RFP #30-2026-017-DHB.pdf

Page 1 of 351 RFP #30-2026-017-DHB

STATE OF NORTH CAROLINA

Department of Health and Human Services

Division of Health Benefits

Request for Proposal #30-2026-017-DHB

Provider Data Management Credentialing Verification Organization (PDM/CVO)

Page 2 of 351 RFP #30-2026-017-DHB

STATE OF NORTH CAROLINA

Request for Proposal

#30-2026-017-DHB

For internal State agency processing, please provide your company’s Federal Employer Identification Number or alternate identification number (e.g., Social Security Number). Pursuant to North Carolina General Statute 132-1.10(b) this identification number shall not be released to the public. This page will be redacted before the procurement file is made available for public inspection.

This page is to be filled out and returned with your Proposal.

ID Number:

Federal ID Number or Social Security Number

Offeror Name

Page 3 of 351 RFP #30-2026-017-DHB

EXECUTION

In compliance with this Request for Proposal (RFP), and subject to all the conditions herein, the undersigned Offeror offers and agrees to furnish and deliver any or all services proposed, at the cost proposed and within the time specified herein. By executing this proposal, the Offeror confirms it has read, understands, and will comply with all specifications and requirements in the RFP and any addenda in the event of contract award. By executing this proposal, the undersigned Offeror certifies that this proposal is submitted competitively and without collusion (N.C. Gen. Stat. § 143-54), that none of its officers, directors, or owners of an unincorporated business entity has been convicted of any violations of Chapter 78A of the General Statutes, the Securities Act of 1933, or the Securities Exchange Act of 1934 (N.C. Gen. Stat. § 143-59.2), and that it is not an ineligible Contractor as set forth in N.C. Gen. Stat. § 143-59.1. False certification is a Class I felony. Furthermore, by executing this proposal, the undersigned certifies to the best of Offeror’s knowledge and belief, that it and its principals are not presently debarred, suspended, proposed for debarment, declared ineligible or voluntarily excluded from covered transactions by any Federal or State department or agency. As required by N.C. Gen. Stat. § 143-48.5, the undersigned Offeror certifies that it, and each of its subcontractors, for any Contract awarded as a result of this RFP, complies with the requirements of Article 2 of Chapter 64 of the NC General Statutes, including the requirement for each employer with more than 25 employees in North Carolina to verify the work authorization of its employees through the Federal E-Verify system. N.C. Gen. Stat. § 133-32 and Executive Order 24 (2009) prohibit the offer to, or acceptance by, any State Employee associated with the preparing plans, specifications, estimates for public Contract; or awarding or administering public Contracts; or inspecting or supervising delivery of the public Contract of any gift from anyone with a Contract with the State, or from any person seeking to do business with the State. By executing this proposal, you attest, for your entire organization and its employees or agents, that you are not aware that any such gift has been offered, accepted, or promised by any employees of your organization. Failure to execute/sign proposal prior to submission shall render proposal invalid and it WILL BE REJECTED. Late proposals will not be accepted.

OFFEROR:

STREET ADDRESS: P.O. BOX: ZIP:

CITY & STATE & ZIP: TELEPHONE NUMBER: TOLL FREE TEL. NO:

PRINCIPAL PLACE OF BUSINESS ADDRESS IF DIFFERENT FROM ABOVE

PRINT NAME & TITLE OF PERSON SIGNING ON BEHALF OF OFFEROR: FAX NUMBER:

OFFEROR’S AUTHORIZED SIGNATURE: DATE: EMAIL:

STATE OF NORTH CAROLINA

Department of Health and Human Services

Refer ALL Inquiries regarding this RFP to:

Tyler Ragor Contract Specialist Medicaid.Procurement@dhhs.nc.gov Tyler.ragor@dhhs.nc.gov

Request for Proposal # 30-2026-017-DHB

Date RFP Issued/Posted: 6/12/2026

Date RFP Submissions due to the Department: at 2:00 p.m. EST

Proposals will be opened: at 2:00 p.m. EST

Contract Type: Open Market

Commodity Number: 811620 - Cloud-based software as a service

Description: Provider Data Management/Credentialing Verification Organization (PDM/CVO) Using Agency: Department of Health and Human Services, Division of Health Benefits Requisition No.: N/A mailto:Medicaid.Procurement@dhhs.nc.gov mailto:Tyler.ragor@dhhs.nc.gov

Page 4 of 351 RFP #30-2026-017-DHB

FOR STATE USE ONLY: Offer accepted and Contract awarded this ____ day of _______________, 20____, by

(Authorized Representative of NC Department of Health and Human Services)

Offer valid for at least 240 calendar days from date of proposal opening unless extended by the State in writing. After this time, any withdrawal of offer shall be made in writing, effective upon receipt by the agency issuing this RFP.

ACCEPTANCE OF RESPONSE

If any or all parts of this proposal are accepted by the State of North Carolina, an authorized representative of the Department of Health and Human Services shall affix his/her signature hereto and this document and all provisions of this Request for Proposal along with the Offeror’s proposal, and the written results of any negotiations shall then constitute the written agreement between the parties. A copy of this acceptance will be forwarded to the successful Offeror.

Page 5 of 351 RFP #30-2026-017-DHB

Table of Contents

1.0 General Procurement Information and Notice to Offerors

1.1 Important Notices

1.2 Procurement Information

1.3 Request for Proposal Functionality and Related Notices

1.4 Schedule and Important Events

2.0 Purpose of RFP

2.1 Introduction

2.2 Contract Term

2.3 Contract Type

2.4 Agency Background

3.0 RFP Requirements and Specifications

3.1 Scope Of Work

3.2 General Requirements and Specifications

3.2.1 REQUIREMENTS

3.2.2 Specifications

3.2.3 Site and System Preparation

3.2.4 Equivalent Items

3.2.5 Enterprise Licensing

3.2.6 ENTERPRISE ARCHITECTURE STANDARDS

3.3 Security Specifications

3.4 Enterprise Specifications

3.5 Business and Technical Requirements

3.6 Business and Technical Specifications

3.7 Option Requirements and Specifications - RESERVED

4.0 Cost of Vendor’s Offer

4.1 Offer Costs

4.2 Payment Schedule

5.0 Evaluation

5.1 Source Selection

5.2 Evaluation Criteria

5.3 Best and Final Offers (BAFO)

5.4 Possession And Review

Page 6 of 351 RFP #30-2026-017-DHB

5.5 Competitive Range

5.6 System Demonstrations

6.0 Vendor Information and Instructions

6.1 General Conditions of Offer

6.1.1 Vendor Responsibility

6.1.2 Rights Reserved

6.1.3 Solicitation amendments or revisions

6.1.4 Oral Explanations

6.1.5 E-PROCUREMENT

6.1.6 Electronic Vendor Portal

6.1.7 Protest Procedures

6.2 General Instructions for Vendor

6.3 Instructions for Offer Submission

7.0 Other Requirements and Special Terms

7.1 Vendor Utilization Of Workers Outside of U.S

7.2 Financial Statements

7.3 Financial Resources Assessment, Quality Assurance, Performance and Reliability

7.4 Vendor’s License or Support Agreements

7.5 Resellers - Reserved

7.6 Disclosure Of Litigation

7.7 Criminal Conviction

7.8 Security and Background Checks

7.9 Assurances

7.10 Confidentiality of offers

7.11 Project Management

7.12 Meetings

7.13 Recycling and Source Reduction - Reserved

7.14 Special Terms And Conditions

7.15 Technical Operations

7.16 Help Center

7.17 Testing

7.18 Incident Prioritization

Attachment A: Definitions Attachment B: Department of Information Technology Terms and Conditions

Page 7 of 351 RFP #30-2026-017-DHB

Section 1: General Terms and Conditions Applicable to All Purchases Section 2: Terms and Conditions Applicable to Information Technology Goods and Services Section 3: Terms and Conditions Applicable to Personnel and Personal Services Section 4: Software as a Service (SaaS) Terms and Conditions (Only Applies to Proposed SaaS Solutions) 187

Attachment C: Agency Terms and Conditions Section 1: NCDHHS Department of Health Benefits (DHB) Section 2: NCDHHS Privacy and Security Office (PSO) Section 3: NCDHHS Development of Artificial Intelligence Systems

Attachment D: Description of Offeror Attachment E: Cost Form Attachment F: Vendor Certification Form Attachment G: Location of Workers Utilized by Vendor Attachment H: Vendor References/Past Performance Attachment I: Financial Review Form Attachment J: Enterprise Architecture Attachment K: Vendor Key Personnel Attachment L: Service Level Agreements………………………………………………………………………

Attachment M: Contract Administrators Attachment N: Deliverables And Milestones Schedule Attachment O: Business Continuity Plan Attachment P: Disaster Recovery Plan Attachment Q: State Certifications Attachment R: Federal Certifications Attachment S: Business Associate Agreement Attachment T: Technical / Management Proposal Attachment U: Conceptual Architectural Diagrams Attachment V: Medicaid Integration Services Core Capabilities Attachment W: Work Products Attachment X: Request for Proposed Modifications to The Terms and Conditions Attachment Y: Minimum Qualifications Attachment Z: SUBCONTRACTOR IDENTIFICATION FORM Attachment AA: Reports Attachment AB: Interfaces Attachment AC: GenAI Disclosure and Fact Sheet

Page 8 of 351 RFP #30-2026-017-DHB

1.0 GENERAL PROCUREMENT INFORMATION AND NOTICE TO OFFERORS

1.1 IMPORTANT NOTICES

Offerors are Cautioned to Read Carefully

1.1.1 READ, REVIEW, AND COMPLY

It shall be the Offeror’s responsibility to read this entire document, review all enclosures and attachments, and any addenda thereto, and comply with all requirements specified herein, regardless of whether appearing in these Instructions to Offerors or elsewhere in this RFP document.

1.1.2 EXECUTION OF PROPOSAL

Failure to sign the Execution Page in the indicated space and return all attachments, tables, charts, exhibits, diagrams, and appendices completed and signed where required shall render the proposal non-responsive.

1.1.3 RESULTING CONTRACT

Under the State’s procurement process, any contract resulting from this RFP will consist of the RFP and the Offeror’s response, along with any addenda to the RFP, written Clarifications, Best and Final Offers (BAFO), and negotiation documents. The Contractor will be obligated to perform services as proposed in its offer, unless otherwise modified by Clarification, BAFO, negotiation, or Contract amendment, or superseded by a document with higher order of precedence. See Attachment C: Agency Terms and Conditions, Section 1, Paragraph 14 Entire Agreement and Order of Precedence, of this document for more information and the order of precedence of the contract documents.

See section 1.3 Request for Proposal Functionality and Related Notices in this section for more information on the RFP, changes in specifications, and instructions regarding modifications to the terms and conditions.

1.1.4 POTENTIAL NEGOTIATIONS

The Department reserves the right to enter into negotiations with one or more Offerors to establish a contract that is in the best interest of the Department. Negotiations are specific to each Offer and shall be conducted to maximize the State's ability to obtain the most advantageous offer based on the evaluation factors set forth in the RFP. Such negotiations are at the Department’s sole discretion and may result in modifications to the RFP and/or Offeror’s proposal/response to the RFP.

1.1.5 EVENTS AND DEADLINES

a. Pre-proposal Conference will be hosted by the Department on the date and time indicated in the RFP Schedule in Section 1.4.1.

b. Questions concerning this RFP must be submitted in writing by the date and time indicated in the RFP Schedule in Section 1.4.1.

c. Submission of Proposals will be accepted until the date and time indicated in the RFP Schedule in Section 1.4.1.

Page 9 of 351 RFP #30-2026-017-DHB

1.1.6 BIDDER’S LIBRARY

The Bidder’s Library is a collection of documents, data, and reference materials that the Department provides to prospective Offerors during the Request for Proposal (RFP) process. Its primary purpose is to give Offerors access to relevant background information necessary to develop informed, accurate, and compliant proposals. The contents of the Bidder’s Library are provided solely for informational purposes and will not be included as part of the final contract.

The documents contained in the Bidder’s Library will be available only while the solicitation remains open in the Ariba Sourcing Tool. Offerors are strongly encouraged to review the Bidder’s Library section found in the solicitation in the Ariba Sourcing Tool and download the documents for review and future reference. After the solicitation closes in the Ariba Sourcing Tool, the documents in the Bidder’s Library will no longer be accessible.

The content of the Bidder’s Library reflects the current state of information at the time the RFP is issued and is not guaranteed to be updated throughout the procurement process.

1.2 PROCUREMENT INFORMATION

1.2.1 INFORMATION AND DESCRIPTIVE LITERATURE

The Offeror shall furnish all information requested as part of this RFP. Each Offeror shall submit detailed information with their proposal (e.g., narratives, diagrams, exhibits, examples, sketches, descriptive literature, complete specifications) to support the services and products offered

1.2.2 RESERVED

1.2.3 MISCELLANEOUS

Pronouns, whether masculine, feminine, or gender-non-specific, shall be read to be inclusive of all genders and shall be read to include the plural and vice versa.

1.2.4 INFORMAL COMMENTS

The Department shall not be bound by informal explanations, instructions or information given at any time by anyone on behalf of the Department prior to or during the competitive process or after award, including but not limited to policy papers or any written or verbal statements whatsoever made outside of this RFP and any formal Addenda issued herewith. The Department is bound only by information provided in this RFP and in formal Addenda issued

1.2.5 OFFEROR’S REPRESENTATIVE

Page 10 of 351 RFP #30-2026-017-DHB

Each Offeror shall submit with its proposal the name, title, email address, physical address, and telephone number of the person(s) with authority to bind the Offeror and answer questions or provide clarification concerning the Offeror's proposal. This information must be included in the Offeror’s proposal and response

1.2.6 DISCLOSURE OF ARTIFICIAL INTELLIGENCE (AI) USE–

The Offeror shall disclose whether Artificial Intelligence (AI), including generative AI tools, was used in the preparation of any portion of its response to this RFP. If AI tools were utilized, the Offeror affirms that it has reviewed and verified the accuracy, completeness, and appropriateness of all AI-generated content. The Offeror shall remain solely responsible for the content of its submission, including any errors, omissions, or misrepresentations resulting from the use of AI.

1.3 REQUEST FOR PROPOSAL FUNCTIONALITY AND RELATED NOTICES

1.3.1 RFP FUNCTIONALITY

a. This RFP serves two functions:

i. Define the specifications of the Solution sought by the Department; and

ii. Provide the requirements and terms and conditions of any contract resulting from this procurement.

b. All Terms and Conditions in this RFP shall be enforceable. The use of phrases such as “shall”, “will”, “must”, “required”, and “requirements” are intended to create enforceable Contract conditions. In determining whether proposals should be evaluated or rejected, the Department will take into consideration the degree to which the Offeror has proposed or failed to propose solutions that are responsive to the Department’s needs as described in this RFP.

1.3.2 NOTICES REGARDING RFP AND TERMS AND CONDITIONS

a. It is the Offeror’s responsibility to read all instructions, terms and conditions, specifications, requirements, attachments and appendices, and any other components made a part of this RFP and comply with all instructions and directives. The Offeror is responsible for obtaining and complying with all addenda and other changes that may be issued relating to this RFP.

b. All questions and issues regarding any term, condition, instruction, or other component within this RFP must be submitted in accordance with Section 6.2.2. Questions Regarding this RFP. If the Department determines that any changes will be made because of the questions asked, then such decisions will be communicated in the form of an Addendum posted on the North Carolina electronic Vendor Portal (NC eVP). The Department may also elect to leave open the possibility for later negotiation and amendment of specific provisions of the Contract that have been raised during the question-and-answer period. Other than through this process, and except as provided in Section 1.3.3 Proposed Modifications to Terms and Conditions, the Department rejects and will not be required to evaluate or consider any additional or modified terms and conditions submitted with Offeror’s proposal. This applies to any language appearing in or attached to the RFP document as part of the Offeror’s proposal that purports to vary any terms and conditions, or Offeror’s Instructions therein to render the proposal non-binding or subject to further negotiation.

c. The Offeror’s proposal to this RFP shall constitute a firm offer. By execution and delivery of a proposal to this RFP, the Offeror agrees that any additional or modified terms and conditions, whether submitted purposely or inadvertently, or any purported

Page 11 of 351 RFP #30-2026-017-DHB condition to the offer, shall have no force or effect, and will be disregarded. Noncompliance with, or any attempt to alter or delete, this paragraph shall constitute sufficient grounds to reject the Offeror’s proposal.

1.3.3 PROPOSED MODIFICATIONS TO TERMS AND CONDITIONS

a. Offerors are urged and cautioned to inquire during the question period, in accordance with the instructions in this RFP, about whether specific language proposed as a modification is acceptable to or will be considered by the Department.

b. Identification of objections or exceptions to the terms and conditions in the proposal itself shall not be allowed and shall be disregarded or the proposal rejected.

c. If the Offeror wishes to suggest changes to any of the terms and conditions included In Attachments B and C of this RFP, those must be submitted in Attachment X: Request for Proposed Modifications to the Terms and Conditions. The Department, in its sole discretion, may consider any proposed modifications identified by the Offeror. Where necessary, any modification(s) to the terms and conditions agreed upon by the Department may be incorporated as part of an Addendum to the RFP, BAFO, negotiation document, Execution of Contract, or Contract Amendment after award. Other than through this process, the Department rejects and shall not be required to evaluate or consider any additional or modified terms, conditions, or instructions included in the Offeror’s proposal.

1.3.4 CHANGES IN REQUIREMENTS AND SPECIFICATIONS

a. The Offeror is cautioned that the requirements of this RFP can only be altered by written Addendum issued or other documents issued by the Department as described in this RFP, and that oral or emailed communications from whatever source(s) are of no effect.

b. Any modification to specifications will be specified in an Addendum which shall be posted to the NC eVP prior to the opening of proposals or through Negotiation after opening the proposals.

1.4 SCHEDULE AND IMPORTANT EVENTS

1.4.1 ANTICIPATED PROCUREMENT SCHEDULE

The Department will make every effort to adhere to the schedule detailed below in Table 1.4 1-1: RFP Schedule. The Department reserves the right to adjust the schedule and will post an Addendum on the NC eVP website for any schedule changes occurring prior to the opening of proposals.

Action Responsible Party Due Date Time (ET)

RFP Issued Department 06/12/2026

Register for Pre-Proposal Conference Offeror(s) 06/16/2026 10:00 am

Pre-Proposal Conference Offeror(s) and Department

06/17/2026 2:00 pm

Written Questions Deadline Offeror(s) 06/26/2026 2:00 pm

Page 12 of 351 RFP #30-2026-017-DHB

Action Responsible Party Due Date Time (ET)

Agency’s Response to Written Questions / RFP Addendum Issued

Department 07/17/2026

Proposals Due Offeror(s) 08/21/2026 2:00 pm

Proposals Evaluation Begins Department 08/24/2026

System Demonstrations Offeror(s) 1/5/2027

Estimated Contract Award Department 6/1/2027

Protest Deadline Responding Vendors

15 days after award

Table 1.4 1-1 RFP Schedule

1.4.2 PRE-PROPOSAL CONFERENCE

a. The Department will hold a Pre-proposal virtual Conference on the date and time indicated in the RFP Schedule in Section 1.4.1 for one hour via Microsoft (MS) Teams. No purchase is required to use the MS Teams app.

b. The purpose of the conference is to allow the Department to review key priorities and objectives of the RFP and to review the submission requirements and instructions.

c. While attendees may ask questions at the Pre-proposal Conference, the Department is not required to respond during the conference. The Department will respond to written questions per the process described in this RFP.

d. Potential Offerors are not required to attend the Pre-proposal Conference in order to submit responses to this RFP; however, they are urged and cautioned to attend the Pre-proposal Conference to apprise themselves of the conditions and requirements of the submission.

e. To ensure receipt of the video conference invite and instructions for participation, interested parties are required to pre-register for the conference by sending an email to Medicaid.Procurement@dhhs.nc.gov stating the name of the potential Offeror, the names and email addresses of representatives who will attend, the current title or role of each representative, and requests for a sign language interpreter or other accommodations. Interested parties must pre-register at this email address by the date and time indicated in the RFP Schedule in Section 1.4.1.

f. The Department limits the number of representatives attending on behalf of each Offeror or organization to two (2) representatives to ensure adherence to videoconference capacity limits.

g. Audio and video recording will not be permitted. Statements and materials discussed at the conference are informational only, are not binding upon the Department and do not replace reading, reviewing and complying with this RFP.

Page 13 of 351 RFP #30-2026-017-DHB

h. Attendees will be required to announce their name or otherwise confirm their presence via a roll call during the Pre-Proposal Conference.

2.0 PURPOSE OF RFP

2.1 INTRODUCTION

The Purpose of this Request for Proposal (RFP) is the for the North Carolina Department of Health and Human Services (NCDHHS), Division of Health Benefits (DHB or Department), to solicit offers for the acquisition for the Provider Data Management Credentialing Verification Organization

(PDM/CVO).

Medicaid Integrated Modular Solution (MIMS)

NCDHHS is replacing the Department’s Medicaid Management Information System (MMIS) with a Medicaid Enterprise System (MES), also referred to as the Medicaid Integrated Modular Solution (MIMS). MIMS will be implemented through a multi-phase initiative, the MMIS Replacement Project. The MMIS Replacement Project will implement a series of interrelated modules. These modules will have functionality designated by the Centers for Medicare and Medicaid (CMS) in support of obtaining compliance with Medicaid Information Technology Architecture (MITA) 3.0 Framework and CMS certification for each module.

The future PDM/CVO solution is envisioned as a centralized Provider Data Management/Credentialing Verification Organization (PDM/CVO) solution that will support the Agency’s provider data management functions including data intake, data management, enrollment, credentialing, data sharing and data archiving throughout the provider life cycle. The solution will also meet National Committee for Quality Assurance (NCQA) standards and enhance provider credentialing through centralized CVO features that include a Credentialing Committee and delegated enrollment and credentialing.

The PDM/CVO solution will consist of the below high-level items:

• Consolidate all provider data to reduce administrative redundancy for providers.

• Simplify enrollment, data maintenance and revalidation processes.

• Facilitate centralized credentialing on behalf of NCDHHS payers and health plans.

• Potentially mitigate reimbursement errors caused by outdated provider data.

• Allow for delegated enrollment and credentialing.

• Aligning North Carolina’s credentialing process with NCQA standards.

• Establish a representative centralized Credentialing Committee with representatives from NCDHHS payers and health plans.

The NC MIMS system will modernize and transform North Carolina Medicaid and its sister divisions, including the Division of Mental Health (DMH) and Division of Public Health (DPH). NC MIMS will improve the Provider and Medicaid beneficiary experience across the enterprise.

Page 14 of 351 RFP #30-2026-017-DHB

2.2 CONTRACT TERM

A contract awarded pursuant to this RFP shall have an effective date as provided in the Notice of Award. The initial term shall be five (5) years unless otherwise stated in the Notice of Award and unless otherwise terminated in accordance with the Contract.

2.2.1 OPTIONAL EXTENSIONS

After the initial term, the Department shall have the option to extend the Contract for two (2) additional one (1) year periods at its sole discretion. Each year that the Contract remains in effect shall be a “Contract Year.” The Department will give the Contractor written notice of its intent whether to exercise each option year no later than thirty (30) Calendar Days before the end of the Contract’s then current term.

2.2.2 Effective Date

This solicitation, including any Exhibits, or any resulting contract or amendment shall not become effective nor bind the Department until the appropriate State purchasing authority / official, or Agency official has signed the document(s), contract or amendment; the effective award date has been completed on the document(s), by the State purchasing official, and that date has arrived or passed. The Department shall not be responsible for reimbursing the Vendor for goods provided nor services rendered prior to the appropriate signatures and the arrival of the effective date of the Agreement. No contract shall be binding on the State until an encumbrance of funds has been made for payment of the sums due under the Agreement.

2.3 CONTRACT TYPE

Definite Quantity Contract - This request is for a close-ended contract between the awarded Vendor and the State to furnish a pre-determined quantity of a good or service during a specified period of time.

The State reserves the right to make partial, progressive or multiple awards: where it is advantageous to award separately by items; or where more than one supplier is needed to provide the contemplated specifications as to quantity, quality, delivery, service, geographical areas; and where other factors are deemed to be necessary or proper to the purchase in question.

2.4 AGENCY BACKGROUND

NCDHHS manages the delivery of health- and human-related services for all North Carolinians, especially our most vulnerable citizens – children, elderly, disabled and low-income families. The Department works closely with health care professionals, community leaders and advocacy groups;

local, state and federal entities; and many other stakeholders to make this happen. Within NCDHHS, the Division of Health Benefits is dedicated to providing access to physical and behavioral health care and services to improve the health and well-being of over 3 million North Carolinians.

NCDHHS is replacing the Department’s Medicaid Management Information System (MMIS) with a Medicaid Enterprise System (MES), also referred to as the Medicaid Integrated Modular Solution (MIMS). MIMS will be implemented through a multi-phase initiative, the MMIS

Page 15 of 351 RFP #30-2026-017-DHB

Replacement Project. The MMIS Replacement Project will implement a series of interrelated modules. These modules will have functionality designated by the Centers for Medicare & Medicaid Services (CMS) in support of obtaining compliance with Medicaid Information Technology Architecture (MITA) Framework and CMS certification for each module.

The NC MIMS system will modernize and transform North Carolina Medicaid and its sister divisions, including the Division of Mental Health (DMH) and Division of Public Health (DPH) NC MIMS will improve the Provider and Medicaid beneficiary experience across the enterprise.

3.0 RFP REQUIREMENTS AND SPECIFICATIONS

3.1 SCOPE OF WORK

The Provider Data Management Credentialing Verification (PDM/CVO) solution will replace and modernize provider enrollment and management functionality provided by the legacy MMIS. The PDM/CVO solution will meet North Carolina’s “to be” vision for the Provider Eligibility and Enrollment, Provider Management, Credentialing, as well as other applicable MITA business areas.

The PDM/CVO module will support a web-based self-service tool for providers to electronically sign and submit enrollment applications, complete periodic updates of their enrollment information, and revalidate provider record information. The self-service enrollment and maintenance portal must be configurable by provider criteria that include, at a minimum, provider role (e.g., OPR Rendering, Attending, Billing/Pay-to Providers), provider risk level, and provider classification (e.g., physician-family practice, physician-oncologist, hospital-acute care, nurse practitioner-pediatrics), as well as other required criteria detailed in Section 3.5 Business and Technical Requirements. In addition, the PDM/CVO module must also support provider maintenance activities for external and internal users that are founded on business process driven workflow automation principles.

The web-based application will collect, validate, and maintain the required data:

• To support decisions regarding a provider’s enrollment request or continued participation.

• For provider directories, network adequacy analysis, federal and state compliance reporting, data analytics, claims processing, service authorizations, provider payment, tax and general reporting, use within other MES modules, and other purposes identified by the state.

• To associate providers with multiple networks, healthcare programs, and affiliations as directed by the state and governed by business rules.

The solution will leverage integrated, automated workflow to ensure that data and documentation are routed to the appropriate unit responsible for decisions on provider applications or findings.

A successful Provider Services solution will provide a variety of self-service options with a seamless end-user experience for North Carolina Healthcare Programs providers.

3.1.1 Business Operations

Page 16 of 351 RFP #30-2026-017-DHB

Self-Service Portal The PDM/CVO module must include a Provider Self-Service Portal to support provider enrollment and maintenance activities. The Portal will solicit and receive data entry from applicants and providers according to Business Rules and shall be the primary point of interface between the provider and the PDM/CVO solution. The Portal must:

• Allow providers and potential applicants to learn and understand the process for submitting applications, viewing and updating their data, completing revalidations, and completing any activities required as part of the PDM/CVO solution.

• Allow enrolled providers to review and manage demographic data associated with their records.

• Include other self-service functions necessary to support day-to-day business functions, including but not limited to; a provider inbox, interactive chat functionality, and a provider locator for both public and authenticated users to find actively enrolled providers based on specified criteria.

The web screens that make up the Portal shall be efficient and concise, gathering all information required to complete steps in application processing, enrollment, and data management. Screens and their components will be subject to Department approval.

Refer to 3.1.2 Technical and Information Architecture Requirements for the technical architecture and associated technology requirements for enabling users to seamlessly navigate between the PDM/CVO Self-Service Portal and other MES modules.

Provider Maintenance The PDM/CVO module must support provider maintenance activities for external and internal users that are founded on business process driven workflow automation principles. These activities include the collection, storage, and maintenance of all provider information identified for the operation of the MES. It also requires ongoing, automated provider monitoring necessary to support North Carolina Healthcare Programs business objectives and must be compliant with federal and state statutes, NCQA, policies and mandates.

Credentialing Committee The Vendor is responsible for the operation of an NCQA-compliant Credentialing Committee to evaluate all applicants and providers, including initial enrollments, re-enrollments, revalidations, and data maintenance requests that may require credentialing, as well as ongoing monthly monitoring. The Credentialing Committee shall meet regularly (at least weekly) and make decisions regarding the credentialing status of the provider. The Vendor must provide IT solutions to manage all aspects of the process, provide staffing for operations, and coordinate with multiple payers, health plans, and other stakeholders.

The Vendor must employ a Medical Director, subject to Department approval, who is directly responsible for the operation of the Credentialing Committee and will serve as its chair and voting member, as well as appointing a proxy in their absence. The Medical Director will follow and enforce the Credentialing Committee Bylaws as approved by the Department. The Medical Director must participate in the review of the Credentialing Committee Bylaws, Credentialing Committee operating policy and procedures, recruitment of Credentialing Committee members, and coordination of peer reviewers.

Page 17 of 351 RFP #30-2026-017-DHB

The Vendor must prepare and make electronically available to all committee members a Provider Profile Package for each medium and high-risk provider under consideration, which contains all primary source verifications and supporting documentation. The package will include:

• Provider information - type/specialty, risk level, file ID, review type (application type/ongoing monitoring)

• A brief, objective description of any concerns or findings that elevate the file’s risk status.

• A summary of each of the applicable primary source verification results

• Supporting documentation

Delegated Enrollment and Credentialing Qualifying North Carolina hospitals, large health care systems, and the Cherokee Indian Hospital Authority (CIHA) shall be permitted to perform enrollment and credentialing activities for their own healthcare practitioners.

This will allow hospitals and large health care systems to better manage large volumes of individual providers, reduce administrative burden, accommodate program growth, expedite individual Provider Enrollment and Credentialing, improve efficiency in the credentialing process, increase practitioner satisfaction, remove the NC Application fee for their individual providers, and support centralized credentialing.

The Vendor must provide IT solutions to manage all aspects of allowing delegated entities to:

• Submit a new provider to the PDM.

• Submit a re-enrollment of a terminated provider to the PDM.

• Submit provider data updates to a provider on its roster.

• Identify existing active providers on its roster and the most recent Revalidation completion date.

• Remove a provider from its roster.

The solution must maintain and make affiliations between a delegated entity and its rostered providers viewable to the Department in real time and through standardized reports.

The Vendor is responsible for providing oversight and monitoring of each delegated entity, including:

• A pre-delegation audit that includes a performance and staffing assessment, a policy and procedure review, and a review of the entities understanding and adherence to NCQA, State, Federal enrollment and credentialing requirements and delegation tasks.

• Completion of an annual compliance audit to re-review all the components of the pre-delegation audit, audit 5% of the entity's credentialing and recredentialing files against NCQA, State, and Federal enrollment and credentialing requirements, and create corrective action plans for deficiencies in collaboration with the Department, including revocation recommendations for delegated entity participation.

Page 18 of 351 RFP #30-2026-017-DHB

• The Vendor must report results to the Department for each pre-delegation and annual compliance audit within 30 days of audit completion. If the entity is found to be out of compliance during the audit, the Vendor must report those results to the Department within 10 days of audit completion.

Conduct Federal Site Visit/Screening Verification During the provider enrollment screening process for moderate and high-risk providers, there is a federally mandated requirement for the Agency to conduct an on-site evaluation of the provider. The Vendor’s solutions and services shall include providing staff to act on behalf of the Agency to conduct pre- and post-enrollment on-site screening of the provider. The Vendor will upload the results of the site visit evaluation into the provider’s profile within the PDM/CVO module.

The onsite screening includes:

• Conducting the initial assessment to verify the facility location, hours and personnel.

• Verifying operational status; and

• Confirming final determination of provider enrollment status.

Business Rules The Vendor must create and maintain a business rules repository of requirements applicable to every combination of application classification that the State uses to set provider enrollment requirements. The rules in the repository shall be approved by the State and maintained by the Vendor. The repository sets a hierarchy of provider classifications (healthcare/non-healthcare, in-state/out-of-state/border, business type, provider type, application type, add-ons, etc.) and establishes criteria for the application process for office administration, required provider information, fees, addresses, NPPES (National Plan and Provider Enumeration System) and other external registrations, affiliations, sanctions, care management and other licensing requirements, health plan selection, required attestations and signatures, specialty and supplemental information.

The Vendor must consider, for each business rule: the beginning and end dates for the application of the rule, the conditions that trigger the rule, the actions to be executed when the rule is invoked, any predecessor or successor rules, the sequence of the rule in relation to other rules and the business process as a whole, and the timing of rule invocation and execution. Rules may invoke other rules; the output from one rule may be an input (trigger or values) to other rules.

The Vendor’s solution must control how changes to the rules are made, how rule versions are tracked, how rules are tested in an environment that does not impact production, how test results are presented to the State, how rules are implemented in production after approval by the State, and how rules may be rolled back if production errors occur.

The Vendor must work with the State to identify the specific Business Rules that will be included in the repository, and will develop the processes, logic, and data elements needed to support them. The Vendor must reference existing documentation from the State to create the initial business rules repository during the DDI phase. Business rule documentation can be found in the Bidder’s Library and includes:

• State-approved business rules and job aids

Page 19 of 351 RFP #30-2026-017-DHB

• Most recent version of the legacy system’s Provider Permissions Matrix (PPM) – This Excel file communicates provider enrollment requirements including fingerprinting, site visits, federal fees, licensures, accreditations, and certifications for enrollment participation

• State-approved Application Data files - These word documents detail data fields captured for provider enrollment based on provider enrollment type

The Vendor must add to the business rules repository all rules needed to support its solution and meet all contractual requirements.

The Vendor must provide real time access to the business rules repository, in an electronic format approved by the State, that documents all business rule logic used by the solution.

3.1.2 Technical and Information Architecture Requirements

The Vendor must provide a scalable, cloud-based solution that complies with all applicable federal, state, and Departmental security standards. The proposed solution must deliver the following:

• Interoperability: Support integration with existing enterprise systems and third-party applications through standard APIs and data exchange protocols.

• Scalability: Be architected to handle growth in users, data volume, and transaction load without degradation in performance.

• Security: Implement robust security measures aligned with industry best practices, including encryption, access controls, and vulnerability management.

• Data Governance: Provide mechanisms for data quality, lineage, and stewardship to maintain integrity and accountability across the lifecycle.

• Compliance: Ensure compliance with applicable federal and state regulations, such as NIST, Health Information Portability and Accountability Act (HIPAA), Fast Healthcare Interoperability Resources (FHIR) /Health Level 7(HL7), etc.

The infrastructure must support seamless integration across all components within the solution and with the modules of the MES. This integration must utilize tools that ensure high availability, confidentiality, and data integrity. Furthermore, these tools must be maintained in alignment with the latest technology standards.

Core components must include

• A Self-service provider portal that is easy to use for providers to initiate, track, and update enrollment applications and maintain their provider data.

• An operations portal for the Vendor’s credentialing staff to conduct credentialing and data maintenance activities, and allow State resources, along with other authorized users, access to applications and provider data.

• A Credentialing component that is driven by a workflow that is highly automated and configurable to the Department’s business rules.

Page 20 of 351 RFP #30-2026-017-DHB

• A document management solution integrated with the enrollment and credentialing workflows, ensuring secure storage and access control to uploaded documents and system generated forms.

• Correspondence management components capable of generating and tracking electronic and physical communications based on business rules.

• Audit trails and reporting shall be integrated throughout all components to capture logs and actions supporting regulatory compliance.

The application layer must incorporate business friendly, interactive, and intuitive user interfaces; dynamic dashboards; and flexible reporting tools for both standard and ad-hoc reporting needs, with access to current and historical data.

The data management and access layer must include role-based access control, prioritizing real-time and near-time access to data over batch feeds, enforcing data quality and validation in compliance with the State data governance policies and maintaining a single source of truth for providers across the MES.

The solution must integrate with external verification sources (e.g., CMS, SSA, National Plan and Provider Enumeration System (NPPES)) to automate provider credentialing and monitoring, enabling APIs in support of interoperability where available.

The integration layer must operate in full alignment as defined in Attachment V: Medicaid Integration Services Core Capabilities, with the Medicaid Integration Services (MIS) platform to:

a. Provide single sign-on capabilities ensuring seamless user navigation between the PDM/CVO portal applications and other MES modules; and

b. Facilitate secure data exchange with the NCDHHS systems and integration partners through supported mechanisms, including API-based integrations and MFT.

Security The Vendor shall implement a configuration management policy that ensures all changes to the solution’s hardware, software, and firmware components adhere to applicable security and privacy control requirements. Data must be classified based on sensitivity and protected accordingly, using encryption and access controls to prevent unauthorized access.

The Vendor’s solution must integrate with the statewide identity management system (NCID) to manage user authentication and authorization in coordination with the Department’s Medicaid Integration Services (MIS) module (see Attachment V: Medicaid Integration Services Core Capabilities).

The PDM/CVO solution must conform to the NCDHHS Acceptable Use Policy, which establishes baseline information security requirements.

Additionally, the Vendor must comply with the Statewide Data Classification and Handling Policy and the High-Risk Applications Policy, which define mandatory security and data handling standards for all NCDHHS systems and vendors.

Page 21 of 351 RFP #30-2026-017-DHB

The Vendor shall support the establishment and maintenance of provider office administrators, who are responsible for managing user access across the MES. The PDM solution shall provision these roles and share updates with the MIS in real-time to ensure accurate and current access control information.

Data Management The Vendor’s proposed solution must incorporate robust data management practices. The Vendor shall implement comprehensive data lifecycle management to ensure the accuracy, completeness, and reliability of provider data. This data must be protected from unauthorized access through the use of encryption technologies and role-based access controls in compliance with federal and state security and privacy requirements.

The solution must include audit controls to maintain data integrity. These controls include audit trails, version control mechanisms, and other tools that enable traceability and accountability.

The scope of data management encompasses transactional data, current data, and historical data maintained within the PDM. The PDM must also support seamless integration with external sources such as managed care entities and credentialing sources. Combined, this data ensures a centralized and comprehensive provider data profile.

Content Management The Vendor’s solution must collect, manage, store, and preserve electronic documents associated with a provider and/or application. All electronic documents must be stored securely using encryption and access controls to prevent unauthorized access.

• Each document must be categorized and assigned a unique document identifier to be associated with the provider and/or the application.

• The provider’s self-service portal’s application workflow shall electronically collect documentation required from the provider based on the business rules for the type of provider and application.

• Authorized Vendor and Department users must have the capability to upload documentation required as part of primary source verification credentialing requirements.

• Authorized Vendor and Department users must be able to access stored documents in a timely and efficient manner.

In certain cases, documents may need to be physically mailed to the Vendor for association with a provider and/or application (e.g., transcripts). The Vendor must establish and implement standardized procedures for digitizing any paper documentation received by mail.

The Vendor must integrate with the State’s Centralized Medicaid Content Management System, when available.

Correspondence Management The Vendor must configure and implement a Correspondence Management Solution capable of generating and managing provider communications. The Vendor must provide functionality to generate, store, and track all written communications to and from providers. All correspondence sent to a provider must be stored in the content management solution.

Page 22 of 351 RFP #30-2026-017-DHB

While most communications will be transmitted electronically (e.g. email, Provider Portal), certain communications must be sent via standard or certified mail in accordance with defined Business Rules. For example, all involuntary denials and terminations must be sent via certified mail. This solution must coordinate the printing and distribution of physical correspondence through a State-approved print and mail service.

The Correspondence Management Solution must operate in accordance with Business Rules provided by the State. Each communication, whether directed to a single recipient, a group of recipients with identical content, or a group using a templated message with variable fields, must be assigned to a unique identifier and a common name for reference and tracking purposes.

The solution must support the generation of scheduled, ad-hoc, and automated (system-triggered) communications. Supported formats include standard letters, notices, memos, form templates, and free-form letters. Correspondence content may include letterhead, images, tables, static text, variable-filled insert text, and formatting elements consistent with Microsoft Word capabilities. Variable data fields may be populated from any data element available within the Vendor’s solution or provided by the State. Please see counts of prior year certified and non-certified correspondence.

Calendar Year Certified Non-Certified Total

2023 33,109 1,052,971 1,086,080

2024 36,468 1,136,191 1,172,659

2025 19,637 671,011 690,648 (Amount through July 2025)

Est Remaining 14,026 479,294 493,320

Est Total 2025 33,663 1,150,305 1,183,968

Reporting The Vendor must provide a Reporting Solution and capabilities to schedule the generation of data extracts,…