OCMP_27-25703_SURS_RFI_Questions_Department_Responses.xlsx
XLSX spreadsheet 15 KB Posted
- Attached to
- Request for Information (RFI) for Surveillance and Utilization Review Subsystem (SURS) OCMP 27-25703
- Solicitation number
- BPM058351
- Issued by
- Maryland
About this file
This document contains Maryland Department of Health (MDH) responses to a Request for Information (RFI) regarding a Surveillance and Utilization Review Subsystem (SURS) for the Maryland Medicaid program. The RFI is market research in nature and not a formal solicitation to procure, designed to familiarize MDH with currently available products and services for SURS, which is a federally required component of the Medicaid Management Information System (MMIS) operating under 42 CFR Parts 433, 455, and 456. MDH is seeking to replace its legacy IBM JSURS platform with a modern, modular solution. The agency strongly prefers a proven Commercial Off-The-Shelf (COTS) or Software as a Service (SaaS) solution with demonstrated implementation experience in state Medicaid environments, requiring vendors to have prior statewide Medicaid SURS implementations as a mandatory minimum qualification. MDH anticipates the future solution will feature a modern, API-driven, modular architecture with loosely coupled, interoperable functional capabilities including data storage, advanced analytics, case management, and portal/workflow components that can be updated independently to comply with CMS Medicaid Enterprise Systems Modularity Rules.
MDH's baseline expectations favor a vendor-hosted SaaS model compliant with Maryland Department of Information Technology security standards and applicable federal mandates, including NIST 800-53 controls, HIPAA requirements, and CMS Streamlined Modular Certification (SMC) outcomes. The future contractor will assume full operational responsibility for SURS data processing and will ingest standard Medicaid enterprise data domains including fee-for-service claims, managed care organization encounters, pharmacy data, provider and eligibility data, and external data sources from raw state-provided feeds and historical datasets rather than migrating legacy JSURS data. MDH will provide interface specifications, file layouts, and data dictionaries for primary source data feeds, and the contractor will be responsible for providing technical certification evidence and continuous operational reporting artifacts to support CMS modular certification. The new contractor will work collaboratively with MDH to deliver investigation-ready leads—prioritized, data-enriched suspect billing anomalies or provider profiles that provide program integrity staff with complete context for immediate evaluation and action. The transition period, formal technical specifications, ingestion frequencies, latency service level agreements, cloud authorization tiers, data residency rules, and specific certification milestones will be formally established in a future Request for Proposals (RFP).
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Addendum #1_SURS RFI OCMP 27-25703.pdf | ||
| SURS RFI OCMP 27-25703.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
SURS RFI Responses
| Question # | RFI Question | Department Response |
| 1 | Does MDH anticipate procuring SURS as a single end-to-end solution, or would the State consider separately deployable modules for the data store, advanced analytics, case management, reporting, and portal/workflow capabilities? | MDH favors a single-vendor procurement model for turnkey implementation to streamline governance, reduce administrative overhead and establish single-point accountability. However, to align with CMS Medicaid Enterprise Systems (MES) Modularity Rules, the underlying solution must feature a modern, API-driven, modular architecture. This ensures that functional capabilities (such as the data store, analytics engine, case management, and portals) are loosely coupled, fully interoperable and capable of being updated independently without creating long-term proprietary lock-in. |
| 2 | For planning purposes, please identify the anticipated source systems, file formats, ingestion frequencies, latency expectations, approximate historical data volume, and division of responsibility between MDH and the future contractor for data cleansing and reconciliation. | This RFI is conducted solely for market research, and binding technical specifications will be defined in a future solicitation. For RFI planning purposes, vendors should anticipate ingesting standard Medicaid enterprise data domains including fee-for-service claims, MCO encounters, pharmacy data, provider and eligibility data along with some additional external data sources. Exact file schemas, interface protocols, ingestion frequencies, and latency SLAs will be formally specified in the RFP. Vendors are encouraged to outline their standard integration architecture, data ingestion frameworks, and recommended operational divisions of responsibility between the State and the contractor for data cleansing and reconciliation based on industry best practices. |
| 3 | Does MDH expect the future SURS to be vendor-hosted SaaS, State-hosted, or deployment-model neutral, and what Maryland cloud authorization, data-residency, HIPAA, NIST 800-53, disaster-recovery, and security-assessment requirements are anticipated? | MDH baseline expectations favor a vendor-hosted Software as a Service (SaaS) model, requiring the contractor to manage, maintain, and secure the platform within a cloud environment compliant with Maryland Department of Information Technology (DoIT) security standards and applicable federal mandates. While open to alternative deployment models that offer clear operational advantages, MDH considers a vendor-managed cloud delivery model the primary reference standard for this modernization effort. Specific, binding technical requirements including detailed NIST controls, cloud authorization tiers, data residency rules, and CMS Streamlined Modular Certification (SMC) outcomes will be formally established in the future Request for Proposals (RFP). |
| 4 | Which CMS Streamlined Modular Certification outcomes, evidence, performance metrics, and operational reporting artifacts does MDH expect the future SURS contractor to own or support? | The future SURS contractor will be expected to support MDH in achieving and maintaining CMS Streamlined Modular Certification (SMC). MDH anticipates that the contractor will provide standard technical certification evidence (such as system architecture, API documentation, and security packages) and native operational reporting capabilities that satisfy both CMS federal certification outcomes and Maryland-specific program integrity goals. |
Specific certification milestones, state-defined business outcomes, performance metrics, and reporting deliverables will be formally established in the future Request for Proposals (RFP). For RFI planning purposes, respondents are encouraged to outline their standard approach to CMS modular certification and describe how their platform’s reporting and analytics capabilities support both state operational needs and federal outcomes.
5 Does MDH anticipate that the future contractor will assume all IBM JSURS data processing and operational responsibilities, and what transition period, incumbent cooperation, interface documentation, and historical-data access are expected to be available? MDH anticipates the new contractor will assume full operational responsibility for SURS data processing, replacing legacy SURS operations. MDH expects the future solution to generate its analytics and baseline models by ingesting raw source feeds and historical Medicaid datasets provided by the State, rather than migrating data out of JSURS.
A formal transition-in period, source interface specifications, and access to historical Medicaid data will be established in the upcoming Request for Proposals (RFP). For RFI planning purposes, respondents should describe their standard transition methodology and approach to ingesting raw historical Medicaid data.
6 Does MDH currently anticipate acquiring a commercial COTS product, or is it open to custom solutions developed according to unique MDH needs? MDH strongly prefers a proven, configurable Commercial Off-The-Shelf (COTS) or SaaS solution with a demonstrated track record in state Medicaid environments. Due to the upcoming expiration of legacy SURS operations, MDH prioritizes platforms with standard out-of-the-box functionality that can be rapidly customized and implemented with minimal effort.
Formal procurement criteria will be detailed in the future Request for Proposals (RFP). For RFI planning purposes, respondents should highlight their platform’s core out-of-the-box features, rapid deployment methodologies, and list state Medicaid agencies where their solution is currently deployed, including specific operational use cases and scope of implementation.
| 7 | Considering MDH's unique needs and requirements, will prior statewide Medicaid / SURS implementations be a mandatory minimum qualification? | To mitigate project risk and ensure rapid deployment before legacy SURS operations expire, MDH anticipates requiring demonstrated prior experience with statewide Medicaid SURS implementations as a mandatory minimum qualification in the upcoming RFP. RFI respondents should provide a list of state Medicaid agencies where their SURS platform is currently or previously operational. |
| 8 | Will MDH furnish the current JSURS specifications as part of a future solicitation? | MDH does not anticipate providing legacy JSURS technical specifications, as the future solution will not replicate or migrate from the legacy JSURS environment. Instead, MDH will furnish interface specifications, file layouts, and data dictionaries for the primary source data feeds (such as Medicaid MMIS/eMEDS claims, encounter data, and provider files) as part of the future solicitation. |
| 9 | What does MDH mean operationally by an “investigation-ready lead”? | Operationally, MDH defines an "investigation-ready lead" as a prioritized, data-enriched suspect billing anomaly or provider profile that provides program integrity staff with all necessary context and analytics to immediately evaluate and take action without state users conducting any manual data gathering. |
MDH anticipates that the future SURS contractor will propose its standard, proven methodologies for identifying, scoring, and packaging leads. Following contract award, the vendor will work collaboratively with MDH to refine and tailor these lead parameters to align with specific State program integrity priorities.
For RFI planning purposes, respondents should describe their standard platform capabilities, automated data aggregation features, and recommended methodologies for delivering complete, self-contained leads to state investigators.
10 Who will own responsibility for CMS Streamlined Modular Certification? MDH ultimately holds primary accountability to CMS for achieving and maintaining CMS Streamlined Modular Certification (SMC). However, the future SURS contractor will be required to actively support MDH throughout the certification lifecycle.
The contractor will be responsible for providing all technical certification evidence (such as system architecture diagrams, API documentation, and security packages), demonstrating standard platform outcome capabilities, and delivering continuous operational reporting artifacts required by CMS.
Formal roles, deliverable schedules, and specific compliance expectations will be established in the upcoming Request for Proposals (RFP). For RFI planning purposes, respondents should describe their experience supporting state Medicaid agencies through CMS modular certification and detail the standard evidence packages provided with their platform.
11 What transition cooperation will be available from IBM and the existing MMIS team? MDH will ensure appropriate administrative and technical coordination during the implementation phase to support a smooth transition.
The existing MMIS team will provide standard interface specifications, file layouts, and data feeds necessary to integrate raw Medicaid data into the new SURS solution. Because the State does not anticipate transferring data or code from legacy JSURS, operational turnover with IBM will be limited to baseline administrative coordination.
Specific turnover obligations, communication protocols, and interface deliverable schedules will be formally defined in the upcoming Request for Proposals (RFP). For RFI planning purposes, respondents should describe their standard integration requirements and best practices for coordinating with state MMIS/data teams during onboarding.
File details come from the government source that posted it. Updated .