RFP Amendment No 3.pdf

AMENDMENT No. 3

DATED: November 12, 2026

Palm Beach County Procurement Department

50 South Military Trail, Suite 110, West Palm Beach, FL 33415

RFP No. 26-081/BW

Title: Digital Client Engagement and Care Coordination SaaS Platform

Request for Submittal Due Date: November 17, 2026

This Amendment is issued to provide additional information, and clarification to the RFP document:

A. Questions received from Velvetech and the County’s responses:

# Question RFP reference County’s Response

1 Approximately how many participants does the County expect to enroll at launch and by the end of the initial term, and how many are expected to use the platform in a typical month? How many County, provider, and administrative users are anticipated by role, and how many provider organizations will participate? If rollout is phased, what volumes should bidders use for the base price? Please give separate counts for each licensing category in Appendix A, items 7 to 9.

Section 4.10, pp. 33-

34; Appendix A, items 7 to 9, p. 63

This will roll out to up to 5000 participants. Since this is client-facing, the participants will need to agree to be part of this app; therefore, there isn’t a specific # at the moment.

There is no specific admin user at the moment. This will be negotiated at the time of contracting.

2 Which programs (e.g., behavioral health, substance use, HIV/AIDS, housing) and provider organizations will be included in the initial launch, and which are expected in later phases?

Section 1.4, p. 2;

Section 4.1, p. 24;

Section 4.10.4, p. 34

We are first looking to onboard clients within the Behavioral

Health and Substance Use systems, then expand to other systems/partners. We will inform the agencies about this platform to engage their clients to use this platform.

3 What case management, EHR, HMIS and other systems do

Community Services and participating providers currently use? Which connections are required at launch versus later phases, including OSCARSS, CARISK, County data warehouses, telehealth, text and email messaging, reporting and security-monitoring systems? Is the platform expected to replace any existing system, and which supporting services must the contractor supply?

Sections 4.5.3, 4.5.4 and 4.5.7, p. 28;

Section 4.8.4, p. 32

This system will not replace any system that the county uses.

It will eventually interface with the existing system. The system should have the capabilities of telehealth, text, and email messaging for clients to use.

4 What existing records and files must be migrated before launch, from which systems and with how much history?

Please provide approximate volumes and clarify who will supply the extracts and perform any required data cleanup.

Section 4.8, pp. 31-

32; Section 4.5.5, p.

The system should allow interoperability. No records or files will be migrated beforehand.

The Community Services Department, in partnership with the

Office of Technology and Innovation, will be supporting this project

5 Can the County share a budget or planning range for the initial contract, including licenses, implementation, integrations and ongoing support?

Section 4.2, p. 24;

Appendix A, p. 63 Not at this moment.

AMENDMENT No. 3 to

6 Section 4.8.3 says the solution should not depend on substantial custom development. Will the evaluation favor requirements met through configuration over vendor-performed customization? Does the County want its own staff to modify workflows, forms, and assessments after launch?

Section 4.2, p. 24;

Section 4.8.3, p. 32 The workflow will be customizable based on needs. Both, we will prefer vendor assistance with customization and provide support for this. Also have the ability to customize if needed.

7 For the client-facing mobile app (Section 4.3), will the County accept a mobile-responsive portal, an installable progressive web app (PWA), or an integrated third-party app if clearly identified and priced under Section 4.2? Must apps support both iOS and Android and be distributed through their app stores? Which functions must work offline, and what controls apply to personal or shared devices, local data storage, lost devices and removal of access or stored data?

Section 4.3, p. 25;

Section 4.2, p. 24 The platform shall provide a mobile application that supports client/participant engagement and self-management. Must work for both iOS and Android users.

The platform may also provide web-based tools that support these functions.

8 Which languages are required for the participant app, messages and training materials at launch?

Must participants without a smartphone be supported through text messages or other channels, and what usage should bidders price?

Under Sample Contract Article 14, what accessibility evidence and testing are required for participant and staff tools and digital materials, and who will confirm acceptance?

Section 4.3, p. 25;

Sample Contract

Article 14, p. 45

The RFP does not specify required launch languages, non-smartphone messaging volumes, or offline functionality.

Proposers should identify available language and communication options and any associated costs. Sample

Contract Article 14 requires applicable public-facing digital services and materials to conform to WCAG 2.1

Level AA or a successor DOJ-adopted standard. Specific testing evidence and acceptance responsibilities are not prescribed. [County confirmation needed on languages, SMS volumes, and acceptance process.] (RFP §4.3;

Article 14, p.45)

9 Is there a required or preferred SDOH screening tool (e.g., PRAPARE, AHC HRSN), and do the

County or providers use an existing community resource directory? What other forms or assessments, apart from the RCI question below, must be included at launch? Who will provide and maintain these materials and listings, provide permission to use them, and cover any associated fees?

Sections 4.3 and 4.4;

Section 4.1, p. 24 No particular SDOH screening instrument, resource directory, or launch assessment is mandated in the RFP.

The platform must support collection, management, and/or use of SDOH information and resource navigation.

Proposers should explain configurable assessments and directories and disclose third-party licensing or fees.

10 For risk stratification and alerts (Sections 4.6.2–

4.6.3), does the County have existing criteria, models or follow-up rules it wants configured, or does it expect the contractor to provide them?

Who will approve and maintain them?

Sections 4.6.2 and

4.6.3, p. 29 The RFP requires risk stratification, alerts, and human-in-the-loop decision support, but does not supply prescribed models, thresholds, escalation rules, or approving officials. Proposers should describe available standard and configurable functions and their governance approach.

The Department will approve them.

11 Should the platform support the Recovery Capital

Index (RCI) assessment and reporting described in County publications at launch, and for which programs? Should it exchange results with the current assessment system, collect the assessment itself, or both? Please provide the specifications, confirm which existing access arrangements and use rights the contractor may use, and identify any fees to include.

Section 4.11, pp. 34-

The platform should support interoperability with the

County Approved Vendor for assessing Recovery Capital.

Clients will have access to the link to complete the assessment outside of the app.

12 For the required launch connections, what data must move, in which direction, how often, and at what volume? Are specific HL7/FHIR versions or uses required, such as admission/discharge alerts or exchange with a health information exchange? Must bidders use County warehouses, connect directly, or propose the approach? Please share interface documentation and identify who provides access and test environments, plus any third-party charges. Will the County provide participant identifiers or a matching service, or must the contractor match records? Who will resolve uncertain matches?

Sections 4.5.3 to

4.5.7, p. 28 The RFP requires HL7/FHIR-compatible interoperability, APIs, EHR and non-clinical integration capability, import/export, multi-provider data protections, and County reporting. Proposers must use a County-approved vendor system. The County will provide matching services.

13 What permissions should each user group have, including County and provider administrators?

Please share any existing access matrix. When a participant uses multiple providers, what records or fields may each provider view or change? Is separation within a shared system acceptable, or are separate environments required? Which

County oversight roles may access individual records rather than aggregates, and is caregiver or representative access needed?

Section 4.7.2, p. 30;

Section 4.4.7 The platform must support role-based access appropriate to program responsibilities and organizational affiliation, with confidentiality and organizational separation for multiple providers. The

RFP does not provide a detailed access matrix, cross-provider record-sharing rules, caregiver access requirements, or a mandate for separate environments.

Proposers should describe configurable permissions and tenant separation.

14 Must County staff use Microsoft Entra ID (Azure

AD), should providers use their own organization’s sign-in, and how should participants sign in? Which groups require multifactor authentication or specific mobile sign-in controls? Who will verify identity, approve and create accounts, assign roles, recover access and deactivate accounts, and must account or role changes synchronize automatically with County or provider directories?

Section 4.7, pp. 30-

The RFP requires appropriate security, role-based access and user administration but does not mandate

Microsoft Entra ID, provider identity federation, a particular participant sign-in method, or specific MFA rules. Proposers should identify supported authentication, MFA, provisioning/deprovisioning, and account recovery options.

15 Is commercial SaaS hosting acceptable, or is a government-cloud environment required? Please share applicable County policies, permitted locations for production data, backups and disaster recovery and restrictions on vendor or subcontractor support access. Are specific certifications, cloud authorizations such as

FedRAMP, security assessments, private connections or County-controlled encryption keys required? What evidence or approvals are needed with the proposal and before launch, and are there required agreements for handling health or personal data?

Section 4.7, pp. 30-

31; Section 4.7.5, p.

The RFP calls for an existing commercial SaaS platform, secure storage/transmission, regulatory compliance and adherence to applicable County technology/security requirements. It does not expressly mandate a government cloud, FedRAMP authorization, particular data region, private connectivity or County-managed encryption keys. Proposers should fully describe hosting, security certifications, data residency, subcontractor access, backup and disaster recovery arrangements.

16 Will the County require a HIPAA Business

Associate Agreement? Which party acts as the covered entity?

Section 1.2, p. 1;

Section 4.7.5, p. 31 Section 4.7.5 requires support for HIPAA compliance where applicable, but the RFP does not expressly prescribe a Business Associate Agreement or identify the covered entity for each program. Any BAA requirement and the parties’ HIPAA roles must be determined based on actual data flows and participating entities before implementation.

17 Will the platform store records subject to 42 CFR

Part 2, and must consent management support

Part 2 consent requirements? Which consent and information-sharing policies and forms apply to the launch programs, including substance-use treatment records? Do the published CMIS policies apply? How must consent be recorded and applied to user permissions, and what must the platform do when consent is withdrawn, including for information already sent to another provider?

Sections 4.7.4 and

4.7.5, p. 31 The RFP requires consent management appropriate to the programs and information involved and compliance with applicable federal/state confidentiality requirements. It does not specifically identify 42 CFR

Part 2 workflows, CMIS policies, approved consent forms, withdrawal procedures, or redisclosure controls.

Proposers should explain their ability to configure consent restrictions and revocation.

18 Beyond Sample Contract Article 23, how long must participant records, audit logs and backups be kept? At contract end, what deadlines apply to returning data, helping transfer it to a replacement service and deleting remaining copies when authorized?

Sample Contract

Article 23, p. 49;

Section 4.7.3, p. 30

Sample Contract Article 23 requires retention of contract-related books and records for five years after completion/termination; this is not an explicit universal retention schedule for participant data, audit logs, or backups. Section 4.7.3 requires disclosure of audit-log retention and export capability, and §4.5.8 requires an exit strategy covering data return, deletion including backups, and transition assistance. Specific deadlines and retention schedules are not given.

19 Section 4.6.6 asks vendors to identify AI functionality and human oversight. Does the

County have an AI governance policy, and what additional approvals or use restrictions apply beyond the human oversight required by the

RFP? Are there AI-assisted uses it is especially interested in, such as case-note summarization, triage suggestions or risk flagging with staff review?

Section 4.6.6, p. 30 The RFP requests disclosure of AI or emerging-technology functionality and human oversight, but does not include an AI governance policy or approve specific AI use cases. Proposers should identify AI functions, explain human review and safeguards, and distinguish available from future capabilities.

20 Will the County provide the Section 4.7.6 policies not included in the RFP package? Which data governance, information security, access and technology policies apply?

Section 4.7.6, p. 31 Section 4.7.6 requires compliance with applicable

County data governance, security, access and technology requirements, but the referenced policies are not attached to the RFP.

21 Section 1.6 gives a December 1, 2026 start and a nineteen-month term ending June 30, 2028, while Section 1.8 lists January 12, 2027. Which start date, end date and contract length should bidders use, and does the County have a target production launch date?

Section 1.6, p. 2; Section

1.8, p. 3 January 12, 2027 is the anticipated start date

22 What must be working before the County accepts the initial launch, and who will approve it? Please identify required reports and outcome measures, with existing definitions and data sources where available. What County and provider staff will be available to confirm requirements, test the system and approve launch?

Sections 4.8 to 4.11, pp. 31-

The contractor must complete implementation planning, configuration, integrations as applicable, testing, onboarding and coordinated production launch. Testing must cover platform functions, integrations, workflows and access controls. The RFP describes outcomes such as engagement, retention, adherence, service coordination and utilization, but does not provide a final acceptance checklist, report specifications, data dictionary or named sign-off officials. These should be documented jointly during project planning.

23 Will the County accept a proposal where the software publisher provides the platform, hosting and updates and a certified implementation partner provides implementation and support, including where that partner acts as prime contractor and authorized reseller? How should each party and its personnel be presented under

Section 3.3, when must the publisher be listed as a subcontractor rather than a supplier, and which registrations or documents are required from each party?

Section 3.3, p. 18; Section

4.2, p. 24 The RFP requires an existing commercially available

SaaS solution and requires proposers to identify all third-party components, services and costs. It does not expressly prohibit a publisher/implementation-partner arrangement or define when a publisher is a subcontractor versus supplier. The proposal should clearly identify the prime contractor, publisher, implementation/support responsibilities, personnel and contractual relationships. All subcontractors must register in County VSS before contract award;

classification and eligibility should be confirmed by

Procurement

24 In addition to Sample Contract Article 18, what routine technical support hours are required, who should be the first contact, and do requirements differ for participant-facing and staff-facing functionality? What minimum targets apply to availability, incident response, service restoration and acceptable data loss? Please specify backup and recovery-testing schedules, maintenance windows, and deadlines and channels for notifying the County of outages or security incidents.

Section 4.9, pp. 32-33;

Sample Contract Article 18,

p. 47

Sections 3.2.3, 3.3.6, and 4.9 require proposers to describe their support model, support hours, methods for obtaining assistance, escalation procedures, and maintenance and upgrade procedures. Proposers shall identify the initial support contact and explain any differences between participant-facing and staff-facing support.

Include proposed service levels for availability, incident response and restoration, recovery time and recovery point objectives, backup frequency, recovery testing, maintenance windows, and outage and security-incident notifications. Identify any additional costs for enhanced support.

Article 18 separately requires a 24-hour telephone number and first-priority service in connection with the emergencies described in that article.

25 Will County or provider staff review participant messages and alerts, follow up with participants and moderate peer groups? Which of these activities, if any, is the contractor expected to staff, including outside normal business hours?

Sections 4.4, 4.6 and 4.9 The RFP anticipates communication, triage/alerts, staff follow-up and possible moderated peer/community features, but does not allocate staffing for message monitoring, peer moderation or after-hours response between the County, providers and contractor. Proposers should describe technology features and any optional managed services separately.

26 Should Appendix A pricing cover the full initial contract term, and how should annual license charges be shown? Must bidders provide prices for the two optional renewal years, where should they be shown, and do they count toward the evaluated “Total Offered

Price”? Will optional modules in Item 5 count toward that total or be evaluated separately, given that Section 4.2 requires all components needed to meet the RFP in the base price?

Appendix A, pp. 63-

64; Section 4.2, p.

Appendix A pricing shall identify the total cost for the full initial contract term of. Show annual subscription rates and separately identify the amount applicable to the initial term, including any partial-year calculation.

Provide pricing for each optional twelve-month renewal period in a separately labeled attachment.

All components necessary to satisfy the RFP requirements must be included in the required solution pricing, even if the proposer ordinarily markets them as optional modules. Separately identify enhancements that are not necessary to meet the RFP requirements.

Avoid duplicating charges across line items.

27 How should annual software subscription fees be billed under the Sample Contract’s monthly billing provisions, and how should those fees be handled if the County ends the contract before the subscription period expires?

Sample Contract, billing and termination provisions

Article 4 provides for monthly billing for services rendered, unless otherwise provided in the contract.

Proposers shall identify any proposed alternative subscription billing arrangement, including annual billing, and any requested exceptions to the payment or termination provisions.

Annual subscription pricing does not, by itself, establish County acceptance of annual advance payment, a noncancelable subscription, or nonrefundable fees. Article 6 governs termination and payment for services rendered through termination.

Any alternative billing arrangement and treatment of unused prepaid subscription fees must be expressly addressed in the executed contract.

28 How does Sample Contract Article 20 apply to the publisher’s existing software and to configuration or other work created for the

County? What must the County own, and what may be provided under a software license?

Sample Contract

Article 20, p. 48 The County is procuring access to an existing commercial SaaS platform. Proposers shall distinguish preexisting proprietary software and other intellectual property from documents, materials, configurations, interfaces, and other deliverables created specifically under the County contract.

County data remains County property under Section

4.5.8. Article 20 governs ownership and delivery of

materials and work product created under the contract.

Proposers shall identify applicable software license terms and any requested exceptions or clarifications concerning ownership and use rights.

29 Which funding sources will pay for the initial contract, and what grant terms, federal contract conditions or additional reporting requirements should bidders allow for? Must Appendix E, Certification Regarding Lobbying, be submitted with the proposal?

Section 2.27, p. 14;

Appendices D and

E, pp. 67-68

This will be a blended-funded project.

30 May the three requested references include projects delivered by the proposed software publisher or a named delivery partner if each party’s role is clear? How many, if any, must be for work delivered by the prime contractor itself?

Section 3.1.2, p. 16 Section 3.1.2 requests a minimum of three references demonstrating successful implementation and operation of comparable platforms within the past five years. References shall clearly identify the entity that performed the work, its responsibilities, and its proposed role on this project.

31 Does this RFP have a Small Business

Enterprise participation goal or another

Affirmative Procurement Initiative requirement? Please identify any applicable goal and required Office of Small Business

Development schedules, including whether

Schedule 2 or 2(a) applies and which forms remain required if no goal applies. Where can proposers obtain Schedules 1, 2 and 2(a)?

Schedules 1 to 4 instructions, items A and B; Attachment

1, Article 9

Does not apply to this RFP

32 The RFP text and appendix list identify the

Drug-Free Workplace Certification as

Appendix E and Disclosure of Ownership

Interests as Appendix F, but the forms are labeled F and G, and Appendix E contains the lobbying certification. Which labels and instructions should bidders use, and will corrected forms be issued?

Section 2.23, p. 13;

Appendices E, F and

G, pp. 68-70

The correct appendix designations are:

• Appendix E — Certification Regarding

Lobbying.

• Appendix F — Drug-Free Workplace

Certification.

• Appendix G — Disclosure of Ownership

Interests.

References identifying the Drug-Free Workplace

Certification as Appendix E or the Disclosure of

Ownership Interests as Appendix F are corrected accordingly. The substantive submission instructions remain unchanged unless expressly revised by amendment.

All changes addressed in this Amendment No. 3 shall be incorporated into RFP No. 26- 081/BW and the final contract. All other terms and conditions of the RFP remain the same and unchanged.

NOTE: Please acknowledge receipt of this Amendment No. 3 by signing below and returning this page with your Proposal Response. Each Amendment to the RFP shall be signed by an authorized agent and submitted with the proposal or the proposal shall be deemed non-responsive.

Procurement Manager

ACKNOWLEDGMENT:

COMPANY NAME SIGNATURE

DATE