Scope of Work Exhibit A.pdf

OPWDD: Putting People First

RFP OPD-2025-61 7 of 41 Electronic Dental Record Solution shall immediately notify OPWDD of such error(s) in writing to the designated contact(s) identified in Section

1.4.2 of this RFP. If, prior to the proposal due date/time as specified in Section 1.3 of this RFP, a Bidder fails to notify OPWDD of a known error or an error that reasonably should have been known, the Bidder shall assume the risk of proposing. If awarded the contract, the Bidder shall not be entitled to additional compensation by reason of the error or its correction. Prior to the proposal due date, any clarifications or modifications deemed necessary by OPWDD will be posted to the OPWDD website and the NYSCR website provided in Section 1.2 of this RFP.

1.4.3.4. Any change to language, terms, or requirements within the RFP, including all associated attachments, appendices, and exhibits, that is proposed by a Bidder after the question-and-answer period has ended will not be considered by OPWDD, as any such change would not have been offered to all potential Bidders.

1.5. Announcements and Amendments to the RFP

OPWDD will utilize its procurement opportunities webpage and the NYSCR for the purpose of disseminating information relating to this procurement. OPWDD will post its official answers to Bidder questions and any changes to the RFP resulting from such questions on these sites on or before the Issuance of Response to Questions date as indicated in the Calendar of Events. Bidders are encouraged to monitor these sites: https://opwdd.ny.gov/procurement-opportunities and https://www.nyscr.ny.gov/.

OPWDD’s responses to questions and notification of amendments to the RFP, if any, will be in the form of a formal addendum that will be annexed to and become part of this RFP and any ensuing contract.

1.6. Term of Contract

OPWDD intends to award one contract for the Electronic Dental Record Solution to one responsive and responsible Bidder as a result of this RFP. The term of the Contract is anticipated to be 5 years with an anticipated start date of September 1, 2026 and the possibility of renewal for an additional two 5 year extensions. In accordance with SFL § 41, the State shall have no liability under this contract to the Bidder or to anyone else beyond funds appropriated and available for this contract. Continued contract approval beyond August 31, 2031, including any extensions will be at the sole discretion of OPWDD and the OSC, until such time as a replacement contract can be put in place. If this contract is extended, all original terms and conditions will remain the same.

1.7. Conflicts of Interest

Bidders must disclose actual and potential conflicts of interest in the Administrative Proposal (see Section 4.10 below for additional information).

If an organization or person is presently performing consulting services for OPWDD, or has provided consulting services for OPWDD, it may still submit a proposal in response to this RFP but must also satisfy these conflict-of-interest provisions.

After the RFP is awarded, if the awarded Bidder utilizes individuals or entities that violate these conflict-of-interest provisions, the Bidder is subject to termination and reimbursement of contract funding to OPWDD.

1.8. Bidder Minimum Qualifications

Any Bidder submitting a proposal in response to this RFP must meet the minimum qualifications listed below.

Information demonstrating these qualifications must be incorporated into the Bidder’s Administrative Proposal response.

1.8.1. A minimum of three years of professional experience in all of the following:

• Designing, developing, and implementing solutions specifically for dental practice record keeping via a Cloud Based Solution.

Exhibit A https://opwdd.ny.gov/procurement-opportunities https://www.nyscr.ny.gov/

RFP OPD-2025-61 8 of 41 Electronic Dental Record Solution

• Maintaining records with the same volume/size as OPWDD.

• 5 current installations with a service base of 20,000 individuals each, utilizing the offered solution.

• Storing data within the contiguous United States.

• Scheduled demonstrations of the solution offered.

1.9. Glossary and Definitions

Authentication The process of establishing confidence in the identity of users or information systems.

Best Value The basis for awarding all service and technology Contracts to the Bidder that optimizes quality, cost and efficiency, among responsive and responsible Bidders.

(State Finance Law §163 (1) (j)).

Bid Response to the RFP submitted by a Bidder to provide products or services to this scope of work.

Bidder Any individual, business, contractor, vendor or other legal entity, or any employee, agent, consultant, or person acting on behalf thereof, that submits a bid in response to this RFP.

Business Day Monday through Friday from 8:00 AM – 5:00 PM ET, excluding New York State or Federal holidays

Cloud Solution Cloud Solution shall mean any Product or Service sold “as a service” offering with one or more of the following characteristics:

(a) Authorized User Data is transmitted, acted upon, or stored on equipment not owned by an Authorized User;

(b) Allows a Contractor access to Authorized User Data from a location other than the Authorized User’s premises;

(c) Allows an Authorized User access to data not owned by the Authorized User which access may or may not result in the collection of Authorized User Data.

Compliance Conformity in fulfilling requirements.

Configuration An arrangement of elements in a particular form, figure, or combination which includes minor physical or software setting changes that can be implemented without custom physical modifications or changes to the base code. Configuration may include Installation.

Conflict of Interest A “real or seeming incompatibility between one’s private interests and one’s public or fiduciary duties.” When the same entity is both assisting a person to gain access to services and providing services to that person, the role of the entity staff has potential to be conflicted. This is a higher threshold than the requirements of conflict-free; and to avoid a conflict of interest, the same entity would not be allowed to serve in both capacities.

Continental United States (CONUS) The 48 contiguous States, and the District of Columbia.

Contract Term The initial term of the Contract and any renewals and/or extensions.

Commercial Off–The Shelf (COTS) A term for Products available in the commercial marketplace that can be purchased and used under government Contract. Does not include Custom Software.

Exhibit A

RFP OPD-2025-61 9 of 41 Electronic Dental Record Solution

Cx360 by Core Solutions Current OPWDD EHR.

Custom Software Software that does not meet the definition of COTS Software.

Customization The modification of packaged Product to meet the individual requirements of an Authorized User.

Customized Training

Training that is designed to meet the special requirements of an Authorized User.

Data Any information, Analytic Derivatives, formula, algorithms, or other content that the Authorized User may provide to the Contractor pursuant to this Contract. Data includes, but is not limited to, any of the foregoing that the Authorized User and/or Contractor (i) uploads to the Cloud Service, and/or

(ii) creates and/or modifies using the Cloud Solution. See Appendix A-1.

Data Breach Refers to unauthorized access to Data or equipment which is used to transmit, store, or act upon such Data by any person, including employees, officers, partners or subcontractors of Contractor, who have not been authorized to access such Data.

Data Center All facilities in which Authorized User Data is processed or stored.

Data Categorization The process of risk assessment of Data. See also “High Risk Data”, “Moderate Risk Data” and “Low Risk Data”.

Data Conversion The conversion of computer data from one format to another

Data Mining The computational process of discovering patterns in large data sets involving methods at the intersection of artificial intelligence, machine learning, statistics, and database systems. The overall goal of the Data Mining process is to extract information from a data set and transform it into an understandable structure for further use. Aside from the raw analysis step, it involves database and data management aspects, data pre-processing, model and inference considerations, interestingness metrics, complexity considerations, post-processing of discovered structures, visualization, and online updating.

RFP OPD-2025-61 10 of 41 Electronic Dental Record Solution

Deliverable Products, Software, Information Technology, telecommunications technology, Hardware, and other items (e.g. reports) to be delivered pursuant to this Contract, including any such items furnished within the provision of services.

Electronic Dental Record Solution

(EDRS)

A digital version of a patient’s dental health information, which includes all treatment records, medical history, diagnoses and progress notes. EDRs facilitate efficient documentation, improve clinical efficiency and enhance patient safety by allowing for better recordkeeping and data sharing across dental practices. They support various functions such as patient registration, imaging, and patient education, ultimately contributing to a comprehensive patient health portfolio. Functions to document patient sedation and monitoring are included as well.

Electronic Health Record (EHR)

An Electronic Health Record (EHR) is an electronic version of a patient’s medical and care coordination, which is maintained by the provider over time, and may include all of the key administrative clinical data relevant to that persons care under a particular provider, including demographics, progress notes, problems, medications, vital signs, past medical history/ICD Diagnoses, immunizations, laboratory data and radiology reports. The EHR automates access to information and has the potential to streamline the clinician's workflow. The EHR also has the ability to support other care-related activities directly or indirectly through various interfaces, including evidence-based decision support, quality management, and outcomes reporting.

Encryption A technique used to protect the confidentiality of information. The process transforms ("encrypts") readable information into unintelligible text through an algorithm and associated cryptographic key(s).

End-of-Life When a product is no longer being manufactured and/or is no longer being marketed or sold.

Equal Employment Opportunity (EEO) Policies and procedures of the jurisdiction to ensure non-discrimination against employees or applicants for employment because of race, creed, color, national origin, sex, age, disability or marital status.

Equipment An all-inclusive term which refers either to individual Machines or to a complete Data Processing System or Subsystem, including its Hardware and Operating Software (if any). See also “Device, “Appliance,” and “Hardware,” “Machine.”

High Risk Data Is as defined in FIPS PUB 199, Standards for Security Categorization of Federal Information and Information Systems (“High Impact Data”).

HL7 DEFINITION IREDHL7 (Health Level 7) is a set of international standards for exchanging, integrating, sharing and retrieving electronic health information.

Implementation The post sales process of guiding a client from purchase to use of the Product that was purchased. This may include but is not limited to post sales requirements analysis, scope analysis, limited customizations, systems integrations, data conversion/migration, business process analysis/improvement, user policy, customized user training, knowledge transfer, project management and system documentation. User may start the Implementation process at any time in the lifecycle of a project.

Information Technology (IT) Includes, but is not limited to, all electronic technology systems and services, automated information handling, System design and analysis, conversion of data, computer programming, information storage and retrieval, telecommunications which include voice, video, and data communications, requisite System controls, simulation, electronic commerce, and all related interactions between people and Machines.

Exhibit A https://www.bing.com/ck/a?!&&p=71d0fa27161e61762acce9602b4365ce26bb8feb9b14dced6e0cc3ab3c42e729JmltdHM9MTc0ODMwNDAwMA&ptn=3&ver=2&hsh=4&fclid=0471858d-b072-66b1-1ef9-9074b1cd6780&u=a1aHR0cHM6Ly9wb2NrZXRkZW50aXN0cnkuY29tLzg4LWVsZWN0cm9uaWMtZGVudGFsLXJlY29yZHMtYW5kLWRlY2lzaW9uLXN1cHBvcnQtc3lzdGVtcy8&ntb=1 https://www.bing.com/ck/a?!&&p=71d0fa27161e61762acce9602b4365ce26bb8feb9b14dced6e0cc3ab3c42e729JmltdHM9MTc0ODMwNDAwMA&ptn=3&ver=2&hsh=4&fclid=0471858d-b072-66b1-1ef9-9074b1cd6780&u=a1aHR0cHM6Ly9wb2NrZXRkZW50aXN0cnkuY29tLzg4LWVsZWN0cm9uaWMtZGVudGFsLXJlY29yZHMtYW5kLWRlY2lzaW9uLXN1cHBvcnQtc3lzdGVtcy8&ntb=1 https://www.bing.com/ck/a?!&&p=71d0fa27161e61762acce9602b4365ce26bb8feb9b14dced6e0cc3ab3c42e729JmltdHM9MTc0ODMwNDAwMA&ptn=3&ver=2&hsh=4&fclid=0471858d-b072-66b1-1ef9-9074b1cd6780&u=a1aHR0cHM6Ly9wb2NrZXRkZW50aXN0cnkuY29tLzg4LWVsZWN0cm9uaWMtZGVudGFsLXJlY29yZHMtYW5kLWRlY2lzaW9uLXN1cHBvcnQtc3lzdGVtcy8&ntb=1 https://www.bing.com/ck/a?!&&p=71d0fa27161e61762acce9602b4365ce26bb8feb9b14dced6e0cc3ab3c42e729JmltdHM9MTc0ODMwNDAwMA&ptn=3&ver=2&hsh=4&fclid=0471858d-b072-66b1-1ef9-9074b1cd6780&u=a1aHR0cHM6Ly9wb2NrZXRkZW50aXN0cnkuY29tLzg4LWVsZWN0cm9uaWMtZGVudGFsLXJlY29yZHMtYW5kLWRlY2lzaW9uLXN1cHBvcnQtc3lzdGVtcy8&ntb=1 https://www.bing.com/ck/a?!&&p=71d0fa27161e61762acce9602b4365ce26bb8feb9b14dced6e0cc3ab3c42e729JmltdHM9MTc0ODMwNDAwMA&ptn=3&ver=2&hsh=4&fclid=0471858d-b072-66b1-1ef9-9074b1cd6780&u=a1aHR0cHM6Ly9wb2NrZXRkZW50aXN0cnkuY29tLzg4LWVsZWN0cm9uaWMtZGVudGFsLXJlY29yZHMtYW5kLWRlY2lzaW9uLXN1cHBvcnQtc3lzdGVtcy8&ntb=1 https://www.bing.com/ck/a?!&&p=71d0fa27161e61762acce9602b4365ce26bb8feb9b14dced6e0cc3ab3c42e729JmltdHM9MTc0ODMwNDAwMA&ptn=3&ver=2&hsh=4&fclid=0471858d-b072-66b1-1ef9-9074b1cd6780&u=a1aHR0cHM6Ly9wb2NrZXRkZW50aXN0cnkuY29tLzg4LWVsZWN0cm9uaWMtZGVudGFsLXJlY29yZHMtYW5kLWRlY2lzaW9uLXN1cHBvcnQtc3lzdGVtcy8&ntb=1 https://www.bing.com/ck/a?!&&p=71d0fa27161e61762acce9602b4365ce26bb8feb9b14dced6e0cc3ab3c42e729JmltdHM9MTc0ODMwNDAwMA&ptn=3&ver=2&hsh=4&fclid=0471858d-b072-66b1-1ef9-9074b1cd6780&u=a1aHR0cHM6Ly9wb2NrZXRkZW50aXN0cnkuY29tLzg4LWVsZWN0cm9uaWMtZGVudGFsLXJlY29yZHMtYW5kLWRlY2lzaW9uLXN1cHBvcnQtc3lzdGVtcy8&ntb=1

RFP OPD-2025-61 11 of 41 Electronic Dental Record Solution

Information Technology Services (ITS) New York State Office of Information Technology Services (http://www.its.ny.gov/).

Installation The act or process of making products ready to be used. Installation does not include Configuration.

Intellectual Property (IP) Includes inventions, patents, Copyrights, trade secrets, trademarks, technical Data, industrial designs that are generally protected and proprietary.

Interoperability The capability to communicate, to execute programs, or to transfer Data among various functional units under specified conditions.

Low Risk Data Is as defined in FIPS PUB 199, Standards for Security Categorization of Federal Information and Information Systems (“Low Impact Data”).

Maintenance The upkeep of Product that keeps the Product operating in accordance with the Manufacturer’s specification.

Mandatory Refers to items or information that the State has deemed that a bidder/contractor must submit as compulsory, required and obligatory.

These items or information are noted as such, or the requirements may be phrased in terms of “must” or “shall”. Mandatory requirements must be met by the bidder/contractor for the bidder/contractor’s Submission to be considered responsive.

Manufacturer – Cloud Solution A Cloud Solution Manufacturer is an organization or Business Entity that: 1.

Sells its own Proprietary Cloud Solution; or 2. Assembles a package of Products or Services into its own Proprietary Product to create a Cloud Solution. This Product may include the services of one or more organizations or Business Entities that directly produce and/or provide components of the package. The Cloud Solution, must be branded, supported, and maintained by the entity for the life of the transaction.

Minority and/or Woman-Owned Business (MWBE)

A business certified with Empire State Development (ESD) as a Minority and/or Woman-Owned Business.

Moderate Risk Data Is as defined in FIPS PUB 199, Standards for Security Categorization of Federal Information and Information Systems (“Moderate Impact Data”).

National Institute of Standards and Technology (NIST)

The federal technology agency that works with industry to develop and apply technology, measurements, and standards. http://www.nist.gov

New York State Small Business Enterprise (NYS SBE) or Small Business

A company that is a resident to New York State, independently owned and operated, with 100 or fewer employees, and not dominant in its field. See State Finance Law §160(8).

OPWDD The New York State Office for People With Developmental Disabilities

Preventive Maintenance Maintenance performed on a scheduled basis by the contractor, which is designed to keep the equipment in proper operating condition.

RFP OPD-2025-61 12 of 41 Electronic Dental Record Solution

Project Manager (PM) A professional in the field of project management. A PM can have the responsibility of the planning, execution and closing of any project, typically relating to construction industry, architecture, aerospace and defense, computer networking, telecommunications or Software development.

Security Incident A violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices. See NIST 800-61 or its successor for additional information.

Service-Disabled Veteran-Owned Business

Please refer to New York Executive Law Article 17-B for the definition of Service-Disabled Veteran-Owned Business.

Staffing and Organization Plan Detailed description of the total number of staff proposed for the project, and how the staff is organized, including an organizational chart of key roles and staffing titles, with the proposed number of supporting staff and units identified. The staffing and organization plan should also identify staff that support the project but are not FTE dedicated and include their role and percentage of time dedicated to the project. The plan should also outline where the staff are located and how communication is handled between remote sites, the main project site, and OPWDD.

Small Business Please refer to State Finance Law section 160(8) for the definition of “small business concern” or “small business.”

Software An all-inclusive term which refers to any computer programs, routines, or subroutines supplied by the Contractor, including operating Software, programming aids, application programs, and program Products

Storage Specific to technology, a computer memory that retains data for some period of time. Storage can be categorized in many ways such as: primary, secondary, read-only, random access and/or magnetic storage.

System The complete collection of Hardware, Software and Services as described in the resulting Authorized User Agreements, integrated and functioning together, and performing in accordance with the Authorized User Agreement.

Third Party Products Third Party Intellectual Property or Third Party Products means any intellectual property owned by parties other than Authorized User or Contractor and provided to Authorized Users for use in connection with the Services.

Web-Based Solution Online record keeping, cloud model.

2. SCOPE OF WORK

2.1. Current State

OPWDD does not currently have a statewide solution. Each dental clinic is documenting differently, and imaging is maintained differently. Having a new system would streamline the process and would provide consistency across the state in how records are maintained and documented, and how imaging is stored.

RFP OPD-2025-61 13 of 41 Electronic Dental Record Solution

2.2. Future State

OPWDD’s goal for the future is a streamlined, up to date record keeping and scheduling solution to assist providers in performing dental services to people with DD and reduce the wait time for some people to receive these services. The solution will provide uniformity across the state and update outdated, disparate solutions currently in use, in a single online solution. The system must connect to OPWDD's Electronic Health Record (EHR). The solution will enhance workflow and efficient communication within dental clinics across New York State, increasing productivity and enhancing overall practice results. The Electronic Dental Record will provide functions for scheduling appointments, documentation, and patient record keeping that includes tracking insurance claims, charting dental history, e-prescribing, and imaging. OPWDD plans to expand dental services throughout the state, so that all regions are supported.

2.3. Workplan and Required Components

2.3.1. Overall Program Requirements

2.3.1.1. Electronic Dental Record (EDR) Cloud Solution

2.3.1.1.1. Upon award, the bidder/contractor must be able to perform the following tasks and comply with

Appendix A-1 Section 16 of the contract:

• The bidder/contractor must maintain the necessary data to measure its performance and report monthly. This data must be kept in appropriate files.

• Eligible bidder/contractors must have current and ongoing data and workforce management infrastructure to successfully meet the deliverables listed in this RFP. The bidder/contractor will use the proposed solution to process report data to NYS as outlined herein.

• If OPWDD notifies the Contractor that consequences will be assessed because of nonconformance with Appendix A-1 Section 16 of the contract boilerplate attached to this RFP, service level agreement (SLA) standards and consequences. If the files are not maintained or are damaged in such a way that the contractor cannot substantiate its performance against an SLA standard, it will be construed and admitted to by implication that the contractor did not meet the SLA standard in question.

2.3.1.1.2. The solution proposed must have the ability to connect to OPWDD's Electronic Health Record (EHR), which will allow OPWDD to manage one platform for everything. This will allow OPWDD to enhance workflow and efficient communication within our dental clinics, while increasing the productivity of the staff and enhancing overall practice results. This will include the ability to move data and information for integration, retainment of data and information, and successfully work with equipment in existence, as per Sections 2.3.1.2., Sections 2.3.1.4. through 2.3.1.8, and Sections 2.3.1.10. through 2.3.1.14.

2.3.1.1.3. Preference will be given to contractors who have experience working with people with DD.

2.3.1.2. IT Infrastructure for Cloud Solution

The vendor will obtain, use, and/or manage technology to support program implementation and ongoing operations.

The Cloud’s IT Infrastructure must have the following capabilities:

2.3.1.2.1. Ability to securely separate person-level data, eligibility, and workflows for OPWDD-directed work;

2.3.1.2.2. Document imaging to accommodate the scope of work (See section 2.3.1.5.);

RFP OPD-2025-61 14 of 41 Electronic Dental Record Solution

2.3.1.2.3. Knowledge Management System (KMS) – A searchable database that supports customer service infrastructure and gives staff quick access to call scripts, policies, template documents, and other key resources;

2.3.1.2.4. A provider facing website with the following characteristics:

2.3.1.2.4.1. It includes Information about the bidder/contractor, and available services and options.

2.3.1.2.4.2. It included a secure sign on portal for use by OPWDD Dental Staff.

Locations where OPWDD Dental Staff will access the system from include but are not limited to (due to work from home and off site usage by OPWDD Dental Staff):

Region 2 620 Westfall Road, Rochester, NY Region 2 5259 Parkside Drive, Canandaigua, NY Region 1 703 E. Maple Avenue, Newark, NY Region 1 295 Jemison Drive, Geneseo, NY Region 2 249 Glenwood Road, Binghamton, NY Region 3 200 Smith Drive, Corinth, NY Region 3 500 Balltown Road, Schenectady, NY Region 4 26 Center Circle, Wassaic, NY Region 6 9 Wilbur Road, Thiells, NY Region 6 80-45 Winchester Blvd., Bldg 80, Queens Village, NY

2.3.1.2.4.3. Capability to support secure file transfer system (SFT), to and from OPWDD as indicated by the agency, such as:

• support ability to send/receive secure information between themselves, OPWDD and its Providers. FedRAMP preferred. See section 2.5.5.

• access to the Cx360 by Core Solutions or future her provider, to facilitate information sharing with Providers and OPWDD. The bidder/contractor may be requested to also have access and data exchange with other agency-specific technology resources as needed.

• have HL7 (standard for data exchange) system interoperability. If not HL7, the solution will be assessed by ITS for acceptability.

• Data storage within the contiguous United States

2.3.1.3. Demonstration of the Cloud Solution

2.3.1.3.1. Bidders will provide a comprehensive demonstration of the Cloud Solution they are offering.

2.3.1.3.2. Coordinate with OPWDD to demonstrate the solution to staff for evaluation. OPWDD, within four weeks of the RFP due date, may contact entities that submit a response with a request to provide a demonstration of their recommended solution. This demonstration must be on a production system with full functionality using the test data.

2.3.1.4. Information Management System (IMS)

2.3.1.4.1. The IMS must capture and track all requirements of this RFP on a person-level basis, including but not limited to:

• receive, document, and track referrals;

• schedule appointments;

• conduct and track outreach activities;

RFP OPD-2025-61 15 of 41 Electronic Dental Record Solution

• conduct, manage, and report on quality assurance processes; and other activities outlined in this document.

• retention of Records for the purposes of tasks outlined in Section 2.3.1.5. and Appendix A.

2.3.1.5. Record Keeping

2.3.1.5.1. The contractor will be able to establish and maintain complete and accurate books, records, documents, accounts and other evidence directly pertinent to performance under the contract resulting from this RFP (hereinafter, collectively, the “Records”). The Records must currently be kept for forever after death or, if discharged, retain 110 years after DOB as per current OPWDD Clinical Record Policy (RDA 23108), or the current RDA minimum.

2.3.1.5.2. The State Comptroller, the Attorney General and any other person or entity authorized to conduct an examination, as well as the agency or agencies involved in a potential contract, shall have access to the Records during normal business hours at an office of the contractor within the State of New York or, if no such office is available, at a mutually agreeable and reasonable venue within the State, for the term specified above for the purposes of inspection, auditing and copying.

2.3.1.5.3. The State shall take reasonable steps to protect from public disclosure any of the Records that are exempt from disclosure under Section 87 of the Public Officers Law (the “Statute”) provided that: (i) the contractors shall timely inform an appropriate State official, in writing, that said records should not be disclosed; and (ii) said records shall be sufficiently identified; and (iii) designation of said records as exempt under the Statute is reasonable. Nothing contained herein shall diminish, or in any way adversely affect, the State’s right to discovery in any pending or future litigation.

2.3.1.5.4. The IMS and all systems and components supporting it, including, but not limited to, any forms and databases that include Personal Health, Personal Identification (PHI) or other New York State information, must comply with all NYS security policies and standards listed at http://its.ny.gov/tables/technologypolicyindex.htm. All records pertaining to medical/dental services and PHI must be transferred to OPWDD’s EHR (Cx360) for retention (section 2.3.1.5 through 2.3.1.7.).

2.3.1.5.5. Comply with all privacy and security policies and procedures of NYS Information Technology Services which can be found at https://its.ny.gov/eiso/policies/security and applicable Federal law and administrative guidance with respect to the performance of the Contract. The bidder/contractor is required, if applicable, to execute a number of security and privacy agreements with OPWDD including a Business Associate Agreement (BAA) (Appendix G) and/or a Data Use Agreement (DUA) at contract signing.

2.3.1.5.5.1. Maintain and provide to OPWDD upon request their data confidentiality plans and procedures for meeting security requirements as they relate to the deliverables and services within this RFP, including all plans as they relate to subcontractor work where applicable.

2.3.1.5.5.2. Provide secure and confidential backup, storage and transmission for hard copy and electronically stored information. Under no circumstances will any records be released to any person, agency, or organization without specific written permission of OPWDD. The vendor is obligated to ensure any Subcontractor hired by the bidder/contractor who stores, processes, analyzes or transmits Medicaid Data (MCD) on behalf of the bidder/contractor has the appropriate security requirements in place. The bidder/contractor is required to include in all subcontracts and Business Associate Agreements with their Subcontractors language surrounding the security and privacy requirements as well as the language contained in the Confidentiality Language for Third Parties section of the DUA. If any breach or suspected breach of the data or confidentiality occurs, whether the breach occurred with the bidder/contractor or Subcontractor, OPWDD must be notified immediately.

Exhibit A http://its.ny.gov/tables/technologypolicyindex.htm https://its.ny.gov/eiso/policies/security

RFP OPD-2025-61 16 of 41 Electronic Dental Record Solution

2.3.1.5.6. Bidder/Contractor will develop and maintain adequate fully trained staff to respond to all stakeholder inquiries while protecting confidentiality and maintaining the security and integrity of all systems. Staff must be trained to understand and observe requirements related to confidentiality and operating guidelines for functions included in this RFP.

2.3.1.6. Cloud Solution Integration and Functionality

2.3.1.6.1. The Electronic Dental Record must streamline the daily business operations of our dental clinics and must include scheduling, documentation, and maintaining patient records. It shall also include tracking insurance claims, charting dental history, e-prescribing, and imaging. Thus, decreasing the wait time for many people to receive services, as well as improving quality and comprehensiveness of the services provided.

2.3.1.6.2. Cloud Based solution must handle the data entry, retrieval, back up to EHR (via bridge), billing, and other information exchange with the existing EHR for approximately 900 – 1500 individuals per month throughout the state. Usage of the solution expected is isas follows:

• Can accommodate at least 75 concurrent logins.

• Role based user interface: Administrative, Dentist, Hygienist. Authentication: NYS MFA – OPWDD users will sign in using their already established NYS IDs for up to 35 users.

• 4-hour call to fix repair SLA Maintenance. The system cannot be down more than 4 hours.

99.99% up time M-F.

• Tie in with Carestream imaging software and EHR (Cx360) via bridge for patient data. Solution must be compatible and able to communicate with Cx360. This should include service details/encounters needed for billing services, progress notes, and imaging. This solution will be required to integrate with future OPWDD EHR systems, also via bridge.

2.3.1.6.3. The Cloud solution must include billing and billing coding, but no billing interface is required at this time.

2.3.1.7. Data Management

2.3.1.7.1. The contractor will operate and maintain a data management system. The Cloud Solution and all systems and components supporting it, including, but not limited to, any forms and databases that include Personal Health, Personal Identifying Information (PII) or other New York State information, must comply with all NYS security policies and standards listed at https://its.ny.gov/cloud-computing http://its.ny.gov/tables/technologypolicyindex.htm. See Section 2.3.1.5.

2.3.1.7.2. Before developing or utilizing new Commercial Off the Shelf (COTS) application programs, systems programs, operating systems, websites and/or contractor-supplied web portals, that will affect the resulting contract of this RFP, prior approval must be granted by OPWDD. The bidder/contractor must provide access to OPWDD, and any designed entities based on a role and access policy approved by OPWDD. Permissions and privileges to enable access to authorized users, using role-based access control (RBAC) to provide varying levels of access based on user roles and responsibilities must be set upon request from OPWDD.

2.3.1.8. Workforce Management (WFM) System

The bidder/contractor must have the ability to securely separate person-level data, eligibility, and workflows for OPWDD-directed work;

2.3.1.8.1. The bidder/contractor will operate and maintain a workforce management system that schedules and forecasts appropriate staffing levels to handle incoming call volumes, as well as all OPWDD assessment referrals.

Exhibit A https://its.ny.gov/cloud-computing http://its.ny.gov/tables/technologypolicyindex.htm

RFP OPD-2025-61 17 of 41 Electronic Dental Record Solution

2.3.1.8.2. The bidder/contractor will track and monitor their on and off boarding staff, including background checks, and provisioning and deprovisioning to required systems for security purposes.

2.3.1.8.3. The bidder/contractor will track and monitor all staff training, certification, performance standards, complaints.

2.3.1.8.4. The bidder/contractor will confirm all changes (addition and removal) of users of the Solution within 24 hours of the updates to OPWDD.

2.3.1.8.5. Annually, the bidder/contractor names list must be reviewed and confirmed as accurate for quarterly reporting. OPWDD will send the bidder/contractor the current list of users and the bidder/contractor will review and respond with any discrepancies within 24 hours.

2.3.1.8.6. The bidder/contractor will provide routine reports regarding staffing volume and forecasted risks on, at a minimum, a monthly basis or when requested.

2.3.1.8.7. The bidder/contractor will track and monitor all workload requests, including call volume, assessments, and care management.

2.3.1.8.8. The bidder/contractor will track and report on call volume (approximately xx calls/month),

2.3.1.8.9. The bidder/contractor will maintain a record of requested assessments, and delineate the proportion that have been scheduled, are in process of being competed, and that have been completed.

Methods will be incorporated into the Cloud Solution to ensure there is no duplication of assignments.

Identified risks that may result in the failure to complete an assessment must be reported by the bidder/contractor.

2.3.1.8.10. The bidder/contractor will provide routine reports regarding staffing volume and forecasted risks on, at a minimum, a monthly basis or when requested.

2.3.1.8.11. The bidder/contractor will provide OPWDD reports, as outlined in Section 2.3.1.11. Quality Assurance/ Quality Management and Reporting, and at the following frequency:

2.3.1.8.12. Immediately when a critical issue arises (e.g., bidder/contractor cannot open files, loses connectivity to state systems, has a critical breach of security or system failure, etc.) follow the references in Section 2.5.7. Incident Reporting.

2.3.1.8.13. The bidder/contractor will provide routine monthly reporting as part of invoicing structure as referenced in Section 2.3.1.11.

2.3.1.8.14. The bidder/contractor will provide quarterly and annual reporting including staffing and assignment forecasts, as references in Section 2.3.1.11. Quarterly and Annual Reporting.

2.3.1.9. Staff Training

The bidder/contractor will work collaboratively with OPWDD to ensure that all dental staff (dentists, hygienists, dental assistants, admin staff as applicable) will be fully trained, either via on-site or remotely to ensure knowledge and competency with system usage.

2.3.1.9.1. There must be accessible and on-going training as needed for things such as system upgrades, new staff or refresher training.

2.3.1.9.2. Training will encompass different learning styles to users, including a mixture of on-line and in person options for 25-35 trainees per session. The bidder/contractor must provide both written and electronic resources that provide plain language instructions for use and troubleshooting of the solution.

Recordings of live/online training modules will be available for 24/7 access.

2.3.1.9.3. Classroom delivery at locations determined by OPWDD at rollout, subject to change.

RFP OPD-2025-61 18 of 41 Electronic Dental Record Solution

Region 2 620 Westfall Road, Rochester, NY Region 2 5259 Parkside Drive, Canandaigua, NY Region 1 703 E. Maple Avenue, Newark, NY Region 1 295 Jemison Drive, Geneseo, NY Region 2 249 Glenwood Road, Binghamton, NY Region 3 200 Smith Drive, Corinth, NY Region 3 500 Balltown Road, Schenectady, NY Region 4 26 Center Circle, Wassaic, NY Region 6 9 Wilbur Road, Thiells, NY Region 6 80-45 Winchester Blvd., Bldg 80, Queens Village, NY

2.3.1.9.4. All actions and activities performed by the bidder/contractor will be in accordance with all state and federal laws.

2.3.1.10. Telephone and Technical Support

The bidder/contractor must provide technical services, such as product support/maintenance and off-hours support (helpdesk). Contractor must have customer service available during normal working hours (7:00 am – 6:00 PM EST) of OPWDD dental clinics to assist users with any issues that may arise.

2.3.1.10.1. Dental care is primarily utilized during normal business hours but potentially may be provided for urgent services during off hours. Contractor will provide full telephone support during normal clinic hours of operation (7:00 am – 6:00 pm EST, Monday – Saturday). Additional support may be required outside of normal business hours. Contractor options must be noted for consideration.

2.3.1.10.2. Contractor will provide unlimited technical support via various channels, including email, telephone, remote support, on-line meeting (Webex, Teams, etc.) and other applications as necessary.

2.3.1.10.3. Contractor will provide solution updates, bug fixes and new features, and new versions of the Electronic Dental Record as they are released.

2.3.1.10.4. Contractor will provide minimal after-hours support for after-hour emergencies.

2.3.1.11. Contractor Reporting Requirements

Contractor is expected to report annually on the services performed. This may include, but is not limited to the total dollar amount invoiced for services performed during the preceding year; the number of contractor direct labor hours;

customer assistance calls, time spent on site for training, etc.

2.3.1.12. Equipment

2.3.1.12.1. OPWDD staff will use their existing equipment (PC / Laptop) to access the web-based application.

No additional software should be required. If additional software, plug-ins or non-standard browser requirements are needed, those requirements need to be listed by the bidder and accepted to

OPWDD.

2.3.1.12.2. The solution must work with Carestream Imaging as outlined in section 2.3.1.6.

2.3.1.13. Business Continuity Plans

RFP OPD-2025-61 19 of 41 Electronic Dental Record Solution

2.3.1.13.1. Thirty (30) calendar days from contract execution and annually thereafter, the contractor must submit to OPWDD for review and approval a draft Business Continuity Plan that is based upon the contractorr’s business continuity and disaster recovery methodology. At a minimum, the Business Continuity Plan must provide for back-up processing capability at remote site(s) from the contractor's primary site(s), such that normal payment processing, as well as other systems and services deemed necessary by the state, can continue in the event of a disaster or major hardware problem at the primary site(s). At a minimum, the Business Continuity Plan must be reviewed, updated, and submitted to OPWDD for review and/or approval on an annual basis. It seems that the Business Continuity Plans include two plans: The Disaster Recovery Pland and the Turnover/Transition Plan.

I would include a paragraph here explaining.

2.3.1.13.2. Thirty (30) calendar days from contract execution and annually thereafter, the contractor must submit to OPWDD for review and approval a draft Disaster Recovery Plan (DRP).

The bidder/contractor should:

• Maintain and execute a detailed disaster recovery/business continuity plan that meets approved disaster recovery requirements. The approved plan needs to include details regarding data, backups, storage management, and contingency operations that are capable of restoring the production environment within required recovery timeframes.

• Perform annual Disaster Recovery (DR) testing. The DR test results, and the lessons learned documentation will be shared with OPWDD.

• Develop action plan(s) to address issues or vulnerabilities found during disaster recovery testing routines and update the DR/BC plan accordingly.

• Establish the EDR environment in a different geographic area to ensure business continuity when natural calamity hits a specific location.

2.3.1.14. Turnover/Transition Plan

2.3.1.14.1. At a minimum, the Turnover Plan must include:

• A draft work schedule outlining all meetings required with OPWDD and its successor contractor(s) to coordinate the turnover of activities outlined in this RFP while providing all required turnover services.

• An outline of the schedule and process to transfer to OPWDD and the successor contractor(s) all manuals, standard operating procedures, and all contract-related documentation.

• An inventory of all in-progress work, and the method and proposed schedule to transfer these activities to OPWDD and the successor contractor(s).

• A training plan, including a technical application walk-through for all RFP-related applications and systems, the standard operating procedures and proposed schedule to complete training for OPWDD and the successor contractor(s).

• Updates or replacements for all data and reference files, computer programs, and all other documentation that will be required by OPWDD or the successor contractor to run acceptance tests.

• Updated computer programs, data, and reference files, that will be required by OPWDD or the successor contractor(s) to operate the EDR solution.

RFP OPD-2025-61 20 of 41 Electronic Dental Record Solution

• An inventory, and proposed schedule to turn over all hardcopy and electronically stored documents in accordance with the applicable State and federal regulations.

Upon turnover of all services as defined in this RFP, the contractor will facilitate a seamless transition to another vendor providing such services, as designated by OPWDD. The contractor will continue to provide uninterrupted services after Contract termination/expiration as the State deems reasonable and necessary for the State to comply with all legal requirements for establishing a new contract and transitioning to a replacement vendor in accordance with the terms specified herein. Transition services shall include the performance of the contractor’s responsibilities, as outlined in the RFP and Contract, and the transferring of those responsibilities to a successor contractor, the State, or a third party designated by the State in accordance with the Transition Plan agreed upon by the parties. The contractor shall maintain the same level of service during the transition period as is set forth in the RFP until specific tasks or services are completely transitioned to or assumed by a successor contractor, the State, or a third party designated by the State.

The contractor will identify and, whenever possible, remedy any actual or potential barriers to transition. No additional payments will be made to the contractor for any activities, services, and support required to be performed during any transition period or after contract end.

2.4. Staffing

2.4.1. Key Staff

These positions will serve as back up to each other as needed. The contractor must be prepared to provide detailed resumes for the staff proposed to perform the key rolls under the Contract as follows:

Position Title Minimum Qualifications and Required Duties Account Executive This role will be the primary point of contact, be responsible for learning the goals of this project and how the bidder/contractor can meet them. The account executive must be able to perform the duties stated below:

• Maintain strong client relationships and effectively understand client needs in delivering solutions.

• Provide a high level of customer satisfaction throughout the term of the contract.

Project Manager (PM)/Technical Account Manager (TAM)

The bidder/contractor will provide one PM, dedicated to OPWDD efforts. The PM will lead various aspects of this work, including but not limited to:

• Resolve all service-level issues,

• Monitor all customer support services (e.g., service call metrics and reporting)’

• Provide management for staff, including hire/onboard

Supervisors and Operators, track performance, time and attendance and conduct terminations, if necessary, assume a leadership role in attending all requested meetings, respond to inquiries, and provide overall programmatic feedback.

Qualifications:

• Minimum of ten years of documented professional managerial experience, and at least five years’ experience managing staff;

• Experience establishing and leading a team to include hiring, onboarding, and overseeing many staff, activities, and organizational changes;

• Past documented experience seamlessly bringing on a new

RFP OPD-2025-61 21 of 41 Electronic Dental Record Solution project/client on time and on budget; and,

• Documented analytical, organizational, and problem-solving skills.

• Project Management Professional (PMP) Certification from the Project Management Institute (PMI).

Developer Manager/Technical Lead This role will be responsible for mapping out project development plans, including identifying project goals, timelines, required resources and potential roadblocks. The developer manager / technical lead must be able to perform the duties stated below:

• Oversee the entire project from inception to completion.

• Key point of contact for all troubleshooting issues.

• Collaborate with cross-functional teams to translate business requirements into technical solutions..

Testing Supervisor/Release Manager This role will oversee the testing process to ensure software quality and performance before deployment. The testing supervisor / release manager must be able to perform the duties stated below:

• Coordination of release schedules.

• Foster communication between the development and operations teams.

Trainer/Training Staff • Minimum of five years of documented professional training experience, including knowledge and expertise on the solution.

• Curriculum development, curriculum maintenance

• Presentation of live training in-person and virtual.

• Travel statewide to deliver onboarding training, and then maintenance/update training in subsequent periods.

2.5. Cloud Solution Data Security and Privacy Requirements

OPWDD requires that contractors providing information technology (IT) and application services, commercial off-the-shelf (COTS) or custom, to OPWDD comply with the security and privacy policies and controls outlined in this RFP and all other applicable New York State and federal laws, regulations, policies, and standards for IT systems that transfer, process, or store OPWDD data, including but not limited to the Health Insurance Portability and Accountability Act (HIPAA) Omnibus Final Rule. Contractors are required to verify compliance with security and privacy requirements by providing OPWDD with documentation and artifacts validating that applicable standards and controls are in place.

2.5.1. ETHICS COMPLIANCE

All Bidders/Contractors and their employees must comply with the requirements of Sections 73 and 74 of the Public Officers Law, other State codes, rules, regulations and executive orders establishing ethical standards for the conduct of business with New York State. In signing the Bid, Bidder certifies full compliance with those provisions for any present or future dealings, transactions, sales, contracts, services, offers, relationships, etc., involving New York State, OPWDD, and/or its employees. Failure to comply with those provisions may result in disqualification from the Bidding process, termination of contract, and/or other civil or criminal proceedings as required by law.

RFP OPD-2025-61 22 of 41 Electronic Dental Record Solution

2.5.2. Moderate-Plus Security Controls Baseline

OPWDD has defined a Moderate-Plus Security Controls Baseline based on, and consistent with, the security provisions described in the Centers for Medicare & Medicaid Services (CMS) Information Security and Privacy Acceptable Risk Safeguards (ARS) and National Institute of Standards and Technology (NIST) Special Publication 800-53 at the Moderate level. Additionally, OPWDD has augmented these federal standards with New York State Policies and Standards. The Moderate-Plus Security Controls Baseline includes a System Overview document. All bidders shall complete the System Overview document and submit it with their Technical Proposal to thoroughly and accurately describe the technical security environments that will support the proposed system.

2.5.3. System Security Plan (SSP)

OPWDD requires the selected bidder to maintain a System Security Plan (SSP) that aligns with the Moderate-Plus Security Controls Baseline for all systems that will transfer, process, or store OPWDD data.