27-Micromedex Subscr SP SS

The State of Illinois Department of Human Services is procuring a Micromedex software subscription for its Pharmacy division as a small purchase under sole source conditions, with proposals due July 24, 2026.

This is a sole source procurement, which eliminates competitive bidding and restricts eligibility to the single vendor meeting the stated need. The scope is Micromedex pharmacy software; the attached IT Terms and Conditions v.26.1 and Cloud Hosting Appendix v.26.1 establish the operational and security framework governing the contract.

The vendor must comply with 34 standard Illinois certifications covering vendor eligibility, financial integrity, ethical conduct, employment practices, environmental compliance, tax compliance, debarment status, drug-free workplace policies, equal employment opportunity, forced labor and child labor prohibitions, cybersecurity compliance, and political contribution restrictions. Vendors must recertify annually by January 1 for contracts exceeding one year.

The Cloud Hosting Appendix requires SOC 2 Type 2 audit reports at contract award and annually thereafter; breach notification within 24 hours; encryption of all State data at rest and in transit using FIPS 140-compliant AES-256; secure integration with the State's Identity and Access Management platform with multi-factor authentication for privileged accounts; encrypted backups meeting State-defined Recovery Point Objectives and Maximum Tolerable Downtime standards; media sanitization per NIST SP 800-88; and compliance with the Illinois Information Technology Accessibility Act incorporating WCAG 2.1 Level AA standards. The vendor must prohibit use of State data for artificial intelligence or machine learning model training and provide logs within 24 hours of State request.

The vendor must carry general commercial liability insurance of $1 million per occurrence with $2 million annual aggregate, maintain books and records for three years (five years if federal funds are used), and comply with HIPAA requirements and prevailing wage obligations where applicable. The State may terminate for cause immediately or for convenience with 30 days' notice, subject to appropriation availability.