RFP 0050-N, Page 1 of 47

BOILERPLATE

REVISED MARCH 2026

STATE OF WYOMING

DEPARTMENT OF ADMINISTRATION & INFORMATION

GENERAL SERVICES DIVISION, PROCUREMENT SECTION

2323 CAREY AVENUE

CHEYENNE, WY 82002

REQUEST FOR PROPOSAL NUMBER 0050-N

DEPARTMENT OF HEALTH

BEHAVIORAL HEALTH DIVISION

BEHAVIORAL HEALTH MANAGEMENT SYSTEM

(BHMS)

PROPOSAL DUE DATE AND TIME

SEPTEMBER 30, 2026 – 2:00:00 P.M. MOUNTAIN TIME

AGENCY REPRESENTATIVE:

POLLY TANI

PROCUREMENT REPRESENTATIVE:

JAMIE RAFF

Jamie.raff1@wyo.gov 307-777-6721

RFP 0050-N, Page 2 of 47

Table of Contents

SECTION 1: REQUEST FOR PROPOSAL

SECTION 2: GENERAL PROVISIONS

SECTION 3: SPECIAL PROVISIONS INFORMATION

SECTION 4: KEY DATES

SECTION 5: ADMINISTRATIVE BACKGROUND

SECTION 6: REQUIREMENTS/SPECIFICATIONS

SECTION 7: PROPOSAL SUBMISSION REQUIREMENTS

SECTION 8: EVALUATION METHODOLOGY

SECTION 9: PROPOSAL PRICE SHEET AND SIGNATURE PAGE

REMAINDER OF PAGE INTENTIONALLY LEFT BLANK.

RFP 0050-N, Page 3 of 47

SECTION 1: REQUEST FOR PROPOSAL

1. SUBMISSION OF PROPOSALS:

The A&I Procurement Office will receive proposals for providing a secure, web-based software data management system, referred to as the “Behavioral Health Management System (BHMS)”, for the State of Wyoming, Department of Health, Behavioral Health Division (Agency) through the Public Purchase online bidding system. Proposals are due no later than 2:00:00 P.M. (Mountain Time) on September 30, 2026.

The technical proposal and cost proposal should be uploaded as separate documents and identified as such.

1.1. Proposals should be accompanied by the attached Proposal Price Sheet and signed by the proper official of the firm. All proposals should be uploaded on the Public Purchase online bidding system. Proposals sent by facsimile, email or paper copy may be rejected.

1.2. Proposals should be submitted through the Public Purchase online bidding system on or before the date and time specified. Proposals received after the date and time specified may be rejected.

1.3. The State of Wyoming reserves the right to withdraw this Request for Proposal, without cause, at any time before a contract has been fully signed and submitted to the A&I Procurement Office.

2. MODIFICATIONS OR WITHDRAWAL OF PROPOSALS:

2.1. A proposal may be altered through the Public Purchase online bidding system before the proposal due date and time contained in this document.

2.2. The proposer may withdraw its proposal through the Public Purchase online bidding system up to the proposal due date and time contained in this document. If a proposal is accepted and the proposer fails to furnish the service agreed upon in the proposal, that proposer may be eliminated from future consideration.

3. PREPARATION OF PROPOSALS:

3.1. A proposal may be rejected if it modifies any of the provisions, specifications or minimum requirements of the Request for Proposal.

3.2. In case of error in the extension of prices in the proposal, unit prices will govern.

4. AWARD AND CONTRACT INFORMATION:

4.1. The State of Wyoming will ensure that minority business enterprises will be afforded full opportunity to submit proposals. The State of Wyoming will not discriminate on the grounds of age, race, color, sex, creed, national origin, or disability status.

4.2. The proposer also, agrees that should their firm be awarded a contract, it will not discriminate against any person who performs work there under because of age, race, color, sex, creed, national origin or disability. In addition, the successful proposer shall comply with the Americans with Disability Act and the Wyoming Fair Employment Practices Act.

4.3. The proposer expressly warrants to the State that it has the ability and expertise to perform the contract if awarded. In doing so, it shall use the highest standards of professional workmanship.

RFP 0050-N, Page 4 of 47

4.4. The State of Wyoming reserves the right to reject any or all proposals, to waive any informality or technical defect in the proposals, or to award the contract in whole or in part, if deemed to be in the best interest of the State to do so. The A&I Procurement Office will award the contract to the firm, determined to have the most responsive and responsible proposal by the Wyoming Department of Health, Behavioral Health Division.

4.5. The successful proposer will be required to agree to and execute a formal contract with the State containing terms required by the Attorney General with reasonable adjustments acceptable to the State.

4.6. If applicable, the State will negotiate payment terms based upon a schedule to be determined by the proposer and the State. Paying invoices will be based upon the proposer successfully completing the deliverables within the stated deadlines, and upon the Agency’s written acceptance of the deliverables or services.

DATED: August 31, 2026

State of Wyoming Procurement Section Buyer: Jamie Raff

RFP 0050-N, Page 5 of 47

SECTION 2: GENERAL PROVISIONS

1. INSURANCE:

1.1. The contract between the successful proposer and the State shall require the successful proposer to carry certain insurance policies. All such insurance policies, except workers’ compensation and unemployment compensation policies, shall contain a waiver of subrogation against the Agency and the State, its agents and employees.

1.2. The contract between the successful proposer and the State shall require cyber liability insurance which shall be sufficiently broad to cover all duties and obligations undertaken by successful proposer and shall include, but not limited to, claims involving infringement of copyright, trademark, trade dress, invasion of privacy violations, information theft, damage to or description of electronic information, release of private information, alteration of electronic information, extortion and network security, with minimum limits as follows:

1.2.1. $2,000,000.00 each occurrence; and

1.2.2. $2,000,000.00 general aggregate.

1.2.3. Coverage should include breach response, regulatory fines and penalties, and credit monitoring expenses, with limits sufficient to respond to these obligations. Higher limits may be required when the contract involves large amounts of protected information or is high risk.

2. LAWS TO BE OBSERVED:

2.1. The proposer shall keep fully informed of, and comply with, all applicable federal and state laws or rules, all local bylaws, regulations and all orders and decrees of bodies or tribunals having any jurisdiction or authority. The proposer shall protect and indemnify the State and its representatives against any claim or liability arising from or based on the violation of any law, bylaw, ordinance, regulation, order or decree whether by himself or its employees.

3. ASSIGNMENT:

3.1. The proposal shall not be assigned by the proposer. Third party participation is authorized only as a joint venture that shall be clearly stated in detail in the original proposal and signed by all parties participating.

3.2. The proposer shall not enter into any subcontracts for any of the work contemplated under this Request for Proposal without the State’s prior written authorization.

4. EXTENSION AND AMENDMENT:

4.1. The proposer and the State covenant and agree that this proposal or subsequent contract may, with the mutual approval of the proposer and the State, be extended, for terms of up to three (3) years each, for a total contract period not to exceed nine (9) years.

RFP 0050-N, Page 6 of 47

5. AUDIT AND ACCESS TO RECORDS:

5.1. The State or any of its duly authorized representatives shall have access to the proposer’s books, documents, papers, electronic data and records that are directly pertinent to this Request for Proposal.

6. CONFLICT OF INTEREST:

6.1. The proposer warrants that no kickbacks, gratuities, or contingency fees have been paid in connection with this Request for Proposal and none have been promised. The proposer warrants that no one being paid pursuant to the proposal is engaged in any activity that would constitute a conflict of interest with respect to the purchases of the proposal.

7. NO FINDER’S FEE:

7.1. The proposer warrants that no finder’s fee, employment agency fee, or any such fee related to the proposal shall be paid.

8. SOVEREIGN IMMUNITY:

8.1. Pursuant to Wyoming Statute § 1-39-104(a), the State of Wyoming and the Agency expressly reserve sovereign immunity and specifically retain all immunities and defenses available to them as sovereigns. The proposer acknowledges that the State of Wyoming has sovereign immunity and only the Wyoming Legislature has the power to waive sovereign immunity. Designation of venue, choice of law, enforcement actions, and similar provisions shall not be construed as a waiver of sovereign immunity. The parties agree that any ambiguity in this Request for Proposal shall not be strictly construed, either against or for either party, except that any ambiguity as to sovereign immunity shall be construed in favor of sovereign immunity.

9. INDEMNIFICATION:

9.1. The proposer shall release, indemnify, and hold harmless the State, the Agency and its officers, agents, and employees from any and all claims, suits, liabilities, court awards, damages, costs, attorneys’ fees, and expenses arising out of the proposer’s failure to perform any of the proposer’s duties and obligations hereunder or in connection with the negligent performance of proposer’s duties and obligations, including, but not limited to, any claims, suits, liabilities, court awards, damages, costs, attorneys’ fees, and expenses arising out of proposer’s negligence or other tortious conduct.

10. APPLICABLE LAW/VENUE:

10.1. The construction, interpretation, and enforcement of this Request for Proposal shall be governed by the laws of the State of Wyoming, without regard to conflicts of law principles. The terms “hereof,” “hereunder,” “herein,” and words of similar import, are intended to refer to this Request for Proposal as a whole and not to any particular provision or part.

RFP 0050-N, Page 7 of 47

11. RIGHT OF OWNERSHIP AND MARKETING OF INTELLECTUAL PROPERTY

AND INTELLECTUAL ASSETS SUBMITTED FOR THE RFP (IF APPLICABLE):

11.1. It is acknowledged and agreed that the only party with a right to market, trademark, patent, copyright, or any like right to any intellectual property or intellectual assets submitted in relation to the Request for Proposal shall be and is solely vested in the State. This includes all intellectual property and intellectual assets related to both the written proposal and the oral presentation and any and all documents, pitches, products, media pitches, web screens, layouts, etc. produced for the written proposal and the oral presentation, and any updates, changes, alterations, or modifications to or derivative works.

RFP 0050-N, Page 8 of 47

SECTION 3: SPECIAL PROVISIONS INFORMATION

PROPOSALS SHOULD BE SUBMITTED THROUGH THE PUBLIC PURCHASE ONLINE BIDDING

SYSTEM BY 2:00:00 P.M. MOUNTAIN TIME ON SEPTEMBER 30, 2026. PROPOSALS RECEIVED

AFTER THE DATE AND TIME SPECIFIED MAY BE REJECTED.

It is the responsibility of the proposer to clearly identify all information that is considered confidential in accordance with the Wyoming Public Records Act, Wyoming Statute §16-4-201 through §16-4-205. Please identify each confidential page with the word “CONFIDENTIAL” in capital, bold letters centered at the bottom of each page. Information not clearly marked may be considered public. If the proposer submits information that it believes is confidential, it should include a statement justifying its basis for that belief.

1. STATE PARTIES:

1.1. This Request for Proposal is issued by the Wyoming Department of Administration and Information, General Services Division, Procurement Section (Procurement) on behalf of the Wyoming Department of Health, Behavioral Health Division (Agency).

1.2. Throughout this document and others in connection with this project, various references are made, or will be made to the “State.” Generally, whenever this reference appears, the term “State” incorporates all state agencies working on this project.

1.3. It should be understood that the Director of Wyoming Department of Health is empowered to be the signatory on all contracts, agreements, or modifications pertaining to this project. Any contracts, agreements, or modifications not bearing this signature or that of a designee are invalid.

2. CONTENT AND PROCUREMENT POINTS OF CONTACT:

2.1. Procurement is the primary point of contact from the date of release of the Request for Proposal until a proposer is selected and the selection is announced.

2.2. Written questions about the procurement should be submitted through the Public Purchase online bidding system until 2:00:00 P.M. Mountain Time on September 11th, 2026. Any questions received after that deadline may not be accepted or considered. Each question should be submitted individually. It is the proposer’s responsibility to check the Public Purchase online bidding system for answers to questions, addenda, or bid tabulations. Telephone calls, emails or faxes may not be accepted.

2.3. Written responses will be available through the Public Purchase online bidding system. Responses will not identify the firm that submitted the question. Only the written answers issued by the Agency are the official position on an issue, and these answers shall become part of the Request for Proposal.

3. RESTRICTIONS ON COMMUNICATIONS WITH AGENCY STAFF:

3.1. Until a proposer is selected and the selection is announced, proposers shall not communicate with Agency staff except via written questions through the Public Purchase online bidding system.

3.2. If a proposer violates this restriction, the State reserves the right to reject the proposal.

RFP 0050-N, Page 9 of 47

4. EFFECTIVE DATES OF PROPOSAL:

4.1. All terms, conditions and costs quoted in the proposer’s response will be binding on the proposer for one-hundred eighty (180) days from the effective date of the proposal.

5. ADVERTISING AWARD CONDITIONS:

5.1. A fully executed contract should be completed with the State before the successful proposer may advertise the award of the contract or the services being performed. The proposer should agree not to refer to awards in commercial advertising in such a manner that states or implies that the firm or its services are endorsed or preferred by the State of Wyoming.

6. CONTRACT NEGOTIATIONS:

6.1. The State will notify the most qualified/successful proposer and negotiate a contract in accordance with the Wyoming Attorney General’s contract guidelines. The successful proposer will be required to enter into and sign a formal contract with the Agency.

6.2. In the event the Agency determines contract negotiations are making no forward progress, negotiations will be terminated, and at the State’s sole discretion, negotiations may be initiated with the next most qualified/successful proposer, or the RFP may be withdrawn or reissued. This process will be followed until an agreement is reached, or until the State determines that the RFP will be withdrawn or reissued. The State assumes no obligation to a selected proposer until an agreement is reached and a contract is fully executed. The State will not negotiate concurrently with more than one proposer for the same award.

7. BEGINNING WORK:

7.1. The successful proposer may not perform any work that could be billed until a contract has been executed. The State will not pay for any work by the proposer before a contract is executed.

8. COPYRIGHT INFRINGEMENT:

8.1. The proposer warrants that no materials, products, and services proposed will infringe upon or violate any patent, copyright, trade secret, or other proprietary right of any third party. In the event of a claim by any third party against the State, the State shall promptly notify the proposer, and the proposer shall defend the claim. The defense will be at the proposer’s expense.

9. COST OF PREPARING PROPOSALS:

9.1. All costs incurred for preparing the proposal and for other procurement related activities are solely the proposer’s responsibility. The State of Wyoming will not provide reimbursement of these costs.

10. RISKS AND LIABILITIES:

10.1. By submitting a proposal, a proposer assumes any and all risks and liability associated with information in the proposal and its release.

RFP 0050-N, Page 10 of 47

11. AMENDMENTS:

11.1. The State reserves the right to amend this Request for Proposal before the proposal submission date. Amendments shall be uploaded to the Public Purchase online bidding system. It is the proposer’s responsibility to check the Public Purchase online bidding system for amendments.

12. PROPERTY DAMAGE AND LIABILITY INSURANCE:

12.1. The proposer may be required to furnish proof of property damage liability insurance in the amount deemed necessary by the Agency for this project, if applicable.

12.2. Questions regarding required insurance coverage and limits for this project should be submitted in writing, in accordance with instructions outlined in the special provisions.

13. MISREPRESENTATION OF INFORMATION:

13.1. Misrepresentation of a proposer’s status, experience, or capability in the proposal may result in disqualification of that proposer from the selection process. Discovery of litigation or investigations in a similar area of endeavor may, at the discretion of the Agency and after consultation with Procurement, preclude the proposer from the selection process.

14. DISPOSITION OF PROPOSALS:

14.1. All material submitted becomes property of the State of Wyoming, which is under no obligation to return any of the material submitted.

15. LEGAL CONSIDERATIONS:

15.1. This Request for Proposal is issued under Wyoming Statute §9-2-3204.

16. PROPOSER RELATIONS WITH STATE:

16.1. The proposer and its staff will have an ongoing relationship with the State that is based on trust, confidentiality, objectivity and integrity. The proposer will operate at all times in the State’s best interests and in a straightforward, trustworthy and professional manner. The proposer shall:

16.1.1. Work cooperatively with the State’s staff and business partners whenever required.

16.1.2. Work cooperatively with the staff of other proposers whenever required.

REMAINDER OF PAGE INTENTIONALLY LEFT BLANK.

RFP 0050-N, Page 11 of 47

SECTION 4: KEY DATES

Event Description Date Time (Mountain Time)

RFP Release Date August 31, 2026

Closing Date for Questions September 11, 2026 2:00 P.M.

Response to Questions Returned September 18, 2026 2:00 P.M.

RFP Submission Due Date September 30, 2026 2:00 P.M.

Tentative Award Date November 2026 N/A

Tentative Work Begins Date March 2027 N/A

RFP 0050-N, Page 12 of 47

SECTION 5: ADMINISTRATIVE BACKGROUND

1. INTRODUCTION AND BACKGROUND:

1.1. The Wyoming Department of Health, Behavioral Health Division (Agency), utilizes a secure, web-based software data management system referred to as the “Behavioral Health Management System (BHMS)”. The BHMS collects, monitors, analyzes, and reports statewide client-level Mental Health and Substance Use Disorder (MHSUD) treatment data for clients receiving services at the state-contracted Behavioral Health Centers (BHCs), and Agency facilities. By capturing both MHSUD and the SAMHSA Unified Performance Reporting Tool (SUPRT) data from state-funded treatment service providers in a single location, the system reduces duplicate data entry, standardizes overlapping data sets, and ensures information is readily available for state and federal decision-making, funding, and reporting.

Following the passage of House Enrolled Act 56 (2021 General Session) and W.S. § 35-1-612 through 627, the Agency redesigned the state-funded behavioral health system to establish tiered funding prioritization and fee-for-service reimbursement models for state-contracted BHCs, referred to as the Behavioral Health Redesign (BHR). The BHMS serves as the central data infrastructure supporting the BHR.

This in-house data system provides complete and efficient analysis of client treatments and outcomes as individuals move through the BHC or Agency facilities’ systems of care. Its customizable infrastructure is critical for adapting to evolving state and federal data collection requirements. To support these comprehensive operations, the proposed BHMS must process claim files for BHC treatment contracts, track BHR priority population eligibility, and support several integrated modules, including tools for provider certification, the Level of Care Utilization System (LOCUS), the SAMHSA SUPRT, residential bed capacity tracking, and crisis enrollments.

2. PURPOSE AND INTENT:

2.1. The purpose of this Request for Proposal (RFP) is to solicit competitive proposals from proposers who can offer a secure, web-based software data management system, the BHMS. This system will meet the Agency’s needs and expectations, as described within this RFP.

3. STAKEHOLDERS:

3.1. The stakeholders for this RFP include the following groups: clients receiving services at state-contracted BHCs, Agency facilities, other contracted providers, Agency staff, Agency Administrators, the Department of Corrections (DOC), the Department of Family Services (DFS), the Wyoming Judicial Branch, including Drug Courts, the Wyoming Legislature, the Governor’s Office, the SAMHSA, and Wyoming taxpayers. The BHMS benefits Wyoming's citizens by providing a transparent, accurate system for the Agency to monitor grant and contract compliance, safeguard fiscal integrity, track priority population access to care, and continuously improve the quality of state-funded behavioral health programs.

RFP 0050-N, Page 13 of 47

SECTION 6: REQUIREMENTS/SPECIFICATIONS

1. SCOPE OF PROJECT:

1.1. The primary scope of this project is to provide, maintain, and enhance a secure, web-based software data management system, BHMS, for the Wyoming Department of Health, Behavioral Health Division (Agency). The system serves as the central platform for data collection, validation, subrecipient monitoring, and reporting for state-funded MHSUD treatment services across Wyoming, as detailed in this RFP. The starting date for work under this contract is upon execution of a contract, and ceases upon expiration of the contract.

2. GENERAL REQUIREMENTS:

2.1. Scope of Activity – Contractor

2.1.1. The contractor shall develop a secure, web-based software data management system, the BHMS, to serve as the central platform for MHSUD treatment services data collection, validation, subrecipient monitoring, and reporting.

2.1.2. To support these monitoring and operational goals, the system must provide the following core capabilities:

2.1.2.1. Data Collection & Performance Measurement: Capture client-level treatment and service data from state-funded providers to continuously measure the performance and effectiveness of outpatient and residential programs managed by the Agency.

2.1.2.2. Capacity Management: Provide robust bed and waitlist management tools for residential treatment providers.

2.1.2.3. Customizable Infrastructure: Develop and implement additional features or modules, as requested by the Agency, to meet the changing needs of the system. The contractor must provide advance written notice to the Agency prior to changing primary cloud infrastructure or sub processor hosting providers.

2.1.2.4. Financial & Contract Operations: Equip providers and Agency staff with dedicated contract management tools, process claim files for state-contracted Behavioral Health Center (BHC) treatment contracts, facilitate the calculation of monthly state-to-provider payments, and enable monthly data reconciliation to guarantee completeness and accuracy.

2.1.2.5. Integrated Eligibility & System Tools: Track Behavioral Health Redesign (BHR) priority population eligibility and support specialized modules for provider certification, Level of Care Utilization System (LOCUS), the Substance Abuse and Mental Health Services Administration (SAMHSA) Unified Performance Reporting Tool (SUPRT), and crisis enrollments.

2.1.2.6. Federal Grant Compliance: Collect and maintain the data required for multiple federal awards, verify allowable costs, fulfill federal reporting mandates via direct links to federal systems, and ensure strict adherence to 2 CFR 200 regulations.

2.1.2.7. Subrecipient Monitoring: Capture service delivery records and outcomes, enabling Agency staff to perform programmatic desk reviews, audit client-level treatment records, and actively monitor subrecipient compliance with contract deliverables.

2.2. Scope of Activity – Agency

RFP 0050-N, Page 14 of 47

2.2.1. Consult with the contractor as to the needs of the BHMS.

2.2.2. Provide information at the request of the contractor, on the MHSUD treatment services, the BHR, and other systems which will be supported by the BHMS.

2.3. Communication Requirements

2.3.1. The Proposer shall communicate as needed and required by the Agency throughout the duration of the project.

2.3.2. The Proposer shall attend sprint planning, status, quality review, and acceptance meetings and present status and progress reports, as requested by the Agency.

2.3.2.1. Overall project status updates include (but are not limited to) the project’s progress, key issues or risks, accomplishments, and compliance with milestones and delivery dates

2.3.2.2. Sprint planning meetings include, but are not limited to, evaluating sprint task priorities, demonstrating work products in progress, reviewing mock-ups, discussing design recommendations that are efficient and user-friendly, clarifying task requirements, and identifying impediments to progress.

2.3.3 The Proposer shall provide ongoing communication, through email, virtual chat, or ad-hoc meetings, during sprint development to ask or answer questions, eliminate roadblocks, and ensure the work matches the requirements.

2.3.4. The Proposer shall immediately communicate when urgent system issues arise, including, but not limited to, the website going down or security issues being identified.

3. SYSTEM AND WYOMING INFORMATIONAL TECHNOLOGY STANDARDS:

3.1. The services, work products, and final deliverables provided by the proposer shall be in compliance with the State Statutes, CIO Promulgated Rules, State IT policies and standards, the Agency standards for required system hardware, and software and development components, when completed and accepted by the Agency.

3.2. State of Wyoming Electronic Transactions: Visit https://rules.wyo.gov/Search.aspx and search Electronic Transactions. Click on the Enterprise Technology Services drop-down arrow, then the Director’s Office drop-down arrow. Chapters 4, 5, and 7.

3.3. State of Wyoming IT Policies and Standards: https://ets.wyo.gov/resources/policies-standards

3.4. Agency Standards:

3.4.1. Agency Enforcement, Sanctions, and Penalties Policy (AS-009 & S-006A);

3.4.2. WDH Client Privacy Rights Policy;

3.4.3. WDH Notice of Privacy Practices (NPP); and

3.4.4. Wyoming State Archives Records Retention Schedules.

3.5. Statutory Mandates:

3.5.1. W.S. § 9-2-102, which authorizes the administration of comprehensive state programs for mental health, developmental disabilities, and substance abuse services;

3.5.2. Community Human Services Act (W.S. §§ 35-1-611 through 627);

3.5.3. Section 1911 of Title XIX, Part B, Subpart I and III of the Public Health Service Act (42 U.S.C. § 300);

https://rules.wyo.gov/Search.aspx https://ets.wyo.gov/resources/policies-standards

RFP 0050-N, Page 15 of 47

3.5.4. 42 U.S.C § 300x-35, which determines the required "Core Data Set";

3.5.5. 42 CFR Part 2, which protects substance use information;

3.5.6. 45 CFR Part 160 and Part 164 (Subparts A, C, D, and E), governing the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule, including pending Notice of Proposed Rulemaking (NPRM) requirements designed to strengthen cybersecurity protections for electronic protected health information (ePHI); and

3.5.7. 45 CFR Part 162, which is the HIPAA Administrative Simplification standards for electronic healthcare transactions, code sets, and 837 billing claims.

4. TECHNOLOGY AND SPECIFICATIONS:

4.1. Proposer must describe the technology which will drive the development, implementation, and operations of this project. Examples may include, but are not limited to: proposed technology (hardware/software), existing State environment (provide details as to the configuration and operating system), in-house development vs. Custom Off the Shelf (COTS), program language, web development, ADA Compliance, interfaces/integration, maintenance/support, reliability, performance measures, disaster recovery, security, help desk support, central services, network, telecommunications, etc.

4.2. To align with HIPAA Security Rule NPRM proposals, the proposer must provide a secure network, including a technology asset inventory and network map that illustrates the movement of ePHI throughout the regulated entity's electronic information system(s). The awarded proposer shall provide the agency with notice of any change in the regulated entity's environment or operations that may affect ePHI during the contract term.

4.3. Proposers should outline their product roadmap for the next three (3) to five (5) years as part of their technical response to inform the Agency of the long-term direction of the platform, anticipate system evolution, and ensure smooth, continuous operations throughout the contract term.

4.4. Accessibility (ADA): The public-facing components of the solution must be compliant with ADA Section 508 and WCAG 2.1 AA standards.

5. BASIC SECURITY REQUIREMENTS

5.1. Provide the ability for web pages to be accessible directly by providers and Division staff.

5.2. Provide the ability to time out a user's screen with an automatic timer for security.

5.3. Provide the capability of mass security updates.

5.4. Provide for the use of Secure Sockets Layer (SSL) encryption initially and Transport Layer Security (TLS) or other forms of comparable Advanced Encryption Standard (AES) encryption, for all transfer of individually identifiable data between client and server.

5.5. Provide the ability to do mass updates to groups of users as needed.

5.6. Have secure, 2-factor authentication.

5.7. Use supported versions of TLS and SSL.

5.8. Have a secure Application Programming Interface (API) experience.

5.9. Utilize up-to-date versions of code.

5.10. Provide the ability to restrict access and record all failed and successful security contacts.

5.11. Provide client Social Security Number (SSN) encryption.

RFP 0050-N, Page 16 of 47

5.12. Be HIPAA-compliant throughout the System; allow providers to view their own client-level treatment data, but not the client-level data of other providers; allow Data Unit and Division System Administrators and State Users to see all treatment data for clients on an as-needed basis.

5.13. Have security measures that allow the state to comply with federal, state, and local privacy requirements, including those that address:

5.13.1. Data backup and recovery;

5.13.2. Data storage;

5.13.3. Data encryption;

5.13.4. Proper destruction of data; and

5.13.5. Secure transmission of data.

5.14. Have encrypted data at rest and in transit.

5.15. Provide the capability to associate roles with a user and provide Data Unit and Division System Administrators the capability to add, change, or delete roles; role control which users can add/edit/delete data, and which users can only view the data; and Data Unit and Division System Administrators and state users are prevented from entering/changing client information. Provide Data Unit and Division System Administrators the capability to grant or restrict access to various reports.

5.16. Have audit tables to identify which users added, edited, or deleted data in the System, what the change was, and the timestamp.

6. GENERAL and HOSTING REQUIREMENTS:

6.1. The proposer shall provide multiple layers of external and internal security that establish administrative, physical, and technical safeguards to protect sensitive, confidential, and protected health information (PHI/ePHI) processed or maintained in the BHMS. All implementation specifications outlined below are required.

6.1.1. The successful proposer shall assume full, lead responsibility for all planning, execution, validation, and technical activities associated with migrating legacy data into any new BHMS platform, including, but not limited to, legacy SUPRT data, historical client records, provider certification data, and system lookup tables. The proposer must provide all necessary tools, scripts, technical expertise, and personnel to execute a turnkey data migration.

6.1.1.1. The Agency’s role in data migration will be strictly limited to granting authorized read-only access to legacy source data files and databases, answering high-level business logic questions regarding historical data definitions, and reviewing and providing final written approval for the vendor’s Data Migration Plan and final post-migration and audit report.

6.1.2. Design and develop custom-built software for a web-based in-house system, the BHMS.

6.1.3. Ensure the BHMS may be accessed via modern, standard web browsers without requiring client-side software installations or proprietary browser extension components.

6.1.4. Demonstrate an application architecture and design consistent with current industry best practices, ensuring the database shall be scalable, hardware independent, and support cross-platform application operations.

RFP 0050-N, Page 17 of 47

6.1.5. Utilize a system architecture featuring a web application front-end, and backend database structure built with Vue.js and ASP.NET Core, employing automated secure industry-standard data exchange protocols (e.g., RESTful APIs, SFTP, VPN) connecting directly into the State of Wyoming, Enterprise Technology Services (ETS) servers.

6.1.6. Accommodate users accessing the system using either laptop or desktop hardware running current supported versions of Microsoft operating systems, Apple operating systems, Microsoft Edge, supported versions of Apple Safari, and current supported versions of Google Chrome for both PC and Apple. If current versions change during the course of the contract, updates will be made to ensure BHMS is compatible with the systems used by the Agency.

6.1.7. Accommodate users with a minimum 56kBps-based Internet connection.

6.1.8. Provide sufficient bandwidth and redundancy to ensure continuous access to proposed solution functionality during internet congestion.

6.1.9. Provide the ability to utilize Microsoft Office and its evolutionary replacement for required documents, spreadsheets, narratives, summaries, and face sheets (i.e., detailed history documents).

6.1.10. Provide the ability to check data integrity and validity via various cross-referencing field verification checks.

6.1.11. Provide three (3) system environments dedicated to development, testing, and production.

6.1.12. Provide quality assurance testing of new functionality and regression testing of existing functionality.

6.1.13. Provide software assurance guarantees.

6.1.14. Maintain the ability to change and adapt the BHMS regularly to meet the changing needs of the Agency.

6.1.15. Provide an established process for migrating to new software releases.

6.1.16. Provide robust functionality for the Agency Data Unit, and Division System Administrators (e.g., configuration tools) to allow Agency staff to make adjustments without coding change costs.

6.1.17. Ensure the Agency Data Unit staff are granted SQL Server access to the BHMS in order to write custom queries as necessary.

6.1.18. Restrict access to the server databases solely to authorized development staff and designated state staff users, and implement network segmentation.

6.1.19. Ensure facilities housing system hardware or accessing the system implement physical safeguards, including a locked suite perimeter with assigned key-card access controls.

6.1.20. Restrict server environment access to development staff actively working on the project, and ensure all workstations accessing the system are encrypted and subject to inventory tracking.

6.1.21. Maintain proper power and cooling infrastructure, including redundant power and cooling, to safeguard hardware and state-owned data, establish technical baseline controls for configuring relevant systems and workstations, deploy anti-malware protection, remove extraneous software, and disable unneeded network ports based on ongoing risk analysis.

RFP 0050-N, Page 18 of 47

6.1.22. Provide sufficient storage capacity to operate and support the proposed solution, encrypt databases containing state-owned data at rest, and deploy separate technical controls for backup and recovery of ePHI and relevant electronic information systems.

6.1.23. Maintain adequate technical support and staffing to provide twenty-four (24) hour, seven (7) days per week, three hundred sixty-five (365) days per year, hosting services, providing dedicated support staff to perform ongoing maintenance, resolve software bugs, and execute releases for system upgrades.

6.1.24. Ensure the BHMS is available twenty-four (24) hours per day, seven (7) days per week, three hundred sixty-five (365) days per year, coordinating any maintenance outages in advance with designated Agency personnel.

6.1.25. Control user access through an access request approval process verified by a designated Access Control Contact or supervisor, and notify regulated entities within twenty-four (24) hours when a workforce member's access to ePHI or restricted electronic information systems is changed or terminated.

6.1.26. Grant access to the BHMS using a unique user identifier and a user profile combined with a strong password, multi-factor authentication (MFA), and strict role-based or Agency-based permissions, ensuring any transaction or change to data is traced and audited down to the user ID level.

6.1.27. Secure the network through multiple redundant firewalls and anti-virus software, requiring encryption of ePHI at rest and in transit, meeting Federal Information Processing Standard (FIPS), with limited exceptions.

6.1.28. Require all new system users to attend role-specific training with an Agency Data Unit team member covering HIPAA privacy and security guidelines, and maintain and revise a technology asset inventory and network map illustrating ePHI movement at least once every twelve (12) months and in response to major operational changes.

6.1.29. Ensure the BHMS tracks all user activity via audit tables and logs, and provide a Login Report that actively monitors login attempts, successful logins, and the most recent successful login by active users.

6.1.30. Maintain policies and procedures to support the security of confidential information, including but not limited to PHI, personally identifiable information (PII), and 42 CFR Part 2 data, ensuring data breach notification procedures and plans comply with Wyoming Statute §40-12-505, 45 CFR Parts 160/164 (HIPAA/HITECH), and proposed or finalized HIPAA Security Rule updates.

6.1.31. Conduct a compliance audit at least once every twelve (12) months regarding Security Rule requirements, and require business associates or subcontractors to verify technical safeguard deployment at least once every twelve (12) months through a written expert analysis and certification.

6.1.32. Support an automated annual archiving routine for client records reaching seven (7) years active status, systematically obfuscating PHI and PII (e.g., date of birth (DOB) changed to 1/1/YEAR, Social Security Numbers (SSNs), and names cleared) while preserving non-identifying fields for historical analysis.

6.1.33. Provide policies, procedures, and safeguards to respond to and recover from Denial of Service (DOS) attacks, including vulnerability scanning at least every six (6) months, penetration testing at least once every twelve (12) months, and written procedures to restore relevant systems and data within seventy-two (72) hours.

RFP 0050-N, Page 19 of 47

6.1.34. Maintain a hosting Disaster Recovery Plan (DRP), Continuity of Operations Plan (COOP), and disaster recovery facility; notify the Agency without unreasonable delay and no later than twenty-four (24) hours following plan activation; restore the solution within twenty-four (24) hours if complete system failure occurs; and conduct annual testing while providing results to the Agency within thirty (30) days of execution.

6.1.35. Perform a critical analysis of technology assets to establish the priority order of restoration for hosted services.

6.1.36. Describe website archiving practices that comply with the Wyoming Public Records Act (Wyoming Statute §16-4-201 through 16-4-205).

7. RISK MANAGEMENT:

7.1. Provide a description of how the proposer will conduct risk management planning, identification, analysis, responses and monitoring and controlling the risks throughout the life cycle of the project. Identify how the proposer’s Risk Management Plan will increase positive impacts and decrease adverse events in the project.

7.2. For work performed in each location, describe what plans/arrangements are in place for an alternative work site should the facilities become inoperative because of fire, earthquake, etc.

7.3. Describe your emergency and disaster recovery plans.

8. RESOURCE RESPONSIBILITIES

8.1. Project Manager: The proposer should designate a project manager to represent and oversee the project. This individual will serve as the focal and contact point for all proposer business matters relating to the project. An individual resume, a list of their qualifications, years of experience, current work assignments, and office location should be included. Confirm that the project manager will:

8.1.1. Be the single point of contact for the duration of the engagement.

8.1.2. Be responsible for the timely completion of all phases of the project.

8.1.3. Be responsible for meeting all contractual requirements for the duration of the project.

8.1.4. Attend status, quality review, and acceptance meetings as required and present status and progress reports on the project.

8.1.5. Remain assigned to the project through completion of the project as determined by the Agency.

8.1.6. Identify project responsibilities and job functions.

8.2. Other Key Personnel: The proposer should provide a list of all key personnel to be assigned to any part of the project and the duration of time they will serve on the project. The following should be considered:

8.2.1. Project Management;

8.2.2. Information Technology Implementation Strategies;

8.2.3. Change Management Strategies;

8.2.4. Subject Matter/Industry Expertise;

8.2.5. Experience on Government Projects;

8.2.6. Quality Assurance for Government Projects;

RFP 0050-N, Page 20 of 47

8.2.7. Identify how long the current team to be assigned to the project has been together; and

8.2.8. Describe the proposer’s transition plan, how the firm plans to deal with the possible sudden departure of key personnel within the team.

8.3. Subcontractors will report to and be responsible to the proposer.

8.3.1. The proposer shall provide a description of the work to be subcontracted to third parties.

8.3.2. Certify any supporting contractor who may assist the primary contractor and meet the minimum proposer qualifications.

8.3.3. A description of the nature and duration of the previous relationship of all subcontractors and/or third parties with the prime contractor.

8.3.4. Explanation of any existing contractual relationship between the prime and subcontractors, or among subcontractors.

8.4. Resource Management and Staffing Plan: The proposal should contain the proposer’s staffing plan in response to the requirements set forth in the RFP. At a minimum, the staffing plan should address the following:

8.4.1. Staffing Levels (estimated by staff disciplines by month for the duration of the project).

8.4.2. Break out of staff disciplines (including title and job responsibility).

8.4.3. Detail differentiated by staff (proposer, subcontractor, etc.).

8.4.4. Personnel whose names and resumes are submitted in the proposal shall not be removed from this project without prior approval of the Agency. Substitute or additional personnel shall not be used for the project until a resume is received and approved by the Agency.

8.4.5. The agency shall have the right to request the removal of any proposer staff member from all work on this project, and the proposer will comply with any such request immediately.

8.5. The replacement for any staff member who is removed from or leaves the project for any reason should match or exceed the replaced staff member in terms of skill level and experience. Such replacements are subject to the Agency approval at the time of assignment and again 90 days later.

9. REPORTING:

9.1. Proposer will provide to the Agency as requested:

9.1.1. Weekly progress or status reports, to include, but not limited to, milestones and deliverables, risks and mitigation strategies, cost projects, etc.

9.1.2. Monthly management and budget reporting

9.1.3. Ad hoc (as needed/requested)

9.1.4. Customized reports

10. TRAINING AND KNOWLEDGE TRANSFER PLAN:

10.1. The proposer shall provide training upon request, for the Agency or end users, either on-site or virtually. The following are the training requirements the proposer will be required to perform, including, but not limited to:

10.1.1. The proposer must execute a comprehensive training plan, ensuring that Agency staff and designated users are thoroughly trained on system operability, security protocols, and data management.

RFP 0050-N, Page 21 of 47

10.1.2. Train-the-trainer – Through scrum meetings, development walk-throughs, and UAT testing, train Agency Data Unit staff to use the system and become familiar with new front-end functionality before it is released to production. The Agency Data Unit staff will then train other internal state users and external users (e.g., treatment providers) on use of the BHMS.

11. OPERATIONAL READINESS AND OPERABILITY TESTING:

The proposer shall be required to comprehensively describe the responsibilities, testing methodologies, and deliverables they will execute to prove the BHMS’s operational readiness and operability prior to final acceptance.

The proposer must outline their approach to proving readiness across the following key areas:

11.1.1. The proposer must demonstrate the successful setup, installation, and operation of the proposed solution, utilizing detailed punch lists to track completion. The proposer must develop and adhere to a Configuration Management Plan to ensure all system components are correctly baselined and tracked.

11.1.2. The proposer must test and validate all system interfaces and data transfer protocols. This includes verifying secure Virtual Private Network (VPN) and Secure File Transfer Protocol (SFTP) connections with the State of Wyoming Enterprise Technology Services (ETS) servers, as well as connections to the Medicaid Data Warehouse.

11.1.3. The proposer must demonstrate the operability of the BHMS web application and its integrated components, such as the Provider Certification, Level of Care Utilization System (LOCUS), and Residential Bed modules.

11.1.4. The proposer must prove the effectiveness of the system's three-tiered data validation process (i.e., field-level validation, property on object validation, and property and object validation) to ensure accurate data intake from manual entries and Extensible Markup Language (XML) batch uploads.

11.1.5. The proposer must successfully test the generation of all required output files and reports, including federal data extracts (e.g., Treatment Episode Data Set (TEDS), Mental Health Client-Level Data (MH-CLD), and SUPRT files) and state-level contract monitoring dashboards.

11.1.6. The proposer must test and validate all system security measures, ensuring complete compliance with the Health Insurance Portability and Accountability Act (HIPAA) Security Rule and 42 CFR Part 2.

11.1.7. The proposer must demonstrate the successful implementation of the user access management process, proving that strict Role-Based Access Controls (RBAC), secure two-factor authentication, and quarterly user audit reports function as intended.

11.1.8. The proposer must prove that all electronic protected health information (ePHI) and personally identifiable information (PII) is appropriately encrypted at rest and in transit.

11.1.9. The proposer must test their disaster recovery and contingency plans, establishing written procedures to respond to security incidents and restore critical systems and data within seventy-two (72) hours.

11.1.10. The proposer must coordinate responsibilities with any other component proposers or third-party vendors and conduct a pilot phase if deemed necessary to ensure system stability.

RFP 0050-N, Page 22 of 47

11.1.11. The proposer must detail their deployment strategy, prioritizing small, frequent releases of new functionality and features to minimize operational disruption. Maintenance may be provided under a separate contract between the proposer and Agency, and shall be negotiated with the final acceptance of the solution.

11.1.12. As part of the proposer’s proposal, they should provide a sample of their Service Level Agreement (SLA) to maintain and support the proposed solution.

11.1.13. The proposer should provide sufficient technical staff to perform all routine maintenance responsibilities as follows: perform research immediately upon recognizing potential system problems; and proactively maintain and upgrade software (i.e., current version) and/or allow the Agency access to source code or establish a software escrow account per the contract terms and conditions.

12. MAINTENANCE AND SUPPORT REQUIREMENTS:

12.1. The proposer shall be responsible for maintaining and upgrading the software solution as part of the contract maintenance responsibilities for up to nine (9) years.

12.1.1. During this period, the proposer will perform all maintenance and support as a routine activity, including the establishment and adherence to a software version control and release schedule.

12.1.2. A sample Service Level Agreement (SLA) to maintain and support the proposed solution should be included in the…