Data_Exchange_Framework_(DxF)_and_Social_Health_Information_Exchange_(SHIE).pdf

County of San Mateo

Request for Proposals (RFP) for Data Exchange Framework

(DxF) and Social Health Information Exchange (SHIE)

Health - Health IT

RFP No. 2026-RFP-00398

RFP Contact: Thomas Collins tcollins@smcgov.org

1. Introduction and Schedule

The County of San Mateo (the “County” or “SMC”) covers most of the San Francisco Peninsula. The region covers 744 mi and is home to nearly 800,000 residents and 20 incorporated cities. The County provides for the health and welfare of all people within its borders and serves as the local government for the unincorporated areas. Innovation thrives here in industries including bioscience, computer software, green technology, hospitality, financial management, health care, education and transportation. The

County prides itself on how that prosperity fosters its commitment to protecting and enhancing the health, safety, welfare and natural resources of the community.

1.1. Summary

The County of San Mateo (the “County” or “SMC”) covers most of the San Francisco Peninsula. The region covers 744 mi and is home to nearly 800,000 residents and 20 incorporated cities. The County provides for the health and welfare of all people within its borders and serves as the local government for the unincorporated areas. Innovation thrives here in industries including bioscience, computer software, green technology, hospitality, financial management, health care, education and transportation. The

County prides itself on how that prosperity fosters its commitment to protecting and enhancing the health, safety, welfare and natural resources of the community.

The County of San Mateo Health Administration is comprised of 10 Divisions providing health and welfare across San Mateo County including (a) Administration & Central Finance, (b) Aging & Disability

Services, (c) Behavioral Health & Recovery Services, (d) Correctional Health, (e) Emergency Medical

Services, (f) Environmental Health, (g) Family Health, (h) Health Information Technology, (i) Public

Health, Policy & Planning, (j) San Mateo Medical Center.

1.2. Contact Information

Project Contact:

Natalie Del Sarto Contract Administrator II Email: ndelsarto@smcgov.org Phone: (650) 502-2976

Procurement Contact:

Thomas Collins Director, Portfolio and Program Management Email: tcollins@smcgov.org Phone: (628) 258-3275

Department:

Health - Health IT

Department Head:

Colleen Chawla Chief, San Mateo County Health mailto:ndelsarto@smcgov.org tel:(650)502-2976 mailto:tcollins@smcgov.org tel:(628)258-3275

Page 3 of 23 Release date of June 3, 2026

1.3. Timeline

RFP Released June 3, 2026

Deadline for Questions, Comments and

Contract Exceptions

June 10, 2026, 2:00pm

Question Response Deadline June 17, 2026, 2:00pm

Proposal Due Date and Time July 17, 2026, 2:00pm

Interviews (tentative) August 3, 2026

Anticipated Contract Award Date October 13, 2026

2. Scope of Work

2.1. Data Exchange Framework (DxF) and Social Health Information Exchange (SHIE)

County Health is soliciting proposals from qualified vendors to provide a comprehensive, FHIR-based data exchange solution to support compliance with California’s Data Exchange Framework (DxF) and enable future Social Health Information Exchange (SHIE) use cases. The selected vendor will deliver software, configuration, integration, testing, training, support, and ongoing maintenance services. This RFP prioritizes rapid implementation, Epic-centric interoperability, regulatory compliance, and County control over data sharing.

1. Background and Purpose

County Health is required to implement data exchange capabilities in alignment with the California Health and Human Services Agency (CalHHS) Data Exchange Framework (DxF), including requirements established under SB 660. DxF mandates three core forms of data exchange: query-based exchange, electronic referrals and orders, and admission, discharge, and transfer (ADT) notifications.

The County is standardizing on Epic as its enterprise electronic health record and will participate in TEFCA through Epic Nexus. However, the County must also support data exchange with systems that will not migrate to Epic, across various departmental platforms. This RFP seeks a vendor capable of rapidly implementing a secure, scalable, and standards-based exchange solution that meets DxF requirements, while supporting sensitive data protection and future expansion.

The County is required not only to establish technical capability, but to actively participate in ongoing data exchange with external partners in accordance with DxF requirements.

2. Scope of Work

The selected vendor will provide a FHIR-based data exchange solution, including software, configuration, integration, testing, training, support, and ongoing maintenance to support DxF compliance and SHIE capabilities.

Page 4 of 23 Release date of June 3, 2026

2.1 System and Functional Requirements

The system must support all data exchange requirements defined by the DxF, including:

• Query-based exchange providing real-time access to patient information upon request.

• Electronic referrals and orders to support care coordination across providers.

• ADT notifications to automatically inform providers of patient care events.

The system must be scalable, highly available, and capable of supporting multiple trading partners. The vendor must support configuration flexibility to adapt as regulatory or operational requirements evolve.

The solution must support structured data exchange using HL7 FHIR standards in alignment with DxF requirements. The solution should also support ingestion and/or generation of C-CDA documents where appropriate to facilitate interoperability with trading partners not yet fully FHIR-enabled.

The solution must support exchange of data aligned with the United States Core Data for Interoperability (USCDI) standards, including clinical, demographic, and social determinants of health data elements. The solution must support production-level exchange of data with external partners, including the ability to send, receive, and reconcile data in operational workflows.

The solution should support exchange of structured social determinants of health (SDOH) data, including but not limited to Z codes and other standardized terminology.

2.2 Data Control and Consent Management

The solution must provide granular control over data exchange, including the ability to:

• Define which data elements are shared.

• Control which external partners receive specific data.

• Apply additional protections for sensitive data, including substance use disorder, behavioral health, and mental health information.

The solution must support data segmentation and tagging to ensure compliance with federal and state regulations governing sensitive data, including 42 CFR Part 2 and other specially protected categories under California law.

The solution must support enforcement of purpose-of-use and recipient-based data sharing restrictions at the data element level.

Consent management will be County-managed. The solution must support enforcement of consent and data-sharing policies in alignment with federal and state regulations.

2.3 Reporting and Test Environments

The vendor should provide dashboards and reports to support regulatory compliance monitoring, exchange activity, and system performance. Reporting capabilities should include:

• Compliance and operational dashboards.

• Exchange volume and usage metrics.

• Error, failure, and latency monitoring.

The vendor must provide test or sandbox environments to support configuration validation, testing, and ongoing enhancements prior to production deployment.

2.4 Integration Requirements

Page 5 of 23 Release date of June 3, 2026

The solution must integrate with Epic and Epic Nexus (TEFCA) and support HL7 FHIR-based interoperability. The vendor must also support integration with non-Epic systems, including Innovaccer and other County platforms that may be identified during implementation.

All respondents must provide technical integration specifics for all systems including an integration technical summary with a diagram indicating required integration network paths and protocols.

2.5 Security and Compliance

The solution must meet all applicable federal and state security and regulatory requirements, including HIPAA, 42 CFR Part 2, and California privacy laws. Requirements include:

• Role-based access controls.

• Comprehensive audit trails and logging.

• Encryption of data in transit and at rest.

• Support for County security reviews and audits.

2.6 Support, Maintenance, and Training

The vendor must provide 24/7 production support, ongoing maintenance, and regular system updates. The vendor shall propose a training approach focused primarily on administrative and technical users, recognizing that most DxF functionality operates in the background with minimal end-user interaction.

Comprehensive documentation must be provided and maintained.

2.7 Data Ownership and Exit Provisions

All data exchanged, stored, or processed under this contract remains the sole property of County Health.

The vendor may not use County data for secondary purposes. Upon contract termination, the vendor must provide complete data export and transition support at no additional cost, with data delivered in a usable, non-proprietary format.

2.8 EPIC-NATIVE WORKFLOW ALIGNMENT

The solution must:

• Align with Epic-native interoperability workflows, including:

o Care Everywhere exchange o Epic Nexus participation

• Support Epic-to-non-Epic exchange patterns without requiring duplicate documentation or manual re-entry.

• Avoid creation of parallel workflows outside of Epic unless explicitly approved by the County.

• Support ingestion and reconciliation of exchanged data into appropriate Epic domains (e.g., medications, allergies, problem list, encounters) where applicable and permitted.

• The solution must support electronic referral workflows in alignment with DxF requirements.

Clinical referrals should integrate with Epic-native referral workflows where appropriate.

2.9 Trading Partner Connectivity & Onboarding

The vendor must support onboarding and management of external data exchange partners, including:

Page 6 of 23 Release date of June 3, 2026

• Technical connection setup and validation

• Testing and certification of exchange workflows

• Ongoing partner management and support

• Monitoring of partner connectivity and exchange performance

3. Service Requirements

The selected vendor will be responsible for delivering professional services necessary to support successful implementation and ongoing operation.

The vendor shall serve as the primary point of accountability for exchange functionality. When issues arise involving Epic, trading partners, or other integrated systems, the vendor is responsible for leading coordinated troubleshooting efforts until resolution.

The vendor shall meet minimum service levels for production issues:

Severity 1 – Critical (Exchange Down / Regulatory Impact)

Severity 2 – Major Degradation

Severity 3 – Minor Issue

In addition to these SLAs, the vendor should provide:

• 24/7 monitoring of exchange services

• Proactive notification to County of outages

For critical incidents, the vendor must provide root cause analysis within five (5) business days, including corrective and preventative actions.

3.1 Installation and Configuration

• System setup, configuration, and validation aligned with County requirements.

• Coordination with County IT and operational teams.

• Support for fixed and accelerated implementation timelines.

3.2 Maintenance

• Ongoing system maintenance, upgrades, and issue resolution.

• Proactive monitoring and performance optimization.

3.3 Training

• Initial and ongoing training services for administrators and technical staff.

• Knowledge transfer to support long-term County sustainability.

4. Delivery Requirements

The vendor must deliver the solution in accordance with the County’s regulatory timelines and quality expectations.

The vendor must support comprehensive testing capabilities, including:

a. Realistic Workflow Testing

Page 7 of 23 Release date of June 3, 2026

• End-to-end validation of DxF-required workflows (query-based exchange, referrals, ADT notifications)

• Validation of sensitive data segmentation and consent enforcement

• Testing of reconciliation workflows within Epic

b. Parallel Testing Support

• Ability to test DxF changes concurrently with Epic upgrades or configuration changes

• Support for regression testing during Epic upgrade cycles

• Coordination with County IT and Epic teams during major system changes

c. Non-Production Environment Requirements

• Provision of non-production environments that mirror production configurations, interfaces, and security controls

• Data refresh capability (appropriately de-identified or masked where required)

• Support for testing new trading partners prior to production activation

• Ability to validate configuration changes prior to go-live

All configuration and exchange changes must be validated in a non-production environment prior to deployment to production.

4.1 Project Timeline

The vendor shall propose a detailed, fixed implementation timeline with key milestones and deliverables.

4.2 Quality Control The vendor shall ensure the solution meets all specified requirements and supports reliable, secure, and accurate data exchange. Quality assurance processes must include testing for data accuracy, de-duplication, and end-to-end workflow validation.

3. Submission Requirements

3.1. Submission Deadline

Proposals must be electronically received by 2:00 pm, on Friday, July 17, 2026 via eProcurement system.

Allow sufficient time for the upload to complete by the Due Date and Time. Partial uploads will automatically terminate, and proposals will be rejected. The eProcurement system submission time will be the official submission time. The County will not be responsible for and may not accept proposals that are late due to slow internet connections or for any other failure of the eProcurement system.

NOTE: The County does not maintain the eProcurement system and is not liable for site failures or technical problems. To resolve technical issues, contact OpenGov Technical Support by using the real time chat located in the lower right hand corner of the screen, or via email at procurement-support@opengov.com https://procurement.opengov.com/portal/smcgov mailto:procurement-support@opengov.com mailto:procurement-support@opengov.com https://procurement.opengov.com/portal/smcgov

Page 8 of 23 Release date of June 3, 2026

3.2. Pre-submission Registration

Organizations or individuals interested in responding to this solicitation must register online with the

County of San Mateo at:

• https://procurement.opengov.com/portal/smcgov

It is recommended that organizations complete this registration as soon as possible. The County will not be responsible for and may not accept proposals that are late due to a failure to register in the eProcurement system.

3.3. Submission via eProcurement Portal

Required Documents

Please refer to the Technical Proposal section for submittal documents and requirements.

Electronic Submissions

Include the proposer name and the RFP title and number in each filename. Submit proposals via the eProcurement website, allowing sufficient time for the upload to complete by the Due Date and Time. As noted above, the eProcurement portal submission time will be the official submission time, and partial uploads will automatically terminate, and proposals will be rejected. Contact eProcurement Portal with technical questions regarding this site.

Conflicts between Certain Requirements

Prior to the submission deadlines and solely relating to a determination of the timeliness of questions, comments, and proposal submissions, information displayed on the eProcurement portal site will take precedence in the event of a discrepancy between that information and the information within the solicitation documents. For all other discrepancies, the information in the solicitation documents will take precedence.

Format

Documents should be created in the following format:

• Text should be Times New Roman (12-point minimum font size) and unjustified (i.e., with a ragged-right margin)

• Pages should have margins of at least one inch on all sides (excluding headers and footers)

• If the proposal is lengthy, a Table of Contents should be included.

• PDF format is preferred.

Errors in Proposals

The County will not be liable for any errors in proposals. Proposals may be rejected as unresponsive if they are late, incomplete, missing pages or information, or cannot be opened for any reason. The County may waive minor irregularities, but such waiver will not modify any remaining RFP requirements.

https://procurement.opengov.com/portal/smcgov https://procurement.opengov.com/portal/smcgov/projects/243020/document?section=2317958

Page 9 of 23 Release date of June 3, 2026

3.4. Procurement Preference for Local Businesses and Local Non-Profits

The County of San Mateo has adopted a Procurement Preference for Local Businesses Ordinance (County

Ord. Code Ch. 2.89.) The purpose of this Ordinance is to promote a strong local economy by giving preference to local businesses, local non-profits, local small and micro businesses, and local small and micro non-profits in County procurements, to the extent consistent with the law and interests of the public. The County’s process for applying local preferences to competitive procurements is set forth in

County Ordinance Code Section 2.89.030. The Ordinance and exemptions (e.g. the ordinance will be exempt when all bids or proposals received are from Non-Profit Organizations) can be reviewed here:

Chapter 2.89 - PROCUREMENT PREFERENCE FOR LOCAL BUSINESSES | Code of Ordinances |

San Mateo County, CA | Municode Library

The requirements for bidders to establish eligibility for a local preference for this solicitation are detailed below in Section III (Submission Requirements) The Ordinance does not apply if a procurement is determined to be exempt (County Ord. Code sec. 2.89.050), and the County reserves the right to waive application of the Ordinance to this procurement if determined to be in the best interests of the County

(County Ord. Code sec. 2.89.060).

4. Minimum Qualifications, Local Preference Ordinance, and Technical Proposal

4.1. Minimum Qualifications - Contracting

4.1.1. Is your QHIO or HIE solution currently operational and certified to support California

Data Exchange Framework (DxF) compliance?*

☐ Yes

☐ No

*Response required

4.1.2. Have you successfully onboarded at least one healthcare entity to meet DxF compliance requirements?*

☐ Yes

☐ No

*Response required

4.1.3. Insurance Requirements Confirmation *

The vendor agrees to be insured for the following coverages, naming the County of San

Mateo as an additional insured.

Comprehensive General Liability $1,000,000

Motor Vehicle Liability $1,000,000

Professional Liability $1,000,000 https://library.municode.com/ca/san_mateo_county/codes/code_of_ordinances?nodeId=TIT2AD_ART2.8INFIPRCOCO_CH2.89PRPRLOBU https://library.municode.com/ca/san_mateo_county/codes/code_of_ordinances?nodeId=TIT2AD_ART2.8INFIPRCOCO_CH2.89PRPRLOBU

Page 10 of 23 Release date of June 3, 2026

Cyber Liability:

Privacy and Network

Security/Technology Errors and

Omissions

$5,000,000/$1,000,000

Workers' compensation and employer’s liability insurance

Full statutory coverage, per

California Law

By submitting your proposal for this RFP, you agree to the above coverages.

☐ Yes

☐ No

*Response required

4.1.4. Please confirm your firm is registered with an Active System for Award Management

(SAM) ID**

• Your SAM.gov account will have a green dot with the words "ACTIVE REGISTRATION" beside it. Your account will also show an expiration date in the future. If you have any other description than ACTIVE REGISTRATION (i.e. ID Assigned or Expired), this indicates the registration is incomplete.

• Incomplete SAM.gov registrations at the time of submission will disqualify the proposal.

☐ Please confirm

*Response required

4.1.5. What is the registered Business Name and Unique Entity ID (UEI) No.?*

• UEI number can be obtained by registering your business through SAM.GOV

• Should you be in the process of obtaining your UEI number, please enter the digits ‘123’ temporarily for your response below in order to proceed with proposal. This temporary number should be replaced with the correct registration number for submission of the proposal.

*Response required

4.1.6. Agree to Use County Standard Template for the Agreement*

Vendor must agree to use the County’s standard contract template without requiring substantive modifications.

☐ Yes

☐ No

*Response required

4.1.7. Limitation of Liability Confirmation *

https://sam.gov/content/home

Page 11 of 23 Release date of June 3, 2026

The County disfavors contracts that limit vendor liability and prefers contractors that will agree to the terms in the attached sample contract without exception.

Please mark yes that you agree not to limit liability, or, if you cannot agree to those terms, please mark no and provide proposed language regarding limitations on liability that would accommodate as many of the following factors as possible:

• Align limitation of liability with insurance coverage limits such that contractual defenses do not impair the amount of insurance that would cover a claim under subrogation principles

• Propose a “super-cap” for liability limitation (for example, “ten times sales” or up to a specific dollar amount)

• Carve out application of the limitation of liability for specific types of risk scenarios (for example, intellectual property, intentional acts, negligence, gross negligence, data loss or theft, privacy breaches)

Carve out application of the limitation of liability for specific types of damages (for example, “no liability cap for consequential damages for intellectual property claims” or “liability cap up to insurance limits for data breach, theft, or loss”)

☐ Yes

☐ No

*Response required

When equals "No"

4.1.8. Liability Limitation*

Vendor must supply exact language proposed to be included in the Master Agreement.

*Response required

4.1.9. Epic GuestHouse and System Access History Disclosure *

Has your organization ever been required by Epic Systems Corporation to operate within Epic's

GuestHouse program, or has your access to any Epic system been restricted, limited, or conditioned by Epic for any reason, whether currently or at any point in the past?

This includes, but is not limited to:

• Placement in Epic's GuestHouse program or any predecessor or successor restricted-access environment

• Limitations on the scope, type, or duration of your access to Epic software or systems

• Requirements to enter into special access agreements beyond Epic's standard third-party access terms

Page 12 of 23 Release date of June 3, 2026

• Any suspension, removal, or denial of access to Epic systems

☐ Yes

☐ No

*Response required

When equals "Yes"

4.1.10. If yes, Epic GuestHouse details are required.*

Please provide a written explanation of the circumstances, the dates the placement was in effect, the reason provided by Epic, whether the placement was removed, and if removed, the reason for removal.

*Response required

4.1.11. Has Proposer has been providing similar services for a minimum of four (4) years within the last seven (7) years?*

☐ Yes

☐ No

*Response required

4.1.12. Account manager has a minimum of two (2) years of experience within the last five (5) years in providing account services?*

☐ Yes

☐ No

*Response required

4.2. Procurement Preference for Local Businesses and Local Non-Profits

4.2.1. Is the Proposer a "Local Business"?

As Defined by Chapter 2.89.020 of the San Mateo County Ordinance Code, a “Local Business” means any for-profit business which has its principal place of business, or is headquartered, in San Mateo

County. If this designation applies to the proposer, a self-attestation form must be completed and provided with this response.

Please download the below documents, complete, and upload. If this designation is not applicable, please leave blank.

• SMC_LocalBusiness_self-atte...

4.2.2. Is the Proposer a Non-Profit?*

A Non-Profit is defined as a tax-exempt public charity organization (within the meaning of section

501(c)(3) of the Internal Revenue Code) that is formed for purposes other than making a profit, is exempt from paying federal income taxes on the income generated for their exempt purposes.

☐ Yes

☐ No https://government-project.s3.us-west-2.amazonaws.com/153456/a16ffdc0-a0ee-44ca-b6de-1fddd010042f_SMC_LocalBusiness_self-attestation_form_120424.pdf

Page 13 of 23 Release date of June 3, 2026

*Response required

When equals "Yes"

4.2.3. Is the Proposer a "Local Non-Profit"

As Defined by Chapter 2.89.020 of the San Mateo County Ordinance Code, a “Local Non-Profit" means a tax-exempt public charity organization (within the meaning of section 501(c)(3) of the

Internal Revenue Code) that is formed for purposes other than making a profit, is exempt from paying federal income taxes on the income generated for their exempt purposes, and has its principal place of business, or is headquartered, in San Mateo County. If this designation applies to the proposer, a self-attestation form must be completed and provided with this response.

Please download the below documents, complete, and upload. If this designation is not applicable, please leave blank.

• SMC_LocalBusiness_self-atte...

4.2.4. Is the Proposer a Local "Small" or "Micro" Business?

As Defined by Chapter 2.89.020 of the San Mateo County Ordinance Code:

“Small Business” means any business which holds a Small Business Certification awarded by the

California Office of Small Business and Disabled Veteran Business Enterprise Services (OSDS).

“Micro Business” means any Small Business certified by the OSDS which is automatically designated by the OSDS as a Micro Business due to gross annual receipts falling below the OSDS-designated dollar amount.

If the above designations apply, please provide the OSDS provided Certification ID.

If this designation is not applicable, please leave blank.

4.2.5. Is the Proposer a Local "Small" or "Micro" Non-Profit?

As Defined by Chapter 2.89.020 of the San Mateo County Ordinance Code:

“Small Non-Profit" means a Local Non-Profit with an annual revenue of $1,000,000 to $2,500,000 according to its most recently filed IRS Form 990.

“Micro Non-Profit" means a Local Non-Profit with an annual revenue of less than $1,000,000, according to its most recently filed IRS Form 990.

If the above designations apply, please provide your latest filed IRS form 990. A filing from the last two calendar years is acceptable.

If this designation is not applicable, please leave blank.

4.3. Technical Proposal

4.3.1. Introduction and Executive Summary *

Submit a letter of introduction and executive summary of the proposal. The letter must contain:

• Name, title and contact information (email, phone, and address) for representative of proposer that is responsible for communication related to this RFP.

https://government-project.s3.us-west-2.amazonaws.com/153456/80d29c2f-acda-4b87-837e-cb4ead1fb303_SMC_LocalBusiness_self-attestation_form_120424.pdf

Page 14 of 23 Release date of June 3, 2026

• Name, title, contact information, and signature of person authorized to obligate firm to perform the commitment contained in the proposal.

Submission of the letter will constitute a representation by proposer that it is willing and able to perform the commitments contained in the proposal and has not violated the terms of this RFP.

*Response required

4.3.2. Statement of Minimum Qualifications *

Describe how the proposer meets the minimum qualifications as set forth in Minimum Qualifications of this RFP.

Submission of the Minimum Qualifications checklist is not a substitute for providing a detailed written response.

*Response required

4.3.3. Project Approach*

This section should correlate to the Scope of Work . Proposer should give a short summary describing how it will perform the relevant work

*Response required

4.3.4. Scope of Work tasks/milestones*

Describe your proposed approach to tasks/milestones

*Response required

4.3.5. Proposed schedule *

Attach proposed schedule reference ability to complete the project within the County's required time frame

*Response required

4.3.6. Innovations*

Refence any notable innovations or improvements that you expect to provide (with respect to, for example, efficiency, technology, sustainability)

*Response required

4.3.7. Performance Measures*

Describe a plan for achieving performance measures

*Response required

4.3.8. Firm Qualifications *

Attach information regarding background and qualifications, including the following:

• A brief description of the proposer.

• A description of not more than three (3) projects similar in size and scope conducted by the proposer, including the client, reference and telephone numbers, primary staff members involved, Page 15 of 23 Release date of June 3, 2026 budget, schedule, and project summary. Descriptions should be limited to one (1) page for each project.

• If subcontractors are anticipated, identify them (if known) and provide information on how they will be used.

*Response required

4.3.9. Team Qualifications*

Provide a chart identifying:

▪ Project team and reporting structure

▪ Lead project manager

▪ Role each person will play in the project

Provide a brief description of the experience and qualifications of the project team members, including short resumes if desired.

Written assurance that the key individuals listed and identified will be performing the work and will not be substituted or reassigned without the County’s prior approval

*Response required

4.3.10. References*

Provide 3 references for each of the following, including the name, address, and telephone number of recent clients (preferably other public agencies):

*Response required

4.3.11. Fee Proposal*

The Fee Proposal should be submitted as a separate PDF file from the Technical Proposals detailed in

Required Documents.

The County reserves the right to accept other than the lowest priced offer and to reject any proposals that are not responsive to this request.

*Response required

4.3.12. Technical and Security Requirements*

Vendor must demonstrate that all employees have undergone a background security check and are provided training to handle confidential data including a yearly security awareness training.

- Employees for this project must be located in the United States.

Vendor must demonstrate evidence that all subcontractors used have undergone a background security check, provided training to handle confidential data including a yearly security awareness training.

Vendor must adhere to all County policies and procedures and will utilize all reasonable means and due diligence to protect the confidentiality and security of the County’s data.

Page 16 of 23 Release date of June 3, 2026

Remote access tools, if used, must be approved by the County’s Information Services Department prior to implementation.

Session network connectivity and traffic must be encrypted at all times.

Proposed solution must be compatible with SAML v. 2.0 for identity management, if required.

Vendor must provide security and administrative controls, such as performance monitoring, event monitoring, vulnerability assessments.

☐ Please confirm

*Response required

5. Evaluation and Selection Criteria

The proposals will be evaluated by a selection committee with relevant expertise. The County intends to evaluate the proposals generally in accordance with the criteria itemized below. Proposers with the highest scoring proposals may be interviewed by the committee to make the final selection.

5.1. Phase 1

N o.

Evaluation Criteria Scori ng

Meth od

Weig ht

(Point s)

Page 17 of 23 Release date of June 3, 2026

1. Pass/Fail Evaluation Criteria Statement

A vendor will receive a pass under this evaluation criterion if they have provided confirmation that demonstrates full agreement and compliance with all of the following requirements:

1. Your QHIO or HIE solution is currently operational and certified to support

California Data Exchange Framework (DxF) compliance .

2. You have successfully onboarded at least one healthcare entity to meet DxF compliance requirements.

3. Insurance Requirements

Vendor must agree to comply with all insurance requirements outlined in the RFP, without exception or condition.

4. System for Award Management (SAM)

Vendor must be actively registered and in good standing with the federal System for Award Management (SAM) at the time of proposal submission.

5. Use of County Standard Contract Template

Vendor must agree to use the County’s standard contract template without requiring substantive modifications.

Failure to comply with any of the above conditions will result in a Fail and disqualification from further evaluation.

Pass /

Fail

(100% of

Total)

5.2. Phase 2

No. Evaluation Criteria Scoring Method Weight (Points)

1. Project Approach Points Based 30 (27.3% of Total)

2. Firm Qualifications Points Based 25 (22.7% of Total)

3. Team Qualifications Points Based 20 (18.2% of Total)

4. Price Points Based 25 (22.7% of Total)

Page 18 of 23 Release date of June 3, 2026

5. Preferential Points

Where price is not the sole evaluation factor for a solicitation (e.g., in the case of a "best-value" solicitation), five percent (5%) of the total evaluation points awardable will be added to the proposal score for each Local Business or

Local Non-Profit score for evaluation purposes.

In the event of a tie between a Local Business or Local Non-Profit and another bidder, the

Local Business or Non-Profit shall be awarded the Contract, assuming agreement on other contract terms.

An additional three percent (3%) preference shall be given to a Local Business or Local

Non-profit (for a total of eight percent (8%) of total points awardable) if the proposer is a

Small Business or Small Non-Profit, or an additional 5 percent preference (for a total of ten percent (10%) of total points awardable) if the proposer is a Micro Business or Micro Non-

Profit.

Points Based 10 (9.1% of Total)

5.3. Phase 3

1. Interview/Demo

Criteria to be provided upon vendor being elevated to this phase.

Points Based 100 (100% of Total)

5.4. Phase 4

1. Overall Best Fit

Criteria to be provided upon vendor being elevated to this phase.

0-5 Points 5 (100% of Total)

6. Instructions to Proposers

6.1. Instructions

There will be no pre-proposal conference or site visit for this project.

6.2. Communications

A. As of the issuance date of this RFP and continuing until it is canceled or an award is made, no proposer or person acting on behalf of a prospective proposer may discuss any matter relating to the RFP with any officer, agent, or employee of the County, other than through eProcurement portal, to the Authorized Contact Person, or as outlined in the evaluation or protest procedures.

Page 19 of 23 Release date of June 3, 2026

B. Proposers (including any agent, owner, employee, board members, or other such affiliates) shall not offer any gift, favor, or other personal benefit to any County officer or employee during the procurement process for this agreement, including during the solicitation period and contract negotiations.

Violation of the foregoing prohibitions may result in a proposer being found non-responsible and barred from participating in this or future procurements.

6.3. Contract Award

A. Award Procedure

Contract negotiations are neither an offer nor guarantee that a contract will be executed. A contract award, if any is made, will be to the responsive, responsible proposer offering the overall best value to the County for the services and goods described in this solicitation, or as applicable, for a specific portion of the services and goods described. Any agreement reached will be memorialized in a formal agreement using the attached template, executed by the appropriate authority.

B. Notice of Intent to Award

If a decision is made to take steps to enter into an agreement with one or more proposers, the

County will post a Notice of Intent to Award or otherwise notify proposers the remaining proposers of their non-selection. Notice may instead be provided by including approval of the agreement as an item on an agenda for a meeting of the Board of Supervisors.

C. Commencement of Performance

After all parties have signed the agreement, the County will notify the contractor and performance may proceed. Prior to execution of the agreement by the County, no County employee may authorize work under the agreement. Any work performed prior to the full execution of the Agreement may not be compensated.

D. Levine Act DisclosureThe Levine Act (California Government Code Section 84308) imposes certain requirements on parties contracting with the County of San Mateo related to campaign contributions to County “officers,” including elected County officers and candidates seeking elective office, who may participate in making a decision on certain County contracts. Elected

County officers in San Mateo County include: the San Mateo County Board of Supervisors, Assessor-County Clerk-Recorder, County Controller, Coroner, District Attorney, Sheriff, and Tax

Collector-Treasurer.Generally, under current County policy, approval by the Board of

Supervisors is required for any agreement for services above $200,000, and agreements for services below that threshold may be approved by Department heads.If your proposal is selected, you will be required to certify compliance with the Levine Act.As part of this process, you will need to certify and warrant that you have fully complied, and will remain in full compliance, with all applicable requirements of the Levine Act in connection with the

Agreement, including making any required disclosures of campaign contributions to County

Officers, which includes but may not be limited to elected County Officers. Elected County

Page 20 of 23 Release date of June 3, 2026

Officers include members of the San Mateo County Board of Supervisors, as well as the

Assessor-County Clerk-Recorder, Controller, Coroner, District Attorney, Sheriff, and Tax

Collector-Treasurer. Any campaign contribution required to be disclosed under the Levine Act in connection with this Agreement shall be disclosed on the County of San Mateo Levine Act

Disclosure Form, a copy of which is available from the County upon request.Parties are solely responsible for accurate certification and disclosure. The Levine Act is complex, and this brief description is not legal advice. For example, certain contributions must be aggregated when determining whether contributions have exceeded the $500 threshold. If your proposal is selected, you are urged to review the Levine Act and consider consulting an attorney.

6.4. Term

Health - Health ITis issuing Request for Proposal (RFP) No. 2026-RFP-00398 for Data Exchange

Framework (DxF) and Social Health Information Exchange (SHIE).

The agreement shall have a term of three (3) years. In addition, the County shall have one (1) option to extend the term for an additional period not to exceed two years, which the County may exercise in its sole, absolute discretion. To exercise this option, the County shall provide written notice to the Contractor at least thirty days before the end of the agreement’s term.

The County’s standard contract template has been included with this solicitation. The awarded contractor will be expected to sign an agreement prepared by the County using this template. Please ensure that your firm has completed legal review of these contract terms. If your firm wishes to request exceptions to these standard terms, submit a Contract Exceptions Request by the Deadline for Questions, Comments and

Contract Exceptions listed in the Solicitation Schedule below. The County will consider Contract

Exceptions Requests but reserves the right to reject requested modifications to its standard terms.

7. Terms and Conditions for Receipt of Proposals

7.1. Errors, Omissions and Inquiries regarding the RFP

Proposers are responsible for reviewing all portions of this RFP. Proposers are to notify the department, in eProcurement portal, if the proposer discovers any ambiguity, discrepancy, omission, or apparent error in the RFP. Such notification should be made promptly after discovery, but in no event later than five business days prior to the deadline for receipt of proposals. Modifications and clarifications will be made by addenda as provided below.

Inquiries regarding the RFP should be lodged in eProcurement portal.

7.2. Objections to RFP Terms

Should a proposer object on any ground to any provision or legal requirement set forth in this RFP, the proposer must, not more than ten calendar days after the RFP is issued, provide written notice to the department, via eProcurement portal, setting forth with specific grounds for the objection.

7.3. Addenda

The County may cancel, revise, or reissue this RFP, in whole or in part, for any reason. Revisions will be posted as Addenda on eProcurement portal. No other revision of this RFP is valid. Proposers shall be

Page 21 of 23 Release date of June 3, 2026 responsible for ensuring that their proposals reflects any and all Addenda issued by the County prior to the proposal due date regardless of when a proposal is submitted. Therefore, the County recommends that proposers consult eProcurement portal frequently, including shortly before the proposal due date, to confirm that all Addenda have been downloaded.

7.4. Term of Proposal

Submission of a proposal signifies that the proposed services and prices are valid for the duration of the proposed agreement term and that the quoted prices are genuine and not the result of collusion or any other anti-competitive activity.

7.5. Revision or Withdrawal of Proposal

A proposer may revise a proposal on the proposer’s own initiative at any time before the deadline for submission of proposals. The proposer must submit the revised proposal in the same manner as the original on or before the proposal due date.

A proposer may withdraw a proposal at any time before the deadline for submission of proposals. After that time, whether or not a new RFP is issued for the same subject matter, withdrawal of a proposal may preclude the proposer from participating in the procurement as a proposer or subcontractor, except that an original equipment manufacturer may participate indirectly through a reseller.

7.6. Errors and Omissions in Proposal

The County will not be liable for any errors in proposals. Proposals may be rejected as unresponsive if they are incomplete, are missing pages or information, or cannot be opened for any reason. The County may waive minor irregularities, but such waiver will not modify any of the remaining RFP requirements.

7.7. No Commitment

Neither submission of a proposal nor the County’s receipt of proposal materials confers any right to the proposer nor any obligation on the County. This RFP does not commit the County to award a contract.

7.8. Financial Responsibility

The County shall have no financial responsibility for any costs incurred by a firm in responding to this

RFP or participating in any presentations or negotiations.

7.9. Estimated Quantity

If the RFP results in an indefinite quantity or a requirements agreement, the goods and services actually requested by the County may be less than the maximum value of the agreement and there is no guarantee, either expressed or implied, as to the actual quantity of goods and services that will be authorized under the agreement.

7.10. Public Record

A. General

1. All proposals, protests, and information submitted in response to this solicitation will become the property of the County and will be considered public records. As such, they may be subject to public review.

Page 22 of 23 Release date of June 3, 2026

2. Any contract arising from this RFP will be a public record.

3. The County is not seeking proprietary information and will not assert any privileges that may exist on behalf of the proposer.

4. Submission of any materials in response to this RFP constitutes:

▪ Consent to the County’s release of such materials under the Public Records Act without notice to the person or entity submitting the materials; and

▪ Waiver of all claims against the County and/or its officers, agents, or employees that the

County has violated a proposer's right to privacy, disclosed trade secrets, or caused any damage by allowing the proposal or materials to be inspected; and

▪ Agreement to indemnify and hold harmless the County for release of such information under the Public Records Act; and

▪ Acknowledgement that the County will not assert any privileges that may exist on behalf of the person or entity submitting the materials.

7.11. Reservations of Rights by the County

The issuance of this RFP does not constitute an agreement by the County that any contract will actually be entered into by the County. The County expressly reserves the right at any time to:

• Waive or correct any defect or informality in any response, proposal, or proposal procedure;

• Reject any or all proposals;

• Reissue an RFP;

• Prior to submission deadline for proposals, modify all or any portion of the selection procedures, including deadlines for accepting responses, the specifications or requirements for any materials, equipment or services to be provided under this RFP, or the requirements for contents or format of the proposals;

• Procure any materials, equipment or services specified in this RFP by any other means; or

• Determine that no project will be pursued.

7.12. No Waiver

No waiver by the County of any provision of this RFP shall be implied from any failure by the County to recognize or take action on account of any failure by a proposer to observe any provision of this RFP.

7.13. Cooperative Agreement (Piggyback)

This competitive solicitation is being conducted as a Cooperative Procurement. The services, terms and conditions of any agreement resulting from this solicitation may be used by other organizations as a

Cooperative Agreement.

Page 23 of 23 Release date of June 3, 2026

This provision in no way commits any affiliate to procure services from any awarded contractor, nor does it guarantee that any additional orders will result. At their discretion, and subject to their own procurement policies, interested organizations may make use of this competitive procurement and contract directly from the awarded contractor.

8. Protest Procedures

8.1. Protest of Non-Responsiveness Determination

Within five (5) working days of the County's issuance of a notice of non-responsiveness, any firm that has submitted a proposal and believes that the County has incorrectly determined that its proposal is non-responsive may submit a written notice of protest. Such notice of protest must be received by the County on or before the fifth working day following the County's issuance of the notice of non-responsiveness. The notice of protest must include a written statement specifying in detail each and every one of the grounds asserted for the protest. The protest must be signed by an individual authorized to represent the proposer, and must cite the law, rule, local ordinance, procedure or RFP provision on which the protest is based. In addition, the protestor must specify facts and evidence sufficient for the County to determine the validity of the protest.

8.2. Protest of Contract Award

Within five (5) working days of the County's issuance of a notice of intent to award the contract, any firm that has submitted a responsive proposal and believes that the County has incorrectly selected another proposer for award may submit a written notice of protest. Such notice of protest must be received by the

County on or before the fifth working day after the County's issuance of the notice of intent to award.

The notice of protest must include a written statement specifying in detail each and every one of the grounds asserted for the protest. The protest must be signed by an individual authorized to represent the proposer, and must cite the law, rule, local ordinance, procedure or RFP provision on which the protest is based. In addition, the protestor must specify facts and evidence sufficient for the County to determine the validity of the protest.

8.3. Delivery of Protests

All protests must be received by the due date. If a protest is mailed, the protestor bears the risk of non-delivery within the deadlines specified herein. Protests should be transmitted by a means that will objectively establish the date the County received the protest. Protests or notice of protests made orally

(e.g., by telephone) will not be considered. Protests must be delivered to:

Protests@smcgov.org

Subject: Data Exchange Framework (DxF) and Social Health Information Exchange (SHIE), 2026-RFP-00398