Commercially available off-the-shelf (COTS) Enterprise Data Management Platform

The Oregon Health Authority is soliciting quotes for a commercially available off-the-shelf Enterprise Data Management Platform capable of supporting a Data Catalog Solution with metadata management, enterprise-wide data discovery, and governance workflows integrated with OHA's existing infrastructure, with quotes due September 18, 2026 at 5:00 PM Pacific Time.

This RFQ 6256 is conducted under an existing Master Service Agreement with seven authorized addendum holders: A&T, CDWG, Carahsoft Technology Corp, Lumen, SHI International Corporation, Smartronix, and Strategic Communications. Only vendors holding active addendum authority under this MSA are eligible to respond.

The platform must integrate with Snowflake, Power BI, and Azure and support production and non-production environments. OHA seeks software licensing (SaaS or perpetual options), vendor-provided training, and implementation enablement services. The solution must comply with HIPAA, Oregon's Statewide Security Standards, Level 3 Data Security Compliance, role-based access controls, multi-factor authentication, AES-256 and TLS 1.2+ encryption, and audit logging. OHA will procure implementation services—including program management, requirement gathering, configuration, connector builds, ETL, metadata ingestion, data profiling, and change management—through a separate implementation partner procurement; vendors must not assume these costs unless OHA explicitly requests optional add-ons.

The estimated contract term is five years. Pricing responses must cover the full five-year period, itemizing license model, total license costs, included seats, additional-seat costs, fixed-price support and training packages, and optional add-ons. Licensing metrics such as named users, concurrent users, capacity, and ingestion volume are proposed by respondents.

Evaluation uses a 1,000-point scoring matrix: general requirements (150 points), system capabilities (300 points), security and architecture (150 points), accessibility (100 points), vendor experience and references (100 points), pricing (150 points), and statement of work (50 points). Best Value criteria apply.

Questions and clarifications are due September 10, 2026 at 5:00 PM Pacific Time, with OHA responses anticipated September 16. Notice of Intent to Award is anticipated October 2, 2026, followed by a seven-calendar-day protest period. Responses must include a Disclosure Exemption Affidavit, respondent certification, solution overview with system architecture and security documentation, an Oregon Security & Hosting Requirement Attestation, vendor references, a Statement of Work, and a Requirements Matrix. Failure to submit all mandatory elements may result in disqualification.