RFQ 6256 –Enterprise Data Management Platform

REQUEST FOR QUOTES (RFQ)

Enterprise Data Management Platform Solution

Issue Date: August 28th , 2026 Issued to: Participating Addendum Holders name and PA #

A&T 8352

CDWG 9414

Carahsoft Technology Corp 9412

Lumen (formerly CenturyLink) 8355

SHI International Corporation 9404

Smartronix 8354 Strategic Communications 9413

Issuing Office: OHA - Oregon Health Authority (OHA) (Authorized Purchaser)

Authorized Purchaser Contact Information

RFQ (Authorized Representative): Elvis Howard Address: 635 Capitol St NE Ste 350 City, State, Zip Salem, OR 97301 Phone: 503-871-3074 E-mail: elvis.r.howard@odhsoha.oregon.gov

You can get this document in other languages, large print, braille, or a format you prefer free of charge. Contact the Single Point of Contact (SPC) at the contact information found above. We accept all relay calls.

Table of Contents

1.0 PURPOSE & INTENT

2.0 SCHEDULE

3.0 BACKGROUND

4.0 OBJECTIVES

5.0 SCOPE

5.1 IN SCOPE (TO BE PURCHASED)

5.2 OUT OF SCOPE (NOT TO BE PURCHASED)

5.3 COLLABORATION WITH OHA’S IMPLEMENTATION PARTNER (REQUIRED)

6.0 MINIMUM SOLUTION REQUIREMENTS (HIGH-LEVEL)

6.1 CORE CATALOG & GOVERNANCE CAPABILITIES

6.2 SECURITY & PRIVACY

6.3 ACCESSIBILITY

7.0 QUOTE AND SUBMITTAL REQUIREMENTS

7.1 GENERAL REQUIREMENTS

7.2 QUOTE PACKET CONTENTS/REQUIREMENTS

7.3 QUESTIONS AND REQUEST CLARIFICATIONS

8.0 EVALUATION CRITERIA

8.1 RESPONSIVENESS DETERMINATION AND RIGHT OF REJECTION

8.2 EVALUATION CRITERIA

1.0 Purpose & Intent

This RFQ is issued by the State of Oregon’s Oregon Health Authority (OHA). The purpose of this RFQ is to solicit for a commercially available off-the-shelf (COTS) Enterprise Data Management Platform capable of standing up a Data Catalog Solution (DC) that enables robust metadata management, enterprise-wide data discovery, governance workflows, and integration with OHA’s existing data infrastructure, delivered through a Data Management Platform.

OHA intends to enter a Purchase Order (PO) contract with the vendor whose solution most advantageously meets the Agency’s technical, functional, and operational needs, as determined through the evaluation process described herein.

Specifically, the RFQ seeks solely to obtain:

1. Software licensing (subscription or perpetual, as proposed)

2. Vendor-provided training and implementation support limited to enablement, Further details described in Section 5.

OHA desires this solution to be a commercially available off-the-shelf (COTS) Data Management Platform with a robust Data Cataloging tool that enables metadata management, enterprise-wide data discovery, data quality and lineage capabilities, data governance workflows, and integration with OHA’s existing data infrastructure that provides flexibility for future scalability and innovation.

OHA will execute a separate procurement for an implementation partner to perform all Design, Development, and Implementation (DDI) for the solution procured through this

RFQ.

Estimated term for the Contract: 5 Years

2.0 Schedule

The table below represents a tentative schedule of events. All times are listed in Pacific Time. All dates listed are subject to change.

Event Date & Time

Questions/Clarification Request Due September 10th, 2026, at 5:00PM

OHA Responses Issued (anticipated) September 16th, 2026

RFQ Responses Due September 18th, 2026, at 5:00PM

Notice of Intent to Award (anticipated) October 2nd, 2026

Award Protest Period Ends 7 calendar days after Notice of Intent to Award

3.0 Background

The Oregon Health Authority (OHA) serves as the State of Oregon’s single Medicaid agency and is dedicated to ensuring equitable access to health services for all Oregonians. In alignment with this mission, OHA is committed to advancing data accessibility, governance, and transparency across its enterprise through the modernization of the data management capabilities across their data landscape.

OHA’s current data landscape consists of more than 1000+ discrete data sources distributed across multiple program areas, with limited standardization or enterprise visibility. Data assets are largely managed within program-specific systems, resulting in fragmented access and documentation processes, inconsistent identification of data stewards, and minimal transparency into data location, lineage, and quality. This siloed environment constrains cross-program data sharing, limits enterprise analytics, and impedes the agency’s ability to generate the integrated insights necessary to advance strategic objectives and improve outcomes for Oregonians.

In partnership with the Oregon Department of Human Services (ODHS) and the Office of Information Services (OIS), OHA has embarked on a coordinated journey focused on strengthening enterprise-wide data management capabilities across the data landscape.

This collaboration reflects a shared commitment to improving OHA’s data landscape by treating our data as an asset and improving the standardization and visualization of data assets to meet OHA’s strategic goals through the Transparency, Accountability and Belonging (TAB) initiative and OHA’s Open Data Program to improve services offered and outcomes achieved for the people who live in Oregon.

Seeking to provide a strong foundation upon which to build this data management modernization journey, OHA’s Data Office is releasing this request for quote procurement for an Enterprise Data Management Platform based Data Catalog (DC) solution. The DC will serve as a cornerstone tool for the Agency as it takes action to mature and expand our data inventory, governance, and management capabilities across the data landscape. The implementation of a modern data catalog is essential to ensuring the efficient and responsible use of data, enhancing governance and stewardship, reducing data redundancy, and empowering staff and leadership to make data-informed decisions that improve health outcomes and promote equity statewide.

The decision to pursue this procurement follows a comprehensive and applied set of related project activities. In Fall of 2024, OHA conducted an internally focused landscape assessment on data cataloging, quality, and inventory. The assessment identified opportunities to strengthen OHA’s data practices through maturing the Agency’s ability to complete data discovery, management, and governance through a modern data management solution.

In early 2025, in response to the findings of the landscape assessment, ODSO developed a Data Catalog Proof of Concept (PoC). Conducted in partnership with OIS and under the agency’s Transparency, Accountability, and Belonging Initiative, it successfully demonstrated the added value of a data catalog serving as the cornerstone in OHA’s data management modernization journey. It will help OHA staff and partners more effectively coordinate, discover, and understand data across the organization.

Over the Summer of 2025, OHA released a Request for Information (RFI 6106) on Data Cataloging tools to enhance the Agency’s ability to gather market intelligence and assess solution capabilities. Demonstrations were provided by four solution vendors to program and business staff across the enterprise, allowing for both the assessment of the standard data cataloging functionalities and for knowledge building in potential future users of the technology.

The extensive knowledge gained through the landscape assessment, PoC, and RFI has created a strong and well-supported understanding of Agency needs and the solution capabilities required. This RFQ is a culmination of these efforts.

4.0 Objectives

The primary objective of this RFQ procurement is to acquire a cloud-hosted, user-friendly, and commercially available off-the-shelf (COTS) Data Management Platform capable of standing up a Data Catalog Solution (DC).

This solution must enable the Oregon Health Authority (OHA) to:

A. Create and Maintain a Centralized Metadata Repository Deliver a unified, agency-wide metadata repository that consolidates metadata from all designated OHA data sources and supports efficient, reliable retrieval.

B. Enable Scalable, Searchable, and User-Friendly Metadata Management Allow users to search, navigate, and manage metadata across diverse data assets with high performance, minimal latency, and an intuitive user experience that supports varying levels of technical proficiency.

C. Enable Improved Data Discovery and Accessibility Provide functionality that enables internal and approved-external users to quickly locate, interpret, and access data assets based on permissions, using clear documentation, search tools, and contextual metadata.

D. Strengthen Data Governance and Stewardship Capabilities Enable role-based access controls, visibility into data ownership and stewardship assignments, glossary and taxonomy management, and configurable governance workflows that support OHA’s governance framework and promote consistent data practices.

E. Enable Data Quality and Lineage Capabilities Provide automated or on-demand profiling, monitoring, and visualization of data quality and lineage, enabling users to validate data integrity, trace data transformations, and build trust in data used for operational and analytical purposes.

F. Support Integration and Interoperability Across the Enterprise Seamlessly integrate with OHA’s existing systems—including Snowflake, Power BI, and Azure—through APIs, connectors, and import/export mechanisms, supporting both cloud and hybrid environments with minimal manual intervention.

G. Maintain Security and Regulatory Compliance Meet or exceed all applicable State and federal data privacy and security requirements, including PHI/PII classification, audit logging, and adherence to Oregon’s Statewide Security Standards, while supporting secure user access and data handling practices.

H. Provide Flexibility for Future Scalability and Innovation Support OHA’s evolving data strategy by enabling future enhancements such as AI-driven metadata enrichment, data mastering capabilities, and modular expansion without requiring extensive re-architecture or replacement.

5.0 Scope

This procurement seeks a cloud-hosed Data Management Platform solution licensing and enablement, outlined as follows:

5.1 In Scope (To be purchased)

5.1.1 Software License

• Data Management Platform’s Data Cataloging Tool software license (SaaS) including any required base modules to meet minimum requirements.

• Environments: Production/Non-Production, as applicable.

• Licensing metrics: Named users, concurrent users, capacity, ingestion volume, consumption, etc. (Respondent to specify clearly).

5.1.2 Vendor Support (Product Support)

• Standard support packages (ticketing, escalation, release notes, patching policy, etc.)

• Support hours and Service Level Agreements (provide response targets by severity).

• Product documentation access.

5.1.3 Vendor Training & Implementation Enablement (Limited)

Training and enablement services shall prepare OHA/OIS/ODHS staff and the separately procured implementation partner to configure/use the product, including:

• Administrative training (RBAC, ingestion/scanners, glossary, workflows, configuration concepts)

• Steward training (metadata curation, approvals, stewardship workflows)

• End-user training (search/discover, request/access workflows)

• Technical enablement for the implementation partner and OHA/OIS technical team (APIs, connectors, SSO patterns, best practices)

• Training artifacts, as deemed of critical import to the implementation by the implementation partner

5.2 Out of Scope (Not to be purchased)

The following will be performed by a separate implementation partner and must not be assumed in pricing unless OHA explicitly request optional add-ons:

• Program and/or project management for implementation

• Detailed requirement gathering or governance operating model design

• Configuration execution, customization, or workflow buildout (beyond describing “how” or enablement activities as described in 4.1)

• Connector build/ETL, metadata ingestion execution, data profiling, lineage buildout

• Change management, communications, or partner engagement

• Knowledge transfer deliverables beyond those described in 5.1.3

Respondents may propose optional professional services, but they must be clearly separated and not required for award.

5.3 Collaboration with OHA’s Implementation Partner (Required) Vendor response must state understanding of and willingness to:

• Participate in technical Q&A sessions with the implementation partner.

• Provide reasonable product guidance aligned to standard support and the enablement package quoted.

• Identify any vendor-only tasks that MUST be performed by the vendor (if any), including rationale.

6.0 Minimum Solution Requirements (High-Level)

To be considered responsive, respondent must clearly describe their product functionalities, features, and supports, in the areas as follows. The full solution requirements matrix can be found in Attachment G.

6.1 Core Catalog & Governance Capabilities

The solution must provide enterprise capabilities that enable OHA to collect, manage, and operationalize metadata across designated data sources to support data discovery, stewardship, governance, lineage transparency, and data quality monitoring.

At a high-level, the solution must perform the following:

6.1.1 Metadata Management & Discovery

• Aggregate and maintain metadata from multiple systems, supporting both automated collection and user-driven enrichment.

• Support business-friendly metadata curations (including glossary/terms and configurable attributes) with auditability of changes.

• Provide role-based search and discovery (including semantic/natural language search) and organizational features such as tagging and categorization.

• Enable identification and promotions of authoritative/canonical data assets.

6.1.2 Lineage & Provenance

• Provide clear lineage from source through transformation to consumption, presented in visual and user-appropriate views.

• Support lineage representation across structured and unstructured data where applicable.

6.1.3 Governance & Stewardship Enablement

• Enforce role-based access aligned to governance policies and support configurable stewardship workflows (e.g., approvals and notifications).

• Support creation and management of key governance artifacts such as definitions, policies, and glossary content, and integrate with existing governance tools where feasible.

6.1.4 Data Quality Monitoring Support

• Support definition and management of data quality rules/expectations and provide monitoring visibility (e.g. dashboards/reports).

• Support notification and tracking of data quality issues through resolution process.

6.2 Security & Privacy

All proposed solutions must meet stringent security and privacy standards. Vendors may be designated as HIPAA Business Associates depending on the nature of services provided under this contract. As such, vendors must ensure their proposed Data Catalog Solution meets or exceeds the following security and privacy requirements:

• Ability to meet all Federal and Oregon’s Statewide Security Standards, including HIPAA, Level 3 Data Security Compliance, Oregon Enterprise Information Services (EIS) cybersecurity policies, and Oregon Administrative Rule (OAR) 125-800-0020

• Role-Based Access Control (RBAC) and Multi-Factor Authentication/SSO options (e.g., SAML/LDAP, OAuth, Active Directory)

• Encryption of PHI/PII in transit and at rest using industry-standard protocols (e.g., AES-256, TLS 1.2+)

• Audit logging (supporting compliance monitoring, incident response, and forensic analysis)

• Data ownership/portability: ability to export metadata in useable formats upon request/termination

• Platform should comply with Data Related CIS Controls.

6.3 Accessibility

Solution user interfaces and end-user workflows must meet the follow accessibility requirements:

• Must comply with the ADA and meet or exceed section 508 of the Rehabilitation Act and WCAG 2.1 Level AA accessibility standards.

• Must be consistent with Oregon’s statewide accessibility obligations and timelines (including contractor responsibility for covered services.)

Provide a Voluntary Product Accessibility Template (VPAT) (or equivalent) and a remediation plan must be provided if gaps exist

7.0 Quote and Submittal Requirements

Failure to submit information as indicated below may result in your submission being deemed non-responsive and disqualified for evaluation.

7.1 General Requirements

Quotes must be received on or before the posted RFQ Due Date and Time at the location identified above to be considered. Authorized Purchaser, in its sole discretion, may extend the Due Date and Time. Quotes will be accepted by e-mail, regular mail or hand delivery to the SPC. Submission may be submitted as a single document or a group of documents. All should be clearly labeled according to the instructions on 7.2.1. Acceptable submission file formats the response packet are Word Documents and PDFs. Note that Attachment G – Requirements Matrix may be returned as an Excel file or PDF.

Quotes will not be accepted after 3:00pm Friday September 18th, 2026.

7.2 Quote Packet Contents/Requirements

7.2.1 Disclosure Exemption Affidavit (Attachment A)

Complete per instructions in Attachment A

7.2.2 Mandatory Requirements Checklist (Attachment B)

The mandatory checklist has been provided to ensure a shared understanding of what constitutes a satisfactory quote. Quotes that do not include a completed checklist or is deemed to be an incomplete submission may not be evaluated further. Response section should be submitted in the order as indicated within Attachment B.

7.2.3 Respondent Information and Certification (Attachment C) Complete per instructions in Attachment C.

7.2.4 RFQ – Primary Solution Response (not to exceed 30 pages) Must include the following:

1. Executive Summary (1-2 Pages)

2. Overview of solution’s functionalities and description of how they satisfy requirements in 6.1.

3. Overview of solution’s accessibility features and description of how they satisfy requirements in 6.3, including VPAT.

4. Proposed Licensing Model & Assumptions (users, environments, modules) that describes approach for each item in 5.1.1.

5. Description of Support Package (services included, SLAs) addressing each point in 5.1.2.

6. Training & Enablement Plan (sessions, audiences, artifacts) that addresses approach to satisfying each point in 5.1.3.

7. Privacy & Security Description asserting that proposed solution satisfies security requirements in 6.2.

8. Two examples of successful implementations of the solution with organizations comparable to OHA, including:

a. Where the solution was implemented.

b. How the solution was used.

c. What successes the solution has facilitated.

9. Exceptions to OHA terms.

7.2.5 System Architecture Overview

Respondents must describe the type of system being proposed. The response should address the following:

1. Deployment Model Indicate whether the proposed solution is:

a. Software as a Service (SaaS)

b. Platform as a Service (PaaS)

c. Infrastructure as a Service (IaaS)

d. On-Premises

e. Hybrid (please describe)

2. Hosting Environment

a. Identify the hosting provider, if any (e.g., AWS, Azure, Google Cloud, private data center).

b. Specify the geographic location(s) of data storage and processing.

c. Describe any options for Oregon to select or restrict data residency.

3. Architecture

a. Describe the system architecture (e.g., microservices, monolithic, serverless).

b. Indicate whether the system is multi-tenant or single-tenant.

c. Include a high-level diagram if available.

4. Access and Integration

a. Describe how users access the system (e.g., web portal, API, mobile app).

b. Identify supported integration methods (e.g., REST APIs, cXML, SFTP, webhooks).

c. Indicate support for Single Sign-On (SSO) and identity federation (e.g., SAML, OAuth2).

5. Scalability and Performance

a. Describe how the system scales to accommodate increased data volume or user load.

b. Provide any relevant performance benchmarks or SLAs.

6. System Dependencies

a. List any third-party software, plugins, or components required for full functionality.

b. Indicate whether any client-side installations are required.

7.2.6 Security Documentation

Provide the following:

1. Security architecture Description

2. Details on access management protocols

3. Any relevant third-party certifications, such as:

a. SOC 2 Type II

b. HITRUST

c. ISO/IEC 27001

4. Attestation of ability to meet or exceed Oregon Security & Hosting Requirements (see Attachment D).

7.2.7 Requirements Matrix (Attachment G – Excel File)

Complete the Solution Requirements Response Section found in Attachment G. For any requirements that respondent marks “Partially Meets” or “Does Not Meet” complete the Respondent Notes section.

7.2.8 Cost Quote/Pricing Response (Attachment E)

Responses must provide a cost proposal spanning the 5-year contract.

Cost Quote must include:

1. License model description (consumption based, seat based, etc.)

2. License cost over a 5 Year term

3. Number of seats included in license

4. Costs for additional seats (if needed)

5. Support Package (if separate, fixed price preferred)

6. Training/Enablement Package (fixed price preferred)

7. Optional add-ons features and modules (separately priced; not required)

No travel expenses should be assumed as part of the quote. Remote will always be preferred by default.

7.2.9 Vendor References (see Attachment F)

Complete per instructions in Attachment F.

7.2.10 Draft Statement of Work

Responses must include a draft Statement of Work that meets the scope as articulated in Section 5 of this RFQ.

7.3 Questions and Request Clarifications

All questions and requests for clarification regarding this RFQ must be submitted in writing by e-mail, regular mail or hand delivery to the SPC and must be received no later than Thursday September 10th, 2026 at 5:00 PM.

Authorized Purchaser may issue revisions, substitutions or clarifications of the RFQ.

Authorized Purchaser will send revisions, substitutions or clarifications, if any, electronically to the above-mentioned MSA Holders

8.0 Evaluation Criteria

8.1 Responsiveness Determination and Right of Rejection

A Quote received before the Due Date and Time will be reviewed to determine if it is responsive to all RFQ submission requirements in 7.2. A non-responsive Quote may be rejected and not move forward to further evaluations described in this section. Material in Quotes not clearly labeled or not included in the appropriate section may not be evaluated. Authorized Purchaser, in its sole discretion, may reject all Quotes or cancel this RFQ at any time.

8.2 Evaluation Criteria

The Oregon Health Authority (OHA) will determine the “Best Value” based on the solution that most effectively meets the agency’s needs, considering both cost and qualitative factors.

Quotes that meet the minimum requirements from 8.1 will be evaluated by members of an Evaluation Committee. Evaluators will assign a score for each evaluation criterion listed below up to the maximum points specified.

Scoring Matrix

Evaluation Criteria RFQ Section Maximum Points General Requirements

Licensing Model, Product Support, Training & Enablement

5.1.1-3 150

System Capabilities Core Data Management Capabilities

6.1.1-4, 7.2.4, 7.2.7 300

Security, Privacy & System Architecture

6.2, 7.2.5, 7.2.6 150

Accessibility 6.3 100 Vendor Evaluation

Vendor Experience & References 7.2.2.8, 7.2.9 100 Cost Quote/Pricing Summary 7.2.8 150 Statement of Work 7.2.10 50

Total Points Possible 1000

Attachment List

Attachment A – Disclosure Exemption Affidavit

Attachment B – Mandatory Checklist

Attachment C – Respondent Information & Certification

Attachment D – Oregon Security & Hosting Requirements

Attachment E – Cost Quote/Pricing Response

Attachment F – Vendor References

Attachment G – Full Requirements Matrix

7.3 Questions and Request Clarifications