EVT0010525_-_Bid_Amendment_1_-_Q_As.pdf

Office of Procurement and Contracts 900 SW Jackson St., Room 451 South Topeka, KS 66612

Phone: 785-296-2376 Fax: 785-296-7240 www.admin.ks.gov/offices/procurement-and-contracts Adam Proffitt, Secretary Todd Herman, Director

Laura Kelly, Governor

Amendment

Request for Proposal

Date: October 30, 2025

Amendment Number: 1

Event Number: EVT0010525

Closing Date: November 19th, 2:00 PM CST

Procurement Officer: Tyrone Gasper

Telephone: 785-296-3126

E-Mail Address: Tyrone.Gasper@ks.gov

Agency: Kansas Department of Health and Environment

Item: Trauma Registry Web-Based Application

Conditions: 1) Answers to submitted questions follow on page two (2) of this document.

A signed copy of this Addendum must be submitted with your bid. If your bid response has been returned, submit this Addendum by the closing date indicated above.

I (We) have read and understand this addendum and agree it is a part of my (our) bid response.

NAME OF COMPANY OR FIRM:

SIGNED BY:

TITLE: DATE:

It shall be the vendor's responsibility to monitor this website on a regular basis for any changes/addenda.

http://admin.ks.gov/offices/procurement-contract mailto:Tyrone.Gasper@ks.gov http://admin.ks.gov/offices/procurement-contract

Event ID: EVT0010525

EVT0010525 – Amendment 1

Trauma Registry Web-Based Application

Questions and Answers

Q1: Will the "20 hospitals collecting data on local servers" transition to using the centrally hosted state provided system? (Page 26)

A1: No

Q2: Several "Services to be Provided" use the term "develop". Can the bidder meet the requirements with existing functionality or is KDHE seeking custom development? (Page 28)

A2: Yes, current existing functionality is acceptable

Q3: What is the data format of the historical trauma registry data? (Page 28)

A3: Format is required to be exported to KDHE in a format acceptable for submission to NTDB

Q4: How many historical trauma registry records are required for import into the new registry? (Page 28)

A4: All records dated back to 2016, approximately 200,000

Q5: Are all historical trauma registry records in a common format? (Page 28)

A5: Yes

Q6: Has KTP ever collected custom data elements (custom with respect to the ACS NTDS)?

(Page 28)

A6: Yes

Q7: Is "the application shall identify and link records" referring to trauma registry records?

(Page 28)

A7: Yes

Q8: Can you provide examples of reports that are compliant with "standardized reports reflective of established standards of care as defined by [ACS, JACHO, ACEP]"? (Page 29)

A8: These reports would be the standardized reports provided by TQIP

Q9: Can you provide examples of "reports on clinical Performance Improvement and Patient Safety necessary for the ACS site survey review for Level I, II, and III facilities"? (Page 29)

A9: Level I, II, and III trauma centers run these reports for their ACS site survey reviews. KDHE does not have access to these reports.

Q10: Can the "contractor must demonstrate HIPAA compliance, security, virus protection, and data backup processes/procedures in all processing environments" requirement be met with a SOC 2 Type 2 report and associated evidence? (Page 29)

A10: No, the SOC2 cannot be used alone unless you can map all of your SOC2 requirements to HIPAA requirements. Another option would be to map your NIST 800-53 to the HIPAA requirements.

Q11: What versions of EHR must be supported? (Page 29)

A11: All EHR versions utilized by KS hospitals

Q12: What features of integration with the Kansas EMS registry are required? (Page 29)

A12: A DUA with the KS Board of EMS will be needed to pull data from the EMS registry as well as push data from the trauma registry.

Q13: What features of integration with the "existing State registry databases, such as rehabilitation, vital statistics, and traffic crash records" are required? (Page 29)

A13: The features of integration must include being able to search individuals or incidents within the existing databases and, once identified, exchange data between the databases at the record level.

Q14: How many on-site training sessions are desired? (Page 31)

A14: 2 per contract year

Q15: Does Kansas require a single-sign on (SSO) integration? (Page 32)

A15: No

Q16: Can you provide an example of a "custom content template for the end user to create and generate reports as necessary?" (Page 28)

A:16: We require the ability to provide users with custom benchmark reports, report writer

Q17: Section 5. COST SHEET- Please confirm the estimated or not-to-exceed budget for implementation and three-year operations and maintenance.

A:17: Budget Information is not available.

Q18: Section 3.38. Indefinite Quantity Contract - What contract type does KDHE anticipate (e.g., firm-fixed-price, time-and-materials, or hybrid)?

A18: Please reference Section 3.39 Prices.

Q19: General - Has KDHE already reviewed or seen demonstrations of any trauma registry or comparable platforms?

A19: Demonstrations may be required it is the bidder responsibility to be prepared a demonstration should be required. Please reference Section 1.5 Appearance Before Committee.

Q20: Section 4 – Specifications - Deliverables / Timeline - When does KDHE expect the new system to go live following contract award?

A20: July 1, 2026

Q21: Section 4 – Specifications / Integration / Interfaces - Please describe KDHE’s current technology landscape (databases, hosting platforms, integration tools, identity management, and reporting systems) to ensure compatibility planning.

A21: KDHE is seeking a fully managed, hosted solution designed to minimize technical dependency on the current KDHE infrastructure. We expect the proposed solution to be architected as a modern, standalone system requiring minimal KDHE integration.

Q22: Section 4 – Specifications / Reporting - Please indicate KDHE’s preferred or existing business-intelligence or reporting platforms (e.g., Power BI, Tableau, SAS, Qlik) for analytics and dashboard integration.

A22: Tableau, SAS, R

Q23: Section 11 - Generative AI - Is KDHE open to AI-assisted or NLP-driven features (e.g., automated data validation, trend analysis, case summaries, or natural-language report generation), or should proposals focus solely on core registry functionality?

A23: No

Q24: Section 3.23. Subcontractors - Will KDHE accept subcontractor experience toward meeting the five-year minimum experience requirement?

A24: Yes

Q25: Section 3.36. Off-Shore Sourcing - Please confirm whether offshore or non-U.S. resources may be used for configuration, development, or QA, provided all hosting and PHI data remain within the U.S. and under HIPAA-compliant controls.

A25: No

Q26: Data Security Attachment - Please specify any required or preferred security certifications or standards (e.g., FedRAMP, SOC 2, NIST 800-53, HIPAA).

A26: HIPAA standards

Q27: Section 4 – Specifications -Disaster Recovery Plan - What RTO/RPO targets should be used for disaster-recovery planning?

A27: Data should be saved at a minimum every 24 hours

Q28: Vendor Preparedness for WCAG 2.1 Level AA Form - Does KDHE require third-party accessibility testing or will self-attestation be accepted for WCAG 2.1 AA compliance?

A28: KDHE does not require third party testing

Q29: Section 4 – Specifications-Integration - Beyond NTDB and TQIP, what other systems or agencies will require integration or automated reporting?

A29: KDHE and all KS hospitals

Q30: Section 4 – Specifications-Data Migration Plan - Please confirm the source systems, data volumes, and number of years of historical data expected to be migrated.

A30: All records since 2016 from the legacy system

Q31: Section 4 – Specifications- Key Functional Requirements - Approximately how many users are expected to access the new system—broken down by state-level and hospital-level users—and should scalability be planned for additional facilities?

A31: KDHE employees- 5, 127 hospitals with 2-7 users each

Platform should allow for scalability

Q32: Section 4 – Specifications- Test Plan - What acceptance process will KDHE use to verify successful implementation and data migration (e.g., UAT sign-off, validation checklist)?

A32: UAT sign-off

Q33: Section 4 – Specifications- Service Level Agreement(s) (SLA) - Please define the post-go-live warranty period and expected incident-response and resolution SLAs during O&M.

A33: Critical incident: Action on ticket within 1 hour, resolved within 12 hours Major incident: Action on ticket within 4 business hours, resolved within 1 business day Moderate incident: Action on ticket within 1 business day, resolved within 4 business days Minor incident: Action on ticket within 2 business days, resolved within 7 business days

Q34: Section 4 – Specifications- Solution Deployment to Test Environment - Should the proposed architecture include multiple environments (Development, Test, UAT, Production), and are these to be vendor-hosted or State-managed?

A34: Yes, vendor-hosted

Q35: Section 4 – Specifications- Deliverables / Timeline - Will KDHE consider a phased or pilot rollout before full statewide deployment if it reduces implementation risk?

A35: Pilot rollout

Q36: Section 1.5. Appearance Before Committee - Will KDHE conduct vendor demonstrations or walkthroughs as part of the evaluation process, and if so, what is the anticipated timeline?

A36: Demonstrations may be required it is the bidder responsibility to be prepared a demonstration should be required. Please reference Section 1.5 Appearance Before Committee.

Q37: Is there any incumbent for this opportunity?

A37: N/A

Q38: If there is an incumbent then why you are looking for other companies? Are you not happy with them?

A38: N/A

Q39: If there is an incumbent then are they bidding for this opportunity?

A39: N/A

Q40: What is the allocated budget for this RFP?

A40: Budget Information is not available.

Q41: Will the State accept a custom-developed solution, or are you specifically expecting a

COTS platform configured to your needs?

A41: Both will be accepted

Q42: Will the new platform need to support both web-based hosted entry and local uploads, as some hospitals currently submit via on-premise systems?

A42: Yes, both

Q43: Is the State open to a cloud-hosted solution (SaaS/PaaS) or do you prefer deployment on

State-managed infrastructure?

A43: Cloud-hosted solution is acceptable

Q44: Will the hosting environment be provided by the vendor (IaaS/PaaS) or is the State providing infrastructure?

A44: Provided by the vendor

Q45: Approximately how many hospitals/users will access the system statewide?

A45: KDHE employees- 5, 127 hospitals with 2-7 users each

Q46: Do users require role-based access levels (e.g., KDHE admin, hospital admin, hospital user, read-only)?

A46: Yes

Q47: Will multi-factor authentication be required?

A47: No

Q48: The RFP requires WCAG 2.1 Level AA compliance — is VPAT documentation required at submission, or only post-award?

A48: At submission

Q49: What are the project timelines?

A49: Go live goal is June 1, 2026

Q50: Is there an allocated budget range for this project? It would also be helpful to know if implementation and ongoing annual costs are funded from separate sources.

A50: Budget Information is not available.

Q51: Does KDHE have a preference for a solution built upon a configurable Commercial-Off-

The-Shelf (COTS) platform, or are you seeking a fully custom-developed application?

A51: Both are acceptable

Q52: What are the primary limitations or pain points of the current system that this RFP is intended to solve? Conversely, what features of the current system work well and should be retained or enhanced?

A52: This can be discussed after award

Q53: What is the name of the current trauma registry vendor and platform?

A53: N/A

Q54: Could you provide the current database schema, total data volume (in GB/TB), and the number of years of historical data that will need to be migrated?

A54: Migration of data dating back to 2016

Q55: For the ~20 hospitals using local servers, what software platforms are they using? Will they be required to transition fully to the new centralized solution, or will the new system need to accept batch uploads from them indefinitely?

A55: Will need to accept batch uploads

Q56: What are the primary EHR systems (e.g., Epic, Cerner, Meditech) in use across the 130 facilities?

A56: Epic, Cerner, others

Q57: What are the preferred integration methods (e.g., HL7v2, FHIR APIs, automated file transfer)? Are there existing interfaces that can be leveraged?

A57: N/A

Q58: Could you identify the vendors/systems for the Kansas EMS registry and the other state databases requiring interfaces?

A58: Can be discussed after award

Q59: Is existing API documentation available for these systems?

A59: No

Q60: Are these interfaces required at go-live, or can they be implemented in phases?

A60: Can be implemented in phases within the first year of contract

Q61: Beyond the ~15,000 annual cases, what is the projected growth rate?

A61: Unknown

Q62: What is the current breakdown of active users by role (e.g., data entry, administrator, analyst)?

A62: Data entry, state administrator, data submission, data query

Q63: The application must include the Abbreviated Injury Scale (AIS). Will the vendor need to procure the necessary AIS licenses on behalf of the State, or will KDHE provide them?

A63: Vendor must procure these licenses

Q64: For tracking patients across facilities without PII, are there specific probabilistic matching algorithms or state-mandated methodologies that must be used?

A64: No, the percent needs to be above 80% matching, dependent on the number of variables used

Q65: To ensure continuity, would it be possible to get samples of the most critical existing reports, particularly the ACS site survey reports and the Kansas-specific Level IV facility reports?

A65: At the time of award

Q66: Is the primary need for a set of pre-defined custom reports, or is the expectation for a powerful, user-friendly ad-hoc report builder that allows KDHE staff to create their own reports without vendor intervention?

A66: A report builder for KDHE staff is acceptable

Q67: The RFP mentions both Software-as-a-Service and Infrastructure-as-a-Service. Does

KDHE have a preference? If IaaS is an option, what are the specifications of the state-provided infrastructure?

A67: SaaS is preferred

Q68: The RFP requires vendors to complete three "Cloud Service Provider" documents. Could you please provide these specific document templates?

A68: The three IT questionnaires are found on pages 42-50 within the RFP document.

Q69: Does KDHE have a target go-live date for the new system?

A69: June 1, 2026

Q70: What are the expected helpdesk service hours? Should support be provided to both KDHE staff and the end-users at the 130+ hospital facilities?

A70: Support should be provided to KDHE and users, If support isn’t provided 24/7/365, a response should be given to the user giving a timeline of resolution

Q71: What is the approximate number of KDHE staff requiring admin training and the total number of end-users requiring initial training?

A71: KDHE employees- 5, 127 hospitals with 2-7 users each

Q72: When does the contract with the current vendor expire? Is there an expected transition period or knowledge transfer process involving the incumbent vendor?

A72: Pilot period for transition approximately June 2026

END OF AMENDMENT 1 – EVT0010525