REQUEST FOR INFORMATION_EMMY VERIFICATION DATA SERVICES.pdf

REQUEST FOR INFORMATION (RFI) - Consumer-Reported Verification Data Sources for State Medicaid Eligibility Determination

NOTICE ID: 269998

POSTED DATE: March 27, 2026

RESPONSE DATE: April 17, 2026, 5:00 PM Eastern Time (Responses will be considered as received).

THIS IS A REQUEST FOR INFORMATION (RFI) ONLY. THIS IS NOT A SOLICITATION. This notice is issued solely for market research and information planning. This RFI does not constitute a solicitation for proposals, a request for quotations, or an invitation for bids.

Responses to this RFI are not offers and cannot be accepted by the Government to form a binding contract. CMS is under no obligation to issue a solicitation or award a contract based on responses received. No reimbursement will be made for any costs associated with providing information in response to this RFI or any follow-on information requests.

This RFI is issued for market research purposes only. Questions regarding this RFI will not be accepted or answered. Vendors should address any assumptions or clarifications within their written response submission.

SECTION 1 — INTRODUCTION AND PURPOSE

1.1 Purpose

The Centers for Medicare & Medicaid Services (CMS) is conducting market research to identify and assess industry capabilities for providing consumer-reported verification data services to support state Medicaid agencies in meeting federal eligibility determination requirements.

CMS is developing the EMMY (Eligibility Made Easy) platform, a centralized, API-based data exchange infrastructure designed to provide participating state Medicaid agencies with standardized access to trusted third-party data sources for eligibility verification. This RFI supports CMS's broader market intelligence efforts to understand the landscape of available data sources, vendor capabilities, and potential approaches to meeting CMS's verification data needs across multiple data domains.

This RFI seeks information across two related but distinct areas of interest:

1. Immediate Focus — Payroll and Employment Verification Data: CMS has an operational need for authoritative payroll and employment verification data to support Medicaid eligibility determinations and to prepare for community engagement verification requirements established under the Working Families Tax Cut Act (WFTCA), which takes effect January 2027, subject to implementing guidance. This data domain represents the primary procurement focus of this market research effort.

2. Broader Strategic Interest — Additional Verification Data Domains: CMS is also gathering market intelligence on industry capabilities across other verification data domains relevant to Medicaid eligibility and benefits program compliance, including but not limited to educational enrollment verification, asset and financial verification, and identity verification. Responses addressing these additional domains will inform CMS's broader platform strategy and ongoing acquisition planning activities. Vendors should note that this RFI does not signal a single consolidated procurement across all data domains described. CMS's approach to acquiring services in these additional domains, including whether and how each domain is addressed, will be determined through ongoing acquisition planning.

Vendors are encouraged to respond to the areas most relevant to their capabilities.

Responses addressing only one data domain are equally welcome as responses addressing multiple domains.

1.2 Background

State Medicaid agencies are required to verify applicant-provided information related to employment status, earnings, and other eligibility factors when evaluating eligibility for Medicaid and other benefits programs. The current verification landscape presents significant operational challenges: many states rely on manual verification processes, maintain fragmented direct relationships with individual data providers, and face inconsistent access to authoritative data sources, resulting in administrative burden on beneficiaries, processing delays, and duplicative costs across states. These challenges are not limited to payroll and employment data; they extend across the full range of verification data types that states rely upon to make accurate, timely eligibility determinations.

CMS is developing the EMMY platform, through the Center for Medicaid and CHIP Services (CMCS), to address these challenges by enabling states to access trusted verification data sources through a standardized, centralized federal service, reducing burden, improving consistency, and supporting cost-effective access at scale. An anticipated primary objective of the EMMY platform is to provide participating state Medicaid agencies with a standardized, centralized mechanism to verification services across relevant data domains, reducing the need for states to independently negotiate and maintain separate vendor agreements and associated costs.

CMS is pursuing verification data integration across multiple domains as part of its broader eligibility modernization strategy, with individual data domains being addressed through a combination of acquisition efforts and workstreams.

The urgency of this effort is reinforced by the Working Families Tax Cut Act (WFTCA), which establishes community engagement requirements for certain Medicaid beneficiaries effective January 2027, subject to implementing guidance. Under the WFTCA, certain beneficiaries must verify participation in qualifying activities, which may include employment, work activities, and educational enrollment, as a condition of eligibility.

States will need reliable, scalable access to verification data across multiple domains to implement these compliance workflows. CMS is focused on achieving integration readiness for payroll and employment verification in advance of the statutory deadline, while simultaneously gathering market intelligence on the broader landscape of verification data services to inform its ongoing platform strategy.

Pending Legislation Note: H.R. 1 (Public Law 119-21), commonly referred to as the Working Families Tax Cut Act (WFTCA), has been enacted. The January 2027 effective date referenced in this RFI pertains specifically to the WFTCA's community engagement verification requirements. References to those requirements in this RFI are subject to implementing guidance and federal rulemaking, which are still being developed. CMS is conducting this market research in advance of final implementing guidance to ensure readiness, and vendor responses should be scoped accordingly.

1.3 EMMY Platform Context

CMS is developing EMMY as a platform to support Medicaid eligibility verification and program compliance workflows through trusted third-party data sources. EMMY is being designed as an API-based service that will enable participating state Medicaid agencies to submit verification requests and receive authoritative data responses through a standardized, secure interface, replacing fragmented state-level approaches with a shared federal capability.

CMS intends for EMMY to serve as an extensible platform capable of integrating multiple verification data domains over time. The payroll and employment verification integration represents the immediate acquisition focus that this market research effort is designed to support. Other verification data domains described in this RFI are areas of strategic interest that CMS is evaluating as part of its broader eligibility modernization strategy. This RFI is a market research instrument spanning all of those domains, gathering intelligence across the full verification data landscape.

EMMY is being developed as an open-source platform. CMS is committed to open, interoperable integration approaches that avoid proprietary vendor lock-in and preserve CMS's ability to adapt its platform architecture over time. Vendors are encouraged to describe their current API architecture and data exchange approach, and to identify any aspects of their technical architecture or licensing model that would present challenges in supporting integration with an open-source, interoperable federal platform, including how their data assets and API layer are structured to support open integration.

SECTION 2 — SCOPE OF MARKET RESEARCH

CMS is seeking information on industry capabilities across multiple verification data domains relevant to Medicaid eligibility determination and benefits program compliance.

This section describes the scope of CMS's market research interest and provides context to help vendors assess their potential fit and respond meaningfully.

This RFI gathers market research across multiple verification data domains to inform CMS's broader eligibility verification modernization strategy. Payroll and employment verification (Section 2.1) is the immediate acquisition focus of this market research effort. Other data domains described in this RFI may be the subject of separate CMS acquisition activities;

this RFI does not represent the full scope of CMS's eligibility verification efforts and should not be interpreted as signaling a single consolidated procurement. Vendors should respond to the domains most relevant to their current capabilities. Responses addressing a single data domain are equally welcome as responses addressing multiple domains.

2.1 Payroll and Employment Verification (Immediate Acquisition Focus) CMS has a need for authoritative payroll and employment verification data to support Medicaid income-based eligibility determinations and to prepare for community engagement verification requirements established under the WFTCA, effective January 2027, subject to implementing guidance.

CMS is seeking to understand the market's capacity to provide services that support the following general outcomes:

• Verification of an individual's current or recent employment status, including full-time, part-time, seasonal, and other employment classifications

• Verification of earnings and payroll data sufficient to support income-based eligibility determinations

• Coverage across a broad range of employer types, industries, and geographies, including awareness of known coverage gaps for populations such as gig workers, self-employed individuals, and workers in informal or non-traditional employment arrangements

• Data that is sufficiently current and frequently refreshed, including real-time or near-real-time availability where feasible, to support reliable eligibility determinations

• Consent-based verification workflows that respect applicable privacy and employment data protections, including the Fair Credit Reporting Act (FCRA)

• Secure data exchange compatible with federal integration standards and the EMMY platform architecture

CMS is interested in understanding both the current state of the market for these services and vendors' perspectives on what is technically and commercially feasible within the timeframes relevant to this requirement.

2.2 Educational Enrollment Verification (Strategic Market Intelligence) CMS is gathering market intelligence on industry capabilities for educational enrollment verification data. Under the WFTCA, educational enrollment may constitute a qualifying community engagement activity, creating a potential future need for enrollment verification at scale.

CMS is seeking to understand the market's capacity to support the following general outcomes:

• Verification of an individual's current enrollment status at an educational institution, including degree or program information where available

• Verification of enrollment dates, academic terms, and enrollment intensity (full-time versus part-time)

• Coverage across institution types, including two-year colleges, four-year universities, vocational and trade programs, and other qualifying educational programs, with institution name and location included in verification response where available

• Consent-based verification workflows consistent with applicable privacy requirements, including the Family Educational Rights and Privacy Act (FERPA) and other applicable laws

• Secure data exchange compatible with federal integration standards

CMS is interested in understanding the current landscape of educational enrollment data sources, the nature and breadth of available coverage, and any legal or regulatory considerations specific to this data domain that would affect its use for Medicaid eligibility purposes.

2.3 Asset and Financial Verification

CMS is gathering market intelligence on industry capabilities for asset and financial verification data relevant to Medicaid eligibility determinations. Areas of general interest include:

• Verification of financial account ownership and balances

• Verification of financial asset holdings relevant to eligibility determinations

• Coverage across financial institution types and account categories

• Consent-based verification workflows consistent with applicable financial privacy requirements, including the Gramm-Leach-Bliley Act (GLBA) and other applicable law

• Secure data exchange compatible with federal integration standards

CMS is interested in understanding the nature and breadth of available data sources in this domain, as well as any legal or regulatory constraints that would affect the use of financial verification data for Medicaid eligibility purposes.

2.4 Identity Verification

CMS is gathering market intelligence on industry capabilities for identity verification and proofing services relevant to Medicaid eligibility workflows. Areas of general interest include:

• Identity proofing and authentication services

• Social Security Number (SSN) validation

• Address and date of birth verification

• Fraud detection and prevention capabilities relevant to benefits eligibility contexts

• Integration approaches for identity verification within eligibility determination workflows

CMS is interested in understanding how identity verification services are currently delivered in government benefits contexts, including applicable compliance frameworks and integration approaches.

2.5 Multi-Source and Integrated Verification Platforms

CMS is also interested in understanding whether vendors offer integrated platforms that provide access to multiple verification data types through a unified interface or API. Areas of general interest include:

• Single-API access to multiple verification data domains (e.g., payroll, enrollment, identity)

• Approaches to managing consent across multiple data domains through a single workflow

• Unified reporting and case management capabilities

• Commercial models for multi-domain platform access

• Extensibility and the ability to add new data domains over time

Vendors offering integrated or multi-source platforms are encouraged to describe how their platform architecture addresses the data domains described above, and to identify which domains are currently available versus planned for future availability.

2.6 Multi-Program Applicability

While this RFI is focused on Medicaid eligibility verification, CMS recognizes that the verification data services described in this section may have applicability to other public assistance programs, including SNAP (Supplemental Nutrition Assistance Program), TANF (Temporary Assistance for Needy Families), housing assistance programs, and other federal and state benefit programs.

Vendors whose services can support multi-program verification needs are encouraged to indicate this and describe relevant experience in their responses to Questions A3 and F2.

SECTION 3: TECHNICAL AND COMPLIANCE CONTEXT

The following information is provided to give vendors relevant context regarding CMS's technical environment and compliance landscape. This context is intended to help vendors assess their potential fit and provide informed responses. CMS is not prescribing specific technical requirements at this stage of market research. CMS is interested in understanding how vendors currently meet, or could meet, these standards, and welcomes candid information about gaps, timelines, and alternative approaches.

3.1 Technical Integration Context

EMMY is being designed as an API-based data exchange platform. CMS is interested in understanding vendors' existing technical architectures and integration approaches, across all data domains described in this RFI, including:

• API design and data exchange standards in current use (e.g., RESTful, FHIR-compliant, or other approaches)

• Authentication and authorization mechanisms

• Data transmission and storage security practices

• Availability of sandbox or testing environments to support integration and onboarding

• Typical integration timelines and the nature of onboarding support provided to new clients

• Scalability characteristics and current processing capacity

Vendors are encouraged to describe their current technical approach and to identify any aspects of a federal integration environment that would require adaptation or present implementation challenges.

3.2 Federal Compliance Context

Solutions integrated with EMMY will be required to comply with applicable federal security, privacy, and data governance requirements. CMS is interested in understanding vendors' current compliance posture across the following areas, recognizing that applicable requirements may vary by data domain:

• Federal cybersecurity standards, including NIST SP 800-53 security controls and FISMA requirements

• FedRAMP authorization status: current authorization level, if any, or assessment of feasibility and timeline for pursuing authorization

• Privacy protections for personally identifiable information (PII) consistent with the Privacy Act of 1974

• Data domain-specific privacy and regulatory requirements, including:

o FCRA for employment and earnings data o FERPA for educational enrollment data o GLBA for financial and asset data o Other applicable federal and state privacy frameworks

• Other relevant certifications or compliance frameworks vendors currently hold (e.g., SOC 2 Type II, HIPAA, ISO 27001, HITRUST)

CMS recognizes that vendors may be at varying stages of federal compliance readiness and that compliance requirements differ meaningfully across data domains. CMS is interested in understanding both current status and vendors’ assessment of the feasibility and timeline for achieving required compliance levels.

3.3 Anticipated Scale – For Context Only

To assist vendors in assessing the scale of CMS's potential need, the following estimates are provided for market research purposes only. These figures are illustrative and do not represent a commitment to any specific contract scope:

• Participating agencies: Up to 50+ state Medicaid agencies, subject to state participation decisions

• Deployment model: Anticipated phased rollout beginning with a limited number of pilot states, expanding to broader national deployment over time

Vendors are encouraged to describe how their services currently perform at comparable scale, and to identify any capacity, infrastructure, or commercial model considerations that would be relevant to multi-state government deployments.

CMS is coordinating with state Medicaid directors and agency representatives to ensure that solutions meet end-user operational needs. State Medicaid representatives may participate in follow-on market research activities, pilot implementations, and ongoing feedback processes. Vendors with existing relationships with state Medicaid agencies are encouraged to describe those relationships in their responses to Question A3.

SECTION 4: INFORMATION REQUESTED AND QUESTIONS FOR

INDUSTRY

CMS requests that respondents address the following questions to the extent applicable to their organization, capabilities, and offerings. Responses need not be exhaustive. CMS is seeking sufficient information to understand market capabilities and inform acquisition planning. Responses should be factual, concise, and focused on current, demonstrated capabilities.

Questions are organized by topic area. Where a question references a specific data domain, vendors should respond for the domains they offer. Vendors offering capabilities in only one domain are encouraged to focus their responses accordingly rather than attempting to address all questions comprehensively.

Topic A: Company and Capability Overview A1. Provide a brief description of your organization, including your primary business focus, years in operation, organizational structure (e.g., small business, large business, nonprofit), and any government-wide contract vehicles (e.g., GSA Multiple Award Schedules, GWACs, or other indefinite-delivery vehicles) through which your services could be made available to CMS. If your organization does not currently hold a government-wide contract vehicle but is actively pursuing one (e.g., through GSA expedited or other alternative contract vehicle pathways), please describe the vehicle being pursued and your estimated timeline for award. What procurement mechanism(s) do you believe would be most suitable for an acquisition of this nature, and are there any contract vehicle considerations CMS should be aware of in its acquisition planning? Small businesses that do not currently hold a government-wide contract vehicle but are interested in teaming or subcontracting arrangements relevant to this requirement are encouraged to indicate this in their response. The absence of a current contract vehicle will not preclude a vendor from responding to this RFI or from competing in any future procurement conducted through open competition; CMS is gathering this information solely to understand the range of available acquisition pathways. Basic registration information (CAGE Code, SAM.gov UEI, and small business designations) should be provided on the required header page (see Section 5.1) and need not be repeated here.

A2. Describe the verification data services your organization currently provides. Which of the data domains described does your organization currently offer, and at what stage of maturity (e.g., commercially available, in development, available through partnership)? If you offer services across multiple domains, please describe each.

A3. Describe your organization's experience providing verification data services to federal, state, or local government clients, particularly in the context of public benefits programs (e.g., Medicaid, SNAP, TANF, housing assistance). Please provide general descriptions of relevant experience; current contracts or client names are not required but may be included at your discretion.

Topic B: Data Sources, Coverage, and Quality B1. Describe the data sources underlying your verification services for each domain you offer. What types of data sources do you access (e.g., direct employer payroll data, third-party aggregators, educational institution registrars, financial institutions, government data sources)? CMS is interested in understanding the nature and breadth of your data access across domains, not necessarily the identity of specific source partners. Please also describe your organization's role in the data market (for example, as a primary data source, a data aggregator, a multi-source platform, or another model) and how that role affects the nature and cost of the data you provide.

For context, illustrative data attributes of interest for payroll and employment verification are provided below. These attributes are illustrative and not intended to prescribe or limit vendor approaches. CMS welcomes information on any additional attributes relevant to Medicaid eligibility determination.

On the request side, CMS would typically provide individual identifiers to initiate a verification request, which may include attributes such as: first name, last name, date of birth, a verification as-of date, account and client identifiers, and a consent or terms flag.

On the response side, illustrative data attributes of interest include: verified employment status, employer name and address, employment period dates, employee name on record, and earnings information sufficient to support income-based eligibility determinations.

B2. Describe the geographic (all 50 states?) and demographic coverage of your data across the domains you offer. Are there known gaps in coverage (e.g., certain employer types, geographic regions, institution types, population segments such as gig workers, self-employed individuals, part-time students, or workers in informal employment)? How do you address or communicate these gaps to clients?

B3. Describe the freshness and update frequency of your data across the domains you offer. How current is the data available through your service, and how frequently is it refreshed (e.g. real-time, daily, weekly, monthly)? How do you handle data latency? How do you handle situations where data is unavailable or a verification request cannot be matched?

For context, CMS's current operational need for payroll and employment verification requires data that reflects an individual's current or recent employment and earnings status in a timely manner sufficient to support eligibility determinations. Vendors are encouraged to describe the minimum refresh frequency their service currently supports, any options for more frequent or real-time updates, and how data latency is managed when the most current data is not immediately available.

B4. How do you ensure the accuracy and reliability of the data you provide across the domains you offer? What quality assurance processes, error rates, or accuracy metrics can you share at a general level?

Topic C: Consent-Based Verification and Privacy C1. Describe how your service supports consent-based verification workflows, in which individuals authorize the release of their verification data to a requesting agency. How does your service document, manage, and audit consent? If you offer services across multiple data domains, please describe any differences in how consent is managed across domains.

C2. How does your organization ensure compliance with applicable privacy and data requirements relevant to the domains you offer? This may include the Fair Credit Reporting Act (FCRA) for employment data, the Family Educational Rights and Privacy Act (FERPA) for educational enrollment data, the Gramm-Leach-Bliley Act (GLBA) for financial data, the Privacy Act of 1974, and other relevant federal and state privacy laws. Vendors should also describe their approach to compliance with the Health Insurance Portability and Accountability Act (HIPAA), to the extent applicable to their services and data exchange arrangements with covered entities such as state Medicaid agencies. Are there any legal or regulatory constraints on the use of your data for Medicaid eligibility determination purposes that CMS should be aware of?

C3. Are there data use, licensing, or contractual constraints associated with your data sources, across any of the domains you offer, that could affect CMS's ability to use your services for the purposes described in this RFI? Please describe any known constraints at a general level.

Topic D: Technical Integration and Federal Readiness D1. Describe your API architecture and data exchange approach across the domains you offer. How would your service integrate with a federal platform such as EMMY, and what is your typical integration timeline from initial engagement to production deployment? Do you offer sandbox or test environments with representative data to support integration testing prior to production deployment?

D2. Describe your current federal security and compliance posture. Do you currently hold FedRAMP authorization? If so, at what impact level, and does your authorization cover all data domains you offer? If you currently hold FedRAMP authorization, please also describe whether that authorization covers the specific services and data domains you would offer under this requirement, or whether an expanded or new authorization would be needed. If you do not currently hold FedRAMP authorization, have you assessed the feasibility of pursuing it, and what is your estimated timeline?

D3. Describe your service's scalability and availability across the domains you offer. What is your current processing capacity, and how does your infrastructure support high-volume usage across multiple state agencies simultaneously? What service availability commitments do you currently offer?

D4. At a general level, what is a realistic timeline for achieving production-ready integration of a payroll and employment verification service with a federal platform, measured from contract award? Given the WFTCA community engagement verification requirements taking effect January 2027, subject to implementing guidance, CMS is particularly interested in understanding what factors most commonly affect that timeline and whether there are actions a federal agency could take to accelerate or support integration readiness.

Topic E: Pricing Models and Cost Structures Note: CMS is not requesting specific price quotes or binding pricing commitments in response to this RFI. The following questions are intended to help CMS understand the general structure of market pricing and the range of commercial pricing models available across verification data domains, in support of acquisition planning activities. Vendors are encouraged to describe general market norms, ranges, and structures rather than specific proprietary pricing, to the extent that doing so provides useful market research.

E1. Describe the pricing model(s) your organization currently uses or could offer for verification data services across the domains you offer. What pricing structures are commercially available (e.g., per-transaction, subscription-based, tiered volume pricing, enterprise licensing, or hybrid models)? Does your pricing model differ across data domains?

E2. What factors most significantly influence the cost of your services? For example, how does pricing vary based on verification volume, data domain, geographic scope, integration complexity, or the number of state agencies accessing the service? CMS is also interested in understanding how your organization's approach to data sourcing and delivery, including any technology-driven efficiencies such as automation or AI/ML-assisted verification, affects your cost structure and pricing model. Vendors are encouraged to describe what distinguishes their approach and how it translates to pricing for a large-scale, multi-state government deployment.

E3. Beyond the pricing model structures described in your response to E1, CMS is interested in understanding how the commercial opportunity of a centralized federal arrangement, providing access to a large, stable, multi-state client base with the potential for long-term engagement, typically factors into pricing or partnership terms in your market. For example, do vendors in your market commonly offer more favorable pricing in exchange for volume commitments, long-term agreements, or other commercial arrangements that reflect the value of a stable, long-term government client relationship?

What commercial arrangements have worked well in comparable multi-agency or large-scale government deployments?

E4. Are there implementation, onboarding, or integration costs associated with your services that are separate from ongoing usage costs? How are these typically structured, and do they vary by data domain or integration complexity?

E5. To assist CMS in planning for this requirement, vendors are invited to share any publicly available or generally available pricing information for services of the type described in this RFI. This may include published rate cards, GSA Schedule pricing, or general price ranges for comparable government or enterprise deployments. Vendors are not required to provide proprietary or competitively sensitive pricing information. Any pricing information provided will be used solely for market research purposes and will not be used as the basis for contract award.

Topic F: Market and Industry Considerations F1. From your perspective, what are the most significant market, technical, or regulatory challenges associated with providing verification data services, across any of the domains described in this RFI, to a federal agency for Medicaid eligibility purposes? Are there barriers to entry or participation that CMS should be aware of in its acquisition planning?

F2. Are there aspects of your capabilities, data, or commercial model, across any of the domains you offer, that are not well-captured by the questions above? Please use this question to share any additional information relevant to CMS's market research, including potential applicability of your services to other public assistance programs such as SNAP (Supplemental Nutrition Assistance Program), TANF (Temporary Assistance for Needy Families), housing assistance programs, or other federal and state benefit programs beyond Medicaid, and any small business participation or teaming arrangements relevant to this requirement.

SECTION 5: RESPONSE FORMAT AND SUBMISSION

INSTRUCTIONS

5.1 Response Format

CMS requests that responses be organized to correspond with the topic areas and questions in Section 4. Responses need not follow a rigid format but should be clearly organized and easy to navigate.

Submission Method / File format: PDF preferred; Microsoft Word acceptable

Respondents are encouraged to use the following file naming convention for ease of processing: [Vendor Name]_EMMY_RFI_Response.pdf

Recommended Page Limit: CMS requests that responses be no longer than 15 pages, exclusive of the required header page and any optional attachments described in Section

5.2. Narrative responses should be concise and substantive. Vendors are encouraged to focus on the questions most relevant to their capabilities rather than attempting to address every question comprehensively.

Header Page (Recommended)

Respondents are asked to include a header page containing the following information to assist CMS in organizing and reviewing responses.

• Company Name

• Company Address

• Point of Contact Name and Title

• Point of Contact Phone and Email

• CAGE Code

• SAM.gov Unique Entity Identifier (UEI)

• Small Business Status / Socioeconomic Designations

• Data Domain(s) Addressed: (Payroll/Employment / Educational Enrollment /

Asset/Financial / Identity Verification / Multi-Source Platform)

• Government-Wide Contract Vehicle(s) Held, if any

• Interest in Follow-On Market Research Session (if conducted): Yes / No

Narrative Response (Pages 2–16, maximum 15 pages)

The narrative response should address the questions in Section 4 most relevant to the vendor's capabilities and offerings. Responses should be organized by topic area (A through F) and clearly labeled. Vendors are not required to respond to every question.

5.2 Optional Information / Attachments

The following materials may be submitted as optional attachments and will not count toward the 15-page narrative limit. Attachments are not required and will not be evaluated as a substitute for narrative responses.

Optional Capability Statement (maximum 2 pages)

Vendors may optionally submit a brief capability statement as a standalone attachment. If submitted, the capability statement should address the following elements concisely:

• Brief company description and primary business focus

• Verification data domain(s) offered and maturity level

• Summary of relevant government or public sector experience

• Key technical capabilities and compliance certifications held

• Any unique differentiators relevant to the services described in this RFI

Additional Optional Attachments:

• Relevant compliance certifications (e.g., FedRAMP authorization letter, SOC 2 report summary)

• Sample API documentation or technical architecture overview

• Relevant past performance summaries

• Published pricing information or rate cards (if provided in response to Question E5)

5.3 Submission Instructions / Other Information

Responses must be submitted electronically via email by April 17, 2026, 5:00 PM Eastern Time.

Email Subject Line: RFI Response – CMS-EMMY-2026 – [Vendor Name]

Respondents are encouraged to clearly mark any proprietary or confidential information included in their responses. CMS will make reasonable efforts to protect marked proprietary information, but responses may be subject to Freedom of Information Act (FOIA) requests.

Contact Information is provided solely for the purpose of receiving written RFI responses.

Questions regarding this RFI will not be accepted or answered. Vendors should address any assumptions or clarifications within their written response.

Contact Information

Primary Point of Contact:

Matthew Wendel, USDS Supporting CMS

Email: matthew.wendel@cms.hhs.gov

Alternative Point of Contact:

Colin Hahn, CMS Office of Acquisition and Grants Management

Email: colin.hahn@cms.hhs.gov

Contracting Office Address:

Centers for Medicare & Medicaid Services

Office of Acquisition and Grants Management

7500 Security Blvd

Baltimore, MD 21244 USA mailto:matthew.wendel@cms.hhs.gov mailto:colin.hahn@cms.hhs.gov

SECTION 6: FOLLOW-ON MARKET RESEARCH ACTIVITIES

Following review of written RFI responses, CMS may conduct follow-on one-on-one market research sessions with vendors, held remotely. These sessions, if held, are intended to allow CMS to ask more targeted questions, explore specific capabilities in greater depth, and gather feedback on draft requirements documentation.

If follow-on sessions are conducted, CMS will select participants based on the relevance of a vendor's stated capabilities to CMS's active market research needs at the time sessions are scheduled. Selection is not a competitive evaluation. CMS retains full discretion in determining which vendors to contact for follow-on sessions. Participation or non-participation in follow-on sessions will have no bearing on eligibility to compete for, or receive award of, any resulting contract.

Follow-on sessions are market research activities conducted pursuant to FAR Part 10 (Market Research). Information gathered will be used solely to inform CMS's acquisition planning and treated as aggregate market research input, not as a predetermined basis for limiting competition or establishing vendor-specific requirements, with CMS's acquisition approach determined based on the totality of market research findings in accordance with applicable law and regulation. Vendors are advised that substantial input on technical requirements or acquisition strategy may be considered in any OCI assessment associated with a resulting procurement (see Section 7).

Participation is voluntary. CMS will contact selected vendors directly to schedule sessions.

Vendors interested in participating should indicate this on their RFI response header page (see Section 5.1). CMS makes no commitment to conduct follow-on sessions and reserves the right to complete its market research based solely on written responses received.

SECTION 7: DISCLAIMERS & LEGAL NOTICES

No Commitment; No Reimbursement

This is an RFI only and does not constitute a solicitation or commitment by CMS to award a contract.

Responses are voluntary. Failure to respond will not preclude participation in any future procurement.

The Government will not reimburse any costs incurred in preparing or submitting responses.

Proprietary or confidential information should be clearly marked.

Use of Information; Right to Modify

Information obtained through this RFI may be used to:

• Develop acquisition strategy

• Inform future solicitation development

• Coordinate with other federal agencies

• Support planning activities

A future solicitation, if issued, may differ substantially from the concepts described in this

RFI.

CMS reserves the right to use information gathered through this RFI to inform the development of future solicitations and acquisition strategy.

Organizational Conflicts of Interest (OCI)

Vendors who respond to this RFI and provide substantial input regarding requirements or acquisition strategy may be subject to an OCI determination that could preclude them from competing for any resulting contract. CMS will assess potential conflicts on a case-by-case basis in accordance with FAR Subpart 9.5 and may consider mitigation measures where appropriate.