Attachment I Scope of Work.pdf

RFP 6070 Prescription Drug Monitoring Program (PDMP)

ATTACHMENT G

SCOPE OF WORK

1. Overview

This Scope of Work (SOW) outlines the general requirements and parameters for the design, development, implementation, and ongoing Maintenance and Operations (M&O) of the Oregon Prescription Drug Monitoring Program (PDMP) System. The system is a critical public health and safety tool designed to support the appropriate use of controlled substances, reduce prescription drug misuse, and improve patient care by providing timely and secure access to prescription data for authorized users.

Agency is seeking a Contractor to provide a PDMP system . Contractor must be capable of delivering a secure, scalable, and compliant solution that meets all applicable federal and state requirements, integrates with external systems (e.g., EHRs (Electronic Health Records), HIEs (Health Information Exchange), PMPi (Prescription Monitoring Program reconnect), RxCheck), and supports a wide range of stakeholders including healthcare providers, pharmacists, public health officials, and law enforcement.

This SOW is intended to provide a high-level description of Agency’s expectations.

The detailed tasks, deliverables, and responsibilities will be defined in the Statement of Work in the resulting Contract.

2. Key Persons

Contractor shall provide the following staffing positions as key personnel for the PDMP project. These individuals must have the appropriate qualifications, experience, and authority to fulfill their roles and responsibilities throughout the life of the Contract. Substitutions of Key Persons must be approved in writing by the Agency.

Key Person Role Description

Project Manager Serves as the primary point of contact for the Agency.

Responsible for overall project planning, execution, risk management, and communication.

Technical Lead Oversees system architecture, development, integration, and technical decision-making. Ensures compliance with security and interoperability standards.

Implementation Manager

Leads system implementation or transition activities, including configuration, testing, and deployment.

Coordinates with legacy system stakeholders if applicable.

Security & Compliance Officer

Ensures the system complies with all applicable federal and state privacy and security regulations (e.g., HIPAA, 42 CFR Part 2). Oversees audits and risk assessments.

Data Integration Lead

Manages data exchange with external systems such as EHRs, HIEs, and PMPi/Rxcheck. Ensures data quality and integrity.

Key Person Role Description

Operations Manager

Oversee ongoing system operations, user support, and maintenance activities. Ensure service levels and performance targets are met.

Training & Outreach Coordinator

Develops and delivers training materials and sessions for system users. Coordinates stakeholder engagement and communications.

3. PDMP Solution Services

3.1 Compliance with Laws, Regulations, and Policies

Contractor and its employees shall comply with all applicable federal and state laws, regulations, and Agency policies governing the use, access, storage, and disclosure of prescription drug data and access to Agency networks and information systems. This includes, but is not limited to:

3.1.1 Complying with all applicable requirements, including but not limited to:

• Health Insurance Portability and Accountability Act (HIPAA)

• 42 CFR Part 2 (Confidentiality of Substance Use Disorder Patient Records).

• Oregon Revised Statutes (ORS) and Oregon Administrative Rules (OAR) governing PDMP

• Federal and state security and accessibility standards.

3.1.2 Adhering to Agency’s data governance standards and policies;

3.1.3 Providing Contractor staff with regular refresher training on Agency security policies and procedures;

3.1.4 Providing Contractor staff with regular refresher training on Agency business rules and policies made available to Contractor that impact delivery of services.

3.2 Application Services and Data Management

Contractor shall provide all software, services, and technical capabilities necessary to implement, operate, and maintain the PDMP system and manage PDMP data in compliance with all applicable federal, State of Oregon, and Agency rules, policies, and procedures. Application services and data management activities include, but are not limited to:

3.2.1 Ensuring the PDMP system supports real-time or near real-time collection, validation, and secure storage of controlled substance prescription data from dispensers and pharmacies. Details related to the data flow and collection process expanded in attachment H.

3.2.2 Managing all PDMP system components, including:

• Provider and dispenser user portals

• Administrative and reporting dashboards

• Peer Comparison Reports

3.2.3 Maintaining and supporting connections with external systems, including:

• Electronic Health Records (EHRs)

• Health Information Exchanges (HIEs)

• PMP InterConnect and RxCheck (for interstate data sharing)

3.2.4 Responding to data-related inquiries from Agency staff, public health analysts, and authorized stakeholders.

3.2.5 Facilitating the secure ingestion and reconciliation of prescription data from multiple sources, including pharmacies, mail-order services, and third-party data aggregators.

3.2.6 Ensuring data quality through validation, deduplication, and reconciliation processes to resolve discrepancies in patient, prescriber, and dispenser records.

3.2.7 Documenting and following defined Agency review and approval processes for any data corrections, system changes, or reporting outputs.

3.2.8 Supporting functionality for secure document upload, audit trails, and automated workflows for user registration, access requests, and compliance monitoring.

3.3 Operations

Contractor shall provide all operational services and support necessary to ensure the secure, reliable, and compliant functioning of the PDMP System. This includes system maintenance, infrastructure support, user support, data quality assurance, and coordination with Agency staff for ongoing enhancements and compliance activities. Operational responsibilities include, but are not limited to:

3.3.1 System Operations and Support

• Ensure the PDMP System is available and operational 24/7, with appropriate uptime, performance, and disaster recovery capabilities.

• Provide technical and user support to authorized users, including prescribers, dispensers, public health officials, and law enforcement (as permitted by law);

• Maintain and monitor system infrastructure, including hosting environments, databases, and interfaces with external systems.

• Perform readiness activities for system updates, including stakeholder outreach, training, and documentation updates.

• Ensure data integrity by validating and cleansing prescription data, resolving mismatches in patient, prescriber, and dispenser records, and addressing duplicate or erroneous entries.

• Monitor and resolve data submission errors from pharmacies and other data submitters in a timely manner.

• Provide quality assurance checks to ensure compliance with data submission standards and reduce the risk of inaccurate or incomplete data being used for clinical or regulatory purposes.

3.3.2 Defect and Issue Management

3.3.2.1 Maintain a defect tracking and resolution process, including:

• Logging, triaging, and prioritizing system issues.

• Participating in Agency-led triage meetings.

• Providing analysis, documentation, and recommendations for resolution.

• Documenting workarounds and root cause analyses.

• Proactively identifying issues through system monitoring, error logs, and data validation routines.

3.3.2.2 Provide highly skilled subject matter experts (SMEs) to support triage and resolution of system issues.

3.4 Change, Configuration, and Release Management

3.4.1 Support change management processes, including:

• Scoping sessions and impact analysis.

• Change request documentation and prioritization.

• Cost and timeline estimate for enhancements.

3.4.2 Manage configuration of third-party components and ensure all necessary components and their licenses are maintained and up to date.

3.4.3 Support transition of applicable licenses and system documentation to Agency or a successor vendor in the event of a transition, as outlined in the Transition Plan.

3.4.4 Coordinate release management activities, including:

• Scheduling and content planning for regular and emergency releases.

• Communicating release details to Agency staff and stakeholders.

• Supporting rollback and recovery procedures as needed.

3.5 Testing and Validation

3.5.1 Conduct testing activities to ensure system compliance with

Requirements and Design, including:

• System integration testing.

• Regression testing.

• Performance and load testing.

• Penetration and security testing.

• Disaster recovery testing.

3.5.2 Support Agency-led User Acceptance Testing (UAT), including test planning, execution support, and defect resolution.

3.6 Infrastructure Hosting and Support (Informational)

This information will not be scored directly but may be used to inform contract negotiations and ensure alignment with State infrastructure policies.

3.6.1 The PDMP System may be hosted in the Agency’s Microsoft Azure tenancy or in a FedRAMP-authorized cloud environment approved by the Agency.

3.6.2 Proposer shall describe:

• Contractor preferred hosting model (e.g., vendor-hosted, Azure tenancy, hybrid), any dependencies or limitations related to hosting location, experience supporting systems in Microsoft Azure or comparable environments.

4. System Administration

• Respond to Agency questions, attend meetings, and provide information related to PDMP System infrastructure.

• Administer servers and monitor performance of all environments and third-party components.

• Analyze and optimize SQL queries to improve system responsiveness.

• Maintain and publish a downtime calendar for planned and unplanned outages.

• Notify users of planned and unplanned downtime and provide timely status updates.

• Manage all system environments (Production, Development, Test) per the current Accepted Configuration Management Plan.

• Perform data refreshes and sanitization in non-production environments.

• Provide usage, capacity, and availability reports to Agency.

4.1 Change Management

• For infrastructure-driven changes, create change documentation, perform impact analysis, and recommend prioritization.

• For other changes, assess infrastructure impacts and provide relevant information to the Agency.

4.2 Release Management

• Deploy planned and emergency builds per the release management plan.

• Execute data fixes and participate in release planning meetings.

• Provide infrastructure-related input on timelines, downtime, and communications.

• Collaborate on emergency builds and follow Agency emergency deployment procedures.

4.3 Configuration Management

• Apply and validate patches to third-party products on schedule

• Identify and mitigate vulnerabilities in servers and third-party tools

• Maintain and update certificates (internal and external)

• Manage service account credentials and interface credentials across environments

• Apply infrastructure changes (e.g., firewall requests, load balancing, capacity upgrades)

• Install and configure Agency security tools and assist with troubleshooting.

• Review third-party product configurations quarterly and provide upgrade recommendations

4.4 Batch and Data Management

• Manage batch processes and data workflows to ensure timely and accurate data ingestion, processing, and reporting

4.5 License Management

• Meet with Agency and State staff to review license compliance for all third-party products

• Ensure all components meet licensing requirements

4.6 Service Account Management

• Maintain and update domain account passwords.

• Report on password renewal progress.

4.7 Infrastructure Support and Recommendations

• Provide infrastructure documentation and audit logs for security assessments.

• Identify misconfigurations, assign risk ratings, and recommend remediations.

• Provide system architecture and network details, including firewall, ports, and certificates.

• Assist with issue resolution by providing performance data and expert analysis.

• Support external partners with interface connectivity, certificates, and file paths.

• Ensure infrastructure tasks and deliverables are reflected in the Integrated

Project Schedule.

4.8 Testing Support

• Provide infrastructure support for all testing phases, including UAT, performance, and disaster recovery testing.

4.9 System Monitoring and Reporting

• Monitor and report on system performance in the Production environment.

• Provide 24/7 access to monitoring dashboards for Agency infrastructure staff.

• Monitor database performance, including slow queries, deadlocks, and timeouts.

• Track and report on interface transaction failures and coordinate resolution plans.

• Monitor server capacity, user access, application usage, and trading partner connectivity.

• Generate security incident and event monitoring reports.

• Conduct daily and on-demand health checks and provide system health reports.

4.10 Disaster Recovery Support

Contractor shall provide disaster recovery and business continuity services. This includes successfully completing PDMP System disaster recovery (DR) testing on an annual basis. At a minimum, this includes:

• Creating, managing, and executing a DR Plan, including updates as infrastructure evolves;

• Coordinating and communicating with all stakeholders to ensure successful DR testing;

• Performing infrastructure and technical validation once the DR environment is activated;

• Confirming that the Recovery Time Objective (RTO) and Recovery Point Objective (RPO) are met;

• Collecting and documenting DR test results and incorporating Agency feedback into DR Plan updates.

4.11 Security Management

Contractor shall ensure the PDMP System remains secure and compliant with all applicable security standards and best practices. At a minimum, this includes:

4.11.1 Access Control Management

• Periodic review and management of user roles, permissions, and access controls to prevent unauthorized access.

4.11.2 Security Patching and Updates

• Regular application of security patches, updates, and hotfixes to maintain system integrity and protect against vulnerabilities.

4.11.3 Ongoing Security Assessments

• Conduct security audits and assessments as required by Agency to ensure the system remains resilient against emerging threats.

4.12 Enhancement Services

Contractor shall provide Enhancement Services for the PDMP System.

Enhancements may be requested by Agency to reflect changes in law, administrative rule, policy, or business need. Enhancements may include new functionality, modifications to existing features, or updates to data structures.

Examples include, but are not limited to:

4.12.1 Requirements and Design

• Implementing capabilities not specified in the original Requirements Traceability Matrix (RTM) or SOW;

• Gathering and validating new requirements;

• Conducting Joint Application Design (JAD) sessions;

• Creating data flow and logic diagrams;

• Mapping business rules to Agency policy;

• Updating training, transition, and communication materials;

• Design enhancements and updating the Requirements and Solution

Design documentation.

4.12.2 Testing Services

• Creating and maintaining test cases and test data;

• Updating and executing regression tests (manual or automated);

• Performing code quality checks and system performance tuning;

• Testing enhancements in production-like environments using obfuscated data;

• Conducting performance and accessibility testing;

• Supporting Agency-led User Acceptance Testing (UAT).

4.12.3 Implementation and Support

• Responding to Agency questions related to enhancements.

• Supporting environment refreshes and ensuring synchronization across environments.

• Simulating time-based scenarios for testing;

• Assisting the Agency in validating enhancements and system functionality;

• Implementing enhancements and providing implementation support services;

• Supporting Organizational Change Management (OCM) to help Agency staff adopt new or modified functionality.

5 DELIVERABLES

Below are some of the expected Deliverables associated with the implementation, enhancement, and Maintenance & Operations (M&O) of the PDMP System. These include, but are not limited to:

5.1 PDMP M&O Plan

Contractor shall create and maintain a M&O Plan that identifies the resources, processes, and high-level schedule to execute the Tasks and Deliverables. At a minimum, this Deliverable must:

• Include a detailed project plan that identifies tasks, activities, resources, dependencies, and Deliverables.;

• Describe Contractor’s quality control processes and performance metrics;

• Describe the testing activities and test data used for validation and verification;

• Describe the approach for maintaining the PDMP solution, including infrastructure, data integration, and user support.

5.2 Requirements and Solution Design

This Deliverable includes two key components:

• Contractor-updated and maintained Requirements Matrix (RM) that identifies all functional and non-functional requirements for the PDMP System.

• Contractor-updated and maintained PDMP Solution Design Document that describes how requirements are implemented across the system. At a minimum, this includes:

• Data flow diagrams.

• Rules for data validation and cleansing;

• Description of how the PDMP Solution Services comply with all requirements;

• Description of infrastructure services, user access and authentication, data exchange mechanisms, and compliance with applicable security and privacy standards (e.g., HIPAA, 42 CFR Part 2).

5.3 Monthly PDMP Services Report

On an agreed upon frequency, anticipated to be monthly for ongoing operations and weekly for new implementation. Contractor shall report on the PDMP Services performed during the reporting period. At a minimum, each report must:

• Provide an executive summary of the overall status of the PDMP Solution Services;

• Report on Contractor’s performance against each of the Service Level Agreements (SLAs);

• Identify data submissions, user activity, and system usage metrics during the reporting period.

• Describe maintenance activities related to application development, infrastructure, and security.

• Identify communications and stakeholder engagement activities conducted during the reporting period.

• Describe data validation, cleansing, and reconciliation activities completed;

• Describe overall quality management (QA and QC) activities performed to improve the quality and reliability of PDMP Solution Services.

6 SERVICE LEVEL AGREEMENTS

Below are Agency’s general anticipated service levels for the PDMP System. Final service levels will be negotiated with the successful Proposer.

6.1 System Availability Service Level

SLA Name SLA

System Availability

The PDMP System in the Production environment must be available to users 99.9% of the time.

6.2 Measurement Method:

• System availability is calculated as the total duration of availability of all PDMP System components in the Production environment divided by the total number of minutes in the calendar month.

• Scheduled downtime, as approved by the Agency’s Change Advisory Board (CAB), is excluded from the total minutes in the month.

6.3 Liquidated Damages:

• To be determined during contract negotiations.

6.4 Incident Management Support Service Levels

Contractor shall accept and process user-reported Incidents from the Agency Help Desk that require Tier 2 or Tier 3 support. Contractor shall ensure Incidents are addressed according to the Agency-assigned Incident Level, which is based on the severity and impact of the issue on the PDMP System, services, and affected users.

6.5 Incident Response Expectations:

• Response is defined as Contractor acknowledging receipt of the Incident and assigning the appropriate personnel or team to assess and resolve the issue.

• Contractor shall:

• Log and track all Incidents in a ticketing system accessible to the

Agency.

• Assign resources based on the severity level.

• Provide timely updates to the Agency on resolution progress.

• Escalate unresolved or high-impact Incidents per the escalation procedures defined in the M&O Plan.

Note: Some Incidents may not be classified as Defects but may still require resolution to maintain system performance or user satisfaction.

6.6 Incident Response Service Levels

Contractor shall respond to Incidents based on the severity level assigned by the Agency. Response time is defined as the time from when the Incident is submitted by the Agency to when the Contractor acknowledges receipt and assigns appropriate personnel to begin resolution.

Incident Level

Response Time

Service Level Requirement

Period of Measurement

Liquidated Damages

Level 1 Within XX minutes of Incident submission

XX% of Level 1 Incidents must meet SLA

Monthly To be negotiated

Level 2 Within X hour of Incident submission

XX% of Level 2 Incidents must meet SLA

Monthly To be negotiated

Level 3 & 4

As agreed upon by the parties

As agreed upon by the parties

Monthly N/A

6.7 Defect Escalation Process

If the parties are unable to agree on whether an Incident constitutes a Defect, or on the severity level assigned to a Defect, the Contractor and Agency shall follow the Defect Escalation Process as described in the current version of the Operational Support Plan.

6.8 Defect Resolution Service Levels

Contractor shall provide timely updates and resolution of Defects based on their assigned severity level. Status updates and resolution timelines are measured from the time of Contractor’s initial response.

Defect Level

Status Update Frequency

Resolution Time Requirement

Period of Measurement

Liquidated Damages

Level 1 Every hour until resolution during Business Hours

Within XX hours after response or as agreed upon

Monthly To be negotiated

Level 2 Every X hours during Business Hours

Within X business days after response

Monthly To be negotiated

Level 3 & 4

As agreed upon by the parties

As agreed upon by the parties

Monthly N/A