QI Consultant FY 27 (1).docx

State of Maryland Dorchester County Health Department (DCHD) Request for Proposals (RFP) Quality Improvement Consultant RFP Number: FY27 #01 DCHD

Issue date: July 20, 2026

NOTICE

A Prospective Offeror that has received this document from a source other than eMaryland Marketplace (eMMA) https://procurement.maryland.gov should register on eMMA. See Section 4.2.

VENDOR FEEDBACK FORM

To help us improve the quality of State solicitations, and to make our procurement process more responsive and business friendly, please provide comments and suggestions regarding this solicitation. Please return your comments with your response. If you have chosen not to respond to this solicitation, please email or fax this completed form to the attention of the Procurement Officer (see Key Information Summary Sheet below for contact information).

Title: Strategic Plan Consultant Solicitation No: FY24 #01 DCHD

1. If you have chosen not to respond to this solicitation, please indicate the reason(s) below:

· Other commitments preclude our participation at this time

· The subject of the solicitation is not something we ordinarily provide

· We are inexperienced in the work/commodities required

· Specifications are unclear, too restrictive, etc. (Explain in REMARKS section)

· The scope of work is beyond our present capacity

· Doing business with the State is simply too complicated. (Explain in REMARKS section)

· We cannot be competitive. (Explain in REMARKS section)

· Time allotted for completion of the Proposal is insufficient

· Start-up time is insufficient

· Bonding/Insurance requirements are restrictive (Explain in REMARKS section)

· Proposal requirements (other than specifications) are unreasonable or too risky (Explain in REMARKS section)

· MBE or VSBE requirements (Explain in REMARKS section)

· Prior State of Maryland contract experience was unprofitable or otherwise unsatisfactory. (Explain in REMARKS section)

· Payment schedule too slow

· Other: __________________________________________________________________

2. If you have submitted a response to this solicitation, but wish to offer suggestions or express concerns, please use the REMARKS section below. (Attach additional pages as needed.)

REMARKS: ____________________________________________________________________________________ Vendor Name: ________________________________ Date: _______________________ Contact Person: _________________________________ Phone (____) _____ - _________________ Address: ______________________________________________________________________ E-mail Address: ________________________________________________________________ State of Maryland Dorchester County Health Department (DCHD) Key Information Summary Sheet

627 Race Street, Cambridge, MD 21613 e-mail:

Office Phone:

Colleen.wilburn@maryland.gov 410-228-3223

See Attachment A for directions and instructions.

Offerors are reminded that a completed Feedback Form is requested if a no-bid decision is made (see page iv).

627 Race Street Cambridge, MD 21613

Virtual meetings will be considered.

Table of Contents – RFP

Quality Improvement Consultant Solicitation #: FY27 #01 DCHD RFP Document

RFP for Dorchester County Health Department Page 103 of 83

Minimum Qualifications Offeror Minimum Qualifications As part of the determination to be considered reasonably susceptible of being selected for award, the Offeror must document in its Proposal that, within the last five (5) years, the following Minimum Qualifications have been met:

The Offeror shall have experience providing quality improvement/strategic planning consultation to public health departments and/or health care agencies or organizations.

Required Documentation: As proof of meeting this requirement, the Offeror shall provide with its Proposal a list of references that attest to their experience in providing strategic planning consultation.

The Offeror shall be current and in compliance with applicable tax filings of Dorchester County, and shall be registered and in “Good Standing” with the Maryland Department of Assessment and Taxation http://www.dat.state.md.us

THE REMAINDER OF THIS PAGE IS INTENTIONALLY LEFT BLANK.

Contractor Requirements: Scope of Work Summary Statement The Dorchester County Health Department (DCHD or the "Local Health Department") is issuing this Request for Proposals (RFP) to develop a comprehensive quality improvement plan and update the current 5 year strategic plan to align with state health metrics.

It is the State’s intention to obtain goods and services, as specified in this RFP, from a Contract between the selected Offeror and the State.

The Local Health Department intends to make a single award as a result of this RFP. See RFP Section 4.9 Award Basis for more Contract award information.

An Offeror, either directly or through its subcontractor(s), must be able to provide all goods and services and meet all of the requirements requested in this solicitation and the successful Offeror (the Contractor) shall remain responsible for Contract performance regardless of subcontractor participation in the work.

A Contract award does not ensure a Contractor will receive all or any State business under the Contract.

All Contract prices, terms, and conditions must be provided to any Maryland local government or not-for-profit entity requesting services under the Contract. The Contractor bears the risk of determining whether or not a government, agency or organization with which the Contractor is dealing is a State entity.

Background, Purpose, and Goals The Dorchester County Health Department (DCHD) is in Cambridge, Maryland and is the county’s leading public health authority. With a staff of approximately 140 public health professionals, DCHD provides an array of services including health education, medical services, environmental health, reproductive health, school-based health, family support, and linkages to medical assistance and transportation. Executive leadership has determined the need to pursue the development of a quality improvement plan and to update the current strategic plan.

Project Goals The purpose of this project is to develop a comprehensive Quality Improvement (QI) Plan that establishes a formal framework for continuous quality improvement across the Dorchester County Health Department. The plan will align with Public Health Accreditation Board (PHAB) standards and support DCHD’s strategic priorities. DCHD’s strategic priorities will need to be updated to align with the QI Plan and state health metrics.

State Staff and Roles

1. Health Officer

1) The Health Officer is responsible for providing direction and participating in the development of the quality improvement plan and update to the strategic plan. The Health Officer will have final approval of the plans.

Director of Administration

2) The Director of Administration is responsible for driving the planning process.

Health Planner

3) The Health Planner is responsible for the day-to-day activities related to the development of the quality improvement plan and update to the strategic plan.

Executive Leadership

4) Executive leadership is tasked with participating in any and all meetings related to the development of the plans.

Other State Responsibilities

1. The State is responsible for providing required information, data, documentation, and test data to facilitate the Contractor’s performance of the work and will provide such additional assistance and services as is specifically set forth.

Responsibilities and Tasks Designate one person to liaise with the Health Planner who will serve as the Point of Contact for this project at a minimum of monthly to discuss progress.

Comply with all Information Technology requirements listed in this RFP. All offers must include a completed Strategic Data Initiative Agreement Review Form (attached).

Provide monthly invoicing with detailed documentation showing hours and any deliverables.

Provide key deliverables including:

A quality improvement plan timeline. To be finalized one week after notice of award;

Conduct a needs assessment by reviewing existing policies, plans, and performance management practices.

Assess current QI capacity, infrastructure, and culture within DCHD.

Develop a written Quality Improvement Plan that includes the following:

QI governance structure (e.g., QI Council or Committee), roles and responsibilities of staff and leadership;

Standardized QI methodology (e.g., PDSA cycles);

Criteria for selecting, prioritizing, and documenting QI projects;

Performance measurement and reporting processes;

Communication strategies for QI activities, and;

Integration with the Performance Management System Ensure the QI Plan meets PHAB requirements and aligns with DCHD’s Strategic and Workforce Development Plans.

Incorporate relevant documentation and processes to support accreditation readiness.

Provide one training to the QI Advisory Committee on the plan and associated processes;

Update current strategic plan to ensure alignment with the following:

State Health Improvement Plan (SHIP);

Community Health Improvement Plan (CHIP);

Achieving Health Care Efficiency through Accountable Design (AHEAD), and;

The Quality Improvement Plan.

Required Project Policies, Guidelines and Methodologies The Contractor shall be required to comply with all applicable laws, regulations, policies, standards and guidelines affecting Information Technology projects, which may be created or changed periodically. Offeror is required to review all applicable links provided below and state compliance in its response.

It is the responsibility of the Contractor to ensure adherence and to remain abreast of new or revised laws, regulations, policies, standards and guidelines affecting project execution. These include, but are not limited to:

1. The State of Maryland System Development Life Cycle (SDLC) methodology at: http://doit.maryland.gov/SDLC/Pages/agile-sdlc.aspx ;;

1. The State of Maryland Information Technology Security Policy and Standards at: http://www.DoIT.maryland.gov- keyword: Security Policy;

1. The State of Maryland Information Technology Non-Visual Standards at: http://doit.maryland.gov/policies/Pages/ContractPolicies.aspx;

Product Requirements

1. No international processing for State Data: As described in Section 3.7 Security Requirements, Offerors are advised that any processing or storage of data outside of the continental U.S. is prohibited.

1. Any Contract award is contingent on the State’s agreement, during the Proposal evaluation process, to any applicable terms of use and any other agreement submitted. Such agreed upon terms of use shall apply consistently across services ordered under the Contract.

1. The Contractor shall not establish any auto-renewal of services beyond the period identified in Contract documents.

Deliverables Deliverable Submission

1. For every deliverable, the Contractor shall request the Contract Monitor confirm receipt of that deliverable by sending an e-mail identifying the deliverable name and date of receipt.

Unless specified otherwise, written deliverables shall be compatible with Microsoft Office. At the Contract Monitor’s discretion, the Contract Monitor may request one hard copy of a written deliverable.

A standard deliverable review cycle will be elaborated and agreed-upon between the State and the Contractor. This review process is entered into when the Contractor completes a deliverable.

1. For any written deliverable, the Contract Monitor may request a draft version of the deliverable, to comply with the minimum deliverable quality criteria listed in Section 2.4.3 Minimum Deliverable Quality. Drafts of each final deliverable, except status reports, are required at least two weeks in advance of when the final deliverables are due (with the exception of deliverables due at the beginning of the project where this lead time is not possible, or where draft delivery date is explicitly specified). Draft versions of a deliverable shall comply with the minimum deliverable quality criteria listed in Section 2.4.3 Minimum Deliverable Quality.

Deliverable Acceptance

1. A final deliverable shall satisfy the scope and requirements of this RFP for that deliverable, including the quality and acceptance criteria for a final deliverable as defined in Section 2.4.4 Deliverable Descriptions/Acceptance Criteria.

The Contract Monitor shall review a final deliverable to determine compliance with the acceptance criteria as defined for that deliverable. The Contract Monitor is responsible for coordinating comments and input from various team members and stakeholders. The Contract Monitor is responsible for providing clear guidance and direction to the Contractor in the event of divergent feedback from various team members.

The Contract Monitor will issue to the Contractor a notice of acceptance or rejection of the deliverable. Upon acceptance by the Local Health Department the Contractor shall submit a proper invoice in accordance with the procedures in Section 3.3.

1. In the event of rejection, the Contract Monitor will formally communicate in writing any deliverable deficiencies or non-conformities to the Contractor, describing in those deficiencies what shall be corrected prior to acceptance of the deliverable in sufficient detail for the Contractor to address the deficiencies. The Contractor shall correct deficiencies and resubmit the corrected deliverable for acceptance within the agreed-upon time period for correction.

Minimum Deliverable Quality The Contractor shall subject each deliverable to its internal quality-control process prior to submitting the deliverable to the State.

Each deliverable shall meet the following minimum acceptance criteria:

1. Be presented in a format appropriate for the subject matter and depth of discussion.

1. Be organized in a manner that presents a logical flow of the deliverable’s content.

1. Represent factual information reasonably expected to have been known at the time of submittal.

1. In each section of the deliverable, include only information relevant to that section of the deliverable.

1. Contain content and presentation consistent with industry best practices in terms of deliverable completeness, clarity, and quality.

1. Meets the acceptance criteria applicable to that deliverable, including any State policies, functional or non-functional requirements, or industry standards.

1. Contains no structural errors such as poor grammar, misspellings or incorrect punctuation.

1. Must contain the date, author, and page numbers. When applicable for a deliverable, a revision table must be included.

1. A draft written deliverable may contain limited structural errors such as incorrect punctuation, and shall represent a significant level of completeness toward the associated final written deliverable. The draft written deliverable shall otherwise comply with minimum deliverable quality criteria above.

Deliverable Descriptions/Acceptance Criteria In addition to the items identified in the table below, the Contractor may suggest other subtasks, artifacts, or deliverables to improve the quality and success of the assigned tasks.

Deliverables Summary Table*

*The deliverables summary table may not list every contractually-required deliverable. Offerors and Contractors should read the RFP thoroughly for all Contract requirements and deliverables.

Contractor Requirements: General Contract Initiation Requirements

1. Contractor shall schedule and hold a kickoff meeting within 10 Business Days of NTP Date. At the kickoff, the Contractor shall furnish an updated Project Schedule describing the activities for the Contractor.

Reserved Return and Maintenance of State Data

1. Upon termination or the expiration of the Contract Term, the Contractor shall: (a) return to the State all State data in either the form it was provided to the Contractor or in a mutually agreed format along with the schema necessary to read such data; (b) preserve, maintain, and protect all State data until the earlier of a direction by the State to delete such data or the expiration of 90 days (“the retention period”) from the date of termination or expiration of the Contract term; (c) after the retention period, the Contractor shall securely dispose of and permanently delete all State data in all of its forms, such as disk, CD/DVD, backup tape and paper such that it is not recoverable, according to National Institute of Standards and Technology (NIST)-approved methods with certificates of destruction to be provided to the State; and (d) prepare an accurate accounting from which the State may reconcile all outstanding accounts. The final monthly invoice for the services provided hereunder shall include all charges for the 90-day data retention period.

1. During any period of service suspension, the Contractor shall maintain all State data in its then existing form, unless otherwise directed in writing by the Contract Monitor.

1. In addition to the foregoing, the State shall be entitled to any post-termination/expiration assistance generally made available by Contractor with respect to the services.

Invoicing General

1. The Contractor shall email the original of each invoice and signed authorization to invoice to the Contract Monitor at e-mail address: brice.strang@maryland.gov All invoices for services shall be verified by the Contractor as accurate at the time of submission.

An invoice not satisfying the requirements of a Proper Invoice (as defined at COMAR 21.06.09.01 and .02) cannot be processed for payment. To be considered a Proper Invoice, invoices must include the following information, without error:

1) Contractor name and address;

2) Remittance address;

3) Federal taxpayer identification (FEIN) number, social security number, as appropriate;

4) Invoice period (i.e. time period during which services covered by invoice were performed);

5) Invoice date;

6) Invoice number;

7) State assigned Contract number;

8) State assigned (Blanket) Purchase Order number(s);

9) Goods or services provided;

10) Amount due; and

11) Any additional documentation required by regulation or the Contract.

Invoices that contain both fixed price and time and material items shall clearly identify each item as either fixed price or time and material billing.

The Local Health Department reserves the right to reduce or withhold Contract payment in the event the Contractor does not provide the Local Health Department with all required deliverables within the time frame specified in the Contract or otherwise breaches the terms and conditions of the Contract until such time as the Contractor brings itself into full compliance with the Contract.

Any action on the part of the Local Health Department, or dispute of action by the Contractor, shall be in accordance with the provisions of Md. Code Ann., State Finance and Procurement Article §§ 15-215 through 15-223 and with COMAR 21.10.04.

The State is generally exempt from federal excise taxes, Maryland sales and use taxes, District of Columbia sales taxes and transportation taxes. The Contractor; however, is not exempt from such sales and use taxes and may be liable for the same.

Invoices for final payment shall be clearly marked as “FINAL” and submitted when all work requirements have been completed and no further charges are to be incurred under the Contract. In no event shall any invoice be submitted later than 60 calendar days from the Contract termination date.

Invoice Submission Schedule The Contractor shall submit invoices in accordance with the following schedule:

1. For items of work for which there is one-time pricing (see Attachment B – Financial Proposal Form) those items shall be billed in the month following the acceptance of the work by the Local Health Department.

1. For items of work for which there is annual pricing, see Attachment B– Financial Proposal Form, those items shall be billed in equal monthly installments for the applicable Contract year in the month following the performance of the services.

Deliverable Invoicing Payment for deliverables will only be made upon completion and acceptance of the deliverables as defined in Section 2.4.

For the purposes of the Contract an amount will not be deemed due and payable if:

1. The amount invoiced is inconsistent with the Contract;

1. The proper invoice has not been received by the party or office specified in the Contract;

1. The invoice or performance is in dispute or the Contractor has failed to otherwise comply with the provisions of the Contract;

1. The item or services have not been accepted;

1. The quantity of items delivered is less than the quantity ordered;

1. The items or services do not meet the quality requirements of the Contract;

1. If the Contract provides for progress payments, the proper invoice for the progress payment has not been submitted pursuant to the schedule;

1. If the Contract provides for withholding a retainage and the invoice is for the retainage, all stipulated conditions for release of the retainage have not been met; or

1. The Contractor has not submitted satisfactory documentation or other evidence reasonably required by the Procurement Officer or by the Contract concerning performance under the Contract and compliance with its provisions.

Travel Reimbursement Travel will not be reimbursed under this RFP.

Liquidated Damages MBE Liquidated Damages Inapplicable because there is no MBE goal for this RFP.

Liquidated Damages other than MBE

THIS SECTION IS INAPPLICABLE TO THIS RFP.

Disaster Recovery and Data The following requirements apply to the Contract:

Redundancy, Data Backup and Disaster Recovery

1. Unless specified otherwise in the RFP, Contractor shall maintain or cause to be maintained disaster avoidance procedures designed to safeguard State data and other confidential information, Contractor’s processing capability and the availability of hosted services, in each case throughout the Contract term. Any force majeure provisions of the Contract do not limit the Contractor’s obligations under this provision.

1. The Contractor shall have robust contingency and disaster recovery (DR) plans in place to ensure that the services provided under the Contract will be maintained in the event of disruption to the Contractor/subcontractor’s operations (including, but not limited to, disruption to information technology systems), however caused.

37. The Contractor shall furnish a DR site.

37. The DR site shall be at least 100 miles from the primary operations site, and have the capacity to take over complete production volume in case the primary site becomes unresponsive.

1. The contingency and DR plans must be designed to ensure that services under the Contract are restored after a disruption within twenty-four (24) hours from notification and a recovery point objective of one (1) hour or less prior to the outage in order to avoid unacceptable consequences due to the unavailability of services.

1. The Contractor shall test the contingency/DR plans at least twice annually to identify any changes that need to be made to the plan(s) to ensure a minimum interruption of service. Coordination shall be made with the State to ensure limited system downtime when testing is conducted. At least one (1) annual test shall include backup media restoration and failover/fallback operations at the DR location. The Contractor shall send the Contract Monitor a notice of completion following completion of DR testing.

1. Such contingency and DR plans shall be available for the Local Health Department to inspect and practically test at any reasonable time, and subject to regular updating, revising, and testing throughout the term of the Contract.

Data Export/Import

1. The Contractor shall, at no additional cost or charge to the State, in an industry standard/non-proprietary format:

41. perform a full or partial import/export of State data within 24 hours of a request; or

41. provide to the State the ability to import/export data at will and provide the State with any access and instructions which are needed for the State to import or export data.

1. Any import or export shall be in a secure format per the Security Requirements.

Data Ownership and Access

1. Data, databases and derived data products created, collected, manipulated, or directly purchased as part of a RFP are the property of the State. The purchasing State agency is considered the custodian of the data and shall determine the use, access, distribution, and other conditions based on appropriate State statutes and regulations.

Public jurisdiction user accounts and public jurisdiction data shall not be accessed, except (1) in the course of data center operations, (2) in response to service or technical issues, (3) as required by the express terms of the Contract, including as necessary to perform the services hereunder or (4) at the State’s written request.

The Contractor shall limit access to and possession of State data to only Contractor Personnel whose responsibilities reasonably require such access or possession and shall train such Contractor Personnel on the confidentiality obligations set forth herein.

At no time shall any data or processes – that either belong to or are intended for the use of the State or its officers, agents or employees – be copied, disclosed or retained by the Contractor or any party related to the Contractor for subsequent use in any transaction that does not include the State.

The Contractor shall not use any information collected in connection with the services furnished under the Contract for any purpose other than fulfilling such services.

Provisions in Sections 3.5.1 – 3.5.3 shall survive expiration or termination of the Contract. Additionally, the Contractor shall flow down the provisions of Sections 3.5.1-3.5.3 (or the substance thereof) in all subcontracts.

Insurance Requirements The Contractor shall maintain, at a minimum, the insurance coverages outlined below, or any minimum requirements established by law if higher, for the duration of the Contract, including option periods, if exercised:

The following type(s) of insurance and minimum amount(s) of coverage are required:

1. Commercial General Liability - of $1,000,000 combined single limit per occurrence for bodily injury, property damage, and personal and advertising injury and $3,000,000 annual aggregate. The minimum limits required herein may be satisfied through any combination of primary and umbrella/excess liability policies.

1. Errors and Omissions/Professional Liability - $1,000,000 per combined single limit per claim and $3,000,000 annual aggregate.

1. Crime Insurance/Employee Theft Insurance - to cover employee theft with a minimum single loss limit of $1,000,000 per loss, and a minimum single loss retention not to exceed $10,000. The State of Maryland and the Local Health Department should be added as a “loss payee.”

1. Cyber Security / Data Breach Insurance – The Contractor shall possess and maintain throughout the term of the Contractor and for three (3) years thereafter, cyber risk/ data breach insurance (either separately or as part of a broad Professional Liability or Errors and Omissions Insurance) with limits of at least five million dollars ($5,000,000) per claim. Any "insured vs. insured" exclusions will be modified accordingly to allow the State additional insured status without prejudicing the State’s rights under the policy(ies). Coverage shall be sufficiently broad to respond to the Contractor's duties and obligations under the Contract and shall include, but not be limited to, claims involving privacy violations, information theft, damage to or destruction of electronic information, the release of Sensitive Data, and alteration of electronic information, extortion, and network security. The policy shall provide coverage for, not by way of limitation, breach response costs as well as regulatory fines and penalties as well as credit monitoring expenses with limits sufficient to respond to these obligations.

1. Worker’s Compensation - The Contractor shall maintain such insurance as necessary or as required under Workers’ Compensation Acts, the Longshore and Harbor Workers’ Compensation Act, and the Federal Employers’ Liability Act, to not be less than one million dollars ($1,000,000) per occurrence (unless a state’s law requires a greater amount of coverage). Coverage must be valid in all states where work is performed.

The State shall be listed as an additional insured on the faces of the certificates associated with the coverages listed above, including umbrella policies, excluding Workers’ Compensation Insurance and professional liability.

All insurance policies shall be endorsed to include a clause requiring the insurance carrier provide the Procurement Officer, by certified mail, not less than 30 days’ advance notice of any non-renewal, cancellation, or expiration. The Contractor shall notify the Procurement Officer in writing, if policies are cancelled or not renewed within five (5) days of learning of such cancellation or nonrenewal. The Contractor shall provide evidence of replacement insurance coverage to the Procurement Officer at least 15 days prior to the expiration of the insurance policy then in effect.

Any insurance furnished as a condition of the Contract shall be issued by a company authorized to do business in the State.

The recommended awardee must provide current certificate(s) of insurance with the prescribed coverages, limits and requirements set forth in this section within five (5) Business Days from notice of recommended award. During the period of performance for multi-year contracts, the Contractor shall provide certificates of insurance annually, or as otherwise directed by the Contract Monitor.

Subcontractor Insurance The Contractor shall require any subcontractors to obtain and maintain comparable levels of coverage and shall provide the Contract Monitor with the same documentation as is required of the Contractor.

Security Requirements The following requirements are applicable to the Contract:

Employee Identification

1. Contractor Personnel shall display his or her company ID badge in a visible location at all times while on State premises. Upon request of authorized State personnel, each Contractor Personnel shall provide additional photo identification.

1. Contractor Personnel shall cooperate with State site requirements, including but not limited to, being prepared to be escorted at all times, and providing information for State badge issuance.

1. Contractor shall remove any Contractor Personnel from working on the Contract where the State determines, in its sole discretion, that Contractor Personnel has not adhered to the Security requirements specified herein.

1. The State reserves the right to request that the Contractor submit proof of employment authorization of non-United States Citizens, prior to commencement of work under the Contract.

Criminal Background Check

1. Contractor Personnel with access to systems supporting the State or to State data who have been convicted of a felony or of a crime involving telecommunications and electronics from the above list of crimes shall not be permitted to work on State premises under the Contract; Contractor Personnel who have been convicted within the past five (5) years of a misdemeanor from the above list of crimes shall not be permitted to work on State premises.

On-Site Security Requirement(s)

1. For the conditions noted below, Contractor Personnel may be barred from entrance or leaving any site until such time that the State’s conditions and queries are satisfied.

54. Contractor Personnel may be subject to random security checks when entering and leaving State secured areas. The State reserves the right to require Contractor Personnel to be accompanied while in secured premises.

1. Any Contractor Personnel who enters the premises of a facility under the jurisdiction of the Local Health Department may be searched, photographed and required to wear an identification card.

1. Further, Contractor Personnel shall not violate Md. Code Ann., Criminal Law Art. Section 9-410 through 9-417 and such other security policies of the agency that controls the facility to which the Contractor Personnel seeks access. The failure of any of the Contractor Personnel to comply with any provision of the Contract is sufficient grounds for the State to immediately terminate the Contract for default.

Information Technology

(a) Contractors shall comply with and adhere to the State IT Security Policy and Standards. These policies may be revised from time to time and the Contractor shall comply with all such revisions. Updated and revised versions of the State IT Policy and Standards are available online at: www.doit.maryland.gov – keyword: Security Policy.

(b) The Contractor shall not connect any of its own equipment to a State LAN/WAN without prior written approval by the State. The Contractor shall complete any necessary paperwork as directed and coordinated with the Contract Monitor to obtain approval by the State to connect Contractor-owned equipment to a State LAN/WAN.

The Contractor shall:

56. Implement administrative, physical, and technical safeguards to protect State data that are no less rigorous than accepted industry best practices for information security such as those listed below (see Section 3.7.5);

56. Ensure that all such safeguards, including the manner in which State data is collected, accessed, used, stored, processed, disposed of and disclosed, comply with applicable data protection and privacy laws as well as the terms and conditions of the Contract; and

56. The Contractor, and Contractor Personnel, shall (i) abide by all applicable federal, State and local laws, rules and regulations concerning security of Information Systems and Information Technology and (ii) comply with and adhere to the State IT Security Policy and Standards as each may be amended or revised from time to time. Updated and revised versions of the State IT Policy and Standards are available online at:

https://doit.maryland.gov/policies/Pages/default.aspx Data Protection and Controls A. Contractor shall ensure a secure environment for all State data and any hardware and software (including but not limited to servers, network and data components) provided or used in connection with the performance of the Contract and shall apply or cause application of appropriate controls so as to maintain such a secure environment (“Security Best Practices”). Such Security Best Practices shall comply with an accepted industry standard, such as the NIST cybersecurity framework.

B. To ensure appropriate data protection safeguards are in place, the Contractor shall implement and maintain the following controls at all times throughout the Term of the Contract (the Contractor may augment this list with additional controls):

1) Establish separate production, test, and training environments for systems supporting the services provided under the Contract and ensure that production data is not replicated in test or training environment(s) unless it has been previously anonymized or otherwise modified to protect the confidentiality of Sensitive Data elements. The Contractor shall ensure the appropriate separation of production and non-production environments by applying the data protection and control requirements listed in Section 3.7.5.

2) Apply hardware and software hardening procedures as recommended by Center for Internet Security (CIS) guides https://www.cisecurity.org/, Security Technical Implementation Guides (STIG) https://public.cyber.mil/stigs/, or similar industry best practices to reduce the systems’ surface of vulnerability, eliminating as many security risks as possible and documenting what is not feasible or not performed according to best practices. Any hardening practices not implemented shall be documented with a plan of action and milestones including any compensating control. These procedures may include but are not limited to removal of unnecessary software, disabling or removing unnecessary services, removal of unnecessary usernames or logins, and the deactivation of unneeded features in the Contractor’s system configuration files.

3) Ensure that State data is not comingled with non-State data through the proper application of compartmentalization Security Measures.

4) Apply data encryption to protect Sensitive Data at all times, including in transit, at rest, and also when archived for backup purposes. Unless otherwise directed, the Contractor is responsible for the encryption of all Sensitive Data.

5) For all State data the Contractor manages or controls, data encryption shall be applied to such data in transit over untrusted networks.

6) Encryption algorithms which are utilized for encrypting data shall comply with current Federal Information Processing Standards (FIPS), “Security Requirements for Cryptographic Modules”, FIPS PUB 140-2:

http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401vend.htm

7) Enable appropriate logging parameters to monitor user access activities, authorized and failed access attempts, system exceptions, and critical information security events as recommended by the operating system and application manufacturers and information security standards, including Maryland Department of Information Technology’s Information Security Policy.

8) Retain the aforementioned logs and review them at least daily to identify suspicious or questionable activity for investigation and documentation as to their cause and remediation, if required. The Local Health Department shall have the right to inspect these policies and procedures and the Contractor or subcontractor’s performance to confirm the effectiveness of these measures for the services being provided under the Contract.

9) Ensure system and network environments are separated by properly configured and updated firewalls.

10) Restrict network connections between trusted and untrusted networks by physically or logically isolating systems from unsolicited and unauthenticated network traffic.

11) By default “deny all” and only allow access by exception.

12) Review, at least annually, the aforementioned network connections, documenting and confirming the business justification for the use of all service, protocols, and ports allowed, including the rationale or compensating controls implemented for those protocols considered insecure but necessary.

13) Perform regular vulnerability testing of operating system, application, and network devices. Such testing is expected to identify outdated software versions; missing software patches; device or software misconfigurations; and to validate compliance with or deviations from the security policies applicable to the Contract. Contractor shall evaluate all identified vulnerabilities for potential adverse effect on security and integrity and remediate the vulnerability no later than 30 days following the earlier of vulnerability’s identification or public disclosure, or document why remediation action is unnecessary or unsuitable. The Local Health Department shall have the right to inspect the Contractor’s policies and procedures and the results of vulnerability testing to confirm the effectiveness of these measures for the services being provided under the Contract.

14) Enforce strong user authentication and password control measures to minimize the opportunity for unauthorized access through compromise of the user access controls. At a minimum, the implemented measures should be consistent with the most current Maryland Department of Information Technology’s Information Security Policy (https://doit.maryland.gov/policies/Pages/default.aspx), including specific requirements for password length, complexity, history, and account lockout.

15) Ensure State data is not processed, transferred, or stored outside of the United States (“U.S.”). The Contractor shall provide its services to the State and the State’s end users solely from data centers in the U.S. Unless granted an exception in writing by the State, the Contractor shall not allow Contractor Personnel to store State data on portable devices, including personal computers, except for devices that are used and kept only at its U.S. data centers. The Contractor shall permit its Contractor Personnel to access State data remotely only as required to provide technical support.

16) Ensure Contractor’s Personnel shall not connect any of its own equipment to a State LAN/WAN without prior written approval by the State, which may be revoked at any time for any reason. The Contractor shall complete any necessary paperwork as directed and coordinated with the Contract Monitor to obtain approval by the State to connect Contractor -owned equipment to a State LAN/WAN.

17) Ensure that anti-virus and anti-malware software is installed and maintained on all systems supporting the services provided under the Contract; that the anti-virus and anti-malware software is automatically updated; and that the software is configured to actively scan and detect threats to the system for remediation. The Contractor shall perform routine vulnerability scans and take corrective actions for any findings.

18) Conduct regular external vulnerability testing designed to examine the service provider’s security profile from the Internet without benefit of access to internal systems and networks behind the external security perimeter. Evaluate all identified vulnerabilities on Internet-facing devices for potential adverse effect on the service’s security and integrity and remediate the vulnerability promptly or document why remediation action is unnecessary or unsuitable. The Local Health Department shall have the right to inspect these policies and procedures and the performance of vulnerability testing to confirm the effectiveness of these measures for the services being provided under the Contract.

Security Plan

1. The Contractor shall protect State data according to a written security policy (“Security Plan”) no less rigorous than that of the State and shall supply a copy of such policy to the State for validation, with any appropriate updates, on an annual basis.

The Security Plan shall detail the steps and processes employed by the Contractor as well as the features and characteristics which will ensure compliance with the security requirements of the Contract.

Security Incident Response A. The Contractor shall notify the Local Health Department in accordance with Section 3.7.7A-D when any Contractor system that may access, process, or store State data or State systems experiences a Security Incident or a Data Breach as follows:

1) notify the Local Health Department within twenty-four (24) hours of the discovery of a Security Incident by providing notice via written or electronic correspondence to the Contract Monitor, Local Health Department chief information officer and Local Health Department chief information security officer;

2) notify the Local Health Department within two (2) hours if there is a threat to Contractor’s Solution as it pertains to the use, disclosure, and security of State data; and

3) provide written notice to the Local Health Department within one (1) Business Day after Contractor’s discovery of unauthorized use or disclosure of State data and thereafter all information the State (or Local Health Department) requests concerning such unauthorized use or disclosure.

B. Contractor’s notice shall identify:

1) the nature of the unauthorized use or disclosure;

2) the State data used or disclosed,

3) who made the unauthorized use or received the unauthorized disclosure;

4) what the Contractor has done or shall do to mitigate any deleterious effect of the unauthorized use or disclosure; and

5) what corrective action the Contractor has taken or shall take to prevent future similar unauthorized use or disclosure.

6) The Contractor shall provide such other information, including a written report, as reasonably requested by the State.

C. The Contractor may need to communicate with outside parties regarding a Security Incident, which may include contacting law enforcement, fielding media inquiries and seeking external expertise as mutually agreed upon, defined by law or contained in the Contract. Discussing Security Incidents with the State should be handled on an urgent as-needed basis, as part of Contractor communication and mitigation processes as mutually agreed upon, defined by law or contained in the Contract.

D. The Contractor shall comply with all applicable laws that require the notification of individuals in the event of unauthorized release of State data or other event requiring notification, and, where notification is required, assume responsibility for informing all such individuals in accordance with applicable law and to indemnify and hold harmless the State (or Local Health…