RFI - Digital Badge and IDs BD-26-2018-CNB-CNB-125475 - Final.pdf

Request for Information (“RFI”)

Digital Agent Badges and Medical Patient

Identification

COMMBUYS Bid#: BD-26-2018-CNB-CNB-125475

February 17, 2026

Contents

1. Background

2. Purpose of Request of Information (RFI)

3. Information Solicited

Patient and Caregivers IDs Agent IDs Commission Staff Official IDs Response Details

4. Costs Table

5. General Instructions

A. Response Submission B. Respondent Questions C. Response Timeline D. Response Content E. Response Format F. Response Cover Letter and Information Requested G. Cannabis Control Commission RFI Contact Information A. Additional Information B. Review Rights C. Use of RFI Information D. Electronic Distribution E. RFI Amendments F. Costs G. Review Rights H. Public Record

1. Background

Established in 2017 by Chapter 55 of the Acts of 2017, An Act to Ensure Safe Access to Marijuana, the Cannabis Control Commission is responsible for implementing and administering

Massachusetts’ adult-use and medical cannabis laws and related statutes. The Commission’s mission is to honor the will of Massachusetts voters by ensuring safe, equitable, and effective access to cannabis, regulating cultivation, manufacturing, testing, distribution, and sales while prioritizing public health, equity, product safety, and community safeguards. The agency is tasked with implementing and administering laws that govern the cultivation, manufacture, testing, distribution, and sale of cannabis in Massachusetts. These responsibilities include developing and enforcing regulations that prioritize public health, promote equity in the marketplace, ensure product safety and integrity, and safeguard communities.

The Massachusetts Cannabis Control Commission (the Commission) currently has over 80,000 certified patient and caregivers and over 25,000 medical and adult use agents that each currently receive a printed identification badge printed either annually or every 3 years for agents.

Cards are produced for a variety of constituents including:

• Patients

• Caregivers

• Agents

• Commission Staff Official IDs

2. Purpose of Request of Information (RFI)

The Commission seeks information from qualified, experienced vendors that could provide digital identification cards (dIDs) for various use cases supporting the Commission mission and regulations.

The Commission is seeking opportunities to reduce costs related to card production and mailing, improve operational efficiency, as well as reduce environmental impact of the plastic physical cards.

The Commission is seeking a solution that has a low impact on constituents needing Commission issued IDs offering digital option primarily but may continue offering printed version for some use cases. The solution should be easy for the end-users to use and access and provide secure access to the ID.

3. Information Solicited

The Commission is seeking information with respect to developing, implementing and managing a digital ID program for Agents, Patient & Caregivers and Commission staff.

Patient and Caregivers IDs are used by a patient or caregiver at a Marijuana Treatment Center

(MTC) to confirm their standing as a certified and registered patient. Patients and Caregivers may also use their ID as requested at law enforcement request to confirm their standing as a certified and registered patient when in possession of Medical Marijuana.

Agent IDs are used by agents (employees) of Medical, Adult Use and Independent Testing Labs.

Commission Staff Official IDs are used by members of the Investigation and Enforcement Team, Commissioners and other staff members so authorized to present to Marijuana Establishments when coming onsite for visits and inspections.

The dID solution will need to integrate with the Commission’s platforms including Medical Patient

Portal, Licensing Portal and Seed to Sale System of Record.

Respondents are requested to review the specifications and functional requirements mentioned in this section to guide their responses to this RFI. While this RFI outlines important requirements to address, it is not intended to be a complete list of requirements. The Commission encourages the respondents to share features of their services that will support the Commission’s needs. If applicable, please list if and how a respondent might collaborate with another entity to address any or all functional areas as outlined.

Complete information regarding the Commission’s regulations can be found on the Commission website https://masscannabiscontrol.com/know-the-laws/

Response Details

More specifically, respondents should provide:

• Solution description and capabilities;

• Describe how users access and manage their dID;

• Describe support of third party Identity management applications such as Apple, Google or Samsung Wallet;

• Describe capabilities for integration with Commission [platforms including Medical

Patient Portal, Licensing System and Seed-to-Sale platforms;

• Provide information on data and reporting capabilities including API’s and database schemas;

• Describe capabilities to support dID and physical cards,

• Additional third-party and external integrations and data sharing capabilities including other state agencies including Executive Office of Public Safety and Security (EOPSS) and

Registry of Motor Vehicles (RMV);

• Description of support for Commission staff and external constituencies (applicants and licensees) including after-hours support options;

• Training capabilities for Commission internal users, administrators as well as external end user training and documentation provided for initial launch and ongoing;

• Description of the Disaster Recovery and Business Continuity Plans and Service Level

Agreements (SLAs) for restoration;

• What security certifications (NIST v1.1, SOC2, HITRUST, FEDRAMP) does the vendor possess and ability to comply with Massachusetts General Laws Chapters 93H and 66A and the regulations promulgated in 201 CMR 17.00 and 950 CMR 33.00;

https://masscannabiscontrol.com/know-the-laws/

• Compliance with the Web Content Accessibility Guidelines (WCAG 2.2 Level AA) for external and internal facing access;

• Estimated planning and implementation timeline; and

• Methodology used for implementation of the solution.

In addition any forward-looking technology solutions including use of blockchain technology and biometric and other novel methods, techniques or strategies for managing and providing constituents’ identification to meet the Commissions goals and requirements for a safe and equitable cannabis industry.

4. Costs Table

Please provide initial implementation and ongoing estimated costs and descriptions, including bundled discounts (where applicable).

Cost Item Estimated Cost Frequency of Cost –

Annual, Quarterly, Monthly, or One-Time

Implementation (Build-out)

Ongoing Support and Maintenance

Platform hosting (if applicable)

API, Data Exports and Integrations

Training (Initial and On-going)

Platform customization costs (initial and ongoing)

Mobile App Development for Apple and Google stores (if applicable)

Other costs. Add lines to itemize the service and cost.

Total:

5. General Instructions

This RFI is issued solely for the purpose of obtaining information for market research purposes.

Nothing in this RFI and no action taken during the review process shall be interpreted as a commitment on the part of the Commission to any particular Respondent or to seek a procurement.

A. Response Submission. All responses to this RFI are due by 5 PM on April 2, 2026.

Respondents should submit one (1) electronic copy of the response via COMMBUYS. All responses must include on the first page the official name of the firm or entity submitting the response. Please consecutively number all pages of the response. Responses should be submitted in the format specified in Section 4.E of this RFI.

B. Respondent Questions. Potential respondents who have questions may submit questions via COMMBUYS by 5 PM on March 6, 2026 Responses to inquiries and clarification questions will be provided at the discretion of the Commission electronically to all interested parties.

C. Response Timeline. Please see the table below for this RFI timeline summary:

Action Date Time (EST)

RFI Release 2/17/2026 5:00pm

Deadline for Submission of Questions through

COMMBUYS “Q&A”

3/6/2026 5:00pm

Commission’s Responses to Q&A Posted 3/18/2026 5:00pm

RFI Submission Deadline for Respondents 4/2/2026 5:00pm

D. Response Content. Responses should include:

1. the content requested in Section 2 to provide information on how the services meet the Commission’s needs;

2. a completed estimated Costs Table in Section 3; and

3. a cover letter with the information as set forth in Section 4.F.

E. Response Format. The Commission requests that all responses are typewritten. The font must be Times New Roman or similar, size 12 point or larger. Respondents are requested to limit their responses to 10-15 pages for this RFI.

F. Response Cover Letter and Information Requested. Respondents must provide a cover letter that is signed by an authorized representative of the respondent and that includes the following organizational information about the respondent:

• Company Name (list parent company and relationship to parent company as well);

• Company Address;

• Company Website;

• Years of experience in Software as a Service (SaaS), Platform as a Service (Paas) and/or and Software Development as appropriate.

• Additional company profile information, as Respondent deems relevant; and

• Contact name and information (e-mail address required).

G. Cannabis Control Commission RFI Contact Information.

Michelle Ngo, Project Manager, Procurement michelle.ngo@cccmass.com

All RFI-related questions are to be submitted through the Q&A function within

COMMBUYS to ensure responses are shared with all interested parties. Vendors requiring technical assistance with COMMBUYS should contact OSD Help Desk at

OSDHelpDesk@mass.gov or by phone at 1-888-MA-STATE (627-8283).

mailto:michelle.ngo@cccmass.com mailto:OSDHelpDesk@mass.gov

6. General RFI Information

A. Additional Information. The Commission retains the right to request additional information from respondents that have met the requirements of this RFI. The Commission may, at its sole discretion, elect to request formal presentations, further explanation, or demonstrations from certain respondent.

B. Review Rights. Responses to this RFI may be reviewed and evaluated by any person(s) at the discretion of the Commission, including independent consultants retained by the

Commission now or in the future.

C. Use of RFI Information. Please note that this RFI is issued solely for the purpose of obtaining information and conducting market research. The RFI does not obligate the

Commission to issue an RFR nor to include any of the RFI provisions or responses in any

RFR. No part of the response to this RFI will be returned. Receipt of RFI responses will not be acknowledged.

Information received in response to this RFI shall serve solely to assist the Commonwealth in the development of policy. No information received in response to this RFI is binding on the Commonwealth or any of its agencies. Responding to this RFI is voluntary and will not affect consideration of any proposal submitted in response to any subsequent procurement or solicitation.

Responses to this RFI become the property of the Commission and are public records under

M.G.L. c. 4, § 7(26). Information provided in response to this RFI and identified by the respondent as trade secrets or commercial or financial information, or which the

Commission has determined is such, shall be kept confidential to the extent permitted by law and shall be considered by the Commission as exempt from disclosure as a public record (according to G.L. c. 4, § 7(26)(g)). This exemption may not apply to information submitted in response to any subsequent procurement solicitations. All information is otherwise subject to Public Records Law regardless of confidentiality notices set forth on such writings to the contrary unless it qualifies under any of the exemptions listed in the above code section.

D. Electronic Distribution. This RFI has been distributed electronically using COMMBUYS.

No individual may alter (manually or electronically) the RFI or its components, except the

Commission, as described in section 5.E.

E. RFI Amendments. Interested parties are solely responsible for updating their submissions in response to any amendments, addenda, or modifications that are subsequently made to this RFI. The Commission and its staff accept no liability and will provide no accommodation to interested parties who fail to submit updated submissions in response to amendments to this RFI.

F. Costs. All costs incurred in responding to this RFI, or in support of activities associated with this RFI, shall be the sole responsibility of respondent. The Commission shall not be held responsible for any costs incurred by respondents in preparing responses to this RFI.

G. Review Rights. Responses to this RFI may be reviewed and evaluated by any person(s) at the discretion of PMT or Commission, including independent consultants retained by

Commission now or in the future.

H. Public Record. All responses to this RFI will be public record under the Commonwealth’s

Public Records Law, Mass. Gen. L. c. 66 s. 10, regardless of confidentiality notices set forth on such writings to the contrary.