QA Summary RFP 202510143 BRFSS Additional Questions FINAL.xlsx

This is a Questions and Answers (QA) Summary document for RFP 202510143 issued by the State of Maine Department of Health and Human Services, Maine Center for Disease Control and Prevention, regarding Behavioral Risk Factor Surveillance System (BRFSS) Data Collection and Management services. The solicitation seeks a qualified vendor to conduct approximately 10,200 annual surveys using Computer-Assisted Telephone Interviewing (CATI) software, with monthly samples containing between 45,000 to 50,000 randomly selected phone numbers, distributed across Maine's 16 counties with a minimum of 150 landline and 700 cell phone surveys monthly. The initial contract period runs from October 1, 2026, through December 31, 2028, with data collection occurring during calendar years 2027 and 2028. The State develops an initial draft survey in October and will provide it to the awarded bidder at that time. Questions from bidders were due by January 30, 2026, at 4:00 p.m. local time, with final proposals due by April 21, 2026, at 4:00 p.m. local time.

Key requirements clarified in this QA document include that no summary report for Performance Measures is required, the initial SOC 2 Type 2 audit must be completed prior to production data migration with remediation of all Critical, High, and Medium findings, and subsequent annual SOC 2 submissions must align with the contract renewal cadence. The cost proposal is based on a fixed amount covering 1,800 landline and 8,400 cell phone surveys annually, with the lowest cost proposal receiving the full 35 cost points. The selected vendor must implement robust quality assurance procedures including 5% monthly verification of completed surveys and submit monthly raw data files to the Federal CDC and the Department, along with weekly completion summaries, monthly frequency reports, and quarterly stratum reports. The vendor must maintain 99.9% monthly system uptime, comply with MaineIT Policies and Standards and NIST 800-53 Rev 5 security controls, store all data within the Continental United States, and provide a dedicated project lead with sufficient staffing trained in sensitive topics.