment B

II. Manner of

Service(s)

Provision

B. Services

Provided by the

Vendor

B.1.a 4

Please describe how the ENS integrates with E-PLUS today? Please see answer to Question 10.

36 Velatura HIE Corporation Attachment B

II. Manner of

Service(s)

Provision

B. Services

Provided by the

Vendor

B.1.b 4

Approximately how many IHE transactrions are processed by FL HIE

Services on a monthly basis today?

Over 10.9 million encounter transactions were sent to subscribers during the month of April 2024.

37 Velatura HIE Corporation Attachment B

II. Manner of

Service(s)

Provision

B. Services

Provided by the

Vendor

B.1.c 4

Approximately how many transactrions are processed by ARCHER on a monthly basis today?

In April 2024, 5,303 Continuity of Care Documents (CCDs) were delivered via ARCHER.

38 Velatura HIE Corporation Attachment B

II. Manner of

Service(s)

Provision

B. Services

Provided by the

Vendor

B.2.b 4

Please describe how FL HIE services support Medicaid today? Please see answer to Question 32.

39 Velatura HIE Corporation Attachment B

II. Manner of

Service(s)

Provision

B. Services

Provided by the

Vendor

B.2.b 4

Please describe how FL HIE services support HEIDIS data collection today?

Health plans use ADT data to support collection of HEDIS data.

40 Velatura HIE Corporation Attachment B

II. Manner of

Service(s)

Provision

B. Services

Provided by the

Vendor

B.25 10

Please describe what support services are provided to E-PLUS troday? Please see answer to Question 10.

41 Velatura HIE Corporation Attachment B X. Information

Technology

D. Development

Requirements

Please descibe how FL HIE Services interoperates with the Agency's information technology enterprise today?

Florida HIE Services do not directly interoperate with the Agency's information technology enterprise today.

42 Velatura HIE Corporation Attachment A

B. Response

Preparation and

Content

2. Mandatory

Response

Content c Original

Proposal

Guarantee

Please ellaborate on how FL HIE differentiates between the two bonds that are needed. Our understanding is that the Proposal Guarantee =

$1,745,000.00 and that would be for when the contract is awarded to when the contract is signed. Then the Performance Bond would take effect after the contract is signed and is 4.5% of the resulting contract

($34,900,000 x 4.5% = $1,570,500).

The Proposal Guarantee is different from the Performance Bond.

Please review Attachment A, Section A.1, Instructions, Sub-section

B., Response Preparation and Content, Item 2., Mandatory

Response Content, Sub-item c., Original Proposal Guarantee, and

Attachment A, Section A.1, Instructions, Sub-section D., Response

Evaluation and Contract Award, Item 9., Performance Bond. Also, please see Attachment B, Section VIII., Performance Bond.

43 Velatura HIE Corporation Attachment B

II. Manner of

Service(s)

Provision

B. Services

Provided by the

Vendor

B.3 91-92

How will the FL HIE guarentee that the Vendor will have connections to users of the services on a yearly basis? We would like to ensure that there will be a significat participation.

Please see answer to Question 32.

44 Audacious Inquiry A C 1 b 1) 10 Will AHCA consider permitting DocuSign signatures in place of original signatures on hard copy forms?

Electronic signatures are acceptable.

45 Audacious Inquiry A SRC# 2 A-4 5

In support of the Respondent’s financial stability, is documentation outlining financial information of the Respondent’s parent company that includes an overview of six years of revenue growth, positive cash flow, and the expanding margins of cash flow over that time period sufficient for the Agency as similar documentation if it clearly demonstrates that the Respondent is financially stable?

Please see the modification to this SRC in Addendum No. 1, Item

1.

46 Audacious Inquiry B II G Table 3 19 - 21 Please clarify what is meant by "commercialize" in the liquidated damages section of Attachment B.

The Vendor shall not use PHI for profit in alignment with the Notice of Privacy Practices (NPP).

47 Audacious Inquiry B II B 12b 9

Will AHCA accept the utilization of more than one manager to meet the

40 hours of dedicated on-site Marketing and Outreach Strategy services, business development activities, research and development of marketing opportunities and plans, and implementation of the plans?

Please see Attachment B, Scope of Services, Section II., Manner of

Service(s) Provision, Sub-section B., Services Provided by the

Vendor, Item 12.c., Marketing and Outreach Manager.

48 Audacious Inquiry A A-4 12

Is the reference in SRC# 7 to a "proposed implementation plan (from

SRC#7)" intended to refer instead to SRC# 6: Project Management and

Service Delivery Approach?

Yes. Please see the modification to this SRC in Addendum No. 1, Item 1.

49 CRISP Shared Services

Will you release the names of organizations that submitted questions? All written questions submitted by the deadline outlined in

Attachment A, Instructions and Special Conditions, are included in

Addendum No. 1, along with the name of the submitting organization.

50 CRISP Shared Services Are there page limits or font preferences for the technical response? There are no page limits or font preferences.

51 CRISP Shared Services Is MES certification a requirement of the new vendors technology? No.

52 CRISP Shared Services A Transmittal

Letter FEID Exhibit A-2 1 of 1

Is FEID the same as a FEIN (Federal ID Number)? Yes.

53 CRISP Shared Services A A.1

Instructions A. Overview

7. PUR 1000,

General Contract

Conditions

#33

(pg. 12 of

14) within the hyperlinked document

Is the expectation that the incoming vendor will adhere to all of U.S.’s security procedures found within this document, Item#33: “The

Contractor shall comply fully with all security procedures of the United

States, State of Florida and Customer in performance of the Contract”.

Where can we find the Florida Security rules?

Yes. If awarded, the respondent is obligated to comply with all applicable federal laws and security procedures, Florida statutes, rules, and Agency policies.

54 CRISP Shared Services A

C. Response

Submission

Requirements

b. Hard copies of the

Response

1) Original

Response

Do the original signature requirements mean wet signatures? Wet signatures or electronic signatures are acceptable.

AHCA ITN 012-23/24 Attachment A, Exhibit A-1, Page 3 of 6

VENDOR NAME

ATTACHMENT

IDENTIFIER

SECTION

IDENTIFIER

SUB-SECTION

REFERENCE

ITEM

REFERENCE

ATTACHMENT

EXHIBIT

PAGE

NUMBER QUESTION ANSWER

55 CRISP Shared Services A

C.

Response

Submission

Requirements

c. Electronic Copy of the Response Exhibit A-4 2 of 16

Attachments are acceptable for any SRC but must be referenced in the form field for the respective SRC and located behind each respective

SRC response.

Understood for the reference and form field and understood for the hard copy version regarding placement of attachments but for the electronic versions, should the attachments be included in the form field and on the page following the last page of the SRC text response or should there be a separate Word file that houses attachments per

SRC inserted between the different category responses?

For instructions regarding the electronic PDF, please reference the

Note on Page 2 of Exhibit A-4-V2, which can be found in

Addendum No. 1.

56 CRISP Shared Services A

Category 3:

Respondent

Qualifications

SRC #3:

Vendor Staffing Exhibit A-4 6 of 16

There are three mandatory staff positions listed in the RFP.

What are the timing requirements for having these positions filled?

This can be addressed with respondents invited to negotiations.

57 CRISP Shared Services A Security Rating

Score SRC#9 Exhibit A-4 14 of 16

Some of the tools used for passive scanning for security scoring have high false positive rates.

Is the security risk score scan a tool? If so, what’s the name of the tool?

The tool used is Risk Recon, which has not experienced a high false positive rate with current vendors. The Agency does not require a perfect score to allow for any such concerns, however.

58 CRISP Shared Services A

SRC #10

Disaster

Recovery

Requirements

#2 Evaluation Criteria Exhibit A-4 15 of 16

Is the 24 clock hours for both RTO and RPO? This time to recovery aligns most closely with RTO rather than RPO as they are commonly used. A significantly shorter RPO can be presented depending on vendor capability.

59 CRISP Shared Services A

SRC #10

Disaster

Recovery

Requirements

#5 Evaluation Criteria Exhibit A-4 15 of 16

What would the Agency consider a reasonable time for disruption of service and loss of data?

Criteria 5 is looking for a robust approach "that shall eliminate disruption of service or loss of data due to system or program failures or destruction." This criteria is seeking adequate approaches to eliminate such loss and does not provide a reasonable amount of loss greater than none.

60 CRISP Shared Services A

SRC #10

Disaster

Recovery

Requirements

#7 Evaluation Criteria Exhibit A-4 15 of 16

Can the Agency try to define “best interest” in this statement? If there is a need to make a plan modification to align with mandatory standards or the Agency's statutorily mandated duties, this criteria expects the Respondent's' plans to allow for modification to support the Agency.

61 CRISP Shared Services A

SRC #10

Disaster

Recovery

Requirements

#9 Evaluation Criteria Exhibit A-4 15 of 16

Who is setting the objective of the DR plan test?

What is deemed critical to help build the DR plan and ultimately testing?

This should be included in the Respondent’s proposed approach.

The Agency is seeking the Respondent's approach, but generally expects DR efforts to align with industry best practices.

62 CRISP Shared Services A ENS Pricing

Guide Exhibit A-5 1 of 1

Based on publicly available data, can the Agency confirm the number of current subscribers to the notification services? Public data suggests there are 244 current subscribers in the state.

Please see answer to Question 21.

63 CRISP Shared Services A ENS Pricing

Guide Exhibit A-5 1 of 1

If the public data is accurate at 244 of that figure, how many of those subscriber are paying subscribers?

In April 2024, 213 Invoices were sent for 271 subscribers.

64 CRISP Shared Services A ENS Pricing Exhibit A-5 1 of 1

Are any organizations mandated to connect and use the notification services? i.e. hospitals, payers, etc. If so, does the mandate require the organization to pay for the services?

Please see answer to Question 32.

65 CRISP Shared Services A ENS Pricing

Guide Exhibit A-5 1 of 1

Will all current participant contracts with the current vendor be assigned to the new vendor?

If so, how will ACHA facilitate the transition?

This can be discussed with respondents invited to negotiations.

66 CRISP Shared Services A ENS Pricing

Guide Exhibit A-5 1 of 1

Will current notification service customers be required to sign new contracts with the incoming vendor and continue with payments in alignment with an agreed upon pricing structure?

Please see answer to Question 4.

67 CRISP Shared Services A ENS Pricing

Guide Exhibit A-5 1 of 1

Does AHCA anticipate a gap in service and/or fees while transitioning? This can be discussed with respondents invited to negotiations.

68 CRISP Shared Services A ENS Pricing

Guide Exhibit A-5 1 of 1

How will ACHA help with converting current ENS customers to a new vendor?

Please see answer to Question 19.

69 CRISP Shared Services A ENS Pricing

Guide Exhibit A-5 1 of 1

Are there agreed upon payment terms for all notification subscribers? Yes.

70 CRISP Shared Services A ENS Pricing

Guide Exhibit A-5 1 of 1

How often are payments made to the vendor? Monthly? Quarterly?

Annually?

Please see Attachment B, Scope of Services, Section II., Manner of

Service(s) Provision, Sub-section B., Services Provided by the

Vendor, Item 5.

71 CRISP Shared Services A ENS Pricing

Guide Exhibit A-5 1 of 1

Are payments typically received on time or should the new vendor expect delayed payments?

Yes, payments are typically received on time. Please see answer to

Question 4.

72 CRISP Shared Services A ENS Pricing

Guide Exhibit A-5 1 of 1

Have current subscribers paid for services to the current vendor through a specific timeframe where the new vendor could not bill for services during that timeframe?

This can be addressed with respondents invited to negotiations.

73 CRISP Shared Services A ENS Pricing

Guide Exhibit A-5 1 of 1

Will the current FL HIE vendor be required to transition all data feeds to the new vendor?

If so, what is the anticipated time period for that transition?

This can be addressed with respondents invited to negotiations.

74 CRISP Shared Services A Standard

Contract

D. Terms and

Conditions Exhibit A-7 3-26

Are any of the Terms and Conditions negotiable? No.

AHCA ITN 012-23/24 Attachment A, Exhibit A-1, Page 4 of 6

VENDOR NAME

ATTACHMENT

IDENTIFIER

SECTION

IDENTIFIER

SUB-SECTION

REFERENCE

ITEM

REFERENCE

ATTACHMENT

EXHIBIT

PAGE

NUMBER QUESTION ANSWER

75 CRISP Shared Services A Standard

Contract

G. Inspection of

Records and

Work Performed

6. Exhibit A-7 6 of 26

The terms and conditions state that we must comply with the Florida

Public Records Act.

By entering into any agreement, what if any, documents and information…