DOH23-027 Addendum 2.pdf

Mission:

To protect, promote and improve the health of all people in Florida through integrated state, county and community efforts.

Ron DeSantis Governor

Joseph A. Ladapo, MD, PhD

State Surgeon General

Vision: To be the Healthiest State in the Nation

Florida Department of Health Division of Administration • Bureau of General Services 4052 Bald Cypress Way, Bin B-07 • Tallahassee, FL 32399

PHONE: 850-245-4199

FloridaHealth.gov

Accredited Health Department Public Health Accreditation Board

Addendum #2 Modifications, Additions and Questions and Answers

RFP DOH23-027

HIV Prevention Minority Media Campaign

DATE: February 14, 2024

TO: Prospective Vendors

FROM: Voncelia Meeks, Procurement Officer

Florida Department of Health Central Purchasing Office

SUBJECT: Addendum #2 Modifications, Additions and Questions and Answers

The purpose of this addendum is to modify Section 3.5, Proposal Labeling, and to answer questions received in accordance with Section 2.7, Questions, of the Request for Proposal (RFP). This addendum serves as notice of the following change(s):

Deletions are indicated by “strikethrough” or reference. Additions, updates or replacements are indicated by highlighting.

A. Modifications: The following modification is made to Section 3.5, Proposal Labeling, of the RFP:

3.5 Proposal Labeling

3.5.1. Technical Proposal

The Technical Proposal should be sealed and identified as follows:

DOH23-027

Request for Proposal for HIV Prevention Minority Media Campaign Due: January 09, 2024 at 3:00 PM EST Respondent’s Name

TECHNICAL PROPOSAL

3.5.2. Cost Proposal

It is mandatory that the Respondent’s Cost Proposal be in a separate sealed envelope and identified as follows:

DOH23-027

Request for Proposal for HIV Prevention Minority Media Campaign

Questions and Answers

Due: January 09, 2024 at 3:00 PM EST Respondent’s Name

COST PROPOSAL

B. Additions: The following sections and forms are hereby incorporated to the solicitiation as mandatory requirements.

ATTACHMENT I

Data Security and Confidentiality

The Contractor, its employees, subcontractors, and agents must comply at all times with all Department data security procedures and policies during the performance of the resulting agreement as specified in this solicitation.

All Respondents must complete and submit the ATTACHMENT I, Application, Data Security, and Confidentiality form, with its bid submittal.

ATTACHMENT J

FOREIGN COUNTRIES OF CONCERN

In accordance with section 287.138, Florida Statutes, the Department may not accept a bid, proposal, or reply for a contract which would grant Respondent access to Personal Identifying Information unless the Respondent provides the Department with an attestation signed by an officer or representative of the Respondent on Form PUR 1355, “Foreign Country of Concern Attestation” Form.

All Respondents must complete and submit the ATTACHMENT J, Foreign Countries of Concern Attestation form, with its bid submittal.

C. Responses to Questions received pursuant to Section 2.7, Questions: Please see the

Department’s response to questions received by the due date outlined in Section 2.5. Timeline, of the RFP, below:

# Question Answer

What happened to RFP-07387 DOH23- 015? I submitted an intent to participate.

See the Department’s Notice of Intent to Withdraw which was advertised and may be found on the Vendor Information Portal. See the link below:

https://vendor.myfloridamarketplace.com/

2 Who is the incumbent vendor? There is no incumbent.

Page 34 and 35 do not seem to agree.

On page 34 the contract is identified as fixed price and cost reimbursement, attachment B Cost proposal is only a monthly fixed price. Do you want one set price per month that when multiplied by 12 gives you the total annual budget or do we need an additional form that outlines media spend and monthly fixed price in two different sections?

"Page 34 Attachment A, HIV Prevention Minority Media Campaign Scope of Services:

Contract, and the Provider’s price sheet, which is hereby incorporated by reference.

a. Fixed Price, Unit Cost Payments for Deliverable B.1.b.1) : Provider will be paid a fixed monthly amount as specified in Provider’s Cost Proposal (Attachment B).

b. Cost Reimbursement Payment for Deliverable B.1.b.2): Provider will be reimbursed for each media buy purchased as specified in Section B.1.b.2). Provider may seek reimbursement on a monthly basis for the actual costs incurred.

Yes, a monthly unit price is required on Attachment B, Price Page. This fixed price, unit cost applies to the provision of the monthy campaign as specified in B.1.a.1 through B.1.a.12.

No, Attachment B, Price Page, is the only pricing structure required for the Reply process.

When invoicing, the the respondent will also be required to provide itemized documentation for cost reimbursement, as specified in Section B.1 b.2 https://vendor.myfloridamarketplace.com/

2. Unit of Service: A unit of service will consist of one month of completed deliverables specified in Section B.1.b.1. A month of deliverables will include all deliverables due in that month, including any quarterly or annual deliverables scheduled for delivery in a particular month.

3. Invoice Requirements: Provider must submit a properly completed invoice via email to the Department’s Contract Manager within 15 calendar days of completing each deliverable as specified. At a minimum, each invoice must be submitted on the Provider’s letterhead, contain a description of all deliverables for the invoice period, number of units delivered per deliverable, total amount due, total invoice amount, invoice number, invoice date, and period of services."

Are website hosting and application fees included in B.1.b.2) media reimbursement?

Yes.

Is it the case that all, production, travel, and resources required to perform the contract come out of B. 1. b. 1) and are not direct reimbursement items but fall under the monthly fixed price?

Yes.

I received the below RFP which we would be a great fit for as part of the media. We would not be the ones to put the whole plan together, just a piece of it. How do we go about incorporating ourselves to help in Hillsborough County specifically?

The Department intends to make a single award for this statewide campaign. See Section 2.8, Basis of Award, of the RFP. The Department encourages all prospective Respondents to read the RFP in its entirety to ensure that all requirements are met when responding to this RFP.

At your convenience, can you provide the submissions (technical and cost proposals) of all the firms who

This can be obtained through a public record request.

submitted on DOH22-049 and DOH23- 015?

Attachment G - Evaluation Criteria Page 45- Regarding the requirement for a "qualified, experienced account executive in Tallahassee to manage the campaign," will the government clarify whether the proposed account executive is required to reside in Tallahassee or be available as needed to support the project in Tallahassee (i.e. attend meetings, etc.)?

The account executive must be available in Tallahassee for in person meetings as needed, per Attachment A, Section B.1.a.1). However, the Department does not specify a residential location and does not require the account manager to reside in Tallahassee.

Attachment G - Evaluation Criteria Page 44-45 Re: Evaluation Criteria #7 and #8, the revised RFP has removed the requirement to provide "at least 5 years of experience" developing, implementing, and evaluating public health campaigns (#7) and developing tailored messaging and creative concepts for designated market areas (#8). However, Attachment H requires offerors to provide at least 5 years of experience across each experience area. Will the government provide an updated Attachment H to remove the requirement for at least 5 years of experience across each experience area in alignment with the revised evaluation criteria?

No. The 5 years of experience requirements are specified in Section 3.3.2.1.3 Tab 2 – Technical Proposal, of the RFP and are related to evaluation criteria 1-6. The evaluation criteria 7 and 8 are related to Section 3.3.2.1.1 and 3.3.2.1.2

The Department encourages all prospective Respondents to read the RFP DOH23-027 in its entirety to ensure that all requirements are met when responding to this RFP.

10 Attachment A - Scope of Services, Section B.1.a.1 Page 22 Will the government clarify whether the account executive is expected to be available on a part-time or full-time basis?

The Department requires the account executive be available in Tallahassee for in person meetings and discussions as needed to meet the requirements of this RFP.

11 Pg 12 3.5 Proposal Labeling 3.5.1.

Technical Proposal The Technical Proposal should be sealed and identified as follows: DOH23-027 Request for Proposal for HIV Prevention Minority Media Campaign Due: January 09, 2024 at 3:00 PM EST Respondent’s Name TECHNICAL PROPOSAL 3.5.2. Cost Proposal It is mandatory that the Respondent’s Cost Proposal be in a separate sealed envelope and identified as follows:

DOH23-027 Request for Proposal for HIV Prevention Minority Media Campaign Due: January 09, 2024 at 3:00 PM EST Respondent’s Name COST PROPOSAL. Is this the way you want the packaging label? With January date?

No. See Addendum #2, Section A. Modifications, modifying Section 3.5, Proposal Labeling of the RFP. Please refer to the RFP, Section 2.5, Timeline for submission deadlines, and any future addenda regarding any changes made to submission deadlines.

12 TAB 2: 3.3.2.1.1 -Should the organizational table and bios that are asked for in the following question:

(Describe the Respondent’s history developing, implementing, and evaluating Public Health media campaigns) be for the experience / campaigns described in the past public health media campaigns, or for the RFP HIV minority media campaign?

Section 3.3.2.2.1 refers to general public health media campaign experience.

13 TAB 2: 3.3.2.1.2 -Please define designated market areas; Is that different from priority populations designated by DOH?

Designated market areas is a standard marketing industry term. See Section A.2., Definition of Terms, for the Department’s official definitions related to this RFP.

14 How is 3.3.1.9 from TAB 1 different from the 3.3.21 in TAB 2?

Section 3.3.1.9 specifically refers to the Respondent Experience Form (Attachment H) as a mandatory requirement. Section 3.3.2.1 outlines the Respondent’s Executive Overview which is included as part of the Technical Proposal, Section 3.3.2.

15 ATTACHMENT A: Does the account executive need to reside in Tallahassee or available to travel to Tallahassee?

See the answer to question 8.

16 ATTACHMENT A: TASK LIST B -●

Can you confirm that all creative assets and media plan(s) are in English and Spanish

See Attachment A, B.1.a.3 regarding all language requirements.

Spanish translation is specifically addressed in B.1.a.2.a.4.b and also B.1.a.2.b.7 which is where the task(s) identify a Spanish dialect.

17 ATTACHMENT A: TASK LIST PART 5

-Is the website campaign-specific, intended more as a microsite within the DOH site, or a standalone site?

The website should be a standalone site.

ATTACHMENT B: COST PROPOSAL -

● To confirm, is the $5,000,000 available for MEDIA SPEND ONLY or should the $5M budget cover media spend, agency fees and production cost for all deliverables?

● Does the Respondent need to show a cost breakout or just provide the total sum cost? For cost proposal, should the monthly unit price include media spend?

● The expectation that the agency pays media vendors upfront on the client’s behalf, to be reimbursed after the fact?

● Can media be gross to cover agency fees for media and finance teams?

The anticipated total annual amount is approximately $5,000,000.00, subject to the availability of funds, and is inclusive of all costs.

No, see Attachment B Price Page, Cost Proposal, which only captures the fixed price for the monthly provision of services. The cost reimbursement for media spend is not included and will be reimbursed separately, however the total amount can not exceded $5,000,000.00 for both fixed price payments and media spend reinbursement See the answer to question 3.

No, it is not the expectation of the Department to provide advance payments.

The Department is unclear regarding the meaning of the last question and cannot provide an official answer at this time.

ATTACHMENT H: SUMMARY OF

EXPERIENCE

Please clarify the difference between Criteria #2 (Developing and implementing marketing and media plans) and Criteria #3 (Managing multi-media campaigns)

Media plans are one component of a media campaign. Criteria #2 is about plans and Criteria #3 is about managing campaigns as a whole.

Is there an incumbent firm for this campaign? If so, has the agency been satisfied with the vendor's performance?

There is no current incumbent.

Why was the previous solicitation (DOH23-015) not evaluated and reissued as this current one (DOH23- 027)?

Any decisions regarding a previous solicitation were made in the best interest of the Department at that time.

Failure to file a protest within the time prescribed in section 120.57(3), Florida Statutes, or failure to post the bond or other security required by law within the time allowed for filing a bond shall constitute a waiver of proceedings under Chapter 120, Florida Statutes.

ATTACHMENT I

APPLICATION, DATA SECURITY, AND CONFIDENTIALITY

Request for Proposal

(Provider’s Name)

This attachment is for the purpose of ensuring that adequate information security protection is in place at all times during this contract between the Department of Health (hereinafter referred to as “the Department”), and service providers, vendors, and information trading partners, all referenced hereinafter together referred to as “Providers” in this attachment. It is not comprehensive in its scope, but rather is supplemental guidance to standard contracts, purchase orders, and statements of work, to assure the confidentiality, integrity, and availability of information technology (IT) assets and adherence to statutory obligations at a summary level.

In this attachment, State Data means any electronic information including, but not limited to, records, files, computer programs, and databases owned by the state of Florida.

1. Hosting Data or Applications – This section applies to all contracts whereby a Provider is hosting data, or hosting an application that processes data, on behalf of the Department. Provider will comply with the following:

a. Provider, its employees, subcontractors, and agents will comply with all Department security and administrative requirements in the performance of this contract. Provider will provide immediate notice to the Department’s Information Security Manager (ISM), or their designee, in the event it becomes aware of any security breach and any unauthorized transmission of State Data as described below or of any allegation or suspected violation of security requirements of the Department.

b. Upon contract execution, produce a current security audit (no more than 12 months old) performed by a third party that is certified to perform such audits that demonstrate the use of sound security measures and practices by the provider hosting the data or application that is processing data, as defined by a nationally recognized security framework. Provider will produce the status of any corrective action plans underway to address deficiencies found in the security audit. Provider must provide an annual update on any open corrective action plans associated with the most recent audit’s noted deficiencies. The Department has the right to require the Provider to produce a new or updated audit every three years or as deemed reasonably necessary by the Department, during the contract term, at Provider’s expense.

c. At the request of the Department in lieu of or in combination with the requirements of 1.b.

above, Provider will obtain an American Institute of Certified Public Accountants (AICPA) “Standards for Attestation Engagements (SSAE) System and Organizations Controls (SOC) Report 2, Type 2” which shall have been performed within 12 months prior to the date of contract execution.

d. Data Loss Prevention: Provider will perform periodic backups of all data (files, programs, databases, electronic records, etc.) hosted by Provider on behalf of the Department sufficient to ensure no data loss occurs, and that data will be restored from backup when necessary, at the Provider’s sole expense. In the event of loss of any State Data or records, where such loss is due to the negligence of Provider or any of its subcontractors or agents, the Department may be entitled to sanctions by law or financial consequences per the Contract.

e. In the event of a breach of any State Data where such breach is due to the negligence of Provider or any of its subcontractors or agents, the Department may be entitled to sanctions by law or financial consequences per the Contract. Provider may be subject to administrative sanctions for failure to comply with section 501.171, Florida Statutes, for any breach of data, due to a failure to maintain adequate security, and responsible for any costs to the Department for the breach caused by Provider. For purposes of this attachment, a breach is defined as a confirmed event that compromises the confidentiality, integrity, or availability of information or data.

f. Data Protection: No State Data or information will be stored in, processed in, or shipped to offshore locations or outside of the United States of America, regardless of method, except as required by law or approved by the Department’s agency head or designee in writing. Provider may request an exemption from the offshoring of State Data or information outside of the United States of America prohibition by submitting a request in writing to the Department’s agency head or designee, prior to the exemption being granted. Regardless of location, data storage technologies including encryption requirements must be reviewed and approved by the Department prior to State data being stored, processed, or transmitted by the Provider.

g. Access to State Data will only be available to approved and authorized Provider staff. Even when using approved technologies, requests for access from outside the United States will be submitted in accordance with the Department’s established processes and will only be allowed with express written approval from the Department’s Deputy Secretary of Operations. Third parties may be granted time-limited terminal or other remote service access to IT resources as necessary for the fulfillment of related responsibilities with prior written approval by the ISM.

When remote access needs to be changed, the ISM will be promptly notified in writing.

Regardless of location, data access and transmission technologies including encryption requirements must be reviewed and approved by the Department prior to State data being stored, processed, or transmitted by the Provider.

h. Notice Requirement: Provider will notify the Department upon detection of anomalous or malicious traffic that may compromise the confidentiality, integrity, or availability of the contracted services. To the extent applicable, failure to notify the Department of events or incidents that result in breach will subject Provider to legal sanctions, financial consequences per the contract, and/or any costs to the Department of such breach of security.

i. Data Retention: Provider must retain data as follows:

(1) Copies: At contract termination or expiration, submit copies of all finished or unfinished documents, data, studies, correspondence, reports, and other products prepared by or for Provider under the contract; submit copies of all State Data to the Department in a format to be designated by the Department in accordance with section 119.0701, Florida Statutes; shred or erase parts of any retained duplicates containing personal information to make the personal information unreadable.

(2) Originals: At contract termination or expiration--retain its original records, and maintain, in confidence to the extent required by law, Provider’s original records in un-redacted form, until the records retention schedule expires and to reasonably protect such documents and data during any pending investigation or audit.

(3) Both Copies and Originals: Upon expiration of all retention schedules and audits or investigations and upon notice to the Department, destroy all State Data from Provider’s systems including, but not limited to, electronic data and documents containing personal information or other data that is confidential and exempt under Florida public records law.

(4) Return of State Data: In the event this contract is terminated for cause, Provider shall return all State Data or information to the Department within 14 days from the date of termination unless a lesser period is agreed upon by the parties in writing.

2. Application Provisioning – This section applies to all contracts whereby a Provider is making available a software application to be used by the Department for collecting, processing, reporting, and storing data. Provider’s software application used for the Department’s automation and processing must support, and not inhibit, each of the following Department security requirements:

a. Identity and Access Management must support the following accountability principles:

(1) Individual users must never share credentials. Service and utility accounts will be carefully provisioned and monitored.

(2) User sessions will automatically timeout after a maximum of 10 minutes of inactivity, requiring re-authentication.

(3) Passwords and Secrets must be encrypted or secured by other means when stored or in transit and will not be stored or passed in plain text.

(4) Audit records will allow actions of users and utility accounts to be uniquely traced by a minimum of account, action, and date.

(5) Allow role-based access or other methods to enforce least-privilege and authorized access principles based on system requirements.

(6) Support Azure Active Directory integration (normally OpenID Connect) for authentication of DOH end users.

(7) If provision (6) is not reasonably feasible, an exception may be granted by submitting a request in writing to the Department’s agency head or designee, prior to the exception being granted. If so, the following requirements must be met:

a) User accounts must be authenticated at a minimum by a complex password constructed as follows: a minimum of 10 characters to include an upper and lowercase letter, a number, and a special character.

b) Users must change their passwords at a maximum of every 90 days.

c) Accounts must be locked after a maximum of 10 incorrect attempts.

d) Multi-Factor (MFA) authentication will be enforced for any access to any system containing confidential and/or exempt data.

b. User accounts will be deactivated and archived for accountability purposes upon non-use of account for 60 consecutive days, or under direction of the Department if account self-management has not been provided to Department personnel.

3. Data Interchange – This section applies to contracts whereby the Department will be sending data transmissions to, or receiving data transmissions from, a Provider for the purpose of independent processing. Examples include: sending laboratory orders to a laboratory, receiving laboratory results, sending billing information to a clearing house, receiving billing results or notification of payment, sending vital statistics to the Social Security Administration, sending physician licensing information to Florida’s Agency for Health Care Administration, receiving continuing education credit information for medical profession licensees, etc. Data interchange contracts must have a data-sharing agreement in place. Provider will comply with the following:

a. Follow all Department and State of Florida data encryption standards regarding the transmission of confidential or confidential and exempt information between the Department and the Provider.

The Provider’s documented encryption standards will be provided upon request. All transmission of confidential or confidential and exempt data must utilize protected protocols approved by the Department.

b. Use of any connection to the Department’s network will be for retrieving information delivered by the Department, or sending data to the Department, and not for any other access to resources on the Department’s network.

c. Protect and maintain the confidentiality of all data, files, and records, classified by the Department as confidential or confidential and exempt, retrieved from the Department pursuant to this agreement. Provider will immediately notify the Department’s ISM of any loss or breach of information originating from the Department and retrieved by Provider.

4. All IT Services – This section applies to all contracts whereby a Provider is providing IT services to the Department.

a. Provider will protect and maintain the confidentiality of all data, files, and records, deemed to be confidential or confidential and exempt, acquired from the Department pursuant to this Contract.

b. Provider will not divulge to third parties any confidential information obtained by the Provider or its agents, distributors, resellers, subcontractors, officers, or employees while performing contract work, including, but not limited to, security design or architecture, business operations information, or commercial proprietary information in the possession of the state or the Department unless:

(1) Provider is required by law or legal process to share such confidential information and written notice is provided to the Department prior to disclosure; or

(2) The Department submits a written request to the Provider to share such confidential information with a Department-designated third party.

ATTACHMENT J

FOREIGN COUNTRIES OF CONCERN

DOH23-027

This form must be completed by an officer or representative of an entity submitting a bid, proposal, or reply to, or entering into, renewing, or extending, a contract with a Governmental Entity which would grant the entity access to an individual’s Personal Identifying Information.

Capitalized terms used herein have the definitions ascribed in Rule 60A-1.020, F.A.C.

Name of entity is not owned by the government of a Foreign Country of Concern, is not organized under the laws of nor has its Principal Place of Business in a Foreign Country of Concern, and the government of a Foreign Country of Concern does not have a Controlling Interest in the entity.

Under penalties of perjury, I declare that I have read the foregoing statement and that the facts stated in it are true.

Printed Name:

Title:

Signature: Date:

https://www.flrules.org/gateway/RuleNo.asp?title=GENERAL%20REGULATIONS&ID=60A-1.020