AHCA RFQ 015-2526_Addendum No. 3.pdf

RON DESANTIS

GOVERNOR

SHEVAUN L. HARRIS

SECRETARY

Facebook.com /AHCA Flor ida Youtube .com /AHCA Flor i da

X .com/AHCA_ FL

2727 Mahan Dr ive • Mai l Stop #15 Ta l lahassee , FL 32308 AHCA.MyFlor i da .com

August 11, 2026

Prospective Vendor(s):

Subject: Solicitation Number: AHCA RFP 015-25/26, Addendum No. 3

Title: Organ and Tissue Donor Registry and Education Program

This addendum to the subject solicitation makes modifications to the Scope of Services and the Timeline of the RFP.

All other terms and conditions of the solicitation remain in effect.

Section 120.57(3)(b), Florida Statutes, and section 28-110.003, Florida Administrative Code, require that a Notice of Protest of the solicitation documents shall be made within seventy-two hours after the posting of the solicitation. Failure to file a protest within the time prescribed in section 120.57(3), Florida Statutes, or failure to post the bond or other security required by law within the time allowed for filing a bond shall constitute a waiver of proceedings under chapter 120, Florida Statutes.

Sincerely, Ashley Balkcom Procurement Officer Bureau of Purchasing and Contract Administration

Enclosures:

Addendum No. 3

REMAINDER OF PAGE INTENTIONALLY LEFT BLANK

AHCA RFP 015-25/26

ADDENDUM NO. 3

AHCA RFP 015-25/26, Addendum No. 3, Page 1 of 4

Addendum No. 3 is issued to make modifications to the Request for Proposals (RFP). All other terms and conditions of the RFP not modified herein remain in full force and effect.

ITEM 1

AHCA RFP 015-25/26, Attachment B, Scope of Services, Section XII., Information Technology, Sub- Section G. is hereby deleted in its entirety and replaced with the following:

G. Web service and data handling must fully comply with the Driver Privacy Protection Act (DPPA) requirements of 18 United States Code, Section 2721. Additionally, the Vendor must adhere to the DPPA rules that address a memorandum of understanding and security requirements as well as other requirements contained in Rule.

ITEM 2

AHCA RFP 015-25/26, Attachment B, Scope of Services, Section XIII., Disaster Recovery, Sub- Section B., Data Transmission and Security and Sub-Section C., Data Transfer and Security, are hereby deleted in their entirety, replaced, and relocated within this document to become Section XII.

Information Technology, Sub-Sections U. and V. as follows:

U. Data Transmission and Security

1. The Vendor shall ensure system security and the confidentiality of donor identifiable information and donations by using its protocols and internal procedures.

a. The Vendor shall ensure that the operation of all of its systems is performed in accordance with Federal and State regulations and guidelines related to security and confidentiality and meet all privacy and security requirements of HIPAA regulations.

b. Any Protected Health Information (PHI) released shall be in accordance with

HIPAA requirements as interpreted by the Agency and Agency policy.

c. The Vendor shall ensure all electronic mail communications that contain PHI are encrypted in accordance with HIPAA requirements and Agency policy. The Vendor shall encrypt all data that is submitted to the Agency in electronic format outside the Agency's firewall.

d. The Vendor shall use the Agency's encryption software when corresponding with the Agency via electronic mail. Any costs associated with obtaining the Agency's encryption software shall be at the Vendor's expense and at no cost to the Agency.

2. All deliverables provided by the Vendor shall be performed in accordance with professional industry standards and specifications as described in this Contract. DHSMV and the Agency require the use of information systems development methodology (ISDM) standards and guidelines as a reference for the Vendor's approach but reserve the right to modify the standards and guidelines solely at the discretion of the DHSMV and the Agency when there is a reasonable cause for the change.

AHCA RFP 015-25/26, Addendum No. 3, Page 2 of 4

V. Data Transfer and Security

1. Development language and data storage:

a. Data shall be managed with an enterprise level data base management system (DBMS) such as Oracle or Microsoft Standard Query Language (SQL) Server;

and

b. The Application shall be developed using Microsoft.Net framework or other mainstream toolset.

2. Application security requirements:

a. The Vendor will adhere and comply with Agency Division of IT standards regarding Secure Sockets Layer (SSL) web interface(s) and Transport Layer Security (TLS);

b. The Vendor will comply with the current and up-to-date Internet browser version releases in coordination with Agency IT standards, including Microsoft Edge (Chromium-based), Apple's Safari, Mozilla's Firefox and Google Chrome browsers;

c. The Vendor will have a written disaster recovery plan and a documented disaster recovery exercise; and

d. Use of passwords for all user accounts.

3. Initial data load and subsequent input:

a. The Agency will facilitate the transfer of the initial donor data set from the prior vendor to the Vendor. The initial donor data set will contain approximately 10.6 million records. The Vendor is required to migrate all existing records and historical data to the Registry during the implementation period. Additionally, the Agency will work with the Vendor and DHSMV to facilitate integration activities.

b. DHSMV will send batch updates to the Registry via secure sFTP on a weekly basis. The Vendor shall load these batch updates into the Registry as part of its weekly processing. The Vendor may optionally provide a secure, encrypted, and properly authenticated web service capable of accepting real-time or near real-time updates from DHSMV to the Registry as a future capability. In the future case, the web service will be used (consumed) by DHSMV, a process of referencing and calling the web service provided by the Vendor. DHSMV will only send updates to the Vendor after the initial load of the Registry database.

ITEM 3

AHCA RFP 015-25/26, Attachment B, Scope of Services, Section II., Manner of Service(s) Provision, Sub-Section B., Services Provided by the Vendor, Section 7., Implementation Plan, is hereby deleted in its entirety and replaced with the following:

7. Implementation Plan

AHCA RFP 015-25/26, Addendum No. 3, Page 3 of 4

a. The Vendor shall prepare and execute a final implementation plan. The final implementation plan shall be submitted to the Agency and the DHSMV no later than thirty (30) calendar days following the execution of this Contract. The final implementation plan shall be based upon the requirements of this Contract and coordinated with the Agency and the DHSMV to ensure readiness to complete required tasks by dates specified in this Contract. The final implementation plan shall be based on the preliminary implementation plan submitted by the Vendor in its response to the RFP resulting in this Contract. The final implementation plan shall outline in detail all steps necessary for the Vendor to establish an on-line donor registry and educational program, including but not limited to:

• A timeline for implementing Program components of both the Registry and the educational initiative;

• Identification of any potential barriers to the timely implementation of the Program and proposed methods for overcoming them; and

• Identification of any expected assistance needed from the DHSMV or the Agency for interface definition, joint testing, and cutover support for the Program.

b. Within ninety (90) calendar days of Contract execution, the Vendor shall complete all implementation, data migration, transition, user acceptance testing, and related implementation activities required to ensure the Registry meets the requirements of this Scope of Services. All implementation activities shall be completed by the Vendor prior to beginning the operations and maintenance period of the Contract.

ITEM 4

AHCA RFP 015-25/26, Attachment B, Scope of Services, Section XII., Information Technology, Sub- Section D., Development Requirements, Item 15. is hereby deleted in its entirety and replaced with the following:

15. The Vendor’s test plan shall be prior approved by the Agency’s Division of IT and DHSMV.

The system will be tested on and off site using different browsers and different devices.

ITEM 5

Attachment A, Instructions and Special Conditions, Section A.1., Instructions, Sub-Section A., Overview, Item 6., Solicitation Timeline, is hereby deleted in its entirety and replaced with the following:

6. Solicitation Timeline

The projected solicitation timeline is shown in Table 1, Solicitation Timeline, below (all times are Eastern Time). The Agency for Health Care Administration (Agency) reserves the right to amend the timeline in the State’s best interest. If the Agency finds it necessary to change any of the activities/dates/times listed, all interested parties will be notified by addenda to the original

AHCA RFP 015-25/26, Addendum No. 3, Page 4 of 4 solicitation document posted on the Vendor Information Portal (VIP) (https://vendor.myfloridamarketplace.com/).

TABLE 1

SOLICITATION TIMELINE

ACTIVITY DATE/TIME LOCATION

Solicitation Issued by Agency

June 23, 2026 Electronically Posted https://vendor.myfloridamarketplace.com/

Deadline for Receipt of Written Questions

July 7, 2026 2:00 p.m.

solicitation.questions@ahca.myflorida.com

Anticipated Date for Agency Responses to

Written Questions

July 21, 2026

Electronically Posted https://vendor.myfloridamarketplace.com/

Deadline for Receipt of Responses

August 18, 2026 2:00 p.m.

Attention: Ashley Balkcom Agency for Health Care Administration

2729 Fort Knox Boulevard Mailroom, Building 2, Tallahassee, FL 32308-5403

Public Opening of Responses

August 18, 2026 2:30 p.m.

2727 Mahan Drive, Building 2 Operations Conference Room, 2nd Floor, Room

200, Tallahassee, FL 32308-5403 Anticipated Posting of

Notice of Intent to Award

September 15, 2026 Electronically Posted

REMAINDER OF PAGE INTENTIONALLY LEFT BLANK

mailto:solicitation.questions@ahca.myflorida.com https://vendor.myfloridamarketplace.com/ https://vendor.myfloridamarketplace.com/