ESBD_494237_1776691100890_RFP 515-26-0001 Prescription Monitoring .doc

RFP 515-26-0001 Prescription Monitoring

STATE OF TEXAS

TEXAS STATE BOARD OF PHARMACY

REQUEST FOR PROPOSAL NO. 515-26-0001

PRESCRIPTION MONITORING PROGRAM

Reference: RFP 515-26-0001

CLASS: 920 ITEM: 05

Posting Date: 04/20/2026

RESPONSE DEADLINE: 05/20/2026 @ 4:00 PM CT

SUBMIT RESPONSES to Texas State Board of Pharmacy online Procurement Portal: https://pharmacytexas.bonfirehub.com/portal/

Submissions by other methods will not be accepted. Minimum system requirements: Microsoft Edge, Google Chrome, Safari, or Mozilla Firefox. JavaScript and browser cookies must be enabled.

Respondents should contact Bonfire at Support.bonfire@eunasolutions.com for technical questions related to submissions or visit Bonfire’s help forum at https://vendorsupport.gobonfire.com/hc/en-us

Submission materials should be prepared in the file formats listed under Requested Information for this opportunity in the Bonfire Portal. The maximum upload file size is 1000 MB. Documents should not be embedded within uploaded files, as the embedded files will not be accessible or evaluated.

ORGANIZATION NAME

ADDRESS

TAX ID/VENDOR IDENTIFICATION NUMBER

The vendor’s authorized agent must sign below. By signing this document, the Respondent acknowledges that all information contained in the document is true and correct and that Respondent agrees to comply with all terms and conditions. Failure to sign will disqualify this bid. By signing this bid, Respondent certifies that if a Texas address is shown as the address of the Respondent, Respondent qualifies as a Texas Bidder as defined in Section 2155.444(c) of the Texas Government Code.

Signature Title

Date

TABLE OF CONTENTS

1.0 INTRODUCTION

1.1 General Information

1.2 Purpose

1.3 Statutory Basis

1.4 Definitions

1.5 Term of Contract

1.6 Change Process

1.7 Corrective Action

1.8 Cancellation

1.9 Order of Precedence

1.10 Agency Contact

1.11 Schedule

1.12 Data Ownership

1.13 TxRAMP Compliance

2.0 DATA COLLECTION

2.1 Instruction to Dispensers

2.2 Receive Electronic Prescription Data

2.3 Collecting and Uploading

2.4 Law Enforcement Use and Access to Data

2.5 Manual Entry

2.6 Report of No Prescriptions Issued

2.7 Joint Transmission

2.8 Data Checks

2.9 Notify Dispensers

2.10 Corrected Data

2.11 Collect Data from Licensing Agencies

2.12 Collect Data from TSBP

2.13 Collect Data from Other Users

2.14 Standard Format

2.15 Export Mechanism

2.16 Completion of the Contract

3.0 DATA MANAGEMENT

3.1 Collect and Load Data

3.2 Collect DEA Registration Information

3.3 Collect and Convert NPI Numbers

3.4 Collect NDC Number Information

3.5 Data Access, Data Management, and Data Cleansing Capabilities 3.6 Geocoding

3.7 Cleanse and Standardize Data

3.8 Query of Relational Data

3.9 Identification of Illegal and Unprofessional Activities

3.10 Removal of Data

3.11 Convert and Store Live Program Data

3.12 De-identification of Data

3.13 Upload History

3.14 Reports

3.15 Incomplete Uploads

3.16 Automated Verification

4.0 DATA EXCHANGE

4.1 Access to PMP InterConnect

4.2 Data Exchange with HIE systems

5.0 SECURE WEB SERVICES

5.1 Secure Website

5.2 Authenticate User Registrations

5.3 Compliance with HIPAA

5.4 Volume of Concurrent Users

5.5 Request and Receive Information

5.6 Communicating Information to Registered Users

5.7 Procedures and Controls

5.8 Federal and State Privacy and Security Laws

5.9 Data Breach Notifications

6.0 QUERIES AND REPORTS

6.1 Audit Reports

6.2 Search, Correlate, Query, and Match

6.3 Query Records with Prescribers’ DEA Number

6.4 Minimum Reports

6.5 Registered User Requests

6.6 Ad Hoc Queries

6.7 De-identified Data

6.8 Automatic Threshold Reports

6.9 Alerts to Prescribers and Dispensers

6.10 Deactivate Accounts

7.0 System Enhancements

7.1 Patient Risk Scores and Usage Patterns

7.2 Enhanced Data Analytic Capabilities

7.3 Non-Appropriation of Funds

8.0 DATA RECORDS

8.1 Receipt of Data Transmission from Dispenser

8.2 Written Transition Plan

8.3 Transfer of Electronic and Paper Files

9.0 INTEGRATION OF ELECTRONIC MEDICAL RECORDS

9.1 TX PMP Information and Clinical Workflows

9.2 Integration Service

9.3 Health IT Systems

9.4 Audits Logs

9.5 Integration Request Form and Terms of Use

9.6 Technical Documentation

9.7 System Already Connected to Integration Service

9.8 Test Environment

9.9 Point of Contact

9.10 Use of Integration Services

9.11 Required Services

9.12 Non-Appropriation of Funds

10.0 Texas Wholesale Distributor Database Reporting

10.1 Data Collection System

10.2 Electronic Controlled Substance Distribution

10.3 Secure Mechanism

10.4 Standardize Data

10.5 Access to Texas Wholesale Distributor Database

10.6 Other Requirements

11.0 OTHER REQUIREMENTS

11.1 Disaster Recovery Plan

11.2 Continuing Technical Assistance

11.3 Toll-Free Telephone Number and Email Address

11.4 Training for Database System

11.5 Database System Updates

11.6 Option to Exclude Searches

11.7 Law Enforcement Access

11.8 Implementation Plan

12.0 RESPONDENT QUALIFICATIONS

12.1 Examples of Previous or Current PMP Projects

12.2 Canceled or Terminated Contracts

12.3 Number and Skill-Level of Staff

12.4 Ability to Meet Project Deadlines

12.5 Past Performance

13.0 DEMONSTRATIONS

13.1 Oral Demonstrations

13.2 Demonstration Costs

13.3 Demonstration

13.4 Right to Waive Demonstrations

13.5 Pass or Fail

14.0 PRICING

14.1 Pricing

14.2 Renewal Pricing

14.3 Payment

14.4 Modification and Additional Services

15.0 Evaluation

15.1 Best Value

15.2 Proposal Evaluation

15.3 Vendor Performance

16.0 Submission and Contract Requirements

16.1 Submissions

16.2 Authorized Agent Signature

16.3 Cost of Submissions

16.4 Public Information

16.5 Questions

16.6 HUB Subcontracting

16.7 Insurance Requirements

16.8 Certification and Prohibited Contracts

16.9 Form 1295

1.0 INTRODUCTION

1.1 General Information

The Texas State Board of Pharmacy (TSBP) is issuing a request for proposal from Respondents for a prescription monitoring program (PMP) to collect and monitor controlled substance prescriptions issued and filled in Texas. Respondents who wish to be considered for the award shall prepare a detailed proposal for consideration which shall include information and costs substantiating their proficiency in the collection, management, and communication of electronic data relative to prescription transaction information for controlled substances. Generally, a Respondent would be capable of collecting data from the reporting entities, host the data in a secure site, coordinate data management securely, and be able to establish a secure web-based portal with graphical internet interfaces to include standard browsers to facilitate automated communication for authorized users including prescribers, one for dispensers, one for health-profession regulatory agencies, and law enforcement. Such database system shall be capable of supporting interstate data sharing, integrating with electronic health records (EHRs), health information exchange (HIE), and pharmacy dispensing systems to facilitate prescriber and dispenser access to PMP data, reducing time and effort needed to obtain a patient’s history, seamlessly and in as close to real time as possible.

The goal of the PMP is to provide a database system that is continuously available and provide information in a timely manner. With approximately 6,000 dispensers and more than 200,000 authorized users, the database system receives approximately 25 million requests for information on a monthly basis. A comprehensive system, to meet and exceed this demand, is required to successfully manage the PMP, to keep response times to a minimum, and provide continuous access to authorized users. After over nine years of operation, the current database system contains over 134 million records.

1.2 Purpose

The Texas State Board of Pharmacy is seeking proposals from Respondents to establish the PMP at TSBP. TSBP intends to select an experienced Respondent that will provide improved functionality, stability, and usability of the data as well providing suggestions for options that could provide cost savings.

Respondents should be able to provide an extant database system that can be adapted to TSBP’s needs prior to September 1, 2026.

1.3 Statutory Basis

The duties and regulatory oversight of the PMP resides TSBP as authorized in the Texas Controlled Substances Act, Health and Safety Code §481.076, and provides that TSBP is responsible for implementation and administration of ongoing activities related to the program.

1.4 Definitions

Administrator – An authorized TSBP employee who oversees the operations of the controlled substances prescription monitoring program

API – Application Programming Interface

Awarded Vendor, Vendor, Contractor – Any Respondent awarded a Contract as a result of this RFP

Controlled Substance – As defined in Chapter 481, Health and Safety Code Contract – Entire agreement including at a minimum all documents noted in the order of precedence, Sec. 1.9.

CPA – Comptroller of Public Accounts

DEA – Drug Enforcement Administration

Delegate – Any person whose prescribing authority is delegated by a practitioner

Dispenser – As defined in Chapter 481, Health and Safety Code EHR – Electronic Health Record

Fiscal Year – September 1 to August 31

HIE – Health Information Exchange

HIPAA – Health Insurance Portability and Accountability Act

HUB – Historically Underutilized Business

Live Data – Prescription drug records uploaded into the PMP database system and available to authorized users

MME – Morphine milligram equivalent

NDC – National Drug Code

NPI – National Provider Identifier

PAT – Prescription Access in Texas

PMIX – Prescription Monitoring Information Exchange

PMP – Prescription Monitoring Program Practitioner – As defined in Chapter 481, Health and Safety Code Prescriber – A practitioner as defined in Chapter 481, Health and Safety Code, who prescribes a controlled substance prescription for a patient

Professional Licensee – Individuals or entities authorized to prescribe or dispense controlled substances under Chapter 481, Health and Safety Code

Requestor – A prescriber or a pharmacist authorized to access the database system

Respondent – Any individual, partnership, corporation or other legal entity submitting a timely proposal in response to this RFP

RFP – Request for Proposal

SPD – State Procurement Division

State – State of Texas

TSBP – Texas State Board of Pharmacy

TWDD – Texas Wholesale Distribution Database UAT – User acceptance testing

1.5 Term of Agreement

A Contract, if any, will be effective upon signing by the Texas State Board of Pharmacy (TSBP) and any vendor awarded by the evaluation process. The awarded vendor will be eligible to provide services for an initial period of one year from the initiation of the Contract, with four (4) optional one-year renewals at TSBP’s discretion.

1.6 Change Process

Changes to any Contract arising from this RFP must be in writing and coordinated through TSBP’s designated contract administrator prior to the change. The agency point-of-contact for contract administration is David Hardy. TSBP may appoint a new contract administrator at its sole discretion. Upon agreement of both parties, except as noted below, a formal amendment will be issued by TSBP.

TSBP reserves the right to request modifications to the PMP from the awarded vendor in order to enhance functionality as needed. Cost shall be negotiated at the time the request is placed.

1.7 Corrective Action

Failure to comply with contract requirements in Section 2 or elsewhere in the Contract (which includes notice of award), attachments to the Contract, request for proposal, Respondent’s response to the request for proposal, and all changes and amendments may result in imposition of a corrective action plan. The plan’s design and duration are at TSBP’s discretion.

1.8 Cancellation

TSBP reserves the right to cancel this Contract without cause with thirty (30) days written notice to the vendor.

1.9 Order of Precedence

In the event of conflicts or inconsistencies between this Contract and its exhibits or attachments, such conflicts or inconsistencies shall be resolved by reference to the documents in the following order of priority (from highest to lowest): Award Letter, Attachments to the Contract (or Notice of Award), Request for Proposal, and Respondent’s Response to Request for Proposal.

1.10 Agency Contact

The point-of-contact for this RFP is:

David Hardy, CTCD/CTCM 1801 Congress Ave., Ste. 13.100 Austin, TX 78701 Phone: 512-305-8023 Fax: 512-305-8075 E-mail: david.hardy@pharmacy.texas.gov

All questions are to be directed to the agency point-of-contact. Upon publication of this RFP, besides written inquiries as described in Section 16.5 Questions, employees and representatives of TSBP will not answer any questions or otherwise discuss the contents of the RFP with any potential provider or their representatives. If a potential provider fails to observe this restriction, that provider’s response to this RFP may be disqualified.

1.11 Schedule

This schedule of events is subject to change by TSBP. In the event of a change, notice will be posted on the ESBD and bid portal, https://pharmacytexas.bonfirehub.com/portal/.

1.12 Data Ownership

Any data collected pursuant to this Contract as part of the Prescription Monitoring Program whether prescriptions, patient data, notes by investigators, prescribers, or dispensers, or other relevant data is the property of TSBP, the relevant agency generating such data, or the State of Texas as appropriate.

TSBP may permit the awarded vendor to share de-identified data with other entities, subject to relevant law and usage. Such permission will be granted in writing by TSBP but does not require a contract amendment. TSBP may impose additional conditions on data sharing permissions. TSBP has the right to revoke data sharing permissions at any time with no advanced notice.

ANY EXCEPTIONS TO THIS CLAUSE MUST BE IN WRITING.

1.13 TxRAMP Compliance

The Respondent must provide evidence of compliance with TX-RAMP Level 2 requirements for the service and demonstrate continuous compliance upon TSBP's request.

2.0 DATA COLLECTION – For the anticipated requirements below, Respondent must indicate a recommended solution and identify the associated costs.

2.1 Prepare and provide to statutorily authorized dispensers, as indicated by TSBP, any instructions necessary to comply with the reporting requirements, including technical assistance. The instructions/manual must be available online. TSBP will reserve the right to review and approve any communication prior to its distribution.

2.2 Receive electronic prescription information transmitted directly from the dispensers, seven days a week, and twenty-four hours a day. Daily volume is expected to exceed 135,000 prescriptions, or over 35 million prescriptions per year.

2.3 Collect and provide a secure mechanism for collecting and/or uploading for dispensers of controlled substance prescriptions as required under Texas State Board of Pharmacy Rule 315.6. Reports are to be in a standardized format, 24 hours a day, 7 days a week. Data elements for all controlled prescription transactions including the following:

2.3.1 Prescriber’s registration number, with suffix if applicable, as assigned by the U.S. Drug Enforcement Administration (DEA), and the National Provider Identifier (NPI) number, if supplied, as assigned by the U.S. Centers for Medicare and Medicaid Services (CMS).

2.3.2 Patient’s information, including but not limited to, full name, full address including city, state, and zip code, date of birth or age, gender, and identification number (e.g., driver’s license number), if available.

2.3.3 Prescription information including, but not limited to, prescription number, date of issuance, date of dispensing, number of refills authorized on the original prescription, refill number (if applicable), and method of payment; and for Schedule II prescriptions, the prescription control number or electronic reference number.

2.3.4 Drug information including, but not limited to, National Drug Code (NDC) number, quantity dispensed, and number of days’ supply.

2.3.6 Dispenser information including DEA registration number, NPI number if supplied, and the name and address of the pharmacy.

2.4 Establish a solution for law enforcement use and access to data with approval of TSBP (see Section 11.6, Other Requirements).

2.5 Provide a secure web portal to allow for manual entry for low volume uploads.

2.6 Accept a report of no (or zero) prescriptions issued in a given time period and generate and deliver a report of those submissions to TSBP within a schedule established by TSBP.

2.7 Accept submission of data from dispensers under common ownership in a single joint transmission, provided each dispenser is clearly identified for each prescription dispensed.

2.8 Perform data checks to ensure the submitted data is compliant with the quality standards established by TSBP relative to accuracy and completion.

2.9 Notify dispensers when a dispenser’s data file does not meet the quality standards for accuracy and completeness, specifying the data deficiency, and ensure the dispenser corrects and resubmits the data. TSBP must be notified automatically when a dispenser fails to correct a failed submission within a schedule established by TSBP.

2.10 Allow a dispenser to submit corrected data and display the corrected data with a notice that the data has been corrected.

2.11 Collect data from TSBP and/or other licensing agencies for the prescribers and pharmacists authorized to access the database system as defined by Section 481.076(a)(5) and (6), Health and Safety Code.

2.11.1 Licensing agencies include the Texas State Board of Pharmacy, the Texas Medical Board, the Texas Department of Licensing and Regulation, with respect to the regulation of podiatrists, the State Board of Dental Examiners, the State Board of Veterinary Medical Examiners, the Texas Board of Nursing, and the Texas Optometry Board.

2.12 Collect data from TSBP for dispensers required to report to the database system.

2.13 Collect data from other users authorized under Section 481.076(a)(1) and (4), Health and Safety Code, and allow for registration of these users.

2.14 A standard format will be established for the upload of licensing data.

2.14.1 Agencies responsible for regulating professional licensees will upload licensee data periodically to be used to validate professional licensee access to the PMP.

2.14.2 Provide audit reports and notifications to alert TSBP if any data fails to update as scheduled by TSBP.

2.15 Provide an export mechanism for data to be downloaded to TSBP on demand.

2.16 Upon completion of the Contract, data shall be provided to TSBP.

3. DATA MANAGEMENT – For the anticipated requirements below, Respondent must indicate a recommended solution.

3.1 Collect and load data into the database system daily. Servers storing the data will be provided by and shall reside with the Respondent. Pharmacies are required to report data by the next business day after dispensing, which could be any day as dispensing is a daily activity. All of the data in the system shall belong to TSBP.

3.2 Collect DEA registration information and provide a mechanism to convert DEA registration numbers reported to the database system into the corresponding prescriber or dispenser name and address. A current list of DEA registration information shall be maintained by the Respondent for validation and translation purposes.

3.3 Collect and convert NPI numbers reported to the database system into prescriber or dispenser name and address when NPI is supplied. NPI numbers do not override DEA-provided name/address.

3.4 Collect NDC number information and provide a mechanism to convert NDC numbers to drug name, strength, dosage form, and controlled substance schedule, both at the point of data import and retrospectively upon receiving NDC number updates. A current reference source of NDC numbers shall be maintained by the Respondent for validation and translation purposes.

3.5 Provide data access, data management, and data cleansing capabilities seamlessly integrated with data mining for ease of data analysis. (See Section 5.4, Secure Web Services, for target percentage of automated reports.)

3.6 Provide capability for geocoding of patients, prescribers, and dispenser locations to enable geographic analysis of the relationships to identify potential criminal activity, abuse or a localized trend in a specific health-related issue.

3.7 Electronically cleanse and standardize the data. This includes but is not limited to identifying individuals using different but similar names, individuals using different but similar addresses, and multiple individuals using the same address. Provide the anticipated logic used and examples.

3.8 Provide tools for the query of relational or multi-dimensional data that supports a broad range of search criteria.

3.9 Provide tools that will electronically assist in the identification of illegal and unprofessional activities. This requirement is to control both intrusions by non-authorized persons and to monitor users for inappropriate use, such as searching data for persons who are not that user’s patients.

3.10 Provide automated tools that will be used in the removal of data once it has reached its retention limit. Describe how the deletion/purging and sanitizing of data would occur for data that exceeds its retention date. Describe how this process will be recorded or documented.

3.11 Convert and store any live program data from the existing system. Anticipated data retention period is three years.

3.12 Provide automated tools that will be used in the de-identification of data to be moved to a historical repository. De-identification tools are to comply with HIPAA requirements, as well as any applicable federal or state law. Identified data is maintained for thirty-six (36) months.

3.12.1 Provide a system to exclude data that must retain all identification data for investigative purposes. Access for authorized agencies to this data must also be provided. Data retained for investigative purposes must be flagged.

3.12.2 Provide measures to preserve data for investigative purposes while preventing accidental migration of identified data to a historical repository.

3.12.3 Provide audit reports of flagged data.

3.13 Provide a mechanism for TSBP staff to:

3.13.1 Sort and view the upload history of a dispenser by timeframe, number of prescription errors, zero reports filed, late submissions and trends.

3.13.2 Check the accuracy of a specific upload.

3.14 Provide a mechanism for TSBP staff to produce reports, on demand or scheduled, displaying information about all uploads by a dispenser, including contact information for each dispenser and the reported date ranges of the submission.

3.15 Provide a mechanism for TSBP staff to produce reports displaying records that were uploaded containing incomplete, invalid, or missing data including DEA, NDC, or NPI numbers or prescription control numbers (e.g., verify prescription control number as supplied by TSBP).

3.16 Provide mechanism for automated verification of prescription data as specified by TSBP. This requirement is for data validation including, but not necessarily limited to, a valid pharmacy, a valid prescriber, DEA number, NDC code, controlled substance number, and relevant patient information.

3.17 Provide data back up and recovery to include at a minimum:

3.17.1 Daily data backups.

3.17.2 Restore times for partial backups are to be completed by the next business day. Restore times for full backups are to be completed within forty-eight (48) hours.

4. DATA EXCHANGE – For the anticipated requirements below, Respondent must indicate a recommended solution.

4.1 The Respondent shall provide access to the National Association of Boards of Pharmacy’s (NABP) PMP InterConnect hub to allow for intrastate data exchange, for queries made by authorized users, and for disclosure of queries received from other states’ PMPs through the PMP InterConnect hub.

4.2 The database system must be compatible to allow data exchange with HIE systems.

5. SECURE WEB SERVICES – For the anticipated requirements below, Respondent must indicate the recommended solution.

5.1 Provide a secure website for access to the information in the database system.

5.2 Authenticate user registrations before providing user accounts. Users include: requestors, dispensers, prescribers, designated agency personnel, TSBP, agency investigators, prosecutorial officials, and law enforcement officers.

5.2.1 Each user account must have a unique user identification/password combination. Email/text verification must be performed during registration. Security questions should be selected from a list by the user.

5.2.2 Passwords must be at least 12 characters long, include upper and lower-case letters, numbers and special characters. Passwords will expire every year with prior warning to user including number of days password is still valid. If passwords are entered more than 7 times incorrectly the account must be locked for at least ten minutes. Allow users the opportunity to change passwords at each logon. Include self-service password reset for users who successfully answer pre-set security questions or email/text a link to reset password. Note-TSBP reserves the right to modify the password character length and expiration cadence.

5.2.3 Provide logon and logoff capability. Limit logon attempts before locking account with email/text notification for reporting and unlocking ability. Track, record, and timeout illegal attempts at system access.

5.2.4 Provide the ability to upload required documentation for registration.

5.2.5 Require users to periodically (1) review and (2) confirm or update account holder information details and employment information at least annually.

5.2.6 System must be capable of employing Multi-Factor Authentication login requirements for authorized users wishing to access the system.

5.3 Address compliance with the privacy and security standards of the Health Insurance Portability and Accountability Act (HIPAA) and common standards for privacy and security. Provide examples.

5.3.1 Professional licensee users will authenticate by matching license data against agency upload files.

5.4.3 Agency staff user registration will be managed by agency administrators.

5.4 Allow for a high volume of concurrent users to access the database system and applications at the same time. The total number of authorized users is estimated to be in excess of 200,000. Routine daily usage is estimated in the range of 50,000 users. Based on Respondent’s experience, provide details on how this will be accomplished.

5.5 Permit a registered user to request and receive information, including automatic reports, via the secure web interface, without intervention by TSBP. TSBP expects 98.5% of reports to be delivered automatically without TSBP action. Access to the database system shall be provided 24 hours per day, seven days per week.

5.6 Provide TSBP with the capability of communicating information of interest to registered users of the database system through broadcast alerts and postings on the database system home page.

5.7 Establish and maintain procedures and controls to assure the information or data is not mishandled, misused, released, disclosed, or used in an inappropriate manner by the Respondent, its agents, officers, or employees. The Respondent shall take all reasonable steps and precautions to safeguard this information and data shall not divulge the information and data to parties other than those needed for the performance of duties under the Contract.

5.8 Comply with all federal and state of Texas privacy and security laws, rules, and regulations.

5.9 Respondent will be responsible for data breach notifications to prescribers, dispensers, TSBP and any other parties in accordance with HIPAA regulations.

5.9.1 Provide an example of this process which includes procedures and the appropriate timeline.

5.9.2 Provide detailed methods used to detect database system intrusion.

5.9.3 Provide privacy methods used to ensure that confidential data and communications are kept private.

6. QUERIES AND REPORTS – For the anticipated requirements below, Respondent must indicate the recommended solution. All reports must be available for download in both PDF and CSV formats.

6.1 Prepare audit reports for TSBP at the end of each reporting period identifying dispensers that have either not submitted a report or have been rejected.

6.2 Allow TSBP to search, correlate, query, and match records on all variables contained in the database system. Allow TSBP to correct the records and accept or reject any corrections made from any source.

6.3 Allow prescribers the ability to query records with the prescriber’s DEA number.

6.4 At a minimum, include the following reports:

6.4.1 Top prescribers of controlled substances

6.4.2 Top dispensers of controlled substances

6.4.3 Top household addresses receiving controlled substances

6.4.4 Top recipients of controlled substances

6.4.5 Patients using the most different pharmacies

6.4.6 Patients using the most different prescribers

6.4.7 Top controlled substances by generic name

6.4.8 Top drug usage by therapeutic class

6.4.9 Top drug usage by NDC number

The format of all reports shall be approved by TSBP.

6.5 Specify, identify, and report the number of registered user requests by user type (e.g., prescribers, dispensers, pharmacists) and provide audit report capabilities for individual users on demand.

6.6 Enable TSBP to perform ad hoc queries on live data immediately following submission and provide mechanism to download or create reports from the data.

6.7 Provide de-identified data for population health use and reports.

6.7.1 Data must be downloadable upon demand.

6.7.2 A mechanism must be provided to facilitate the display of data trends to the TSBP website. Provide examples of standardized statistical reports and graphs showing health trends related to the PMP.

6.8 Produce automatic threshold reports and a robust reporting module that allows for the modification of parameters. Expected criteria may consist of, but is not limited to, the number of prescriptions dispensed, number prescribers used, and the number of dispensers used in a designated period of time.

6.9 Provide the ability to generate alerts to prescribers and dispensers of patients who have been identified as exceeding specific threshold levels. TSBP must have the ability to review a patient’s auto-populated prescription history report and choose whether an alert should be sent to specific prescribers and/or dispensers of that patient.

6.9.1 Provide alerts generated on the following areas of concern:

· Generate an alert when a specified number of prescribers and/or dispensers is met or exceeded within a set time period.

· Generate an alert when the daily active MME is greater than or equal to a specified value.

· Generate an alert when opioids and benzodiazepines are prescribed within a set time period.

· Generate an alert when the daily active MME (morphine milligram equivalent) for methadone is greater than or equal to specified value.

· Generate an alert when opioids have been received daily for longer than a set time period.

6.10 Provide TSBP the ability to deactivate accounts of requestors and dispensers who are no longer authorized to use the database system for any reason.

7.0 PMP sYSTEM ENHANCEMENTS-For the anticipated requirements below, proposer must indicate a recommended solution.

7.1 Patient risk scores and usage patterns. Provide prescribers and dispensers with patient risk scores and an interactive visualization of usage patterns based on aggregated PMP data. The objective of this enhancement is to allow prescribers and dispensers to provide better care and quickly understand a patient’s history by identifying potential risk factors for accidental overdose death and harmful drug interactions.

7.2 Enhanced Data Analytic Capabilities. Provide functionality that allows TSBP staff to easily identify insights, outliers and areas of opportunity within PMP data through the use of pre-built interactive dashboards (with various filters such as AHFS descriptions, active ingredients, patient county, etc.) and custom-built reports that provide data visualizations, benchmarking and time series trending. At a minimum, pre-built dashboards must include:

· Dispensations-Ranked by Selected Measure (e.g., unique patients, prescriptions, total MME)

· Dispensation Detail by Patient Category (Patient Name, Birthdate, City and State, County, Postal Code, etc.)

· Dispensation Detail by Prescriber Category (Specialty, License, etc.)

· Dispensation Related Metrics Trended Over Time

· Dispensation Related Metrics-Travel Distance by Patient Dispensation

· Dispensation Submission Analysis (AHFS descriptions, prescription unit, active ingredient, etc.)

7.3 Non-Appropriation of Funds. TSBP is a state agency whose authority and appropriations are subject to actions of the Texas Legislature. If TSBP becomes subject to a lack of appropriated funds for costs related to PMP System Enhancements under Section 7 of this RFP, then those services will be terminated. In the event of a termination or cancellation under this Section, TSBP will not be liable to Respondent for any damages, which are caused or associated with such termination, or cancellation and TSBP will not be required to give prior notice. See Clause 16 of Attachment A Terms & Conditions for general terms related to Non-Appropriation of Funds.

8.0 DATA RECORDS – For the anticipated requirements below, Respondent must indicate a recommended solution.

8.1 Respondent shall provide a mechanism to document receipt of each data transmission from a dispenser. All documentation shall be retained by the Respondent until such time as TSBP provides written authorization for its destruction.

8.2 Upon termination of the Contract by TSBP, or six months prior to the expiration of the Contract, the Respondent shall provide to TSBP a written transition plan designed to ensure a smooth and efficient turnover of data from the Respondent to TSBP. The Respondent shall take all reasonable action to provide a minimally disruptive transition. TSBP shall approve the transition plan prior to its implementation.

8.3 At no additional cost to TSBP, the Respondent shall ensure the transfer to TSBP of all electronic and paper files, including archived files, at the termination of the Contract. The software used to access and view files shall not be proprietary and shall not in any manner preclude access to the files by TSBP. TSBP reserves the right to transfer all data to any future vendor.

9.0 Integration of Electronic Medical Records-For the anticipated requirements below, Respondent must indicate the recommended solution.

9.1 Respondent must provide a solution to authorized healthcare entities (subscriber) that wish to integrate TX PMP information into clinical workflows. The solution must include technical expertise, integration software and ongoing support services to authorized healthcare entities through designated IT support personnel of said entities.

9.2 Respondent must provide an integration service that provides Health IT Systems (Electronic Health Records (EHR), Pharmacy Management Systems (PMS), etc.) of authorized healthcare organizations with the ability to make requests for patient reports from the target PMP on behalf of authorized users and receive prescription reports from the responding PMP. Integration service must also facilitate integration of multi-state PMP information within the clinical workflow.

9.3 Respondent must ensure that Health IT Systems used by a prospective subscriber seeking integration are compatible with Respondent’s integration solution to include vetting for basic system functions (e.g., system security, user security, audit tracking).

9.4 Respondent must ensure that integration solution is capable of maintaining audits logs of all prescription report data supplied to an authorized user through integration. Respondent must maintain audit logs per retention in 3.11. Respondent must supply audit records immediate access to TSBP upon request.

9.5 Respondent must develop an Integration Request Form and Terms of Use to be signed by healthcare entities before they can subscribe to the integration services. Any healthcare entity interested in integrating TX PMP information into workflows of authorized users will accept the Terms of Use prior to accessing the integration services. Respondent must receive and process Integration Request Forms and Terms of Use agreements received from prospective entities applying for Integrated access. Integration Request Forms must then be submitted to TSBP for final review and approval prior to enabling integrated access.

9.6 Respondent must provide subscriber, and if requested, subscriber’s contracted EHR or PMS, with technical documentation (the Application Programming Interface) that describes how to connect to and use integration service. Respondent must provide subscriber or subscriber’s IT organization (EHR or PMS) with technical support as required during the implementation phase and while in production.

9.7 If subscriber is utilizing a health IT system (EMR) that has already connected to integration service, Respondent must make the subscriber aware of it. Subscriber will then work with the vendor of the health IT system to procure the required code/services to accelerate the integration. Respondent must not charge the subscriber any startup or recurring fees for said integration. However, any charges from the health IT vendor to provide the code/services to affect such integration will be the responsibility of the subscriber.

9.8 Respondent must provide a test environment where the licensee is able to test their integration before utilizing the integration technology against the live TX PMP system.

9.9 Subscriber agrees to designate a point of contact for the end-users (defined as any authorized user of TX PMP who is an employee of, or contractor to, the subscriber’s organization), in case the end-users have support needs. Respondent must work with subscriber’s point of contact to diagnose and resolve any issues related to the integration services.

9.10 Respondent must provide TSBP with information regarding the use of integration services by subscribers. Said information includes, but is not limited to:

· Subscriber organization name

· Number of transactions from subscriber to TX PMP within any timeframe

· Specific users within subscriber’s organization that have requested TX PMP reports

· Specific facilities from which subscriber’s authorized users have requested TX PMP reports

9.11 The solution must include the following services:

· Managed Service API: A web service interface that can be invoked by the Health IT system (such as an EHR/EMR, or Pharmacy Management System) of an authorized healthcare organization (Health System, Pharmacy Chain, Integrated Delivery Network, etc.).

· Requestor Provisioning Service: A module to provision healthcare organizations to PMP Gateway. An order form that is mutually agreed upon by TSBP and Respondent must be filled out by the requesting healthcare organization prior to provisioning. Upon provisioning, a message is sent to the TX PMP Administrator to review and authorize the requesting healthcare organization to connect to the TX PMP via PMP Gateway.

· Authorization Module for PMP Administrator: A module to provide the TX PMP Administrator the ability to authorize a requesting healthcare organization (e.g., the EHR of an ambulatory care practice in TX) to access TX PMP information through the PMP Gateway.

· Run-Time Services: Services to enforce the authorization rules set forth by the TX PMP Administrator and process incoming requests from the Health IT System.

· Reporting Services: PMP Gateway must provide regular reports to the TX PMP Administrator relating to the usage of the PMP Gateway service by authorized healthcare organizations. The reports include, but are not limited to, usage metrics drilled down by various attributes. Usage reports include, but are not limited to:

· Usage metrics by healthcare organization;

· Usage metrics by facility;

· Usage metrics by authorized user within a healthcare facility (including a pharmacy);

· Specific patient reports accessed via PMP Gateway, with cross-references to the response identifier provided by the underlying PMP system.

· Authorized administrative user must be able to export reports as a Comma Separated Values (CSV) files.

· Technical Support: Respondent must operate a 24x7x365 support center to receive incoming support requests from designated IT support personnel within authorized healthcare organizations. Support requests are routed to the appropriate organization/department for response.

· Integration Support: Respondent must provide technical assistance to authorized healthcare organizations in integrating their Health IT System to PMP Gateway and testing the integration.

9.12 Non-Appropriation of Funds. TSBP is a state agency whose authority and appropriations are subject to actions of the Texas Legislature. If TSBP becomes subject to a lack of appropriated funds for costs related to Integration under Section 9 of this RFP, then those services will be terminated. In the event of a termination or cancellation under this Section, TSBP will not be liable to Respondent for any damages, which are caused or associated with such termination, or cancellation and TSBP will not be required to give prior notice. See Clause 16 of Attachment A Terms & Conditions for general terms related to Non-Appropriation of Funds.

10.0 Texas Wholesale Distributor Database Reporting-For the anticipated requirements below, Respondent must indicate a recommended solution.

10.1 Establish a data collection system capable of collecting and ingesting Schedules II, III, IV, and V controlled substance distribution data as reported by distributors under Section 481.0764 of the Texas Health and Safety Code.

10.2 Receive electronic controlled substance distribution data transmitted directly from distributors or distributing entities, seven days a week, and twenty-fours a day. The number of submitters reporting monthly is estimated to exceed 250 while the number of controlled substances distributions reported monthly could be in excess of 100,000 distributions.

10.3 Collect and provide a secure mechanism for collecting and/or uploading of distribution data reported by distributors of controlled substances which are required to be reported in a standardized Automation of Reports and Consolidated Orders System (ARCOS) format as established by the Drug Enforcement Administration (DEA). For details of the format see the DEA’s document at: https://www.deadiversion.usdoj.gov/arcos/tran2kco.pdf. Submitted data fields will include, at a minimum:

· Reporting Registrant DEA

· Reporting Registrant Name

· Transaction Code

· Action Indicator

· NDC Number

· Quantity

· Unit

· Associate Registrant DEA Number

· Order Form Number

· Transaction Date

· Correction Number

· Strength

· Transaction Identifier

· NDC Description

· NDC Label Name

· Drug Type

10.4 Standardize data, to include the identification and removal of duplicates, population of additional details about recipient facilities and drugs distributed using external reference files.

10.5 Provide a mechanism or portal for TSBP staff to access all Texas Wholesale Distributor Database. Additionally, portal must allow TSBP staff to generate reports, on-demand, of distribution data. Portal must include, at a minimum, filter functionality of the following data fields:

· Reporting Registrant DEA

· Reporting Registrant Name

· Associate Registrant DEA

· NDC Number

· Drug Type

· Transaction Date

10.6 The Respondent must observe the following requirements.

10.6.1 All provisions of Section 1.12 Data Ownership apply to Texas Wholesale Distributor Database collected as part of Section 10.0.

10.6.2 All provisions of Section 8.0 Data Records apply to Texas Wholesale Distributor Data collected as part of Section 10.0.

11.0 OTHER REQUIREMENTS – For the anticipated requirements below, Respondents must indicate the recommended solution.

11.1 Provide a disaster recovery plan for data pertaining to the database system in the event the system is unavailable due to human error, equipment failure, or a natural disaster. Please address any historical statistics on database system unavailability for other states (i.e., on average, how long is the database system down or otherwise unavailable on a monthly basis for reasons other than natural disaster). Describe how users will be notified in the event of down-time.

11.2 Provide continuing technical assistance for TSBP and other licensing agencies via telephone and email. A minimal coverage of Monday through Friday, 8 A.M. to 5 P.M., central time, is required.

11.3 Provide a toll-free telephone number and email address by which requestors and dispensers may contact the Respondent to resolve problems and receive information concerning data transmissions. Suggested coverage is Monday through Saturday, 8 A.M. to 8 P.M., central time. Coverage on Sundays is preferred.

11.4 Provide training for database system use for TSBP as required throughout the life of the Contract and at the request of TSBP.

11.5 Explain how database system patches, version updates, security updates and software upgrades will be managed and funded.

11.6 Provide a solution to allow the option to exclude searches originated by users of categories designated by TSBP in patient search history reports.

11.7 Provide a means for law enforcement and prosecutorial official user access that allows:

· Ability of a user to request a query and upload required documentation.

· Ability for staff review and approval before queried data is made viewable to user and downloadable by user in both PDF and CSV formats.

· Ability to generate an automatic email alert to user when requested data is available.

11.8 Responses must include an implementation plan for go-live date of September 1, 2026. This plan must outline the timeline and deliverables for each of the following elements:

· An online prescription monitoring platform as required by specifications from Section 2.0, 3.0, 4.0, 5.0, 6.0 and Section 7.0.

· Intake of existing data records as required by Section 8.0.

· Integration of the prescription monitoring platform and health IT records as required by Section 9.0.

· Implementation of wholesale distributor data as required by Section 10.0.

12.0 RESPONDENT QUALIFICATIONS

12.1 Respondent must provide examples of previous or current PMP projects undertaken. Projects of similar size and scope should also be listed. Experience with PMP projects is required.

The following benchmarks of size and scope apply:

· 200,000 users.

· 30 million dispensations annually.

· 50 million manual searches annually.

· 250 million integrated searches annually.

· Five year contract duration.

12.2 Respondent must list all contracts or purchase orders that Respondent executed or accepted within the last three (3) years and which were canceled or terminated prior to completion by any state agency or other entity with which Respondent contracted. For each cancelled or terminated contract or purchase order, Respondent must include a detailed explanation for the cancellation or termination and final resolution of the matter. Include the names and telephone numbers of each such agency’s or firm’s contact person. If none, specify none.

12.3 Respondent must indicate the number and skill-level of staff that would be assigned to this project. Respondent must provide resumes of staff with primary responsibility for implementation and operations of the project.

12.4 Respondent must indicate ability to meet project deadlines. Proposals should include solutions for meeting milestones established in the RFP schedule (Section 1.11, Schedule).

12.5 TSBP will evaluate Respondent’s past performance through the Vendor Performance Tracking System as authorized by 34 Texas Administrative Code §20.108 (see Section 15.3).

13.0 DEMONSTRATIONS

13.1 TSBP, in its sole discretion, reserves the right to require Respondents to make demonstrations (including oral and online portions) prior to the Contract award and may consider such demonstrations when evaluating proposals. Respondents will be notified in writing and will be provided with equal advance notification of demonstration assignments and guidelines. Failure to participate in the requested demonstration may eliminate a Respondent from further consideration.

13.2 Respondents are responsible for their own demonstration equipment. TSBP is not responsible for any costs incurred by the Respondent in preparation for the demonstration.

13.3 Demonstrations should demonstrate user interfaces, uploading of prescription data, reports, notifications, and other aspects of the proposed PMP database system.

13.4 TSBP reserves the right to waive demonstrations.

13.5 Demonstrations will be reviewed and graded as pass or fail. Only passing demonstrations will be considered for award of Contract.

14.0 PRICING

14.1 Pricing

Respondent shall provide prices on bid table BT-69FI for each of the following:

1. Development of services for a PMP platform provided under Sec. 2 through Sec. 8 and Section 11, and any associated services (one time cost).

2. Migration of PMP data to populate platform (one time cost).

3. Ongoing annual cost of PMP platform.

4. Development of services provided under Sec. 9, Integration of Health IT systems (one time cost).

5. Ongoing annual cost of integration services.

6. Development of services provided under Sec. 10, Texas Wholesale Distribution Database (one time cost).

7. Ongoing annual cost of TWDD.

Respondent shall provide firm fixed prices. All costs associated with providing the required services shall be included in the stated prices.