Questions and Answers - RFI for an Incident Prevention Monitoring System (IPMS).docx

COMMONWEALTH OF MASSACHUSETTS

EXECUTIVE OFFICE OF HEALTH AND HUMAN SERVICES

QUESTIONS AND ANSWERS

Regarding the

REQUEST FOR INFORMATION

For An

Incident Prevention Monitoring System (IPMS) Procurement Preview

DOCUMENT NUMBER: 27EHSPMDDSIPMSRFI

COMMBUYS BD ID: BD-27-1039-EHS01-ASHWA-133015

Q&A Issued: September 25, 2026

What specific behaviors must the system detect? For example: physical aggression / striking between clients, staff physical interventions or restraints, falls, self-injurious behavior, property destruction, elopement/wandering, or weapons. Which of these are in scope, and are any explicitly out of scope?

The RFI focuses on real-time detection of physical aggression, conflict, and other high-risk safety incidents. Other listed behaviors may be described as optional capabilities. Facial recognition and identity tracking are not contemplated nor allowed as noted in the RFI.

Beyond real-time detection and alerting, is DDS also interested in early-warning / predictive indicators, or is detect-and-alert on active incidents sufficient for this phase?

Real-time detection and alerting is sufficient for this RFI. Early-warning or predictive features may be described as optional, including their safeguards and limitations.

Can DDS make historical facility footage available for model training? If so, approximately what volume and time span, in what format, and is any of it already labeled/annotated for incident types?

DDS has not committed to providing historical footage or established its volume, format, or labeling. Respondents should state what data they would need and alternatives if footage is unavailable.

Can DDS clinical staff provide behavioral context (e.g., behavioral support plans) and help define what constitutes a reportable incident versus expected behavior for individuals with intellectual disabilities and/or co-occurring autism spectrum disorder?

DDS may involve appropriate clinical and operational staff during a proof of concept or implementation. Access to individual behavioral plans or other protected information should not be assumed.

Are specific security certifications (SOC 2 Type II, FedRAMP, HITRUST) hard requirements, or is documentation of equivalent controls acceptable? Is HITRUST in particular a requirement or a preference?

No specific certification, including HITRUST, is mandatory at the RFI stage. Respondents should identify relevant certifications or equivalent controls in hand or in progress.

Does 42 CFR Part 2 (substance-use-disorder records) apply to Hogan’s resident population, and are there specific CMS regulations the system must comply with?

The RFI does not determine whether 42 CFR Part 2 applies or identify specific CMS requirements. Respondents should address requirements applicable to their solution.

Which Commonwealth standards apply — specifically EOTSS security policies and any published Responsible AI / bias-assessment framework? Is NIST AI RMF alignment acceptable, or is a third-party bias audit required? Which demographic and behavioral characteristics must bias testing cover?

Respondents should describe alignment with applicable EOTSS and EOHHS requirements and responsible AI practices as available on mass.gov, including any NIST AI RMF use and bias testing for individuals served by DDS. No third-party audit or final testing matrix is required at the RFI stage.

What camera makes/models are installed at Hogan Regional Center, and do they currently feed an existing VMS/NVR platform?

Respondents should state supported standards and the information needed for a compatibility assessment.

Does DDS already have GPU-capable server infrastructure available, or should we assume server hardware procurement is part of scope?

Respondents should identify minimum hardware specifications and any additional equipment required for their proposed solution.

Which specific DDS or Commonwealth systems should the solution integrate with (e.g., incident-management, staff notification, facility security)?

The RFI requires integration with the existing camera and security environment; no other systems are currently designated. Respondents should describe standard APIs, alerting options, and integration requirements.

What are DDS’s retention requirements for video recordings and for alert/incident records?

Respondents may refer to DDS camera retention policy here: https://www.mass.gov/doc/cameras-in-common-areas-requirements-november-2025/download . Respondents should explain what data are stored or transmitted, available retention settings, and related storage and cost impacts. DDS may change retention policies specific to the rollout of this incident prevention initiative. Specific requirements are subject to change.

What is DDS’s target go-live timeframe, and is a phased rollout (pilot area → full campus) acceptable?

No firm go-live date is established. Respondents should provide a realistic schedule; a proof of concept or phased rollout may be proposed.

Does DDS anticipate expanding this system to other DDS facilities beyond Hogan Regional Center?

The current scope is Hogan Regional Center. Respondents may describe multi-site scalability and licensing for possible future consideration.

Approximately how many staff operators and administrators would require system access?

User counts have not been established. Respondents should state their assumptions and explain whether pricing depends on users, roles, cameras, facilities, or another metric.

Does DDS have defined acceptance criteria for detection performance — e.g., minimum sensitivity or maximum false-positive rate — that a proof-of-concept must demonstrate before go-live?

DDS has not set performance thresholds for the RFI. Respondents should recommend measurable proof-of-concept criteria, including detection performance, false alerts, latency, and reliability.

Should respondents interpret Section 2.9 as a request to describe their current controls and general alignment with applicable Commonwealth requirements, or to provide a formal compliance mapping or attestation against specific Commonwealth standards at the RFI stage?

For this RFI, respondents should provide a concise description of current controls, certifications, and general alignment. A formal control-by-control mapping or attestation is not required; material exceptions and assumptions should be identified.

If specific Commonwealth policies, standards, or frameworks are expected to be addressed in the response, could DDS identify the applicable references?

Respondents may use applicable EOTSS policies and guidance on security, technology and cloud, privacy, accessibility, and Responsible AI as general references as available on mass.gov. Cloud requirements apply only to cloud or externally managed components.

Q&A Response DDS Incident Prevention Monitoring System RFI Page 1 of 6