RFI_DSH_Pharmacy_Modernization_25-IT0001_8.12.25.pdf

Date: August 6, 2025

To: INTERESTED PARTICIPANTS

Subject: Request for Information (RFI) for Pharmacy Modernization

(#RFI DSH-25-IT0001) (Event ID#36411)

A. PURPOSE

The purpose of this Request for Information (RFI) is to solicit information and suggestions from experienced sources, Pharmacy equipment and inventory management vendors, medical and pharmacy billing vendors, system integrators, providers of similar enterprise software/systems, suppliers, and other qualified service providers as part of a market survey effort being conducted by the Department of State Hospitals (DSH). The DSH cannot guarantee that any future business will result from the information provided.

A broad scope of work that entails the implementation of Pharmacy equipment and inventory management systems, integration with both new and existing sub systems and internal and external data providers may be considered. The information received from this RFI may be utilized in a scope of work for future use.

This request is issued solely for informational and planning purposes and does not constitute a Competitive Solicitation.

DISCLAIMER – PLEASE READ BEFORE RESPONDING TO THIS RFI

1. DSH will not reimburse Respondents for any costs associated with responding to this

RFI.

2. DSH has no obligation to buy or issue a solicitation to any Respondent as a result of this RFI.

3. Information provided in response to this RFI will not be considered when evaluating bidders responding to any future procurement.

4. Participants are admonished that the responses to this RFI are subject to the Public Records Act.

5. Information provided in response to this RFI related to any costing should be estimated costs, only to be used by DSH for informational and planning purposes and understood not to be represented as a bid from the Respondent.

6. DSH, at its sole discretion, may invite Respondents to this RFI to make a presentation or engage in a confidential conversation concerning their response.

7. DSH may, at its sole discretion, choose to not consider or evaluate any response, or any portion of a response, received as a result of this RFI.

Department of State Hospitals

RFI DSH- 25-IT0001

Pharmacy Modernization Page 2

B. BACKGROUND

The Department of State Hospitals (DSH) manages the California state hospital system, which provides mental health services to patients admitted into five state hospitals. The department strives to provide effective treatment in a safe environment and in a fiscally responsible manner. DSH oversees five state hospitals located around California in Atascadero, Coalinga, Metro – Los Angeles, Napa, and Patton. DSH oversees five state hospitals and employs nearly 11,000 staff. Each state hospital provides inpatient treatment services for Californians with serious mental illnesses. While each patient shares the same characteristic of obtaining a mental illness in one form or another, the reasons for their stay at a hospital vary.

There are two types of commitments to our state hospitals: forensic and civil. Forensic commitments are persons appointed by the court for having violated or allegedly violated the Penal or Civil Code; this includes commitments known as 1370, or persons who are incompetent to stand trial. Civil commitments are persons who are also court appointed, however, the court determines the person suffering from a mental illness is either a danger to themselves or others, or simply cannot care for themselves anymore.

DSH seeks an enterprise-level solution for pharmacy operations that includes an Inventory Management system capable of integration with medication repackaging and dispensing equipment, secure management of controlled medications, and generating accurate patient billing information. The system should facilitate standardized methodologies which will help the department implement industry best practices providing the ability for improved patient outcomes. The improvements will not only be seen at the patient level but will also be evident in improved efficiencies of staff and operational accountability.

Description of current environment

DSH Pharmacy Operations are currently a combination of manual practices with very little automation. There are currently no DSH hospitals with a complete end-to-end automated inventory management system that is integrated with the repackaging equipment. Current inventory management is a predominately a manual process at all the state hospitals. Medication is manually tracked upon receipt in the Pharmacy and when it is removed from stock to fulfill doctor orders for patients. Pharmacy staff perform daily reviews of expiration dates to ensure they are not dispensed to patients once they have expired. At this point the expired medications are also manually removed from the inventory lists. The pharmacies conduct a complete medication inventory annually, quarterly for controlled substances or as needed when circumstances warrant an off-cycle inventory.

Dispensing medications to patients in three of the five hospitals is primarily a manual process. Nursing staff pick up medications from the pharmacy and physically sign for it on paper tracking logs. Staff can erroneously select the wrong medication because drawers contain multiple medications. Controlled medications are managed by a work around using locked cabinets however, stocking them and signing for them remains a manual process today.

The billing data currently generated at the pharmacies often contains erroneous data that results in lost revenue for DSH. The new pharmacy operations system must be capable of creating accurate claims data which includes the ability to keep updated data such as National Drug Codes available to all systems where required.

The purpose of this RFI is to solicit information from Pharmacy operations vendors, System Integrators and companies that provide standalone components of Pharmacy operations or Pharmacy operations as a part of a broader enterprise solution. No purchase orders or contracts will be executed based upon this RFI.

Pharmacy Modernization Page 3

C. SCOPE

This RFI seeks input from the vendor community as the Department of State Hospitals plans its improvements to Pharmacy operations. DSH request the following information:

Estimated one-time cost and ongoing cost associated with the implementation of an Inventory

Management system that is integrated with medication repackaging equipment and Automated

Drug Dispensing Systems. The Automated Drug Dispensing Systems for each hospital unit that is capable of meeting Medicare Part D patient billing data requirements and finally, providing the capability to securely manage controlled medications. These scenarios may range from custom development to Commercial Off the Shelf (COTS) products that may be cloud based, deployed on premise or a hybrid model.

Remote Contractor access shall be facilitated in coordination with DSH Technology Services Division (TSD) Staff via approved by GE Healthcare and DSH TSD remote access solutions- Securelink/Imprivata or VPN. DSH TSD staff shall manage security controls provided within the Securelink/Imprivata or VPN solution so that contractor shall not initiate remote support sessions without advance scheduling to coordinate DSH TSD availability. DSH TSD’s approved scheduled maintenance window is Tuesday evenings from 1830 to Wednesday mornings at 0100 PST. Notification of any normal change that will incur an outage is required to be submitted to DSH TSD no later than the Tuesday prior to the week in which maintenance is to be scheduled. Normal changes include but are not limited to software updates, enhancement releases, maintenance releases, or implementation of new modules. If an emergency change is necessary to resolve a break/fix in the system, this lead time may be waved with approval of DSH TSD Emergency Change Advisory Board.

Proposed cost break-down for the chosen scenarios based on one-time and on-going costs for the following categories:

o Staffing Resources o Hardware (Lease and purchase options to include one-time plus annual, maintenance and refresh) o Software (License, Service, maintenance and refresh) o Telecommunications o Contract Services o Storage (different types if affecting cost) o End user devices (minimum required, suggested based on optimal use)

Proposed Service Level Agreements {SLAs) for the chosen scenarios and maintenance modes

(Uptime, Disaster Recovery, etc.)

Difference in the one time and ongoing costs for the proposed scenario(s) based on suggested

SLA’s

Difference in maintenance costs based on proposed SLA’s

Below is a list of the four sites and the number of medication dispensing units needed

Pharmacy Modernization Page 4

Sites # of Units Needed

DSH-Atascadero 38

DSH-Coalinga 32

DSH-Metro 29

DSH-Napa 49

DSH-Patton 39

Total 187

D. KEY ACTION DATES

Listed below are the Key Action Dates and times within which actions should be taken or completed. If DSH finds it necessary to change any of these dates, an Addendum to this RFI will be posted on the Cal eProcure webpage at caleprocure.ca.gov. Respondents will need to email any questions regarding this RFI to the Procurement Official listed in Section E. If necessary, a question-and-answer set will be provided as an attachment to the RFI advertisement on Cal eProcure.

Key Action Date Time

Release of RFI August 12, 2025 N/A

Last Day to Submit Questions on the RFI

August 25, 2025 4:00 p.m. Pacific Time (PT)

State Responds to Questions

September 1, 2025 4:00 p.m. PT

Last Day to Submit RFI Response

September 8, 2025 4:00 p.m. PT

E. CONTACT OFFICIAL

All correspondence related to this RFI shall be directed to:

Department of State Hospitals Attention: Andrew Bradbury Email: Andrew.Bradbury@dsh.ca.gov Phone: 805-600-4006

The contact person designated above is the contact person for this RFI. Organizations responding to this RFI that require clarification of any matter must contact only this individual. No other representative of the Department of State Hospitals is authorized to communicate with Participants with respect to this

RFI.

F. RFI RESPONSE AND CONTENT FORMAT

If Respondents are interested in participating in this RFI, they shall complete and submit Attachments 1 through 3. Responses should be concise and straightforward. Respondents are to submit one (1) soft copy of their response to the Procurement Official listed in Section E, by email. Microsoft Word 2010 or newer or PDF formats are acceptable. RFI responses must be submitted by the deadline identified in Section D, Key Action Dates.

Pharmacy Modernization Page 5

Please complete the following attachments:

ATTACHMENT 1 – Respondent’s Information Company name and contact information.

ATTACHMENT 2 – Requirements Table For each question respond directly within the attachment. Please include any additional files as an object embedded into Attachment 2.

ATTACHMENT 3 – Estimated Cost Worksheet Estimated list pricing for budgetary purposes.

Company Name and Contact Information

Company Name:

Address:

State:

Zip Code:

Contact:

Phone:

Email:

Alternate Contact:

Phone:

Email:

RFI DSH- 25-IT0002

Pharmacy Modernization Page 6

ATTACHMENT 2

DEPARTMENT OF STATE HOSPITALS

REQUIREMENTS TABLE

Please select one of the following eight (8) Options to complete Column #5 in the Requirements Table below.

1. Currently provided within the Standard Service in a lease option.

2. Currently provided through configuration to Standard Service (lease option) at No Additional

Cost.

3. Currently provided through configuration through Standard Service (lease option with

Additional Costs.

4. Not currently provided but will be added through customization at No Additional Cost.

5. Not currently provided but will be added through customization at Additional Costs.

6. Functionality not included but vendor will seek partner and integrate a third-party solution

(costs included).

7. Functionality not included, DSH will need to find a third-party solution (additional cost incurred for interfaces).

8. Service will not be provided.

Column 1

REQ. #

Column 2

REQUIREMENT

Column 3

MET

Y/N?

Column 4

DESCRIBE HOW THE

SOLUTION MEETS

THIS REQUIREMENT?

(Include specificities of the included solution such as fields, attributes, screenshots, etc.)

Column 5

1 - 8

Pharmacy Operations – Inventory Control

INV.1 The solution must be able to create and maintain unique user account credentials by connecting to DSH active directory services using SAML or Oauth2.

INV.2 The solution must be able to create multiple user groups with unique attributes and assign to individual users.

INV.3 The solution must be easy to use.

INV.4 The solution must be able to add medication inventory from external warehouse systems electronically.

INV.5 The solution must be able to interface with external Automated Drug Dispensing systems.

INV.6 The solution must be compliant with Health Level 7 (HL7) standard.

Commented [A1]: Are these the current requirements, or pulled from the last RFI? Can we please run these by the Pharm Mod PM’s/ Pharmacy SME to make sure they are still valid if they are from the previous RFI?

Commented [A2R1]: done

Pharmacy Modernization Page 7

ATTACHMENT 2

INV.7 The solution must be able to export pharmacy inventory information for evaluation and reporting purposes.

INV.8 The solution must be able to edit medication entries in inventory system.

INV.9 The solution must be able to record/track inventory for controlled and non-controlled drugs

INV.10 The solution must be able to maintain inventory information, e.g., items and quantities, in real time when it leaves the main pharmacy and is transferred to the Automated Drug Dispensing system.

INV.11 The solution must be able to create a threshold amount to trigger an alert for when inventory is low

INV.12 The solution must be able to store and accept updates (electronically and manually) to published National Drug Code

(NDC).

INV.13 The solution must be able to assign correct National Drug Codes to medications including same medication and dosage even from different manufacturers.

INV.14 The solution must be able to record medication expiration dates.

INV.15 The solution must be able to identify expired medication.

INV.16 The solution must be able to set alerts with multiple thresholds for medication expiration, e.g., number of days and weeks, etc.

INV.17 The solution must be able to delete the inventory items.

INV.18 The solution must be able to provide a reporting function, including ad hoc reports, reconciliation (e.g., quantity to billed) and medication inventory reports

INV.19 The solution must be able to generate reports from inventory system via an automatic schedular function.

INV.20 The solution must be able to email automatic scheduled inventory reports

INV.21 The solution must be able to share hospital inventory data between hospitals.

Pharmacy Modernization Page 8

ATTACHMENT 2

INV.22 DSH must retain ownership of all Pharmacy data.

INV.23 The solution must be able to provide all equipment and software in compliance with pharmacy services regulations that govern DSH pharmacy operations including State Board of Pharmacy California Law, US Department of Justice, California Department of Public Health, and Title 22 Requirements

INV.24 The delivery of the solution must include in-person training at all hospital sites.

Pharmacy Operations – Repackaging Equipment

RPK.1 The solution must be able to create and

RPK.2 The solution must be able to create

RPK.3 The solution must work upon installation without the need to replace any major components.

RPK.4 The solution must be able to repackage oral, solid medications in unit-doses.

RPK.5 The solution must be able to allow repackaging of split dose medications

RPK.6 The solution must be able to create bar-coded labels.

RPK.7 The solution must support FDA guidelines for repackaging paper regarding water, vapor and light transmission (CFR Title 21, Part 210 and 211).

RPK.8 The solution must be able to have canisters capable to protect product stability while product is in storage.

RPK.9 The solution must be able to provide half tablet canisters to automate splitting the pills and tablets

RPK.10 The solution must be able to allow users to update changes entered in the repackaging system real time

Pharmacy Modernization Page 9

ATTACHMENT 2

RPK.11 The solution must be able to verify medication by analyzing the quantity, shape and color of every pill to ensure it matched expected prescription for a given patient.

RPK.12 The solution must support equipment and software compliance with pharmacy services regulations that govern DSH pharmacy operations including State Board of Pharmacy California Law, US Department of Justice, California Department of Public Health, and Title 22 Requirements

RPK.13 The solution must be able to support United States Pharmacopeia (USP) Class A (one year), B (six months), and D (30 days) repackaging materials

Pharmacy Operations – Automated Drug Dispensing System (ADDS)

ADDS.1 The solution must be able to create and

ADDS.2 The solution must be able to create

ADDS.3 The solution must work upon installation without the need to replace any major components.

ADDS.4 The solution must be able to access dispensing systems using biometrics in addition to password entry

ADDS.5 The solution must be able to hash user password, and the method used for hashing passwords, including algorithm, generation, storage and number of iterations

ADDS.6 The solution must be able to modify the medication inventory stored in the ADDS by authorized users.

ADDS.7 The solution must provide drawers with single entry compartments for all medications, e.g., one medication per compartment in a drawer.

Pharmacy Modernization Page 10

ATTACHMENT 2

ADDS.8 The solution must be able to secure the drawer compartments for single access per medication.

ADDS.9 The solution must be able to configure threshold amounts to notify when drugs are below those threshold amounts.

ADDS.10 The solution must be able to send a notification to Pharmacy when drugs are at the threshold amount.

ADDS.11 The solution must be able to interface with an Electronic Medication Administration Record (eMAR) in a standardized format.

ADDS.12 The solution must be able to capture a timestamp (date:hh:mm:ss) that medication is administered to a patient.

ADDS.13 The solution must be able to track medications that have not been administered (refused, wasted, patient not available) to a patient on schedule.

ADDS.14 The solution must be able to provide an audit trail for all controlled substances added to the Automated Dispensing Device (ADDs)

ADDS.15 The solution must be able to compare the actual, initial medication (controlled substances) inventory added to the ADD with a point in time, manual actual physical inventory count in the ADDs

ADDS.16 The solution must be able to record medication dispensed through a barcode scanner

ADDS.17 The solution must be able to create configurable thresh holds to track and identify expired medication and send an alert.

ADDS.18 The solution must be able to dispense "as-needed" pro re nata (PRN) doses

ADDS.19 The solution must be able to dispense medication for at least 30 days in case of a power outage

ADDS.20 The solution must be able to override medical orders for during configurable timeframes.

Pharmacy Modernization Page 11

ATTACHMENT 2

ADDS.21 The solution must provide an audit trail for all override activity for all medication, including timestamp, user credentials, patient information, medication and justification.

ADDS.22 The solution must be able to secure dispensing of all controlled substances in a separate locked location

ADDS.23 The solution must be able to report controlled substance dispensing, returned or credited to an ADD system. Information must include timestamp, user credentials, patient information, medication and reason.

ADDS.24 The solution must be able to report separately by specific controlled substance schedule.

ADDS.25 Must be able to keep each hospital databases separate and hidden from each other in an enterprise solution.

ADDS.26 The solution must be able to configure profile preference for each hospital such as NDC selection preference from master formula

ADDS.27 The solution must be able to query prescription data such as order date, medication name and dose, patient ID etc., for medications currently stored in an individual ADD system.

ADDS.28 The solution must be able to store Federal Drug and Administration (FDA) Black Box Warnings

ADDS.29 The solution must be able to provide all equipment and software in compliance with pharmacy services regulations that govern DSH pharmacy operations including State Board of Pharmacy California Law, US Department of Justice, California Department of Public Health, and Title 22 Requirements

Pharmacy Operations – Patient Billing

BIL.1 The solution must be able to include

Medicare Part D eligibility information in

Pharmacy Modernization Page 12

ATTACHMENT 2

claims data, e.g., all documented claims data formats.

BIL.2 The solution must be able to provide an audit log of information as requested in the format requested by State for ingestion into security tools as it relates to activities within the solution.

BIL.3 The solution must be able to support a standardized (across all hospitals) claims data format.

BIL.4 The solution must be able to support HL-7 protocol.

Pharmacy Operations – Security Policy Compliance Requirements for Solution

SEC.1 The solution must be able to manage identities of devices

SEC.2 The solution must be able to encrypt non-public State data in transit and at rest.

SEC.3 The solution must be able to be FIPS 140-2 encryption compliant.

SEC.4 The solution must be able to provide data security by complying with HIPAA rules, regulations and agreements.

SEC.5 The solution must be able to provide information security, privacy, breach notification to prevent use or disclosure of data.

SEC.6 The solution must be able to comply with the California information Practices Act of 1977, and must provide assistance to the State to comply with these provisions (civil code section 1798 et seq)

SEC.7 The solution must be able to provide compliance of health and safety code with the applicable privacy and security provisions and shall provide assistance to State as may be necessary for State to comply with these provisions.

SEC.8 The solution must provide a list of software that will be utilized for the solution.

SEC.9 The solution must provide a list of 3rd party authentication solutions or protocols required.

Pharmacy Modernization Page 13

ATTACHMENT 2

SEC.10 The solution must be able to provide a diagram in Visio format demonstrating how systems and operations will be secured.

SEC.11 The solution must be able to ensure that critical business functions, systems and data will be available in the event of a disaster

SEC.12 The solution must be able to provide a system data backup and recovery process solution that must follow (SIMM 5325), with scenarios with incremental/full backups or data set reloads are appropriate

SEC.13 The solution must be able to test disaster recovery test every six months

SEC.14 The solution must be able to perform continuous monitoring of all network/host security of medical and computing devices, for indicators of compromise, signs of attach, anomalies, malfunction and/or inappropriate activities in violation of policy.

SEC.15 The solution must be able to provide security incident management procedures which included provisions for data breaches as well as other security violations.

SEC.16 The solution must be able to provide threat and vulnerability management by continuously identifying and remediating them before they can be exploited.

SEC.17 The solution must be able to provide boundary defense with separate and control access to different networks with different threat levels and set of users to reduce the number of successful attacks and risks to confidentiality, integrity, and availability (CIA).

SEC.18 The solution must be able to provide endpoint defense by protecting information assets that routinely interact with untrusted devices on the internet this includes endpoint protection software (AV/Host FW/Encryption/IPS/IDS) selected solely by DSH and in compliance with

Pharmacy Modernization Page 14

ATTACHMENT 2

SIMM5355A and other applicable SIMMS as determined solely by State

SEC.19 The solution must be able to provide identity and access management of control access to resources physical/logical and data base on the need to know.

SEC.20 The solution must be able to provide log-In credentials at all times ensure that each individual user of any State computer system through which PII/IIHI/PHI is accessed maintains his or her own unique user-id and password.

SEC.21 The solution must be able to provide ensure that former employees, sub-contractors, agents or other representatives who are no longer subject to this Agreement are de-activated or otherwise changed to prevent unauthorized access by any such individual

SEC.22 The solution must be able to provide physical security solution to protect information systems and data from physical threats.

SEC.23 The solution must be able to implement email threat protection as required by SIMM 5315A Email Threat Protection Standard and recommended by industry best practices.

SEC.24 The solution must be able to ensure vendor operations adherence to security controls in the NIST800-53 most current version designated as impact level HIGH, including organizationally defined setting set by the State.

SEC.25 The solution must be able to provide a solution that is fully compatible with State administrative and technical environment.

SEC.26 Must be able to pass Criminal Background Check (CBC). The contractor will be solely responsible for the cost of the CBC. DSH will review the CBC results. DSH at their sole discretion may request that a Contractor staff member be replaced if their CBC result is unsatisfactory

Pharmacy Modernization Page 15

ATTACHMENT 2

SEC.27 Must be able to complete and agree to abide by State Acceptable Use Policy, CDT/OTECH Data Center User Authorization requirements, and DSH Non- Disclosure Agreement for necessary authorizations before starting work under the contract.

SEC.28 Must be able to work at a secured DSH site and meet the required site specific physical access security requirements

SEC.29 Must be able to provide a Cyber Security Liability Insurance

SEC.30 Must be able to provide multifunctional equipment in accordance with DoD STIGS and/or Center for Internet baselines when used/or connected to the network.

SEC.31 Must be able to provide multifunctional equipment configured to harden the network protocols used, management services, processing services (print, copy, fax, and scan), audit logging, and physical security.

SEC.32 The solution must be able to ensure that any State non-public data is removed from memory before service calls and/or equipment disposal.

SEC.33 The solution must be able to ensure that any electronic information storage devices (hard drives, takes, diskettes, compact disk, USB, Multifunction peripherals, etc.) shall be disposed of in a manner corresponding to the classification of the stored information, up to and including physical destruction. DoD 5220.22-M and NIST SP800-88 standards

SEC.34 Must be able to provide a network diagram of the user's integration with the solution and any interfaces between the solution and the State, just be clearly documented (ports, protocols, direction of communication). The network diagram does not need to contain the inner workings of the solution or proprietary information.

Pharmacy Modernization Page 16

ATTACHMENT 2

SEC.35 Must provide a list of browsers and versions that are officially supported for web applications (3rd Party Authentication)

SEC.36 Must provide a list of any 3rd party authentication solutions or protocols that they support.

SEC.37 The solution must be able to provide encryption for non-public State data in transit and at rest.

SEC.38 The solution must be able to provide administrative, physical operational and technical controls in place to protect State

PII/IIHI/PHI

SEC.39 The solution must be able to secure User Acceptance Testing (UAT) environments at a level to the security in place for the production environment.

SEC.40 The solution must be able to provide secure training environments at a level to the security in place for the production environment.

SEC.41 Must provide UAT architecture such that an entire copy of the production files can be copied over into UAT.

SEC.42 Must provide UAT architecture equivalently configured so that performance and load testing will essentially produce the same results and expectations as testing in the production environment

SEC.43 The solution must be able to provide masking of production in lower with a detailed proposed plan.

SEC.44 The solution must be able to protect controlled unclassified information's

SEC.45 The solution must be able to provide documentation that demonstrates compliance with NIST SP 800-171 https://doi.org/10.6028/NIST.SP.800-171r2

SEC.46 The solution must be able to exceed FedRAMP baseline security controls latest version designated a sight impact system.

SEC.47 The solution must be able to provide to the State upon request without alteration, the data passing through, residing upon, or generated by the Contractor’s

Pharmacy Modernization Page 17

ATTACHMENT 2

infrastructure (in the form of virtual machines, data files, databases, or any other form of data storage).

SEC.48 Must agree to comply with the most current version of State security policies and standards accessible to the Contractor.

SEC.49 Must agree to utilize State designated time servers (NTP) where time server references are required in the Contractor’s physical and virtual infrastructure.

SEC.50 The solution must be able to provide contractor support that are subject to audit by State designated independent third-party auditors-assessors upon written notice or the equivalent audit information provided back to State.

SEC.51 Must be able to provide solution environment that are subject to oversight including Federal and State audit including compliance audit upon written notice.

SEC.52 Must be able to remediate all Contractor assigned findings resulting from these audits within a mutually agreed to period of months on Critical Findings (calculated from date the findings are reported), within a mutually agreed to period of months on Important findings (calculated from date the findings are discovered), and within a mutually agreed to period of months on all other findings (calculated from date the findings are reported). Criticality levels will be designated by the auditing authority.

SEC.53 The solution must be able to log as set by the State the copy function.

SEC.54 The solution must be able to limit as set by the State the copy function.

SEC.55 The solution must be able to log as set by the State the paste function.

SEC.56 The solution must be able to limit as set by the State the paste function.

SEC.57 The solution must be able to provide an audit log of information as requested in the format requested by State for ingestion into security tools as it relates to activities within the solution.

Pharmacy Modernization Page 18

ATTACHMENT 2

SEC.58 The solution must be able to break the glass feature for high profile patients

SEC.59 The solution must be able to provide technical system support during DSH standard downtime

SEC.60 The solution must be able to provide restricted authorized users access to logical systems

SEC.61 The solution must be able to provide restricted authorized users access to physical systems

SEC.62 Must provide Technical Services Division (TSD) facility for access to vendor systems

SEC.63 Must use TSD approved remote access tools.

SEC.64 The solution must be able to support all concurrent users, without degradation of system performance and/or functionality

SEC.65 The solution must be able to provide communication compatible with HL7 data communications

SEC.66 The solution must be able to provide a web-based interface which meets DSH accessibility requirements

SEC.67 The solution must be able to export data from the Dispensing to excel and tab delimited .csv file formats

SEC.68 The solution must be able to limit access to authorized facility personnel only

SEC.69 The solution must be able to store data for a minimum of seven years. See contract Exhibit E and Business Associate Dispensing Addendum for detail

SEC.70 Must agree to Service Level Agreement (SLA) to make changes as requested by business need or Centers for Medicare and Medicaid (CMS) standards and quality

SEC.71 The solution must be able to provide information security, privacy, breach notification to prevent use or disclosure of data

Pharmacy Modernization Page 19

ATTACHMENT 3

ESTIMATED COST WORKSHEET

Respondent shall estimate one-time cost and ongoing cost associated with the implementation of the high-level design document, including products and associated services. Respondent may expand or adjust the table in the attachment below, as desired.

Cost Worksheet for RFI