HSS24018-DUITRACK-qa.docx

DEPARTMENT OF HEALTH

AND SOCIAL SERVICES "Office of the Secretary"

Date: January 30, 2024

By: Eddie Mui Office of the Secretary

Subject: Addendum 1 – Questions and Answers HSS-24-018 - DHSS DUI Tracking System

Please Note: The attached Questions and Answers hereby become a part of HSS-24-018 - DHSS DUI Tracking System.

Eddie Mui Management Analyst III

Stacy Saylor Strategic Information Systems Project Leader

Questions for HSS-24-018 - DHSS DUI Tracking System

1. If this RFI greenlights a solicitation, what is the estimated timeframe for procurement?

Solicitations are approved through a Request for Proposal (RFP). A Request for Information is the first step prior to an RFP. If a solicitation is approved, the estimated timeframe for procurement is six months. This includes developing the proposal documents, publication of the proposal, review of the bids and contract negotiations.

2. What is the anticipated contract value?

The estimated contract value is $150,000 to $300,000.

3. How many potential users will there be that will need to use the software?

The software will have approximately 875 active users.

4. Section number: II Scope of Work Paragraph number: 3 Page number: 4 Text of passage being questioned: Technical capabilities of the system include numerous interfaces with other State systems utilizing existing web services.

Can you provide what other State Systems are utilizing so that in order to evaluate if the interface already exists or needs built?

The existing interfaces include the Division of Motor Vehicles and the Delaware Criminal Justice Information System. The system also includes an email webservice.

5. Can you provide the number of DHHS users that will require access to the system to input information?

The software will have approximately 875 active users.

6. Would there be a need for Clients to ever input or update their own information?

The DUI Tracking System is not public facing. Client data is updated via interfaces and/or providers.

7. RFI Reference: "Cloud solutions are desired. Cloud platforms and/or COTS products must have stringent data protections. Data must be encrypted in transit and at rest according to State technology standards. Additionally, cloud environments should be securely provisioned in a 'Government Cloud' or similar environment that will provide additional levels of security protections such as FedRamp or an equivalent type of certification."

"Regarding the cloud environment's security standards, particularly for Government Cloud implementations, could you specify whether certifications equivalent to FedRAMP, such as ISO 27001 or SOC 2, are also acceptable?

Both ISO 27001 and SOC 2 are acceptable.

8. Additionally, are there any state-specific certifications or compliance requirements that vendors need to be aware of to ensure alignment with the desired security posture?"

There are no state specific certifications. The state specific compliance requirements can be found using the below links:

https://dti.delaware.gov/technology-services/standards-and-policies/ https://dhss.delaware.gov/dhss/otsa/itpubs.html

9. RFI Reference: "Client Management Functions – This function should capture demographics and contact information of each client."

"In relation to the importation of existing client demographic and contact data into the new system, is there a preference for certain file formats or data structures? For instance, are formats like CSV, XML, or JSON preferred, and are there any specific requirements for data mapping or transformation to ensure seamless integration with the new system's data schema?"

Data migration will occur one time with a delta update performed prior to implementation. Because data migration activities will be minimal, expectations are uploads would follow CSV, fixed length text files or some other static data format mutually acceptable between parties.

10. RFI Reference: "Provider functions - View client assignments from DERP. Establish and track client communications. Track program completion requirements based on charge conviction and restitution (restitution includes client education and/or counseling). Communicate restitution completion to Courts. Facilitate and track driver’s license reinstatement."

"Regarding the tracking of program completion requirements for providers, could you elaborate on the specific types of data and milestones that need to be monitored? For instance, are key indicators like completion of counseling sessions, restitution payments, or educational program attendance mandatory for tracking, and is there a need for automated notifications or alerts when clients reach certain milestones or fail to comply with their program requirements?"

The data to be monitored includes three general areas: counseling, education and restitution. Data elements associated to these three general areas include beginning and end dates along with basic description of the types of counseling, education and/or restitution requirements. The ability to provide outbound administrative notification upon missed deadlines is an optional requirement. DHSS is interested in any value add deliverables not specifically listed in the RFI requirements. If the Vendor feels the optional requirements provide a more comprehensive user experience, please include those optional requirements.

11. RFI Reference: "Data... Provide ability for ad-hoc reporting functions."

"In regard to the system's ad-hoc reporting capabilities, could you detail the anticipated complexity and specific functionalities expected? For example, is there a requirement for dynamic filtering, pivot capabilities, or real-time data aggregation in these reports, and are there specific data visualization elements, like charts or graphs, that should be supported?"

The minimum requirements for ad-hoc reporting capabilities are the ability to extract flat files from the system. The flat file can be fixed length or CSV format. The end user should have the capability to generate 10-15 canned reports displaying discrete data elements.

12. RFI Reference: "Workflow Capabilities - The DUI tracking system will require basic workflow capabilities with due date and notification features associated with each workflow step."

"Concerning the workflow capabilities of the DUI Tracking System, could you specify the critical steps and the corresponding notifications required for each stage? For instance, are there specific alerts for case assignment, progress updates, and completion milestones, and is there a need for escalation notifications for overdue tasks or non-compliance incidents?"

The critical steps and corresponding notifications will be detailed in the requirements validation phase of the project. The ability to provide outbound administrative notification upon missed deadlines is an optional requirement. DHSS is interested in any value add deliverables not specifically listed in the RFI requirements. If the Vendor feels the optional requirements provide a more comprehensive user experience, please include those optional requirements.

13. RFI Reference: "Data must be encrypted in transit and at rest according to State technology standards."

"With respect to the requirement for data encryption both in transit and at rest, could you specify the particular encryption standards or protocols mandated by State technology standards? For example, are standards such as AES 256-bit encryption or TLS 1.3 for data in transit, and similar robust protocols for data at rest, expected for compliance?"

Both AES-256 and TLS 1.2 are acceptable for both in transit and at rest data encryption.

14. RFI Reference: "Web Services/interfaces for client referrals... Department of Corrections, Division of Motor Vehicles, Delaware Court System, Delaware Justice Information System, Other State DUI Tracking Systems (ex. New Jersey)."

Regarding the interface with the Delaware Court System, can you specify the required data exchange standards and protocols? For example, are formats such as XML, JSON, or RESTful APIs expected, and is there a need for specific security measures like SSL/TLS encryption or OAuth 2.0 for secure data transmission?

DHSS uses mainframe native interfaces on z/OS. DHSS also does not use OAuth for this solution. Currently we utilize TLS 1.2.

15. RFI Reference: In the area of audit trails within data management, could you specify the critical events and activities that need to be comprehensively logged? For example, are actions such as user access, data modifications, system configuration changes, and any security breach attempts essential for inclusion in the audit trail to ensure regulatory compliance and operational transparency?

Relating to the DUI case referrals to DSAMH, can you specify the crucial information required upon referral? For instance, are details such as the client's identifying information, specific DUI offense details, and any initial assessments or recommendations from referring entities necessary for an effective transition to DSAMH?

For Authentication Logs, the below is required:

Date/Time Stamp

User ID

Event Category

Event Name

Event Outcome (success/failure)

Client IP Address

For Application Access Logs, the below is required:

Application

User ID

Time Accessed

Time Exited

IP Address

For Application Code Error Logs, the below is required:

Error

Description

IP

Date/Time Stamp

Web Application Page ID

For the interface, the only crucial information to be provided is the client’s identifying information and the DUI offense details.

16. RFI Reference: System Integration with Other State Systems On the requirement of the integration of the proposed DHSS DUI Tracking System with other state systems, could you identify the key technical and compliance requirements that are essential for this integration? For example, are there specific communication protocols, data security standards, or interoperability frameworks such as HL7 or FHIR for healthcare data that need to be adhered to for effective and secure data exchange between systems?

Detailed technical requirements will be provided upon Request for Proposal creation. High level technical requires are: cloud first, government cloud provisioning for data protection, adhering to state and federal standards (Standards and Policies - Department of Technology & Information (DTI) - State of Delaware). Interoperability with HL7 and FHIR standards will be required. Data Security Standards can be found at previously provided link for the standards and policies.

image1.png