Appendix C - Detailed Business and Technical Requirements.xlsx

Instructions

Glossary

Data Collection and Submission

Provide timely notifications to dispensers when submitted data is found to be incomplete or inaccurate.

Clearly identify the data elements in error.

Support resubmission and correction workflows; and

Data Management and Validation

All data shall be hosted on vendor-provided cloud-based servers, maintained in compliance with federal and state security standards.

The system shall translate NDC numbers into drug name, strength, dosage form, and DEA-controlled substance schedule.

Variations in names (e.g., nicknames, aliases);

Similar or duplicate addresses;

Slightly differing dates of birth; and

Retention policies are currently defined as follows:

Live Data: Retained for thirty-six (36) months after the prescription dispense date;

Archived Data: Retained for up to sixty (60) months total.

All live program data shall be preserved, including metadata and associated audit logs.

View the upload history of any dispenser by timeframe;

Identify error rates and late submissions;

Detect trends in reporting behavior;

Submission histories by dispenser;

Contact information for each reporting entity;

Contain invalid or missing DEA, NDC, or NPI numbers;

Contain incomplete or incorrect prescription control numbers;

Data Exchange and System Integr

The integration shall support:

Intrastate and interstate data exchange;

Authorized user queries to out-of-state PDMPs;

Secure Web Services and User Ac

Access must be available twenty-four (24) hours per day, seven (7) days per week, with high availability and minimal downtime.

The contractor to notify RIDOH and all registered users of major outages, with regular status updates and estimated resolution times. Distinguish from security/breach notifications.

Authorized user groups shall include, but are not limited to: licensed dispensers, prescribing practitioners, designated agency personnel, and Rhode Island PDMP staff.

The system shall enforce the following user security features:

Unique user ID and password credentials;

Email and/or text-based verification during account registration;

Password expiration protocols as defined by the Rhode Island PDMP, with advance notification to the user;

Optional password change prompt at each login;

Self-service password reset functionality using security questions or secure email/text reset links;

Login/logout capabilities with session timeout controls;

Automatic account locking after a defined number of failed login attempts, including email/text notifications and user unlocking procedures;

The system shall support agency administrator-managed user registration workflows for designated agency personnel.

Home page announcements;

Role-based message targeting;

Ability to compose or paste a message into the portal interface;

Automatic inclusion of all registered email addresses for each recipient;

Support for file attachments;

Option to select individual or all recipients using a “Select All” function;

All users;

Specific individuals; or

Comply with HIPAA notification requirements for prescribers, dispensers, RIDOH, and other applicable entities.

Include procedures and timelines for breach response and notification (Contractor must provide a sample policy).

Include technical mechanisms to detect system intrusion or unauthorized access attempts.

Enforce privacy protocols that protect confidential data and communications at all stages of storage and transmission.

Notify the RIDOH Privacy Officer, Bureau of Drug Control, and the Chief Information Security Officer immediately, and no later than twenty-four (24) hours, by telephone or email.

Conduct an initial investigation and secure any evidence related to the breach.

Provide a written incident report within three (3) business days of first learning of the breach.

Provide a subsequent report within seven (7) business days detailing the impact of the breach, corrective actions, future prevention measures, and timelines.

Delegates must provide their supervisor’s registered email address during registration.

Supervisors are notified of delegate registration and must approve the delegate’s account.

PDMP Administrators must be able to view delegate–supervisor relationships and approval status.

Once approved, delegates may perform patient searches on behalf of their supervisor and must select the supervisor prior to running a report.

Supervisors shall be able to view all delegate-run reports within their own patient request history.

Supervisors may deactivate a delegate account at any time.

For example, a “Physician” role may be configured to access prescribing history reports, while a “Delegate” role may be restricted from viewing or generating such reports.

Helpdesk support shall be available twenty-four (24) hours per day, seven (7) days per week, and 365 days per year.

The toll-free number must be staffed by personnel located within the United States.

All voicemails must be acknowledged and responded to within twenty-four (24) hours.

SLA expectations for (a) acknowledgment of requests within 2 hours, and (b) resolution or escalation within 24 hours.

Helpdesk support shall include assistance with:

Web-based submissions;

System navigation;

Report generation;

Password recovery;

Account access issues.

Queries, Reporting, Analytics

Dispensers who failed to submit required reports; and

DEA numbers;

Patient demographics;

Drug classes; and

Prescriber and Dispenser Volume Thresholds: Alert when a set number of prescriptions or interactions is exceeded.

Daily Active MME Threshold: Alert when morphine milligram equivalents (MME) exceed a defined daily value.

Opioid & Benzodiazepine Co-Prescribing: Alert when both drug classes are prescribed to a patient within a defined timeframe.

Methadone Daily Active MME Threshold: Alert when daily methadone MME surpasses a defined threshold.

Patients;

Professional licensing boards;

Law enforcement agencies (local, state, or federal); and

Pre-configured dashboards;

Customizable views;

Parameter-based filters;

Dispensations (by pharmacy/prescriber/time);

Gateway and PMPi request/response activity;

CDC and COAP grant metrics;

Login activity and registration tracking;

Identify pharmacies with recurring or unresolved data submission errors;

Rolling 30-day submission activity;

Number of pharmacies submitting vs. not submitting;

Record error rates and void rates.

The system shall assess whether dispensations involving selected drug types were preceded by a PDMP query by the prescriber (or delegate) within a configurable timeframe.

Reports shall identify non-compliant transactions based on configurable logic aligned with Rhode Island law.

The compliance monitoring solution shall support state-configurable parameters to align with Rhode Island law and evolving policy requirements. At a minimum, these configurable parameters shall include:

Drug Classes: The ability to designate one or more controlled substance schedules or drug classes for mandatory PDMP query compliance monitoring.

Duration of Supply: The ability to configure thresholds based on prescription duration (e.g., number of days’ supply) for which mandatory queries must be enforced and monitored.

Prescriber Role: The ability to apply compliance monitoring by role (e.g., physician, nurse practitioner, delegate), with flexibility to add, remove, or modify roles as required by RIDOH.

These configurable parameters shall be adjustable by RIDOH administrators without requiring vendor intervention and shall be applied consistently across all mandatory use compliance reports and alerts. Business

MES Outcomes - CMS Required PDM

a. Information regarding Medicaid beneficiary prescription drug history.

b. The number and type of controlled substances prescribed to and filled for the covered individual during at least the most recent 12-month period.

c. The name, location, and contact information (or other identifying number selected by the state, such as a national provider identifier issued by the CMS National Plan and Provider Enumeration System) of each covered provider who prescribed a controlled substance to the covered individual during at least the most recent 12-month period. - Real-time access: Average time (in mins) to access a report on bene prescription drug history Section 1944(b) of the Act Section 5042 Medicaid PARTNERSHIP Act CMS FAQs-SUPPORT for Patients and Communities Act

Section 5042 Medicaid PARTNERSHIP Act CMS FAQs-SUPPORT for Patients and Communities Act

Section 5042 Medicaid PARTNERSHIP Act CMS FAQs-SUPPORT for Patients and Communities Act

Section 5042 Medicaid PARTNERSHIP Act CMS FAQs-SUPPORT for Patients and Communities Act

- the number and Quantity of daily morphine milligram equivalents prescribed for controlled substances per covered individual.

- number of occurrences of data or privacy breaches of a qualified PDMP that includes the number of covered individuals impacted by each breach. Section 1944(e) of the Act Section 5042 Medicaid PARTNERSHIP Act 42 CFR 433.112(b)(15) CMS FAQs-SUPPORT for Patients and Communities Act

- List of covered individuals who were prescribed opioids from multiple providers.

- number and/or percentage of opioid-related hospitalizations, ER visits, urgent care visits for covered individuals. Section 1944 (e)(1) of the Act Section 1927(g)(2)(B) and (g)(3)(D) of the Act Section 1004 of the SUPPORT Act 42 CFR 433.112(b)(15) CMS FAQs-SUPPORT for Patients and Communities Act Centers for Disease Control

Business

-- A Project Management Plan submitted within 60 days of contract execution, detailing governance structure, milestones, deliverables, risks, and mitigation strategies.

https://www.section508.gov/sell/vpat/