RFP27007077 Agency Solicitation Specification.pdf

RFP - AGENCY SOLICITATION SPECIFICATIONS

HEADER: RFP27007077 | DOH PRESCRIPTION DRUG MONITORING PROGRAM

SECTION A. BACKGROUND

On October 24, 2018, President Trump signed the Substance Use–Disorder Prevention that

Promotes Opioid Recovery and Treatment for Patients and Communities Act (SUPPORT for

Patients and Communities Act) into law (Pub. L. No. 115-271). Section 5042 of the SUPPORT for Patients and Communities Act includes the “Medicaid Providers Are Required to Note

Experiences in Record Systems to Help In-need Patients Act (Medicaid PARTNERSHIP Act), which added section 1944 to the Social Security Act (Act). Under section 1944 of the Act, beginning October 1, 2021, states must have a qualified prescription drug monitoring program

(PDMP) and must require that certain Medicaid providers check information about certain

Medicaid beneficiaries’ prescription drug history in the qualified PDMP before prescribing controlled substances to the beneficiary.

RI’s PDMP is legislatively mandated through RIGL §21-28-3.18 to be maintained by the RIDOH.

This system collects dispensed medication history for any controlled substance on Schedules II, III, IV, and V, and opioid antagonists directly from all licensed outpatient pharmacies in Rhode

Island. Pharmacies are required to report within 24 hours. Since 2014, RIGL § 21-28-3.32 has required that all practitioners that hold a RI Controlled Substance Registration (CSR) must register with the PDMP. CSR holders have been automatically registered since mid-2016, leading to a consistent 100% registration rate. Since 2015 the law has required that the PDMP be reviewed prior to prescribing an opioid for the first time, and at least every three months for continuous opioid prescriptions. The practitioner must document reviewing the PDMP within the patient’s medical record. Providers or their delegates are allowed access to the PDMP.

The Rhode Island Department of Health is seeking a single vendor to implement a comprehensive

Prescription Drug Monitoring Program (PDMP) solution. This system will collect, manage, and analyze data on all controlled substance prescriptions (Schedules II–V and opioid antagonists) dispensed in Rhode Island, in accordance with state regulations. The primary objectives are to enhance patient safety, support prescribers and pharmacists in clinical decision-making, and help prevent prescription drug misuse and diversion. In 2020, EOHHS contracted with BRILJENT

LLC, the vendor selected via RFP to develop a Statewide Health Information Technology Strategic

Roadmap and Implementation Plan, to develop a more detailed, accelerated PDMP planning project.

The planning vendor (BRILJENT LLC) led focused stakeholder engagement sessions with users and potential users of PDMP data, identified gaps between the current state and the desired/required future state, developed a strategic roadmap for the PDMP, and developed a detailed implementation plan for the roadmap. With a goal to provide insight into medication http://webserver.rilin.state.ri.us/Statutes/TITLE21/21-28/21-28-3.18.HTM http://webserver.rilin.state.ri.us/Statutes/TITLE21/21-28/21-28-3.32.HTM utilization to optimize health outcomes of acute and chronic diseases, the department has set forth the following priorities:

Enhance PDMP team and expertise to maximize PDMP value and utility

• Enhance human resources and expertise to reach PDMP strategic vision and purpose.

• Measure improvements by quantifying reduced provider burden, surveillance efforts, and correlation with expanding opioid efforts.

• Identify automation opportunities that support PDMP administrators by reducing manual processes and interventions.

• Continue ongoing communication with public and private stakeholders enhancing transparency and promoting progress in expanded PDMP vision and use.

• Evaluate additional uses beyond health through a systematic, repeatable decision-making process.

Identify opportunities for improvement and efficiencies across PDMP users, stakeholders, and strategies.

• Improve PDMP features and usability in current views and integrated systems.

• Strive for efficient and flexible updates reducing end-user provider impact.

• Improve usability of PDMP data by integrating into provider workflow and features across small and large health systems.

• Evaluate data to identify what can be done to close data gaps and improve data quality.

• Improve integrations and globally make changes to all integrated systems through process and technical solutions.

• Monitor and utilize emerging standards to improve data availability, quality, and use.

• Identify additional access and use needs for user populations, including delegates.

• Improve access to cross-state data sharing by identifying the security, technical, policy, and operational processes required for alignment.

Improve use of PDMP data and flexibility of data systems

• Improve PDMP data reporting and data quality.

• Expand access to PDMP data for broader health uses.

• Expand use of PDMP data and flexibility of data systems for repeatable configurations.

• Configurations should be evaluated based on the following considerations:

1) Data source(s) and availability,

2) Data quality,

3) Benefits and/or constraints, and

4) Impact to treatment, surveillance, and care coordination questions.

• Understand and scale available data elements from available sources.

Leverage and utilize existing data sources

• Allow data from PDMP to be extracted for analysis with other data sets from RIDOH.

• Improve PDMP usability, sustainability, and flexibility of EHR/HIE integrations.

• Identify availability and feasibility of additional data sources, data sets, and technology needed to reach PDMP vision and purpose.

• Utilize Federal-supported interstate hubs for out-of-state data for approved purposes and uses.

Improve insights into opioid prescribing practices, deaths, and broader medication insights through focused questions creating a learning health system

• Identify a robust PDMP data research strategy and research questions for policy, research, public health, and operational insights.

• Determine questions beyond opioid research use cases.

• Manage data gaps and plan for closing data gaps and availability.

• Infrastructure – Architect and build infrastructure to support long-term PDMP vision as defined here.

• Support integrated, reusable infrastructure with appropriate policies and data use agreements.

• Enhance reporting capabilities for required measure reporting while reducing provider burden.

• Identify roles and responsibilities of integrated data sources and reusable, shared technology services across public and private stakeholders.

• Define the scope and plan for integration to meet short-term and long-term goals.

Prior to the posting of this RFP, the State conducted a review of Contract materials and Insurance levels to ensure those that are included are specific to this effort. In turn, the State expects vendor replies to comply with this RFP’s terms, conditions, insurance requirements, etc.

The State reserves the right to reject any bid that requests this RFP’s terms, conditions, and/or insurance levels, etc. be aligned to that of another RFP or award.

Vendors will be asked to agree to the below-referenced attached documents, or the most current versions of these documents at the time of award:

Contract Addendum B – IT Requirements

Contract Addendum D – Federal Funding Requirements

Contract Addendum E – Business Associate Agreement - BAA

Contract Addendum F – RIDOH Specific Supplemental Terms and Conditions

The state reserves the right to reject any proposal of a vendor that indicates it will not honor its

180-day bid irrevocable period.

SECTION B. SCOPE OF WORK

This Statement of Work (SOW) contains requirements specifically for the PDMP program. The goal of the Rhode Island PDMP, under the Department of Health, is to ensure the continued performance and functionality of the PDMP at the authorized user and administrative level. The

State is seeking a single vendor to provide a cloud-based, out of the box, highly configurable, preferably FedRamp certified system, to meet the requirements of the PDMP program.

The Incumbent Vendor (Bamboo Health) collects data from reporting entities, hosts the data in a secure site, coordinates data management securely, and establishes a secure web-based portal with graphical internet interfaces to include standard browsers and be designed in a mobile responsive manner to facilitate automated communication for authorized users. The current system supports interstate data sharing and integrating with electronic health records (EHRs) and pharmacy dispensing systems to facilitate prescriber and dispenser access to PDMP data, reducing time and effort needed to obtain a patient's history, seamlessly and in as close to real time as possible.

Currently, there are over 11,251 healthcare practitioners who can access the PDMP. Since 2017, the PDMP has over 8,430,000 records and collects Schedule II- -V controlled substance records from over 782 dispensers.

With this proposal, the State is expecting vendors to integrate with at least three (3) EHRs (like

Epic, Meditech and Wellsky) and the State HIE. Additionally, the vendor is expected to use PMPi and/or RxCheck to interface with potentially all other state PDMPs.

Task 1: Data Collection and Submission RIDOH is seeking to strengthen its Prescription Drug Monitoring Program (PDMP) through the development of a robust, secure, and comprehensive cloud-based data collection infrastructure. At the highest level, the State’s objective is not just to collect prescription data, but to build a trusted foundation for public health decision-making, clinical support, and regulatory oversight.

To achieve this, the contractor must create a system that ensures prescription records are complete, accurate, and timely. By requiring data submissions 24/7 and rejecting incomplete records in real-time, RIDOH will ensure Rhode Island is not relying on stale or partial data. This outcome will give prescribers, pharmacists, and first responders actionable insights in a timely manner in order to perform corresponding tasks or actions.

Improving Compliance and Removing Barriers for Dispensers

A central business outcome is to drive greater compliance among all types of dispensers. To accomplish this, the contractor must provide clear, accessible, and standardized reporting guidance for providers completing data submission, including FAQs, step-by-step submission instructions, and a readily available support channel. This approach reduces reporting errors and minimizes confusion.

High-Availability, Secure Infrastructure

RIDOH envisions a 24/7, high-availability system (as defined in SLAs in Appendix F) that accommodates both real-time and batch submissions, backed by secure transmission protocols

(like APIs, SFTP, VPN). The business goal is dual: (1) guarantee availability of reporting at all times and (2) safeguard sensitive patients and prescriber information against cybersecurity threats.

Flexibility for Different Types of Users

Recognizing the diversity of dispensers, RIDOH emphasizes the importance of multiple submission pathways. Larger pharmacy chains may submit data in automated batches, while small independent pharmacies—or even healthcare providers issuing a handful of controlled substances—may need a secure, user-friendly manual entry portal.

Independent rural pharmacies that may experience PDMP compliance challenges because of limited IT capacity will need a secure web portal designed to minimize administrative burden. The

State expects the solution to have the ability of standardized HL7/ FHIR exchanges as well as the ability for small pharmacies to report via an authenticated online portal. The solution must provide an RxCheck-supported submission channel for all applicable dispenser submissions.

Stakeholder and User Engagement in Design, Development, and Implementation

It is expected that the offered solution is over 70% configurable to meet State needs. Discovery and design sessions conducted will determine gaps that need to be addressed through configuration. Only in exceptional cases the State may consider building customized pieces of the application. Some State requirements are outlined below:

The Contractor shall establish and execute a structured, ongoing User-Centered Design (UCD) and Stakeholder Engagement Program throughout all phases of system design, development, testing, and implementation. This program shall ensure that the diverse needs of dispensers (large chains, independent pharmacies, hospitals, veterinary clinics), prescribers, delegates, public health analysts, law enforcement, and RIDOH administrators are proactively captured, prioritized, and incorporated into the solution.

The Contractor’s responsibilities shall include, but not be limited to:

• Stakeholder Mapping and Inclusion Plan Within 30 days of contract execution, submit a comprehensive plan identifying all user cohorts (e.g., urban vs.

rural pharmacies, high-volume vs. low-volume prescribers, EHR-integrated vs. non-integrated practices) and defining engagement methods, frequency, and feedback loops. The plan must be approved by RIDOH prior to initiation.

• Targeted User Research and Feedback Sessions Conduct a minimum of six (6) focused user research sessions during the first 12 months, including:

o Journey mapping for manual entry, batch submission, zero-fill, and error correction workflows o Usability testing of submission portals, validation feedback, and support tools with live prototypes o Pain point workshops with low-compliance or rural dispensers to identify barriers (e.g., internet access, staffing, training)

Sessions must include at least 50% participation from non-chain, independent, or rural dispensers to ensure equity in feedback.

• Iterative Design Sprints with Rapid Prototyping Implement bi-weekly design sprints (2–4 weeks each) during the development phase, where:

o Mockups or clickable prototypes of submission interfaces, error messages, and support tools are presented to targeted user groups o Feedback is collected via structured surveys, heatmaps, and live observation o Changes are prioritized, implemented, and re-tested in the next sprint

RIDOH reserves the right to participate in or observe any sprint review.

• Change Impact Communication and Training Co-Design Collaborate with stakeholders to co-develop:

o Plain-language submission guides, FAQs, and video tutorials o Change impact summaries for major updates (distributed via portal, email, and UAC) o Train-the-trainer programs for large health systems and pharmacy associations

• Efficiency Metrics and Continuous Improvement Define and track user efficiency KPIs, such as:

o Average time to complete a manual submission o Error rate on first submission o Support ticket volume per 1,000 submissions o User satisfaction (via post-interaction CSAT surveys)

Report KPI trends quarterly to RIDOH and the UAC, with recommended process or system improvements.

• Documentation of Engagement Outcomes Maintain a living Stakeholder

Engagement Log (shared via RIDOH-approved platform) capturing:

o All feedback received o Disposition (accepted, deferred, rejected) o Rationale and resulting system change (if applicable)

This log shall be auditable and submitted as a deliverable at go-live and annually thereafter.

The Contractor shall propose dedicated personnel (e.g., UX Researcher, Stakeholder Engagement

Lead) with demonstrated experience in healthcare IT user-centered design and PDMP/pharmacy workflow optimization. Resumes must be included in the proposal.

In the proposal response, vendors shall:

• Describe their standard UCD methodology and provide one (1) case study of a

PDMP or pharmacy-facing system where stakeholder engagement led to measurable efficiency gains (e.g., reduced submission errors, faster compliance onboarding).

• Include a sample stakeholder engagement plan and prototype feedback report.

• Identify any proposed tools (e.g., MURAL, Figma, UserTesting) for remote collaboration.

RIDOH views active, inclusive user engagement not as optional but as a core requirement for achieving the state’s vision of a frictionless, equitable, and continuously improving PDMP data collection ecosystem.

Special Reporting Scenarios: Zero-Fill, Aggregates, and Exemptions

RIDOH also understands that prescription activity can vary across entities and circumstances. To prevent misinterpretation of absent data, the system will support zero reporting, which signals deliberate “no prescriptions dispensed” for a given period. This avoids the common data quality issue of distinguishing whether a dispenser is non-compliant versus simply having no activity.

Similarly, pharmacies owned by large corporate groups will be allowed to submit aggregated reports while maintaining identifiers to trace each prescription back to its source. This reduces redundancies, as with CVS or Walgreens, while still enabling regulatory oversight at the store level. Exemptions, whether partial or full, align with state policy and ensure the system is flexible while still enforcing accountability—for example, exempting certain hospital-based dispensing when appropriate.

Ensuring Data Quality and Integrity

Perhaps the most critical outcome is ensuring data integrity. Automatic validation, rejection of incomplete records, and immediate feedback to dispensers will preserve the quality of incoming data. Poor-quality PDMP data decreases trust among healthcare providers and limits the system’s value.

Incomplete patient histories caused by missing demographic fields are one example of the challenges prescribers may encounter. After implementing automated rejections and clear correction workflows, the completeness rate rose significantly, leading to more reliable patient profiles and stronger clinical trust in the system. Rhode Island intends to apply the same approach to deliver clean, actionable data that can be confidently used—whether by clinicians assessing drug-seeking behavior or RIDOH analysts identifying public health trends.

Integration with RIDOH-Provided Data

Finally, recognizing that RIDOH itself may contribute additional data, the contractor must create an infrastructure that extracts and integrates internal health department datasets. This ensures that

RIDOH retains flexibility and control over emerging data needs—whether those stem from legislative changes, newly defined “drugs of concern,” or integration with broader surveillance systems.

In summary, RIDOH’s overarching business outcome is to establish a comprehensive, secure, and flexible PDMP data infrastructure that:

• Captures all prescription activity reliably and consistently;

• Enables near real-time visibility for clinical and public health decision-makers;

• Protects sensitive information while simplifying compliance for all dispensers;

• Ensures long-term adaptability in response to evolving state and federal requirements.

In practical terms, this means Rhode Island will be equipped to identify prescribing anomalies, detect potential opioid misuse more rapidly, support prescribers with trusted patient histories, and strengthen its ability to combat addiction and diversion at both the clinical and community levels.

Task 2: Data Management and Validation

The Rhode Island Department of Health (RIDOH) seeks to evolve its Prescription Drug

Monitoring Program (PDMP) into a secure, validated, and analytics-ready data environment.

While Task 1 focused on the collection of prescription data, Task 2 ensures that data is ingested, validated, enriched, normalized, stored, and maintained so that it can be meaningfully applied in public health surveillance, provider decision-making, and regulatory oversight. At its core, the business objective is to transform raw prescription records into trusted, high-quality information that can be confidently used across the healthcare ecosystem.

The Contractor shall be responsible for implementing, managing, and maintaining comprehensive data management functions for the Prescription Drug Monitoring Program (PDMP). These functions shall include the secure ingestion, validation, normalization, translation, storage, analysis, and lifecycle management of data in compliance with the Rhode Island Department of

Health (RIDOH) policies and applicable regulatory requirements.

Building a Secure and Always-On Data Environment

RIDOH requires secure, highly available, vendor-hosted infrastructure operating in a cloud-hosted environment, ensuring PDMP data can be accessed whenever needed. With uptime governed by

Service Level Agreements (Appendix F), the system will be resilient to disruptions. Rhode Island seeks a model of uninterrupted service. RIDOH wants to avoid periodic outages, forcing pharmacists to either delay dispensing or dispense without access to prescribing histories. This undermines both compliance and patient safety. It is required to maintain near-continuous uptime, giving providers confidence that critical patient data is always available.

Enhancing Data Accuracy Through Identifier Mapping

To ensure records are correctly tied to the right practitioners and medications, RIDOH mandates the use of DEA, NPI, and NDC mapping. These mappings enrich data submissions by converting numerical identifiers into context-rich information—prescriber names, addresses, drug details, and

DEA-controlled substance schedules. As an example: In absence of strong DEA/NDC validation, prescribers with common names like “John Smith” are often miss-linked or duplicated. This creates blind spots in tracking prescribing behaviors. With identifier mapping, Rhode Island would like to prevent such errors and ensure data reliability at both the practitioner and medication level.

Empowering Public Health Insights with Advanced Analytics

RIDOH envisions a system where data management functions seamlessly integrate with business intelligence and analysis tools. By combining data cleansing and mining, the platform will provide actionable insights into prescribing trends and potential misuse. Integrated PDMP analytics reveal insight into use cases of overlapping opioid prescriptions across different providers—helping authorities detect “doctor shopping” patterns earlier. Rhode Island aims for the same proactive intelligence that allows intervention before misuse escalates.

Locating Emerging Hotspots with Geocoding

An advanced business goal is to enable geographic and spatial analysis. RIDOH will be able to use records from the PDMP to standard and RIDOH-specified data like geocode dispenser, prescriber, and patient addresses, allowing detection of clusters that may signal diversion or abuse.

Use of techniques such as spatial analysis to uncover “pill mill” concentrations in specific counties allows regulatory and law enforcement teams to focus efforts where risks were highest. Rhode

Island’s use of the same capability will enable targeted interventions that are data-driven and community-specific.

Note that the vendor is not required to provide any geo-spatial analysis, only data with elements that support RIDOH’s internal efforts in doing so.

Ensuring Clean, Consolidated Patient and Prescriber Records

Another key outcome is entity resolution. By cleansing and normalizing data, the system will consolidate records containing spelling differences, nicknames, or slightly varying addresses and birthdates. This prevents a single patient or prescriber from appearing as multiple individuals in the system.

With entity resolution, individuals could manipulate minor spelling variations (“Jon Smyth” vs.

“John Smith”) to conceal overlapping opioid prescriptions, the state can successfully identify doctor-shopping behavior that could have been previously gone unnoticed. Rhode Island’s system will close these same data quality loopholes.

Making Data Searchable and Actionable

Advanced search and query tools will allow RIDOH staff and authorized users to filter across demographics, prescriber IDs, drugs, dispenser histories, and geographic fields. Such flexible searches empower investigators and clinicians alike. RIDOH requires a prescriber to search whether a patient has filled opioid prescriptions at multiple pharmacies in the past month. With advanced search, results are returned instantly, improving prescriber decision-making and preventing harmful overlapping prescriptions.

Complying with Retention and Privacy Regulations

RIDOH’s policies dictate strict retention schedules—36 months of live data and up to 60 months archived, with flexibility to accommodate legislative changes. Automating data purging aligns the

PDMP with evolving privacy requirements while balancing the need for long-term analytics.

Failure to manage retention timelines may spark privacy concerns and legal pushbacks. By building in retention automation, Rhode Island would like to protect patient privacy while maintaining necessary oversight data.

Seamless Data Migration and Continuity of Service

Transitioning from the current PDMP to a new platform must occur without loss of historical data, metadata, or audit trails. This ensures continuity for prescribers and regulators who rely on historical context. Data migration challenges could leave providers unable to see older histories, undermining confidence in the PDMP. Rhode Island’s requirement for careful migration preserves trust while avoiding any break in clinical or regulatory workflows. The vendor is expected to work with the incumbent vendor to migrate data completely and successfully.

Coordination with current Vendor (Bamboo Health) for Transition

The Contractor shall collaborate directly with the current PDMP vendor, Bamboo Health, to ensure a seamless, secure, and efficient transition from Bamboo Health's existing SaaS platform to the new PDMP system. This collaboration is essential to minimize service disruptions, maintain data continuity, and preserve operational knowledge, while complying with all state and federal regulations, including HIPAA, the SUPPORT for Patients and

Communities Act, and Rhode Island-specific PDMP mandates (e.g., R.I. Gen. Laws § 21-28-

3.32).

The Contractor's responsibilities for this transition shall include, but not be limited to:

• Joint Transition Planning: Developing and executing a detailed transition plan in partnership with Bamboo Health and RIDOH. The plan must outline timelines, milestones, roles and responsibilities, risk mitigation strategies, contingency measures, and success criteria. The plan shall be submitted to RIDOH for approval within 30 days of contract execution and updated as needed throughout the transition period (estimated

3-6 months, subject to RIDOH approval).

• Data Migration Coordination: Working with Bamboo Health to extract, transform, and load (ETL) all historical PDMP data, including but not limited to prescription records (over 8,430,000 records since 2017), dispenser submissions from over 782 entities, user profiles (over 11,251 healthcare practitioners), audit trails, metadata, configurations, and interstate data-sharing. Migration must occur without data loss, corruption, or extended downtime (not to exceed 4 hours during non-peak periods, as defined in the SLA). The Contractor shall validate data integrity, with a goal of 100% accuracy, through joint testing and provide certification of completeness upon migration completion.

• Knowledge Transfer and Documentation: Facilitating structured knowledge transfer sessions with Bamboo Health's technical and operational teams. This includes documenting system architecture, data schemas, integration points (e.g., EHR/HIE interfaces), custom Rhode Island configurations, error-handling protocols, and best practices for data submission, validation, and reporting. All documentation must be provided to RIDOH in a searchable, digital format (e.g., PDF and editable Word/Excel) within 60 days of contract start.

• Joint Testing and Validation: Conducting parallel system testing with Bamboo

Health to compare outputs, performance, and functionality. This includes end-to-end testing of data collection, validation, interstate sharing, EHR integrations, user access, and analytics. Any discrepancies must be resolved collaboratively, with RIDOH overseeing final acceptance testing.

• Communication and Issue Resolution: Establishing dedicated communication channels (e.g., weekly status meetings, shared project management tools like Microsoft

Teams or Jira) for ongoing coordination. The Contractor shall define escalation protocols for issues such as data access delays or technical incompatibilities, with

RIDOH as the final arbiter. All communications and resolutions must be logged and auditable.

• Compliance and Security Alignment: Ensuring the transition adheres to the

State's IT policies (Contract Addendum B), ETSS’ cybersecurity standards (Appendix

D), and RIDOH’s Business Associate Agreement (Contract Addendum E). This includes joint security assessments, breach response planning, and confirmation that

Bamboo Health's SaaS data is securely decommissioned post-migration.

Monitoring, Auditing, and Enforcing Reporting Behavior

To strengthen oversight, RIDOH’s system will include tools to review dispenser upload histories, error rates, and reporting patterns. This will allow Rhode Island to easily identify late submitters, frequent upload errors, and inconsistent reporting. Monitoring tools for instance can uncover a subset of pharmacies with repeated late reporting patterns, enabling targeted compliance outreach.

Rhode Island will adopt this best practice to drive consistent reporting across all dispensers.

Automating Prescription Verification for Fraud Prevention

Finally, RIDOH seeks automated verification of prescription data fields, including control numbers. This prevents fraudulent or fabricated prescriptions from polluting the PDMP system.

For example, some states discovered prescriptions with invalid control numbers used in attempts to submit false opioid records. Automated checks eliminated these fraudulent entries before they entered the main records. Rhode Island’s PDMP will apply similar safeguards, ensuring data is trustworthy and resistant to manipulation.

In summary, Task 2 ensures that Rhode Island’s PDMP does more than collect data—it delivers a clean, secure, intelligent, and actionable prescription monitoring system. By enriching, normalizing, geocoding, cleansing, and validating prescription records, RIDOH will achieve:

• High trust in data accuracy by eliminating duplicates and errors;

• Greater oversight of dispenser compliance through transparent auditing tools;

• Advanced public health intelligence with built-in analytics and spatial mapping;

• Improved fraud resistance via automated verification processes;

• Regulatory alignment with retention, privacy, and security requirements.

Task 3: Data Exchange and System Integration

This task represents a critical step in evolving Rhode Island’s PDMP from being a standalone system of secure prescription data into a fully interoperable and integrated platform that connects seamlessly with state, national, and clinical care environments. The business outcomes RIDOH seeks here revolve around ensuring that PDMP data is accessible when and where it is needed most — across borders, within clinical decision-making workflows, and as part of the State’s broader health information infrastructure.

As part of Task 3, this RFP requires vendors to focus on scope and technical requirements for interoperability -

1. The proposed solution must support both pathways (PMPi and RxCheck) for inbound and outbound interstate data-sharing;

2. Standard HL7-based interfaces are required with the HIE and with provider EHRs, with costs included in this bid;

3. Inbound and outbound APIs for querying data in discrete parse-able formats are required.

Through Task 3, RIDOH intends to move beyond simply storing and validating prescription data

— the goal is to make PDMP data work for providers, pharmacists, and public health entities by embedding it into existing workflows and securely connecting it across systems and states.

RIDOH seeks to support provider choice in how to utilize the PDMP by establishing pathways to access data through the HIE or through direct EHR integration. To that end, the vendor must support both inbound and outbound API-based queries for PDMP data, including any necessary user authentication. Vendors should expect a total of 4 bidirectional exchanges: 1 to the HIE and

3 additional to provider EHRs.

Importantly, bidders should incorporate all costs necessary to support statewide access to the

PDMP through the provider’s access pathway of choice in their bid. The State will not entertain additional costs for access to PDMP data imposed after the time of award. (Note that providers are expected to bear the costs imposed by their own contracted vendors to make any such connection.) RIDOH may request additional modifications to other areas of the scope of work that can be scoped and discussed with the selected vendor as the opportunity arises.

Enabling a Complete Patient View Through Interstate Data Sharing

RIDOH recognizes that patients and prescribers are not confined by state borders. Interstate data sharing ensures that healthcare providers have visibility into out-of-state prescription activity, a critical requirement in a region like New England where patients can easily cross into

Massachusetts or Connecticut to fill prescriptions and often travel to Florida for portions of the year.

RIDOH does not have preferences or requirements around whether the selected vendor utilizes

PMP InterConnect (PMPi) or RxCheck pathways for supporting inbound inter-state data-sharing from critical states (Massachusetts, Connecticut and Florida) so long as it is effectively accomplished. Although RIDOH does not have an existing agreement with the National

Association of Boards of Pharmacy (NABP), the State does have agreements with all contiguous states and Florida to exchange PDMP data.

Outbound data-sharing (RI PDMP providing data to other states) must be supported through both methods, RxCheck and PMPi.

For example: Connecticut providers uncovered opioid diversion patterns once they joined PMP

InterConnect and gained access to Massachusetts’ PDMP data. Patients previously evaded detection by filling opioids across state lines. Rhode Island is pursuing the same objective — achieving regional oversight and cross-border monitoring that will directly reduce doctor shopping and fraudulent prescribing.

Streamlining Clinical Workflows through EHR and Pharmacy Integration

One of the most important outcomes RIDOH is targeting is workflow efficiency for prescribers and pharmacists. Instead of requiring a separate login, the PDMP will be integrated directly into commonly used Electronic Health Records (EHRs) and pharmacy dispensing systems.

The business objective here is twofold:

1. Increase PDMP utilization by making access frictionless.

2. Improve clinical decision-making by embedding PDMP insights directly at the point of care.

RIDOH anticipates two major connections with Epic instances in the state as well as additional connections to Athena, eClinicalWorks, and NextGen to support health centers. Since most data flows can be mediated through the RI HIE instead – and we expect most providers to prefer this

– the vendor can anticipate a total of 3 direct EHR integrations in addition to the main HIE integration.

For example: Indiana saw a dramatic increase in PDMP usage after integrating systems into

EHRs like Epic and Cerner. Providers no longer had to leave their workflow, so they checked

PDMP data more consistently. The impact was measurable: opioid prescribing rates fell significantly after integration. RIDOH seeks to achieve this same behavioral shift in provider adoption by requiring coverage of at least 75% of prescriber and pharmacist software systems in

Rhode Island at minimal additional cost to the provider.

Securing Access and Ensuring Compliance

RIDOH emphasizes that integration must be accompanied by robust security and access controls.

Authorized PDMP users will be validated, access will be logged, and all transactions will be subject to audit trails. The integration must also use modern identity and access management protocols like OAuth 2.0 and SAML to guarantee secure authentication. This ensures that while the PDMP becomes easier to access, it does not compromise on data security or patient privacy.

If integrated PDMP connections lack adequate audit logging, it would impact accountability.

Rhode Island’s requirement for comprehensive identity and audit logging ensures transparency, compliance with state law, and public trust in the process.

Connecting PDMP to the State Health Information Exchange (HIE)

Integrating the PDMP with Rhode Island’s state-designated Health Information Exchange

(HIE) represents another transformational objective. By combining prescription data with other health information, RIDOH seeks to provide a whole-patient and population-level perspective that can inform both direct care and public health strategies. Through this integration, PDMP data will not operate in isolation but as part of a broader ecosystem of patient data available through the HIE. This integration will also be governed by state consent and privacy policies overseen by the state’s Regional Health Information Organization, which positions the system to remain aligned with Rhode Island’s legislative framework.

Linking HIE with PDMP records allows care teams — from prescribers to behavioral health providers — to see both prescription histories and other care data when coordinating treatment.

This integration will improve early referrals for addiction treatment and enhanced population health monitoring. Rhode Island aims for the same holistic view of patient care and improved coordination across its healthcare system. Exchange with the HIE is required to conform to standard HL7 specifications and USCDI-supported code sets wherever possible, resulting in

“raw” parse-able data sent to the HIE. Documents will be transported using IHE-compliant web services (e.g., XDR or XDS.b) over secure HTTPS leveraging Public Key Infrastructure (PKI)– based authentication. All transmissions are protected with 2048-bit RSA keys and TLS 1.2+ certificates, providing encryption in transit, endpoint verification, and message integrity.

Future-Proofing PDMP Interoperability

Finally, RIDOH is requiring all integration efforts to be standards-based and scalable, ensuring the PDMP can adapt to future interoperability requirements and additional system linkages down the road. This keeps Rhode Island from getting locked into outdated technologies and ensures it can participate in emerging national healthcare data exchange strategies. Transition to HL7

FHIR® standards for PDMP exchange will allow seamless pipelines into other clinical decision support tools. By structuring interoperability around recognized standards, Rhode Island plans to future-proof its investment and reduce long-term costs associated with system upgrades.

In summary, outcomes RIDOH seeks include:

1. Holistic patient profiles enabled through cross-state PDMP sharing.

2. Increased PDMP utilization by embedding access directly in EHRs and pharmacy systems.

3. Improved care decisions facilitated by real-time PDMP visibility at the point of prescribing or dispensing.

4. Public health benefits driven by HIE integration and population-level analytics.

5. Governance and compliance transparency ensured through consent alignment and audit logging.

6. Future adaptability through standards-based, scalable integration approaches.

Task 3 is about turning Rhode Island’s PDMP into a connected and interoperable tool — one that protects privacy, increases provider use, enhances region-wide monitoring, and contributes to a comprehensive, policy-aligned health data ecosystem.

Task 4: Secure Web Services and User Access Management

This task reflects Rhode Island’s intention to make its PDMP not only a secure data repository but also a trusted, user-friendly, and always-available clinical and regulatory tool. The business outcomes focus on building a secure, accessible web portal that providers, pharmacists, and state officials can rely on for real-time, privacy-compliant insights, while maintaining accountability, scalability, and resilience against security threats.

The Contractor shall develop, implement, and maintain a secure, user-centric web-based portal that provides registered users with 24/7 access to the PDMP database. The system shall incorporate robust authentication, access control, communication, and administrative capabilities in accordance with federal and state privacy and security regulations, including the Health Insurance

Portability and Accountability Act (HIPAA).

Ensuring Round-the-Clock Secure Access for Users

The first outcome is guaranteeing that the PDMP portal is available 24/7 with minimal downtime, so prescribers and pharmacists have uninterrupted ability to look up patient histories before dispensing or prescribing controlled substances.

Strengthening Trust Through Robust User Authentication

RIDOH emphasizes multi-layered authentication and account security: unique credentials, two-factor verification, password expiration policies, and lockout features after failed logins. These controls prevent unauthorized access and eliminate the risks of shared accounts. Introducing structured logins with delegates and lockout functions stops the practice of widespread account sharing in provider offices to save time practice and improved accountability. Rhode Island plans to apply the same standard, ensuring prescribers, pharmacists, and delegates are uniquely identified and traceable within the system.

Protecting Privacy Through Compliance with HIPAA and State Standards

Another key outcome is protecting patient confidentiality by ensuring HIPAA compliance and role-based data access controls. Administrators will be able to configure permissions, so each user only sees the data relevant to their practice needs. Lose permission configurations can result in too many staff having access to sensitive PDMP records. This is where role-based security is critical to prevent breaches. Rhode Island plans to build this safeguard into its requirements from day one to avoid similar challenges.

Scaling to Serve Thousands of Users Concurrently

As the PDMP grows to over 10,500 users statewide (prescribers, pharmacists, agency staff), the system must handle high volumes of concurrent traffic without slowing down. By designing for growth now, RIDOH ensures future mandates or expanded access populations will not compromise performance.

Making PDMP Data Usable Through On-Demand Reporting

RIDOH wants users to be able to generate their own reports directly within the secure portal without manual staff intervention. This enables providers to immediately see prescribing patterns or patient histories at the point of care. The ability to empower prescribers with instant patient history reports pulled directly from the PDMP reduces duplicate opioid prescribing and improved clinical decision-making. Rhode Island’s self-service report generation is structured to drive similar outcomes.

Enabling Direct Communication and Role-Based Alerts

The portal will act as a two-way communication tool. RIDOH wants the ability to push alerts, announcements, and targeted notices to prescribers, pharmacists, or regions as needed.

Administrators can also directly message dispensers and uploaders with updates or corrective guidance.

Example: North Carolina’s PDMP successfully used statewide alerts to inform providers about a surge in fentanyl-laced counterfeit pills. Targeted communications through the PDMP portal dramatically increased prescriber caution in affected counties. Rhode Island expects to mirror this capability for both emergency alerts and routine policy notices.

Balancing Delegated Access with Oversight

Recognizing that prescribers often rely on office staff to assist, RIDOH requires a delegate workflow where prescribers authorize staff to run queries on their behalf, while retaining audit visibility of all delegate actions. This saves clinicians time but keeps accountability intact.

Defending Against Data Breaches and Unauthorized Access

A central business outcome is ensuring incident readiness. The contractor must have intrusion detection, breach response protocols, and compliance with HIPAA’s 24-hour notification rule. The

PDMP vendor must not only notify RIDOH immediately but also investigate, secure evidence, and produce a written impact assessment.

PDMP vendor is required to set the bar with rapid notification protocols and predefined investigation steps. Rhode Island wants to ensure public trust in sensitive prescription data management.

Specific requirements pertaining to HIPAA and breach notification and response procedures are outlined in Addenda B and E (Information Technology and Business Associate Agreement, respectively) and the successful vendor is expected to sign both sets of terms without revision.

Providing Reliable 24/7 User Support

To build confidence and adoption, RIDOH requires 24/7/365 helpdesk support, U.S.-based, with fast turnaround times. This ensures that providers in emergencies or off-hours can resolve issues with password recovery, portal navigation, or reports quickly.

Rhode Island is addressing the need to provide PDMP support to be available during off business hours by mandating continuous, U.S.-based customer support to match the clinical realities of around-the-clock healthcare.

Through these measures, RIDOH ensures the PDMP system is:

• Secure: Strong authentication, HIPAA compliance, and breach readiness.

• Reliable: 24/7 access with high availability and concurrent user support.

• Accountable: Role-based security, delegate workflows, and audit trails.

• User-Friendly: On-demand reporting, communication tools, and responsive helpdesk support.

• Trusted: Transparent breach management and robust privacy safeguards.

In summary, Task 4 ensures the PDMP is not just a database, but a secure, trusted, and accessible tool clinicians and pharmacists actually want to use — because it is safe, efficient, available anytime, and backed with real accountability. This transforms the PDMP from a compliance requirement into a valuable clinical and public health asset.

Task 5: Queries, Reporting, Analytics, and Threshold Alerts

This task shifts the Rhode Island PDMP from being a data repository to becoming an actionable intelligence platform. The goal is to empower prescribers, pharmacists, regulators, and public health officials with meaningful insights, alerts, and customizable reports so they can act quickly to improve patient safety, enforce compliance, and monitor population-level health trends.

The Contractor shall develop, support, and maintain robust reporting, query, and analytics capabilities that enable the Rhode Island PDMP and its users to generate, customize, and analyze data and reports efficiently. The system must provide actionable intelligence through automated reports, ad hoc queries, threshold alerts, and integrated dashboards, while also meeting state and federal compliance reporting requirements.

Making Reports Accessible and User-Friendly

For outward-facing reporting, RIDOH wants users to be able to generate standardized reports in multiple formats (PDF, CSV) to match different needs. A clinician may want a simple PDF to attach to a chart, while a public health analyst may need CSV data to conduct deeper analysis.

Example: In Connecticut’s PDMP, public health teams frequently export CSV files to analyze opioid prescribing trends for grant reporting, while doctors rely on PDFs for quick consultation.

Rhode Island is building the same dual-purpose utility.

Ensuring Pharmacy Compliance Through Submission Audits

The system will automatically flag pharmacies that fail to submit data or whose submissions were rejected due to errors. RIDOH can then intervene quickly to correct compliance issues.

Example: Tennessee’s PDMP routinely used audit reports to identify pharmacies that repeatedly failed to upload data on time. This allowed the state to deploy targeted technical training and bring those pharmacies back into compliance. Rhode Island seeks a similar continuous compliance cycle.

Supporting Flexible Ad Hoc Queries for Investigations

Investigators and users with appropriate permissions need the ability to query across multiple fields

— patient demographics, prescriber IDs, drug classes, etc. - to uncover patterns.

Example: In Kentucky, ad hoc search functionality allowed state analysts to discover that overlapping opioid prescriptions were heavily concentrated among a small group of prescribers, leading to policy reforms. Rhode Island’s PDMP will provide this same search-and-expand investigative capacity.

Helping Prescribers Self-Audit Their Own Activity

Prescribers will be able to query their own records by DEA number, giving them visibility into their prescribing behavior.

Example: In Indiana, prescribers who began reviewing their own data — and benchmarks compared to peers — voluntarily changed their prescribing practices, significantly reducing high-dose opioid prescriptions. Rhode Island recognizes the value of self-auditing as a preventive, education-driven intervention.

Bringing Transparency with Audit Logs and User Activity Reports

All system queries and activities will be logged, enabling RIDOH to generate on-demand reports of who accessed what data.

Example: Nevada’s PDMP uncovered misuse when audit logs showed non-clinical staff were accessing data outside of authorized purposes. After tightening oversight, trust in the program grew. Rhode Island will embed this transparency and accountability from the outset.

Supporting Public Health Through Data File Submission

Beyond individual prescriber or dispenser monitoring, RIDOH will receive identified, individual-level data files on a monthly cadence to support public health purposes such as overdose risks, prescribing clusters,…