DOH24-010 - BPH IT Hosting .pdf

Version 8/2024

TITLE PAGE

FLORIDA DEPARTMENT OF HEALTH

DOH24-010

2.2018

REQUEST FOR PROPOSAL (RFP)

FOR

Division of Emergency Preparedness and Community Support (DEPCS) IT Hosting

Services

Respondent Name:

Respondent Mailing Address:

City, State, Zip:

Phone: Fax Number:

E-Mail Address:

Federal Employer Identification Number (FEID):

BY AFFIXING MY SIGNATURE ON THIS PROPOSAL TITLE PAGE, I HEREBY STATE THAT I

HAVE READ THE ENTIRE RFP TERMS, CONDITIONS, PROVISIONS AND SPECIFICATIONS

AND ALL ITS ATTACHMENTS, INCLUDING THE REFERENCED PUR 1000 AND PUR 1001.

I hereby certify that my company, its employees, and its principals agree to all of the terms, conditions, provisions and specifications during the competitive solicitation and any resulting

Contract including those contained in the Standard Contract.

Signature of Authorized Representative:

Printed (Typed) Name and Title:

*An authorized representative is an officer of the respondent’s organization who has legal authority to bind the organization to the provisions of the Proposals. This usually is the President, Chairman of the Board, or owner of the entity. Documentation establishing delegated authority must be included with the Proposal if signed by other than the authorized representative.

Request for Proposal DEPCS IT Hosting Services

Page | 2

TABLE OF CONTENTS

SECTION 1.0: Introduction

SECTION 2.0: Procurement Rules and Information

SECTION 3.0: Instructions for Proposal Submittal

SECTION 4.0: Special Conditions

SECTION 5.0: Proposal Evaluation Process and Criteria…………………………………….

ATTACHMENT A: Scope of Services

ATTACHMENT B: Cost Proposal

ATTACHMENT C: Evaluation Criteria

ATTACHMENT D: Prior Experience Form

ATTACHMENT E: Statement of Non-Collusion

ATTACHMENT F: Respondent Certification Regarding Scrutinized Companies List……

ATTACHMENT G: Identical Tie Certification…………………………………….……………

ATTACHMENT H: Vendor Certification (PUR 7801) ………………………………………..

ATTACHMENT I: Forced Labor Certifications (PUR 2024) ……………….……..……..….

ATTACHMENT J: Foreign Countries of Concern Attestation (PUR 1355) ……………….

ATTACHMENT K: Application, Data Security, and Confidentiality……………….……..…

ATTACHMENT L: HIPAA Business Associate Agreement…………………………….…...

ATTACHMENT M: Background Screening and Drug Screening Attestation……………..

DEPCS IT Hosting Services

Page | 3

SECTION 1.0 INTRODUCTION

1.1 Statement of Purpose

The Department of Health (the Department) is requesting proposals for managed hosting services and equipment required to support the Bureau of Public Health Pharmacy’s

(BPHP) online software systems and the Department’s Division of Emergency

Preparedness and Community Support (DEPCS).

1.2 Legal Authority

Chapter 287.057, Florida Statutes and 381.0203, Florida Statutes.

1.3 Scope of Services

A detailed scope of services for this solicitation is provided as Scope of Services (Attachment A) in this RFP.

1.4 Incorporation by Reference

The PUR 1001, General Instructions to Respondents (PUR 1001), and PUR 1000, General

Contract Requirements (PUR 1000), are hereby incorporated by reference to the terms of this solicitation. Refer to Sections 3.1 and 4.1 of this RFP for further detail.

1.5 Solicitation Definitions

In addition to the definitions in the PUR 1000 and PUR 1001, and the Scope of Services (Attachment A), the following definitions also apply to this RFP:

Business Days: Monday through Friday, excluding state holidays.

Business Hours: 8:00 a.m. to 5:00 p.m., Eastern Time on all business days.

Calendar Days: All days, including weekends and holidays.

Contract: The formal agreement that will be awarded to the successful Respondent under this RFP, unless indicated otherwise.

Department: The Department of Health; may be used interchangeably with DOH.

Minor Irregularity: As used in the context of this solicitation, indicates a variation from the RFP terms and conditions which does not affect the price of the Proposal, or give the Respondent an advantage or benefit not enjoyed by other Respondents, or does not adversely impact the interests of the Department.

Proposal: The complete written response of the Respondent to the RFP (technical and cost proposals), including properly completed forms, supporting documents, and attachments.

DEPCS IT Hosting Services

Page | 4

Respondent: The business entity that submits a proposal.

Respondent: The successful Respondent awarded a contract by the Department in accordance with the terms of this RFP.

State: State of Florida.

Vendor Information Portal (VIP): Refers to the State of Florida’s internet-based vendor information system, which is available at: https://vendor.myfloridamarketplace.com.

Where there is a conflict between a definition in this solicitation, Section 1.5, above, and the definition in Scope of Services (Attachment A), the definition in this solicitation will prevail when the term is used in this solicitation. The definition in the Scope of Services (Attachment A), will prevail when the term is used in the Scope of Services (Attachment A).

https://vendor.myfloridamarketplace.com/

DEPCS IT Hosting Services

Page | 5

SECTION 2.0 PROCUREMENT RULES AND INFORMATION

2.1 Procurement Officer

The Procurement Officer assigned to this solicitation is:

Florida Department of Health Attention: Voncelia Meeks 4052 Bald Cypress Way, Bin B07 Tallahassee, FL 32399-1749 Email: voncelia.meeks@flhealth.gov

******ALL EMAILS TO THE PROCUREMENT OFFICER MUST CONTAIN THE

SOLICITATION NUMBER IN THE SUBJECT LINE OF THE EMAIL*************

2.2 Restrictions on Communications

Pursuant to section 287.057(23), Florida Statutes, Respondents to this solicitation or persons acting on their behalf may not contact, between the release of the solicitation and the end of the 72-hour period following the agency posting the notice of intended award, excluding Saturdays, Sundays, and state holidays, any employee or officer of the executive or legislative branch concerning any aspect of this solicitation, except in writing to the Procurement Officer listed in Section 2.1., above. Violation of this provision may be grounds for rejecting a Proposal.

2.3 Term

It is anticipated that the Contract resulting from this RFP will be for five years, beginning October 01, 2025, or the Contract execution date whichever is later, subject to renewal as identified in Section 2.4. The Contract resulting from this RFP is contingent upon availability of funds.

2.4 Renewal

The Contract resulting from this solicitation may be renewed. Renewals may be made on a yearly basis for no more than three years beyond the initial contract, or for the term of the original contract, whichever is longer. Renewals must be in writing, subject to the same terms and conditions set forth in the initial Contract and any written amendments signed by the parties. Renewals are contingent upon satisfactory fiscal and programmatic performance evaluations as determined by the Department and are subject to the availability of funds.

2.5 Timeline

EVENT DUE DATE LOCATION

RFP Advertised / Released

July 22, 2025 Posted to the Vendor Information Portal at:

https://vendor.myfloridamarketplace.com mailto:voncelia.meeks@flhealth.gov

DEPCS IT Hosting Services

Page | 6

Questions Submitted in

Writing

Must be received

PRIOR TO:

August 04, 2025

Submit to: Florida Department of Health Central Purchasing Office

Attention: Voncelia Meeks Suite 310 4052 Bald Cypress Way, Bin B07 Tallahassee, FL 32399-1749 E-mail: voncelia.meeks@flhealth.gov

Answers to Questions

(Anticipated Date)

August 11, 2025 Posted to Vendor Information Portal at:

https://vendor.myfloridamarketplace.com

Sealed Proposals Due and Opened

Must be received PRIOR to:

August 19, 2025, at

3:00 PM

PUBLIC OPENING

Florida Department of Health Central Purchasing Office Attention: Voncelia Meeks Suite 310 4052 Bald Cypress Way, Bin B07 Tallahassee, FL 32399-1749

Evaluation of Proposals

(Anticipated Date)

August 25 - 29, 2025 Evaluation Team Members to begin evaluations individually.

Posting of Intent to Award (Anticipated

Date)

September 09, 2025 Posted to the Vendor Information Portal at:

https://vendor.myfloridamarketplace.com

2.6 Addenda

If the Department finds it necessary to supplement, modify, or interpret any portion of the solicitation during the procurement process, a written addendum will be posted on the VIP.

It is the responsibility of the Respondent to be aware of any addenda that might affect this RFP or their Proposal.

2.7 Questions

This provision takes precedence over General Instruction #5 in PUR1001.

Questions related to this solicitation must be received, in writing (either via United States Postal Service, courier, e-mail, or hand-delivery), by the Procurement Officer identified in Section 2.1, within the time indicated in Section 2.5. Verbal questions or those submitted after the period specified in Section 2.5 will not be addressed.

Answers to questions submitted in accordance with Section 2.5 will be posted on the

VIP.

DEPCS IT Hosting Services

Page | 7

2.10 Basis of Award

A single award will be made to the responsive, responsible Respondent offering the most advantageous Proposal through the evaluation of proposals in accordance with Section

5.2. The Department reserves the right to not make an award under this RFP, as determined to be in the best interest of the State.

2.11 Identical Tie Proposals

In the event the Department’s evaluation results in identical scoring outcomes between two or more Respondents, the Department will provide the Identical Tie Certification, Attachment G, form for the affected Respondents to complete. If one or more Respondents are entitled to the certified veteran business enterprise preference specified in section 295.187, Florida Statutes, and one or more business entitled to this preference or another preference provided by law submit bids, proposals, or replies for procurement of commodities or contractual services which are equal with respect to all relevant considerations, including price, quality, and service, the Department will award the procurement or contract to the business having the smallest net worth. If one or more Respondents has the certified veteran preference, it and any other vendor entitled to another preference provided by law will be requested by the Department to submit Respondents net worth.

In the event the Department is unable to select a Respondent using the Tie Breaker Criteria specified in Attachment F, and the net worth criteria above, or if the net worth criteria above does not apply, then, the affected Respondent(s) name will be placed in a container for the Department’s Procurement Officer to randomly select the awardee of this solicitation. The date, time, and location will be posted on VIP.

2.12 Modifications and Withdrawal

A Respondent may modify or withdraw its Proposal at any time prior to the submittal deadline, as specified in Section 2.5, by submitting a request to the Procurement Officer.

Requests for modification or withdrawal of a submitted Proposal must be in writing and signed by an authorized signatory of the Respondent. Upon receipt and acceptance of such a request, the entire Proposal will be returned to the Respondent and will not be considered unless resubmitted by the Proposal due date and time.

2.13 Clarification Process

The Department may request clarification from the Respondent to resolve ambiguities or questioning information (i.e., minor irregularities) presented in its Proposal. Clarifications may be requested throughout this procurement process. The Respondent’s answers to requested clarifications must be in writing and must address only the information requested. The Respondent’s answers to requested clarifications must be submitted to the Department within the time specified by the Department.

2.14 Contract Formation

The Department will enter into a Contract with the awarded Provider pursuant to Section 2.10, Basis of Award. The Contract will incorporate the terms of the Scope of Services (Attachment A), the Department’s Standard Contract, and the awarded Provider’s Cost Proposal (Attachment B).

DEPCS IT Hosting Services

Page | 8

SECTION 3.0 INSTRUCTIONS FOR PROPOSAL SUBMITTAL

3.1 General Instructions to Respondents (PUR 1001)

The General Instructions to Respondents (PUR 1001) is incorporated by reference in this solicitation. This document should not be returned with the Proposal. The PUR 1001 is located at http://dms.myflorida.com/content/download/2934/11780.

The terms of this solicitation control over any conflicting terms of the PUR 1001.

3.2 Proposal Format

This section describes the format in which Proposals are to be submitted. The Department discourages lengthy Proposals. Additional information deemed appropriate by the Respondent may be included but should be placed within the relevant section. Additional tabs beyond those designated in Section 3.3 will not be evaluated.

Proposals should be limited to a page size of 8.5” x 11” inches. Font size and style are at the Respondent’s discretion but must be at least 11 point. All pages must be sequentially numbered, and one-inch margins should be used.

All Proposals must contain the sections outlined below. Those sections are called “Tabs.” A “Tab”, as used herein, is a section separator, offset and labeled, so each Department Evaluator can easily turn to “Tabbed” sections during the evaluation process.

3.3 Proposal Contents

It is a mandatory requirement of this RFP that the Proposal contain the specified documents and address all items listed below. Proposals to this RFP should be prepared using simple terms and minimal technical or industry specific language. The Respondent must organize its Proposal submittal contents as follows:

3.3.1. TAB 1 – Mandatory Requirements

Respondents must complete and submit the following mandatory information or documentation as part of their Proposal by the time specified in Section 2.5. Any Reply which does not contain the information below will be deemed non-responsive to this RFP:

3.3.1.1 Minimum Experience and Qualifications: Respondents must provide with their Proposal a resume/CV or written summary that demonstrates the following:

3.3.1.1.1 The Respondent must have a minimum of ten (10) years of experience in information technology media buying, production, interactive web, and public relations.

http://dms.myflorida.com/content/download/2934/11780

DEPCS IT Hosting Services

Page | 9

3.3.1.1.2 The Respondent must have a minimum of five (5) years of experience in business process in the general medical fields with a focus in pharmaceuticals.

3.3.1.1.3 The Respondent must have a minimum of ten (10) years of experience in the development of web applications using the following languages and tools: ASP.NET, Microsoft SQL, Cascading Style Sheets, HTML, XML, JavaScript, AJAX, and IIS.

3.3.1.1.4 The Respondent must have a minimum of eight (8) years of experience in Pharmaceutical Forms System (PFS).

3.3.1.1.5 At the time of contract execution, the Respondent must have the equipment outlined in Attachment A section B.1.a.1.b. to perform the services or equivalent as approved by the Department.

3.3.1.2 Proposals must be received by the time specified in the Timeline, Section 2.5.

3.3.1.3 Proposals must be received in the format specified in Section 3.2.

3.3.1.4 Copies of the Proposals must be received as specified in Section 3.3.

3.3.1.5 The Title Page of this RFP must be completed, signed and returned with the Technical Proposal.

3.3.1.6 Cost Proposal (Attachment B) must be completed as specified in Section 3.4.2

3.3.1.7 Prior Experience Form (Attachment D) as specified in Section 3.9.

3.3.1.8 Statement of Non-Collusion (Attachment E), as specified in Section 4.3.

3.3.1.9 Respondent Certification Regarding Scrutinized Companies Lists (Attachment F), as specified in Section 4.2.

3.3.1.10 Identical Tie Certification form (Attachment G), as specified in Section 2.11.

3.3.1.11 Vendor Certification (PUR 7801) (Attachment H) must be completed and submit with the Proposal.

3.3.1.12 Forced Labor Certifications (PUR 2024) (Attachment I) as specified in Section 4.7.

3.3.1.13 Foreign Countries of Concern Attestation (PUR 1355)

(Attachment J) as specified in Section 4.8.

DEPCS IT Hosting Services

Page | 10

3.3.1.14 Application, Data Security, and Confidentiality (Attachment K) as specified in Section 4.9.

3.3.1.15 Background Screening and Drug Screening Attestation

(Attachment N), as specified in Section 4.13.

3.3.1.16 HIPAA Business Associate Agreement (Attachment L), as specified in Section 4.12.

3.3.1.17 Security Operation Controls (SOC2 Type 2) Certification, as specified in Section 3.10.

3.3.2 TAB 2 – Technical Proposal

The Respondent must provide a narrative of the information listed below.

Respondents should be thorough and detailed in their responses and are encouraged to include any additional relevant information that would assist in the evaluation of their Proposal. The Respondent must include:

3.3.2.1 Executive Overview: Ensure the overview includes the following:

3.3.2.1.1 Describe the Respondent’s understanding of the scope of services included in this RFP, as well as the proposed approach for implementing the requested services.

3.3.2.1.2 Describe the Respondent’s ability to provide the colocation facility and services as specified in Attachment A.

3.3.2.1.3 Describe the Respondent’s ability to provide backup and recovery services as specified in Attachment A.

3.3.2.1.4 Describe the Respondent’s ability to monitor PCI, HIPAA, SOC2, Uptime, and Application errors as specified in Attachment A.

3.3.2.1.5 Describe the Respondent’s ability to meet the hardware and virtual resource requirements specified in attachment A, along with any additional details regarding the implementation of these resources as expected at the time of contract execution.

3.3.2.2 Respondent must fully describe in its Proposal its plan for carrying out each requirement identified in the Scope of Services (Attachment A).

3.3.3 TAB 3 – Cost Proposal (Sealed Separately)

The Respondent must separate the Cost Proposal (Attachment B) as described in Section 3.4.2.

DEPCS IT Hosting Services

Page | 11

3.4 Copies of Proposals

Respondents must submit the following copies:

3.4.1. Technical Proposal

One original and one paper copy of the Technical Proposal must be submitted no later than the date and time set forth in Section 2.5, the Timeline. In addition, one original copy on a single USB storage device viewable in Adobe Acrobat Reader (PDF) must be submitted. The electronic copy submitted must contain the entire Technical Proposal as the submitted original copy, including all supporting and signed documents.

The PDF electronic copy of the “original” Technical Proposal will be considered the control if there are any differences between the paper and electronic copies.

Refer to Section 3.8 for information on redacting confidential information, if applicable.

Respondents must not disclose cost information in the body of the Technical Proposal. Including cost information will cause the Proposal to be disqualified (Mandatory Requirement, refer to Section 3.3.1).

3.4.2. Cost Proposal

One original copy of the Cost Proposal (Mandatory Requirement, refer to Section 3.3) must be submitted using Cost Proposal (Attachment B) no later than the date and time set forth in the timeline.

The Cost Proposal (Attachment B) must be enclosed in a separate sealed envelope and must be identified in accordance with Section 3.5. No additional documentation should be included in the Cost Proposal envelope.

3.5 Proposal Labeling

3.5.1. Technical Proposal

The Technical Proposal should be sealed and identified as follows:

DOH24-010

Request for Proposal for DEPCS IT Hosting System Due:

Respondent’s Name

TECHNICAL PROPOSAL

3.5.2. Cost Proposal

It is mandatory that the Respondent’s Cost Proposal be in a separate sealed envelope and identified as follows:

DEPCS IT Hosting Services

Page | 12

DOH24-010

Request for Proposal for DEPCS IT Hosting System Due:

Respondent’s Name

COST PROPOSAL

3.5.3. All proposals must be sent or delivered to the Department of Health, Central Purchasing Office, 4052 Bald Cypress Way, Bin B07, Tallahassee, Florida 32399.

3.6 Instructions for Submittal

3.6.1. Respondents must complete, sign, and return the “Title Page” with the Proposal submittal.

3.6.2. Respondents must complete, sign, and return the “Cost Proposal” in a separate sealed envelope with the Proposal submittal.

3.6.3. Respondents must submit all technical and cost data in the formats specified in the RFP.

3.6.4. Proposals must be sent via mail, courier, or hand delivered to the location indicated in Section 2.5., the Timeline.

3.6.5. Proposals submitted via electronic mail (email) or facsimile will not be considered.

3.6.6. The Department is not responsible for improperly marked proposals.

3.6.7. It is the respondent’s responsibility to submit its response at the proper place and time indicated in Section 2.5., the Timeline.

3.6.8. The Department’s clocks will provide the official time for Proposal receipt.

3.6.9. Materials submitted will become the property of the State of Florida and accordingly, the state reserves the right to use any concepts or ideas contained in the response.

3.7 Cost of Preparation

Neither the Department nor the State is liable for any costs incurred by a Respondent in responding to this solicitation.

3.8 Public Records and Trade Secrets

Notwithstanding any provisions to the contrary, public records must be made available pursuant to the provisions of the Public Records Act. If Respondent considers any portion of their Proposal to this solicitation to be confidential, exempt, trade secret, or otherwise not subject to disclosure pursuant to Chapter 119, Florida Statutes, the Florida Constitution, or any other authority, Respondent must segregate and clearly mark the document(s) as “CONFIDENTIAL”.

Simultaneously, Respondent will provide the Department with a separate redacted paper and electronic copy of their Proposal and briefly describe in writing the grounds for

DEPCS IT Hosting Services

Page | 13 claiming exemption from the public records law, including the specific statutory citation for such exemption. This redacted copy must contain the solicitation name, number, and the name of Respondent on the cover, and must be clearly titled “REDACTED COPY”.

The redacted copy must be provided to the Department at the same time Respondent submits its Proposal and must only exclude or obliterate those exact portions which are claimed confidential, proprietary, or trade secret. Respondent will be responsible for defending its determination that the redacted portions of their Proposal are confidential, trade secret, or otherwise not subject to disclosure. Further, Respondent must protect, defend, and indemnify the Department for all claims arising from or relating to the determination that the redacted portions of their Proposal are confidential, proprietary, trade secret, or otherwise not subject to disclosure. If Respondent fails to submit a redacted copy with their Proposal, the Department is authorized to produce the entire documents, data, or records submitted by Respondent in answer to a public records request for these records.

3.9 Prior Experience Form

Respondents must provide contact information for three entities the Respondent has provided services of a similar size and nature of those requested in this solicitation.

Respondents must use Attachment D, Prior Experience Form of this RFP to provide the required information. The Department reserves the right to contact any and all entities in the course of this solicitation in order to verify experience.

3.10 Licenses/Certifications

Respondents must provide proof of Security Operation Controls (SOC2 Type 2) Certification.

3.11 Special Accommodations

Persons with disability requiring special accommodations should call the Department’s Purchasing office at least five business days, prior to any pre-Proposal conference, Proposal opening, or meeting at (850) 245-4199. If hearing or speech impaired, please contact the Department’s Purchasing office through the Florida Relay Service, at 1-800-

955-8771 (TTY).

3.12 Late Proposals

The Procurement Officer must receive Proposals pursuant to this RFP no later than the date and time specified in Section 2.5. Proposals that are not received by the date and time specified will not be considered.

DEPCS IT Hosting Services

Page | 14

SECTION 4.0 SPECIAL CONDITIONS

4.1 PUR 1000, General Contract Conditions

The PUR 1000 is incorporated by reference in this RFP and contains general Contract terms and conditions that will apply to any Contract resulting from this RFP, to the extent they are not otherwise modified. This document should not be returned with the Proposal.

The PUR 1000 is located at http://dms.myflorida.com/content/download/2933/11777.

The terms of this solicitation control over any conflicting terms of the PUR 1000.

4.2 Scrutinized Companies

All Respondents seeking to do business with the Department must be in compliance with section 287.135, Florida Statutes. The Department may, at its option, terminate a contract if Respondent is found to have submitted a false certification as provided under section 287.135(5), Florida Statutes, been placed on the Scrutinized Companies with Activities in Sudan List, the Scrutinized Companies with Activities in the Iran Petroleum Energy Sector List, the Scrutinized Companies that Boycott Israel List, or is engaged in a boycott of Israel, or have been engaged in business operations in Cuba or Syria.

The Respondent must complete ATTACHMENT F, Respondent Certification Regarding Scrutinized Companies Lists, in its entirety and submit with its Proposal.

4.3 Conflict of Interest and Statement of Non-Collusion

Section 287.057(17)(c), Florida Statutes, provides “A person who receives a contract that has not been procured pursuant to subsections (1)-(3) to perform a feasibility study of the potential implementation of a subsequent contract, who participates in the drafting of a solicitation or who develops a program for future implementation, is not eligible to contract with the agency for any other contracts dealing with that specific subject matter, and any firm in which such person has any interest is not eligible to receive such contract. However, this prohibition does not prevent a vendor who responds to a request for information from being eligible to contract with an agency.”

The Department considers participation through decision, approval, disapproval, recommendation, preparation of any part of a purchase request, influencing the content of any specification or procurement standard, rendering of advice, investigation, or auditing or any other advisory capacity to constitute participation in drafting of the solicitation.

The Respondent must complete ATTACHMENT E, Statement of Non-Collusion Form, with its Proposal.

4.4 Certificate of Authority

All limited liability companies, corporations, corporations not for profit, and partnerships seeking to do business with the State must be registered with the Florida Department of State in accordance with the provisions of Chapters 605, 607, 617, and 620, Florida Statutes, respectively, prior to Contract execution. The Department retains the right to http://dms.myflorida.com/content/download/2933/11777

DEPCS IT Hosting Services

Page | 15 ask for verification of compliance before Contract execution. Failure of the successful Respondent to have appropriate registration may result in withdrawal of Contract award.

4.5 Provider Registration

Each Respondent doing business with the State for the sale of commodities or contractual services as defined in section 287.012, Florida Statutes, must register in the MyFloridaMarketPlace system, unless exempted under Rule 60A-1.033, Florida Administrative Code. State agencies must not enter into an agreement for the sale of commodities or contractual services as defined in section 287.012, Florida Statutes, with any Respondent not registered in the MyFloridaMarketPlace system, unless exempted by rule. The successful Respondent must be registered in the MyFloridaMarketPlace system within five days after posting of the Intent to Award.

Registration may be completed at: https://vendor.myfloridamarketplace.com

A Respondent lacking internet access may request assistance from MyFloridaMarketPlace Customer Service at 866-352-3776 or from State Purchasing, 4050 Esplanade Drive, Suite 300, Tallahassee, FL 32399.

4.6 Minority, Women, Service-Disabled Veteran, and Service-Disabled Veteran Business Participation

The Department encourages minority, women, service-disabled veteran, and veteran-owned business enterprise participation in all its solicitations.

4.7 Forced Labor Certifications (PUR 2024)

In accordance with section 787.06(13), Florida Statutes and section 287.1346(4)(b), Florida Statutes, Respondents must complete and submit ATTACHMENT I, Forced Labor Certifications (PUR 2024), with its Proposal.

4.8 Foreign Countries of Concern (PUR 1355)

In accordance with section 287.138, Florida Statutes, the Department may not accept a bid, proposal, or reply for a contract which would grant Respondent access to Personal Identifying Information unless the Respondent provides the Department with an attestation signed by an officer or representative of the Respondent on Form PUR 1355, “Foreign Country of Concern Attestation” Form.

All Respondents must complete and submit the ATTACHMENT J, Foreign Countries of Concern Attestation (PUR 1355), with its Proposal.

4.9 Application, Data Security and Confidentiality

The Contractor, its employees, subcontractors, and agents must comply at all times with all Department data security procedures and policies during the performance of the resulting agreement as specified in this solicitation.

DEPCS IT Hosting Services

Page | 16

All Respondents must complete and submit the ATTACHMENT K, Application, Data Security, and Confidentiality, with its Proposal.

4.10 Subcontractors

The Department will not authorize the use of subcontractors in the Contract resulting from this solicitation.

4.11 Indemnification

Respondent must save and hold harmless and indemnify the Department against any and all liability, claims, judgments, or costs of whatsoever kind or nature for injury to, or death of any person or persons and for loss or damage to any property resulting from the use, service operation, or performance of work under the terms of the Contract, resulting in whole or in part from the negligent acts or omissions by Respondent, their subcontractor, or any of the employees, agents, or representatives of Respondent or subcontractor.

4.12 Health Insurance Portability and Accountability Act of 1996 (HIPAA) Business Associate Agreement

Upon Contract award, the Respondent must execute a HIPAA Business Associate Agreement and comply with all provisions of state and federal law regarding confidentiality of patient information. See the Business Associate Agreement (ATTACHMENT L), for further details.

4.13 Background Screening and Drug Screening Requirements

Prior to Contract or Order execution, a Level 2 Background Screening, including all Respondent staff, including employees and subcontracted Respondents, collectively referred to as Respondent staff, that will perform duties under a Department Contract or Order that includes contact with a vulnerable person or performing in Department designated sensitive positions. See the Background and Drug Screening Attestation (ATTACHMENT N). Additionally, the Respondent must ensure its employees, including any subcontracted Respondents, complete a drug screening prior to performing work under the Department Contract or Order.

4.14 Performance Measures

Pursuant to section 287.058, Florida Statutes, the resulting Contract must contain performance measures which specify the required minimum level of acceptable service to be performed. The performance measures are detailed in the Scope of Services

(ATTACHMENT A).

4.15 Financial Consequences

Pursuant to section 287.058, Florida Statutes, the resulting Contract must contain financial consequences that will apply if Respondent fails to perform in accordance with the Contract terms. The financial consequences are detailed in the Scope of Services

(ATTACHMENT A).

DEPCS IT Hosting Services

Page | 17

4.16 Standard Contract

Respondents must become familiar with the Department’s Standard Contract which contains administrative, financial, and non-programmatic terms and conditions mandated by federal laws, state statutes, administrative code rules, and directive of the Chief Financial Officer.

Use of the Standard Contract is mandatory for Departmental contracts and the terms and conditions contained in the Standard Contract are non-negotiable. The Standard Contract terms and conditions are located at:

https://www.floridahealth.gov/about/administrative-functions/purchasing/Standard_Contract.pdf

4.17 Conflict of Law and Controlling Provisions

Any Contract resulting from this RFP, and any conflict of law issue, will be governed by the laws of Florida. Venue must be in Leon County, Florida, to the exclusion of all other jurisdictions.

Respondents acknowledge that this solicitation (including but not limited to the resulting Contract, exhibits, attachments, or amendments) is not a rule nor subject to rulemaking under Chapter 120 (or its successor) of the Florida Statutes and is not subject to challenge as a rule or non-rule policy under any provision of Chapter 120, Florida Statutes.

4.18 Agency Inspectors General

It is the duty of every state officer, employee, agency, special district, board, commission, contractor, and subcontractor to cooperate with the inspector general in any investigation, audit, inspection, review, or hearing pursuant to section 20.055, Florida Statutes.

4.19 Records and Documentation

To the extent that information is used in the performance of the resulting Contract or generated as a result of it, and to the extent that information meets the definition of “public record” as defined in section 119.011(12), Florida Statutes, said information is hereby declared to be and is hereby recognized by the parties to be a public record and absent a provision of law or administrative rule or regulation requiring otherwise, Respondent must make the public records available for inspection or copying upon request of the Department’s custodian of public records in accordance with Chapter 119, Florida Statutes. Respondent’s refusal to comply with Chapter 119, Florida Statutes, will constitute an immediate breach of the Contract resulting from this RFP and entitles the Department to unilaterally terminate the Contract.

Unless a greater retention period is required by state or federal law, all documents pertaining to the program contemplated by this RFP must be retained by Respondent for a period of six years after the termination of the resulting Contract or longer as may be required by any renewal or extension of the Contract. During the records retention period, Respondent agrees to furnish, when requested to do so, all documents required to be https://www.floridahealth.gov/about/administrative-functions/purchasing/Standard_Contract.pdf https://www.floridahealth.gov/about/administrative-functions/purchasing/Standard_Contract.pdf

DEPCS IT Hosting Services

Page | 18 retained. Submission of such documents must be in the Department’s standard word processing format. If this standard should change, it will be at no cost incurred to the Department. Data files will be provided in a format readable by the Department.

Respondent must maintain all records required to be maintained pursuant to the resulting Contract in such manner as to be accessible by the Department upon demand. Where permitted under applicable law, access by the public must be permitted without delay.

4.20 Attorney’s Fees

In the event of a dispute prior to or post award, each party responding to this solicitation is responsible for its own attorneys’ fees, except as otherwise provided by law.

DEPCS IT Hosting Services

Page | 19

SECTION 5.0 PROPOSAL EVALUATION PROCESS AND CRITERIA

5.1 Introduction

The Department will evaluate and score proposals to determine the most advantageous Proposal. The ability of the Department to evaluate a respondent’s Proposal is dependent upon the completeness of the Proposal.

Failure of a Respondent to provide information requested by this RFP may result in reduction in scoring during the evaluation.

The Department may accept or reject any and all proposals, and waive any minor irregularity, technicality, or omission if the Department determines that doing so will serve the State’s best interests.

5.2 Evaluation Criteria

Technical proposals will be scored by the evaluation team based on the evaluation criteria specified in Attachment C. The total raw scores provided by each team member will be averaged together. These average scores will be used to determine each respondent’s

Technical Proposal score.

Cost Proposals will be scored by the Procurement Officer based upon the Respondent’s proposed cost, as prescribed in Section 3.4.2 of this RFP. The proposed cost will be scored in accordance with the below formula:

Maximum Cost Proposal Points x (Lowest Proposal Cost/Respondent’s Proposal

Cost) = COST SCORE

Each respondent’s overall score will consist of the average technical proposal score plus the cost proposal score.

RFP Scoring Components Maximum Points

Technical Proposal – Section 3.3.2, TAB 2 500

Cost Proposal – Attachment B 100

TOTAL MAXIMUM POINTS POSSIBLE 600

DEPCS IT Hosting Services

Page | 20

5.3 Notice of Agency Decision

At the conclusion of evaluation of the proposals the Department will announce its intended decision. Notice will be posted on the state’s Vendor Information Portal. The Department will award to the responsible, responsive Respondent determined to be the most advantageous to the state, taking into consideration technical and cost proposals.

Notice of Award does not guarantee issuance of a contract.

The Department reserves the right to award more than one Contract as a result of this

RFP.

5.4 Protests

Failure to file a protest within the time prescribed in section 120.57(3), Florida Statutes, or failure to post a bond or other security required by law within the time allowed for filing a bond will constitute a waiver of proceedings under Chapter 120, Florida Statutes. Only documents delivered by the United States Postal Service, a private delivery service, in person, by E-Filing, or by facsimile during business hours will be accepted. Documents received after business hours will be filed the following business day.

Do not send Proposals to the Agency Clerk’s Office. Send all Proposals to the Procurement Officer and address listed in Section 2.5, Timeline.

No filings may be made by email. All filings must be made ONLY with the Agency Clerk and are considered "filed" when stamped by the official stamp of the Agency Clerk. It is the responsibility of the filing party to meet all filing deadlines.

The protest must be submitted by using one of the following delivery methods:

By Mail:

Agency Clerk, Florida Department of Health 4052 Bald Cypress Way, BIN A-02 Tallahassee, Florida 32399-1703 Telephone No. (850) 245-4005;

By hand delivery:

Agency Clerk, Florida Department of Health 2585 Merchants Row Blvd.

Tallahassee, Florida 32399;

By facsimile: 850-413-8743; or

By E-Filing:

https://agency_clerk-fdh.mycusthelp.com/WEBAPP/_rs/supporthome.aspx?&lp=3 https://agency_clerk-fdh.mycusthelp.com/WEBAPP/_rs/supporthome.aspx?&lp=3

ATTACHMENT A

Scope of Services

DOH24-010

Request for Proposal DEPCS IT Hosting Services

Page | 21

A. Services to be provided:

1. General Description:

a. General Statement: This Contract is for the provision of Managed Hosting Services and equipment required to support the Bureau of Public Health Pharmacy’s online software systems and the Department’s Division of Emergency Preparedness and Community Support.

b. Authority: Sections 287.057 and 381.0203, Florida Statutes.

2. Definition of Terms:

a. Backup and Recovery: The process of backing up data in case of a loss and setting up systems that allow data recovery due to data loss.

b. Border Gateway Protocol (BGP): A standardized exterior gateway protocol designed to exchange routing and reachability information among autonomous systems on the Internet.

c. Colocation (Co-lo) Facility: A shared data center space in which a business or other organization can rent space for servers and other hardware. Sometimes additional management services are offered, but a Co-lo is not a public cloud or outsourced IT solution.

d. Color Correlated Temperature (CCT) Video Surveillance: A system that uses the correlated temperature of a light source expressed in Kelvins and is a means for describing the appearance or chromaticity of the source itself.

e. Enterprise-class Distributed Physical Electronically Monitored Security System: Protection of personnel, hardware, software, networks, and data from physical actions and events that could cause serious loss or damage to an enterprise, agency, or institution.

f. Failover: A method of protecting computer systems from failure, in which standby equipment automatically takes over when the main system fails.

g. Fire Suppression System: Used to suppress, extinguish, or prevent the spread of a fire in sensitive environments where water from a fire sprinkler is not a desired extinguishing agent.

h. Firewall and Switch Equipment Intrusion: Firewall and switch devices or software application that monitors a network or systems for malicious activity or policy violations.

i. Health Insurance Portability and Accountability Act (HIPAA): Enacted by congress in 1996 primarily to modernize the flow of healthcare information, stipulate how Personally Identifiable Information maintained by the healthcare and healthcare insurance industries should be

DOH24-010

Request for Proposal DEPCS IT Hosting Services

Page | 22 protected from fraud and theft, and address limitations on healthcare insurance coverage.

j. Internet Service Respondent (ISP): A company that provides customers with Internet access.

k. Managed Hosting: An isolated hosting environment where the Respondent handles the setup, administration, management, and support of the server or platform application.

l. Operating System (OS): Software that communicates with the hardware and allows other programs to run.

m. Payment Card Industry Data Security Standard (PCI DSS): An information security standard for organizations that handle branded credit cards from the major card schemes.

n. Pharmaceutical Forms System (PFS): A cloud based, Department system comprised of multiple sites to form a system for ordering, issuing, inventory, shipping, invoicing, and tracking pharmaceuticals.

o. Quarter: A three-month period of the contract term, coinciding with the state’s fiscal year. The quarters are July through September (first quarter), October through December (second quarter), January through March (third quarter), and April through June (fourth quarter).

p. Random Access Memory (RAM): The hardware in a computing device where the OS, application programs, and data in current use are kept so they can be quickly reached by the device's processor.

q. Security Operation Controls (SOC2 Type 2) Certification: A company that has achieved SOC2 type 2 certification has proven its system is designed to keep its clients’ sensitive data secure, which includes, the security of the system Respondent’s system, processing integrity of the system, availability of the system, privacy of personal information, and confidentiality of the information.

r. Simple Mail Transfer Protocol (SMTP): An Internet standard for electronic mail (email) transmission.

s. Smart Failover Backup: A feature that allows the user to set up a second Wide Area Network (WAN) and Firewall in case the first one fails to assure that the communication between the WAN and the device is always continuous.

t. Smart Hands: A technical support system where technical staff who are located on-site can either proactively or reactively fix any issues that may arise with Co-lo equipment.

u. Throttling: The process through which an ISP intentionally limits user bandwidth, slowing down connection and download speeds.

DOH24-010

Request for Proposal

Page | 23

v. Tier 4 Data Center: A data center that provides 99.995 percent Uptime per year (Tier 4 Uptime), fully redundant infrastructure, 96-hour power outage protection, and has 26.3 minutes of annual downtime.

w. Uptime: The time the data center will be in an operational state.

x. Veeam Software: A privately held information technology company that develops backup, disaster recovery and intelligent data management software for virtual, physical, and multi-cloud infrastructures.

y. Virtual Memory System (VMs): A memory management capability of an OS that uses hardware and software to allow a computer to compensate for physical memory shortages by temporarily transferring data from RAM to disk storage.

z. Virtual Server: A web server that shares computer resources with other virtual servers and is not a dedicated server.

aa. Wide Area Network (WAN): A telecommunications network or computer network that extends over a large geographical distance and place.

B. Manner of Service Provision

1. Scope of Work: Provider will manage hosting services for the Bureau of Public Health Pharmacy’s online software systems, as directed by the Department, 24 hours a day, seven days a week, throughout the contract term.

a. Task List: Provider will perform the following tasks:

1) Provide the management of hosting services for the Bureau of Public Health Pharmacy’s online software systems, as directed by the Department, at the time of contract execution, as follows:

a. An account executive for the Contractor must be available in Tallahassee for in person meetings as needed.

b. Throughout the contract term, have a Co-lo Facility where Managed Hosting services are provided that meets the following requirements:

i. Be a Tier 4 Data Center located in the USA.

ii. Maintain a 99.995% data center Uptime for each contract year. For each incident of unscheduled downtime, create an Incident Report that includes the date and time of the unscheduled downtime, a summary of what caused the unscheduled downtime, and the date and time of resolution. Submit the Incident Report to the Department’s Contract Manager with the corresponding quarterly invoice.

DOH24-010

Request for Proposal

Page | 24

iii. Has an onsite remote Smart Hands availability throughout the contract term. Ensure the Smart Hands responds to an incident within one-hour of the incident.

iv. Has an Enterprise-class Distributed Physical

Electronically Monitored Security System that includes the following:

1. Access Control;

2. Door Alarms;

3. Monitoring 24 hours a day, seven days a week;

and

4. CCT video surveillance, with a 90-day or more online storage.

v. Contains a central management system with multi-factor authentication for enter and exit and maintain an electronic record or log of activity.

vi. Has a Fire Suppression System that includes pre-action, zoned dry-pipe sprinkler systems with zoned maintenance aisles and separate suites.

vii. Is certified for SOC2 Type 2, PCI DSS.

viii. Is HIPAA-compliant.

c. At the time of contract execution, have at the minimum the following hardware resources or equivalent:

i. Primary dedicated business fiber ISP at 200 megabytes per second (mbps) up/down.

1. Cisco SX350X-08 — switch — 8 ports — managed

ii. Secondary dedicated fiber ISP at 200 mbps up/down.

1. Cisco SX350X-08 — switch — 8 ports — managed

iii. BGP failover and throttling.

1. SonicWall Nsa 2650 — primary firewall

2. SonicWall Nsa 2650 — secondary firewall

DOH24-010

Request for Proposal

Page | 25

iv. Smart failover backup switch.

1. Dell X1026 24-port switch — primary switch

2. Dell X1026 24-port switch — secondary switch

v. Smart failover backup firewall.

1. Dell SonicWall TZ500 Firewall — primary firewall

2. Dell SonicWall TZ500 Firewall—secondary firewall

vi. Firewall and Switch Equipment Intrusion and issue alert monitoring SMTP.

vii. Dell PowerEdge R440 (ESXi — 1) which includes:

1. Central Processing Unit CPU: 20 CPUs

2. Processor: Intel Xeon Silver 4114 CPU @ 2.20GHz

3. RAM: 320Gb DDR3

4. Hard Disk Drive (HDD): 4.07TB

viii. Dell PowerEdge R440 (New) (ESXi — 2) which includes:

1. CPU: 32 CPUs

2. Processor: Intel(R) Xeon(R) Silver 4216 CPU @ 2.10GHz

3. RAM: 448Gb DDR5

4. Hard Disk Drive (I-IDD): 3.92 TB

ix. Dell PowerEdge R430 (ESXi — 3) which includes:

1. CPU: 16 CPUs x 2.098 GHz

2. Processor: Intel Xeon E5-2620 v4

3. RAM: 320gb DDR4

4. Hard Disk Drive (I-IDD): 5.45 TB

DOH24-010

Request for Proposal DEPCS IT Hosting Services

Page | 26

x. Dell PowerEdge R440 (ESXi — 4) which includes:

1. CPU: 32 CPUs x 2.1 GHz

2. Processor: Intel Xeon@ Silver 4216 CPU

3. RAM: 192gb DDR5

4. Hard Disk Drive (HDD): 3.35 TB

xi. Dell PowerEdge R440 (ESXi — 5) which includes:

1. CPU: 32 CPUs x 2.1 GHz

2. Processor: Intel Xeon@ Silver 4216 CPU

3. RAM: 192gb DDR5

4. Hard Disk Drive (I-IDD): 3.35 TB

xii. Network Area Storage device (NAS) that includes:

1. CPU: 1 CPUs dual core

2. Processor: Intel Xeon(R) CPU 8-1220 v6 @

3.00 GHz

3. RAM: 8Gb DDR3

4. Hard Disk Drive (HDD): IOTB.

xiii. OS: Windows Storage Server 2016 Workgroup Edition.

d. Have the following Virtual Server resources at the time of contract execution. Update the Virtual Server resources to the most recent Microsoft versions as they become available throughout the contract term.

i. vCenter Server-Linux (64-bit) — VMWare vSphere –

Version 7.0.3.00500;

ii. M2sys Biometric fingerprints - Linux — Ubuntu Linux (64-bit);

iii. (Ubuntu-22.04 LTS (Jammy) version which includes the Gnome v 42.0 and Windowing System Wayland, and Postgres 14);

iv. Windows Server 2016 (64bit) — Domain

Controller/Domain Name System (DNS);

DOH24-010

Request for Proposal DEPCS IT Hosting Services

Page | 27

v. Windows Server 2022 (64-bit) — Backup Domain Controller/DNS;

vi. Windows Server 2022 (64-bit) — Structured Query

Language (SQL) Server 2022 Version 16.0.1115.1;

vii. Windows Server 2022 (64-bit) — Structured Query

SQL Server Replication instance (transaction log replication);

viii. Windows Server 2022 (64bit) — Webserver;

ix. Windows Server 2022 (64bit) — Webserver; and

x. Windows Server 2022 (64bit) — Webserver.

e.…