ITB-24-002B- Addendum No.1.pdf

Honoring Those Who Served U.S.

ADDENDUM NO. 1

SOLICITATION NO.: FDVA-ITB-24-002B

SOLICITATION TITLE: JACOBSON NURSE CALL SYSTEM

ISSUE DATE: NOVEMBER 21, 2023

The following FDVA responses shall clarify or revise the requirements of Solicitation No. FDVA-ITB-24- 002B.

1) Vendor Question: If the technology solutions need to be hosted via a server on site (Microsoft Windows Server) will the server physical or virtual be supplied by the IT department or is this on the Contractor?

1) FDVA Response: Onsite servers are not permitted.

2) Vendor Question: Is a cloud-based technology solution acceptable? If so, what are the requirements for hosting in the cloud?

2) FDVA Response: Yes

System Requirements.

(a) Requirements:

1) So ware as a Service (SaaS) is a Mission Cri cal Applica on Tier solu on for user real me access.

2) Compa ble with Windows 11 and above, current release of M365, the most current Microso web browser, or Google Chrome. All must stay current with security updates.

3) System must be available 6:00 a.m. to 9:00 p.m. EST, 7 days per week, 365 days per year.

4) System shall provide a responsive hybrid mobile app supporting Android and iOS phones and tablets.

(b) Hos ng:

1) Infrastructure and telecommunica ons capabili es in order to support applica on and data access

6:00 a.m. to 9:00 p.m. EST, 7 days per week, 365 days per year.

2) Inform FDVA of any maintenance required system outages three (3) business days in advance and shall conduct such maintenance during non-business hours (9:00 p.m. to 6:00 a.m. EST, 7 days per week, 365 days per year).

3) Contractors shall provide commercially reasonable security and redundancy methods that will ensure a highly available and secure hosting operation.

State of Florida

DEPARTMENT OF VETERANS’ AFFAIRS

Office of the Executive Director 11351 Ulmerton Road, #311-K

Largo, FL 33778-1630

(727) 518-3202 www.FloridaVets.org

Ron DeSantis Governor

Ashley Moody Attorney General

Jimmy Patronis Chief Financial Officer

Wilton Simpson Commissioner of Agriculture

James S. Hartsell Executive Director

(c) Other Features:

1) Maintain a 99.5 % uptime.

2) System accuracy shall be 100% of what is entered and edited (withstanding human error, data integrity must be consistent, correct, and maintained).

1) Support 24-hour clock and standard time zone, with a daylight-saving option.

2) Must complete annual system risk assessment.

3) Must have a disaster recovery plan in place and be tested annually.

Cloud Recovery Point and Time Objec ves. Contractor shall provide recovery point objec ve (RPO) or maximum acceptable data loss and recovery me objec ve (RTO) or the meframe to restore applica on and services based on the following requirements for the designated applica on type.

(a) Mission Cri cal Applica on Tier

1) RPO = 30 minutes

2) RTO = 1 hour

3) Vendor Question: Are there any security protocols the IT department requires in conjunction with HIPAA?

3) FDVA Response: Yes

System Data Security. Contractor and FDVA shall comply with the applicable requirements of the Security Rule, codified at 45 CFR Part 164, Subparts A and C, issued pursuant to the Administra ve Simplifica on provisions of Title II, Sub tle F of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA- AS"), so that the FDVA may meet compliance obligations under HIPAA-AS.

The parties agree to the following:

(a) Security of Electronic Protected Health Information (EPHI): Contractor will develop, implement, maintain, and use administrative, technical, and physical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability (CIA) of EPHI (as defined in 45 CFR

160.103 that Contractor creates, receives, maintains, or transmits on behalf of the FDVA, "EPHI") consistent with the Security Rule.

(b) Reporting Security Incidents: Contractor will report to the FDVA any Security Incident of which Contractor becomes aware that is:

1) a successful unauthorized access, use of disclosure of FDVA's EPHI; or

2) a successful major modification or destruction of the FDVA’s data containing EPHI; or

3) a successful minor modification or destruction of FDVA's data containing EPHI; or

4) interference with system operations in an information system containing FDVA EPHI.

Upon the FDVA's request, Contractor shall report any Security Incident of which Contractor becomes aware.

(c) Compliance Date. The parties will comply by the later of the last date set forth in the signature block above or the compliance date of the Security Rule as defined in 45 CFR 160.103.

(d) Security Breach Notification Costs. Contractor agrees and understands it shall be responsible for payment of all costs of any type or amount associated with the security breach of EPHI if such a security breach occurs and is the fault of the Contractor or its Subcontractors. Such costs shall include, but not limited to, those related to fees and penalties, Governmental investigations and enforcement actions, and other legal actions of any type or kind.

Data Ownership. All informa on in the system belongs to FDVA and shall not be shared with any person or en ty, except when FDVA provides access to its database. Contractor shall not use or allow any online tracking technologies by third par es to track FDVA users or gather informa on about FDVA users should the FDVA user navigate away from the contractor’s original website(s).

Data Center Requirements. Contractor shall operate the data center or must partner with an approved data center (located within the con nental United States). Contractor shall ensure that the data center follows all HIPAA guidelines, as well as all federal and state laws governing this type of informa on and the following requirements:

(a) Data Center Physical Requirements:

1) Monitored security 24 hours per day, 7 days per week, 365 days per year.

2) Redundant power systems capable of running all equipment at full capacity indefinitely.

3) Redundant connec vity to the internet.

4) Must be a hardened facility, able to withstand weather and condi ons of its loca on.

5) Data shall be SSAE 18 and SOC Type 2 cer fied.

6) System must be encrypted at rest.

(b) HIPAA, & Sarbanes Oxley, Compliant Data Center:

1) Must sign a business associate agreement.

2) Shall have data backup for redundancy with off-site storage physically located within the con nental United States or stored in the Cloud on servers that reside within the con nental United States.

3) Shall have a separate training environment from produc on database.

(c) Data Security:

1) Detect and contain undesirable traffic on public networks.

2) Prevent malware invasions, including but not limited to viruses, worms, Trojans, and ransomware.

3) Stop hacker a empts like SQL injec ons and XSS (cross-site scrip ng) a acks.

4) Include stringent data destruc on policies.

5) Residual data must be destroyed in accordance with HIPAA guidelines.

6) Track any changes to hos ng environment and alert data center staff with an e-mail.

(d) Applica on-Level monitoring:

1) Alerts to supervisors, bureau chiefs, and IT Staff.

2) Detect ac ve hosts and bad logons.

3) Planned maintenance during off peak hours.

4) Roles based security matrix.

5) Full data transac on history, with rollback capabili es.

Data Center Audit. FDVA requires access to annual data center audit of data controls security standards and opera ons, as well as cer fy that HIPAA and Sarbanes Oxley are followed.

4) Vendor Question: Will the contractor need to provide battery backup systems for equipment?

4) FDVA Response: ITB-24-002B Section18, 19, 21 Replacement Equipment- contractor provides.

Failure to file a protest within the time prescribed in Section 120.57(3), Florida Statutes, or failure to post the bond or other security required by law within the time allowed for filing a bond shall constitute a waiver of proceedings under Chapter 120, Florida Statutes. Any protest concerning FDVA decision must be timely received by FDVA Agency Clerk at: Florida Department of Veterans’ Affairs, Office of the General Counsel

- Agency Clerk, Largo Headquarters 11351 Ulmerton Rd. Largo, Fl. 33778.

REMINDER: Make sure to fully execute and include Solicitation No. FDVA-ITB-24-002B Form “4” Addendum Acknowledgment with complete bid package submission. Failure to do so may result in respondent bid being considered nonresponsive.

Solicitation No. FDVA-ITB-24-002B is revised to the extent specifically amended by this Addendum.

Otherwise, all other terms, conditions, and provisions of Solicitation No. FDVA-ITB-24-002B remain in full force and effect.

As specified in Solicitation No. FDVA-ITB-24-002B, Respondents bids shall be delivered:

PRIOR TO:

3:00 PM (local time), on Tuesday, December 5, 2023.

TO:

Jo Ann Snyder Purchasing Specialist Florida Department of Veterans’ Affairs Mary Grizzle State Office Building 11351 Ulmerton Road, Suite 335 Largo, FL 33778-1630

Sincerely, Jo Ann Snyder Purchasing Specialist Florida Department of Veterans' Affairs

END OF DOCUMENT