RFP 2024-1600-0249-1624-020 - Questions and Answers.xlsx
XLSX spreadsheet 21 KB Posted
- Solicitation number
- 1624-020
- Issued by
- Juneau City and Borough, Alaska
About this file
This is a Questions and Answers document for RFP 2024-1600-0249/1624-020 issued by the State of Alaska Department of Health, Division of Public Health, Section of Epidemiology regarding the National Electronic Disease Surveillance System (NBS). The RFP seeks a vendor for interface, application, and development support services, with potential migration support and hosting services for Alaska's version of the CDC's NBS. Key dates include a question deadline of November 8, 2024, and a proposal submission deadline of November 20, 2024. The current vendor contract ends in April 2025, and the system serves approximately 50-60 monthly users.
The document clarifies that vendors should only submit proposals for vendor-hosted solutions, with any potential CDC-hosted scenarios to be addressed through future amendments. The system contains 116 nationally notifiable conditions and 172 total active conditions. Technical details indicate no customizations have been made to the core code, though some custom tables exist in the reporting database. The system uses Rhapsody for integration, and NBS 7 includes Keycloak as the standard identity provider. The state requires vendors to obtain Authority to Operate (ATO) certification, though FedRAMP certification is not required.
View the file
Other files
Show 40 more
Latest 50 of 163 listed here. See the rest on GovTribe.
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| RFP 2024-1600-0249 / 1624-020 - Offeror Questions and Answers from the State | |||
| Number | RFP Section | Question | Answer |
| 1 | 3.04 and 3.05 | After submitting the NDA form to the procurement officer, is the subsequent questionnaire form provided to be submitted with our proposal? | No. The form, or questionnaire, referenced in RFP Section 3.05 – Intent to Propose and Non-Disclosure Agreement, is for reference only, to aid vendor in knowing what is expected of them and in determining level of effort. Note also that, per RFP Section 4.11, offerors must incorporate the security assessment into their proposed costs. |
| 2 | 1.03 | Is the proposal due date still 11/20? | The deadline for receipt of proposals remains Wednesday, November 20, 2024. Note, however, the administrative correction above regarding the deadline for submission of questions. |
| 3 | General | When does Alaska’s contract with the current vendor of your production system end? Is there a target date by which the current instance of NBS must be migrated to a different environment? | Approximately April 2025. |
| 4 | 4.04 | Per Form B, ‘Offerors must provide two (2) letters of reference that each address performance of deliverables on time and within budget.’ Would an assessment from CDC Contractor Performance Assessment Reporting System (CPARS) be acceptable? | Yes, that would be acceptable for one of the references. |
| 5 | 3.14 | Are teaming agreements permitted? | Reference RFP Section 3.14 – Joint Ventures. |
| 6 | General | How many end users will be logging in on a monthly basis? | 50 - 60. |
| 7 | 3.04 | The RFP states [Authority to Operate] ATO will be required. Is this related to FedRamp? | No, ATO is independent of FedRAMP. ATO is required before the system can go into production with live data. The State of Alaska, Department of Health, does not require vendors to go through the FedRAMP process today. |
| 8 | 3.04 | Are any certifications required for the environment, even though the RFP does not specify any, achieving an ATO typically requires stringent environmental standards. | No certifications are required. Completion of the security assessment is required, and the system must reach ATO. |
| 9 | General | Could you please provide details on the programming languages and code frameworks utilized within the NBS? | Please refer to these CDC links for more information about NBS: https://www.cdc.gov/nbs/php/modernization/updates.html and https://github.com/CDCgov/NEDSS-Modernization |
| 10 | 3.04 | For SEC. 3.04 HIPAA SECURITY ASSESSMENT REQUIREMENTS, can you provide an example where the state would not be responsible for any additional cost after working with the DOH Security Office and the DOH’s Security Assessor. | An example would be if a vendor refuses to provide requested documentation on a security control question. DOH works in partnership with vendors on the assessment process to reach ATO. |
| 11 | 3.02 | [Re: Section 3.02 – Scope of Work:] The RFP mentions the state’s intent to ‘pilot’ NBS 7X in the CDC Azure cloud. We are aware there is a CDC pilot contract that states must sign to be part of this. Has Alaska already executed this agreement, or do you intend to? | Alaska is in discussions with CDC with the intent to formalize an agreement to host. |
Updated Answer: Please see revised Section 3.02 and added Section 3.19 - Anticipated Amendments. The state only expects one proposal for a vendor hosted solution, any CDC hosted scenario will be dealt with in accordance with 3.19.
12 General Will the CDC agreement be made available to the NBS support vendor given obligations and work effort that could be required by the vendor? Further, does this create obligations for the vendor to any specific CDC deliverables? The substance of the agreements will be shared with the vendor. For the second part of the question, no.
Updated Answer: Please see revised Section 3.02 and added Section 3.19 - Anticipated Amendments. The state only expects one proposal for a vendor hosted solution, any CDC hosted scenario will be dealt with in accordance with 3.19.
13 3.02 [Re: Section 3.02 – Scope of Work:] Many of the IT contract requirements within the RFP cannot be answered by [Company A] given [Company A] would [not] be the hosting vendor. Will the CDC be answering these requirements and providing that information to the state and vendor to ensure compliance? We anticipate respondents will provide two responses to the RFP: one where the main NBS application is hosted in the single-tenant CDC Azure cloud, and the other where the main NBS application is hosted in a third-party cloud in a SaaS model. We believe that the majority of IT contract requirements will be achievable through the new NBS 7 Application Programming Interface (APIs). We acknowledge that there will be some IT requirements where a ticket may need to be entered with the CDC team with direct access to the database.
Updated Answer: Please see revised Section 3.02 and added Section 3.19 - Anticipated Amendments. The state only expects one proposal for a vendor hosted solution, any CDC hosted scenario will be dealt with in accordance with 3.19.
14 3.02 [Re: Section 3.02 – Scope of Work:] [Company A] has communicated with the CDC around the topic of vendor access and the ability for a vendor like [Company A] to support a CDC Azure hosted NBS STLT. Bottom line, [Company A] (or any vendor) will NOT have anything other than front-end application access. Neither the state nor a vendor will have the ability to support, maintain, or troubleshoot any process or part of the NBS that requires access beyond front-end application access. At present, a large portion of the work [Company A] performs for Alaska does require backend or enhanced NBS access beyond just application access. Has the state considered this or spoken to the CDC around this topic? As it stands, Alaska will lose services they currently depend on day to day and week to week. CDC has made it clear they will ONLY serve as a hosting solution and will not be providing other services. How does Alaska plan to fill this gap and does the state understand that vendor support and services will be scaled back and considerably reduced in the CDC Azure cloud? The Authority to Operate (ATO) for NBS in the CDC Azure environment was just recently approved, and thus the CDC was able to provide a clearer description of the landscape of CDC hosting. Per the terms of the ATO, non-CDC-onboarded contractors will not have direct access to the database. Respondents, as SOA contractors, will not have direct access to the NBS database. However, the NBS 7 application provides several APIs that we believe will allow most IT contract requirements to be achieved. As stated in a previous answer, there may be an anticipated, limited number of IT requirements where a ticket will need to be entered with the CDC team that has direct access to the database. APIs in NBS 7 include those for inbound ingestion and outbound notifications. The CDC team can replicate the reporting data base (RDB), which can then be hosted outside of the CDC Azure cloud. Any integrations, i.e., Rhapsody, will need to be hosted outside of the CDC Azure cloud.
Updated Answer: Please see revised Section 3.02 and added Section 3.19 - Anticipated Amendments. The state only expects one proposal for a vendor hosted solution, any CDC hosted scenario will be dealt with in accordance with 3.19.
15 3.02 [Re: Section 3.02 – Scope of Work:] Related to the above question, has the state requested from the CDC an outline of what specific access they will provide to vendor given the state’s needed support? In order to access CDC networks, a vendor must be a CDC-onboarded contractor. If a company is a vendor to a state, but is not a vendor to the CDC, they will not be able to administer CDC-managed infrastructure. This would not prevent vendors from asking the CDC to provide troubleshooting information or make changes on behalf of a state.
Updated Answer: Please see revised Section 3.02 and added Section 3.19 - Anticipated Amendments. The state only expects one proposal for a vendor hosted solution, any CDC hosted scenario will be dealt with in accordance with 3.19.
16 3.02 [Re: Section 3.02 – Scope of Work:] There are several sections in this RFP that cannot be actioned, completed, or delivered by a vendor given hosting will be in the CDC Azure cloud. Are these sections still to be answered by a vendor? Or should they only be answered as it relates to a potential vendor hosted cloud solution? As noted in an above question, we anticipate respondents will provide two responses to the RFP: one where the main NBS application is hosted in the single-tenant CDC Azure cloud, and the other where the main NBS application is hosted in a third-party cloud in an SaaS model. We believe that the majority of IT contract requirement will be achievable through the new NBS 7 APIs. We acknowledge that there will be some IT requirements where a ticket may need to be entered with the CDC team with direct access to the database.
Updated Answer: Please see revised Section 3.02 and added Section 3.19 - Anticipated Amendments. The state only expects one proposal for a vendor hosted solution, any CDC hosted scenario will be dealt with in accordance with 3.19.
17 3.02 [Re: Section 3.02 – Scope of Work:] Per the CDC, pieces of Page Builder assistance, MMG onboarding, application tuning, and more – will now be handled via support tickets to the CDC Help Desk and not by a vendor. Has the state considered this in relation to the requirements and scope of this RFP? Is the intent of the state for the vendor to be the go-between for the state and the CDC? It is our understanding that MMG onboarding can be achieved in the front end of NBS 7. Most application tuning requiring the database is implemented once and not often changed. As stated in previous answers, there may be an anticipated limited number of IT requirements where a ticket will need to be entered with the CDC team that has direct access to the database. The intent of SOA is that the vendor will be the go-between.
Updated Answer: Please see revised Section 3.02 and added Section 3.19 - Anticipated Amendments. The state only expects one proposal for a vendor hosted solution, any CDC hosted scenario will be dealt with in accordance with 3.19.
| 18 | 3.02 | : [Re: Section 3.02 – Scope of Work:] If the CDC cannot or will not provide the vendor access to their Azure cloud, how do the expectations of the state to the vendor change for support of services? | This has been answered in previous questions. (See above.) |
| 19 | 3.02 | Has Alaska requested a copy of any and all exceptions to security requirements that CDC is requesting in order to obtain their ATO on the Azure cloud to ensure alignment with Alaksa IT Security standards? | This can be requested and shared with a vendor. |
Updated Answer: Please see revised Section 3.02 and added Section 3.19 - Anticipated Amendments. The state only expects one proposal for a vendor hosted solution, any CDC hosted scenario will be dealt with in accordance with 3.19.
20 3.02 [Re: Section 3.02 – Scope of Work:] Please confirm that any lift-and-shift and NBS7 version upgrade to the CDC Azure cloud will be performed by the CDC and is not part of this RFP and vendor responsibilities. Deliverable 4 Migrations mentions part of this would be the responsibility of the vendor, however; only CDC could complete these tasks. This goes back to all IT and security related requirements. All of these would be the responsibility of the CDC as the hosting solution, not the services vendor. Please confirm. The future vendor would be working closely with the current vendor, the CDC/CDC partners as the cloud-hosting entity, and the State to ensure coordinated management.
Updated Answer: Please see revised Section 3.02 and added Section 3.19 - Anticipated Amendments. The state only expects one proposal for a vendor hosted solution, any CDC hosted scenario will be dealt with in accordance with 3.19.
21 3.02 Per the uncertainty and ongoing discussions with the CDC regarding vendor access to the Azure cloud which would be required to best complete specific requirements within the State’s RFP and the upcoming submission deadline for the state’s RFP as of November 20th, 2024, would the state be amenable to a 2-week extension for RFP submissions from the date answers to vendor questions are provided by the state? Yes. Reference table in RFP Amendment No. 4, Change to the RFP, for new set of dates.
Updated Answer: Please see revised Section 3.02 and added Section 3.19 - Anticipated Amendments. The state only expects one proposal for a vendor hosted solution, any CDC hosted scenario will be dealt with in accordance with 3.19.
22 Submittal Form F [On Submittal Form F,] Question 8 requests resumes for all proposed principal staff. These are also requested in Submittal Form B, page 22 of the solicitation. Are they required in this section as well, and will they count towards page limits for this section? Requirement No. 8 on Submittal Form F – Mandatory Requirements is one of the mandatory requirements that contributes toward an offeror’s technical proposal being considered responsive and responsible. Regarding the page limitation inquiry within Question 11 above, reference RFP Section 4.04 – Experience and Qualifications, “Letters of reference and resumes will not count against maximum page limitations.”
Updated Answer: For clarity, for Requirement 8 in Submittal Form F, offerors only need to check "yes" for the requirement and provide the required resumes (which again do not count towards any page limits). They do not need to provide an "explanation" for Requirement 8 in the explantion section of Submittal Form F. Also important: For all other mandatory requirements listed in Submittal Form F, offerors must check "yes" and provide the required explation in order to be considered responsive.
| 23 | Submittal Form F | The requirement [No. 8 on Submittal Form F] also seems to be incomplete at the end, are there additional requirements for this section which should be met? “Offerors must provide resumes for all proposed principal staff resumes. All personnel” | Reference RFP Amendment No. 4, Change to RFP Attachment. |
| 24 | Submital Form H | [Re: Submittal Form H – DOH IT Contractual requirements – SaaS Solutions (v241004), please confirm that these requirements pertain to supporting applications and services only, and not the NBS application itself. | These are general requirements that apply to any Saas / Cloud soluition DOH is procuring. The offeror will be the responsible party to comply with the IT contractual requirements and may need to collaborate with CDC. |
| 25 | General | What if any customization have been made to the NBS system for the State of Alaska? | There have not been any customizations that have impacted the core code. Some custom tables have been built in the reporting database. |
| 26 | General | Aside from Rhapsody, is there additional integrations the State is expecting to add? | Not at this time. |
| 27 | General | Does the State have a roadmap for this project after the RFP has been initiated and implemented? (i.e. Data Analytics) | The focus of this RFP is on the surveillance system; analytics capacity and displays are out of scope. |
| 28 | General | If the CDC hosted environment is suitable but NBS v7 is not ready, does Alaska expect the vendor to host NBS v6.x in the CDC hosted environment or an alternate location? | NBS versions 6.x cannot be hosted in the CDC environment. Our intent is to move to NBS 7.x. NBS 7.x is built on top of NBS 6 and can be separated if a rollback is needed. |
Updated Answer: Please see revised Section 3.02 and added Section 3.19 - Anticipated Amendments. The state only expects one proposal for a vendor hosted solution, any CDC hosted scenario will be dealt with in accordance with 3.19.
29 General How many notifiable conditions are in the system? We have 116 nationally notifiable conditions in our NBS instance. Many of these conditions have no cases under them (have not been used) as they are low prevalence. Generally, our nationally notifiable condition list matches with those listed here: https://ndc.services.cdc.gov/. In total, there 172 conditions active in NBS, which include environmental conditions (such as lead and other heavy metal poisoning) and conditions that exist in for workflow purposes only.
For additional reference, these are the infectious conditions reportable by Health Care Providers and Laboratories in Alaska:
https://health.alaska.gov/dph/Epi/Documents/pubs/conditions/ConditionsReportable_HCP.pdf https://health.alaska.gov/dph/Epi/Documents/pubs/conditions/ConditionsReportable_LABS.pdf
| 30 | General | How many additional questions have been configured for the default conditions? | Many of our published pages do not deviate from the CDC NBS page templates. The notable exceptions to this are the 4 pages used for hepatitis B and C. These pages contain about 5-10 custom questions each, some of which are used across multiple of the pages. Our COVID-19 page also contains about 5-10 custom questions. Our salmonellosis page was borrowed from another state, as there has not yet been a page template released by the CDC NBS team. Many conditions in our NBS are using the genV2 page template without any customizations. |
| 31 | General | How many staff members does the State have maintaining Rhapsody? | Rhapsody has been maintained by our NBS vendor and is not internal to the State. |
| 32 | General | What pain points does the State currently have with the Rhapsody integration? | We have not explored our Rhapsody routes closely enough to understand pain points, although we believe that we could be utilizing Rhapsody in more strategic ways to improve data and workflow in our NBS. More collaboration in this area is important to us. |
| 33 | General | Is there a current statewide SSO that this will be integrated with, or will there be a new SSO integration for this project? | NBS 7 includes a standard identity provider (IDP), Keycloak, which integrates to standard SSO via SAML, OAuth, or OpenIDConnect to SOA's preference. |
| 34 | General | Does the fact that the Authority to Operate (ATO) for NBS in the CDC Azure environment was approved mean [that] Alaska has completed [its] review and the selected vendor can plan on moving to the Pilot phase in the CDC environment on day one? | There are still discussions about how/whether the CDC cloud pilot is an option for Alaska. We anticipate having a more definitive assessment of options and timeframe in the future. |
Updated Answer: Please see revised Section 3.02 and added Section 3.19 - Anticipated Amendments. The state only expects one proposal for a vendor hosted solution, any CDC hosted scenario will be dealt with in accordance with 3.19.
| 35 | General | Does Alaska have transition plans in place for current production system with the current vendor? Can you share those plans? | Not yet, but the contract with the current vendor has standard State language about developing a transition plan within a reasonable timeframe and working with a potential incoming vendor and CDC/partners to make a smooth and timely transition. |
| 36 | General | Has the CDC shared any information on how long the NBS V7 install in CDC environment takes and along with a [Responsible, Accountable, Consulted, Informed] RACI chart for the CDC and the selected vendor? If so, can you share that now? | We do not have that information yet. |
| 37 | General | Does Alaska have a plan in place on hosting rhapsody and other elements of NBS V7 that are not allowed in CDC environment? | These would be hosted in the vendor’s cloud. |
Updated Answer: Please see revised Section 3.02 and added Section 3.19 - Anticipated Amendments. The state only expects one proposal for a vendor hosted solution, any CDC hosted scenario will be dealt with in accordance with 3.19.
38 Appendix A Appendix A. Standard Agreement Form references additional appendices B, C, D, E, F. These Appendices have not been provided in the RFP documentation provided, or if they have been provided, they may have been provided under a different name, please clarify. Can you please clarify or provide these missing referenced appendices? Using the cover page of the Standard Agreement Form - Appendix A, Articles 2.2 – 2.6 as a reference:
| • | Article 2.2 Appendix B sets forth the liability and insurance provisions of this contract; this will be from RFP Sections 3.22 (Indemnification) and 3.22 (Insurance Requirements). |
| • | Article 2.3 Appendix C sets forth the services to be performed by the contractor; the information included in this appendix will be drawn directly from the RFP and is drafted following successful negotiations. |
| • | Article 2.4 Appendix D sets forth the provisions for payment; the information included in this appendix will be drawn directly from the RFP and successful offeror’s cost proposal and is drafted following successful negotiations. |
| • | Article 2.5 Appendix E governs the use of Protected Health Information under this contract and is included as Attachment 7: A7 - 2024-1600-0249-1624-020 Appendix E SOA DOH HIPAA Business Associate Agreement. Please see RFP Section 6.04 for further information. |
| • | Article 2.6 Appendix F is the Information Security Agreement and is included as Attachment 8: A8 - 2024-1600-0249-1624-020 Appendix F HIPAA and HITECH Information Security Agreement (ISA v241014) |
Attachments are listed and may be accessed at the bottom of the RFP posting.
| 39 | General | The State has indicated they want a single proposal from respondents, and this single proposal should include information for both a vendor hosted and a CDC hosted solution. If the state wants a two-option approach on one proposal will the state increase the page limits for each section? As it stands, we are unable to appropriately and accurately outline both a vendor hosted and CDC hosted solution in a single response with the current page limit. | The offeror must provide a single proposal for a vendor hosted solution in accordance with Section 3.02 and 3.03. Any CDC hosted solution in the future will be dealt with in accorance with Section 3.19 - Anticipated Amendments. Submittal Form I - Cost Proposal has been modified accordingly and is the version (A3 - 2024-1600-0249-1624-020 Submittal Form I - Cost Proposal v2) that must be submitted by the offeror. |
| 40 | General | How does the State anticipate paying for the hosting of the supporting systems that will be required? Also, how does the State want respondents to indicate different pricing structures and pricing cost for a vendor vs. CDC hosted solution? It seems as though we should only submit 1 pricing outline. The pricing sheet as constructed does not allow respondents to edit or add detail into the outline to differentiate between hosted models. | See answer to the previous question. |
| 41 | General | The State mentions that “depending on the availability of the CDC cloud, the hosting component of the proposal may not be needed/awarded.” However, also stated above, the State has indicated that it understands vendor hosting will be required for both a vendor hosted NBS or a CDC hosted NBS. Without the ability to submit separate pricing models or the ability tothe pricing template, how does the State wish for respondents to outline and explain the different hosting models? | See answer to the previous question. |
File details come from the government source that posted it. Updated .