Immunization information system (IIS)

The West Virginia Department of Health is requesting proposals for an Immunization Information System (IIS) cloud-hosted platform with proposals due August 19, 2026 at 1:30 p.m. ET, under CRFP MIS2700000001. The vendor question deadline has passed (July 31, 2026); no pre-bid meeting is scheduled.

The scope is a comprehensive, web-based immunization registry system managing approximately 2.9 million patient records and 31.9 million vaccination records, with migration from the current system, data integration with the WV Data Bridge surveillance infrastructure, and interfaces supporting CDC IZ Gateway specifications and HL7 messaging standards. The system must be cloud-hosted in the United States with 24/7/365 availability at 99.9% monthly uptime (maximum 43 minutes 50 seconds downtime), operate across major browsers without elevated user permissions, and support real-time data exchange. The platform must comply with HIPAA, manage protected health information including biometric identifiers, demographic data, contact information, identification numbers, vaccination dates, vaccine types, manufacturers, lot numbers, and adverse reaction data. System requirements are organized around nine core functions: Administer System, Manage Organizations and Facilities, Manage Users, Support Interoperability, Ensure Data Quality, Evaluate and Forecast, Manage Patient and Immunization Records, Manage Vaccine Inventory, and Provide Data Access, with 674 baseline functional and non-functional requirements (designated as Essential or Optional) provided in the Requirements Traceability Matrix.

Contract term spans four years plus an optional fifth renewal year. Pricing encompasses one-time implementation costs (project management, configuration, data migration, interface development, training, testing) and annual recurring fees (licensing, cloud hosting, maintenance, support). Optional features include an Oral Health Module and Read Replica for the Data Bridge, each with separate setup and annual fees. Vendors must submit cost and technical proposals in separately sealed envelopes to 2019 Washington Street East, Charleston, West Virginia 25305 in paper form only; no electronic submissions are permitted.

Deliverables include hosting architecture documentation, browser compatibility and performance test results, accessibility verification, maintenance and support plans, data residency certifications, Business Continuity/Disaster Recovery plans aligned with NIST SP 800-34, FedRAMP Moderate or High authorization proof, FIPS 140-2/3 cryptography documentation, TLS compliance per NIST SP 800-52, SOC 2 Type II audit reports, annual penetration testing and vulnerability management reports, secure software development lifecycle documentation, SAST and DAST scan reports, staffing plans with named Project Manager, finalized Project Plan within 10 days of initial planning, digital training videos and user guides, third-party component inventory, continuous monitoring reports, and incident response plans aligned with NIST SP 800-61.

Service Level Agreement establishes 99.9% uptime requirement with retainage penalties ranging from 5% to 100% based on availability violations, plus 5% penalties for unmet support response times, compatibility failures, or support standard violations. Critical issues require 1-hour response and 24-hour resolution; High severity requires 2-hour response and 48-hour resolution; Medium severity requires 4-hour response and 5-calendar-day resolution; Low severity requires 24-hour response and 30-calendar-day resolution. Technical support must be available daily 8:00 AM to 5:00 PM ET with after-hours on-call support for critical issues, with 95% of requests receiving responses within 15 minutes in caller's preferred language or with interpretation services. The vendor must implement CDC specification updates within 90 calendar days and submit monthly performance reports by the 15th of each month.

All vendor employees with access to sensitive or protected health information must undergo state and federal fingerprint-based background checks prior to system access under West Virginia Code 15-2D-3. The addendum governs data protection, security incident reporting (24 hours), data breach notification (72 hours), annual Cloud Security Alliance STAR Self-Assessments and SOC 2 audits, 30 days' advance notice of system upgrades, and comprehensive security logs in CSV format. The vendor bears costs for data breach investigation, mitigation, remediation, notification, credit monitoring, and call center support, capped at the Ponemon Institute's Cost of Data Breach Study per-record rate. Upon contract termination, the vendor must return all jurisdiction data within an agreed timeframe and securely dispose of data per NIST-approved methods within 10 to 60 days depending on termination type. West Virginia retains ownership of all data and the right to import/export in standard formats.

Responses must acknowledge receipt of all addenda, including Addendum 1 (revised Requirements Traceability Matrix). Vendors must register with the West Virginia Purchasing Division prior to award, with a $125 registration fee if applicable. West Virginia applies reciprocal preference to non-resident vendors and preferences to small-business enterprises, women-owned businesses, and minority-owned businesses certified under state regulations. Physical address for submission and questions: Crystal G. Hustead, crystal.g.hustead@wv.gov, or Department of Administration Purchasing Division, 2019 Washington Street East, Charleston, West Virginia 25305-0130.