27-DD Health Risk Screening Tool-SP w SS

The State of Illinois is soliciting a Health Risk Screening Tool under a small purchase with sole source conditions, with proposals due May 29, 2026.

The procurement is structured as a sole source acquisition, which restricts competition to a single identified vendor. The scope involves cloud-hosted health risk screening software. Vendors must meet comprehensive security and compliance standards including SOC 2 Type 2 audit certification (or acceptable alternatives) provided at award and annually thereafter, encryption of all State data at rest and in transit using FIPS 140-compliant AES-256 encryption with State-managed keys, integration with the State's Identity and Access Management platform with multi-factor authentication enforcement, and complete data exports in non-proprietary formats upon request. The vendor must prohibit use of State data in non-production environments or for artificial intelligence model training, provide a Software Bill of Materials following recognized formats, maintain encrypted backup systems with State-defined recovery objectives, conduct annual disaster recovery testing with documented results retained for three years, implement media sanitization per NIST Special Publication 800-88, and comply with Illinois Information Technology Accessibility Act standards (WCAG 2.1 Level AA).

All vendors must execute the State of Illinois IT Standard Terms and Conditions (Version 26.1) with Department of Human Services provisions, including prevailing wage compliance for applicable service categories, NIST Special Publication 800-53 Revision 5 security alignment, and restrictions on artificial intelligence use without express State authorization. Vendors must maintain $1,000,000 general commercial liability insurance and comply with the Illinois Freedom of Information Act. Vendor liability is capped at five times total contract compensation except for carve-outs including data breaches, intellectual property infringement, gross negligence, and fraud. The State retains termination for convenience rights with thirty days' written notice and may reduce contract amounts based on budgetary considerations at its sole discretion. Vendors must certify compliance with 34 distinct compliance areas under the Standard Illinois Certifications form, covering criminal history restrictions, workplace standards, equal employment opportunity, environmental compliance, cybersecurity standards, and prohibitions on bid rigging, bribery, and forced labor exploitation.