RFQ 2022-09 Response to Clarifying Questions 5-19-22.pdf
PDF 229 KB Posted
- Solicitation number
- S-63500-00003107
- Issued by
- Marion County, Oregon
About this file
This document is a Response to Clarifying Questions issued by CareOregon's Procurement Department regarding Request for Quotes #2022-09 for Personal Emergency Response System services, dated May 19, 2022. CareOregon seeks vendor responses for Personal Emergency Response System equipment and services to serve its membership. The RFQ addresses key operational questions submitted by interested vendors, including member eligibility files, data handling requirements, reporting capabilities, and member choice provisions for device types. The clarification responses indicate that CareOregon expects to provide member eligibility information containing Protected Health Information (PHI) as defined under HIPAA, thus requiring vendors to execute Business Associate Agreements and comply with comprehensive data security standards. Vendors are requested to provide standard customer reporting on unit distribution, call/signal utilization, and service performance metrics during monthly or quarterly business review meetings.
CareOregon provided critical operational data to support vendor pricing and planning, noting that members experience a 4-5 percent monthly disenrollment rate with approximately 25 percent of disenrolled members returning to the plan. Data Security requirements mandate compliance with HIPAA audit standards, with CareOregon indicating openness to alternative audit and monitoring approaches beyond the standard SSAE 18 SOC2 Type II audit requirement, provided vendors propose compliant alternatives and clearly identify such proposals in their quotes. Members are to receive choice in device type selection, with specific eligibility criteria to be determined. The clarifications confirm that the Business Associate Agreement and all associated data security requirements remain applicable regardless of vendor concerns regarding audit costs or PHI handling scope.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
315 SW Fifth Ave, Portland, OR 97204 | 800-224-4840 | TTY 711 | careoregon.org
George Marlton Procurement Director
Procurement Department 503-416-4706 Procurement@careoregon.org
REQUEST FOR QUOTES #2022-09
PERSONAL EMERGENCY RESPONSE SYSTEM
RESPONSE TO CLARIFYING QUESTIONS
May 19, 2022
Note that these are questions submitted by interested firms to the above referenced solicitation. The below answers are for clarification purposes only and in no way alter or amend the RFQ as published.
1. Question if the vendor will have PHI or CareOregon data, and if not, then the BAA and Data Security requirements should not be applicable.
Answer: HIPAA defines PHI as individually identifiable information including these 18 items, some of which you will be receiving from us in a member eligibility file. Therefore, the BAA and Data and Security requirements are applicable:
1. Names (Full or last name and initial)
2. All geographical identifiers smaller than a state, except for the initial three digits of a zip code if, according to the current publicly available data from the U.S. Bureau of the Census: the geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and the initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000
3. Dates (other than year) directly related to an individual
4. Phone Numbers
5. Fax numbers
6. Email addresses
7. Social Security numbers
8. Medical record numbers
9. Health insurance beneficiary numbers
10. Account numbers
11. Certificate/license numbers
12. Vehicle identifiers (including serial numbers and license plate numbers)
13. Device identifiers and serial numbers;
14. Web Uniform Resource Locators (URLs)
15. Internet Protocol (IP) address numbers
16. Biometric identifiers, including finger, retinal and voice prints
17. Full face photographic images and any comparable images
18. Any other unique identifying number, characteristic, or code except the unique code assigned by the investigator to code the data
2. The Data Security requirements in the sample contract require SSAE 18 SOC2 Type II audit each year. The audit costs can be expensive. Is this still a requirement?
Answer: The Data Security requirements will be required. We are open to alternative audit/monitoring approaches that meet HIPAA audit standards. Please indicate in your quote if you are proposing an alternative because you do not do a SOC Type II audit.
http://careoregon.org/ mailto:Procurement@careoregon.org
315 SW Fifth Ave, Portland, OR 97204 | 800-224-4840 | TTY 711 | careoregon.org
3. For question 11, is CareOregon looking for some specific reports to be provided or in general what reports can we provide?
Answer: We’re interested in whatever standard customer reporting on new units distributed, utilization of calls/signals for help, service guarantee performance, etc., that you already have and could provide in a monthly or quarterly business review meeting.
4. What percentage of total current members are disenrolled from CareOregon every month?
Answer: You can assume 4-5% monthly disenrollment and of those about 25% return to the plan.
5. Are CareOregon members going to have a choice as to which type of unit they can receive? Will there be specific criteria to make a member eligible for specific type of device?
Answer: Members should have choice of units.
End of Clarifying Questions http://careoregon.org/
File details come from the government source that posted it. Updated .