UPDATED APRIL 10, 2025 V5.1 1

STATE OF SOUTH DAKOTA

INFORMATION TECHNOLOGY (IT) RFP

DEPARTMENT OF SOCIAL SERVICES

700 GOVERNORS DRIVE

PIERRE, SD 57501

Medicaid Asset Verification System (AVS) PROPOSALS ARE DUE NO LATER THAN NOVEMBER 13th, 2025

RFP17546 STATE POC: Kirsten Blachford EMAIL: Kirsten.Blachford@state.sd.us

READ CAREFULLY

FIRM NAME: AUTHORIZED SIGNATURE:

ADDRESS: TYPE OR PRINT NAME:

CITY/STATE: TELEPHONE NO:

ZIP (9 DIGITS): FAX NO:

E-MAIL:

PRIMARY CONTACT INFORMATION

CONTACT NAME:

TELEPHONE NO:

FAX NO: E-MAIL:

UPDATED APRIL 10, 2025 V5.1 2

1.0 General Information

1.1 Purpose of Request for Proposal (RFP)

The State of South Dakota, Department of Social Services (DSS), Division of Economic Assistance is requesting an Asset Verification System (AVS) which will be directly integrated with the State’s Medicaid Eligibility & Enrollment (E&E) system.

Title VII, Section 7001(d) of P.L.110-252 (Supplemental Appropriations Act of 2008) added a new section, 1940, to the Social Security Act. Section 1940 requires states to implement an electronic system for verifying the assets of aged, blind or disabled applicants for and beneficiaries of Medicaid.

South Dakota currently utilizes an existing integrated AVS within its E&E system that produces roughly 3,000 requests for liquid, motor vehicle, and property assets monthly through both real-time and batch transactions for aged, blind, or disabled Medicaid applicants and recipients. The Federal Centers for Medicare and Medicaid Services (CMS) and DSS will provide oversight of the AVS project. Vendors should propose a solution to identify assets that might otherwise not be discovered through the eligibility-determination process. Qualified Contractors are to present the State with a proposal that includes the following:

• Ability of the AVS system to provide information related to liquid resources, motor vehicles, and real property

• Demonstration of a robust network of Financial Institutions (FIs) or a plan for how the

Contractor will establish such a network, particularly that includes FIs prominent in South Dakota

• Demonstration of a robust network of data sources which provide motor vehicle and real property information

• Implementation and operation of an electronic Asset Verification System (AVS) that is directly integrated with the State’s E&E system

• Tracking and reporting of verification activity by individual client, as well as in aggregate

• Manuals and training on system use, as well as technical documentation related to the integrated interface

The RFP and contract are subject to modification and approval by CMS.

1.2 Issuing Office and RFP Reference Number

The Department of Social Services, Division of Economic Assistance (“Agency”) is the issuing office for this document and all subsequent addenda relating to it, on behalf of the State of South Dakota (“State”). The reference number for this transaction is RFP17546. This reference number must be referred to on all proposals, correspondence, and documentation relating to this RFP. For purposes of this RFP, the State’s centralized IT agency, the Bureau of Information and Telecommunications (“BIT”), must approve all IT related purchases.

1.3 Schedule of Activities (Subject to Change)

All deadlines in the Schedule of Activities are due by 5 PM CST. The Schedule of Activities for this RFP is as follows:

UPDATED APRIL 10, 2025 V5.1 3

RFP Publication 09/23/2025 Deadline for Letter of Intent to Respond 09/30/2025 Deadline for Submission of Written Inquiries 10/14/2025 Deadline for Responses to offeror Questions 10/28/2025 Deadline for Request for SFTP Folder 11/12/2025 Deadline for Proposal Submission 11/13/2025 Evaluation of Proposals to Determine Short List (If required) Week of 12/01/2025 Discussions/Technical Review 12/01/25 to 12/17/25 Demonstrations and presentations (if required) 12/01/25 to 12/17/25 Proposal Revisions (if required) Week of 12/29/2025 Anticipated Award Decision/Contract Negotiation 01/22/2026

1.4 Letter of Intent

All interested offerors are requested to submit a non-binding Letter of Intent to respond to this RFP. While preferred, a Letter of Intent is not mandatory to submit a proposal.

Be sure to reference the RFP number in your letter.

The Letter of Intent must be submitted to Kirsten Blachford via email at Kirsten.Blachford@state.sd.us by the date and time indicated in Section 1.3 Schedule of Activities. Please place the following in the subject line of your email: “Letter of Intent for RFP17546”.

1.5 Submitting a Proposal

All proposals must be completed and received by the Agency by the date and time indicated in Section 1.3 Schedule of Activities.

Proposals received after the Deadline for Proposal Submission will be late and ineligible for consideration.

All proposals must be signed, in ink or electronically, by a representative of the offeror who is legally authorized to bind the offeror to the proposal. Proposals that are not properly signed may be rejected. The offeror’s proposal must be prepared pursuant to the requirements of Section 6 Proposal Submission Requirements of this RFP.

Proposals must be submitted as PDFs via Secured File Transfer Protocol (SFTP).

Offerors must request an SFTP folder by the date and time indicated in Section 1.3 Schedule of Activities by emailing Kirsten Blachford at Kirsten.Blachford@state.sd.us with the subject line of “RFP17546 SFTP Request”. The email should contain the name and the email of the person who will be responsible for uploading the document(s).

Please note, the offeror will need to work with its own technical support staff to set up SFTP compatible software on the offeror’s end. While the State can answer questions, the State is not responsible for the software required to access the SFTP folder.

No proposal will be accepted from, or no contract or purchase order will be awarded to, any person, firm, or corporation that is in arrears upon any obligations to the State of South Dakota, or that otherwise may be deemed irresponsible or unreliable by the State of South Dakota.

1.6 Certification Regarding Debarment, Suspension, Ineligibility, and Voluntary

UPDATED APRIL 10, 2025 V5.1 4

Exclusion – Lower Tier Covered Transactions By signing and submitting this proposal, the offeror certifies that neither it nor its principals is presently debarred, suspended, proposed for debarment, declared ineligible, or voluntarily excluded from participation, by any Federal department or agency, from transactions involving the use of Federal funds. Where the offeror is unable to certify to any of the statements in this certification, the offeror shall attach an explanation to its offer.

1.7 Non-Discrimination Statement

The State of South Dakota requires that all contractors, vendors, and suppliers doing business with any State agency, department, or institution, provide a statement of non-discrimination. By signing and submitting their proposal, the offeror certifies they do not discriminate in their employment practices with regard to race, color, creed, religion, age, sex, ancestry, national origin, or disability.

1.8 Restriction of Boycott of Israel

For contractors, vendors, suppliers, or subcontractors with five (5) or more employees who enter into a contract with the State of South Dakota that involves the expenditure of one hundred thousand dollars ($100,000) or more, by submitting a response to this solicitation or agreeing to contract with the State, the bidder or offeror certifies and agrees that the following information is correct:

The bidder or offeror, in preparing its response or offer or in considering proposals submitted from qualified, potential vendors, suppliers, and subcontractors, or in the solicitation, selection, or commercial treatment of any vendor, supplier, or subcontractor, has not refused to transact business activities, has not terminated business activities, and has not taken other similar actions intended to limit its commercial relations, related to the subject matter of the bid or offer, with a person or entity on the basis of Israeli national origin, or residence or incorporation in Israel or its territories, with the specific intent to accomplish a boycott or divestment of Israel in a discriminatory manner. It is understood and agreed that, if this certification is false, such false certification will constitute grounds for the State to reject the bid or response submitted by the bidder or offeror on this project and terminate any contract awarded based on the bid or response. The successful bidder or offeror further agrees to provide immediate written notice to the contracting executive branch agency if during the term of the contract it no longer complies with this certification and agrees such noncompliance may be grounds for contract termination.

1.9 Certification Relating to Prohibited Entity

For contractors, vendors, suppliers, or subcontractors who enter into a contract with the State of South Dakota by submitting a response to this solicitation or agreeing to contract with the State, the bidder or offeror certifies and agrees that the following information is correct:

The bidder or offeror, in preparing its response or offer or in considering proposals submitted from qualified, potential vendors, suppliers, and subcontractors, or in the solicitation, selection, or commercial treatment of any vendor, supplier, or subcontractor, is not a prohibited entity, regardless of its principal place of business, that is ultimately owned or controlled, directly or indirectly, by a foreign national, a foreign parent entity, or foreign government from China, Iran, North Korea, Russia, Cuba, or Venezuela, as defined by South Dakota Codified Law § 5-18A. It is understood and agreed that, if this certification is false, such false certification will constitute grounds for the State to reject

UPDATED APRIL 10, 2025 V5.1 5

the bid or response submitted by the bidder or offeror on this project and terminate any contract awarded based on the bid or response. The successful bidder or offeror further agrees to provide immediate written notice to the contracting executive branch agency if during the term of the contract it no longer complies with this certification and agrees such noncompliance may be grounds for contract termination and would be cause to suspend and debar a business under SDCL § 5-18D-12.

1.10 Certification of No State Legislature Interest

The bidder or offeror (i) understands neither a state legislator nor a business in which a state legislator has an ownership interest may be directly or indirectly interested in any contract with the State that was authorized by any law passed during the term for which that legislator was elected, or within one year thereafter, and (ii) has read South Dakota Constitution Article 3, Section 12 and has had the opportunity to seek independent legal advice on the applicability of that provision to any agreement entered into as a result of this RFP. By signing an agreement pursuant to this RFP, the bidder or offeror certifies that the Agreement is not made in violation of the South Dakota Constitution Article 3, Section 12.

1.11 Modification or Withdrawal of Proposals

Proposals may be modified or withdrawn by the offeror prior to the established due date and time.

No oral, telephonic, telegraphic or facsimile responses or modifications to informal, formal bids, or Request for Proposals will be considered.

1.12 Questions Regarding RFP

Offerors may email inquiries concerning this RFP to obtain clarification of requirements.

No inquiries will be accepted after the date and time indicated in the Schedule of Activities. Inquiries must be emailed to Kirsten Blachford at Kirsten.Blachford@state.sd.us with the subject line “RFP17546”.

The State will to respond to offeror’s inquiries (if required) via e-mail. In addition, all inquiries and the State’s responses will be posted on the state’s e-procurement system and the DSS website at http://dss.sd.gov/keyresources/rfp.aspx. Offerors may not rely on any other statements, either of a written or oral nature, that alter any specification or other term or condition of this RFP. Offerors will be notified in the same manner as indicated above regarding any modifications to this RFP.

1.13 Proprietary Information

The proposal of the successful offeror(s) becomes public information. Proprietary information can be protected under limited circumstances such as client lists and non-public financial statements. An entire proposal may not be marked as proprietary.

Offerors must clearly identify in the Executive Summary and mark in the body of the proposal any specific proprietary information they are requesting to be protected. The Executive Summary must contain specific justification explaining why the information is to be protected. Proposals may be reviewed and evaluated by any person at the discretion of the State. All materials submitted become the property of the State of South Dakota and may be returned only at the State's option.

1.14 Length of Contract

The contract resulting from this RFP will be issued for the period of three (3) years , with mailto:Kirsten.Blachford@state.sd.us http://dss.sd.gov/keyresources/rfp.aspx

UPDATED APRIL 10, 2025 V5.1 6

the option for renewal for (1), three (3) year contract at the discretion of the State based on performance and/or the continued availability of funds.

1.15 Governing Law

This RFP will be governed by and construed in accordance with the laws of the State of South Dakota. Any lawsuit pertaining to or affecting this RFP will be venued in Circuit Court, Sixth Judicial Circuit, Hughes County, South Dakota.

1.16 Presentations/Demonstrations

An oral presentation by an offeror to clarify a proposal may be required at the sole discretion of the State. However, the State may award a contract based on the initial proposals received without discussion with the Offeror. If oral presentations are required, they will be scheduled after the submission of proposals. Oral presentations will be made at the offeror’s expense.

This process is a Request for Proposal/Competitive Negotiation process. Each Proposal shall be evaluated, and each respondent shall be available for negotiation meetings at the State’s request. The State reserves the right to negotiate on any and/or all components of every proposal submitted. From the time the proposals are submitted until the formal award of a contract, each proposal is considered a working document and as such, will be kept confidential. The negotiation discussions will also be held as confidential until such time as the award is completed.

1.17 Discussions

At the State’s discretion, the offeror may or may not be invited to have discussions with the State. The discussions can be before or after the RFP has been submitted.

Discussions will be made at the offeror’s expense.

1.18 Technical Review

At the State’s discretion, the State may require a technical review of the offeror based on the offeror’s proposal and response to the Security and Vendor Questionnaire.

1.19 Negotiations

This process is a Request for Proposal/Competitive Negotiation process. Each proposal will be evaluated, and each respondent will be available for negotiation meetings at the State’s request. The State reserves the right to negotiate on any component of every proposal submitted. From the time the proposals are submitted until the formal award of a contract, each proposal is considered a working document and as such, will be kept confidential. The negotiation discussions will also be held as confidential until such time as the award is completed.

2.0 Standard Contract Terms and Conditions

Any contract or agreement resulting from this RFP will include the State’s standard terms and conditions as listed below and as seen in Attachment A, the State’s standard Information Technology (“IT”) contract terms listed in Appendices 1 and 2, and any additional terms and conditions as negotiated by the parties. The offeror must indicate in its response any issues it has with specific contract terms. If the offeror does not indicate that there is an issue with a specific contract term, then the offeror will be deemed to have accepted the contract terms as written.

2.1 The Contractor will perform those services described in the Scope of Work, attached

UPDATED APRIL 10, 2025 V5.1 7

hereto as Section 3.0 of the RFP and by this reference incorporated herein.

2.2 The Contractor’s services under this Agreement will start on , and end on

, unless terminated sooner pursuant to the terms of the Agreement.

2.3 The Contractor will not use State equipment, supplies, or facilities. The Contractor will provide the State with its Employer Identification Number, Federal Tax Identification Number, or Social Security Number upon execution of this Agreement.

2.4 The State will make payment for services upon satisfactory completion of the services.

The TOTAL CONTRACT AMOUNT is an amount not to exceed $ . The State will not pay Contractor's expenses as a separate item. Payment will be made pursuant to itemized invoices submitted with a signed state voucher. Payment will be made consistent with SDCL chapter 5-26.

2.5 The Contractor agrees to indemnify the State of South Dakota, its officers, agents, and employees, from and against all claims or proceedings for actions, suits, damages, liabilities, other losses or equitable relief that may arise at least in part as a result of an act or omission in performing services under this Agreement. The Contractor will defend the State of South Dakota, its officers, agents, and employees against any claim, including any claim, action, suit, or other proceeding related to the claim. The Contractor’s obligation to indemnify includes the payment of attorney fees and other costs of defense.

In defending the State of South Dakota, its officers, agents, and employees, the Contractor will engage other professionals, subject to the written approval of the State which will not be unreasonably withheld. Notwithstanding the foregoing, the State may, in its sole discretion and at the expense of the Contractor, engage attorneys and other professionals to defend the State of South Dakota, its officers, agents, and employees, or to assist the Contractor in the defense. This section does not require the Contractor to be responsible for or defend against claims or proceedings for damages, liabilities, losses, or equitable relief arising solely from errors or omissions of the State, its officers, agents, or employees.

2.6 During the term of this Agreement, the Contractor will obtain and maintain in force insurance coverage of the types and with the limits as follows:

2.6.1 Commercial General Liability Insurance:

The Contractor will maintain occurrence based commercial general liability insurance or equivalent form with a limit of not less than $1 million for each occurrence. If such insurance contains a general aggregate limit it will apply separately to this Agreement or be no less than two times the occurrence limit.

The insurance policy will name the State of South Dakota, its officers and employees, as additional insureds, but liability coverage is limited to claims not barred by sovereign immunity. The State of South Dakota, its officers and employees do not hereby waive sovereign immunity for discretionary conduct as provided by law.

2.6.2 Professional Liability Insurance or Miscellaneous Professional Liability Insurance:

The Contractor will procure and maintain professional liability insurance or miscellaneous professional liability insurance with a limit not less than $1 million.

2.6.3 Business Automobile Liability Insurance:

UPDATED APRIL 10, 2025 V5.1 8

The Contractor will maintain business automobile liability insurance or equivalent form with a limit of not less than $1 million for each accident. Such insurance will include coverage for owned, hired, and non-owned vehicles.

2.6.4 Workers’ Compensation Insurance:

The Contractor will procure and maintain workers’ compensation and employers’ liability insurance as required by South Dakota or federal law.

Before beginning work under this Agreement, Contractor will furnish the State with properly executed Certificates of Insurance which will clearly evidence all insurance required in this Agreement. In the event a substantial change in insurance, issuance of a new policy, cancellation, or nonrenewal of the policy, the Contractor agrees to provide immediate notice to the State and provide a new certificate of insurance showing continuous coverage in the amounts required. Contractor will furnish copies of insurance policies if requested by the State.

2.7 While performing services under this Agreement, the Contractor is an independent contractor and not an officer, agent, or employee of the State of South Dakota.

2.8 The Contractor agrees to report to the State any event encountered in the course of performance of this Agreement which results in injury to the person or property of third parties, or which may otherwise subject Contractor or the State to liability. The Contractor will report any such event to the State immediately upon discovery.

The Contractor's obligation under this section will only be to report the occurrence of any event to the State and to make any other report provided for by their duties or applicable law. The Contractor’s obligation to report will not require disclosure of any information subject to privilege or confidentiality under law (e.g., attorney-client communications).

Reporting to the State under this section will not excuse or satisfy any obligation of the Contractor to report any event to law enforcement or other entities under the requirements of any applicable law.

2.9 This Agreement may be terminated by either party hereto upon thirty (30) days’ written notice. In the event the Contractor breaches any of the terms or conditions of this Agreement, this Agreement may be terminated by the State at any time with or without notice. If termination for a breach is affected by the State, any payments due to the Contractor at the time of termination may be adjusted to cover any additional costs to the State because of the Contractor's breach. Upon termination the State may take over the work and may award another party an agreement to complete the work under this Agreement. If after the State terminates for a breach by the Contractor it is determined that the Contractor was not at fault, then the Contractor will be paid for eligible services rendered and expenses incurred up to the date of termination.

2.10 This Agreement depends upon the continued availability of appropriated funds and expenditure authority from the Legislature for this purpose. If for any reason the Legislature fails to appropriate funds or grant expenditure authority, or funds become unavailable by operation of law or federal funds reductions, this Agreement will be terminated by the State upon five (5) business days’ written notice. The Contractor agrees that termination for any of these reasons is not a default by the State nor does it give rise to a claim against the State or any officer, agent, or employee of the State, and the Contractor waives any claim against the same.

UPDATED APRIL 10, 2025 V5.1 9

2.11 This Agreement may not be assigned without the express prior written consent of the

State. This Agreement may not be amended except in writing, which writing will be expressly identified as a part of this Agreement and be signed by an authorized representative of each of the parties to this Agreement.

2.12 This Agreement will be governed by and construed in accordance with the laws of the

State of South Dakota, without regard to any conflicts of law principles, decisional law, or statutory provision which would require or permit the application of another jurisdiction’s substantive law. Venue for any lawsuit pertaining to or affecting this Agreement will be in Circuit Court, Sixth Judicial Circuit, Hughes County, South Dakota.

2.13 The Contractor will comply with all federal, tribal, state, and local laws, regulations, ordinances, guidelines, permits, requirements, and other standards applicable to providing services pursuant to this Agreement and will be solely responsible for obtaining current information on such requirements. Nothing herein will constitute a waiver by the State to any defense to jurisdiction nor will anything under this Agreement constitute an acknowledgement by the State that any tribe has or exercises any jurisdiction over this Agreement or the parties.

2.14 The Contractor may not use subcontractors to perform the services described in this

Agreement without the express prior written consent of the State. The Contractor will include provisions in its subcontracts requiring its subcontractors to comply with the applicable provisions of this Agreement, to indemnify the State, and to provide insurance coverage for the benefit of the State in a manner consistent with this Agreement. The Contractor will cause its subcontractors, agents, and employees to comply with applicable federal, tribal, state, and local laws, regulations, ordinances, guidelines, permits, and other standards and will adopt such review and inspection procedures as are necessary to assure such compliance. The State, at its option, may require the vetting of any subcontractors. The Contractor will assist in the vetting process.

2.15 The State reserves the right to reject any person from performing services under this

Agreement who the State believes would be detrimental to the services, presents insufficient skills, presents inappropriate behavior, or is considered by the State to be a security risk.

2.16 The Contractor hereby acknowledges and agrees that all reports, plans, specifications, technical data, miscellaneous drawings, software system programs and documentation, procedures, or files, operating instructions and procedures, source code(s) and documentation, including those necessary to upgrade and maintain the software program, and all information contained therein provided to the State by the Contractor in connection with its performance of services under this Agreement will belong to and is the property of the State and will not be used in any way by the Contractor without the written consent of the State. Papers, reports, forms, software programs, source code(s), and other material which are a part of the work under this Agreement will not be copyrighted without written approval of the State.

2.17 The Contractor certifies that neither Contractor nor its principals are presently debarred, suspended, proposed for debarment or suspension, or declared ineligible from participating in transactions by the federal government or any state or local government department or agency. Contractor further agrees that it will immediately notify the State

UPDATED APRIL 10, 2025 V5.1 10

if during the term of this Agreement Contractor or its principals become subject to debarment, suspension, or ineligibility from participating in transactions by the federal government, or by any state or local government department or agency.

2.18 By signing this Agreement, the Contractor certifies and agrees that is has not refused to transact business activities, have not terminated business activities, and have not taken other similar actions intended to limit its commercial relations, related to the subject matter of this Agreement, with a person or entity that is either the State of Israel, or a company doing business in or with Israel or authorized by, licensed by, or organized under the laws of the State of Israel to do business, or doing business in the State of Israel, with the specific intent to accomplish a boycott or divestment of Israel in a discriminatory manner. It is understood and agreed that, if this certification is false, such false certification will constitute grounds for the State to terminate this Agreement. During the term of this Agreement, if the Contractor no longer complies with this certification, the Contractor agrees to provide immediate written notice to the State and agrees such noncompliance may be grounds for termination of this Agreement.

2.19 Pursuant to South Dakota Codified Law § 5-18A, by entering into this Agreement with the

State of South Dakota, the Contractor certifies and warrants that the Contractor is not a prohibited entity, regardless of its principal place of business, that is ultimately owned or controlled, directly or indirectly, by a foreign national, a foreign parent entity, or foreign government from China, Iran, North Korea, Russia, Cuba, or Venezuela, as defined by South Dakota Codified Law § 5-18A.

The Contractor agrees that if this certification is false, the State may terminate this Agreement with no further liability to the State. The Contractor further agrees to provide immediate written notice to the State if during the term of the contract it no longer complies with this certification, and the Contractor agrees such noncompliance may be grounds for contract termination and would be cause to suspend and debar a business under SDCL § 5-18D-12.

2.20 The Contractor (i) understands neither a state legislator nor a business in which a state legislator has an ownership interest may be directly or indirectly interested in any contract with the State that was authorized by any law passed during the term for which that legislator was elected, or within one year thereafter, and (ii) has read South Dakota Constitution Article 3, Section 12 and has had the opportunity to seek independent legal advice on the applicability of that provision to this Agreement. By signing this Agreement, the Contractor certifies that this Agreement is not made in violation of the South Dakota Constitution Article 3, Section 12.

2.21 Any notice or other communication required under this Agreement will be in writing and sent to the address set forth above. Notices will be given by and to on behalf of the State, and by and to , on behalf of the Contractor, or such authorized designees as either party may from time to time designate in writing. Notices or communications to or between the parties will be deemed to have been delivered when mailed by first class mail, provided that notice of default or termination will be sent by registered or certified mail, or, if personally delivered, when received by such party.

2.22 In the event that any court of competent jurisdiction will hold any provision of this

Agreement unenforceable or invalid, such holding will not invalidate or render unenforceable any other provision of this Agreement.

UPDATED APRIL 10, 2025 V5.1 11

2.23 All other prior discussions, communications, and representations concerning the subject matter of this Agreement are superseded by the terms of this Agreement, and except as specifically provided in this Agreement, this Agreement constitutes the entire agreement with respect to the subject matter.

2.24 The waiver by either party of a breach or violation of any provisions of this Agreement will not operate as, or be construed to be, a waiver of any subsequent breach of the same or other provision of this Agreement.

2.25 Nothing in this Agreement is intended to constitute a waiver of sovereign immunity by or on behalf of the State of South Dakota, its agencies, officers, or employees.

2.26 Neither party will disclose the contents of the Agreement except as required by applicable law or as necessary to carry out the terms of the Agreement or to enforce that party’s rights under this Agreement. The Contractor acknowledges that the State of South Dakota and its agencies are public entities and thus are bound by South Dakota open meetings and open records laws. It is therefore not a breach of this Agreement for the State to take any action that the State reasonably believes is necessary to comply with the South Dakota open records or open meetings laws, including, without limitation, posting this Agreement on the website pursuant to SDCL § 1-27-46.

3.0 Scope of Work

The Division of Economic Assistance is requesting that respondents provide at a minimum, an AVS with the ability to provide liquid, motor vehicle, and property assets for recipient and spouse accounts.

Proposals must provide a description for each of the following requirements and how they will be met.

3.1 The AVS shall send and receive liquid asset inquiries and verifications electronically from the AVS to the Financial Institution (FI) and to the Department of Social Services, Division of Economic Assistance (DSS).

3.2 The AVS shall receive requests via daily batch files from the State’s Medicaid E&E system and return response files on a daily basis or other mutually agreed timeframe between the State and winning vendor. Vendors should include any standard request and response file formats they utilize with their proposal.

3.3 The system must have the capability to provide for electronic submission of requests to FIs and the electronic receipt of responses from FIs.

3.4 The system must have the ability to send and receive motor vehicle and real property inquires and verifications electronically from reliable data sources. If utilizing secondary data sources, response shall provide the source of the information.

3.5 The system must be directly integrated with the State’s existing Medicaid E&E system which is a Merative Cúram product.

3.6 The Contractor shall participate in any necessary design, development, and implementation (DDI) activities related to the integration of the AVS system into the

UPDATED APRIL 10, 2025 V5.1 12

E&E system.

3.7 The AVS must provide documentary evidence that the search was conducted even if no assets are found.

3.8 The AVS shall request information concerning both open and closed FI accounts going back for a period up to five (5) years to determine if the client's name appeared on any account or financial instrument as a single or joint owner during the look-back period.

3.9 The AVS shall include, at a minimum, checking, savings, investment accounts, IRAs, treasury notes, certificates of deposit, annuities and any other assets that may be held or managed by a FI.

3.10 The AVS shall allow for verification requests to be sent to FI other than those identified by the applicant or recipient. These queries shall be based on some logic such as geographic proximity to the applicant's home address or other reasonable factors.

Define geographic proximity methodology used.

3.11 The AVS must provide an option for DSS staff to specify FIs or FIs in an area.

3.12 Network of Financial Institutions

3.11.1 The Contractor shall have an established network of Financial Institutions (FIs) who will participate in the AVS. The network shall be geographically diverse and shall include matching with FIs located outside of South Dakota. The Contractor shall complete and submit a listing of all currently participating FIs and shall provide a contact person’s name, phone number and types of accounts from each FI.

3.11.2 The Contractor shall have an established system for recruiting FIs and shall establish and maintain a good working relationship with FI's and professional associations with which it is required to be in contact in the performance of the Contract. The Contractor shall describe the strategies used to recruit and retain FIs.

3.13 System Requirements and Security

3.12.1 The AVS must meet at a minimum the following standards: SOC 2 Level 2 and

National Institute of Standards and Technology (NIST) guidelines.

3.12.2 All software and cloud services purchased by the state will be subjected to security scans by BIT without exception to non-production systems.

3.12.3 The Contractor shall ensure communication from DSS to FIs and other systems as necessary and approved by DSS is secure.

3.12.4 Potential contractors shall submit in their proposal, data fields available. Data fields shall closely align with form SSA-4641.

3.12.5 The data gathered by the proposed system shall, for liquid assets, shall contain at a minimum: recipient name, spouse’s name, recipients SSN, spouses SSN, UPDATED APRIL 10, 2025 V5.1 13 name and address of FI, account numbers, type of account, lowest monthly balance for date span requested, FI representative name, FI representative phone number, FI response date, any FI comments.

3.12.6 The data gathered by the proposed system shall, for motor vehicles, contain at a minimum: owner’s name(s), vehicle make, vehicle model, vehicle year, fair market value, and registration status (active or expired).

3.12.7 The data gathered by the proposed system shall, for real property, contain at a minimum: owner’s name(s), property address, fair market value, and a date the ownership began.

3.14 Performance Measures

3.13.1 The system shall provide evidence of a response of the finding or not finding of a match for 100% of all requests.

3.13.2 Provide the current turn-around times for a request to an FI, e.g., 90% of requests are returned from the FI within 5 business days, 5% within 10 business days and 5 % are never returned.

3.13.3 Provide the current turn-around time for a request for Motor Vehicle and real property requests.

3.13.4 Contractor shall ensure that its asset verification system is accessible for both individual and batch requests and has an uptime of no less than 98% as measured on a monthly basis.

3.13.5 Contractor shall provide a minimum of 48 hours written notice in advance of a planned outage, and confirmation of system unavailability within one hour before or after the system being unavailable.

3.14 Contract Payment Methodology

3.14.1 DSS will pay Contractor monthly, or another agreed upon time frame for services provided pursuant to this Contract. The total cost of services, whether they are billed on a yearly flat-fee basis or a per-lookup basis, or another proposed methodology may not exceed a maximum allowable contract value determined by DSS.

3.14.2 It is South Dakota’s intent to procure an AVS that is operational in other states and can be used as a service with little upfront development cost.

3.15 Proposed Implementation Plan and Timeline

3.15.1 The AVS vendor shall outline in their response the detailed project plan and schedule that they envision will be necessary to implement their solution in South Dakota. The plan should show the tasks, milestones and timeline necessary to implement the solution and should clearly outline the expectations for State resources for each task.

UPDATED APRIL 10, 2025 V5.1 14

3.15.2 The State does not intend to spend significant time on Design, Development and Implementation activities as AVS solutions exist and are operational in the marketplace and the State expects to leverage existing tools and solutions that can be used by South Dakota. The contractor should clearly specify what implementation activities require DDI, if any.

4.0 Project Deliverables/Approach/Methodology

The offeror must describe in detail how its proposed deliverables will meet the needs of the State as described in Section 3. At its sole discretion, the State may consider a solution that includes any of these deliverables or consider deliverables not originally listed.

An offeror must highlight any requirement in Section 3 or Section 4 that the offeror’s proposed deliverables cannot comply with, and the offeror must provide any suggested “work-around” to the requirement in question or a future date that the offeror will be able to comply with the requirement.

4.1 The offeror’s proposal must include a:

• Project Management Plan

• Project Schedule

• Risk Management Plan

• Data Conversion Plan, if applicable

• Requirements Traceability Matrix

• Communication Plan

• Testing Plan

• Training Plan

• Go-Live/Cutover Plan

• Post-Implementation Support (or Maintenance and Operations Plan)

In addition, the offeror’s proposal must include how its proposed deliverables will meet the following IT requirements (General, State Hosted, and Vendor Hosted). If the offeror’s proposal includes an option for a state hosted solution and an option for a vendor hosted solution, the offeror must provide a separate response for each proposed solution and how each solution will meet the requirements in Sections 3 and 4.

4.2 GENERAL IT REQUIREMENTS

4.2.1 Hosting and Data Access Requirements

The State will own all data tables created as a result of the Agreement. The State must have the ability to manipulate data, run reports as needed, pull code tables, access raw data, and develop dashboards as needed through Microsoft Power BI, ESRI, Tableau, and associated platforms.

The offeror’s proposal must describe how the State can access data housed within the proposed solution for ingestion into a state data repository, encompassing available methodologies (e.g., application programming interface (API), flat file), data formatting, frequency of updates, and any inherent constraints. Additionally, the offeror’s proposal must provide a high-level architecture diagram, as part of the solution diagram as required by Section 6.7, explaining the proposed solution's data provision mechanism.

UPDATED APRIL 10, 2025 V5.1 15

4.2.2 Single Sign-On Requirements

If the offeror’s proposal includes a deliverable with a login component, the proposal must describe how the deliverable will integrate with the State’s standard identity management service single sign-on (SSO).

The State’s SSO supports the industry standard OAuth 2.0 protocol. This identity management will handle password recovery and multi-factor authentication (MFA). MFA is required for all application Administrators and may be required for other users. The State’s SSO requirement and links to Microsoft’s official documentation can be found at:

https://www.sd.gov/bit?id=bit_standards_single_sign_on.

If the offeror is not able to fulfill this identity management standard, the offeror’s proposal will be rejected from consideration.

4.2.3 SSO Logout Initiation Requirements

• The offeror’s deliverable must provide users with a clear and easily accessible logout mechanism (e.g., a “Logout” button/link).

• The logout functionality of the offeror’s deliverable must trigger a session-based logout process utilizing the sign-out endpoint found in the metadata document provided during implementation.

4.2.4 Session Timeout Requirements

• The offeror’s deliverables must allow for a customizable, State-defined inactive user session timeout period.

• The offeror’s deliverables must notify users of impending session expiration five minutes before the timeout occurs, providing users with the option to extend the session.

4.2.5 Session Termination on Browser Close Requirement

The offeror’s deliverables must clearly notify users that closing the browser window or tab is not a valid logout because the SSO session may remain active.

The notice must further notify users that they are responsible for explicitly logging out to ensure complete session termination.

4.2.6 Onboarding/Provisioning of Users Requirement

The offeror’s proposal must describe how new users are onboarded or provisioned into the deliverable. The offeror must provide an automated process for onboarding and offboarding users or must provide a process that requires minimal manual steps.

4.2.7 Interfaces and Integration Requirements

The offeror’s proposal must describe how the deliverables can adapt to business necessary interfaces using widely adopted open APIs and standards.

Additionally, the offeror must make available or expose software services that would enable third-party developers to interface other business applications.

The offeror must publish documentation for the software services in question.

The offeror’s proposal must include a detailed description of system capability.

4.2.8 Web Application Vulnerability Scan Requirements

https://www.sd.gov/bit?id=bit_standards_single_sign_on

UPDATED APRIL 10, 2025 V5.1 16

Any web-based deliverable must undergo a web application vulnerability scan (“Vulnerability Scan”). The Vulnerability Scan must identify misconfigurations or vulnerabilities such as those found in the OWASP Top Ten and must detail the certainty level of each finding.

Unless expressly indicated in writing, the State assumes all price estimates and bids are for the delivery and support of deliverables that will pass Vulnerability Scans. If the State determines that any aspect of the deliverable has security vulnerabilities that must be corrected, the State will inform the offeror of the nature of the issue and the offeror will be required to respond in writing regarding mitigation plans for the security vulnerabilities. If the deliverable does not pass the initial Vulnerability Scan or the offeror cannot provide a satisfactory Vulnerability Scan report, additional scans may be required to confirm the deliverable is secure.

State Hosted: For state hosted web-based deliverables, the Vulnerability Scan will be performed by the State and the offeror’s proposal should take that into consideration when responding to this RFP. As a condition of the resulting contract, the state hosted web-based deliverable will have to successfully pass the Vulnerability Scan prior to the deliverable being allowed to go in a production environment. Any offeror who responds to this RFP must accept such a contract term and must factor this security requirement into the offeror’s proposal.

Vendor Hosted: For vendor hosted web-based deliverables, any offeror who makes it to the “Tech Review” stage of the RFP process must provide the State a copy of the full report of the deliverable’s most recent Vulnerability Scan, a summary will not be accepted. The offeror should mark the vulnerability report as “Confidential” if it treats such a report as confidential information. If the offeror requires a Non-Disclosure Agreement (NDA) to be in place before the State may review the Vulnerability Scan report, the offeror must notify the State of such a requirement and resolve the signing of an NDA with enough time to respond to this RFP within the timeframe.

The offeror’s Vulnerability Scan report must consist of, at a minimum:

• The system that was evaluated,

• The categories that were evaluated (examples: SQLi, XSS, or RCE),

• What were the general findings,

• Technical detail of each issue found,

• Remediation status of enumerated issues (if any).

The cost of any Vulnerability Scans done by the offeror or the offeror’s costs associated with the State performing Vulnerability Scans must be part of the offeror’s cost proposal. Failure of a deliverable to satisfactorily pass a Vulnerability Scan may result in the offeror’s proposal being rejected.

4.2.9 Test System Requirement

The offeror must include a test system for its application deliverables to be used

UPDATED APRIL 10, 2025 V5.1 17

at the discretion of the State. All resource costs, including licensing costs, associated with keeping the test system available must be detailed in the offeror’s cost proposal. If the offeror does not include the test system costs in the offeror’s proposal, then the offeror will bear the costs. The offeror will maintain the test system as a mirror image of the production system code base.

4.2.10 Internal Processes and Procedures Requirement

The offeror must use industry standard processes and procedures, such as a software development lifecycle, when planning the development, configuration, implementation, and support of a proposed deliverable. The offeror must outline their internal processes and procedures in their proposal, including, but not limited to, alerting key stake holders (such as: Operations, Systems Support staff, Desktop Support staff, Administrators, Help Desk personnel, Client Representatives, and others) of changes that will be occurring within State or offeror resources or systems.

4.2.11 Email Domain Name Requirement

If the offeror’s proposal includes a website or a web application that generates email and is hosted by the offeror or in the State’s cloud, the proposed website or web application cannot use state email domains as the originating domain name.

4.2.12 Banned Entity Requirement

The offeror’s proposed deliverables cannot include any hardware or hardware components manufactured by Huawei Technologies Company, Nuctech, or ZTE Corporation or any subsidiary or affiliate of such entities. This includes hardware going on the State’s network as well as the offeror’s network if the offeror’s network is accessing the State’s network or accessing State data. This includes Infrastructure as a Service, Platform as a Service, or Software as a Service situations. Any company that is considered to be a security risk by the government of the United States of America under the International Emergency Economic Powers Act, in a United States appropriation bill, an Executive Order, or listed on the US Department of Commerce’s Entity List will be included in this ban.

4.2.13 Access Management Requirement

If the offeror’s proposed deliverables require accounts allowing access to State systems, then the offeror must indicate the number of the offeror’s staff or subcontractors that will require access, the level of access needed, and if these accounts will be used for remote access. These individuals will be required to use Multi-Factor Authentication (MFA). The State’s costs in providing these accounts will be a consideration when assessing the cost of the offeror’s proposal. All costs associated with providing an account to the offeror will be borne by the agency.

4.2.14 Testing Requirements

The following testing may be required:

4.2.14.1 Regression Testing – Regression testing is the process of testing changes to computer programs to make sure that the older programming still works with the new changes.

UPDATED APRIL 10, 2025 V5.1 18

4.2.14.2 Integration Testing – Integration testing is a software development process which program units are combined and tested as groups in multiple ways. In this context, a unit is defined as the smallest testable part of an application. Integration testing can expose problems with the interfaces among program components before trouble occurs in real-world program execution.