RFA - Telepsychiatry Services and Consultation Crisis Stabilization Centers and Mobile Crisis Teams_5.13.24.pdf

EXHIBIT A

STANDARD GRANT AGREEMENT (SGA)

REQUEST FOR APPLICATIONS (RFA)

(COMPETITIVE)

PROCUREMENT ID NUMBER – BPM044294 / BHA24-013

Issue Date: 5/13/2024

Telepsychiatry Services and Consultation for Crisis Stabilization Centers and Mobile Crisis Teams

NOTICE

A Prospective Applicant that has received this document from the Maryland Department of Health, or that has received this document from a source other than the Procurement Officer, and that wishes to assure receipt of any changes or additional materials related to this RFA, should immediately contact the Procurement Officer and provide the Prospective Applicant’s name and mailing address so that addenda to the RFA or other communications can be sent to the Prospective Applicant.

Minority Business Enterprises Are Encouraged to Respond to this Solicitation

10/2019

STATE OF MARYLAND

MARYLAND DEPARTMENT OF HEALTH

RFA KEY INFORMATION SUMMARY SHEET

Request for Proposals: Telepsychiatry Services and Consultation for Crisis Stabilization Centers and Mobile Crisis Teams

Solicitation Number: BPM044294 / BHA24-013

a. RFP Issue Date: 5/13/2024

RFP Issuing Office: Maryland Department of Health Behavioral Health Administration

Procurement Officer: Crystal Hack

Maryland Department of Health Behavioral Health Administration Finance & Procurement Division 55 Wade Avenue Voc. Rehab. Building Catonsville, MD 21228 Phone: 410-627-6814 e-mail: crystal.hack@maryland.gov

Grant Monitor: Eric Davis

Behavioral Health Administration 55 Wade Avenue Catonsville, MD 21228 Vocational Rehabilitation Building Phone: 240-444-5601 e-mail: Eric.davis3@maryland.gov

Applications are to be sent to: eMaryland Marketplace Only! (See section 1.5) eMMA is an electronic commerce system administered by the Maryland Department of General Services.

In order to receive a Contract award, a Contractor must be registered on eMMA.

Registration is free. Go to https://emaryland.buyspeed.com/bso/login.jsp, click on “Register” to begin the process, and then follow the prompts.

Closing Date and Time: June 3rd, 2024, No later than 2 pm EST Local Time mailto:Eric.davis3@maryland.gov

SECTION 1 - GENERAL INFORMATION

1.1 Summary Statement

1.1.1 The Maryland Department of Health (MDH or the Department), Behavioral Health Administration (BHA), is issuing this Request for Applications (RFA) to provide telepsychiatry services to individuals experiencing a behavioral health crisis and consultation services to providers supporting individuals at Behavioral Health Crisis Stabilization Centers (BHCSC) and Mobile Crisis Teams (MCT). Services will serve the full lifespan of individuals, including children and adolescents, who present in psychiatric crises. Child and Adolescent Psychiatrists, Adult Psychiatrists, other psychiatric specialties, Addiction Medicine physicians, and other physicians, nurse practitioners (NP), and physician assistants (PA) will provide 24/7 telepsychiatry services and consultation. When providing direct care to individuals, providers will be able to bill insurance for these services. Additionally, the Applicant will train providers on supporting individuals who present in psychiatric crises. The Applicant will have the capability to provide broad expertise as well as specific expertise in child and adolescent psychiatry and addiction medicine.

The services will be three-fold and will include a direct care service component, consultation for BHCSC and MCT providers on patients, and training for providers on managing psychiatric presentations during crisis care.

1.1.2 It is the State’s intention to obtain telepsychiatry consultation services, as specified in this RFA, from an Agreement between the selected Applicant and the State. The anticipated duration of services to be provided under this Agreement is for one year with two option years subject to the availability of funding. For commodities, the anticipated delivery date is within three months of award.

1.1.3 BHA intends to make a single award as a result of this RFA.

1.1.4 Applicants, either directly or through their subcontractor(s), must be able to provide all services and meet all of the requirements requested in this solicitation and the successful Applicant shall remain responsible for performance regardless of subcontractor participation in the work.

1.2 Contract Type

The Agreement resulting from this solicitation shall be a firm fixed price.

1.3 Procurement Officer

The sole point of contact in the State for purposes of this solicitation prior to the award of any Agreement is the Procurement Officer at the address listed below:

Crystal Hack Maryland Department of Health Behavioral Health Administration Finance & Procurement Division 55 Wade Avenue Voc. Rehab. Building Catonsville, MD 21228 Phone: 410-627-6814 e-mail: crystal.hack@maryland.gov

The Department may change the Procurement Officer at any time by written notice.

1.4 Grant Monitor

The Grant Monitor is:

Eric Davis Behavioral Health Administration 55 Wade Avenue Catonsville, MD 21228 Vocational Rehabilitation Building Phone: 240-444-5601 e-mail: Eric.davis3@maryland.gov

The Department may change the Grant Monitor at any time by written notice.

1.5 eMaryland Marketplace Advantage

Each Applicant is requested to indicate its eMaryland Marketplace Advantage (eMMA) vendor number in the Transmittal Letter (cover letter) submitted at the time of its Application submission to this RFA.

eMMA is an electronic commerce system administered by the Maryland Department of General Services. The RFA and associated materials, the solicitation and summary of the Pre-Proposal Conference, Applicant questions and the Procurement Officer’s responses, addenda, and other solicitation-related information will be provided via eMMA.

In order to receive a contract award, a vendor must be registered on eMMA. Registration is free. Go to https://procurement.maryland.gov/, click on “Register” to begin the process, and then follow the prompts.

1.6 Questions

Written questions from prospective Applicants will be accepted by the Procurement Officer. Questions to the Procurement Officer shall be submitted via eMaryland Marketplace ONLY! Please identify in the subject line the Solicitation Number and Title.

Questions are requested to be submitted at least 7 days prior to the Application due date. The Procurement Officer, based on the availability of time to research and communicate an answer, shall decide whether an answer can be given before the Application due date. All questions and answers will be posted to eMaryland Marketplace under the documents tab.

1.7 Application Due (Closing) Date and Time

Applications, in the number and form set forth in Section 4.2 “Proposals” must be received by the Procurement Officer, via eMaryland Marketplace Advantage (eMMa), no later than 2:00 PM. Local Time on June 3rd, 2024 in order to be considered.

Requests for extensions of this time or date will not be granted. Applications received after the due date and time listed in this section will not be considered. Questions regarding this solicitation should be submitted to eMMa only.

Applications may be modified or withdrawn by written notice received by the Procurement Officer before the time and date set forth in this section for receipt of Application. Multiple and/or alternate Applications will not be accepted.

mailto:Eric.davis3@maryland.gov https://procurement.maryland.gov/

1.8 Award Basis

The Grant shall be awarded to responsible Applicants submitting Applications that have been determined to be the most advantageous to the State, considering price and evaluation factors set forth in this RFA, for providing the activities as specified in this RFA. See RFA Section 5 for further award information.

1.9 Revisions to the RFA

If it becomes necessary to revise this RFA before the due date for Applications, the Department shall endeavor to provide addenda to all prospective Applicants that were sent this RFA or which are otherwise known by the Procurement Officer to have obtained this RFA. Addenda made after the due date for Applications will be sent only to those Applicants that submitted a timely Application and that remain under award consideration as of the issuance date of the addenda.

Acknowledgment of the receipt of all addenda to this RFA issued before the Application due date shall be included in the Transmittal Letter accompanying the Applicant’s Project Narrative. Acknowledgement of the receipt of addenda to the RFA issued after the Application due date shall be in the manner specified in the addendum notice. Failure to acknowledge receipt of an addendum does not relieve the Applicant from complying with the terms, additions, deletions, or corrections set forth in the addendum.

1.10 Cancellations

The State reserves the right to cancel this RFA, accept or reject any and all Applications, in whole or in part, received in response to this RFA, to waive or permit the cure of minor irregularities, and to conduct discussions with all qualified or potentially qualified Applicants in any manner necessary to serve the best interests of the State. The State also reserves the right, in its sole discretion, to award a Grant based upon the written Applications received without discussions or negotiations.

THE REMAINDER OF THIS PAGE IS INTENTIONALLY LEFT BLANK.

SECTION 2 – MANDATORY REQUIREMENTS

2.1 Applicant Mandatory Requirements

The Applicant must provide proof with its Application that the following Mandatory Requirements have been met:

2.1.1 The Applicant shall have a minimum of five years’ experience providing telepsychiatry services to medical systems. As proof of meeting this requirement, the Applicant shall provide with its Application documentation of their work efforts in the form of annual reports, pertinent contracts or other such documentation to substantiate the details of their experience and track record.

2.1.2 The Applicant shall include board-certified Child and Adolescent Psychiatrist(s) and Adult Psychiatrist(s) with relevant experience treating complex cases such as but not limited to patients with Intellectual and/or Developmental Disabilities (IDD) with co-occurring Mental Health Disorders (MHD). Other psychiatric specialties can include: geriatric, addiction, emergency, and neuropsychiatry. The Applicant shall, as appropriate, include Child and Adolescent Psychiatrists, Adult Psychiatrists, other psychiatric specialties, Addiction Medicine physicians, and other physicians, nurse practitioners (NP), and physician assistants (PA). As proof of meeting this requirement, the Applicant shall provide with its Application licenses and/or certificates issued by the Maryland Board of Physicians and/or Maryland Board of Nursing of evidencing the Applicant’s certification in the aforementioned fields. Along with licenses and/or certificates, the Applicant shall provide resumes/CVs or other relevant documentation as proof of ability to practice in the State of Maryland.

2.1.3 The Applicant shall include Psychiatric consultants capable of providing medication management, including the capability of prescribing controlled substances or medications for substance use disorders, and diagnostic clarification to individuals across the lifespan presenting in psychiatric crises at either a Behavioral Health Crisis Stabilization Center or in the field via Mobile Crisis Team.

SECTION 3 – SCOPE OF WORK

3.1 Background and Purpose

The State is issuing this solicitation for the purpose of identifying an Applicant to provide telepsychiatry services and provider consultation for individuals across the lifespan that present in acute psychiatric crises either in Behavioral Health Crisis Stabilization Centers (BHCSC) or in the field via Mobile Crisis Teams (MCT). Child and Adolescent Psychiatrists, Adult Psychiatrists, other psychiatric specialties, Addiction Medicine physicians, and other physicians, nurse practitioners (NP), and physician assistants (PA) will provide on demand 24/7 telepsychiatry consultation to both providers and patients. The Applicant will fill a critical gap in the crisis continuum of care and further enable the cultural shift away from emergency departments (EDs) being the first stop when an individual is experiencing a behavioral health crisis. The Applicant will serve all of Maryland’s BHCSCs and MCTs that are regulated under COMAR 10.63 in order to reduce on-site staffing hardships and expertise gaps and ensure Marylanders have critical access to psychiatric services during a crisis other than in EDs.

The heightened need for telepsychiatry springs from years of reported shortages of psychiatrists nationally with nearly half of U.S. counties lacking a practicing psychiatrist.1 The professional shortage coupled with long wait times for an outpatient appointment has resulted in many individuals seeking psychiatric care in EDs, long before COVID-19 exacerbated mental health needs.2 The gap only grows greater for access to child and adolescent psychiatrists with families facing months-long wait times or traveling great distances for treatment due to 70 percent of U.S. counties lacking a single pediatric psychiatrist.3 While the child and adolescent population languishes without access to appropriate providers or treatment, their symptoms can intensify beyond caregiver capability leading to an ED visit.

Maryland remains driven to better address psychiatric crises in the least restrictive and most appropriate settings for each individual.

This RFA addresses the growing need particularly amongst children and adolescents experiencing behavioral health challenges and further decompensating while waiting months for an appointment. The ability to have patients in front of a psychiatrist by way of telehealth is lifesaving. A 2018 study on St. Joseph’s Villa telehealth services found that approximately 88 percent of patients had returned home or to a less-restrictive facility over a six-year period.4 Not only can telepsychiatry improve access to care, but this data also supports ED diversion once the community is informed of the availability of services. The American Psychiatric Association promotes telepsychiatry as offering many benefits by reducing delays in care and improving access to specialty care for the pediatric population or in rural areas.5

Initially, BHA estimates there will be six BHCSCs but this number is anticipated to increase over time. A BHCSC will be a newly regulated service open 24 hours/7 days a week every day of the year, offering services to de-escalate and support a person’s behavioral health crisis and deflect as possible from emergency facilities, hospitals, and potential legal consequences. A BHCSC provides access to a safe environment including assessment, diagnosis, and treatment, capable of delivering in a timely manner leading to stabilization. The BHCSC level of care is provided for

Nathaniel Counts, “Understanding the U.S. Behavioral Health Workforce Shortage” (explainer), Commonwealth Fund, May 18, 2023. https://doi.org/10.26099/5km6-8193 Simko, Laura et al. “Waiting for Care: Length of Stay for ED Mental Health Patients by Disposition, Diagnosis, and Region (2009-2015).” Cureus vol. 14,6 e25604. 2 Jun. 2022, doi:10.7759/cureus.25604 McBain, Ryan K et al. “Growth and Distribution of Child Psychiatrists in the United States: 2007-2016.” Pediatrics vol. 144,6 (2019): e20191576. doi:10.1542/peds.2019-1576 Wicklund, E. (2018, June 1). St. Joseph’s Villa Uses Telehealth to Connect With Children in Crisis. MHealthIntelligence.

https://mhealthintelligence.com/news/st.-josephs-villa-uses-telehealth-to-connect-with-children-in-crisis What is Telepsychiatry? https://www.psychiatry.org/patients-families/telepsychiatry#:~:text=Video%2D%20and%20audio%2Dbased%20telepsychiatry,or%20care%20in%20rural%20areas up to 24 hours per episode of care with rapid, same-day access to the service. Additional required BHCSC features include:

● Accept walk-in visits with no appointment needed for immediate mental health and substance use support at all times;

● Capacity to serve individuals under Petition for Emergency Evaluation (EP) status as an alternative destination from an emergency department, including separate confidential entrances for first responders and secure locked facilities;

● Capacity to serve the full lifespan, including children and adolescents;

● Services include screening, assessment, crisis support and stabilization, immediate behavioral health and medication treatment, and linkage to social services and other behavioral health services;

● Capacity to provide:

○ Medical evaluation including appropriate laboratory work;

○ Withdrawal management for all substances along with initiation of medication for the treatment of opioid use disorder;

○ Real-time prescribing; and

○ Referral to other short-term stabilization services or traditional community outpatient resources.

Telepsychiatry services will also be provided to MCT providers as requested. MCTs are designed to:

● Provide services for:

○ Children, adolescents, adults, and older adults;

○ All special populations including but not limited to individuals of all races, individuals with developmental disabilities, veterans, and those who identify as LGBTQ+; and

○ All mental health and substance use presentations;

● Provide crisis prevention, intervention, and stabilization services 24/7 every day of the year based on national SAMHSA guidelines and best practices;

● Connect all individuals served to ongoing behavioral health services and community resources under the least restrictive level of care;

● Ensure a majority of individuals served are transitioned to a lower level of care within two weeks of crisis response;

● Reduce the proportion of individuals experiencing behavioral health symptoms who are referred to or transported to an emergency level of care (i.e., 911 response, emergency department);

● Prioritize warm handoffs over cold referrals (i.e., higher levels of care, ongoing outpatient services);

● Engage in active stabilization services for all individuals served and their support networks unless contraindicated;

● Coordinate and collaborate with all applicable components of the Urgent and Acute Care System continuum of services, including at a minimum a regional 988 call center, walk-in and urgent care services, crisis response and crisis stabilization services, and inpatient and residential care when needed;

● Establish a mobile dispatch plan that dispatches team staff and first responder partners at volumes and levels of licensure commensurate with the indicated level of risk and type of need for each unique response and follow-up service;

● Comply with Code of Maryland Regulations (COMAR) 10.63 and relevant BHA policy documents as they are published and/or updated over time, including for operations, staffing, and services; and

● Utilize the Statewide Urgent & Acute Behavioral Health Care Data System as indicated by BHA.

The Applicant's activities will be three-fold by encompassing direct service, provider consultation, and a training component.

3.2 Scope of Work - Requirements

The Applicant shall provide:

1. Telepsychiatry Services and Provider Consultation

a. Direct Services

b. Provider Consultation

c. Training

2. Staffing

3. Quarterly and Annual Reports

3.2.1 General Requirements

3.2.1.1 Telepsychiatry Services and Provider Consultation

A. Provide telepsychiatry direct services to individuals experiencing a crisis and consultation to providers - at BHCSCs and MCTs through videoconferencing at a distant site.6. This includes:

a. Provide clinical staff hours to conduct telepsychiatry consultation 24/7 on an on-demand basis.

b. Maintain an infrastructure to support phone and video based telepsychiatry consultation.

i. This shall include a high-resolution webcam, sufficient computer processor, sufficient network bandwidth, video conferencing software, microphone, speaker or headset, and other elements as needed to provide fully functioning phone and video-based conferencing.

c. Provide data on the number of individuals served, the number of telepsychiatry services completed, and the provider recommendations made.

B. Video-based consultation will be available 24/7 on an on-demand basis.

a. Consultation includes:

i. Diagnostic clarification

ii. Treatment recommendations

iii. Medication review and management C. Telepsych services must be provided to all BHCSCs and MCTs regulated under COMAR 10.63 in Maryland.

D. Telepsych services must begin within three months of award.

E. Monthly meetings to be scheduled by the Applicant with BHA to discuss program progress.

3.2.1.4 Training

A. The Applicant must provide:

a. Training

b. . Education cTopics may include, but are not limited to:

i. Addressing co-occurring disorders (i.e., mental health and substance use disorder, or behavioral health and somatic conditions)

ii. Somatic care in crisis services (i.e., diabetic ketoacidosis, urinary tract infection)

iii. Child and adolescent-specific de-escalation strategies, evidence-based assessment tools, developmentally appropriate supports and services, and psychiatric management

iv. Other topics to be determined, including based on identified knowledge gaps

3.2.1.5 Population

A. This Applicant will serve children, youth, adults, older adults, and all special populations. This may include:

a. High acuity, complex needs child and adolescent population who often exhibit physical or verbal aggression, self-injurious behavior, sexually reactive behavior, significant difficulty with interpersonal relationships, impulse control disorders, disruptions in occupational functioning, Distant site meaning site at which the physician or other licensed practitioner delivering the service is located at the time the service is provided via telecommunications system.

symptoms interfering with activities of daily living, suicidal ideation and suicide attempts, swallowing, running away, and low distress tolerance and weak problem-solving skills.

b. Children and adolescents who have demonstrated a change in behavior or have experienced an identified trauma.

c. Individuals who may be at imminent risk of having a psychiatric or substance use related crisis.

3.2.2 Staffing

3.2.2.1 Staffing Matrix

A. Staffing is not prescribed.

B. A staffing matrix should be submitted with the application as part of the Budget Narrative to demonstrate how the services will be implemented.

C. Examples of staffing needed to implement the services may include, but are not limited to:

a. Administrative personnel

b. Child and Adolescent Psychiatrists

c. Adult Psychiatrist

d. Geriatric Psychiatrists

e. Addiction Psychiatrists

f. Emergency Psychiatrists

g. Neuropsychiatry Psychiatrists

h. General Psychiatrists

i. Doctors of Medicine

j. Doctors of Osteopathic Medicine

k. Nurse Practitioners

l. Physician Assistants

3.2.4 Reporting Requirements

3.2.4.1 Reporting Schedule and Method

A. Monthly reports due no later than 15 days after the end of the following month.

B. Annual reports due no later than 30 days after the 2025 Fiscal Year (i.e., July 30, 2025).

C. The Applicant will report data to BHA in a standardized format.

D. The Applicant shall report on direct services, provider consultations, and trainings conducted as defined by BHA. Data will be submitted electronically through the Urgent and Acute Care data system.

3.3 Invoicing

3.3.1 General

(a) All invoices for services shall be signed by the Grantee and submitted to the Grant Monitor. All invoices shall include the following information:

● Grantee name;

● Remittance address;

● Federal taxpayer identification number (or if sole proprietorship, the individual’s social security number);

● Invoice period;

● Invoice date;

● Invoice number;

● State assigned Contract number;

● State assigned (Blanket) Purchase Order number(s);

● Goods or services provided; and

● Amount due.

Invoices submitted without the required information cannot be processed for payment until the Contractor provides the required information.

(b) The Department reserves the right to reduce or withhold Grant payment in the event the Grantee does not provide the Department with all required deliverables within the time frame specified in the Grant or in the event that the Grantee otherwise materially breaches the terms and conditions of the Grant until such time as the Grantee brings itself into full compliance with the Grant.

3.3.2 Invoice Submission Schedule

The Grantee shall submit invoices in accordance with the following schedule:

Invoices are due by the 15th of the month following the month in which services were performed.

SECTION 4 – APPLICATION FORMAT

4.1 Two Part Submission

Offerors shall submit Proposals in separate volumes:

▪ Volume I – Project Narrative

▪ Volume II – Budget Justification/Narrative

4.2 Proposals

4.2.1 Applications must be submitted via eMaryland Marketplace Advantage (eMMA). The Procurement Officer will not accept submission by any other means or after the date and exact time stated in the Key Information Summary Sheet. The date and time of submission is determined by the date and time of arrival in eMMA.

4.2.1.1 Two Part Submission:

A. Technical Proposal (See 4.3.)

B. Budget Narrative (See 4.4)

4.2.2 Applications will be shown only to State employees, members of the Evaluation Committee, or other persons deemed by the Department to have a legitimate interest in them.

*All information submitted as part of this proposal is subject to release under the Public Information Act (PIA). If you would like the Maryland Department of Health (MDH) to consider redactions in the event that your proposal is subject to a PIA request, submit a proposed PIA copy including justifications for each redaction and under what statute that justification is qualified for redaction.

4.3 Volume I – Project Narrative

Note: No pricing information is to be included in the Project Narrative (Volume 1). Pricing information is to be included only in the Budget Justification/Narrative (Volume II).

4.3.1 The Technical Proposal shall include the following documents and information in the order specified as follows:

4.3.1.1 Transmittal Letter:

● Applicant;

● Solicitation Title and Solicitation Number that the Proposal is in response to;

● Signature, typed name, and title of an individual authorized to commit the Applicant to its Proposal;

● Federal Employer Identification Number (FEIN) of the Applicant, or if a single individual, that individual’s Social Security Number (SSN);

● Applicant’s eMMA number;

● Applicant’s MBE certification number (if applicable);

● Applicant’s SBR number (if applicable) – please contact eMMA at 410-767-1492 if you don’t know your number.

4.3.1.2 Mandatory Requirements Documentation

a) The Applicant shall provide with its Application documentation of their work efforts in the form of annual reports, pertinent contracts, or other such documentation to substantiate the details of their experience and track record.

b) The Applicant shall provide with its Application licenses and/or certificates issued by the Maryland Board of Physicians and/or Maryland Board of Nursing of evidencing the Applicant’s certification in the aforementioned fields. Along with licenses and/or certificates, the Applicant shall provide resumes/CVs or other relevant documentation as proof of ability to practice in the State of Maryland.

4.3.1.3 Applicant Technical Response to RFA Requirements and Proposed Work Plan:

a. The Applicant shall address each Scope of Work requirement (Section 3.2) in its Project Narrative and describe how its proposed services, including the services of any proposed subcontractor(s), will meet or exceed the requirement(s). If the State is seeking Applicant agreement to any requirement(s), the Applicant shall state its agreement or disagreement. Any paragraph in the Project Narrative that responds to a Scope of Work (Section 3.2) requirement shall include an explanation of how the work will be done. Any exception to a requirement, term, or condition may result in having the Application classified as not reasonably susceptible of being selected for award or the Applicant deemed non-responsive. Please include a work plan and timeline for the activities.

4.4 Volume II – Budget Narrative

4.4.1 Under separate sealed cover from the Project Narrative and clearly identified in the format identified in Section

4.2 “Proposals,” the Applicant shall submit an original unbound copy of the Budget Narrative. The Budget Narrative shall contain all price information in the format specified in Exhibit B. The Applicant shall complete the Budget Narrative Form only as provided in the Budget Narrative Form.

4.4.2 The Applicant shall attach to the Budget Form a Budget Narrative document that details the total cost of the proposed activities. The budget categories may include: Personnel (salary and fringe), Consultants; Travel;

Contractual; Supplies; Operating Costs; and Other project-related costs.

SECTION 5 – EVALUATION COMMITTEE, EVALUATION CRITERIA, AND

SELECTION PROCEDURE

5.1 Evaluation Committee

Evaluation of Applications will be performed by a committee established for that purpose and based on the evaluation criteria set forth below. The Evaluation Committee will review Applications, participate in Applicant oral presentations and discussions, and provide input to the Procurement Officer. The Department reserves the right to utilize the services of individuals outside of the established Evaluation Committee for advice and assistance, as deemed appropriate.

5.2 Project Narrative Evaluation Criteria

The criteria to be used to evaluate each Project Narrative are listed below in descending order of importance.

ORGANIZATIONAL CAPACITY, EXPERIENCE AND EXPERTISE (50%)

Based upon the respondent’s overall demonstrated capacity, expertise, and experience with similar projects to the scope of work outlined in this RFA. This includes the organization’s and individual team members’ experience and expertise in providing telepsychiatry services to individuals and telehealth psychiatric consultation and training to providers. Applicants must demonstrate meeting the mandatory requirements described in Section 2.1, as well as the Scope of Work Requirements outlined in Section 3.2, providing documentation to support meeting these requirements.

METHOD OF APPROACH/WORK PLAN (40%)

Referring to the soundness of the applicant’s planned approach to the project, including the ability to address current and future challenges, planned approach to working in partnership with the Behavioral Health Administration and stakeholders, evidence of achieving organizational support, and proposed staffing approach. Respondent’s technical proposals should contain a response to each component of the Scope of Work that demonstrates their capability to sufficiently meet the requirements. A work plan should be consistent with the description provided in the narrative including timeframes to deliver telepsych services in alignment with the Scope of Work.

ORGANIZATIONAL COMMITMENT TO DIVERSITY, EQUITY AND INCLUSION (10%)

Based upon the respondent’s understanding and planned approach to address the identification of diversity, equity, and inclusion issues in program design, execution, and administration.

5.3 Budget Narrative Evaluation Criteria

All Qualified Applicants will be ranked from the lowest (most advantageous) to the highest (least advantageous) based on the rating of the Project Narratives. The Budget Narrative (including the Budget Form and Budget Narrative) will be evaluated based on reasonable cost given the time and effort described in the Project Narrative. The budget line items must be within the stated guidelines set forth in this RFA and as submitted on Exhibit C – Budget Narrative.

5.4 Information Technology and Information Security Narrative Evaluation

5.4.1 General

1.Provide a narrative that illustrates your understanding of the State’s technology requirements specific to this solicitation.

2.Provide a detailed description of your proposed solution for meeting the technology requirements for this solicitation including features and functionality and describe your experience implementing this type of solution regionally, statewide, or nationally.

5.4.2 Basic Specifications

1. If the proposed technology solution will be hosted by the State, please describe the overall environment requirements for the solution.

2. Describe the overall technical architecture (software, hardware, and network) of the proposed solution including a clear indication of what will be required by each facility making use of this solution.

3. Describe the benefits of the technical architecture (i.e. scalability, adaptability, interoperability, etc.).

4. Describe any additional software that will be required on end-point devices and the access authorization level required to install it.

5. Describe any add-on or third-party Software required.

6. Is your product dependent on an existing solution not included in this proposal?

7. What programming languages are used for development, configuration, and customization of the proposed Solution? When was the core software written?

8. What components of the software, such as middleware, are proprietary?

9. Is the proposed application considered Open Source Software?

10. Describe any Open Source Software used by the proposed Solution.

11. Manpower Requirements: Who will deploy, operate and maintain the technology solution? Will additional full-time employees (FTEs) be required? If so, please provide an indication of the roles (including required knowledge, skills, and abilities) and for each role, the number of recommended FTEs.

12. Upgrades and Patches: Describe the strategy regarding upgrades and patches for all technology components.

Include a typical release schedule, recommended processes, estimated outage and plans for next version/major software upgrades.

13. Provide narrative about your ability to comply with the following:

· The State of Maryland Information Technology Security Policy: https://doit.maryland.gov/policies/Pages/20-07- IT-Security-Policy.aspx

· The State of Maryland Information Technology Non-Visual Standards at:

http://doit.maryland.gov/policies/Pages/ContractPolicies.aspx https://doit.maryland.gov/policies/Pages/20-07-IT-Security-Policy.aspx https://doit.maryland.gov/policies/Pages/20-07-IT-Security-Policy.aspx https://doit.maryland.gov/policies/Pages/20-07-IT-Security-Policy.aspx http://doit.maryland.gov/policies/Pages/ContractPolicies.aspx http://doit.maryland.gov/policies/Pages/ContractPolicies.aspx http://doit.maryland.gov/policies/Pages/ContractPolicies.aspx

5.4.3 Integration

1. Describe the ability of the software components of the technology solution to integrate with Active Directory.

2. Describe the available mechanisms that exist for technology solution integration with Electronic Health Record systems.

3. What logging capabilities does the technology solution have? If this is a hosted solution, will the ability to integrate logging and monitoring tools exist?

4. Does the software component of the technology solution have an application programming interface (API) that enables integration with other applications. If so, is the API .Net based? Web Services-based? Other?

5. Will the State have access to source code? If so, will the license model permit the State to make modifications to the source code? Will the State’s modifications be protected in future upgrades?

6. Is there willingness to place source code in escrow with an escrow agent so that if you are no longer in business or in the scenario that there is discontinued support, the source code will be available to the State?

5.4.4 Accessibility

Provide credible evidence of your capability or ability to produce accessible products and services. Such evidence may include, but is not limited to, internal accessibility policy documents, contractual warranties for accessibility, accessibility testing documents, and examples of prior work results.

5.4.5 Information Security- General Security

1. Does your organization possess a Health Information Trust Alliance (HITRUST) certification. If yes, provide supporting documentation.

2. Does your organization possess Security Operation Center (SOC) certification? If yes:

a. What type?

b. Are you willing to share your most recent SOC reports?

3. If vendor hosted, will the solution be hosted on a FedRamp certified platform?

4. Provide the name of the Chief Information Security Officer (CISO), Chief Information Officer (CIO) or equivalent positions along with a short description of his or her qualifications.

5. Are background checks and screening conducted on employees and subcontractors? If yes, what is the frequency?

6. Is a specific security framework or collection of industry standards applied to harden information systems that will interact with the services proposed, including systems that store, transmit, process, or serve confidential (PHI, PII, and other similarly sensitive data) to users? If so, describe these standards and their source.

7. Do you have documented policies and procedures that cover the following:

a. Information Security

b. Security Incident Response and supporting procedures

c. Change Control and supporting procedures

d. Acceptable/Responsible Use

e. Privacy

f. Risk Management

g. Patch and Vulnerability Management

h. Cloud Security

i. Software Development Security

8. How often are security and privacy policies updated?

9. Is there a formal Change Management process for updating policies?

10. If application(s), whether mobile or otherwise, are provided as part of this Proposal:

a. Are industry standards or a specific method/model followed for software development? If yes, what standard/model?

b. Are multiple, staged software development environments used for development, testing and production? If yes, describe how the environments are isolated from each other and what access controls are in place to minimize the risk of code corruption or unauthorized exposure.

11. List an example of an administrative safeguard or best practice employed to prevent unauthorized access to system data.

12. Where will the system data be stored (answer all that apply):

o In a physical (on-premise) data center, owned and/or managed by the Contractor.

o In third-party storage locations not managed by the Contractor.

o In Public or Private Cloud locations.

o In a Cloud location outside of the United States.

o Other (please provide more details if this is the case)

13. If system data will be stored in a physical data center, what physical controls are in place? What level of redundancy tiering is the data center rated at?

14. How will this system’s data be segregated from the data of other customers to prevent accidental or unauthorized access? (applies to all locations of data storage).

5.4.6 Information Security- Cloud Security (answer applicable questions)

1. Are any services provided hosted in a Public or Private Cloud? If yes, indicate which services and what type of hosting.

2. What industry standards, best practices or Cloud Security frameworks are followed to minimize risk to customer data, including accidental or deliberate exposure?

3. Provide an example of how your virtual systems are segregated and protected from risks.

5.4.7 Information Security- Access and Identity Management

1. Please describe the multi-factor authentication implementation features associated with this product including:

a. Who is required to use it.

b. Alignment with NIST SP 800-63 standards

2. Describe the Identity and Access Management (IAM) components of the Contractor’s services including how the platform ensures accurate and consistent secure identity management of all uniquely identified individuals?

3. Summarize how IAM components are kept in sync and how they integrate with each other.

4. Summarize the process for user account provisioning and de-provisioning, including super user accounts.

5. How do you detect an account compromise of system-issued credentials? Provide two examples.

6. If a user’s password is confirmed to be compromised, what is the process to reset/disable or otherwise protect system data from exposure or malicious attacks?

5.4.8 Technical Security

1. Explain the general encryption method and algorithm (e.g. AES 256) in use for:

a. Data at rest

b. Data in motion

c. Data in Session state (in process)

d. Application data exchange and APIs (whether cloud or on premise)

e. Application and platform external connections

f. Database

g. Data backups

h. Mobile applications (if applicable)

2. Explain how cryptographic keys are managed, what protection mechanisms are in place, and who has access to them.

3. Summarize the process for security patch management, including roles and responsibilities, frequency, testing plan and system maintenance.

4. Are periodic vulnerability scans performed? If yes:

a. How often are scans conducted?

b. What is the process to escalate and/or prioritize and remediate identified vulnerabilities?

c. Do scans include databases?

d. Are applications scanned to detect specific code related vulnerabilities prior to moving to Production?

5.4.9 Disaster Recovery and Business Continuity

1. Do you have a Disaster Recovery Plan (DRP). If so:

a. Is it supported by policies and procedures?

b. Is it updated periodically, If yes, how frequently?

c. Is it tested periodically? If yes, how frequently and what type of tests are performed?

d. Do all staff with a role or responsibility know about the DRP and how to access it in case of a declared disaster?

e. If in place, provide an outline of the DRP.

f. If no DRP exists, describe the controls and methodology used to ensure the restoration and availability of system data.

2. Is a Business Continuity Plan (BCP) in place that ensures minimal disruption of services provided? If yes, what is the maximum amount of time that services may be unavailable?

3. Does a Data Backup and Recovery plan exist? If yes, summarize or provide an outline of the plan. If not, describe what alternative methods will be used to ensure the restoration and availability of system data.

4. Will critical system data be backed up to an offline (completely isolated) location that can be restored in the case of a successful Ransomware attack?

5. Explain how system data is reliably destroyed upon request or under the terms of the contractual agreement?

What evidence will be provided after data has been successfully destroyed?

5.4.10 Security Logging, Monitoring and Incident Response

1. Do the proposed services allow administrative or “super user” level changes to system data that isn’t tracked through audit logs?

2. (For vendor hosted solutions), does the vendor utilize a formal Security Operations Center (SOC), either internally staffed or contracted to a third party? If yes, where is it (or if multiple, describe) geographically located?

Does it operate on a 24x7x365 schedule?

3. Are adequate logs generated and stored to validate security controls function as designed, including MFA requirements?

4. What is the average log retention period?

5. Are all systems that support or connect to services and systems provided in this proposal configured to generate logs to a central storage location? If not, how is visibility into anomalous activity ensured?

6. Summarize how multiple security logs and event data are correlated, analyzed and acted upon.

7. Provide an example of technology controls (e.g. DLP, firewall, IDS/IPS, Endpoint Detection, etc.) coupled with a process that is used to monitor the confidentiality, integrity and availability of the service proposed.

8. Provide two examples of a procedure in place to ensure timely mitigation of detected vulnerabilities and security incidents.

9. Provide the Table of Contents or an overview of the Security Incident Response Plan (IRP) and one example for each category: protection, detection, identification, and recovery.

10. Is there a component of the IRP that addresses how the vendor will work with system users and any subcontractors when a security or privacy incident involving system data is detected?

11. Summarize the procedures in place to isolate or disable suspicious or compromised systems that interact with the Service proposed.

12. When a significant incident that requires digital forensic investigation is declared, could system data be retained for forensic purposes? If so, how will this affect our business processes?

13. Describe two examples of a method or process used to detect and prevent actions taken by an unauthorized entity attempting to access data (e.g., auto-generated audit reports or alerts).

14. Are there automated alerts or reports that monitor unauthorized access to confidential data? If yes, is the Contractor willing to provide these to the State of Maryland?

15. Are controls in place to detect Ransomware or precursor events to a Ransomware attack? If yes, describe these.

16. If Ransomware is discovered, what is the first step to mitigation?

17. If the State of Maryland discovers that a serious vulnerability exists in your platform, describe the process for reporting how and when the risk will be remediated.

5.5 Selection Procedures

5.5.1 General

The Grant will be awarded in accordance with the Standard Grant Agreement method outlined in the Announcement.

The State may determine an Applicant to be non-responsive and/or an Applicant’s Application to be not reasonably susceptible of being selected for award at any time after the initial closing date for receipt of Applications and prior to Grant award. If the State finds an Applicant to be not responsive and/or an Applicant’s Project Narrative to be not reasonably susceptible of being selected for award, that Applicant’s Budget Narrative will be returned if the Budget Narrative is unopened at the time of the determination.

5.5.2 Award Determination

Upon completion of the Project Narrative and Budget Narrative evaluations and rankings, each Applicant will receive an overall ranking. The Procurement Officer will recommend award of the Grant to the responsible Applicant that submitted the Application determined to be the most advantageous to the State. In making this most advantageous Application determination, technical factors and financial factors will be weighted equally.

RFA ATTACHMENTS

EXHIBIT B – Budget Form This must be completed and submitted with the Project Narrative separately from Technical Proposal via eMaryland Marketplace Advantage (eMMA). Login: eMaryland Marketplace Advantage (eMMA)

EXHIBIT C—Budget Narrative This must be completed and submitted with the Project Narrative, along with the Budget Narrative Form, via eMaryland Marketplace Advantage (eMMA). Login: eMaryland Marketplace Advantage (eMMA)

REFERENCE DOCUMENT A - Standard Grant Agreement “Sample” (Pages 18-42) This is the sample grant agreement used by the Department. It is provided with the RFA for informational purposes and is not required to be submitted at Application submission time. Upon notification of recommendation for award, a completed standard grant agreement will be sent to the recommended awardee for signature. The recommended awardee must return to the Procurement Officer a signed agreement signed by the recommended awardee organization within 5 business days to move forward to an executed contract agreement.

ATTACHMENT B – RFA Document Checklist Use this checklist to ensure that the required documents for the Project Narrative and Budget Narrative are completed.

ATTACHMENT C – Work Plan Template (sample provided by the program) https://emma.maryland.gov/page.aspx/en/usr/login?ReturnUrl=%2fpage.aspx%2fen%2fbuy%2fhomepage https://emma.maryland.gov/page.aspx/en/usr/login?ReturnUrl=%2fpage.aspx%2fen%2fbuy%2fhomepage

EXHIBIT B – BUDGET FORM

FINANCIAL PROPOSAL FORM

The Budget Narrative shall contain all price information in the format specified on these pages. Complete the Budget Form only as provided in the Budget Form format. Do not amend, alter or leave blank any items on the Budget Form.

Failure to adhere to any of these instructions may result in the Budget Narrative being determined non-responsive and rejected by the Department.

Submitted By:

Authorized Signature: _______________________________________________ Date: ________________________

Printed Name and Title: ___________________________________________________________________________ Company Name : ________________________________________________________________________________ Company Address: _______________________________________________________________________________ Location(s) from which services will be performed (City/State): ___________________________________________

FEIN: _________________________________________

eMMA #: ________________________________________ Telephone: (_______) _______-- ____________________ Fax: (_______) _______--____________________ E-mail: _________________________________________

Budget Summary (SAMPLE)

Line Item Qty Unit Cost Total Cost Salary Fringe Contractual Travel Operating Costs Supplies Other Other Other Other

TOTAL

EXHIBIT C – BUDGET NARRATIVE

BUDGET NARRATIVE TEMPLATE

Sample Line Item Justification

Personnel (Psychiatric Consultant): $156,000

Justification: The Psychiatrist will be responsible for providing direct services to individuals presenting in psychiatric crisis via videoconferencing, prescribing medications as needed, participating in clinical team meetings, recording provider to patient treatment recommendations, developing and providing training to BHCSC and/or MCT staff on topical areas as approved by BHA.

$150/hr x 1,040 hours = $156,000

Reference Document A - Standard Grant Agreement “Sample Only ”

ORGANIZATIONS RECEIVING APPROPRIATIONS FROM THE STATE

STANDARD GRANT AGREEMENT

This Agreement, which is executed in compliance with Section 7-402 of the State Finance and Procurement Article of the Annotated Code of Maryland, is made this <enter day> day of <month, year> , between the State of Maryland (the “State”), acting through the Maryland Department of Health, (the “Department”), located at <enter MDH Address> and the <grantee name> (the “Grantee” ), located at <grantee address> in <county / city> County, <state, zip> , a Maryland Limited Liability Company / Corporation.

1. Effective on the date of execution of this Agreement, the State is…