NE MDR Attachment B_CMS.docx
DOCX document 76 KB Posted
- Attached to
- Medicaid Drug Rebate System (MDR)
- Solicitation number
- 124528 ON
- Issued by
- Lancaster County, Nebraska
About this file
This is an attachment document for the Medicaid Drug Rebate System (MDR) solicitation issued by the State of Nebraska Department of Health and Human Services under RFP #124528. The State is requesting proposals for design, development, testing, implementation, and five-year operational support of a comprehensive system to manage Medicaid drug rebates, including rebate calculations, claims processing, vendor management, and reporting. The system must integrate with Nebraska's Medicaid Management Information System (MMIS), Health Insurance Administration (HIA), Centers for Medicare & Medicaid Services (CMS), managed care organizations, and pharmacy benefit managers across eighteen defined data interfaces. Key operational requirements include capturing rebate data for timely invoicing within 60 days of each quarter end, generating automatic delinquent letters within 10 business days, completing quarterly rebate file generation within 1 business day of invoice cycle completion, and providing dispute resolution support within 5 business days of DHHS request. Written questions are due June 23, 2026, with proposals due July 23, 2026 at 2:00 p.m. Central Time. The evaluation period runs July 30 through August 13, 2026, with Intent to Award expected August 27, 2026. The initial contract term is five years with one optional three-year renewal, and contract finalization is targeted for September and October 2026, with a January 2027 award and start date.
The contractor must comply with Section 1927 of the Social Security Act, applicable CFR provisions (42 CFR 447.509, 447.511, 447.520), HIPAA regulations, and NIST standards, and must designate Privacy and Information Security Officials to implement administrative, physical, and technical safeguards. The contract includes performance guarantees with daily monetary penalties ranging from $500 to $5,000 per incident for non-compliance across six requirement categories. The vendor must provide trained operational staff 30 calendar days prior to Go Live and replace key personnel within 30 calendar days, and must develop and submit a DHHS-approved Turnover Plan at least 180 days before contract end. The contractor bears all costs for breach investigation, mitigation, and notification, with breaches to federal information requiring notification to DHHS within one hour of discovery and all other confidential information within 15 days. Pricing must remain fixed for the first five years. The State may consider resident disabled veteran and designated enterprise zone preferences under Nebraska Revised Statutes and reserves the right to conduct best and final offer rounds and vendor demonstrations.
View the file
Other files
Show all 28
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
ATTACHMENT B - Technical Requirements
RFP# 124528 ON
Medicaid Drug Rebate (MDR) System State of Nebraska, Department of Health and Human Services
IMPORTANT:
Please note that any additional cost must be captured only on the Cost Sheet and NOT within the response to the specification.
Failure to adhere to these instructions shall result in the bidder being deemed as "Non-Responsive".
General Guidelines for Vendors
1. Thoroughly Review Requirements: Carefully read each requirement, including subpoints and links provided. Ensure responses clearly address each aspect of the requirement.
2. Provide Supporting Details: Each response should include clear descriptions, processes, tools, or diagrams demonstrating how the solution meets the requirement.
3. Organize Responses:
· Use headings and subheadings to structure responses.
· Include bullet points for clarity.
4. Use Standards and Best Practices:
· Refer to relevant standards (e.g., Section 508, NIST, FIPS, HIPAA).
· Provide details of certifications, tools, and industry-compliant processes.
5. Clarity and Precision:
· Avoid vague language or ambiguous claims.
· Use concise, professional terminology.
· Ensure responses are tailored to DHHS requirements and align with federal and state guidelines.
6. Supporting Artifacts:
· Include visuals such as diagrams, charts, and flowcharts where applicable.
· Reference external documents or standards as appropriate.
7. Testing and Validation: Detail testing approaches, validation processes, and evidence that the solution meets outlined expectations.
Specific instructions to complete Technical Requirements
Bidders are to refrain from providing a solution that would result in additional fees and/or expressing that a feature or functionality is available at an additional cost.
This document contains four tables for each Technical Requirement type. The requirement types are as follows:
| Requirement Type |
| Range |
Architecture
ARCH-01 - ARCH-06
Data Management
DM-01 – DM–05
Security, Privacy, and Compliance
SPC-01 – SPC-09
Operations Management
OM-01 – OM-09
For each requirement listed under the tables in this document, the bidder shall choose whether their solution “Met the Requirement” then choose the “Implementation Approach” and the “Bidder’s Response” by following the instructions provided for each requested information directly below.
Met The Requirements Within each requirement there is a dropdown option to select from three options to answer whether the bidder will meet the requirement or not. The available options to choose from and their descriptions are as follows.
| Available Options |
| Description |
YES
The Bidder confirms that their solution meets the specified requirement
| NO |
| The Bidder confirms that their solution does not meet the requirement |
| MET WITH DEVIATION |
| The Bidder Confirms that their solution meets the specified requirement with deviation taken to the specified requirement. |
(If this option is selected, then the bidder shall explain within the Bidder’s Response section how they plan to meet the requirement.
Implementation Approach:
The Implementation Approach requested in this document can be described as the methodology that will be utilized by the bidder to meet the specific requirement. Within each requirement there is a dropdown option provided to select your Implementation Approach from which an option must be selected. The available options to choose from and their descriptions are as follows:
| Available Options |
| Description |
Out of Box (OOB)
Indicates that the functionality is available in the solution without any modifications.
| Customization |
| Refers to changes made to the base product to meet specific requirements. This may involve coding or other significant alterations. |
| Configuration |
| Refers to adjustments or settings changes within the solution that do not require coding but adapt the product to meet requirements. |
TPS
Met with third party software
NA
Not Available
Bidder’s Response As bidders prepare responses to each individual requirement, the responses are expected to address the individual requirement in a manner that demonstrates to DHHS that the bidder understands the requirement and how the bidder will meet the specific requirement. If the bidder’s response simply repeats the requirement, acknowledges, or adds sales materials in the Bidder’s response, DHHS will reserve the right to deem the response as a “Non-Responsive Solicitation Response”. However, if needed to appropriately explain bidder’s response, a mix of tables, graphical details, and written narrative is acceptable.
The bidder’s response to each requirement must include confirmation and a detailed explanation for the Implementation Approach taken. Bidders shall capture any assumptions, risks, or dependencies related to fulfilling each individual requirement.
Provide specifics, such as:
· Tools or methods used.
· Estimated effort for customizations/configurations.
ARCHITECTURE
| Number |
| Requirement Description |
| ARCH-01 |
| 1. Describe the bidder solution to addressing the following architectural details: |
a. Technology Architecture: Describe the software components, including third-party software products, open-source libraries, and utilities that complete the platform for running a service or supporting an application. This section should document any technical requirements for accessing the software, including but not limited to client desktop installs, etc. Further, the section should clearly outline any State required infrastructure, such as setting up VPN, SFTP, etc., to implement or operate the system.
b. Network Architecture: Describe the means of communication, the method of sending and receiving information, between the assets in the Technology Architecture.
c. Application Architecture: Describe how the solution components are assembled and interact to meet the business needs. Describe the solution’s ability to manage and store documents and attachments.
d. Data Flow Architecture: Describe the data flows into and out of the system boundary, include transmission and storage, along with ports, protocols, and services of all inbound and outbound traffic.
Met the requirement: Choose an item.
Implementation Approach: Choose an item.
[Bidder’s Response]
| ARCH-02 |
| 1. Describe the bidder solution to address the following: |
a. Type of Software – SaaS, PaaS or, IaaS
b. Licensing Model- Perpetual or Subscription based licenses
c. Single or Multi-Tenant architecture
Met the requirement: Choose an item.
[Bidder’s Response]
| ARCH-03 |
| The bidder solution must be a cloud-based hosted environment with all components and data residing in the United States and consisting of ready-made software products that do not require major modifications but support customization to meet the functional requirements as outlined in Attachment A – MDR Functional Requirements. Bidder must describe how their approach will meet these requirements. |
Met the requirement: Choose an item.
[Bidder’s Response]
| ARCH-04 |
| Describe bidder’s ability to provide multiple environments concurrently to support functions including but not limited to production, testing, and training. |
Met the requirement: Choose an item.
[Bidder’s Response]
| ARCH-05 |
| 1. Bidder shall review the accessibility requirements described in the following: |
a. Section 508 compliance standards https://www.section508.gov/manage/laws-and-policies/)
b. 45 CFR Part 85 (https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-A/part-85)
c. State of Nebraska Accessibility requirements (https://nitc.nebraska.gov/standards/index.html#2)
Bidder must confirm that your company has read, understands, and can meet all the capabilities and/or requirements as outlined for each of the items +and+ indicate how your solution will meet such requirements as they relate to the accessibility requirements.
Met the requirement: Choose an item.
[Bidder’s Response]
ARCH-06
1. The bidder’s solution must provide Scalability and High Availability Architecture. The bidder must describe how their solution will meet this requirement. The response must include, at a minimum, the following details:
a. The system architecture must support scaling with increased load.
b. The system must provide high availability to support minimum disruptions to the business operations.
c. The system must handle notifications when a component or interface endpoint is unavailable.
d. The system must handle performance functionality and monitoring tools.
e. The system must handle recovery of failed transactions because of a component failure.
f. The system must be available online Monday to Friday 7AM to 6PM Central Time during State working days.
Met the requirement: Choose an item.
[Bidder’s Response]
DATA MANAGEMENT
| Number |
| Requirement Description |
| DM-01 |
| The bidder solution must use industry standard cryptographic modules such as those certified to meet FIPS 140-2/-3 for encrypting data at rest and in transit. Bidder must describe how their approach will meet this requirement. |
Met the requirement: Choose an item.
[Bidder’s Response]
DM-02
Describe the bidder’s technical approach for supporting data conversion and data migration.
Met the requirement: Choose an item.
[Bidder’s Response]
DM-03
1. The bidder’s solution must support data integration. The bidder must describe how their solution will meet this requirement. The response must include, at a minimum, the following details:
a. Ability to import and export data using these file types (XML, JSON, CSV).
b. Support for integration using industry standards approaches and principles for REST APIs and Webservices.
c. Support for industry integration data standards for Health Level 7 (HL7), Fast Healthcare Interoperability Resources (FHIR), X-12, HIPAA.
Met the requirement: Choose an item.
[Bidder’s Response]
| DM-04 |
| The bidder solution must securely dispose of State data from its systems upon request and in accordance with the National Institute for Standards and Technology (NIST) Special Publication 800-88 revision 1 (https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf) and must provide to DHHS a certificate of data destruction. Bidder must describe how their approach will meet this requirement. |
Met the requirement: Choose an item.
[Bidder’s Response]
DM-05
Bidder shall review the data retention requirements described in the following:
a. 45 CFR Part 164.316 (https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.316)
Bidder must meet all the capabilities and/or requirements as outlined for each of the items and indicate how your solution will meet such requirements as they relate to the data retention requirements.
Met the requirement: Choose an item.
[Bidder’s Response]
SECURITY, PRIVACY, AND COMPLIANCE
| Number |
| Requirement Description |
SPC-01
1. Bidder shall review the standards and policies described in the following:
a. DHHS Information Technology (IT) Security Policies and Standards (http://dhhs.ne.gov/ITSecurity).
b. Nebraska Information Technology Commission (NITC) Standards and Guidelines (https://nitc.nebraska.gov/standards/index.html).
c. Health Insurance Portability and Accountability Act (HIPAA) of 1996.
d. Health Information Technology for Economic and Clinical Health Act (HITECH) of 2009
e. Nebraska Electronic Signature Statute (http://www.nebraskalegislature.gov/laws/statutes.php?statute=86-611)
f. Privacy Act of 1974
Bidder must meet all the capabilities and/or requirements as outlined for each of the items and indicate how your solution will meet such requirements as they relate to the standards and policies described above.
Met the requirement: Choose an item.
[Bidder’s Response]
| SPC-02 |
| The bidder must agree to conduct an independent, third-party penetration test for the solution which they are offering within one year prior to the anticipated go-live date that includes, at a minimum, the Open Web Application Security Project (OWASP) Top 10. Identified risks must be classified by severity and additional information must be provided for any risks identified as medium and above. This must be conducted at no additional charge to DHHS. Bidder must conduct this test at the appropriate time and describe how their approach will meet these requirements. |
Met the requirement: Choose an item.
[Bidder’s Response]
SPC-03
The bidder must agree to conduct an annual independent third-party penetration test of the solution that includes the Open Web Application Security Project (OWASP) Top 10. The report must provide details of the critical, high, and medium findings and associated risks. This must be conducted at no additional charge to DHHS. Bidder must conduct this test at the appropriate time and describe how their approach will meet these requirements.
Met the requirement: Choose an item.
[Bidder’s Response]
SPC-04
The bidder must agree to conduct an independent, third-party security and privacy controls assessment that aligns with the National Institute for Standards and Technology (NIST) SP 800-53 moderate standard, within one year prior to the go-live date. Identified security gaps must be classified by severity and additional information must be provided for any gap identified as medium and above. This must be conducted at no additional charge to DHHS. Bidder must conduct this assessment at the appropriate time and describe how their approach will meet these requirements.
Met the requirement: Choose an item.
[Bidder’s Response]
SPC-05
The bidder must agree to conduct an annual independent third-party security controls assessment that meets the National Institute for Standards and Technology (NIST) SP 800-53 moderate standard. The report must provide details of the critical, high, and medium findings and associated risks. This must be conducted at no additional charge to DHHS. Bidder must conduct this assessment at the appropriate time and describe how their approach will meet these requirements.
Met the requirement: Choose an item.
[Bidder’s Response]
SPC-06
1. Describe the bidder solution for the following:Support for self-service password activities.
a. Automatic log-off procedures after determined time of session inactivity.
b. Automatic account disablement after 120 days of inactivity.
c. Administrators’ ability to lockout user(s).
d. Support and approach for single sign-on with State Active Directory
e. Support and approach for Multi-Factor Authentication
f. Automatic locking of account after determined number of failed logon attempts.
Met the requirement: Choose an item.
[Bidder’s Response]
| SPC-07 |
| The bidder solution must use role-based security. Bidder must describe how their approach will meet this requirement |
Met the requirement: Choose an item.
[Bidder’s Response]
| SPC-08 |
| 1. Describe the bidder solution for the following:How user accounts are assigned and managed. |
a. How the system provides usage reports, such as a listing of all users and their last usage date.
b. How the system supports authorization at an attribute/field level (e.g., edit, view).
Met the requirement: Choose an item.
[Bidder’s Response]
SPC-09
Bidder shall review DHHS Information Technology (IT) Audit Standards located at: (https://www.dhhs.ne.gov/ITSecurity).
Bidder must meet all the capabilities and/or requirements as outlined and indicate how your solution will meet such requirements.
1. As a part of the bidder’s response, at minimum, DHHS desires specific information regarding the following elements:
a. Detail the data elements that are audited.
b. Outline the level of audit tracking being maintained.
c. Provide a sample of their audit reports.
d. Capabilities for automated audit log evaluation to identify security issues.
e. How the bidder monitors, identifies, and reports on events impacting the system, such as attacks and other unauthorized use of the system.
Met the requirement: Choose an item.
[Bidder’s Response]
OPERATIONS MANAGEMENT
| Number |
| Requirement Description |
| OM-01 |
| Describe the Business Continuity and Disaster Recovery (BCDR) plan for the solution they are offering. Bidder’s response must describe, at a minimum, their plan to include the following information: |
1. Procedures for data backup, restoration, communication to DHHS, and emergency mode operations in the event of:
a. Hardware or Software Failures.
b. Human Error.
c. Natural Disaster; and/or
d. Other unforeseeable emergencies.
Met the requirement: Choose an item.
[Bidder’s Response]
OM-02
The bidder must agree to conduct a full disaster recovery test for the solution which they are offering prior to the anticipated go-live date. The most recent test must be within one year prior to the go-live date. This must be conducted at no additional charge to DHHS. Bidder must conduct this test at the appropriate time and describe how their approach will meet these requirements.
Met the requirement: Choose an item.
[Bidder’s Response]
OM-03
The bidder must agree to conduct an annual disaster recovery test for the solution and submit the annual results to the designated individual for DHHS. This must be conducted at no additional charge to DHHS. Bidder must conduct this test at the appropriate time and describe how their approach will meet these requirements.
Met the requirement: Choose an item.
[Bidder’s Response]
OM-04
1. The bidder solution shall meet the following:Compliance with the Recovery Time Objective (RTO) of within twelve (12) hours when the system outage is declared as a disaster.
a. Compliance with the Recovery Point Objective (RPO) of fifteen (15) minutes of data lost before the disaster event
Met the requirement: Choose an item.
[Bidder’s Response]
OM-05
1. Describe the bidder solution for the following:Overall testing strategy and support for the following testing types: unit testing, system testing, integration testing, regression testing, user acceptance testing (UAT), parallel testing, performance and load testing, manual and automated and/or scripted testing, and end-to-end integration testing.
a. Approach to planning and preparing the test/staging environment.
b. Approach to conducting each test level.
c. Approach for testing nonfunctional requirements (security, performance, etc.).
d. Approach to test documentation (e.g., test cases, test scripts, test case matrices added as the design configuration progresses).
e. Approach to quality control/quality assurance.
f. Approach to test results reporting, traceability, and metrics
Met the requirement: Choose an item.
[Bidder’s Response]
OM-06
1. Describe the bidder solution for software maintenance processes that address the following:
a. Approach to managing software versions to ensure bidder support.
b. Approach to Change Management, including defects and enhancements.
c. Approach to testing and release management.
d. Approach to maintaining integration with external and internal trading partners.
Met the requirement: Choose an item.
[Bidder’s Response]
OM-07
Describe the incident management process that will be used to report business and security incidents (such as any unauthorized access to, or incidents where data may have been compromised).
Met the requirement: Choose an item.
[Bidder’s Response]
OM-08
1. The bidder shall describe its approach on providing technical documentation that addresses the following.
a. System Operation Manual
b. Administrative Operations
c. Documentation to support testing and collaboration with integrating systems.
d. Documentation of the system's data dictionary which includes user-defined fields and tables.
Met the requirement: Choose an item.
[Bidder’s Response]
OM-09
The bidder must describe its approach to use and integrate with DHHS JIRA infrastructure for the entire software development lifecycle.
Met the requirement: Choose an item.
[Bidder’s Response]
File details come from the government source that posted it. Updated .