Immunization information system (IIS)

The West Virginia Department of Health, Bureau of Public Health, Office of Epidemiology and Prevention Services is requesting proposals for an Immunization Information System (IIS) under CRFP 0506 MIS2700000001, with sealed proposals due August 19, 2026 at 1:30 p.m. ET and written questions due July 31, 2026. No pre-bid meeting will be held. This is a cloud-hosted system contract with extensive federal compliance and security requirements that will govern vendor eligibility and cost.

The scope encompasses a centralized, browser-based immunization records repository serving statewide immunization data management, provider enrollment, and reporting. The vendor must design, implement, and maintain the system to support data migration of 2.9 million patient records and 31.9 million vaccination records, with mandatory interface development and integration with West Virginia's data infrastructure. The system must achieve 99.9% monthly uptime (24/7/365 availability), process 95% of HL7 messages within 60 seconds, and comply with CDC IZ Gateway specifications and bidirectional data exchange requirements. All deliverables require FedRAMP Moderate or High authorization, FIPS 140-2/3 validated cryptography, TLS per NIST standards, SOC 2 Type II audit reports within 60 days of execution with annual renewals, annual penetration testing with 30-day remediation timelines, and continuous SAST/DAST scanning. The vendor must provide technical support daily 8:00 a.m. to 5:00 p.m. Eastern with after-hours on-call support, and achieve 95% response to support requests within 15 minutes. Training, user guides, and digital training videos must be completed prior to go-live.

All contractor and subcontractor employees accessing protected health information (PHI), personally identifiable information (PII), or federal data must undergo fingerprint-based state and federal background checks per West Virginia Code 15-2D-3 prior to system access, with re-investigation every three years. Vendors must execute a Business Associate Agreement under HIPAA and comply with West Virginia OMIS incident reporting procedures, security policies, and breach notification protocols (15-minute discovery reporting, one-hour notification to CMS and SSA for relevant incidents, 24-hour IRS notification for FTI incidents). Data must reside exclusively in U.S. data centers. Pricing includes one-time implementation costs for project management, configuration, data migration, interface development, training, and acceptance testing/go-live support; optional Oral Health Module and Read Replica Implementation features; and annual recurring fees for software licensing/subscription, cloud hosting/infrastructure, and standard maintenance and support across a four-year term with an optional fifth renewal year. Responses must be submitted in sealed paper form (technical proposal and cost proposal separately) to the Department of Administration Purchasing Division, 2019 Washington Street East, Charleston, West Virginia 25305. The State retains reciprocal preference and small, women-owned, or minority-owned business preferences under West Virginia Code. Prior to award, the successful vendor must register with the West Virginia Purchasing Division and pay a $125 registration fee.