CCC QA - Bid BD-26-2018-CNB-CNB-125475.pdf

Q&A

Digital Agent Badges and Medical Patient Identification - RFI

COMMBUYS Bid #: BD-26-2018-CNB-CNB-125475

# Question Subject Question

MMJOS API

availability

The Medical Use of Marijuana Online System (patient.massciportal.com) currently manages patient/caregiver registration and ID issuance. Does the MMJOS expose REST or SOAP APIs for programmatic access to patient registration status, certification validity, and photo retrieval — or would the dID vendor need to integrate via database-level access or batch file exchange?

Answer: The existing MMJOS platform does not provide API’s for patient status and certification. We have a current procurement that includes specifications for API capabilities, details are not yet available.

MassCIP API availability

Does the Massachusetts Cannabis Industry Portal (MassCIP/Licensing Portal) provide API-based access to agent licensing status, establishment associations, and license expiration data? What is the current technology stack (e.g., .NET, Java, cloud-hosted)?

Answer: The Massachusetts Cannabis Industry Portal (MassCIP) currently does not have interactive API capabilities. The platform can interact with other solutions via API to push agent and Marijuana Establishments (ME) licensing status, expiration date and related information. MassCIP is cloud based.

Metrc integration scope

The RFI references Seed-to-Sale integration. Is the Commission seeking real-time bidirectional integration with Metrc (e.g., verifying agent credentials at point of sale), or read-only status verification? Does the Commission envision the dID system as a Metrc-validated integrator, and if so, are there existing Metrc API credentials the vendor would inherit?

Answer: Not at this time. Current integration with Metrc is directly between the licensing system and Metrc for agent and patient validation but the Commission would be interested in understanding any opportunities and capabilities we have not yet considered.

RMV photo transfer

Current patient registration instructions indicate that "a copy of your photo in the Registry of Motor Vehicles database will be transferred into the Medical Use of Marijuana Program Online System." Would the dID system continue to use this RMV photo transfer process, or should the vendor propose an alternative photo capture workflow? Is the current RMV data sharing governed by an existing MOU/data sharing agreement that the dID vendor would operate under?

Answer: The current Medical Patient Portal (MMJOS) accepts RMV photos as well as individual uploaded photos. The Commission is looking for a solution to be able to support both the RMV and non-RMV photos. If a direct connection between the dID vendor and RMV is required, there is an existing agreement the vendor would need to operate under.

Current identity verification process

What is the Commission's current identity proofing workflow for patient and agent registrations? Specifically, are identity documents currently reviewed manually by Commission staff, or is any automated verification in place?

Approximately how many FTEs are currently dedicated to ID review and card production?

Answer: In some cases, ID docs are reviewed manually (anything other than Mass ID or License) as the system triggers a manual review. With a Mass ID or License, automatic verification takes place.

Law enforcement verification

The RFI notes that patients may present their ID to law enforcement to confirm their registration status. Does the Commission require a law enforcement verification interface (e.g., a secure portal or API where law enforcement can validate a dID credential in real-time), or is visual/QR presentation by the patient considered sufficient?

Answer: The current Medical Patient Portal allows law enforcement to verify patient registrations. The Commission is interested in understanding options, capabilities and benefits of verification via the dID provider.

Pediatric patient requirements:

The current MMJOS supports pediatric patient registration with guardian designation. Are there specific dID requirements for pediatric patients (e.g., guardian-controlled credential, age-restricted features, dual-authorization for dispensary access)?

Answer: Pediatric patients are required to have a parent/guardian caregiver, and the accounts are connected in our system. The parent/guardian must provide proof of such via birth certificate or court documents at registration.

There are no specific dID features at this time, and both patient and caregiver each have their own ID.

Current card production vendor and costs:

Can the Commission share the current annual cost of physical card production and mailing (vendor name, per-card cost, annual volume)? This data would enable respondents to provide meaningful cost comparison and projected savings from digital adoption.

Answer: The Commission currently uses Idemia for card production, per card cost is $6.10 per card plus mailing cost. Current annual production is 105,000 cards.

Physical card continuation use cases:

The RFI states the solution "may continue offering printed version for some use cases." Which specific constituent groups or scenarios does the Commission anticipate will require continued physical card issuance (e.g., patients without smartphones, Investigation & Enforcement team members for on-site inspections, pediatric patients)?

Answer: There are a large number of patients/caregivers who utilize paper applications as they are unable to navigate online systems due to ability or access to technology and they would likely want to continue with a hard copy card for the same reasons.

Investigation & Enforcement team members may continue to utilize physical ID’s for on-site inspections.

Temporary card elimination

Currently, patients can download a temporary paper card from MMJOS after registration. Does the Commission intend for the dID to replace this temporary paper credential with immediate digital issuance, or should both options coexist during transition?

Answer: To the extent that this will streamline existing processes the Commission will seek to do so.

HIPAA

applicability

Research indicates that patient and caregiver information on the Massachusetts medical marijuana registry is protected by HIPAA (per 935 CMR 501.000). Does the Commission consider the dID platform within HIPAA scope, and should respondents include HIPAA compliance in their security architecture and cost estimates?

Answer: Yes, all future vendors shall comply with all applicable laws regarding sensitive or personal information that will be stored or used in the Service and will execute any additional contractual documentation if required under any law, rule or regulation for the access, storage, processing, and use of sensitive or personal information included for HIPAA compliance.

RMV/AAMVA

integration scope

Beyond the existing RMV photo transfer, does the Commission envision the dID vendor performing driver's license data verification through the AAMVA DLDV network as part of identity proofing? Or is RMV integration limited to photo retrieval only?

Answer: The Commission is interested in understanding the additional capabilities available including identify proofing/verification.

Anticipated procurement path

Will this RFI inform a subsequent RFP/RFR, and if so, does the Commission have an anticipated timeline for the formal procurement? This helps respondents calibrate the level of detail and commitment in their RFI responses.

Answer: To be determined based on responses to the RFI. The Commission may also elect not to proceed based on budget constraints and responses received to this RFI.

EOPSS/DCJIS

integration specifics:

The RFI references integration with the Executive Office of Public Safety and Security (EOPSS). Does this specifically refer to CORI (Criminal Offender Record Information) background checks via DCJIS iCORI for agent registrations? What is the current integration method (batch file, API, manual lookup), and would the dID vendor be expected to automate this process?

Answer: CJIS CORI access and background checks are not currently part of the existing platform. The Commission would be interested in understanding capabilities to perform such checks for future considerations. Currently the Executive Office of Public Safety uses a web service with the Medical Patient Portal (MMJOS) to verify patient, caregiver and Medical Agent registration status.

Solution Capabilities

Is support for third-party wallets (Apple, Google, Samsung) a required capability for any future solution? Or does the state envision provisioning a state branded app/wallet?

Answer: It is not mandatory; the Commission seeks to understand current available technology and options.

Solution Capabilities

Please describe in detail the type of data to be shared with EOPSS and RMV including the direction of travel, type of integration (API, file drops, etc.), frequency (real-time, batch, ad-hoc), and general volume.

Answer: See Question 14.

Current State Technology

What licensing platform technologies and providers are in use today for Medical Patient Portal, Licensing System, and Seed-to-Sale platforms?

Answer: We are currently using MMJOS through JD Software as for the Medical Patient Portal. Our Licensing system, MassCIP is a SaaS hosted platform developed by JD Software. The current Seed-to-Sale system is a SaaS hosted platform developed and operated by Metrc.

Vendor Expectations

Will the ultimate selected vendor be responsible for creation of physical cards?

Answer: Not necessarily, the Commission is evaluating all possible solutions and vendor approaches including separate procurements for digital and physical cards depending on responses to this RFI.

Vendor Expectations

Will the selected vendor be given access to physical cards to improve their identity verification/onboarding flows and training models?

Answer: The Commission would be able to share existing data dictionary and card templates for building out a solution.

Future Implementation

What is the timeline for procurement of a full solution implementation?

Answer: To be determined based on responses to the RFI. The Commission may also elect not to proceed based on budget constraints and responses received to this RFI

FedRAMP authorization level:

The RFI mentions FedRAMP as a relevant certification. Is FedRAMP High authorization required for the hosting environment, or would FedRAMP Moderate (or FedRAMP-equivalent state authorization) be acceptable? Will you sponsor as agent?

Answer: It is not required, state equivalent would be acceptable, and the Commission would consider being a sponsor agent if needed. The Commission is seeking to understand the landscape of vendors capable of providing a solution and features to be included in any future procurement.