RFP 2914 OHM Exhibit A Bidder Response.xlsx

XLSX spreadsheet 292 KB Posted

Attached to
Occupational Health Management (OHM) Replacement Project
Solicitation number
RFP 2914
Issued by
Adams County, Asotin County, Benton County, Chelan County, Clallam County, Clark County, Columbia County, Cowlitz County, Douglas County, Ferry County, Franklin County, Garfield County, Grant County, Grays Harbor County, Island County, Jefferson County, King County, Kitsap County, Kittitas County, Klickitat County, Lewis County, Lincoln County, Mason County, Okanogan County, Pacific County, Pend Oreille County, Pierce County, San Juan County, Skagit County, Skamania County, Snohomish County, Spokane County, Stevens County, Thurston County, Wahkiakum County, Walla Walla County, Whatcom County, Whitman County, Yakima County, Asotin City, Clarkston City, Clarkston Heights-Vineland CDP, West Clarkston-Highland CDP, Benton City, Chelan City, Chelan Falls CDP, Clallam Bay CDP, Lewisville CDP, Rock Island City, Pacific Beach CDP, Whidbey Island Station CDP, Mercer Island City, Pacific City, Bainbridge Island City, Kingston CDP, Kitsap Lake CDP, Kittitas City, Klickitat CDP, Okanogan City, Anderson Island CDP, Fort Lewis CDP, Fox Island CDP, Herron Island CDP, Ketron Island CDP, North Fort Lewis CDP, Raft Island CDP, Stevenson City, Hat Island CDP, Lake Stevens City, Snohomish City, Spokane City, Spokane Valley City, Puget Island CDP, Garfield Town, Yakima City, Washington

About this file

This document is a Request for Proposal (RFP) issued by the Employee Health Centers of the Environmental Health & Safety Department of the University of Washington (UW EH&S), University of Washington Medical Center (UWMC), Harborview Medical Center (HMC), Northwest Hospital (NWH), and UW Medicine Primary Care (Primary Care), collectively referred to as the "Agency". The Agency is seeking proposals from vendors to provide an enterprise-wide Occupational Health Management (OHM) system for occupational health records that meets the business and security requirements of the Agency and HIPAA. The solution must store and maintain demographic and employee health information, such as immunization, TB testing, and bloodborne pathogen exposure records for staff, faculty, volunteers, medical residents, and contract staff.

The RFP outlines detailed functional, technical, and security requirements for the OHM system, including support for configuring an unlimited number of primary risk groups, recording various occupational health data, providing an employee portal, and interfacing with other systems such as the Washington State Immunization Information System. The RFP also includes instructions for the bidding process, reference requirements, and pricing details. The successful bidder will be awarded a contract to implement and maintain the OHM system for the Agency.

View the file

Other files

File Type Posted
RFP 2914 OHM AMEND 1_FINAL.docx DOCX document
RFP 2914 OHM AMEND 3_FINAL.pdf PDF
RFP 2914 Attachment C UWM Responses.pdf PDF
RFP 2914 OHM AMEND 2_FINAL.docx DOCX document
RFP 2914 Occupational Health Mgmt Replacement.docx DOCX document

On GovTribe

Work with this file

  • Download the original file
  • Contacts named in this file
  • Similar government files
  • Ask GovTribe AI about this file

Text version

UWM Overview Background The Employee Health Centers of the Environmental Health & Safety Department of the University of Washington (UW EH&S), University of Washington Medical Center (UWMC), Harborview Medical Center (HMC), Northwest Hospital (NWH), and UW Medicine Primary Care (Primary Care) collectively herein called the "AGENCY," are initiating this Request for Proposals (RFP) to solicit proposals from vendors interested in providing an enterprise-wide Occupational Health Management system.

The Agency has oversight over a wide range of workplaces throughout a large public research university, with three main campuses and a number of field locations, as well as the UW Medicine healthcare system, including three major hospital campuses, over 80 ambulatory clinics, and multiple other physical office locations. The diversity of workgroups is significant, requiring specialized medical management requirements for healthcare, dental school, veterinary and animal care environments, biohazardous research, construction and maintenance, hazardous material response, and scientific diving, among others.

The Agency has used the Occupational Health Manager (OHM) electronic medical record (EMR) database since February 2005 (purchased in May 2004). OHM holds demographic and employee health information, such as immunization, TB testing, and blood borne pathogen exposure records for the staff, faculty, volunteers, medical residents, and contract staff. OHM is currently hosted on UW Medicine servers. It currently serves over 30,000 employees, plus additional students, volunteers, and trainees.

The Occupational Health Management (OHM) system currently in use at the University is at the end-of-service-life as deemed by the vendor and has several inefficiencies that translate to operational inefficiencies in the employee health areas.

This procurement seeks proposals to implement an electronic medical record (EMR) system for occupational health records that meets the business and security requirements of the Agency and HIPAA.

Purpose UW Medicine is seeking to establish a contract with a qualified and experienced Bidder to provide an enterprise-wide electronic Occupational Health Management system for occupational health records that meets the business and security requirements of the Agency and HIPAA. The solution must store and maintain demographic and employee health information, such as immunization, TB testing, and blood borne pathogen exposure records for the staff, faculty, volunteers, medical residents, and contract staff.

1-Instructions

Instructions
SectionInformation
2-Current StateReview the current state diagram to understand our current system configuration and integrations with other systems.
3.2-ReferencesEnter the contact information for 3 references and provide contact information for the project manager bidder is assigning to this RFP.
4.3.1-Minimum RequirementsComplete the Minimum Requirements section first. These required criteria must be satisfied for the bidder to be considered for the RFP.
4.3.2-Bidder QualificationsIf Bidder successfully meets Minimum Requirements criteria, complete these sections.
4.3.3-Functional Requirements
4.3.4-Technical Requirements
4.3.5-Security Requirements
4.4-Pricing

2-Current State UW / UW Medicine Current State Data Flow Context Diagram (DFD)

3.2-References

Bidder to Complete Sections in Yellow
If Bidder Successfully Meets All Minimum Requirements in Tab 4.3.1, Complete Section BelowVendor Response

(Completed by Vendor)

IDQuestion
3.2.8Reference 1: include description of engagement, professional fees, duration and date of completion, contact person, title, mailing address, telephone number, and current email address.Description of EngagementProfessional Fees, Duration / Date of CompletionContact person, Title

Mailing address Telephone number Current email address.

3.2.8 Reference 2: include description of engagement, professional fees, duration and date of completion, contact person, title, mailing address, telephone number, and current email address. Description of Engagement Professional Fees, Duration / Date of Completion Contact person, Title Mailing address Telephone number Current email address.

3.2.8 Reference 3: include description of engagement, professional fees, duration and date of completion, contact person, title, mailing address, telephone number, and current email address. Description of Engagement Professional Fees, Duration / Date of Completion Contact person, Title Mailing address Telephone number Current email address.

3.2.10 Provide Bidder Project Manager Name, Address, Phone, Fax, Email Bidder Project Manager Name:

Address:

Phone:

Fax:

Email:

Phone:

4.3.1-Minimum Requirements Bidder to Complete Sections in Yellow Bidder must meet below ALL Minimum Requirements for further consideration in RFP

ID Minimum Requirement Qualifications Vendor Response (Yes/No)

4.3.1.1Experience: Bidder has at least three (3) years' experience implementing software solution to large medical institutions.
4.3.1.2Experience: Three (3) years demonstrated effectiveness in maintaining an occupational health management database that is continually monitored and updated on receipt of new information relating to lab test results and immunizations.
4.3.1.3Experience: Bidder has successfully implemented their solution to a minimum of 3 large healthcare institutions including modules supporting Employee Demographics and Employee Health Compliance Monitoring.
4.3.1.4Legal: Your organization is licensed to do business in the State of Washington or provide a commitment that it will become licensed in Washington within thirty (30) calendar days of being selected as the Apparent Successful Vendor.
4.3.1.5Legal: Bidder has had no contracts terminated for default during the five (5) years immediately preceding the date of this RFP. Termination for default is defined as notice to stop performance due to the Bidder's non-performance or poor performance.
4.3.1.6Legal: Bidder is not currently in the process of negotiating for divestiture, transfer of operating rights or licensure to third parties for the company or the software development and support functions for the relevant product/solution components.
4.3.1.7Demographic and Employee Health Information: The bidder's solution includes occupational health management software designed to simplify and automate the process of maintenance & storage of Employee Demographic and Health Information including but not limited to:

o Recording occupational health evaluations o Medical clearances o Surveillance for different workplace exposure risk groups based on activities and regulatory requirements.

o Recording occupational health medical evaluations o Surveillance for different workplace exposure risk groups based on activities and regulatory requirements.

4.3.1.8 Unlimited Primary Risk Groups: The bidder's solution supports the ability to configure an unlimited number of primary risk groups and assign one or more risk groups to an individual with individual medical management strategies, such as:

o Healthcare workers o Biohazardous or infectious disease researchers o Construction and maintenance staff, inclusive of regulated building materials work o Hazardous materials emergency responders o Scientific divers o Animal care and use workers

4.3.1.9 Recording Immunizations, Exposures, Specialized health Parameters: The bidder's solution supports the following but are not limited to:

o Recording Immunizations (e.g., Hepatitis B, COVID-19, influenza) o Recording TB Testing and symptom screening results o Ability to satisfy TB screening/surveillance requirements, both initially and recurring.

o Recording Bloodborne Pathogen Exposure Records for Staff, Faculty, Volunteers, Medical Residents, Students and Contract Staff, and be able to control access to view this data by user role.

o Recording other infectious agent, hazardous chemical and radiological exposure records for personnel Staff, Faculty, Volunteers, Medical Residents, Students and Contract Staff o Recording specialized occupational health parameters for individuals, such as respirator medical clearance and fit testing data, and audiometric test results for hearing loss prevention o Ability to create custom occupational health indicators for compliance tracking for indicators not pre-defined within the application environment.

o Track all vaccinations, periodic surveillance (including questionnaires/clearance forms), and any custom defined occupational health indicators and automatically send next due dates to employees.

o Track unique surveillance criteria for each entity or workgroup

4.3.1.10 Employee Access Portal: The bidder's solution Includes an employee portal, enabling employees to:

o Access their own immunization records, occupational medical exam and clearance records and results.

o Schedule appointments o See questionnaire completion status o Monitor their compliance o Upload immunization records o Submit health questionnaires

4.3.1.11 Compliance Follow-up Rules: The bidder's solution includes configurable compliance rules and automated follow-up including but not limited to:

o Ability to define and configure Compliance Rules and define rules for follow-up o Utility program to re-calculate "next due" dates if the rules change

4.3.1.12 Document Upload: The bidder's solution allows scanning or uploading documents directly to the employee profile.

4.3.1.13User Interface: System is fully web-based and can be accessed via Microsoft Edge, Chrome or Safari browser and requires no PC software installation (or thick client.)
4.3.1.14Remote Access: The application is accessible remotely & via Virtual Provide Network (VPN)
4.3.1.15Multi-Factor Authentication: The application supports multi-factor authentication. (e.g. Duo, Azure MFA, Google Authenticator, OTP, etc.)
4.3.1.16Single Sign On: The web-based interface supports authentication, including standards-based single-sign-on (SSO.)
4.3.1.17Integration/Interfaces: System supports both batch file import/export integration as well as real-time integration via standard API's. Including but not limited to importing

o Demographics data through background jobs or direct interface from multiple HR and other internal University systems (examples may include but are not limited to Workday and SailPoint Identity and Access Management System).

o Immunization information from the Washington State Immunization Information System (WAIIS)

4.3.1.18 Reporting / Auditing: The bidders solution allows for advanced report writing capabilities such as SQL Reporting Services (SSRS)

4.3.1.19Data: All customer data is extractable and/or made available to the customer
4.3.1.20Auditing: System provides

o An electronic audit trail of access to all users who have accessed or updated a provider record, including date and time stamps, and location of access.

o Ability to generate an audit log showing user access to change and review specific data to allow monitoring compliance to data access regulations.

o Ability to generate reports that flag suspicious access activity for review.

4.3.1.21 Accessibility: New Department of Justice rules for Title II of the ADA require all web content at the UW, including that generated by third party applications, to be fully compliant with WCAG 2.1 Level AA by June 24, 2026.

Do you commit that the application is accessible to users with disabilities as defined by the W3C Web Content Accessibility Guidelines (WCAG) 2.1, Level AA, (see Exhibit D Section 9 2.1 UNIVERSITY OF WASHINGTON - IT ACCESSIBILITY RIDER 1.1);

Or if not, do you agree that you can commit to attaining WCAG 2.1 Level AA compliance (or ensure that all show-stopper issues* identified by the UW Accessibility Team will be corrected) before the planned UW product launch in 2025 [exact date TBD].

*Show-Stopper Issue: High impact priority 1 issues that must be fixed before the application is deployed in production. These are issues that will impact a significant number of users in essential tasks.

4.3.2-Bidder Qualifications Bidder to Complete Sections in Yellow If Bidder Successfully Meets All Minimum Requirements in tab 4.3.1 Complete Section Below ID Question Vendor Response (Completed by Vendor)

4.4.2.1Who is the primary contact for this proposal? Provide the contact's name, email address, and phone number.
4.4.2.2Please describe the pricing model including licensing (per seat, per CPU, per named user etc.) Are users licensed per named users, number of concurrent users, or other?
4.4.2.3Describe the company, organization, officers or partners, number of employees and operating policies which would affect this Contract. State the number of years the organization has been continuously engaged in business.
4.4.2.4How many employees does your organization have? What is your total staff including non-employees (i.e. contract staff)?
4.4.2.5What strategic partnerships are relevant to your solution? Who are your major investors?
4.4.2.6Does your organization have any conflict of interest with University of Washington? If so, please describe.
4.4.2.7Where is your "primary" location for the following groups: Sales & Marketing, Technical Support, Corporate.
4.4.2.8How long has your solution been available on the market? What is the history of your solution, was it acquired or developed in-house within your organization?
4.4.2.9Describe the three to five most significant features of your development plans for your product and services for the next three years:
4.4.2.10Please list the number of installed clients using this product/solution/module.
4.4.2.11In the last year how many implementations have you had for the proposed solution?

How large were the organizations? Were they hospitals or health plans?

4.4.2.12Is your company willing to state in the contract that you are not currently in the process of negotiating for divestiture, transfer of operating rights or licensure to third parties for the company or the software development and support functions for the relevant product/solution components?
4.4.2.13List the product/solution name and version of the product/solution or product/solutions you are proposing.
4.4.2.14Please describe your solution in detail (including key modules, software, hardware components).
4.4.2.15How many organizations are currently using your solution? How many of those are healthcare organizations? How many academic research institutions?
4.4.2.16Please provide metrics from existing customers showing how much your solution has helped reduce the time healthcare professionals spend on documentation.
4.4.2.17Describe your three-year solution roadmap, & scheduled delivery date for each new solution. Please list your most current new product & solution enhancements related to this RFP.
4.4.2.18Diversity, equity, and inclusion (DEI) are priorities at UW Medicine. Describe your organization's approach to DEI, in particular with regard to hiring practices.
4.4.2.19Do you have a business relationship with a third party accessibility consultant? If so, please describe the nature of that relationship, including the services they provide, and the frequency with which you receive those services.
4.4.2.20Do you have a documented and implemented process for verifying accessibility compliance? If so, please describe.
4.4.2.21Have you adopted a technical or legal accessibility standard of conformance for the product in question? If so, please describe.
4.4.2.22Can you provide a current, detailed accessibility roadmap with delivery timelines?
4.4.2.23Do you expect your staff to maintain a current skill set in IT accessibility? If so, please describe.
4.4.2.24Can all functions of the application or service be performed using only the keyboard? If not, please describe any limitations.
4.4.2.25Does your product rely on activating a special ‘accessibility mode’ or accessing an alternate interface for accessibility purposes? If so, please describe.
4.4.2.26Please provide a brief description of your implementation approach/methodology from kickoff to post-implementation
4.4.2.27Describe the resources included from your organization for implementation. What resources will be needed from the customer?
4.4.2.28Please provide a narrative telling us how you will develop a future state solution plan specific to our needs. Describe your assessment process including data mapping, understanding of functional requirements etc.
4.4.2.29How many releases in the past are you able to continue to support before a client must upgrade to remain on the support contract?
4.4.2.30How is it determined when project milestones have been met? For example, when project Design phase is completed, is this determined by your team, the customer or both? What are the milestone you track for implementation?
4.4.2.31What type of support is typically provided by your company during the initial deployment phase? Is customization (if required) considered part of the initial deployment and would there be additional cost for customization?
4.4.2.32Can you support installing hot-fixes between releases?
4.4.2.33Please describe service level agreements regarding guaranteed response time to critical issues / unexpected downtimes.
4.4.2.34Please describe your service desk model and hours of availability.
4.4.2.35Describe how your organization elicits feedback from clients and prioritizes requested enhancements.
4.4.2.36Please provide a complete list of all manuals / guides for the proposed product/solutions.
4.4.2.37Is documentation embedded within the product/solution? How do end-users access your “Help”?
4.4.2.38Please describe the training approach as part of the implementation
4.4.2.39Please provide a detailed training plan for implementation and what on-going education/training is included.
4.4.2.40Please provide a sample implementation plan and timeline, including detail for number of trainers, training method, post-implementation support.

&"-,Bold Italic"&12&A

Page &P of &N

4.3.3-Functional Requirements Bidder to Complete Sections in Yellow If Bidder Successfully Meets All Minimum Requirements in tab 4.3.1 Complete Section Below ID Questions: Does your solution include the following features?

Note: When evaluating responses in Exhibit A Tab 4.3.3-Functional Requirements, UW Medicine will rank RFP Bidders that support Configurable Commercial Off the Shelf (COTS) solutions higher than bidders whose solutions require custom development. Solutions must be Generally Available (GA) and cannot be in an Alpha or Beta release phase. Vendor Response Out of the Box - functionality is supported through generally available software release or standard no-code configuration Supported via Customization - functionality is available but requires custom software development Not supported - functionality is not supported Text Response - If there is no drop-down value, some fields may require a text response.

4.3.3.1 Maintenance and storage of demographic and employee health information including but not limited to:

o Recording occupational health medical evaluations, medical clearances, and surveillance for different workplace exposure risk groups based on activities and regulatory requirements.

4.3.3.1.1 The ability to configure an unlimited number of primary risk groups and assign one or more risk groups to an individual with individual medical management strategies which include but are not limited to:

o Healthcare workers

4.3.3.1.2o Biohazardous or infectious disease researchers
4.3.3.1.3o Construction and maintenance staff, inclusive of regulated building materials work
4.3.3.1.4o Hazardous materials emergency responders
4.3.3.1.5o Scientific divers
4.3.3.1.6o Animal care and use workers
4.3.3.2Recording Immunizations (e.g., Hepatitis B, COVID-19, influenza)
4.3.3.3Recording TB Testing and symptom screening results
4.3.3.4Ability to satisfy TB screening/surveillance requirements, both initially and recurring.
4.3.3.5Collecting and recording COVID-19 PCR and Serology test results
4.3.3.6Recording Bloodborne Pathogen Exposure Records for Staff, Faculty, Volunteers, Medical Residents, Students and Contract Staff, and be able to control access to view this data by user role.
4.3.3.7Recording other infectious agent, hazardous chemical and radiological exposure records for personnel Staff, Faculty, Volunteers, Medical Residents, Students and Contract Staff
4.3.3.8Recording specialized occupational health parameters for individuals, such as respirator medical clearance and fit testing data, and audiometric test results for hearing loss prevention
4.3.3.9Recording workplace injuries and occupational health assessments of workplace related injuries, illnesses, and incidents for OSHA record keeping compliance
4.3.3.10Ability to create custom occupational health indicators for compliance tracking for indicators not pre-defined within the application environment.
4.3.3.11Batch assign surveillance to employees when there is an exposure
4.3.3.12Batch archives terminated employees
4.3.3.13Track all vaccinations, periodic surveillance (including questionnaires/clearance forms), and any custom defined occupational health indicators and automatically send next due dates to employees.
4.3.3.14Includes automatic notifications for almost-due and overdue vaccinations or assessments via email to employee and manager/supervisor
4.3.3.15Modify vaccination due dates based on individual needs, including those for Hepatitis B, Mpox and Vaccinia, etc.
4.3.3.16Utility program to re-calculate "next due" dates if the rules change
4.3.3.17Automatically generates user-composed configurable reminders for exposure, injury and illness follow-up, vaccinations, tests and procedures
4.3.3.18Includes an employee portal, enabling employees to:

a. access their own immunization records, occupational medical exam and clearance records and results.

b. schedule appointments

c. see questionnaire completion status

d. monitor their compliance

e. upload immunization records

f. submit health questionnaires

4.3.3.19Ability to create custom consent forms and e-signing
4.3.3.20Ability to create custom questionnaires and allow employees to fill and file them online
4.3.3.21Scan or upload documents directly into employee profile
4.3.3.22Allows managers and administrators to access compliance reports (both at a population and at an individual level), workplace medical clearance/restriction status and other information through a portal
4.3.3.23Ability to define and configure Compliance Rules and define rules for follow-up
4.3.3.24Tracks unique surveillance criteria for each entity or workgroup
4.3.3.25Imports demographics data through background jobs or direct interface from multiple HR and other internal University systems (examples may include but are not limited to Workday and SailPoint Identity and Access Management System)
4.3.3.26Ability to exchange demographic and compliance information with partner organizations external to UW via API or CSV exchanges, enabling organizations to request and exchange information about their respective employees.
4.3.3.27Interfaces with UW Lab Medicine SunQuest system

a. Results returned to employee health system electronically from Lab SunQuest

4.3.3.28 Interfaces with UW Lab Medicine SunQuest system

b. Send requisitions to LabSunquest electronically.

4.3.3.29Interfaces with Epic radiology module to receive radiology results
4.3.3.30Interfaces with Washington State Immunization Information System (WAIIS)
4.3.3.31Record employee incident management documentation including encounters, progress records, and tracking to allow for public records requests - OR - Mechanism to integrate with existing employee incident management systems.
4.3.3.32Ability to affiliate departmental/unit financial information with an individual receiving services in order to accurately perform affiliated cost transfers/charge for services.
4.3.3.33Robust report utility with user subscription features
4.3.3.34Creates reports that show visual distinction between compliance and non-compliance
4.3.3.35Generates / customizes immunization reports, including reports for the National Healthcare Safety Network (NHSN) by entity, department, or clinic
4.3.3.36Allows for advanced report writing capabilities such as SQL Reporting Services (SSRS)
4.3.3.37Ability to configure dashboards for compliance monitoring to allow managers to monitor their team’s compliance, and demographic information.
4.3.3.38Ability to generate an audit log showing user access to change and review specific data to allow monitoring compliance to data access regulations. Ability to generate reports that flag suspicious access activity for review.
4.3.3.39What features not already mentioned in the above requirements does the solution support which we may find useful now or in the future? (You may add additional lines below, one for each major feature)

&"-,Bold Italic"&12&A

4.3.4-Technical Requirements Bidder to Complete Sections in Yellow If Bidder Successfully Meets All Minimum Requirements Complete Section Below

IDTechnical Requirement DescriptionVendor Response
4.3.4.1Describe the application management interface (Web based GUI, Thick Client, Command Line, etc.), what are the requirements for user access?
4.3.4.2Is the end user interface supported in a Citrix VDI environment?
4.3.4.3Can the application be accessed for data entry, data view or management from a mobile device? If so, is it accessible using an Apple iOS device? Other devices?
4.3.4.4Please describe the architecture of the application.
4.3.4.5What level of reliability (in terms of unexpected downtime hours per year) is supported with the proposed architecture of the application?
4.3.4.6What specific network connectivity is required for this application to function? Are specialized network segments required? What bandwidth and response times are necessary for the application to function? If the application is internet facing, what specific requirements (e.g. load balancing, strong authentication, etc.) are needed to support the application?
4.3.4.7How is the application delivered to end users? Indicate if it is web based (what browser types and versions are supported and indicate if the application is HTML 5 compliant)? Or, if it is an installed windows application, can it be delivered via Citrix XenApp or a similar mechanism? If software installation is required at the end device (end user’s PC), can the software be packaged; and if so, with which packaging utilities?
4.3.4.8What are the supported recovery mechanisms if data loss or corruption were to occur? What is the risk to data loss?
4.3.4.9What types of monitoring/alerting are required and/or supported for this application? What methods are provided or suggested to identify a loss of service of the application or its necessary components? Does the application produce system logs or any other diagnostic data? If so, what tools are available to analyze those logs and/or data?
4.3.4.10Describe the process of a major application upgrade. What is the typical client effort required and what is the typical duration of an upgrade from upgrade kickoff to go-live?
4.3.4.11How is authentication supported in the application? Is Active Directory integration supported? Is AWS or Azure supported? What levels of authorization are available and what tools are available to add/change/modify/remove users or privileges within the application? Can these processes be automated?
4.3.4.12What are the supported SLAs (especially response time, call back time, resolution target time) for vendor support? How are incidents classified? Are there differences in support during normal business hours and after hours? What client technical requirements are required or recommended for support (e.g. VPNs, client hosted connection server, etc.)?
4.3.4.13What technologies will the system use for data integration?
4.3.4.14Is the integration available in both real time & batch? How often do you send and receive the data? (Real-time, hourly, daily, weekly etc.)
4.3.4.15How many transmissions do you expect for each interface (per day or per week or per month) between this system and each of the UW Medicine systems integrated with it?
4.3.4.16Does your product require any third-party software or open source products not included within license?
4.3.4.17Are there any dependencies on third-party tools or products to enable integration such as an interface engine, middleware, servers, secure portals, and other downstream peers?
4.3.4.18Will you as the vendor develop & implement the required interfaces as part of the implementation?
4.3.4.19Have you implemented this system Integration with an Academic Research Medical Center or a large multi-hospital healthcare organization or University?
4.3.4.20Have you implemented this system integration with any organization with Epic EHR?
4.3.4.21Does this system require any special network connectivity besides TCP, UDP and ICMP?
4.3.4.22Describe your remote access needs into UW Medicine networks to support the system / monitor your device? If remote access is needed, then can you support site to site VPN and/or individual user access VPN?
4.3.4.23How are inbound connections authenticated?
4.3.4.24Are all inbound and outbound connections encrypted?
4.3.4.25Is the application Hosted, On-Premise or SaaS?
4.3.4.26Does this device or application communicate PHI o PII?
4.3.4.27Is there a retention module? If yes, can retention be configured?
4.3.4.28Does your system have an electronic audit trail of access to all users who have accessed or updated a patient record, including date and time stamps, and location of access?
4.3.4.29Is any of the content in the system stored by the vendor? If yes, where does the vendor store the content?
4.3.4.30Will any content be purged over time? If yes, please describe.
4.3.4.31In the future, if UWM decides not to continue using the system or application, can long-term access to the content be ensured? (i.e. the system or application is required to access the content)
4.3.4.32Can content be uploaded to, or downloaded (or exported) from the system or application? Please list all file formats, i.e. JPEG, TIFF, PDF, Word, Excel, various video file formats, etc.
4.3.4.33Does the system or application connect to any other system(s) or application(s)? If yes, list which systems and indicate if the system is 1) reading content, 2) uploading content, 3) downloading (or exporting) content from the other system(s) or application(s)?
4.3.4.34Can all content be extracted from the system or application?
4.3.4.35Does the application require any peripheral device/equipment to be connected to a physical desktop device? If yes, what are the attached devices? What are the connectivity requirements?

4.3.5-Security Requirements Bidder to Complete Sections in Yellow If Bidder Successfully Meets All Minimum Requirements in tab 4.3.1 Complete Section Below

NumberTechnical Requirement DescriptionVendor Response
4.3.5.1Describe how the product encrypts data within the database (at rest). How are encryption keys secured? Are backups also encrypted?
4.3.5.2Does the device, application, or system communicate or store PII or PHI?
4.3.5.3Will all UWM information be processed and transmitted ONLY within the United States?
4.3.5.4Does your organization have a data privacy policy?
4.3.5.5Describe or provide a reference to system capability to:

1) log security/authorization changes

2) monitor user and administrator security events (i.e. physical or electronic) (e.g. login failures, access denied, changes, type of change)

3) log include specific user, date/time of changes, and originating IP or device

4.3.5.6How long does the application keep access/change logs?
4.3.5.7What confidential information does your system require, and how do you protect this information?
4.3.5.8Do you have a business continuity plan and is there a documented communication plan in your BCP for impacted clients?
4.3.5.9Do you carry cyber-risk insurance to protect against unforeseen service outages, data that is lost or stolen, and security incidents?
4.3.5.10Are you willing to agree to a supplemental data processing agreement (DPA) stating that you take responsibility to protect the privacy of ePHI / PII?
4.3.5.11Describe the role-based access control capabilities of the product for authorizing users.
4.3.5.12Do you conform with a specific industry standard security framework? (e.g. NIST Cybersecurity Framework, ISO 27001, etc.). If yes, please explain.
4.3.5.13Have you had a significant breach in the last 5 years?
4.3.5.14Can you provide a FERPA compliance attestation documenting that the software meets FERPA compliance standards?
4.3.5.15Can you provide a HIPAA compliance attestation document and/or are you willing to enter into a Business Associate Agreement (BAA)?
4.3.5.16Can you provide contractual guarantee to provide updates, software releases and upgrades to ensure HIPAA/HITECH compliance and/or other regulations for academic organizations with no cost?
4.3.5.17Do you support role-based access control (RBAC) for end-users and/or system administrators?
4.3.5.18Does the application comply with FedRAMP standards?
4.3.5.19Does the application comply with HITRUST standards?
4.3.5.20Does the application comply with PCI DSS standards?
4.3.5.21Does your application and/or user-frontend/portal support multi-factor authentication? (e.g. Duo, Azure MFA, Google Authenticator, OTP, etc.)
4.3.5.22Does your application support integration with other authentication and authorization systems? List which ones (such as Active Directory, Kerberos and what version).

Does the system (servers/infrastructure) support external authentication services (e.g. Active Directory, ADFS, LDAP) in place of local authentication?

4.3.5.23Does your system have the ability to mask sensitive data based on user role such as social security number?
4.3.5.24Does your web-based interface support authentication, including standards-based single-sign-on (e.g. SAML)?
4.3.5.25Are all inbound and outbound connections encrypted? How is data encrypted in transport (e.g. system-to-client, in-transit)? What encryption technologies are used when transmitting sensitive information over TCP/IP networks (e.g., SSH, SSL/TLS, VPN)? (e.g. system-to-system and system-to-client)
4.3.5.26Please list what third party audit reports, certifications, or attestations are conducted covering privacy, security and IT operations and processes, including risk assessment and risk management process; application security, data collection, use, disclosure, storage and destruction policies; software development life cycle; breach/Incident response process; privacy and security awareness training for anyone who handles data; and contingency plan for data recovery in case of an emergency.
4.3.5.27What are your incident response processes including breach reporting priorities, response, and reporting times? Include compliance considerations.
4.3.5.28Will the solution support UW data ownership and ability to migrate the data to a legacy data management system or other future state system should UW decide to move to another solution at some point in the future?
4.3.5.29Describe or provide a reference to the overall system and/or application architecture(s), including appropriate diagrams. Include a full description of the data/data flow communications architecture for all components of the system.
4.3.5.30Do you employ or allow any cryptographic modules that do not conform to the Federal Information Processing Standards (FIPS PUB 140-2)?

4.4-Pricing Bidder to Complete Sections in Yellow If Bidder Succesfully Meets All Minimum Requirements Complete Section Below

CostsItemYear 1 FeesYear 2 FeesYear 3 Fees
One-time costsVendor Professional Services for Implementation (discovery, build, testing, training, stabilization)
Other one-time costs
Total one-time costs
Recurring costsLicenses for 12 months
Hosting the solution
Technical and End-user support
Other recurring costs
Total recurring costs

On-Demand costs Professional services for additional customizing the solution (hourly rate)

Is licence policy based on Named Users or Concurrent Users?
Describe the user licensing pricing structure
Please provide Total Estimated Licensing Costs for Year 1
NOTES
UWM Current Number of Users25 Concurrent Max (with hundreds of individual occassional / seasonal users)
UWM Current Number of Transactions per MonthIn 2023, the number of encounters* across all UW clinics was

• Total: 91,207

• Ave/Month: 7600

• Ave/Day: 250 *UW clinics process much of their work in units called “Encounters”. An encounter is, essentially, an interaction with an employee and might indicate a vaccination, a titer evaluation, a fit-test, or any of a hundred different types. A given encounter could represent 5 minutes of time with a person, or 45 minutes, and could include creation of dozens of related DB records, so the number of encounters doesn’t perfectly represent work load, but I believe it is the basic unit in the OHM system indicating use of the system.

Lookups

Functionality
Out of the Box
Supported via Customization
Not Supported

Pricing

Solution Pricing
Please clearly define all expected costs for our enterprise. This shall include acquisition, implementation and all costs incurred throughout the term of the system’s projected use. Include any costs which, as a result of experience in the industry, understanding of the environment of our organization and of the systems proposed. The cost section should clearly and succinctly separate one-time and implementation/installation costs from recurring costs. Costs should include a breakdown of installation and ongoing expenses, by application if appropriate.
Summarized Proposed Costs
Infrastructure & ApplicationDescriptionCost
Hardware
Software
On-going License fees. (Describe if it is volume based or other)?
Implementation costs (Describe what is included)
Consulting costs (Describe what is included)
Project related travel and lodging costs billed to customer
Training costs (include detailed description of what is included)
Initial Maintenance and support costs
Ongoing Maintenance and support costs

Additional information/comments:

Application Support
(Any additional costs not included in maintenance costs noted above)DescriptionCost
Application & Technical support:
Additional information/comments:
Application Interfaces CostDescriptionCost
Please indicate acquisition and/or licensing cost for application or integration interfaces
Operational system toolsDescriptionCost
Please indicate any system monitoring and management tools your solution includes as well as associated pricing (including automated system backup, performance dashboards, etc.)
Supplemental information to be supplied with your response
Provide an executive summary of your solution proposal. Please include summary of assumptions used to generate your proposal

&"-,Bold Italic"&12&A image1.png

File details come from the government source that posted it. Updated .