RFP QAAA 2026000189 Amendment #02.pdf

RFP QAAA 2026000189

Child Care Licensing Inspectors

Amendment #02

The purpose of this Amendment #02 is to incorporate the following exhibits to the RFP:

• Exhibit F - HIPAA Business Associate Agreement (BAA)

• Exhibit G - Personal Identifying Information (PII)

Please reference the revised RFP document (v.2) for updated information. Note that all changes are highlighted in red.

Exhibit F

Page 1 of 12 Version 12/24

Ex_HIPAA_BAA 12-24A

HIPAA BUSINESS ASSOCIATE AGREEMENT

This HIPAA Business Associate Agreement (“Agreement”) between the State and Contractor is agreed to in connection with, and as an exhibit to, the Contract. For purposes of this Agreement, the State is referred to as “Covered Entity” and the Contractor is referred to as “Business Associate”. Unless the context clearly requires a distinction between the Contract and this Agreement, all references to

“Contract” shall include this Agreement.

1. Purpose

Covered Entity wishes to disclose information to Business Associate, which may include

Protected Health Information ("PHI"). The Parties intend to protect the privacy and security of the disclosed PHI in compliance with the Health Insurance Portability and

Accountability Act of 1996 (“HIPAA”), Pub. L. No. 104-191 (1996) as amended by the

Health Information Technology for Economic and Clinical Health Act (“HITECH Act”) enacted under the American Recovery and Reinvestment Act of 2009 (“ARRA”) Pub. L.

No. 111–5 (2009), implementing regulations promulgated by the U.S. Department of

Health and Human Services at 45 C.F.R. Parts 160, 162 and 164 (the “HIPAA Rules”) and other applicable laws, as amended. Prior to the disclosure of PHI, Covered Entity is required to enter into an agreement with Business Associate containing specific requirements as set forth in, but not limited to, Title 45, Sections 160.103, 164.502(e) and

164.504(e) of the Code of Federal Regulations (“C.F.R.”) and all other applicable laws and regulations, all as may be amended.

2. Definitions

The following terms used in this Agreement shall have the same meanings as in the HIPAA

Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care

Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health

Information, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured

Protected Health Information, and Use.

The following terms used in this Agreement shall have the meanings set forth below:

A. Business Associate. “Business Associate” shall have the same meaning as the term

“business associate” at 45 C.F.R. 160.103, and shall refer to Contractor.

Page 2 of 12 Version 12/24

B. Covered Entity. “Covered Entity” shall have the same meaning as the term “covered entity” at 45 C.F.R. 160.103, and shall refer to the State.

C. Information Technology and Information Security. “Information Technology” and

“Information Security” shall have the same meanings as the terms “information technology” and “information security”, respectively, in §24-37.5-102, C.R.S.

Capitalized terms used herein and not otherwise defined herein or in the HIPAA Rules shall have the meanings ascribed to them in the Contract.

3. Obligations and Activities of Business Associate

A. Permitted Uses and Disclosures.

i. Business Associate shall use and disclose PHI only to accomplish Business

Associate’s obligations under the Contract.

ii. To the extent Business Associate carries out one or more of Covered Entity’s obligations under Subpart E of 45 C.F.R. Part 164, Business Associate shall comply with any and all requirements of Subpart E that apply to Covered Entity in the performance of such obligation.

iii. Business Associate may disclose PHI to carry out the legal responsibilities of

Business Associate, provided, that the disclosure is Required by Law or

Business Associate obtains reasonable assurances from the person to whom the information is disclosed that:

a. the information will remain confidential and will be used or disclosed only as Required by Law or for the purpose for which Business Associate originally disclosed the information to that person, and;

b. the person notifies Business Associate of any Breach involving PHI of which it is aware.

iv. Business Associate may provide Data Aggregation services relating to the

Health Care Operations of Covered Entity. Business Associate may de-identify any or all PHI created or received by Business Associate under this Agreement, Page 3 of 12 Version 12/24 provided the de-identification conforms to the requirements of the HIPAA

Rules.

B. Minimum Necessary.

Business Associate, its Subcontractors and agents, shall access, use, and disclose only the minimum amount of PHI necessary to accomplish the objectives of the Contract, in accordance with the Minimum Necessary Requirements of the HIPAA Rules including, but not limited to, 45 C.F.R. 164.502(b) and 164.514(d).

C. Impermissible Uses and Disclosures.

i. Business Associate shall not disclose the PHI of Covered Entity to another covered entity without the written authorization of Covered Entity.

ii. Business Associate shall not share, use, disclose or make available any Covered

Entity PHI in any form via any medium with or to any person or entity beyond the boundaries or jurisdiction of the United States without express written authorization from Covered Entity.

D. Business Associate's Subcontractors.

i. Business Associate shall, in accordance with 45 C.F.R. 164.502(e)(1)(ii) and

164.308(b)(2), ensure that any Subcontractors who create, receive, maintain, or transmit PHI on behalf of Business Associate agree in writing to the same restrictions, conditions, and requirements that apply to Business Associate with respect to safeguarding PHI.

ii. Business Associate shall provide to Covered Entity, on Covered Entity’s request, a list of Subcontractors who have entered into any such agreement with

Business Associate.

iii. Business Associate shall provide to Covered Entity, on Covered Entity’s request, copies of any such agreements Business Associate has entered into with

Subcontractors.

E. Access to System.

Page 4 of 12 Version 12/24

If Business Associate needs access to a Covered Entity Information Technology system to comply with its obligations under the Contract or this Agreement, Business

Associate shall request, review, and comply with any and all policies applicable to

Covered Entity regarding such system including, but not limited to, any policies promulgated by the Office of Information Technology and available at http://oit.state.co.us/about/policies.

F. Access to PHI.

Business Associate shall, within ten days of receiving a written request from Covered

Entity, make available PHI in a Designated Record Set to Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. 164.524.

Amendment of PHI.

i. Business Associate shall within ten days of receiving a written request from

Covered Entity make any amendment to PHI in a Designated Record Set as directed by or agreed to by Covered Entity pursuant to 45 C.F.R. 164.526, or take other measures as necessary to satisfy Covered Entity’s obligations under

45 C.F.R. 164.526.

ii. Business Associate shall promptly forward to Covered Entity any request for amendment of PHI that Business Associate receives directly from an Individual.

G. Accounting Rights.

Business Associate shall, within ten days of receiving a written request from Covered

Entity, maintain and make available to Covered Entity the information necessary for

Covered Entity to satisfy its obligations to provide an accounting of Disclosure under

45 C.F.R. 164.528.

H. Restrictions and Confidential Communications.

i. Business Associate shall restrict the Use or Disclosure of an Individual’s PHI within ten days of notice from Covered Entity of:

a. a restriction on Use or Disclosure of PHI pursuant to 45 C.F.R. 164.522;

or

Page 5 of 12 Version 12/24

b. a request for confidential communication of PHI pursuant to 45 C.F.R.

164.522.

ii. Business Associate shall not respond directly to an Individual’s requests to restrict the Use or Disclosure of PHI or to send all communication of PHI to an alternate address.

iii. Business Associate shall refer such requests to Covered Entity so that Covered

Entity can coordinate and prepare a timely response to the requesting Individual and provide direction to Business Associate.

I. Governmental Access to Records.

Business Associate shall make its facilities, internal practices, books, records, and other sources of information, including PHI, available to the Secretary for purposes of determining compliance with the HIPAA Rules in accordance with 45 C.F.R.

160.310.

J. Audit, Inspection and Enforcement.

i. Business Associate shall obtain and update at least annually a written assessment performed by an independent third party reasonably acceptable to

Covered Entity, which evaluates the Information Security of the applications, infrastructure, and processes that interact with the Covered Entity data Business

Associate receives, manipulates, stores and distributes. Upon request by

Covered Entity, Business Associate shall provide to Covered Entity the executive summary of the assessment.

ii. Business Associate, upon the request of Covered Entity, shall fully cooperate with Covered Entity’s efforts to audit Business Associate’s compliance with applicable HIPAA Rules. If, through audit or inspection, Covered Entity determines that Business Associate’s conduct would result in violation of the

HIPAA Rules or is in violation of the Contract or this Agreement, Business

Associate shall promptly remedy any such violation and shall certify completion of its remedy in writing to Covered Entity.

K. Appropriate Safeguards.

Page 6 of 12 Version 12/24

i. Business Associate shall use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI to prevent use or disclosure of PHI other than as provided in this Agreement.

ii. Business Associate shall safeguard the PHI from tampering and unauthorized disclosures.

iii. Business Associate shall maintain the confidentiality of passwords and other data required for accessing this information.

iv. Business Associate shall extend protection beyond the initial information obtained from Covered Entity to any databases or collections of PHI containing information derived from the PHI. The provisions of this section shall be in force unless PHI is de-identified in conformance to the requirements of the

HIPAA Rules.

L. Safeguard During Transmission.

i. Business Associate shall use reasonable and appropriate safeguards including, without limitation, Information Security measures to ensure that all transmissions of PHI are authorized and to prevent use or disclosure of PHI other than as provided for by this Agreement.

ii. Business Associate shall not transmit PHI over the internet or any other insecure or open communication channel unless the PHI is encrypted or otherwise safeguarded with a FIPS-compliant encryption algorithm.

M. Reporting of Improper Use or Disclosure and Notification of Breach.

i. Business Associate shall, as soon as reasonably possible, but immediately after discovery of a Breach, notify Covered Entity of any use or disclosure of PHI not provided for by this Agreement, including a Breach of Unsecured Protected

Health Information as such notice is required by 45 C.F.R. 164.410 or a breach for which notice is required under §24-73-103, C.R.S.

ii. Such notice shall include the identification of each Individual whose Unsecured

Protected Health Information has been, or is reasonably believed by Business

Associate to have been, accessed, acquired, or disclosed during such Breach.

Page 7 of 12 Version 12/24

iii. Business Associate shall, as soon as reasonably possible, but immediately after discovery of any Security Incident that does not constitute a Breach, notify

Covered Entity of such incident.

iv. Business Associate shall have the burden of demonstrating that all notifications were made as required, including evidence demonstrating the necessity of any delay.

N. Business Associate’s Insurance and Notification Costs.

i. Business Associate shall bear all costs of a Breach response including, without limitation, notifications, and shall maintain insurance to cover:

a. loss of PHI data;

b. Breach notification requirements specified in HIPAA Rules and in §24-

73-103, C.R.S.; and

c. claims based upon alleged violations of privacy rights through improper use or disclosure of PHI.

ii. All such policies shall meet or exceed the minimum insurance requirements of the Contract or otherwise as may be approved by Covered Entity (e.g., occurrence basis, combined single dollar limits, annual aggregate dollar limits, additional insured status, and notice of cancellation).

iii. Business Associate shall provide Covered Entity a point of contact who possesses relevant Information Security knowledge and is accessible 24 hours per day, 7 days per week to assist with incident handling.

iv. Business Associate, to the extent practicable, shall mitigate any harmful effect known to Business Associate of a Use or Disclosure of PHI by Business

Associate in violation of this Agreement.

O. Subcontractors and Breaches.

i. Business Associate shall enter into a written agreement with each of its

Subcontractors and agents, who create, receive, maintain, or transmit PHI on behalf of Business Associate. The agreements shall require such Subcontractors

Page 8 of 12 Version 12/24 and agents to report to Business Associate any use or disclosure of PHI not provided for by this Agreement, including Security Incidents and Breaches of

Unsecured Protected Health Information, on the first day such Subcontractor or agent knows or should have known of the Breach as required by 45 C.F.R.

164.410.

ii. Business Associate shall notify Covered Entity of any such report and shall provide copies of any such agreements to Covered Entity on request.

P. Data Ownership.

i. Business Associate acknowledges that Business Associate has no ownership rights with respect to the PHI.

ii. Upon request by Covered Entity, Business Associate immediately shall provide

Covered Entity with any keys to decrypt information that the Business

Association has encrypted and maintains in encrypted form, or shall provide such information in unencrypted usable form.

Q. Retention of PHI.

Except upon termination of this Agreement as provided in Section 5 below, Business

Associate and its Subcontractors or agents shall retain all PHI throughout the term of this Agreement, and shall continue to maintain the accounting of disclosures required under Section 3.G above, for a period of six years.

4. Obligations of Covered Entity

A. Safeguards During Transmission.

Covered Entity shall be responsible for using appropriate safeguards including encryption of PHI, to maintain and ensure the confidentiality, integrity, and security of PHI transmitted pursuant to this Agreement, in accordance with the standards and requirements of the HIPAA Rules.

B. Notice of Changes.

i. Covered Entity maintains a copy of its Notice of Privacy Practices on its website. Covered Entity shall provide Business Associate with any changes in, Page 9 of 12 Version 12/24 or revocation of, permission to use or disclose PHI, to the extent that it may affect Business Associate’s permitted or required uses or disclosures.

ii. Covered Entity shall notify Business Associate of any restriction on the use or disclosure of PHI to which Covered Entity has agreed in accordance with 45

C.F.R. 164.522, to the extent that it may affect Business Associate’s permitted use or disclosure of PHI.

5. Termination

A. Breach.

i. In addition to any Contract provision regarding remedies for breach, Covered

Entity shall have the right, in the event of a breach by Business Associate of any provision of this Agreement, to terminate immediately the Contract, or this

Agreement, or both.

ii. Subject to any directions from Covered Entity, upon termination of the

Contract, this Agreement, or both, Business Associate shall take timely, reasonable, and necessary action to protect and preserve property in the possession of Business Associate in which Covered Entity has an interest.

B. Effect of Termination.

i. Upon termination of this Agreement for any reason, Business Associate, at the option of Covered Entity, shall return or destroy all PHI that Business

Associate, its agents, or its Subcontractors maintain in any form, and shall not retain any copies of such PHI.

ii. If Covered Entity directs Business Associate to destroy the PHI, Business

Associate shall certify in writing to Covered Entity that such PHI has been destroyed.

iii. If Business Associate believes that returning or destroying the PHI is not feasible, Business Associate shall promptly provide Covered Entity with notice of the conditions making return or destruction infeasible. Business Associate shall continue to extend the protections of Section 3 of this Agreement to such

Page 10 of 12 Version 12/24

PHI, and shall limit further use of such PHI to those purposes that make the return or destruction of such PHI infeasible.

6. Injunctive Relief

Covered Entity and Business Associate agree that irreparable damage would occur in the event Business Associate or any of its Subcontractors or agents use or disclosure of PHI in violation of this Agreement, the HIPAA Rules or any applicable law. Covered Entity and

Business Associate further agree that money damages would not provide an adequate remedy for such Breach. Accordingly, Covered Entity and Business Associate agree that

Covered Entity shall be entitled to injunctive relief, specific performance, and other equitable relief to prevent or restrain any Breach or threatened Breach of and to enforce specifically the terms and provisions of this Agreement.

7. Limitation of Liability

Any provision in the Contract limiting Contractor’s liability shall not apply to Business

Associate’s liability under this Agreement, which shall not be limited.

8. Disclaimer

Covered Entity makes no warranty or representation that compliance by Business

Associate with this Agreement or the HIPAA Rules will be adequate or satisfactory for

Business Associate’s own purposes. Business Associate is solely responsible for all decisions made and actions taken by Business Associate regarding the safeguarding of PHI.

9. Certification

Covered Entity has a legal obligation under HIPAA Rules to certify as to Business

Associate’s Information Security practices. Covered Entity or its authorized agent or contractor shall have the right to examine Business Associate’s facilities, systems, procedures, and records, at Covered Entity’s expense, if Covered Entity determines that examination is necessary to certify that Business Associate’s Information Security safeguards comply with the HIPAA Rules or this Agreement.

10. Amendment

A. Amendment to Comply with Law.

Page 11 of 12 Version 12/24

The Parties acknowledge that state and federal laws and regulations relating to data security and privacy are rapidly evolving and that amendment of this Agreement may be required to provide procedures to ensure compliance with such developments.

i. In the event of any change to state or federal laws and regulations relating to data security and privacy affecting this Agreement, the Parties shall take such action as is necessary to implement the changes to the standards and requirements of HIPAA, the HIPAA Rules and other applicable rules relating to the confidentiality, integrity, availability and security of PHI with respect to this

Agreement.

ii. Business Associate shall provide to Covered Entity written assurance satisfactory to Covered Entity that Business Associate shall adequately safeguard all PHI, and obtain written assurance satisfactory to Covered Entity from Business Associate’s Subcontractors and agents that they shall adequately safeguard all PHI.

iii. Upon the request of either Party, the other Party promptly shall negotiate in good faith the terms of an amendment to the Contract embodying written assurances consistent with the standards and requirements of HIPAA, the

HIPAA Rules, or other applicable rules.

iv. Covered Entity may terminate this Agreement upon 30 days’ prior written notice in the event that:

a. Business Associate does not promptly enter into negotiations to amend the

Contract and this Agreement when requested by Covered Entity pursuant to this Section; or

b. Business Associate does not enter into an amendment to the Contract and this Agreement, which provides assurances regarding the safeguarding of

PHI sufficient, in Covered Entity’s sole discretion, to satisfy the standards and requirements of the HIPAA, the HIPAA Rules and applicable law.

B. Amendment of Appendix.

Page 12 of 12 Version 12/24

The Appendix to this Agreement may be modified or amended by the mutual written agreement of the Parties, without amendment of this Agreement. Any modified or amended Appendix agreed to in writing by the Parties shall supersede and replace any prior version of the Appendix.

11. Assistance in Litigation or Administrative Proceedings

Covered Entity shall provide written notice to Business Associate if litigation or administrative proceeding is commenced against Covered Entity, its directors, officers, or employees, based on a claimed violation by Business Associate of HIPAA, the HIPAA

Rules or other laws relating to security and privacy or PHI. Upon receipt of such notice and to the extent requested by Covered Entity, Business Associate shall, and shall cause its employees, Subcontractors, or agents assisting Business Associate in the performance of its obligations under the Contract to, assist Covered Entity in the defense of such litigation or proceedings. Business Associate shall, and shall cause its employees, Subcontractor’s and agents to, provide assistance, to Covered Entity, which may include testifying as a witness at such proceedings. Business Associate or any of its employees, Subcontractors or agents shall not be required to provide such assistance if Business Associate is a named adverse party.

12. Interpretation and Order of Precedence

Any ambiguity in this Agreement shall be resolved in favor of a meaning that complies and is consistent with the HIPAA Rules. In the event of an inconsistency between the Contract and this Agreement, this Agreement shall control. This Agreement supersedes and replaces any previous, separately executed HIPAA business associate agreement between the

Parties.

13. Survival

Provisions of this Agreement requiring continued performance, compliance, or effect after termination shall survive termination of this contract or this agreement and shall be enforceable by Covered Entity.

Page 1 of 2 Version 12/24

APPENDIX TO HIPAA BUSINESS ASSOCIATE AGREEMENT

This Appendix (“Appendix”) to the HIPAA Business Associate Agreement (“Agreement”) is s an appendix to the Contract and the Agreement. For the purposes of this Appendix, defined terms shall have the meanings ascribed to them in the Agreement and the Contract.

Unless the context clearly requires a distinction between the Contract, the Agreement, and this Appendix, all references to “Contract” or “Agreement” shall include this Appendix.

1. Purpose

This Appendix sets forth additional terms to the Agreement. Any sub-section of this

Appendix marked as “Reserved” shall be construed as setting forth no additional terms.

2. Additional Terms

A. Additional Permitted Uses.

In addition to those purposes set forth in the Agreement, Business Associate may use

PHI for the following additional purposes:

i. Reserved.

B. Additional Permitted Disclosures.

In addition to those purposes set forth in the Agreement, Business Associate may disclose PHI for the following additional purposes:

i. Reserved.

C. Approved Subcontractors.

Covered Entity agrees that the following Subcontractors or agents of Business

Associate may receive PHI under the Agreement:

i. Reserved.

D. Definition of Receipt of PHI.

Business Associate’s receipt of PHI under this Contract shall be deemed to occur, and

Business Associate’s obligations under the Agreement shall commence, as follows:

i. Reserved.

Page 2 of 2 Version 12/24

E. Additional Restrictions on Business Associate.

Business Associate agrees to comply with the following additional restrictions on

Business Associate’s use and disclosure of PHI under the Contract:

i. Reserved.

F. Additional Terms.

Business Associate agrees to comply with the following additional terms under the

Agreement:

i. Reserved.

Exhibit G

Page 1 of 1 Version 12/24

Ex_PII Certification (Organization)_12-24A

STATE OF COLORADO

THIRD PARTY ENTITY / ORGANIZATION CERTIFICATION FOR ACCESS TO PII

THROUGH A DATABASE OR AUTOMATED NETWORK

Pursuant to § 24-74-105, C.R.S., I, __________________________________, on behalf of _____________________________________________ (the “Organization”), hereby certify under the penalty of perjury that the Organization has not and will not use or disclose any Personal Identifying Information, as defined by § 24-74-102(1), C.R.S., for the purpose of investigating for, participating in, cooperating with, or assisting Federal

Immigration Enforcement, including the enforcement of civil immigration laws, and the

Illegal Immigration and Immigrant Responsibility Act, which is codified at 8 U.S.C. §§ 1325 and 1326, unless required to do so to comply with Federal or State law, or to comply with a court-issued subpoena, warrant or order.

I hereby represent and certify that I have full legal authority to execute this certification on behalf of the Organization.

Signature: __________________________

Printed Name: __________________________

Title: __________________________

Date: ___________

Page 1 of 17 RFP12-2025A

Colorado Department of Early Childhood (CDEC)

Request for Proposals (RFP)

Child Care Licensing Inspections

RFP QAAA 2026000189

Publication Date: March 25, 2026

Page 2 of 17 RFP12-2025A

Signature Page

VENDORS: Reference the solicitation document below for the response deadline and other response submission information and requirements.

Vendors responding to this solicitation are required to complete this page in its entirety, sign it, and submit it along with their response. This page must include either a physical or electronic signature, as defined by the

"Uniform Electronic Transactions Act," section 24-71.3-102 (8), to indicate the vendor's intent to be bound by their submission. Failure to comply with this requirement may result in disqualification of the vendor's response.

The undersigned acknowledges and agrees that any misrepresentation made in their response or in subsequent discussions or information provided to the State may be considered sufficient grounds for the State to decline to enter into a contract. Furthermore, any later discovery of omissions or misrepresentations in the solicitation response or in subsequent discussions may lead to the cancellation of any existing contract.

Legal Vendor Name:

Vendor Address:

Vendor Primary Contact Name:

Vendor Primary Contact Email:

Vendor Primary Contact Phone:

Name and email address of individual submitting this proposal (if different from the primary contact):

Is the Vendor a Service-Disabled Veteran Owned Small Business (SDVOSB) pursuant to C.R.S. §24- 103-905?

Is the Vendor currently on any debarred list?

Are you receiving funding from multiple sources for this project? (Yes/No)

● If yes, please provide details on how this proposal is a separate project from the others and how funding will be monitored.

o A duplication occurs when a person, household, business, or other entity receives federal assistance from multiple grant sources for the same purpose, and the total assistance received for that purpose is more than the total need. The amount of the Duplication of Benefit (DOB) is the amount received in excess of the total need for the same purpose. Any persons, business concerns, or other entities that are the recipient of duplicative assistance are liable to the United States for the amount of duplicated aid and the agency that provided the duplicative assistance is responsible for debt collection.

o Grant funds cannot be used to supplant current funding or existing activities. “Supplant” is defined as replacing funding of a recipient's existing program with funds from a state, federal, Page 3 of 17 RFP12-2025A or local funding.

Individual authorized to bind the Vendor to the proposal submission for this RFP:

Signature of individual authorized to bind the Vendor to the proposal submission for this RFP:

*If applicable, I confirm that my printed name acts as my signature.

Page 4 of 17 RFP12-2025A

Schedule of Activities

Single Point of Contact: Raven Lopez – raven.lopez@state.co.us Please note that phone lines may not be consistently monitored, email is the preferred method of communication. The individual listed above is the sole point of contact for this solicitation. Please note that reaching out to anyone other than this individual may lead to disqualification of an offer, with the exception of the Colorado Supplier Diversity Navigator at the Statewide Equity Office of Supplier Diversity for the sole purpose of assisting with submission of the solicitation.

Solicitation Purpose: CDEC is seeking a Vendor(s) to provide licensing recommendations, oversight, and enforcement to programs and providers in Arapahoe, Clear Creek, El Paso, Gilpin, Jefferson, and Pueblo Counties.

Eligibility Requirements: Any organization that can provide the services as outlined in this solicitation.

Service Location/Delivery Area: Arapahoe, Clear Creek, El Paso, Gilpin, Jefferson, and Pueblo Counties – Colorado.

Anticipated Contract Start Date: July 1, 2026, or Upon execution of a Contract.

Anticipated Contract Term: The anticipated term of the resulting contract(s) is July 1, 2026, through June 30, 2027. The resulting contract(s) may be renewed for up to four additional one-year periods, not to exceed a maximum of five years, at the sole discretion of the State, contingent upon funds being appropriated, budgeted, and otherwise made available, and other contractual requirements being satisfied.

Submission Method: Electronic. Reference Section 2.0 - Proposal Submission Instructions, for more information.

Pre-Proposal Conference: March 25, 2026, at 9:00am

* There will be a Pre-Proposal Conference. Reference Section 2.0 - Proposal Submission Instructions, for more information.

Inquiry Due Date and Time: April 3, 2026, at 1:00pm

* Please send any questions via email to the Single Point of Contact prior to the inquiry deadline. Reference Section 2.0 - Proposal Submission Instructions, for more information.

Answers to Inquiries: April 10, 2026

* Reference Section 2.0 - Proposal Submission Instructions, for more information.

Proposal Due Date and Time: April 17, 2026 @ 2pm

* Reference Section 2.0 - Proposal Submission Instructions, for more information.

Public Opening Date and Time: April 17, 2026, at 3pm

* Reference Section 2.0 - Proposal Submission Instructions, for more information.

Note: All dates and times are subject to change and are listed in Mountain Time.

mailto:raven.lopez@state.co.us

Page 5 of 17 RFP12-2025A

1.0 Exhibit List

● Exhibit A - Statement of Work (SOW) Template (Complete and Return)

● Exhibit B - Additional Provisions (For Review Only)

● Exhibit C - Vendor Contact Information Sheet (For Review Only)

● Exhibit D - CDEC Personal Services Contract Template (For Review Only)

● Exhibit E - Contract Federal Provisions (For Review Only)

● Exhibit F - HIPAA Business Associate Agreement (BAA) (For Review Only)

● Exhibit G - Personal Identifying Information (PII) (For Review Only)

2.0 Proposal Submission Instructions

i. Electronic Procurement Systems. Solicitations published by the CDEC will be posted on both BidNet

Direct and the Vendor Self-Service (VSS) site, however all bid submissions will only be officially accepted on BidNet Direct by the deadline listed in the Schedule of Activities.

ii. Electronic Bid Submission. Vendors must be registered with BidNet Direct in order to download solicitation documents (including any amendments or modifications) and to be considered responsive at the time of submission of the response. Bidders who have not registered on the BidNet Direct website must register promptly to ensure they are able to submit a timely bid response. Information may be accessed through the BidNet Direct website at:

https://www.bidnetdirect.com/register. Bidnet Direct’s Help Desk can be reached at 800-835-4603 or by email at: support@bidnet.com. No submissions will be accepted via VSS so please ensure that the proposal is submitted in accordance with these instructions.

iii. File Names. The zip file name should start with the solicitation type, solicitation number, and vendor name (e.g., “RFP QAAA 20XX000XXX Vendor Name…”).

iv. Confirmation. Vendors will receive an email confirmation that the file was uploaded correctly. If not, please contact the BidNet Direct Help Desk.

v. Pre-Proposal Conference.

There will be an optional pre-proposal conference offered. The format of this meeting will be a 15-minute presentation followed by a 30-minute questions and answers (Q&A) session. Please note that during the Q&A session, if there are no questions received after a period of time, the Pre- Proposal conference will end. Please refer to the information below on how to attend the conference:

March 25, 2026, at 9:00am Meeting Link: meet.google.com/wnr-bmhz-ypj Dial in: 8603-436-(US) +1 414 PIN: 149 462 732#

vi. Public Bid Opening. During the public bid opening, CDEC will formally open and announce all received proposals, revealing each bidder's name and submission timestamp to all attendees. To attend the Public Bid Opening, please refer to the information below on how to attend:

April 17, 2026, at 3:00pm Meeting Link: meet.google.com/bxr-bgni-fmq Dial in: (US) +1 614-379-1393 PIN: 945 175 471#

vii. Questions. Vendors may submit questions by email to the Single Point of Contact prior to the inquiry deadline identified in the Schedule of Activities above. The Department may answer some, all, or none of the questions asked by posting them publicly via an amendment to this solicitation on both the BidNet and VSS sites. The state reserves the right to decline to answer any questions that do not pertain to the bid, are deemed offensive, or to decline to answer any question for any reason.

https://www.bidnetdirect.com/register mailto:support@bidnet.com meet.google.com/wnr-bmhz-ypj meet.google.com/bxr-bgni-fmq

Page 6 of 17 RFP12-2025A

viii. Timeliness of Proposal Submission. Proposals received after the submission deadline shall not be opened and shall be rejected as a late proposal, unless otherwise permitted by the procurement official in accordance with Colorado Procurement Rule R-24-103-201-10.

ix. Deadline Adherence. Time is of the essence. Failure of a vendor to respond to any requests by established deadlines may result in the proposal being rejected.

x. Multiple or Alternate Proposals. Unless otherwise stated in this solicitation, vendors shall not be limited in providing multiple or alternate proposals. In the event a vendor provides multiple or alternate proposals, each proposal must be submitted separately and distinctly to permit independent review based on the individual proposal. Further, any vendor submitting multiple or alternate proposals must expressly identify their preferred or primary proposal.

xi. Additional Resources:

● Vendor Assistance. Any vendors needing support responding to solicitations may contact the

Colorado Supplier Diversity Navigator at the Statewide Equity Office of Supplier Diversity, https://dhr.colorado.gov/statewide-equity-office/supplier-diversity. Services provided include assistance with responding to solicitations, interpretation of solicitation documents, technical assistance referrals. The office can be reached during normal business hours by calling 303-866-5765 or emailing DPA_SupplierDiversityHelp@state.co.us.

○ Statewide Equity Office of Supplier Diversity:

https://urldefense.proofpoint.com/v2/url?u=https-3A__dhr.colorado.gov_statewide- 2Dequity-2Doffice_supplier- 2Ddiversity&d=DwMFaQ&c=sdnEM9SRGFuMt5z5w3AhsPNahmNicq64TgF1JwNR0cs&r= 2K9kkYDPzg9W7wrnb9URPPzWuzXzmzc6oQUqmP_d9mA&m=UsSCoCc_Nnj_It7iTj2w9X h- U0kW8zKwh7sIdTrgvW_OXQDDQG8CMBmOZsCmKo6l&s=AHk9LQL8xQKwtYW6AlMhIp Khc64M4gHnBm1wvGiKqhU&e=

● BidNet Direct: https://www.bidnetdirect.com/

● Vendor Self-Service (VSS) Site: https://prd.co.cgiadvantage.com/PRDVSS1X1/Advantage4

3.0 Proposal Format

i. In General. Proposals must clearly demonstrate the organization’s ability to perform the services described in this RFP.

ii. Maximum Length. Proposals should not exceed 25 pages (excluding any required attachments). The Department may evaluate proposals negatively if this page limit is not followed. Proposals must include all required attachments:

iii. Please respond to the items listed in Section 5.0 Proposal Content in the same sequence as outlined in this section. Proposals that do not follow the sequence outline and response format of this Request for Proposals (RFP) may be deemed non-responsive and disqualified from further consideration.

iv. Please define all acronyms used in your proposal. Include any additional considerations, capabilities, or information that demonstrate your qualifications for this project.

v. Mandatory Requirements. Failure to address all mandatory requirements outlined in

Section 5.0 Proposal Content will result in disqualification.

4.0 Introduction and Background

The Division of Early Learning Licensing and Administration (DELLA) brings together the critical work to https://dhr.colorado.gov/statewide-equity-office/supplier-diversity https://urldefense.proofpoint.com/v2/url?u=https-3A__dhr.colorado.gov_statewide-2Dequity-2Doffice_supplier-2Ddiversity&d=DwMFaQ&c=sdnEM9SRGFuMt5z5w3AhsPNahmNicq64TgF1JwNR0cs&r=2K9kkYDPzg9W7wrnb9URPPzWuzXzmzc6oQUqmP_d9mA&m=UsSCoCc_Nnj_It7iTj2w9Xh-U0kW8zKwh7sIdTrgvW_OXQDDQG8CMBmOZsCmKo6l&s=AHk9LQL8xQKwtYW6AlMhIpKhc64M4gHnBm1wvGiKqhU&e= https://urldefense.proofpoint.com/v2/url?u=https-3A__dhr.colorado.gov_statewide-2Dequity-2Doffice_supplier-2Ddiversity&d=DwMFaQ&c=sdnEM9SRGFuMt5z5w3AhsPNahmNicq64TgF1JwNR0cs&r=2K9kkYDPzg9W7wrnb9URPPzWuzXzmzc6oQUqmP_d9mA&m=UsSCoCc_Nnj_It7iTj2w9Xh-U0kW8zKwh7sIdTrgvW_OXQDDQG8CMBmOZsCmKo6l&s=AHk9LQL8xQKwtYW6AlMhIpKhc64M4gHnBm1wvGiKqhU&e= https://urldefense.proofpoint.com/v2/url?u=https-3A__dhr.colorado.gov_statewide-2Dequity-2Doffice_supplier-2Ddiversity&d=DwMFaQ&c=sdnEM9SRGFuMt5z5w3AhsPNahmNicq64TgF1JwNR0cs&r=2K9kkYDPzg9W7wrnb9URPPzWuzXzmzc6oQUqmP_d9mA&m=UsSCoCc_Nnj_It7iTj2w9Xh-U0kW8zKwh7sIdTrgvW_OXQDDQG8CMBmOZsCmKo6l&s=AHk9LQL8xQKwtYW6AlMhIpKhc64M4gHnBm1wvGiKqhU&e= https://urldefense.proofpoint.com/v2/url?u=https-3A__dhr.colorado.gov_statewide-2Dequity-2Doffice_supplier-2Ddiversity&d=DwMFaQ&c=sdnEM9SRGFuMt5z5w3AhsPNahmNicq64TgF1JwNR0cs&r=2K9kkYDPzg9W7wrnb9URPPzWuzXzmzc6oQUqmP_d9mA&m=UsSCoCc_Nnj_It7iTj2w9Xh-U0kW8zKwh7sIdTrgvW_OXQDDQG8CMBmOZsCmKo6l&s=AHk9LQL8xQKwtYW6AlMhIpKhc64M4gHnBm1wvGiKqhU&e= https://urldefense.proofpoint.com/v2/url?u=https-3A__dhr.colorado.gov_statewide-2Dequity-2Doffice_supplier-2Ddiversity&d=DwMFaQ&c=sdnEM9SRGFuMt5z5w3AhsPNahmNicq64TgF1JwNR0cs&r=2K9kkYDPzg9W7wrnb9URPPzWuzXzmzc6oQUqmP_d9mA&m=UsSCoCc_Nnj_It7iTj2w9Xh-U0kW8zKwh7sIdTrgvW_OXQDDQG8CMBmOZsCmKo6l&s=AHk9LQL8xQKwtYW6AlMhIpKhc64M4gHnBm1wvGiKqhU&e= https://urldefense.proofpoint.com/v2/url?u=https-3A__dhr.colorado.gov_statewide-2Dequity-2Doffice_supplier-2Ddiversity&d=DwMFaQ&c=sdnEM9SRGFuMt5z5w3AhsPNahmNicq64TgF1JwNR0cs&r=2K9kkYDPzg9W7wrnb9URPPzWuzXzmzc6oQUqmP_d9mA&m=UsSCoCc_Nnj_It7iTj2w9Xh-U0kW8zKwh7sIdTrgvW_OXQDDQG8CMBmOZsCmKo6l&s=AHk9LQL8xQKwtYW6AlMhIpKhc64M4gHnBm1wvGiKqhU&e= https://urldefense.proofpoint.com/v2/url?u=https-3A__dhr.colorado.gov_statewide-2Dequity-2Doffice_supplier-2Ddiversity&d=DwMFaQ&c=sdnEM9SRGFuMt5z5w3AhsPNahmNicq64TgF1JwNR0cs&r=2K9kkYDPzg9W7wrnb9URPPzWuzXzmzc6oQUqmP_d9mA&m=UsSCoCc_Nnj_It7iTj2w9Xh-U0kW8zKwh7sIdTrgvW_OXQDDQG8CMBmOZsCmKo6l&s=AHk9LQL8xQKwtYW6AlMhIpKhc64M4gHnBm1wvGiKqhU&e= https://www.bidnetdirect.com/ https://prd.co.cgiadvantage.com/PRDVSS1X1/Advantage4

Page 7 of 17 RFP12-2025A support child care with new approaches and priorities that enhance high-quality early learning experiences for Colorado children. The Colorado Department of Early Childhood (CDEC) ensures the delivery of a comprehensive, community-informed, data-driven, high-quality, and equitable early childhood system that supports the care, education, and well-being of all Colorado’s young children, their families, and early childhood professionals in all settings. All children, families, and early childhood professionals in Colorado are valued, healthy, and thriving.

CDEC includes Child Care Licensing and Administration, Early Childhood Quality Initiatives, the Colorado Child Care Assistance Program, Universal Preschool, the Workforce Unit, and works closely with the Head Start State Collaboration Office.

DELLA ensures the health and safety of children in less-than-24-hour licensed early care and education environments by promulgating regulations for child care that ensure minimum standards for the health and safety of facilities. The division accomplishes this through the annual inspection and monitoring of child care facilities, consultation and coaching for early care and learning professionals, and collaborating with early care and learning providers, child care associations, early childhood councils, local community organizations (LCOs), local governments, county and state agencies, including health and fire departments, advocates, and other important stakeholders.

DELLA is responsible for inspecting, licensing, and monitoring family child care homes, child care centers, preschools, school-age child care programs, neighborhood youth organizations, and children’s resident camps. Currently, over 4,625 licensed facilities are inspected by 72 licensing specialists, with each facility inspected at least once a year. Regular inspections are a means of ensuring that children are cared for in settings that meet minimum health, safety, and fire standards. Programs that are inspected more frequently are more likely to adhere to critical health and safety requirements, and child care inspections are associated with lower rates of accidents requiring medical attention. Frequent unannounced inspections help ensure compliance with regulations, especially when there is a history of violations and/or complaints. On-site technical assistance and resources provided during inspections help providers improve the level of care they offer. Further, there is increased accountability for how federal and state funds are spent.

The federal Child Care and Development Block Grant Act (CCDBG) mandates requirements for the operations of child care licensing, including annual licensing inspections, more stringent health, safety, and training requirements for child care providers, consumer education requirements, and greater alignment among licensing, child care assistance programs, and child care quality improvement efforts.

The Child Care Development Block Grant Act requires that licensing inspectors perform inspections, including at least one pre-licensure inspection and at least one unannounced inspection annually, to ensure compliance with all child care licensing standards for all Child Care Development Fund (CCDF) Providers. In 2014, the state legislature provided DELLA with 17 contract licensing specialists to assist in compliance with the new federal regulations. An additional 10 contract licensing specialists were added in 2016 by the General Assembly. In 2020, the state legislature approved additional funding for four licensing specialists to provide greater opportunities and resources for investing time and expertise in low-performing licensed child care providers. This initiative aims to offer all providers more consultation and technical assistance focused on quality, rather than just basic health and safety compliance. In 2022, the state legislature provided DELLA with 2 additional Bilingual Licensing Specialists and a Bilingual Supervisor.

Page 8 of 17 RFP12-2025A

To better meet the goal of ensuring all Colorado children, families, and early childhood professionals are valued, healthy, and thriving, the Department implemented the Colorado Shines Quality Rating and Improvement System (QRIS). This system is embedded in child care licensing, so that those licensed child care programs serving children prior to kindergarten entry have a rating tied to their license. Licensing specialists serve as ambassadors for the Colorado Shines QRIS. Licensing specialists are responsible for the assessment of QRIS Level 1 and Level 2 licensed child care providers. In this role, the specialist also provides guidance and technical assistance to help licensed child care providers maintain or improve their quality rating.

The National Health and Safety Performance Standards Guidelines for Early Care and Education Programs have a standard of two licensing visits per year, including one unannounced visit, and recommend “sufficient numbers of licensing inspectors should be hired to provide adequate time visiting and inspecting facilities to ensure compliance with regulations.” Furthermore, The National Association of Child Care Resources and Referral Agencies (NACCRRA) has evidenced that “weak” oversight undermines strong standards.” Frequent inspections reduce serious violations. Protecting the health, safety, and welfare of children in licensed child care facilities is the underlying charge of the Department and ensuring supervisory licensing inspections are conducted in a timely and responsive manner is a key program performance indicator tracked by CDEC. This request provides resources to better meet the goal of safer facilities, since instances of death, injury, and child abuse and neglect can be reduced with an increase in the frequency of licensing inspections.

5.0 Proposal Content

Proposal Substance. Responses to the following components should be included in the proposal. Each component will be evaluated for completeness. Please address the following:

1. Demonstrated Experience and Capabilities

a. Please provide a detailed company overview that includes your organizational structure, mission and vision statements, years in business, and current staffing levels.

b. Please provide information about the organization’s experience in delivering services comparable to the scope and depth of this project, including a list of similar projects that have been successfully completed.

c. Provide a list of the proposed staff, including specialists and consultants that will be assigned to this project and possess relevant qualifications and experience. In addition, please provide the following information:

i. Current resumes for all proposed staff.

ii. Bachelor's degree from an accredited college or university in Human Services, Social

Work, Psychology, Sociology, Early Childhood Education, or a closely related field.

relevant qualifications.

iii. A minimum of three years of professional experience in human services, with demonstrated work in group care of children, child care licensing, early childhood education, or an equivalent field.

A. Note - Substitutions: Professional work experience in group care of children, child care licensing, child protection, or an occupational field closely related to

Page 9 of 17 RFP12-2025A the work assignment that provides the same kind, amount, and level of knowledge acquired in the required education may be substituted on a year-for-year basis for the Bachelor’s Degree requirement.

iv. Mandatory. Conditions of Employment. Vendors must have the ability to travel great distances alone in all types of weather and road conditions, in personal vehicles, which may require overnight accommodations. All accommodations shall be paid for by the

Vendor, and mileage shall be reimbursed from the employee’s home office. Vendors must possess and maintain a file for each employee containing a valid Colorado Driver's

License. Please provide a statement confirming that the organization understands and will comply with this requirement throughout the project lifecycle.

d. Describe your organization's experience administering contractor licensing programs and/or regulatory compliance contracts for the State of Colorado, including specific examples of projects managed, scope of responsibilities, and outcomes achieved.

e. Provide at least one detailed case study or reference from a client engagement completed within the past five years that demonstrates successful delivery of similar services.

f. Provide a detailed narrative demonstrating how your organization fulfilled each duty and responsibility outlined in the attached Statement of Work.

g. Provide a detailed description of how the vendor will structure and supervise staff in the performance of their duties.

h. Include a detailed description of how the vendor will deploy staff to meet coverage requirements, including absences and vacancies.

i. Include an implementation plan to include a timeline for implementation by July 1, 2026.

2. Mandatory. Exhibit A Statement of Work (SOW) Template. Please thoroughly review the work plan within the Statement of Work and provide a written attestation confirming your organization's ability to adhere to all outlined project deliverables.

3. Mandatory. Exhibit A Statement of Work Template – Payment Schedule. Please note that the payment schedule is included within the Statement of Work Template. Please ensure that the payment schedule is fully complete.

a. Specialist rates will be evaluated for competitiveness and sustainability. CDEC will scrutinize rates that appear artificially low, as they often correlate with staff turnover and service degradation.

Guidelines. Please refer to the items listed below as guidance to complete your budget.

a. Include the monthly cost listed on the Statement of Work; this should, at a minimum, include:

i. Staff salaries, operational costs, including reasonable overhead and administration.

b. Ensure that expenses align with the Statement of Work (Exhibit A).

c. Vendors may expect a fixed price contract.

6.