HCPF Solicitation #:

RFP UHAA 2026000233

Hospital Portal Tool

TABLE OF CONTENTS

SECTION 1.0 INTRODUCTION AND BACKGROUND

1.1. General Information

1.2. Anticipated Contract Term

1.3. Draft Internet Technology (IT) Contract

1.4. Terminology

1.5. Background

1.6. Subrecipient Status

SECTION 2.0 OFFEROR’S EXPERIENCE AND PERSONNEL

2.1. Organizational Experience

2.2. Personnel Requirements

SECTION 3.0 STATEMENT OF WORK

3.1. General Information

3.2. Work Plan

3.3. Portal Tool

3.4. Training

3.5. Security Plan

3.6. Biweekly Status Meetings & Updates

3.7. Helpdesk and Log

3.8. Annual Procedures

3.9. AD Hoc Work

3.10. Accessibility Requirements

SECTION 4.0 COMPENSATION AND INVOICING

4.1. Compensation

4.2. Invoicing and Payment Procedures

4.3. Budget

SECTION 5.0 EVALUATION METHODOLOGY

5.1. Evaluation Process

5.2. Evaluation Committee

5.3. Compliance

5.4. Proposal Evaluation Criteria

APPENDIX A – ADMINISTRATIVE INFORMATION

APPENDIX B – IT CONTRACT TEMPLATE

APPENDIX C – W-9

APPENDIX D – TERMINOLOGY

APPENDIX E – VPAT

APPENDIX F – PRICING WORKSHEET

Solicitation #: RFP UHAA 2026000233 Page 1 of 37

SECTION 1.0 INTRODUCTION AND BACKGROUND

1.1. GENERAL INFORMATION

1.1.1. The Colorado Department of Health Care Policy and Financing (Department) is soliciting competitive, responsive proposals from experienced and financially sound organizations to perform design, develop, maintain, and support a robust, secure, and user-friendly web-based Portal Tool for interaction with Colorado Hospitals and

Providers (Hospitals). The system will support statutory Hospital reporting programs by providing secure data collection, validation, reporting, and communication capabilities. These programs include:

1.1.1.1. Colorado Healthcare Affordability and Sustainability Enterprise (CHASE).

1.1.1.2. Upper Payment Limit (UPL).

1.1.1.3. Disproportionate Share Hospital (DSH).

1.1.1.4. Healthcare Affordability and Sustainability (HAS) Fee.

1.1.1.5. Hospital Financial Transparency (HFT).

1.1.1.6. Hospital Community Benefit Accountability (HCBA).

1.1.2. General solicitation information, timelines and proposal submission requirements are available in Appendix A, Administrative Information Document. To be considered responsive, an Offeror shall comply with all of the requirements and timelines contained in Appendix A.

1.2. ANTICIPATED CONTRACT TERM

1.2.1. Contractor’s start-up period is anticipated to begin on April 1, 2027 and end on June

30, 2027.

1.2.2. The initial operational period of the Contract is anticipated to begin at the end of the start-up period and will last for one year.

1.2.3. The total duration of the Contract, including the Department’s exercise of any options, is not anticipated to exceed five years.

1.2.4. The State may take steps to extend the Contract beyond the anticipated term in accordance with the Colorado Procurement Code, and in the event that the State determines an extension is necessary.

Solicitation #: RFP UHAA 2026000233 Page 2 of 37

1.2.5. The State may, within its sole discretion, choose not to exercise any option or extension term in the Contract for any reason. If the State chooses not to exercise any option or extension term, it may re-procure the goods and/or services in its sole discretion.

1.3. DRAFT INTERNET TECHNOLOGY (IT) CONTRACT

1.3.1. A draft IT Contract is included as Appendix B, Draft IT Contract. The terms of the

Draft IT Contract shall become contractual obligations following award of the

Statement of Work. The Offeror affirms its willingness to enter into a Contract containing terms substantially similar to those in Appendix B, Draft IT Contract, including its exhibits, by submitting a proposal. The successful Offeror may have an opportunity to request modification to the terms of the Draft IT Contract, as described in Appendix A, but the Department may choose not to accept any requested modifications. The Department will not accept any proposals that are conditional on acceptance of modified terms and conditions.

1.4. TERMINOLOGY

1.4.1. Acronyms and abbreviations are defined at their first occurrence in this Request for

Proposals (RFP). Appendix D, Terminology is provided to assist the reader in understanding acronyms, abbreviations, and terminology used throughout this solicitation.

1.5. BACKGROUND

1.5.1. Department of Health Care Policy and Financing Background

1.5.1.1. The Department serves as the Medicaid Single State Agency as defined by 45

C.F.R. §205.100. The Department develops and implements policy and financing for Medicaid and the Children’s Health Insurance Program, called Child Health

Plan Plus (CHP+) in Colorado, as well as a variety of other publicly funded health care programs for Coloradans who qualify. For more information about the

Department, visit https://hcpf.colorado.gov/.

1.5.1.2. The Department is a Covered Entity under the Health Insurance Portability and

Accountability Act of 1996 (HIPAA) (42 U.S.C. §§1320d – 1320d-8) and its implementing regulations.

https://hcpf.colorado.gov/

Solicitation #: RFP UHAA 2026000233 Page 3 of 37

1.5.2. The Department operates the Colorado Medicaid Program, known as Health First

Colorado, in accordance with the Colorado Medical Assistance Act (§§25.5-4-104, et seq., C.R.S.) and Title XIX of the Social Security Act. Colorado Medicaid is annually funded from appropriations authorized by the Colorado General Assembly and matched by federal funds.

1.5.3. Project Background

1.5.3.1. Pursuant to C.R.S. §25.5-4-402.4 and related federal requirements under 42

C.F.R. Parts 447 and 455, the Department of Health Care Policy and Financing administers Colorado’s Hospital Provider Fee programs, including CHASE, UPL, DSH, and related Hospital supplemental payment programs.

1.5.3.2. Since July 2021, Myers & Stauffer LC has served as the Department’s Contractor for the development, maintenance, and operation of a secure, web-based Portal

Tool that supports data collection, validation, analysis, and reporting for these programs.

1.5.3.3. The Portal Tool facilitates communication and file exchange between the

Department and Hospitals and enables production of standardized Hospital-specific and aggregated data reports. These reports are critical to the

Department’s federal reporting, legislative compliance, and payment calculations. This solicitation seeks to continue and refine these services over the next five years to ensure statutory compliance, data accuracy, and program efficiency.

1.5.3.4. The Portal Tool was established in 2022. The data stored in SQL databases pertains to information uploaded by Hospitals to the Portal Tool for the CHASE, HFT, and HCBA programs. The data tracked in the Portal Tool include completed survey data and internal Hospitals data submitted by Hospitals as requested by the Department. Supporting reports created to ensure transparency and accessibility for stakeholders include Progress Tracker Report, Raw Data Extract

Report, and Provider Users Report.

1.6. SUBRECIPIENT STATUS

1.6.1. Contractor will not be considered a subrecipient subject to the requirements of the

Office of Management and Budget Uniform Guidance, 2 CFR Part 200.

Solicitation #: RFP UHAA 2026000233 Page 4 of 37

SECTION 2.0 OFFEROR’S EXPERIENCE AND PERSONNEL

2.1. ORGANIZATIONAL EXPERIENCE

2.1.1. The Department has determined that it desires specific experience and skills for an

Offeror to possess in order for the Offeror to be able to complete the Work efficiently while meeting the demands and deadlines of the Department.

2.1.2. The Department will evaluate the Offeror’s experience, and that of its proposed team, pertaining to the following:

2.1.2.1. Working with Medicaid programs, Hospitals, Providers, Governmental entities, and any other large-scale data projects the Offeror feels would help the

Department determine the Offeror’s experience as it pertains to this Work.

2.1.2.2. Working with Colorado Hospitals in particular.

2.1.2.3. The integration of an Interface for use by Provider groups nationally or within the State.

2.1.2.4. Evaluating and reporting on Hospital compliance with the Interface.

2.1.2.5. Developing, deploying, and operating an Interface.

2.1.2.6. Preparing Training materials for Hospitals in proper Portal Tool use and the use of all components and features associated with the Portal Tool.

2.1.2.7. Managing large data sets, such as Hospital inpatient and outpatient Medicaid claims and Hospital financial data.

2.1.3. The Department will evaluate the Offeror’s current commitment and future plans to employ Coloradans throughout the term of the Contract.

OFFEROR'S RESPONSE 1. Provide a detailed description of the Offeror’s organizational experience and the experience of the proposed team, aligned to each item in

§2.1.2.1 through §2.1.2.7. Include specific examples of relevant work, including project scope, the Offeror’s role, and outcomes. Also describe the Offeror’s current commitment and future plans to employ Coloradans in accordance with §2.1.3.

OFFEROR'S RESPONSE 2. Provide descriptions of similar work performed for other clients, preferably state agency clients, within the last five years. Include no more

Solicitation #: RFP UHAA 2026000233 Page 5 of 37 than five projects. For each project, provide a brief description of the project, the services provided, and a contact name and email address.

OFFEROR'S RESPONSE 3. If the Offeror’s Portal Tool, or a substantially similar system/tool, is currently in use by hospitals or other providers:

a. Provide a list of hospitals and providers currently using the tool.

b. Identify the governmental entities associated with those implementations. List any hospitals or providers planned for integration and provide a timeline for integration, including any commitments.

c. If the Offeror’s Portal Tool is not currently in use by hospitals or providers, clearly state that in the response.

2.2. PERSONNEL REQUIREMENTS

2.2.1. All Personnel Requirements are shown in Appendix B, in the Contractor’s

Administrative Requirements exhibit to that Appendix.

2.2.2. The Key Personnel, as described in Appendix B, for the Contract are as follows:

2.2.2.1. Project Lead

2.2.2.1.1. The Department will evaluate the Project Lead based on the following requirements:

2.2.2.1.1.1 Experience with Hospital cost reporting and Medicare cost reporting principles.

2.2.2.1.1.2 Knowledge of federal Medicaid DSH statutory and regulatory requirements including DSH audit requirements, i.e. 42 CFR Part 455, Subpart D.

2.2.2.1.1.3 Extensive healthcare technology experience with a deep understanding of working with state Medicaid programs, Provider workflows, program implementation, large account management, and information provided by references.

2.2.2.1.1.4 Experience supporting governmental agencies in the political and legislative process, including providing information to support budgetary and legislative requests or initiatives.

Solicitation #: RFP UHAA 2026000233 Page 6 of 37

2.2.2.1.1.5 Demonstrated ability to resolve concerns and issues in cooperation with management of customer organizations.

2.2.2.1.1.6 Position title and authorities within the organization.

2.2.2.1.2. The Project Lead shall be responsible for all of the following:

2.2.2.1.2.1 Serving as Contractor’s primary point of contact for the Department.

2.2.2.1.2.2 Ensuring the completion of all Work in accordance with the Contract’s requirements. This includes, but is not limited to, ensuring the accuracy, timeliness and completeness of all work.

2.2.2.1.2.3 Overseeing all other Key Personnel and Other Personnel and ensuring proper staffing levels throughout the term of the Contract.

2.2.3. Additional Key Personnel

2.2.3.1. The Department desires the additional following positions/ job duties to be addressed in the proposal:

2.2.3.1.1. Project Manager or similar position. This position may be responsible for the following:

2.2.3.1.1.1 Resolving disputes between the Department and Contractor that cannot be resolved by the Project Lead.

2.2.3.1.1.2 Addressing requests and concerns of the Department’s Executive Director and other senior management as determined by the Department.

2.2.3.1.1.3 The Project Manager shall have delegated authority to execute Contract amendments and other modifications on behalf of Contractor.

2.2.3.1.2. The Department will evaluate the Project Manager based on the following requirements:

2.2.3.1.2.1 Experience leading or overseeing projects or contracts with state governmental organizations.

2.2.3.1.2.2 Experience supporting governmental agencies in the political and legislative process, including providing information to support budgetary and legislative requests or initiatives.

Solicitation #: RFP UHAA 2026000233 Page 7 of 37

2.2.3.1.2.3 Demonstrated ability to resolve concerns and issues in cooperation with management of customer organizations.

2.2.4. Other than the Key Personnel identified above, the Offeror may propose any additional personnel and structure it considers most efficient and effective for completing the Work.

2.2.4.1. The Department is interested in positions that may conduct the following tasks:

2.2.4.1.1. Web Application Lead.

2.2.4.1.1.1 The Department will evaluate the Web Application Lead based on the following requirements:

2.2.4.1.1.1.1. Experience conducting complex and/or advanced web application development.

2.2.4.1.1.1.2. Experience in healthcare technology, data collection processes, and tools.

2.2.4.1.1.2 The Web Application Lead may be responsible for the following:

2.2.4.1.1.2.1. Partnering with the other IT team members to help plan, track, and execute projects.

2.2.4.1.1.2.2. Managing risk during the project as well as identifying necessary course corrections.

2.2.4.1.1.2.3. Developing and reporting on metrics for development, test development, and execution.

2.2.4.1.1.2.4. Responding to and troubleshooting all web related issues.

2.2.4.1.1.2.5. Adhering to all required security measures.

2.2.4.1.2. Quality Lead.

2.2.4.1.2.1 The Quality Lead may have the following qualifications:

2.2.4.1.2.1.1. Experience in quality management.

2.2.4.1.2.1.2. Experience in data collection processes and tools.

2.2.4.1.2.2 The Quality Lead may be responsible for the following:

Solicitation #: RFP UHAA 2026000233 Page 8 of 37

2.2.4.1.2.2.1. Assisting the Project Manager in coordinating and monitoring activities related to IT.

2.2.4.1.2.2.2. Overseeing all aspects of Quality Assurance (QA) including, but not limited to:

2.2.4.1.2.2.1. Establishing quality metrics.

2.2.4.1.2.2.2. Applying industry best practices.

2.2.4.1.2.2.3. Developing new tools and processes to ensure quality measures and metrics are met.

2.2.4.1.2.2.3. Acting as a point of contact for all QA aspects including, but not limited to:

2.2.4.1.2.2.1. Coordinating QA resources internally and externally.

2.2.4.1.2.2.2. Leading the QA team.

2.2.4.1.2.2.3. Developing and executing test cases, scripts, plans, and procedures.

2.2.5. Offeror shall not allow any individual to fill more than one of the roles defined as

Key Personnel.

OFFEROR'S RESPONSE 4. Provide a detailed explanation of how the Offeror will provide sufficient personnel to perform the Work, including all of the following:

a. How the Offeror will provide Key Personnel that meets or exceeds the requirements contained in Section 2.2., Personnel Requirements. Offeror may propose combining, renaming, or otherwise adjusting Additional Key Personnel positions, provided that all associated responsibilities are clearly addressed.

b. How the Offeror will provide and train all Other Personnel so that the Work is completed accurately and in a timely manner. Additionally, include a listing of the position titles for each position related to the Contract, the general responsibilities of that position, the number of individuals filling that position and the numbers of hours each week the position will be dedicated to the Work.

Solicitation #: RFP UHAA 2026000233 Page 9 of 37

c. A plan for how the Offeror will replace all Key Personnel and Other Personnel so that the transition between personnel does not affect the ability of the

Contractor to complete the Work.

d. If the Offeror intends to use a Subcontractor, the Offeror shall provide a description of how the Offeror will use Subcontractors and the percentages of the Work that will be completed by each Subcontractor. This description shall also include the anticipated positions provided by the Subcontractor and the roles of those positions, as well as a plan for how the Offeror will manage the

Subcontractor and all Subcontractor personnel to ensure that the portions of the

Work assigned to the Subcontractor will be completed accurately and in a timely manner.

SECTION 3.0 STATEMENT OF WORK

3.1. GENERAL INFORMATION

3.1.1. The following Statement of Work describes the Deliverables sought through this RFP and the scope of what the awarded Offeror will be expected to offer through the contract resulting from this RFP. The Statement of Work is intended to provide interested Offerors with sufficient basic information to submit a proposal. It is not intended to limit a proposal’s content or exclude any relevant or essential data.

3.2. WORK PLAN

3.2.1. Contractor shall develop a comprehensive Work Plan that outlines the full scope of activities, deliverables, timelines, and responsibilities required to successfully complete the Portal Tool. The Work Plan shall be structured, detailed, and actionable. The Work Plan shall include, at a minimum, the following high-level elements and requirements:

3.2.1.1. A description of the implementation process the Offeror will follow to complete all deliverables in sequence for deployment of the Portal Tool.

3.2.1.2. A project schedule that includes deliverable timelines with estimated completion dates.

3.2.2. Contractor shall deliver the Work Plan to the Department for review and approval in accordance with the requirements and schedule set forth herein.

Solicitation #: RFP UHAA 2026000233 Page 10 of 37

3.2.2.1. DELIVERABLE: Work Plan

3.2.2.2. DUE: Within 30 days after the Contract Effective Date

3.2.3. Contractor shall update the Work Plan as needed or at the request of the

Department.

3.2.4. Contractor shall deliver an updated Work Plan annually to the Department for review and approval in accordance with the requirements and schedule set forth herein.

3.2.4.1. DELIVERABLE: Work Plan Update

3.2.4.2. DUE: Annually, by June 30th

3.3. PORTAL TOOL

3.3.1. Design and Purpose

3.3.1.1. Contractor shall design, implement, and maintain a web-based Portal Tool to serve as a centralized platform that facilitates secure communication and data exchange between Hospitals and the Department. The Portal Tool shall support, at a minimum, the following functions:

3.3.1.1.1. Data collection, aggregation, and submission.

3.3.1.1.2. Automated and additional work data analytics.

3.3.1.1.3. Secure data storage and document management.

3.3.1.1.4. File sharing and tracking.

3.3.1.1.5. Customized reporting for Department and legislative use.

3.3.1.2. Contractor shall ensure that the Portal Tool supports all Department initiatives and reporting requirements for the following programs:

3.3.1.2.1. Colorado Healthcare Affordability and Sustainability Enterprise (CHASE).

3.3.1.2.2. Upper Payment Limit (UPL).

3.3.1.2.3. Healthcare Affordability (HAS) fee.

3.3.1.2.4. Disproportionate Share Hospital (DSH) audits.

3.3.1.2.5. Hospital Financial Transparency Annual and Quarterly reporting.

3.3.1.2.6. Hospital Community Benefit Accountability.

Solicitation #: RFP UHAA 2026000233 Page 11 of 37

3.3.2. System Specifications

3.3.2.1. Contractor shall ensure that the Portal Tool meets or exceeds, at a minimum, the following system specifications:

3.3.2.1.1. Accepts large data uploads and accommodates multiple formats including delimited files, flat files, Excel files, and PDF documents.

3.3.2.1.2. Is scalable to accommodate increased usage and file volumes.

3.3.2.1.3. Allows for download of Hospital-submitted files by type, event, or Hospital system.

3.3.2.1.4. Maintains HIPAA compliance and encryption standards for all data at rest and in transit.

3.3.3. Functional Capabilities

3.3.3.1. Contractor shall ensure that the Portal Tool includes, at a minimum, the following functionalities:

3.3.3.1.1. Compliance with Department-defined accessibility, performance, and functionality standards.

3.3.3.1.2. A structured process for Hospital data certification.

3.3.3.1.3. Role-based access controls with permissions tailored to user function.

3.3.3.1.4. Provider and Department access to upload, view, download, and delete their own files.

3.3.3.1.5. Integrated data visualizations and dashboards.

3.3.3.1.6. Internal data validation and quality assurance protocols.

3.3.3.1.7. Aggregation of individual submissions into a combined dataset, when the file type is appropriate.

3.3.3.1.8. File versioning and comparison tools.

3.3.3.1.9. System-generated correspondence with audit trails.

3.3.3.1.10. Document repository with Hospital access to notices and supporting materials.

Solicitation #: RFP UHAA 2026000233 Page 12 of 37

3.3.3.1.11. Configurability for updates and revisions based on program or regulatory changes.

3.3.4. Reporting Capabilities

3.3.4.1. Contractor shall ensure that the Portal Tool includes advanced reporting features, including, at a minimum:

3.3.4.1.1. Visual Dashboard Tools that include, at a minimum:

3.3.4.1.1.1 Progress Tracking.

3.3.4.1.1.2 Deadlines.

3.3.4.1.1.3 Certification Status.

3.3.4.1.1.4 Department Communications.

3.3.4.1.1.5 DELIVERABLE: Visual Dashboard Tools

3.3.4.1.1.6 DUE: By the date in the most recent Department-approved Work Plan

3.3.4.1.2. Customizable and Downloadable Reports, including, at a minimum:

3.3.4.1.2.1 Aggregated Hospital data.

3.3.4.1.2.2 Program-specific insights.

3.3.4.1.2.3 Supporting data for legislative reporting.

3.3.4.1.2.4 Data analysis and trend identification, as determined by the Department and may include, but is not limited to, the following:

3.3.4.1.2.4.1. Basic mathematical aggregation.

3.3.4.1.2.4.2. Percentages.

3.3.4.1.2.4.3. Subsets.

3.3.4.1.2.4.4. Financial ratios.

3.3.4.1.2.4.5. Year-over-year analysis.

3.3.4.1.2.4.6. Outlier analysis.

3.3.4.1.2.5 Data extractions from specific fields from a program’s raw dataset.

Solicitation #: RFP UHAA 2026000233 Page 13 of 37

3.3.4.1.2.6 A data extraction from a program that aggregates all submissions data to reach a Colorado aggregate.

3.3.4.1.2.7 Additional data extraction from Medicare cost reports.

3.3.4.1.2.8 DELIVERABLE: Customizable and Downloadable Reports

3.3.4.1.2.9 DUE: By the date in the most recent Department-approved Work Plan

OFFEROR'S RESPONSE 5. Provide examples of comprehensive, customized reporting functions of Offeror’s proposed Portal Tool that would allow the Department to assess its use and value.

3.3.5. Quality Control Process

3.3.5.1. Contractor shall create, implement, and maintain a Quality Control Process that ensures accurate data analysis and reporting including, at a minimum, the following:

3.3.5.1.1. Change management procedures.

3.3.5.1.2. Documentation of data errors and system defects.

3.3.5.1.3. Process for system updates and refinements.

3.3.5.1.4. Upgrade protocols.

3.3.5.1.5. Internal Quality Assurance (QA) framework, which details Contractor’s quality assurance practices and thresholds for outlier analysis.

3.3.5.2. Contractor shall deliver the Quality Control Process Document to the Department for review and approval in accordance with the requirements and schedule set forth herein.

3.3.5.2.1. DELIVERABLE: Quality Control Process Document

3.3.5.2.2. DUE: At the Department’s request

OFFEROR'S RESPONSE 6. Describe the Offeror’s process for identifying, documenting, and correcting defects. Also include the process for making modifications to the

Portal Tool, and the Offeror's frequency and process for implementing upgrades and new releases. The Department considers high quality work a key attribute to

Solicitation #: RFP UHAA 2026000233 Page 14 of 37 successful Contractor performance. Provide a detailed explanation of how the

Offeror intends to implement a quality control process.

3.3.6. Testing and Launch

3.3.6.1. Contractor shall conduct thorough testing on the Portal Tool prior to deployment to validate all system functions and integrations.

3.3.6.2. Contractor shall maintain a log of the testing process and deliver the final document along with the final operational Portal Tool for the Department’s review and approval.

3.3.7. Data Retention

3.3.7.1. Contractor shall not delete any finalized data or system functionality of the

Portal Tool without prior written authorization from the Department.

3.3.8. Portal Tool Refinements

3.3.8.1. The Department, at its sole discretion, may request Contractor to perform refinements as listed in this Section.

3.3.8.1.1. Refinements encompass activities that improve, expand, or refine existing functionality without requiring a complete system redesign or replacement.

Refinements are typically iterative improvements or modifications that align with the existing technical framework and business processes.

3.3.8.1.2. Refinements may include, but are not limited to, the following:

3.3.8.1.2.1 Additional or modified data extractions and integrations to support new reporting or analysis needs.

3.3.8.1.2.2 Development or modification of reports, dashboards, or data visualizations that leverage existing system capabilities.

3.3.8.1.2.3 Updates to align with new or revised policies, regulations, or reporting requirements that do not necessitate full redevelopment.

3.3.8.1.2.4 Adjustments to improve user experience, accessibility, or workflow efficiency within the current system framework.

3.3.8.1.2.5 Performance tuning, system optimization, or minor technical improvements that refine reliability and responsiveness.

Solicitation #: RFP UHAA 2026000233 Page 15 of 37

3.3.8.1.2.6 Routine maintenance, quality assurance, and support activities that sustain the stability and usability of the system.

OFFEROR'S RESPONSE 7. Please provide an explanation of what refinements, either those shown above or others, the Offeror’s proposed Portal Tool could provide?

3.3.9. Ongoing Portal Tool Services

3.3.9.1. Contractor shall provide continuous Portal Tool support and system maintenance that includes, but is not limited to, the following:

3.3.9.1.1. Software licensing and renewals.

3.3.9.1.2. Routine and emergency system updates.

3.3.9.1.3. Secure data backups and storage.

3.3.9.1.4. Reliable network connectivity.

3.3.10. Contractor shall deliver the Final Operational Portal Tool for review and approval to the Department in accordance with the requirements and schedule set forth herein.

3.3.10.1. DELIVERABLE: Final Operational Portal Tool

3.3.10.2. DUE: By the date in the most recent Department-approved Work Plan

OFFEROR'S RESPONSE 8. Describe any additional features, capabilities, or services

Offeror could include with an effective and complete Portal Tool.

3.4. TRAINING

3.4.1. Contractor shall create and submit a Training Plan to the Department for review and approval that includes, at a minimum:

3.4.1.1. At least one training date per year.

3.4.1.2. Provider outreach.

3.4.1.3. Registration details.

3.4.1.4. Training outline to include, at a minimum:

3.4.1.4.1. Reporting timeline and due dates for submissions.

3.4.1.4.2. Portal Tool access.

3.4.1.4.3. Portal Tool overview.

Solicitation #: RFP UHAA 2026000233 Page 16 of 37

3.4.1.4.4. Dashboard overview.

3.4.1.4.5. Data collection overview.

3.4.1.4.6. Department-provided templates for each program.

3.4.1.4.7. Data submission process.

3.4.1.4.8. Individual Hospital reports.

3.4.1.4.9. Informal review process.

3.4.1.4.10. Communications.

3.4.1.4.11. Helpdesk.

3.4.1.5. Ongoing training that includes, at a minimum:

3.4.1.5.1. Updates and refinements.

3.4.1.5.2. Modifications to the Portal Tool.

3.4.1.5.3. Modifications to individual Hospital reports.

3.4.1.5.4. Revisions to informal review process.

3.4.1.6. Plan for follow up responses.

3.4.1.7. Contractor shall conduct live and recorded training webinars to train Department staff and Hospitals to access and navigate the Portal Tool. Each webinar shall include, at a minimum:

3.4.1.7.1. Compliance with Section U. Accessibility of the Contract (see Appendix B-

Draft IT Contract).

3.4.1.7.2. Recording with Closed Captioning (CC).

3.4.1.7.3. Collecting attendee information, including, at a minimum, the following:

3.4.1.7.3.1 Attendee’s name.

3.4.1.7.3.2 Attendee’s email address.

3.4.1.7.3.3 Name of attendee’s organization.

3.4.1.7.3.4 Attendee’s role at the organization.

3.4.1.7.4. An open discussion board.

Solicitation #: RFP UHAA 2026000233 Page 17 of 37

3.4.1.7.4.1 Contractor shall designate a staff member to monitor the discussion board and respond to all questions from participating attendees.

3.4.1.7.5. Department Representative

3.4.1.7.5.1 The Department may include at least one staff member to attend. This staff member should be familiar with this project and the Hospitals using the Portal Tool.

3.4.1.7.6. The recorded webinar shall be made available to Providers and Department staff through the Portal Tool.

3.4.1.8. Contractor shall deliver the Training Plan to the Department for review and approval in accordance with the requirements and schedule set forth herein.

3.4.1.8.1. DELIVERABLE: Training Plan

3.4.1.8.2. DUE: By the date in the most recent Department-approved Work Plan

3.4.2. Contractor shall develop a Written Instruction Manual, in conjunction with the training webinars, to train Department Staff and Hospitals how to access and navigate the Portal Tool. The Written Instruction Manual may be used for both self-paced study and live training sessions, that includes, at a minimum:

3.4.2.1. Accessing and navigating the Portal Tool.

3.4.2.2. Data submission process.

3.4.2.3. Accessing and downloading data.

3.4.2.4. Accessing and downloading reports.

3.4.2.5. Resubmission processes.

3.4.2.6. Glossary of terms.

3.4.2.7. Helpdesk information.

3.4.2.8. Contractor shall deliver the Written Instructions Manual to the Department for review and approval in accordance with the requirements and schedule set forth herein.

3.4.2.8.1. DELIVERABLE: Written Instructions Manual

3.4.2.8.2. DUE: By the date in the most recent Department-approved Work Plan

Solicitation #: RFP UHAA 2026000233 Page 18 of 37

3.4.2.9. Contractor shall update the Written Instructions Manual as determined and directed upon request by the Department in accordance with the requirements and schedule set forth herein.

3.4.2.9.1. DELIVERABLE: Written Instructions Manual Updates

3.4.2.9.2. DUE: Upon request by the Department

OFFEROR'S RESPONSE 9. Identify strategies the Offeror plans to implement when training Providers how to use the Portal Tool. Include short and long-term educational and promotional strategies to assist the Department with increased acceptance and use of the Portal Tool by Providers, including but not limited to:

a. Training both Department staff and Providers.

b. Creating and maintaining a Written Instructions Manual.

3.5. SECURITY PLAN

3.5.1. Contractor shall develop a System Security Plan that includes, at a minimum:

3.5.1.1. Mission Objectives

3.5.1.1.1. Mission Statement

3.5.1.1.2. Concept of Operations

3.5.1.1.3. Roles and Responsibilities

3.5.1.2. Information Technology Environment

3.5.1.2.1. Network Environment, Enclaves, and Perimeters

3.5.1.2.2. Major Applications and Systems

3.5.1.2.3. General Support Systems

3.5.1.3. Risk Management

3.5.1.3.1. Risk Management Methodology

3.5.1.3.2. Risk Assessment Responsibilities

3.5.1.3.3. Risk Assessment Frequency

3.5.1.3.4. Project Life Cycle

Solicitation #: RFP UHAA 2026000233 Page 19 of 37

3.5.1.3.5. Vendor Management

3.5.1.4. Security Program

3.5.1.4.1. Network and Security Operations Standards

3.5.1.4.2. System and Application Security Standards

3.5.1.4.3. Access Controls

3.5.1.4.4. Change Control and Configuration Management

3.5.1.4.5. Physical Security

3.5.1.4.6. Data Handling and Disposal

3.5.1.4.7. Personnel Security

3.5.1.4.8. Acceptable Use

3.5.1.4.9. Online Privacy

3.5.1.5. Incident Warning, Advisory, and Response

3.5.1.5.1. Evaluating Information Security Warnings and Advisories

3.5.1.5.2. Information Security Incident Response Plan Summary

3.5.1.6. Security Awareness and Training

3.5.1.6.1. Security Awareness and Training Methodology

3.5.1.6.2. Security Awareness and Training Frequency

3.5.1.6.3. Security Awareness and Training Content Updates

3.5.1.7. Self-Assessment

3.5.1.8. Metrics and Reporting

3.5.1.9. Plan Approval and Maintenance

3.5.1.10. Contractor shall identify its processes and policies related to the following:

3.5.1.10.1. Oversight, assessment, planning, implementation, and compliance with all privacy and security standards and practices implemented by federal, State, or Contractor to the extent the privacy and security standards and practices do not conflict.

Solicitation #: RFP UHAA 2026000233 Page 20 of 37

3.5.1.10.2. Coordination of efforts with Medicaid Enterprise Solutions (MES) Vendors to monitor for vulnerabilities.

3.5.1.10.3. Assurance that all penetration testing meets approved security requirements.

3.5.1.10.4. Maintenance of core capabilities in a manner that complies with all federal and State security criteria as set forth by the Colorado Governor’s Office of

Information Technology (OIT) and the U.S Department of Health and Human

Services Office for Civil Rights.

3.5.1.11. Implementation dates for the activities contained in the System Security Plan.

3.5.2. Contractor shall submit the System Security Plan to the Department for review and approval. After the Department approves the System Security Plan, Contractor shall implement the plan and perform all tasks, obligations, and responsibilities described therein and in accordance with the approved implementation dates.

3.5.2.1. DELIVERABLE: System Security Plan

3.5.2.2. DUE: By the date in the most recent Department-approved Work Plan

3.5.3. Contractor shall, at a minimum, annually review and update a Revised System

Security Plan.

3.5.3.1. Contractor shall submit the Revised System Security Plan to the Department for review and approval. After the Department approves the Revised System Security

Plan, Contractor shall implement the plan and perform all tasks, obligations, and responsibilities described therein and in accordance with the approved implementation dates.

3.5.3.1.1. DELIVERABLE: Revised System Security Plan

3.5.3.1.2. DUE: Annually, at a minimum, by the date(s) in the most recent Department-approved Work Plan

OFFEROR'S RESPONSE 10. Offeror shall describe its approach to developing, maintaining, and implementing a System Security Plan that meets all requirements in Section 3.5. Response shall summarize key processes, policies, and timelines for plan approval, updates, and implementation.

3.6. BIWEEKLY STATUS MEETINGS & UPDATES

Solicitation #: RFP UHAA 2026000233 Page 21 of 37

3.6.1. Contractor shall conduct Biweekly Status Meetings and deliver Updates to the

Department for review and approval that includes, at a minimum, the following:

3.6.1.1. Progress toward Contract deliverables, project milestones, and performance targets, including, but not limited to:

3.6.1.1.1. A summary of completed tasks and deliverables since the last report.

3.6.1.1.2. Status of tasks in progress, with estimated completion dates.

3.6.1.1.3. A comparison of actual performance versus the baseline Work Plan timeline.

3.6.1.1.4. Any changes in resource allocations, timelines, or scope (with justification).

3.6.1.1.5. Identification of upcoming deliverables and project phases.

3.6.1.1.6. Issues, risks, or challenges that may affect performance, quality, or schedule, including, but not limited to:

3.6.1.1.6.1 Description of each issue and its origin (e.g. technical, stakeholder-related, data quality, etc.).

3.6.1.1.6.2 Affected workstreams or deliverables.

3.6.1.1.6.3 Issue severity (e.g. low, medium, high) and potential implications for

Contract compliance.

3.6.1.1.6.4 Dependencies or coordination needed from the Department or third parties.

3.6.1.2. Any recurring problems previously reported. For each issue or risk identified, Contractor shall propose and describe mitigation actions, including, but not limited to:

3.6.1.2.1. Any corrective or preventative measures that are currently underway or planned.

3.6.1.2.2. Adjustments to timelines, staffing, or processes to resolve the issue.

3.6.1.2.3. Support or decisions requested from the Department, if applicable.

3.6.1.2.4. A timeline for expected resolution and follow-up reporting.

3.6.2. Contractor shall provide each Status Update Document to the Department at least one Business Day prior to the regular status meeting.

Solicitation #: RFP UHAA 2026000233 Page 22 of 37

3.6.2.1. DELIVERABLE: Biweekly Status Meeting Updates

3.6.2.2. DUE: One Business Day prior to the regular status meeting.

3.6.2.3. DELIVERABLE: Biweekly Status Meetings

3.6.2.4. DUE: By the dates in the most recent Department-approved Work Plan

3.7. HELPDESK AND LOG

3.7.1. Contractor shall implement a Helpdesk that will provide technical assistance to

Department staff and Hospitals with the Portal Tool.

3.7.1.1. Contractor shall ensure the Helpdesk provides a dedicated email address or phone number with voicemail.

3.7.1.2. Contractor shall ensure the Helpdesk is available from 8:00 a.m. to 5:00 p.m.

Mountain Time every Business Day.

3.7.1.2.1. Helpdesk may be closed during State or Federal holidays, as approved in writing by the Department.

3.7.1.3. Contractor shall ensure the Helpdesk responds to inquiries within two Business

Days after receipt.

3.7.1.3.1. For each inquiry received, Contractor shall document the following in a

Helpdesk Log Template, that has been reviewed and approved by the

Department, that includes, at a minimum:

3.7.1.3.1.1 The name of the provider.

3.7.1.3.1.2 The nature of the inquiry.

3.7.1.3.1.3 The resolution of the inquiry.

3.7.1.4. Contractor shall deliver the Helpdesk Log Template to the Department for review and approval in accordance with the requirements and schedule set forth herein.

3.7.1.4.1. DELIVERABLE: Helpdesk Log Template

3.7.1.4.2. DUE: By the date in the most recent Department-approved Work Plan

3.7.1.5. Contractor shall deliver the Helpdesk Log to the Department in the agreed upon format for review and approval in accordance with the requirements and schedule set forth herein.

Solicitation #: RFP UHAA 2026000233 Page 23 of 37

3.7.1.5.1. DELIVERABLE: Helpdesk Log

3.7.1.5.2. DUE: Annually, by the date in the most recent Department-approved Work

Plan

3.8. ANNUAL PROCEDURES

3.8.1. Contactor shall aggregate data for the applicable Federal Fiscal Year (FFY), including, but not limited to, the following:

3.8.1.1. Provider fee.

3.8.1.2. Upper Payment Limit (UPL) for inpatient and outpatient Hospital services.

3.8.1.3. Hospital-specific DSH limit calculation.

3.8.1.4. Inpatient supplemental payment.

3.8.2. Contractor shall obtain data from several outside sources including, but not limited to, the following:

3.8.2.1. The Federal CMS 2552-10 Hospital and Hospital Health Care Complex Cost Report, available through the Centers for Medicare & Medicaid Services (CMS) website

(CMS.gov).

3.8.2.2. Hospital internal accounting records.

3.8.2.3. The Department’s Medicaid Management Information System (MMIS).

3.8.2.4. The Colorado Department of Health and Environment.

3.8.2.5. Other public data sources.

3.8.3. Contractor shall have the capabilities to receive data in various formats including, but not limited to the following:

3.8.3.1. Flat files.

3.8.3.2. Excel files.

3.8.3.3. Portable Document Format (PDF).

3.8.4. Contractor shall obtain MMIS data from the Department and shall propose a develop an MMIS Data Extraction Protocol describing the process for obtaining, extracting, and securely transferring the data necessary to perform the Work.

Solicitation #: RFP UHAA 2026000233 Page 24 of 37

3.8.4.1. Contractor shall submit the protocol to the Department for review and approval.

3.8.4.1.1. DELIVERABLE: MMIS Data Extraction Protocol

3.8.4.1.2. DUE: By the date in the most recent Department-approved Work Plan

3.8.5. Contractor shall obtain the Hospital Medicare cost reports through existing channels including, but not limited to the following:

3.8.5.1. The Healthcare Cost Report Information System (HCRIS).

3.8.5.2. Hospitals.

3.8.6. Contractor shall recalculate the Medicare cost reports prior to the data aggregation to exclude the provider fee assessment amounts reported by providers.

3.8.7. Contractor shall develop a standardized data template to be sent to Hospitals to obtain data not available through cost reports, the MMIS, or public data sources.

3.8.7.1. The standardized data template shall be created in Microsoft Excel.

3.8.7.2. Contractor shall ensure the standardized data template includes, at minimum, the following:

3.8.7.2.1. Uninsured days and charges.

3.8.7.2.2. Out-of-state Medicaid days and charges.

3.8.7.2.3. Managed care Medicaid days and charges.

3.8.7.2.4. Other data elements at the request of the Department.

3.8.7.3. Contractor shall deliver the Standardized Data Template to the Department for review and approval in accordance with the requirements and schedule set forth herein.

3.8.7.3.1. DELIVERABLE: Standardized Data Template

3.8.7.3.2. DUE: By the date in the most recent Department-approved Work Plan

3.8.8. Contractor shall use the Portal Tool to allow Hospitals to electronically and securely exchange data with Contractor and the Department.

3.8.9. Contractor shall upload the approved Standardized Data Template with instructions on how to complete and return the forms to Hospitals using the Portal Tool.

Solicitation #: RFP UHAA 2026000233 Page 25 of 37

3.8.9.1. DELIVERABLE: Upload of Approved Standardized Data Template

3.8.9.2. DUE: By the date in the most recent Department-approved Work Plan

3.8.10. Contractor shall communicate with Hospitals verbally and electronically through the

Portal Tool and/or email to obtain the data and to collaborate with the Hospitals to ensure that complete, correct data is obtained.

3.8.10.1. Contractor shall make the collected data available to the Department through the Portal Tool.

3.8.10.2. Contractor shall provide quality assurance for collected data including, but not limited to the following:

3.8.10.2.1. Implement a quality control process to check the collected data for errors.

3.8.10.2.2. Validate the collected data.

3.8.10.2.3. Conduct variance analyses and reasonableness tests to ensure accuracy of the data elements.

3.8.11. In the event that data has errors or missing information, Contractor shall contact the Hospitals and the Department to obtain correct data.

3.8.12. Contractor shall develop and deliver a Hospital Data Report Template to the

Department for review and approval in accordance with the requirements and schedule set forth herein.

3.8.12.1. DELIVERABLE: Hospital Data Report Template

3.8.12.2. DUE: By the date in the most recent Department-approved Work Plan

3.8.13. Contractor shall use the Department-approved Hospital Data Report Template to prepare individual Hospital Data Reports for the Department, and for each Hospital, after aggregating, validating, and confirming that all data elements are reasonable.

3.8.13.1. The Hospital Data Reports shall include, but are not limited to, the following:

3.8.13.1.1. Inpatient and outpatient cost and charges, allocated by routine and ancillary cost centers per the Medicare Cost Report, for each Hospital that receives reimbursement through the CHASE Model.

Solicitation #: RFP UHAA 2026000233 Page 26 of 37

3.8.13.1.2. Cost and charges for Medicaid and uninsured clients for the applicable State

Fiscal Year (SFY) as required for the annual calculation of the CHASE Model and the calculation of Hospital-specific DSH limits.

3.8.13.1.3. Data elements and calculations as needed for the CHASE Model and approved by the Department.

3.8.13.1.4. Individual data elements, such as the number of Hospital Patient Days and calculations performed on data gathered by Contractor, such as Medicaid inpatient and outpatient costs.

3.8.13.2. Contractor shall deliver the Hospital Data Reports to the Department through the

Portal Tool.

3.8.13.2.1. Contractor shall submit the Hospital Data Reports to each Hospital for their review and confirmation through the Portal Tool. Contractor shall require

Hospitals to respond within ten Business Days.

3.8.13.2.1.1 DELIVERABLE: Upload of Hospital Data Reports

3.8.13.2.1.2 DUE: By the date in the most recent Department-approved Work Plan

3.8.14. Contractor shall generate an Aggregated Data Report Template that combines the data from all the confirmed Hospital Data Reports and delivers the Aggregated Data

Report Template to the Department for review and approval in accordance with the requirements and schedule set forth herein.

3.8.14.1. DELIVERABLE: Aggregated Data Report Template

3.8.14.2. DUE: By the date in the most recent Department-approved Work Plan

3.8.15. Contractor shall compile all submitted data from the Hospital Data Reports that have been confirmed and finalized into an Aggregated Data Report and deliver the completed report through the Portal Tool to the Department for review and approval in accordance with the requirements and schedule set forth herein.

3.8.15.1. DELIVERABLE: Aggregated Data Report

3.8.15.2. DUE: By the date in the most recent Department-approved Work Plan

3.8.16. Contractor shall aggregate annual Hospital Financial Transparency (HFT) data using a Department-approved template for each SFY.

Solicitation #: RFP UHAA 2026000233 Page 27 of 37

3.8.16.1. Contractor shall update the Department-approved template as needed to ensure the system correctly recognizes and extracts data each year

3.8.16.2. Contractor shall submit the updated template to the Department for review and approval in accordance with the requirements and schedule set forth herein.

3.8.16.2.1. DELIVERABLE: Annual HFT Template

3.8.16.2.2. DUE: By the date in the most recent Department-approved Work Plan

3.8.16.3. Contractor shall obtain completed annual HFT data submissions uploaded from

Hospitals, including any supporting documents.

3.8.16.4. Contractor shall provide quality assurance for collected HFT data that includes, at a minimum, implementation of a quality control process to check the collected data for errors.

3.8.16.5. Contractor shall contact Hospitals and/or the Department to request corrected data whenever errors are identified.

3.8.16.6. Contractor shall provide Aggregated Annual HFT Data to the Department for review and approval in accordance with the requirements and schedule set forth herein, and for the Department’s use.

3.8.16.6.1. DELIVERABLE: Aggregated Annual HFT Data

3.8.16.6.2. DUE: By the date in the most recent Department-approved Work Plan.

3.8.17. Contractor shall aggregate annual Hospital Community Benefit Accountability

(HCBA) program data using a Department-approved template for each SFY.

3.8.17.1. Contractor shall update the Department-approved template as needed to ensure the system correctly recognizes and extracts data each year.

3.8.17.2. Contractor shall submit the updated template to the Department for review and approval in accordance with the requirements and schedule set forth herein.

3.8.17.2.1. DELIVERABLE: Annual HCBA Template

3.8.17.2.2. DUE: By the date in the most recent Department-approved Work Plan.

3.8.17.3. Contractor shall obtain completed HCBA template submissions uploaded from

Hospitals, including any supporting documents.

Solicitation #: RFP UHAA 2026000233 Page 28 of 37

3.8.17.4. Contractor shall provide quality assurance for collected HCBA data that includes, at a minimum, implementation of a quality control process to check the collected data for errors.

3.8.17.5. Contractor shall contact the Hospitals and/or the Department to request corrected data whenever errors are identified.

3.8.17.6. Contractor shall provide Aggregated Annual HCBA Data to the Department for review and approval in accordance with the requirements and schedule set forth herein, and for the Department’s use.

3.8.17.6.1. DELIVERABLE: Aggregated Annual HCBA Data

3.8.17.6.2. DUE: By the date in the most recent Department-approved Work Plan.

3.8.18. Contractor shall provide copies to the Department at no charge of any supporting documentation requested by the Department.

3.9. AD HOC WORK

3.9.1. The Department, at its sole discretion, may request Contractor to perform Ad Hoc

Work. Ad Hoc Work consists only of work that is within the general scope of this

Contract but is not otherwise specifically required by the Contract and does not include any of the following:

3.9.1.1. Portal Tool Refinements (Section 3.3.8.).

3.9.1.2. Upgrades.

3.9.1.3. Enhancements.

3.9.1.4. Maintenance.

3.9.1.5. Modifications.

3.9.1.6. Corrections.

3.9.1.7. Optimizations.

3.9.1.8. Regulatory updates.

3.9.1.9. Quality Assurance activities.

3.9.1.10. Support services.

Solicitation #: RFP UHAA 2026000233 Page 29 of 37

3.9.1.11. Reporting enhancements.

3.9.1.12. Dashboards.

3.9.1.13. Data Extractions.

3.9.1.14. Integrations.

3.9.1.15. Other Work required in §§3.2-3.8 of this Contract.

3.9.2. Work in this section shall not duplicate any Work elsewhere in this Contract, and no other Work already required under this Contract shall constitute a project under this section.

3.9.3. Work under this section may include new projects or services that are not otherwise required by this Contract and are separately authorized in writing by the

Department prior to commencement of the work. Examples of Ad Hoc Work that may be approved by the Department include the following:

3.9.3.1. Implementing significant, system-level restructuring or redesign of existing projects, databases, or portal architecture that require substantial redevelopment or a majority rewrite.

3.9.3.2. Large-scale changes that fundamentally alter the functionality, framework, or core structure of the system beyond the scope of routine maintenance or refinements.

3.9.4. Contractor shall ensure that any additional work will not compromise any deliverable due dates specified in the Statement of Work, unless otherwise agreed upon by Contractor and the Department.

3.9.5. The Department may initiate an ad hoc project by submitting a written request to

Contractor for an estimate of the hours and services required to complete the ad hoc project.

3.9.6. Contractor shall…