RFP 2027000072 Data Validation for CHSD Final.pdf

Request for Proposal (RFP)

Prevention Services Division – (PSD)

Data Validation for CHSD - OIT

RFP 2027000072

This solicitation contains instructions governing the proposal to be submitted and the material to be included therein, mandatory requirements which must be met to be eligible for consideration;

and other requirements to be met by each proposal.

TABLE OF CONTENTS

REQUEST FOR PROPOSALS SIGNATURE PAGE EXAMPLE 2

SCHEDULE OF ACTIVITIES 3

SECTION 1: ADMINISTRATIVE INFORMATION 4

SECTION 2: STATEMENT OF WORK 12

SECTION 3: RESPONSE FORMAT 25

SECTION 4: PROPOSAL EVALUATION 27

Attachments & Exhibits

A. Attachments:

1. Attachment 1 - Request for Proposal Signature Page (to be returned)

2. Attachment 2 - Budget / Price Sheet Template

3. Attachment 3 - Proposer Response Template

4. Attachment 4 - System Security Plan

5. Attachment 5 - Data Use Agreement Template

B. Exhibits:

1. Exhibit A, Submission Instructions

2. Exhibit B, Draft Statement of Work

3. Exhibit C, State of Colorado OIT Contract Template

4. Exhibit D, CDPHE Data Management Plan

5. Exhibit E Master Data Inventory

Proposers are urged to read the solicitation document thoroughly before submitting a response. The Vendor Customer Number and F.E.I.N.

referenced above will be used for issuance of award, contracting, and payment for the winning response. Verify that the provided numbers are correct for the entity submitting this response. The FEIN must match VSS registration to be eligible for award.

1. Vendor accepts all Contract/PO Terms and conditions without negotiation: ◻ Yes ◻ No

2. Is your organization submitting any confidential or proprietary information included AS A SEPARATE FILE within the proposal?

◻ Yes ◻ No Any confidential or proprietary information must be kept separate and shall conform to the requirements listed in Section 1 Administrative Information or the proposal may not be considered.

(PLEASE USE ATTACHMENT 1 TO RETURN WITH YOUR RESPONSE - This is the example only)

(EXAMPLE ONLY OF ATTACHMENT 1 ) - REQUEST FOR PROPOSALS – VENDOR INFORMATION /

SIGNATURE PAGE

RFP INFORMATION

RFP # 2027000xxx TITLE: Data Validation for CHDS - OIT

ANTICIPATED INITIAL CONTRACT TERM: ONE (1) Year ANTICIPATED OPTIONAL EXTENSION TERMS: Four (4) One-year extension terms, or a combination of optional extension terms totaling no more than Five (5) years.

IMPORTANT: Proposer Name and the RFP # must be in the file name when the proposal is submitted. For full submission information, see Exhibit A Submission Instructions

For Electronic Submission ONLY: Proposers shall submit proposals WITH One (1) original (signed) version of Attachment 1 via BidNet Direct at: www.bidnetdirect.com//cdphe.

ATTN: Allan Smith, Purchasing Unit Supervisor

EMAIL (INQUIRIES ONLY) TO: allan.smith@state.co.us

PROPOSER’S CONTACT INFORMATION

COMPANY NAME:

CONTACT:

STREET ADDRESS:

PHONE:

CITY/STATE/ZIP:

E-MAIL:

FEIN:

VSS #:

PROPOSER’S AUTHORIZED SIGNATURE

AUTHORIZED SIGNATURE:

PRINTED NAME:

TITLE:

http://www.bidnetdirect.com/cdphe mailto:allan.smith@state.co.us

SCHEDULE OF ACTIVITIES

ACTIVITY DATE/TIME (MST)

RFP Notice Published on VSS and BidNet www.colorado.gov/vss and www.bidnetdirect.com//cdphe

10/16/2026

Prospective Proposers Written Inquiry Deadline (No questions accepted after this date/time; e-mail preferred)

10/28/2026

2:00 PM MDT

Response to Written Inquiries published on Colorado VSS at www.colorado.gov/vss and www.bidnetdirect.com//cdphe

11/4/2026

2:00 PM MST

Bid/Proposal Submission Deadline 12/01/2026

2:00 PM MST

Oral Presentations/Demonstrations/Best and Final Offers 1 To Be Determined

Notice of Award 1 To Be Determined

Initial Contract Period2 7/1/2027-6/30/2028

The resulting contract Initial Contract Term of one (1) year with the option to extend by one (1) year extensions, (or a combination of agreed upon years) for a total potential contract term of Five (5) Years. Although it is anticipated to be a (1) one-year contract, the State reserves the right to extend for up to five

(5) total years.

To Be Determined (TBD)

1 Dates are estimated 2 Initial contract term and option years will be at the discretion of the State in any combination thereof http://www.colorado.gov/vss http://www.colorado.gov/vss

SECTION 1: ADMINISTRATIVE INFORMATION

Issuing Office This Request for Proposals (RFP) is issued by the State of Colorado, Department of Public Health and Environment (CDPHE) Procurement and Contracts Unit, for the benefit of the State of Colorado (State).

The CDPHE Procurement and Contracts Unit and Purchasing Agent listed on the RFP Signature Page is the sole point of contact concerning this RFP. All communication must be directed to the designated Purchasing Agent.

1.1 INVITATION TO SUBMIT PROPOSALS

Please be advised that the Colorado Vendor Self Service (VSS) and BidNet Direct (BidNet) websites are the official sites for all Solicitation information, including Addenda and Modifications.

Though not a requirement, Respondents are encouraged to become a member of VSS and BidNet Direct prior to the submission deadline. Solicitations for most Colorado State Agencies (Agencies), including CDPHE, are posted on VSS. The VSS Help Desk is available Monday through Friday, 8:00 a.m. to 5:00 p.m., local time, phone, 303-866-6464 or email, VSSHelp@state.co.us.

Solicitation details posted on VSS by Agencies for goods, services, and construction are public and do not require registration to view. Should a company opt to register with VSS, it may elect to receive automatic notification in categories of interest. Additionally, there is no cost to register on VSS. However, per Procurement Rule 24-102-202.5-04, Respondents need not be registered with VSS in order to be deemed responsive to this RFP, however, a Proposer must have a current registration on VSS in order to be awarded under this solicitation.

In an effort to expand the potential pool of Respondents to this RFP thus providing the best value for the State, CDPHE is also posting this RFP on BidNet Direct at the link available in the Schedule of Activities or Exhibit A Submission Instructions. Respondents do not need to register on BidNet or pay funds to access the solicitation.

A Proposer must have a current registration on VSS in order to be awarded under this solicitation; however, vendors do not need to be registered to view the solicitation documents. There is no cost to register on Colorado VSS. To become a registered supplier on VSS, please visit www.colorado.gov/vss. To become a registered supplier on BidNet Direct please visit www.bidnetdirect.com//cdphe.

1.2 PROPOSER IDENTIFICATION

All Proposals must include a valid tax identification number for the Proposer. Any Proposer must be a legal entity with the legal right to contract in the State of Colorado. Only the identity of the Proposer will be used to determine the Proposer’s registration status on VSS or BidNet Direct. If a Proposer is owned or controlled by a parent company, the Proposal must also identify the name, main office address, and tax identification number of such parent company.

1.3. WRITTEN INQUIRIES

Proposers may submit written inquiries via email concerning this solicitation to obtain clarifications. The State may not accept inquiries after the date and time indicated in the Schedule of Activities. Inquiries must be made to the designated Purchasing Agent using the contact information appearing on the Signature Page for this RFP. Inquiries must be clearly marked with the RFP number and title. Where appropriate, inquiries should include references to any relevant Section/paragraph of the solicitation.

about:blank about:blank

Responses to Proposers inquiries will be published collectively, as a modification on Colorado VSS and BidNet. Proposers shall not rely on any verbal statements that alter any specification or other term or condition of the solicitation. Such changes are valid only if provided in writing by the Procurement Contact.

1.4. MODIFICATIONS AND / OR SUPPLEMENTAL INFORMATION TO THE SOLICITATION

Any modifications, amendments or supplemental information to the solicitation will be published on Colorado VSS. A modification notice will be published on Colorado VSS in the event that it becomes necessary to revise any part of this solicitation.

It is the Proposer’s sole responsibility to check Colorado VSS on a regular basis, prior to the proposal submission deadline, as this is the primary means for communicating any clarifications or changes to solicitation content, timeline and/or requirements.

1.5. MODIFICATIONS OR WITHDRAWALS OF PROPOSALS

Proposer may modify or withdraw its proposal by written notice to the Procurement Contact prior to the established proposal submission deadline. Withdrawal of a proposer’s proposal following the proposal submission deadline and prior to award, may be allowed, in the State’s discretion. Withdrawal of a proposer’s proposal after award is not allowed. Reference Procurement Rules R-24-103-201-08 and R-24- 103-201-09.

1.6. THE STATE’S RIGHTS

The State reserves the right, in its sole discretion, to waive informalities and minor irregularities in connection with any Proposal received.

In accordance with §24-103-301, C.R.S., and the related Procurement Rules, the State may cancel this solicitation, or any and all proposals may be rejected in whole or in part, without penalty, at any time before a Contract is executed, when it is in the best interest of the State. The reason and documentation supporting the decision to cancel the solicitation or reject proposal(s) shall remain confidential for the lesser of six months or until a Contract(s) is awarded by the State. Reference Procurement Rule R-24-101-401-05.

If the solicitation is cancelled after, proposals are received, the proposals that have been opened shall be retained in the procurement record, or if unopened, they will be disposed of, or returned to the Proposers upon request, at the Proposers’ expense.

1.7. CERTIFICATION OF INDEPENDENT PRICE DETERMINATION

By submitting a Proposal in response to this RFP, each Proposer certifies, and in the case of a joint Proposal each party thereto certifies as to its own organization, that in connection with this procurement:

a. The prices in the Proposal have been arrived at independently, without consultation, communication, or agreement, for the purpose of restricting competition, as to any matter relating to such prices with any other Proposer or with any competitor, other than a joint Proposer;

b. Unless otherwise required by law, the prices which have been quoted in the Proposal have not been knowingly disclosed by the Proposer and will not knowingly be disclosed by the Proposer prior to opening, directly or indirectly to any other Proposer or to any competitor; and

c. No attempt has been made or will be made by the Proposer to induce any other person or firm to submit or not to submit a Proposal for the purpose of restricting competition.

1.7.1. RFP Signature Page Signature Requirements

Each person signing the RFP Signature Page of the Proposal certifies that:

a. The signing individual has the legal authority to bind the Proposer organization to the prices and other obligations offered in the Proposal and that the signing individual has not participated, and will not participate, in any action contrary to the certifications above; and

b. The signing individual is not aware of any person connected with the Proposer organization who has participated in any action contrary to the certifications above; and

c. The signing individual will immediately notify the State if the individual becomes aware of any action by any individual or entity contrary to the certifications above.

A Proposal will not be considered for award where any of the certifications above have been deleted or modified. In the event that any Proposer furnishes with the Proposal a signed statement which sets forth in detail the circumstances of any action contrary to the certifications above, the State may accept such proposal only if the State determines that such disclosure was not made for the purpose of restricting competition.

1.8. PROPRIETARY/CONFIDENTIAL INFORMATION

CDPHE recognizes that some elements of a Proposal may contain proprietary or confidential information.

A Proposer may request confidentiality of information submitted in connection with a Proposal using the following procedure:

a. The Proposer must submit a written request for confidentiality together with its Proposal.

b. The request must state specifically what elements of the Proposal are to be considered confidential and must provide a justification for the request. To the extent that the request includes multiple types of information, the request must include a specific justification for the request as applied to each different type of information requested to be held confidential. Whole sections of the proposal will not be considered as confidential with the exception of references and experiences.

c. Material requested to remain confidential must be separated from the remaining elements of the Proposal and must be readily identified, such as by labeling the pages as “Proprietary/Confidential.”

1.8.1 Disallowed Proprietary/Confidential Information

The State will not consider any requests for confidentiality under the following circumstances:

a. All, or substantially all, of a Proposal is requested to remain confidential.

b. Material requested to be kept confidential is co-mingled with other information in the

Proposal (i.e., is not separated from the remainder of the Proposal as required above).

c. The request concerns price or rate information, or information that will be included in any resulting contract for the goods or services proposed.

d. Whole sections of the proposal. Specific information within any section must be identified and parsed from the proposal as separate and submitted separately in order to be considered for confidentiality.

The CDPHE Procurement Official or delegate will make a written determination regarding any request for confidentiality that complies with the requirements above. In the event that CDPHE denies the Proposer’s request for confidentiality or determines that a request is not in compliance with the requirements of this RFP, a notice of that determination will be sent to the Proposer. Upon notice of such denial, the Proposer may withdraw its entire Proposal. A Proposer’s decision to allow its Proposal to remain under consideration will be considered acceptance of CDPHE’s determination regarding confidentiality.

Nothing in this section prohibits CDPHE from unilaterally determining that any portion of a Proposal should remain confidential, provided that the same criteria for such determination are applied to all proposals submitted under this RFP.

1.9. RFP RESPONSE MATERIAL OWNERSHIP

All material submitted regarding this RFP becomes the property of the State of Colorado. As such, except as provided regarding confidential or proprietary information above, the State of Colorado has the right to use any or all such information or material. The State of Colorado may retain or dispose of all such information or material as is lawfully deemed appropriate.

Except as provided regarding confidential or proprietary information above, all proposals may be reviewed by any person after a Notice of Intent to Make an Award has been issued, subject to the terms of the Colorado Open Records Act (“CORA”), §24-72-200.1, et seq., C.R.S. Proposer expressly agrees that the State of Colorado may use the materials for all lawful State purposes and may make the information available to the public in accordance with the provisions of CORA.

1.10. PROPOSAL PRICING

Price and cost information included in any Proposal must be firm, must be stated in U.S. dollars, and must include all related costs (e.g. surcharges, travel, etc.). Proposed pricing must remain firm during the initial term of the Contract unless otherwise noted in Section 2. Estimated Proposal prices are not acceptable. Any costs not included as part of the Proposal may be disallowed under the contract with the awarded Proposer.

Quantities stated in this RFP or in any Proposal are estimates only. Unless expressly stated otherwise, no volume of goods or services to be purchased can be guaranteed. Pricing may be tiered but may not be contingent upon any unstated assumptions regarding quantities to be purchased. Pricing must include any fees associated with the delivery of the goods or services, including, but not limited to, shipping and installation.

At the request of the State, Best and Final Offers may be considered in determining the awarded Proposer.

Proposals, including Best and Final Offers, shall be firm for a period of not less than one hundred eighty

(180) calendar days from the date of award.

1.11. TAXES

The State of Colorado, as a purchaser, is exempt from all Federal excise taxes under Chapter 32 of the Internal Revenue Code (Registration No. 84-730123K) and from all state and local government use taxes under §39-26-114(a), C.R.S. The State of Colorado’s State and Local Sales Tax Exemption Number is 98- 02565.

Goods and services purchased by a Proposer may be subject to sales tax in certain jurisdictions even though the Proposer is purchasing such goods or services in connection with providing goods or services to the State. Any taxes to which Proposer may be subject will not be reimbursed by the State.

1.12. INSURANCE

Any awarded Proposer shall obtain and maintain at all times during the term of any contract resulting from this RFP insurance in the kinds and amounts outlined in the Model Contract or Purchase Order Terms and Conditions attached with this RFP.

1.13. CONTRACT TERM

Any contract resulting from this RFP will be effective upon approval by the State Controller or designee, or as otherwise allowed by law. The contract performance shall commence upon the effective date of the contract and shall be undertaken and performed in the sequence and manner set forth in the contract. The estimated total term of any resulting contract is stated on the Signature Page for this RFP.

1.14. CONTRACTUAL OFFER AND ACCEPTANCE

1.14.1. Acceptance or Rejection of RFP and Contract Terms

By submitting a Proposal, Proposer acknowledges and accepts all terms and conditions of this RFP unless Proposer’s proposal clearly and unequivocally rejects such term or condition. Failure to clearly articulate any such rejection, or any variation between a Proposal and this RFP, shall be deemed a waiver of any rights to subsequently modify the terms of performance. Rejection of any term or condition of the RFP may be grounds for the state to reject a Proposal or decline to select a Proposal for award.

A Proposal signed by an authorized representative for the Proposer and submitted in response to this RFP shall constitute a binding offer for the State to purchase or otherwise contract for the goods or services proposed therein. Except as modified herein or as agreed to by the State, the Model Contract or Purchase Order Terms and Conditions included with this RFP will be binding upon the awarded Proposer. The contents of the Proposal, including the services of any persons specified, will become contractual obligations of the awarded Proposer if a contract ensues. Failure of the awarded Proposer to accept these obligations in a resulting contract may result in cancellation of the award and such Proposer may be removed from future solicitations.

1.14.2. Proposed Changes to Contract Terms

A Proposal may include proposed changes to the Model Contract language or Purchase Order Terms and Conditions. Each proposed change must include proposed alternative or substitute language. Such proposed changes will not be viewed as rejections of the RFP terms and conditions. General objections or objections indicated to be negotiated subsequent to the award will not be accepted. The State of Colorado, in its sole discretion, may accept or reject proposed changes during the contract negotiation process with the awarded Proposer. The State’s rejection of any proposed change will not alter the awarded Proposer’s obligation to perform subject to the terms of this RFP.

The State of Colorado reserves the right to modify the contract language in response to legislative, budget, or policy changes, or as otherwise required by law. The State reserves the right to clarify terms and conditions not having an appreciable effect on quality, price/cost, risk, or delivery schedule during post-award formalization of the contract.

1.15. AGREEMENT EXECUTION

An awarded Proposer shall have no longer than forty-five (45) calendar days to enter into a contract after being notified of the award by the State. If no contract has been executed after forty-five days and such delay is not the fault of the State, the State may elect to cancel the award. The State may elect to grant the award to the next most responsive Proposer.

The State of Colorado shall not be liable for any costs incurred by any Proposer prior to the execution of a contract. No property interest of any nature shall accrue until a contract is approved by the parties and by the State Controller, or otherwise legally executed as allowed by law.

1.16. INFORMATION SECURITY

All Proposals will be evaluated, in part, based on the Proposer’s willingness and ability to comply with all applicable laws, regulations, rules, policies, procedures, or other requirements concerning the safeguarding of any and all State systems and data. The awarded Proposer will be expected to comply with:

a. All Colorado Office of Information Technology (OIT) policies and procedures which OIT has issued pursuant to §§24-37.5-401 through 406, C.R.S. and 8 CCR §1501-5 and posted at https://oit.colorado.gov/standards-policies-guides/technical-standards-policies

b. All information security and privacy obligations imposed by any federal, state, or local statute or regulation, or by any industry standards or guidelines, as applicable based on the classification of the data relevant to Contractor’s performance under the Contract. Such obligations shall arise from:

i. Health Information Portability and Accountability Act (HIPAA)

ii. IRS Publication 1075

iii. Payment Card Industry Data Security Standard (PCI-DSS)

iv. FBI Criminal Justice Information Service Security Addendum

v. CMS Minimum Acceptable Risk Standards for Exchanges

vi. Electronic Information Exchange Security Requirements and Procedures For State and Local Agencies Exchanging Electronic Information With The Social Security Administration

vii. CIS Center for Internet Security CISecurity.org

viii. NIST Standards: https://csrc.nist.gov/publications/sp800

ix. Clinical Laboratory Improvement Amendment of 1988 (CLIA)

x. National Committee on Clinical Laboratory Standards (NCCLS)

xi. ISO 17025 General Requirements for the Competence of Testing & Calibration Labs

xii. Good Automated Laboratory Procedures (GALP)

xiii. Service Organization Control (SOC2)

xiv. FedRAMP authorization

xv. StateRAMP authorization

The Awarded Proposer shall implement and maintain all appropriate administrative, physical, technical, and procedural safeguards necessary and appropriate to ensure compliance with the standards and guidelines applicable to the performance described in the Proposal.

1.16.1. Additional OIT Security Conditions / Compliance

As a condition of the execution of a contract as a result of this RFP, the Awarded Proposer must provide the State with information reasonably required to assess the Awarded Proposer’s ability to comply with the requirements stated above. At the direction of the Office of Information Technology (“OIT”), such access and information may include:

a. A recent SOC2 Type II audit including, at a minimum, the Trust Principles of Security, Confidentiality, and Availability, or an alternative audit acceptable to OIT.

b. The results of security audits, penetration tests, or vulnerability scans, as requested by OIT or its designee at any time under this Contract;

c. To the extent the Awarded Proposer controls or maintains information systems used in connection with State Records, Awarded Proposer will provide OIT with the results of all security assessment activities when conducted on such information systems, including any code-level vulnerability scans, application level risk assessments, and other security assessment activities as required by this Contract or reasonably requested by OIT. Awarded Proposer will make reasonable efforts to remediate any vulnerabilities or will request a security exception from the State. The State will work with Contractor and OIT to prepare any requests for exceptions from the security requirements described in this Contract and its Exhibits, https://oit.colorado.gov/standards-policies-guides/technical-standards-policies http://cisecurity.org/ https://csrc.nist.gov/publications/sp800 including mitigating controls and other factors, and OIT will consider such requests in accordance with their policies and procedures referenced herein.

1.17 RESERVED

1.18 CONFLICT OF INTEREST DISCLOSURE

Proposers must disclose any potential conflict of interest in connection with a Proposal. A conflict of interest may include, but is not limited to, access to any non-public information regarding the RFP or the subject matter of the RFP by the Proposer, or any of the Proposer’s employees, contractors, or agents, including any individual who may have had access to non-public information in a prior capacity before entering into a relationship with Proposer.

No individual or entity engaged by the State to prepare this RFP or that has otherwise had prior access to the solicitation or to sensitive information related to this procurement process (including, but not limited to the requirements, statement of work, or evaluation criteria), will be eligible to submit or participate in a Proposal in response to this RFP.

If the State determines that a conflict of interest exists, the State, in its sole discretion, may reject any Proposal or cancel the award of a contract. In the event the Awarded Proposer was aware of any conflict of interest prior to the award of the contract and failed to disclose the conflict to the State, the State may terminate the contract for cause.

The provisions of this section regarding disclosure of conflicts of interest to the State must be included in any subcontracts in connection with performance of the work. The language included in any subcontract must preserve the State’s rights to disclosure of conflicts of interest and to termination of the contract on the basis of any unacceptable conflict or failure to disclose any conflict.

1.18.1 Resolution of Controversies

Any controversy in connection with this solicitation or the award of a contract as a result of this RFP shall be resolved according to the provisions of Article 109, Title 24, C.R.S.

1.19 COLORADO BUSINESS REGISTRATION

Within ten (10) business days of the notification of the award of a contract under this RFP, the awarded Proposer must be officially registered with the Colorado Secretary of State’s Office to do business in Colorado. The State may request that the awarded Proposer provide evidence of such registration, as well as other organizing documents such as Articles of Incorporation or By-laws.

1.19.1 Documents After Award

Prior to Contract execution, the awarded Proposer must provide the State with Proof of Good Standing with the Colorado Secretary of State and an insurance certificate documenting coverage according to the Model Contract found as an attachment to this solicitation. Proposers do not need to submit these documents unless they are awarded this solicitation post award.

1.20 PROTESTED SOLICITATIONS AND AWARDS

An aggrieved party may file a protest concerning a material issue(s), at any phase of solicitation, including but not limited to, specifications, award or a disclosure of information marked confidential in the proposal.

The protest shall be submitted to the CDPHE Official within ten (10) business days after such aggrieved person knows, or should have known, of the facts giving rise thereto. Reference §24-109-102, C.R.S., as amended, and Procurement Rule R-24-109-102-01, et seq. Protests should be submitted in writing via email to Chelsea Gilbertson at chelsea.gilbertson@state.co.us.

mailto:chelsea.gilbertson@state.co.us

1.21 ARTIFICIAL INTELLIGENCE

The use of artificial intelligence (AI) must comply with §§6-01-1701, et seq., C.R.S. Additionally, CDPHE has not approved AI for High-Risk use cases as defined in §§6-01-1701, et seq., C.R.S. Intent to use AI or generative AI (GenAI) to meet the requirements of this RFP must be explicitly disclosed along with the AI or GenAI model, product or method intended to be used, if known. The use of AI or GenAI is also subject to publicly available State of Colorado Governor’s Office of Information Technology standards and policies.

Balance of this page intentionally blank

SECTION 2: STATEMENT OF WORK

This section provides the Proposer with a general overview of the requirements contained within this RFP.

Additional information regarding the specific requirements may be contained in any documents attached to this RFP.

2.1. INTRODUCTION

The Colorado Health Systems Directory (CHSD) is a critical data integration and management system created and managed by the Primary Care Office (PCO) under the Prevention Services Division (PSD) within the Colorado Department of Public Health and Environment (CDPHE). The overarching goal of the PCO is to reduce barriers to healthcare access in underserved Colorado communities by assessing the health professional workforce needs and directing incentives, such as loan repayment, to shortage areas across Colorado.

The purpose of the project is to select a Proposer to provide a data validation system accessible via an application program interface (API) that can interface directly with the Colorado Health Systems Directory (CHSD). The proposed system must validate address and individual demographic data and document the data validation accuracy, with the validated data being returned and populated into the CHSD.

2.2. BACKGROUND

The work of the CHSD is essential for the PCO to fulfill its mission, which is driven by federal authority, state statutes, and various grants. The core mandates for the creation and management of the directory include:

Federal Requirements: The PCO, as a funded program of the Health Resources and Services Administration (HRSA) since 1986, is directed to assess communities for primary, oral, and mental health clinician capacity to determine where shortages exist, supporting Health Professional Shortage Area (HPSA) designations. The CHSD is also necessary for conducting predictive modeling for research and policy development, and for monitoring, tracking, and evaluating clinicians who participate in clinician incentive programs.

State Requirements: Colorado statutes mandate the PCO accurately determine where clinician shortages exist and coordinate resources to those areas, a function specifically noted in the statute authorizing the Colorado Health Service Corps (CSHC). Furthermore, House Bill 12-1052 directs the PCO to collaborate with the Division of Professions and Occupations (DORA) to collect, transmit, and analyze health professional licensure data on a statewide basis. More recently, Senate Bill 18-024 directed the PCO to establish state-specific methodologies for designating areas experiencing a shortage of health care or behavioral health care clinicians and to create state-designated HPSAs, with the CHSD serving as the system for storing and analyzing this data.

2.3. MANDATORY MINIMUM REQUIREMENTS

In order to submit a proposal for this RFP, the Proposer shall meet all the requirements listed below.

All mandatory minimum requirements are evaluated based on a pass or fail. All proposals must receive a PASS score in order to be fully evaluated, and the scores totaled for the final award.

1) Be able to perform the work outlined in this RFP and in Exhibit B, Draft Statement of Work.

2) Be capable of operating in a web-based or cloud-based environment.

3) Proposal submission must include a searchable PDF and be in the same section order as the

RFP.

4) Must provide documentation regarding 2.4 below, as requested.

2.4. REFERENCES, EXPERIENCE, AND KEY PERSONNEL

The State reserves the right to use Colorado State Agencies and other state governments as references. In addition to these references, Proposers must include the following with their Proposal:

1) Provide two (2) references, including contact name, individual titles, locations, email address and a current telephone number. The references provided should be associated with work completed corresponding to the nature of the work in scope and size called for in this RFP and Statement of Work.

2) Proposer shall have adequate personnel with the necessary credentials and training to successfully complete the activities in the Draft Statement of Work (Exhibit B) and the requirements of this RFP.

3) Proposer shall have completed a minimum of three (3) projects of similar size and scope within the past five (5) years.

4) Provide samples of work as an example of the experience(s) they meet from list above.

2.5. OVERVIEW AND STATEMENT OF WORK SUMMARY

The successful Proposer shall:

1. Provide CASS-certified address data validation via API

2. Provide validated demographic data via API.

2.5.1 Draft Statement of Work (Exhibit B)

This draft Statement of Work describes the deliverables sought through this RFP and the scope of what the awarded Proposer will be expected to offer through the contract resulting from this RFP.

The Statement of Work is intended to provide interested Proposer with sufficient basic information to submit a proposal. It is not intended to limit a proposal’s content or exclude any relevant or essential data.

2.6. BUDGET (ATTACHMENT 2)

The CDPHE budget for this project is approximately $100,000 annually. The total budget for the five-year period is not expected to exceed $500,000 unless additional funding becomes available.

At the sole discretion of the State, CDPHE may modify the budget depending upon funding availability and proposer performance.

2.7. TIMELINE

The anticipated start date for the executed contract is July 1, 2027 with the initial contract period of July 1, 2027 through June 30, 2028. At the sole discretion of the State and depending upon funding and proposer performance, CDPHE may renew the agreement for up to four (4) additional one (1) year periods, not to exceed five (5) years total. At the sole discretion of the State, CDPHE may modify the dates of the contract.

2.8. KEY TERMINOLOGY

Whenever the following terms are in this document, they have the meaning as outlined below:

1. “Acceptance Criteria” means the standards listed in an order which characterize the Authorized Purchaser’s specific requirements and conditions that must be satisfied by the MSP for the Authorized Purchaser to accept the completed Deliverables.

1) “Acceptance Testing” means testing as described in a Purchase Order to be performed by MSP to determine that deliverable(s) meet the Acceptance Criteria.

2. “Awarded Proposer” means the Proposer(s) whose proposal response the State deems to be most advantageous considering price and the evaluation factors set forth in this RFP.

3. “BidNet Direct” means an alternate website to VSS for RFP’s to be posted along with inquiry responses. Electronic proposal submissions are allowed here.

4. “Business Day” means 8:00 a.m. to 5:00 p.m., Mountain Time, Monday through Friday, excluding State holidays and State mandated office closures.

5. “Contractor” means the Awarded Proposer following the execution of an Enterprise Agreement resulting from this RFP.

6. “Deliverables” means the outcome to be achieved or output to be provided, in the form of a tangible object or software that would be produced as a result of Proposer’s Work as described in a Proposal.

7. “Delivery Schedule” means the schedule(s) for the performance of Work, as set forth in an Order that lists: (1) each Deliverable, including its measurable attributes; (2) payment schedule within each Deliverable, including milestone completion date; and (3) final delivery date for each Deliverable.

8. “Documentation” means an operational description, in written format, of all Work to be performed under an Order, including documents that are Deliverables.

9. “Enterprise Agreement” means the contract resulting from the award under this RFP. An OIT Enterprise Agreement is a contract authorized pursuant to C.R.S. §25-37.5-105 under which various entities may access the good or services described in the agreement at the same prices and on the same terms defined in the Enterprise Agreement.

10. “Errors” mean defect(s) in the Deliverables, Work, or Work Product such that the Work or Work Product does not comply with the specifications set forth in an Order.

11. “Final Acceptance” means the date upon which provides MSP written notice that it has accepted all the Work to be performed, including all Deliverables or when applicable the System to be delivered, including any updates, corrections, or additions to content, and that will make payment for Work performed. The Warranty Period shall commence upon Final Acceptance.

12. “Key Persons” means the State Staff (supervisor or project manager) who will be principally responsible for managing the Services or for performance of Work under an Order and the satisfactory completion, delivery and acceptance of the related Deliverables.

13. “MWBE” means a Minority- or Women-owned Business.

14. “Open Source Software” means one or more of the following: (1) any software that contains or is derived in any manner (in whole or in part) from open source software or software subject to similar licensing or distribution requirements; and (2) any software that requires as a condition of its use, modification or distribution that such software (or other software incorporated into, derived from or distributed with such software) be either (a) disclosed or distributed in source code form; (b) licensed for the purpose of making derivative works; or (c) redistributable at no charge.

15. “Order” means request for work from the awarded vendor by an ordering entity such as OIT, institutions of Higher Education, political subdivisions. A purchase or Task order which may include a statement of work.

16. “PHI” is any information in the medical record or designated record set that can be used to identify an individual and that was created, used, or disclosed in the course of providing a health care service such as diagnosis or treatment.

17. “PII” means personally identifiable information including, without limitation, any information maintained by the State about an individual that can be used to distinguish or trace an individual’s identity, such as name, social security number, date and place of birth, mother’s maiden name, or biometric records; and any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information. PII includes, but is not limited to, all information defined as personally identifiable information in C.R.S.

24-72-501.

18. “Proposal” means a Proposer’s response to this RFP. A Proposal may also be called a bid, response, or offer. If such have been requested and submitted following initial responses, a Proposer’s Proposal shall include any clarifications or any best-and-final offer.

19. “Proposer” means any entity or individual submitting a proposal in response to this RFP.

20. “Request for Proposals” or “RFP” means a procurement solicitation that seeks offers from organizations or individuals to perform the scope of work defined in the RFP, in accordance with the terms listed in the RFP. An RFP is issued with the intent of selecting the most advantageous proposal, making an award to that Proposer, and entering into a contract.

21. “Solicitation” means a document issued by the State of Colorado agency that requests competitive offers from organizations or individuals to sell the goods or services that are specified in the document. A solicitation typically results in an award of a contract or purchase order for the goods or services, based on an award methodology defined in the solicitation.

Types of solicitations include: Requests for Proposals (RFPs), Invitation for Bids (IFBs) and Documented Quotes (DQs).

22. “State” means the State of Colorado.

23. “Statement of Work” means the components of an Order that include but are not limited to an introduction, project objectives, definitions, detailed tasks (and subtasks if needed), measurable Deliverables that correlate with tasks, acceptance criteria, delivery and payment schedule.

24. “System” means one or more of the Authorized Purchaser’s integrated computer software application and database systems that may be modified, converted, created or enhanced by Contractor for Authorized Purchaser under an Order. System includes but shall not be limited to all related technical design documents, software, databases, database schemas, formats, documentation, reports, memoranda, studies, plans, designs, specifications, statements, drawings, materials, exhibits, schedules and other documents or materials, in whatever media, developed by a contractor in the performance of Work under an Order, as more fully described and specified in a Statement of Work.

25. “Vendor” means any organization or individual that seeks to provide, or is already providing, goods or services.

26. “VSS” means The State of Colorado's Vendor Self Service Web site. All solicitations published by State agencies and institutions are published on VSS.

27. “Work” means all work to be performed under an Order, as more fully described in the Exhibits, schedules, and Statements of Work, including but not limited to: related services that support computer software, data processing, know-how transfer, enhancements, business process automation systems, planning, programming, construction, analysis, design, development, project management, testing, risk analysis, quality assurance, integration, training or implementation.

28. “Work Product” means every invention, modification, discovery, design, development, customization, configuration, improvement, process, software program, work of authorship, documentation, formula, datum, technique, know-how, secret, or intellectual property right whatsoever or any interest therein (whether patentable or not patentable or registrable under copyright or similar statutes or subject to analogous protection) that is specifically made, conceived, discovered, or reduced to practice by a contractor or their agents (either alone or with others) pursuant to an Order.

ACRONYMS

Acronym Definition

AAA Authentication, Authorization, and Accounting

ADFS Active Directory Federation Services

ANSI American National Standards Institute

API Application Program Interface

BAFO Best and Final Offer

CCR Code of Colorado Regulations

CDPHE Colorado Department of Public Health and Environment

CIS Center for Internet Security

CORE Colorado Operations Resource Engine

COTS Commercial Off-the-shelf

CSS Cascading Style Sheets

DR Disaster Recover

FTP File Transfer Protocol

GPS Global Positioning System

HTML Hypertext Markup Language

HTTP Hypertext Transfer Protocol

HTTPS Hypertext Transfer Protocol Secure

IaaS Infrastructure as a Service

IAD Information Assurance Directorate

IEC International Electrotechnical Commission

IP Internet Protocol

ISO International Organization for Standardization

IV&V Independent Verification and Validation

JPEG Joint Photographic Experts Group

LAN Local Area Network

LDAP Lightweight Directory Access Protocol

LPHA Local Public Health Agency

MAC Media Access Control

MOTS Modified Off-the-shelf

NAS Network-attached Storage

NIEM National Information Exchange Model

NIST National Institute of Standards and Technology

NSA National Security Agency

ODBC Open Database Connectivity

OIT Colorado Governor’s Office of Information Technology

OS Operating System

OWASP Open Web Application Security Project

PaaS Platform as a Service

PHI Protected Health Information

PII Personal Identifiable Information

PSD Preventative services division

RFC Request for Comments

RFP Request for Proposal

SaaS Software as a Service

SAML Security Assertion Markup Language

SAN Storage Area Network

SDL Security Development Life-cycle

SFTP Secure File Transfer Protocol

SOW Statement of Work

SNMP Simple Network Management Protocol

SQL Structured Query Language

SSL Secure Socket Layer

TCP Transmission Control Protocol

TIFF Tagged Image File Format

TLS Transport Layer Security

UAT User Acceptance Testing

VSS State of Colorado Vendor Self Service

W3C World Wide Web Consortium

XML Extensible Markup Language

2.9. DETAILED DEFINITION OF WORK

The Proposer shall provide CASS certified data validation to include:

i. Address standardization and corrections for

1. Street address

2. City

3. State

4. Zip Code plus 4 coding

5. Append apartment and suite information

6. County

7. Census track

8. Block

9. Rooftop level geo-coding (six (6) digit required, nine (9) digit preferred)

10. Latitude and Longitude

11. Other requests as added by the State of Colorado

The Proposer shall provide ongoing validated demographic data to include:

12. Gender

13. Sex

14. Age and/or date of birth

15. Email address

16. Country of Origin

17. Education Level

18. Other requested as added by the State of Colorado

In the Sections 2.10.1 through 2.13 below, Proposers must provide narrative responses for each numbered section to detail how the Proposal complies for each item using the corresponding Attachment 3 - Proposer Response Template (for return with Proposal).

Where appropriate, provide previous experience, methodology, and plans for delivering on each requirement. In preparing a response for each item below, provide specific examples from previous projects to elaborate on an approach, technology, or technique.

2.10.1 BUSINESS REQUIREMENTS

a. The Proposer’s data standardization and validation system shall have an API that will accept data pushed from a SQL database.

b. The Proposer’s API shall be blind to the format, source and structure of the data.

c. Validated data must meet Coding Accuracy Support System (CASS) standards for addresses.

d. Data standardization and validation shall be able to be conducted on an as-needed basis as files are received and imported into the SQL database. As files are processed through the SQL database, the records will then be pushed via API to the Proposer’s data standardization and validation system.

1) Data standardization and validation will range from hundreds of records per day up to millions of records based on the source of the data imported Proposer must be able to meet State of Colorado Office of Information Technology security standards located at https://oit.colorado.gov/standards-policies-guides/technical-standards-policies

2.10.2. Technical Requirements

1) Describe your capability of supporting production, test, training, and development environments.

2) Describe your solution’s user interface response time. Response should be two seconds or less. Describe how the solution will meet this response requirement as well as methods for verification of performance.

3) Describe how your solution requires users to log on to the system through Directory and cross-domain authentication. The solution should generally support one user, system-wide.

This sign on should include, at a minimum:

a) User classification or role; and

b) Password.

4) Document how your solution is to be configured such that users are notified of impending password expiration. If a user’s password has expired, the system should prompt the user to change the password at sign-on.

2.10.3. System Configuration Requirements

1) Describe your system’s workspace management capability including supporting production, test, training, and development environments.

2) Describe your system's workspace management capabilities as it relates to organizational structures and role-based access control.

3) Describe the role-based user accounts supported by your system, including specific permissions for administration, maintenance, configuration, workflow launch, and viewing.

4) Describe how user groups are defined and access can be assigned at the group level.

2.10.4. System Uptime and Business Continuity Requirements

1) Describe your system for proactive monitoring of platform performance, and the process for announcing major service interruptions, including the minimum notification time provided.

2) Detail the Service Level Agreements (SLAs) offered, including the guaranteed platform uptime and data integrity, the conditions for downtime credits, and any compensation policies for data loss caused by the provider.

2.10.5. Training and Documentation Requirements

1) Describe your solution’s ability to provide users with a highly integrated set of application modules offering a consistent user interface in order to minimize user training and system administration.

2) Describe how your solution provides access to an online user-guide manual that describes fields, forms, and data requirements, as well as procedures and automatic updates of the manual by administrators, including a data directory for all data elements exchanged with CHSD (definitions, formats, and allowable values).

https://oit.colorado.gov/standards-policies-guides/technical-standards-policies

3) Describe your ability to provide a complete set of documentation describing all application components, including validation rules, match logic, confidence thresholds, and the authoritative reference sources used for validation). All documents should be reviewed and approved by CDPHE before acceptance.

4) Describe how knowledge transfer & technical documentation is required of the vendor to State staff.

5) Describe how you will provide the information needed to document your solutions in CDPHE’s data governance records: the CHSD Data Management Plan (DMP), the CDPHE Master Data Inventory (DMI), or both, as directed by the CDPHE Data Governance Manager or the CHSD Lead Data Steward. At a minimum, address how you will provide:

a) A data dictionary…