RFP 2914 OHM Exhibit A Bidder Response.xlsx
XLSX spreadsheet 292 KB Posted
- Solicitation number
- RFP 2914
- Issued by
- Adams County, Asotin County, Benton County, Chelan County, Clallam County, Clark County, Columbia County, Cowlitz County, Douglas County, Ferry County, Franklin County, Garfield County, Grant County, Grays Harbor County, Island County, Jefferson County, King County, Kitsap County, Kittitas County, Klickitat County, Lewis County, Lincoln County, Mason County, Okanogan County, Pacific County, Pend Oreille County, Pierce County, San Juan County, Skagit County, Skamania County, Snohomish County, Spokane County, Stevens County, Thurston County, Wahkiakum County, Walla Walla County, Whatcom County, Whitman County, Yakima County, Asotin City, Clarkston City, Clarkston Heights-Vineland CDP, West Clarkston-Highland CDP, Benton City, Chelan City, Chelan Falls CDP, Clallam Bay CDP, Lewisville CDP, Rock Island City, Pacific Beach CDP, Whidbey Island Station CDP, Mercer Island City, Pacific City, Bainbridge Island City, Kingston CDP, Kitsap Lake CDP, Kittitas City, Klickitat CDP, Okanogan City, Anderson Island CDP, Fort Lewis CDP, Fox Island CDP, Herron Island CDP, Ketron Island CDP, North Fort Lewis CDP, Raft Island CDP, Stevenson City, Hat Island CDP, Lake Stevens City, Snohomish City, Spokane City, Spokane Valley City, Puget Island CDP, Garfield Town, Yakima City, Washington
About this file
This document is a Request for Proposal (RFP) issued by the Employee Health Centers of the Environmental Health & Safety Department of the University of Washington (UW EH&S), University of Washington Medical Center (UWMC), Harborview Medical Center (HMC), Northwest Hospital (NWH), and UW Medicine Primary Care (Primary Care), collectively referred to as the "Agency". The Agency is seeking proposals from vendors to provide an enterprise-wide Occupational Health Management (OHM) system for occupational health records that meets the business and security requirements of the Agency and HIPAA. The solution must store and maintain demographic and employee health information, such as immunization, TB testing, and bloodborne pathogen exposure records for staff, faculty, volunteers, medical residents, and contract staff.
The RFP outlines detailed functional, technical, and security requirements for the OHM system, including support for configuring an unlimited number of primary risk groups, recording various occupational health data, providing an employee portal, and interfacing with other systems such as the Washington State Immunization Information System. The RFP also includes instructions for the bidding process, reference requirements, and pricing details. The successful bidder will be awarded a contract to implement and maintain the OHM system for the Agency.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| RFP 2914 OHM AMEND 1_FINAL.docx | DOCX document | |
| RFP 2914 OHM AMEND 3_FINAL.pdf | ||
| RFP 2914 Attachment C UWM Responses.pdf | ||
| RFP 2914 OHM AMEND 2_FINAL.docx | DOCX document | |
| RFP 2914 Occupational Health Mgmt Replacement.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
UWM Overview Background The Employee Health Centers of the Environmental Health & Safety Department of the University of Washington (UW EH&S), University of Washington Medical Center (UWMC), Harborview Medical Center (HMC), Northwest Hospital (NWH), and UW Medicine Primary Care (Primary Care) collectively herein called the "AGENCY," are initiating this Request for Proposals (RFP) to solicit proposals from vendors interested in providing an enterprise-wide Occupational Health Management system.
The Agency has oversight over a wide range of workplaces throughout a large public research university, with three main campuses and a number of field locations, as well as the UW Medicine healthcare system, including three major hospital campuses, over 80 ambulatory clinics, and multiple other physical office locations. The diversity of workgroups is significant, requiring specialized medical management requirements for healthcare, dental school, veterinary and animal care environments, biohazardous research, construction and maintenance, hazardous material response, and scientific diving, among others.
The Agency has used the Occupational Health Manager (OHM) electronic medical record (EMR) database since February 2005 (purchased in May 2004). OHM holds demographic and employee health information, such as immunization, TB testing, and blood borne pathogen exposure records for the staff, faculty, volunteers, medical residents, and contract staff. OHM is currently hosted on UW Medicine servers. It currently serves over 30,000 employees, plus additional students, volunteers, and trainees.
The Occupational Health Management (OHM) system currently in use at the University is at the end-of-service-life as deemed by the vendor and has several inefficiencies that translate to operational inefficiencies in the employee health areas.
This procurement seeks proposals to implement an electronic medical record (EMR) system for occupational health records that meets the business and security requirements of the Agency and HIPAA.
Purpose UW Medicine is seeking to establish a contract with a qualified and experienced Bidder to provide an enterprise-wide electronic Occupational Health Management system for occupational health records that meets the business and security requirements of the Agency and HIPAA. The solution must store and maintain demographic and employee health information, such as immunization, TB testing, and blood borne pathogen exposure records for the staff, faculty, volunteers, medical residents, and contract staff.
1-Instructions
| Instructions | |
| Section | Information |
| 2-Current State | Review the current state diagram to understand our current system configuration and integrations with other systems. |
| 3.2-References | Enter the contact information for 3 references and provide contact information for the project manager bidder is assigning to this RFP. |
| 4.3.1-Minimum Requirements | Complete the Minimum Requirements section first. These required criteria must be satisfied for the bidder to be considered for the RFP. |
| 4.3.2-Bidder Qualifications | If Bidder successfully meets Minimum Requirements criteria, complete these sections. |
| 4.3.3-Functional Requirements | |
| 4.3.4-Technical Requirements | |
| 4.3.5-Security Requirements | |
| 4.4-Pricing |
2-Current State UW / UW Medicine Current State Data Flow Context Diagram (DFD)
3.2-References
| Bidder to Complete Sections in Yellow | ||
| If Bidder Successfully Meets All Minimum Requirements in Tab 4.3.1, Complete Section Below | Vendor Response |
(Completed by Vendor)
| ID | Question | |||
| 3.2.8 | Reference 1: include description of engagement, professional fees, duration and date of completion, contact person, title, mailing address, telephone number, and current email address. | Description of Engagement | Professional Fees, Duration / Date of Completion | Contact person, Title |
Mailing address Telephone number Current email address.
3.2.8 Reference 2: include description of engagement, professional fees, duration and date of completion, contact person, title, mailing address, telephone number, and current email address. Description of Engagement Professional Fees, Duration / Date of Completion Contact person, Title Mailing address Telephone number Current email address.
3.2.8 Reference 3: include description of engagement, professional fees, duration and date of completion, contact person, title, mailing address, telephone number, and current email address. Description of Engagement Professional Fees, Duration / Date of Completion Contact person, Title Mailing address Telephone number Current email address.
3.2.10 Provide Bidder Project Manager Name, Address, Phone, Fax, Email Bidder Project Manager Name:
Address:
Phone:
Fax:
Email:
Phone:
4.3.1-Minimum Requirements Bidder to Complete Sections in Yellow Bidder must meet below ALL Minimum Requirements for further consideration in RFP
ID Minimum Requirement Qualifications Vendor Response (Yes/No)
| 4.3.1.1 | Experience: Bidder has at least three (3) years' experience implementing software solution to large medical institutions. |
| 4.3.1.2 | Experience: Three (3) years demonstrated effectiveness in maintaining an occupational health management database that is continually monitored and updated on receipt of new information relating to lab test results and immunizations. |
| 4.3.1.3 | Experience: Bidder has successfully implemented their solution to a minimum of 3 large healthcare institutions including modules supporting Employee Demographics and Employee Health Compliance Monitoring. |
| 4.3.1.4 | Legal: Your organization is licensed to do business in the State of Washington or provide a commitment that it will become licensed in Washington within thirty (30) calendar days of being selected as the Apparent Successful Vendor. |
| 4.3.1.5 | Legal: Bidder has had no contracts terminated for default during the five (5) years immediately preceding the date of this RFP. Termination for default is defined as notice to stop performance due to the Bidder's non-performance or poor performance. |
| 4.3.1.6 | Legal: Bidder is not currently in the process of negotiating for divestiture, transfer of operating rights or licensure to third parties for the company or the software development and support functions for the relevant product/solution components. |
| 4.3.1.7 | Demographic and Employee Health Information: The bidder's solution includes occupational health management software designed to simplify and automate the process of maintenance & storage of Employee Demographic and Health Information including but not limited to: |
o Recording occupational health evaluations o Medical clearances o Surveillance for different workplace exposure risk groups based on activities and regulatory requirements.
o Recording occupational health medical evaluations o Surveillance for different workplace exposure risk groups based on activities and regulatory requirements.
4.3.1.8 Unlimited Primary Risk Groups: The bidder's solution supports the ability to configure an unlimited number of primary risk groups and assign one or more risk groups to an individual with individual medical management strategies, such as:
o Healthcare workers o Biohazardous or infectious disease researchers o Construction and maintenance staff, inclusive of regulated building materials work o Hazardous materials emergency responders o Scientific divers o Animal care and use workers
4.3.1.9 Recording Immunizations, Exposures, Specialized health Parameters: The bidder's solution supports the following but are not limited to:
o Recording Immunizations (e.g., Hepatitis B, COVID-19, influenza) o Recording TB Testing and symptom screening results o Ability to satisfy TB screening/surveillance requirements, both initially and recurring.
o Recording Bloodborne Pathogen Exposure Records for Staff, Faculty, Volunteers, Medical Residents, Students and Contract Staff, and be able to control access to view this data by user role.
o Recording other infectious agent, hazardous chemical and radiological exposure records for personnel Staff, Faculty, Volunteers, Medical Residents, Students and Contract Staff o Recording specialized occupational health parameters for individuals, such as respirator medical clearance and fit testing data, and audiometric test results for hearing loss prevention o Ability to create custom occupational health indicators for compliance tracking for indicators not pre-defined within the application environment.
o Track all vaccinations, periodic surveillance (including questionnaires/clearance forms), and any custom defined occupational health indicators and automatically send next due dates to employees.
o Track unique surveillance criteria for each entity or workgroup
4.3.1.10 Employee Access Portal: The bidder's solution Includes an employee portal, enabling employees to:
o Access their own immunization records, occupational medical exam and clearance records and results.
o Schedule appointments o See questionnaire completion status o Monitor their compliance o Upload immunization records o Submit health questionnaires
4.3.1.11 Compliance Follow-up Rules: The bidder's solution includes configurable compliance rules and automated follow-up including but not limited to:
o Ability to define and configure Compliance Rules and define rules for follow-up o Utility program to re-calculate "next due" dates if the rules change
4.3.1.12 Document Upload: The bidder's solution allows scanning or uploading documents directly to the employee profile.
| 4.3.1.13 | User Interface: System is fully web-based and can be accessed via Microsoft Edge, Chrome or Safari browser and requires no PC software installation (or thick client.) |
| 4.3.1.14 | Remote Access: The application is accessible remotely & via Virtual Provide Network (VPN) |
| 4.3.1.15 | Multi-Factor Authentication: The application supports multi-factor authentication. (e.g. Duo, Azure MFA, Google Authenticator, OTP, etc.) |
| 4.3.1.16 | Single Sign On: The web-based interface supports authentication, including standards-based single-sign-on (SSO.) |
| 4.3.1.17 | Integration/Interfaces: System supports both batch file import/export integration as well as real-time integration via standard API's. Including but not limited to importing |
o Demographics data through background jobs or direct interface from multiple HR and other internal University systems (examples may include but are not limited to Workday and SailPoint Identity and Access Management System).
o Immunization information from the Washington State Immunization Information System (WAIIS)
4.3.1.18 Reporting / Auditing: The bidders solution allows for advanced report writing capabilities such as SQL Reporting Services (SSRS)
| 4.3.1.19 | Data: All customer data is extractable and/or made available to the customer |
| 4.3.1.20 | Auditing: System provides |
o An electronic audit trail of access to all users who have accessed or updated a provider record, including date and time stamps, and location of access.
o Ability to generate an audit log showing user access to change and review specific data to allow monitoring compliance to data access regulations.
o Ability to generate reports that flag suspicious access activity for review.
4.3.1.21 Accessibility: New Department of Justice rules for Title II of the ADA require all web content at the UW, including that generated by third party applications, to be fully compliant with WCAG 2.1 Level AA by June 24, 2026.
Do you commit that the application is accessible to users with disabilities as defined by the W3C Web Content Accessibility Guidelines (WCAG) 2.1, Level AA, (see Exhibit D Section 9 2.1 UNIVERSITY OF WASHINGTON - IT ACCESSIBILITY RIDER 1.1);
Or if not, do you agree that you can commit to attaining WCAG 2.1 Level AA compliance (or ensure that all show-stopper issues* identified by the UW Accessibility Team will be corrected) before the planned UW product launch in 2025 [exact date TBD].
*Show-Stopper Issue: High impact priority 1 issues that must be fixed before the application is deployed in production. These are issues that will impact a significant number of users in essential tasks.
4.3.2-Bidder Qualifications Bidder to Complete Sections in Yellow If Bidder Successfully Meets All Minimum Requirements in tab 4.3.1 Complete Section Below ID Question Vendor Response (Completed by Vendor)
| 4.4.2.1 | Who is the primary contact for this proposal? Provide the contact's name, email address, and phone number. |
| 4.4.2.2 | Please describe the pricing model including licensing (per seat, per CPU, per named user etc.) Are users licensed per named users, number of concurrent users, or other? |
| 4.4.2.3 | Describe the company, organization, officers or partners, number of employees and operating policies which would affect this Contract. State the number of years the organization has been continuously engaged in business. |
| 4.4.2.4 | How many employees does your organization have? What is your total staff including non-employees (i.e. contract staff)? |
| 4.4.2.5 | What strategic partnerships are relevant to your solution? Who are your major investors? |
| 4.4.2.6 | Does your organization have any conflict of interest with University of Washington? If so, please describe. |
| 4.4.2.7 | Where is your "primary" location for the following groups: Sales & Marketing, Technical Support, Corporate. |
| 4.4.2.8 | How long has your solution been available on the market? What is the history of your solution, was it acquired or developed in-house within your organization? |
| 4.4.2.9 | Describe the three to five most significant features of your development plans for your product and services for the next three years: |
| 4.4.2.10 | Please list the number of installed clients using this product/solution/module. |
| 4.4.2.11 | In the last year how many implementations have you had for the proposed solution? |
How large were the organizations? Were they hospitals or health plans?
| 4.4.2.12 | Is your company willing to state in the contract that you are not currently in the process of negotiating for divestiture, transfer of operating rights or licensure to third parties for the company or the software development and support functions for the relevant product/solution components? |
| 4.4.2.13 | List the product/solution name and version of the product/solution or product/solutions you are proposing. |
| 4.4.2.14 | Please describe your solution in detail (including key modules, software, hardware components). |
| 4.4.2.15 | How many organizations are currently using your solution? How many of those are healthcare organizations? How many academic research institutions? |
| 4.4.2.16 | Please provide metrics from existing customers showing how much your solution has helped reduce the time healthcare professionals spend on documentation. |
| 4.4.2.17 | Describe your three-year solution roadmap, & scheduled delivery date for each new solution. Please list your most current new product & solution enhancements related to this RFP. |
| 4.4.2.18 | Diversity, equity, and inclusion (DEI) are priorities at UW Medicine. Describe your organization's approach to DEI, in particular with regard to hiring practices. |
| 4.4.2.19 | Do you have a business relationship with a third party accessibility consultant? If so, please describe the nature of that relationship, including the services they provide, and the frequency with which you receive those services. |
| 4.4.2.20 | Do you have a documented and implemented process for verifying accessibility compliance? If so, please describe. |
| 4.4.2.21 | Have you adopted a technical or legal accessibility standard of conformance for the product in question? If so, please describe. |
| 4.4.2.22 | Can you provide a current, detailed accessibility roadmap with delivery timelines? |
| 4.4.2.23 | Do you expect your staff to maintain a current skill set in IT accessibility? If so, please describe. |
| 4.4.2.24 | Can all functions of the application or service be performed using only the keyboard? If not, please describe any limitations. |
| 4.4.2.25 | Does your product rely on activating a special ‘accessibility mode’ or accessing an alternate interface for accessibility purposes? If so, please describe. |
| 4.4.2.26 | Please provide a brief description of your implementation approach/methodology from kickoff to post-implementation |
| 4.4.2.27 | Describe the resources included from your organization for implementation. What resources will be needed from the customer? |
| 4.4.2.28 | Please provide a narrative telling us how you will develop a future state solution plan specific to our needs. Describe your assessment process including data mapping, understanding of functional requirements etc. |
| 4.4.2.29 | How many releases in the past are you able to continue to support before a client must upgrade to remain on the support contract? |
| 4.4.2.30 | How is it determined when project milestones have been met? For example, when project Design phase is completed, is this determined by your team, the customer or both? What are the milestone you track for implementation? |
| 4.4.2.31 | What type of support is typically provided by your company during the initial deployment phase? Is customization (if required) considered part of the initial deployment and would there be additional cost for customization? |
| 4.4.2.32 | Can you support installing hot-fixes between releases? |
| 4.4.2.33 | Please describe service level agreements regarding guaranteed response time to critical issues / unexpected downtimes. |
| 4.4.2.34 | Please describe your service desk model and hours of availability. |
| 4.4.2.35 | Describe how your organization elicits feedback from clients and prioritizes requested enhancements. |
| 4.4.2.36 | Please provide a complete list of all manuals / guides for the proposed product/solutions. |
| 4.4.2.37 | Is documentation embedded within the product/solution? How do end-users access your “Help”? |
| 4.4.2.38 | Please describe the training approach as part of the implementation |
| 4.4.2.39 | Please provide a detailed training plan for implementation and what on-going education/training is included. |
| 4.4.2.40 | Please provide a sample implementation plan and timeline, including detail for number of trainers, training method, post-implementation support. |
&"-,Bold Italic"&12&A
Page &P of &N
4.3.3-Functional Requirements Bidder to Complete Sections in Yellow If Bidder Successfully Meets All Minimum Requirements in tab 4.3.1 Complete Section Below ID Questions: Does your solution include the following features?
Note: When evaluating responses in Exhibit A Tab 4.3.3-Functional Requirements, UW Medicine will rank RFP Bidders that support Configurable Commercial Off the Shelf (COTS) solutions higher than bidders whose solutions require custom development. Solutions must be Generally Available (GA) and cannot be in an Alpha or Beta release phase. Vendor Response Out of the Box - functionality is supported through generally available software release or standard no-code configuration Supported via Customization - functionality is available but requires custom software development Not supported - functionality is not supported Text Response - If there is no drop-down value, some fields may require a text response.
4.3.3.1 Maintenance and storage of demographic and employee health information including but not limited to:
o Recording occupational health medical evaluations, medical clearances, and surveillance for different workplace exposure risk groups based on activities and regulatory requirements.
4.3.3.1.1 The ability to configure an unlimited number of primary risk groups and assign one or more risk groups to an individual with individual medical management strategies which include but are not limited to:
o Healthcare workers
| 4.3.3.1.2 | o Biohazardous or infectious disease researchers |
| 4.3.3.1.3 | o Construction and maintenance staff, inclusive of regulated building materials work |
| 4.3.3.1.4 | o Hazardous materials emergency responders |
| 4.3.3.1.5 | o Scientific divers |
| 4.3.3.1.6 | o Animal care and use workers |
| 4.3.3.2 | Recording Immunizations (e.g., Hepatitis B, COVID-19, influenza) |
| 4.3.3.3 | Recording TB Testing and symptom screening results |
| 4.3.3.4 | Ability to satisfy TB screening/surveillance requirements, both initially and recurring. |
| 4.3.3.5 | Collecting and recording COVID-19 PCR and Serology test results |
| 4.3.3.6 | Recording Bloodborne Pathogen Exposure Records for Staff, Faculty, Volunteers, Medical Residents, Students and Contract Staff, and be able to control access to view this data by user role. |
| 4.3.3.7 | Recording other infectious agent, hazardous chemical and radiological exposure records for personnel Staff, Faculty, Volunteers, Medical Residents, Students and Contract Staff |
| 4.3.3.8 | Recording specialized occupational health parameters for individuals, such as respirator medical clearance and fit testing data, and audiometric test results for hearing loss prevention |
| 4.3.3.9 | Recording workplace injuries and occupational health assessments of workplace related injuries, illnesses, and incidents for OSHA record keeping compliance |
| 4.3.3.10 | Ability to create custom occupational health indicators for compliance tracking for indicators not pre-defined within the application environment. |
| 4.3.3.11 | Batch assign surveillance to employees when there is an exposure |
| 4.3.3.12 | Batch archives terminated employees |
| 4.3.3.13 | Track all vaccinations, periodic surveillance (including questionnaires/clearance forms), and any custom defined occupational health indicators and automatically send next due dates to employees. |
| 4.3.3.14 | Includes automatic notifications for almost-due and overdue vaccinations or assessments via email to employee and manager/supervisor |
| 4.3.3.15 | Modify vaccination due dates based on individual needs, including those for Hepatitis B, Mpox and Vaccinia, etc. |
| 4.3.3.16 | Utility program to re-calculate "next due" dates if the rules change |
| 4.3.3.17 | Automatically generates user-composed configurable reminders for exposure, injury and illness follow-up, vaccinations, tests and procedures |
| 4.3.3.18 | Includes an employee portal, enabling employees to: |
a. access their own immunization records, occupational medical exam and clearance records and results.
b. schedule appointments
c. see questionnaire completion status
d. monitor their compliance
e. upload immunization records
f. submit health questionnaires
| 4.3.3.19 | Ability to create custom consent forms and e-signing |
| 4.3.3.20 | Ability to create custom questionnaires and allow employees to fill and file them online |
| 4.3.3.21 | Scan or upload documents directly into employee profile |
| 4.3.3.22 | Allows managers and administrators to access compliance reports (both at a population and at an individual level), workplace medical clearance/restriction status and other information through a portal |
| 4.3.3.23 | Ability to define and configure Compliance Rules and define rules for follow-up |
| 4.3.3.24 | Tracks unique surveillance criteria for each entity or workgroup |
| 4.3.3.25 | Imports demographics data through background jobs or direct interface from multiple HR and other internal University systems (examples may include but are not limited to Workday and SailPoint Identity and Access Management System) |
| 4.3.3.26 | Ability to exchange demographic and compliance information with partner organizations external to UW via API or CSV exchanges, enabling organizations to request and exchange information about their respective employees. |
| 4.3.3.27 | Interfaces with UW Lab Medicine SunQuest system |
a. Results returned to employee health system electronically from Lab SunQuest
4.3.3.28 Interfaces with UW Lab Medicine SunQuest system
b. Send requisitions to LabSunquest electronically.
| 4.3.3.29 | Interfaces with Epic radiology module to receive radiology results |
| 4.3.3.30 | Interfaces with Washington State Immunization Information System (WAIIS) |
| 4.3.3.31 | Record employee incident management documentation including encounters, progress records, and tracking to allow for public records requests - OR - Mechanism to integrate with existing employee incident management systems. |
| 4.3.3.32 | Ability to affiliate departmental/unit financial information with an individual receiving services in order to accurately perform affiliated cost transfers/charge for services. |
| 4.3.3.33 | Robust report utility with user subscription features |
| 4.3.3.34 | Creates reports that show visual distinction between compliance and non-compliance |
| 4.3.3.35 | Generates / customizes immunization reports, including reports for the National Healthcare Safety Network (NHSN) by entity, department, or clinic |
| 4.3.3.36 | Allows for advanced report writing capabilities such as SQL Reporting Services (SSRS) |
| 4.3.3.37 | Ability to configure dashboards for compliance monitoring to allow managers to monitor their team’s compliance, and demographic information. |
| 4.3.3.38 | Ability to generate an audit log showing user access to change and review specific data to allow monitoring compliance to data access regulations. Ability to generate reports that flag suspicious access activity for review. |
| 4.3.3.39 | What features not already mentioned in the above requirements does the solution support which we may find useful now or in the future? (You may add additional lines below, one for each major feature) |
&"-,Bold Italic"&12&A
4.3.4-Technical Requirements Bidder to Complete Sections in Yellow If Bidder Successfully Meets All Minimum Requirements Complete Section Below
| ID | Technical Requirement Description | Vendor Response |
| 4.3.4.1 | Describe the application management interface (Web based GUI, Thick Client, Command Line, etc.), what are the requirements for user access? | |
| 4.3.4.2 | Is the end user interface supported in a Citrix VDI environment? | |
| 4.3.4.3 | Can the application be accessed for data entry, data view or management from a mobile device? If so, is it accessible using an Apple iOS device? Other devices? | |
| 4.3.4.4 | Please describe the architecture of the application. | |
| 4.3.4.5 | What level of reliability (in terms of unexpected downtime hours per year) is supported with the proposed architecture of the application? | |
| 4.3.4.6 | What specific network connectivity is required for this application to function? Are specialized network segments required? What bandwidth and response times are necessary for the application to function? If the application is internet facing, what specific requirements (e.g. load balancing, strong authentication, etc.) are needed to support the application? | |
| 4.3.4.7 | How is the application delivered to end users? Indicate if it is web based (what browser types and versions are supported and indicate if the application is HTML 5 compliant)? Or, if it is an installed windows application, can it be delivered via Citrix XenApp or a similar mechanism? If software installation is required at the end device (end user’s PC), can the software be packaged; and if so, with which packaging utilities? | |
| 4.3.4.8 | What are the supported recovery mechanisms if data loss or corruption were to occur? What is the risk to data loss? | |
| 4.3.4.9 | What types of monitoring/alerting are required and/or supported for this application? What methods are provided or suggested to identify a loss of service of the application or its necessary components? Does the application produce system logs or any other diagnostic data? If so, what tools are available to analyze those logs and/or data? | |
| 4.3.4.10 | Describe the process of a major application upgrade. What is the typical client effort required and what is the typical duration of an upgrade from upgrade kickoff to go-live? | |
| 4.3.4.11 | How is authentication supported in the application? Is Active Directory integration supported? Is AWS or Azure supported? What levels of authorization are available and what tools are available to add/change/modify/remove users or privileges within the application? Can these processes be automated? | |
| 4.3.4.12 | What are the supported SLAs (especially response time, call back time, resolution target time) for vendor support? How are incidents classified? Are there differences in support during normal business hours and after hours? What client technical requirements are required or recommended for support (e.g. VPNs, client hosted connection server, etc.)? | |
| 4.3.4.13 | What technologies will the system use for data integration? | |
| 4.3.4.14 | Is the integration available in both real time & batch? How often do you send and receive the data? (Real-time, hourly, daily, weekly etc.) | |
| 4.3.4.15 | How many transmissions do you expect for each interface (per day or per week or per month) between this system and each of the UW Medicine systems integrated with it? | |
| 4.3.4.16 | Does your product require any third-party software or open source products not included within license? | |
| 4.3.4.17 | Are there any dependencies on third-party tools or products to enable integration such as an interface engine, middleware, servers, secure portals, and other downstream peers? | |
| 4.3.4.18 | Will you as the vendor develop & implement the required interfaces as part of the implementation? | |
| 4.3.4.19 | Have you implemented this system Integration with an Academic Research Medical Center or a large multi-hospital healthcare organization or University? | |
| 4.3.4.20 | Have you implemented this system integration with any organization with Epic EHR? | |
| 4.3.4.21 | Does this system require any special network connectivity besides TCP, UDP and ICMP? | |
| 4.3.4.22 | Describe your remote access needs into UW Medicine networks to support the system / monitor your device? If remote access is needed, then can you support site to site VPN and/or individual user access VPN? | |
| 4.3.4.23 | How are inbound connections authenticated? | |
| 4.3.4.24 | Are all inbound and outbound connections encrypted? | |
| 4.3.4.25 | Is the application Hosted, On-Premise or SaaS? | |
| 4.3.4.26 | Does this device or application communicate PHI o PII? | |
| 4.3.4.27 | Is there a retention module? If yes, can retention be configured? | |
| 4.3.4.28 | Does your system have an electronic audit trail of access to all users who have accessed or updated a patient record, including date and time stamps, and location of access? | |
| 4.3.4.29 | Is any of the content in the system stored by the vendor? If yes, where does the vendor store the content? | |
| 4.3.4.30 | Will any content be purged over time? If yes, please describe. | |
| 4.3.4.31 | In the future, if UWM decides not to continue using the system or application, can long-term access to the content be ensured? (i.e. the system or application is required to access the content) | |
| 4.3.4.32 | Can content be uploaded to, or downloaded (or exported) from the system or application? Please list all file formats, i.e. JPEG, TIFF, PDF, Word, Excel, various video file formats, etc. | |
| 4.3.4.33 | Does the system or application connect to any other system(s) or application(s)? If yes, list which systems and indicate if the system is 1) reading content, 2) uploading content, 3) downloading (or exporting) content from the other system(s) or application(s)? | |
| 4.3.4.34 | Can all content be extracted from the system or application? | |
| 4.3.4.35 | Does the application require any peripheral device/equipment to be connected to a physical desktop device? If yes, what are the attached devices? What are the connectivity requirements? |
4.3.5-Security Requirements Bidder to Complete Sections in Yellow If Bidder Successfully Meets All Minimum Requirements in tab 4.3.1 Complete Section Below
| Number | Technical Requirement Description | Vendor Response |
| 4.3.5.1 | Describe how the product encrypts data within the database (at rest). How are encryption keys secured? Are backups also encrypted? | |
| 4.3.5.2 | Does the device, application, or system communicate or store PII or PHI? | |
| 4.3.5.3 | Will all UWM information be processed and transmitted ONLY within the United States? | |
| 4.3.5.4 | Does your organization have a data privacy policy? | |
| 4.3.5.5 | Describe or provide a reference to system capability to: |
1) log security/authorization changes
2) monitor user and administrator security events (i.e. physical or electronic) (e.g. login failures, access denied, changes, type of change)
3) log include specific user, date/time of changes, and originating IP or device
| 4.3.5.6 | How long does the application keep access/change logs? |
| 4.3.5.7 | What confidential information does your system require, and how do you protect this information? |
| 4.3.5.8 | Do you have a business continuity plan and is there a documented communication plan in your BCP for impacted clients? |
| 4.3.5.9 | Do you carry cyber-risk insurance to protect against unforeseen service outages, data that is lost or stolen, and security incidents? |
| 4.3.5.10 | Are you willing to agree to a supplemental data processing agreement (DPA) stating that you take responsibility to protect the privacy of ePHI / PII? |
| 4.3.5.11 | Describe the role-based access control capabilities of the product for authorizing users. |
| 4.3.5.12 | Do you conform with a specific industry standard security framework? (e.g. NIST Cybersecurity Framework, ISO 27001, etc.). If yes, please explain. |
| 4.3.5.13 | Have you had a significant breach in the last 5 years? |
| 4.3.5.14 | Can you provide a FERPA compliance attestation documenting that the software meets FERPA compliance standards? |
| 4.3.5.15 | Can you provide a HIPAA compliance attestation document and/or are you willing to enter into a Business Associate Agreement (BAA)? |
| 4.3.5.16 | Can you provide contractual guarantee to provide updates, software releases and upgrades to ensure HIPAA/HITECH compliance and/or other regulations for academic organizations with no cost? |
| 4.3.5.17 | Do you support role-based access control (RBAC) for end-users and/or system administrators? |
| 4.3.5.18 | Does the application comply with FedRAMP standards? |
| 4.3.5.19 | Does the application comply with HITRUST standards? |
| 4.3.5.20 | Does the application comply with PCI DSS standards? |
| 4.3.5.21 | Does your application and/or user-frontend/portal support multi-factor authentication? (e.g. Duo, Azure MFA, Google Authenticator, OTP, etc.) |
| 4.3.5.22 | Does your application support integration with other authentication and authorization systems? List which ones (such as Active Directory, Kerberos and what version). |
Does the system (servers/infrastructure) support external authentication services (e.g. Active Directory, ADFS, LDAP) in place of local authentication?
| 4.3.5.23 | Does your system have the ability to mask sensitive data based on user role such as social security number? |
| 4.3.5.24 | Does your web-based interface support authentication, including standards-based single-sign-on (e.g. SAML)? |
| 4.3.5.25 | Are all inbound and outbound connections encrypted? How is data encrypted in transport (e.g. system-to-client, in-transit)? What encryption technologies are used when transmitting sensitive information over TCP/IP networks (e.g., SSH, SSL/TLS, VPN)? (e.g. system-to-system and system-to-client) |
| 4.3.5.26 | Please list what third party audit reports, certifications, or attestations are conducted covering privacy, security and IT operations and processes, including risk assessment and risk management process; application security, data collection, use, disclosure, storage and destruction policies; software development life cycle; breach/Incident response process; privacy and security awareness training for anyone who handles data; and contingency plan for data recovery in case of an emergency. |
| 4.3.5.27 | What are your incident response processes including breach reporting priorities, response, and reporting times? Include compliance considerations. |
| 4.3.5.28 | Will the solution support UW data ownership and ability to migrate the data to a legacy data management system or other future state system should UW decide to move to another solution at some point in the future? |
| 4.3.5.29 | Describe or provide a reference to the overall system and/or application architecture(s), including appropriate diagrams. Include a full description of the data/data flow communications architecture for all components of the system. |
| 4.3.5.30 | Do you employ or allow any cryptographic modules that do not conform to the Federal Information Processing Standards (FIPS PUB 140-2)? |
4.4-Pricing Bidder to Complete Sections in Yellow If Bidder Succesfully Meets All Minimum Requirements Complete Section Below
| Costs | Item | Year 1 Fees | Year 2 Fees | Year 3 Fees |
| One-time costs | Vendor Professional Services for Implementation (discovery, build, testing, training, stabilization) | |||
| Other one-time costs | ||||
| Total one-time costs |
| Recurring costs | Licenses for 12 months |
| Hosting the solution | |
| Technical and End-user support | |
| Other recurring costs | |
| Total recurring costs |
On-Demand costs Professional services for additional customizing the solution (hourly rate)
| Is licence policy based on Named Users or Concurrent Users? | |
| Describe the user licensing pricing structure | |
| Please provide Total Estimated Licensing Costs for Year 1 | |
| NOTES | |
| UWM Current Number of Users | 25 Concurrent Max (with hundreds of individual occassional / seasonal users) |
| UWM Current Number of Transactions per Month | In 2023, the number of encounters* across all UW clinics was |
• Total: 91,207
• Ave/Month: 7600
• Ave/Day: 250 *UW clinics process much of their work in units called “Encounters”. An encounter is, essentially, an interaction with an employee and might indicate a vaccination, a titer evaluation, a fit-test, or any of a hundred different types. A given encounter could represent 5 minutes of time with a person, or 45 minutes, and could include creation of dozens of related DB records, so the number of encounters doesn’t perfectly represent work load, but I believe it is the basic unit in the OHM system indicating use of the system.
Lookups
| Functionality |
| Out of the Box |
| Supported via Customization |
| Not Supported |
Pricing
| Solution Pricing | ||
| Please clearly define all expected costs for our enterprise. This shall include acquisition, implementation and all costs incurred throughout the term of the system’s projected use. Include any costs which, as a result of experience in the industry, understanding of the environment of our organization and of the systems proposed. The cost section should clearly and succinctly separate one-time and implementation/installation costs from recurring costs. Costs should include a breakdown of installation and ongoing expenses, by application if appropriate. | ||
| Summarized Proposed Costs | ||
| Infrastructure & Application | Description | Cost |
| Hardware | ||
| Software | ||
| On-going License fees. (Describe if it is volume based or other)? | ||
| Implementation costs (Describe what is included) | ||
| Consulting costs (Describe what is included) | ||
| Project related travel and lodging costs billed to customer | ||
| Training costs (include detailed description of what is included) | ||
| Initial Maintenance and support costs | ||
| Ongoing Maintenance and support costs |
Additional information/comments:
| Application Support | ||
| (Any additional costs not included in maintenance costs noted above) | Description | Cost |
| Application & Technical support: | ||
| Additional information/comments: |
| Application Interfaces Cost | Description | Cost |
| Please indicate acquisition and/or licensing cost for application or integration interfaces |
| Operational system tools | Description | Cost |
| Please indicate any system monitoring and management tools your solution includes as well as associated pricing (including automated system backup, performance dashboards, etc.) | ||
| Supplemental information to be supplied with your response | ||
| Provide an executive summary of your solution proposal. Please include summary of assumptions used to generate your proposal |
&"-,Bold Italic"&12&A image1.png
File details come from the government source that posted it. Updated .