Independent Verification and Validation Services for Case Management Transformation

The Texas Health and Human Services Commission (HHSC) is soliciting proposals for Independent Verification and Validation (IV&V) services to oversee a comprehensive case management system transformation at the Texas Department of Family and Protective Services (DFPS), with responses due September 17, 2026 by 10:30 AM Central Time and a question deadline of August 28, 2026.

This is a federally-funded procurement (45 CFR 95.626 mandates IV&V for large-scale Automated Data Processing projects) and requires successful bidders to achieve and maintain Texas Risk and Authorization Management (TX-RAMP) Level 2 Certification by contract start. A Historically Underutilized Business (HUB) Subcontracting Plan is mandatory; respondents must demonstrate good-faith efforts to include certified HUB vendors in probable subcontracting areas: IT consulting, quality assurance and control consulting, system requirements quality assurance review, technical writing and documentation, and project management services.

The scope encompasses IV&V services across all implementation phases of a cloud-based COTS Platform-as-Service replacement for the existing IMPACT system, with module rollout scheduled 2027–2031 (Intake, Investigations, Case Management, Eligibility and Finance, and Portals/Mobility) plus one year of maintenance and operations per module. The contractor must deliver 37 distinct deliverables including a Project Work Plan (due within 30 business days of award), weekly and monthly IV&V reports, monthly executive briefings, and comprehensive assessment reports covering project management, quality assurance, testing, data conversion, security, and system performance.

The initial contract term is three years with one optional two-year extension and a possible one-year extension thereafter. One contract award is anticipated for January 2027. No guaranteed volume or total compensation is specified. Evaluation criteria are Qualifications and Experience (30 percent), Project Work Plan (50 percent), and Cost (20 percent). Minimum qualifications include five years in business or relevant IV&V experience, financial solvency, and proper Texas business registration; respondents must submit audited financial statements for 2023, 2024, and 2025, and three project references from similar contracts within the last five years, preferably for state or governmental entities.

The contractor must comply with Web Content Accessibility Guidelines (WCAG) 2.1 AA and Revised Section 508 Standards; submit Accessibility Conformance Reports (VPAT 2.5 INT or later) for each deliverable; maintain SOC 2 Type II reviews within the first year and biennially thereafter; conduct annual external penetration testing; implement phishing-resistant multi-factor authentication and NIST SP 800-63B-4 password standards; encrypt sensitive data in transit and at rest using minimum 128-bit symmetric or 2048-bit asymmetric encryption; and report confirmed or suspected breaches to DFPS within one calendar day verbally and in writing. Cloud services must comply with FedRAMP or TX-RAMP. Liquidated damages of $300 per business day apply for failure to meet Project Work Plan, Initial IV&V Report, Final IV&V Report, and annual updated Project Work Plan due dates.

Comprehensive insurance is required including workers' compensation ($1 million per accident, $1 million disease per employee, $1 million disease policy limit), commercial general liability ($1 million per occurrence, $2 million aggregate), automobile liability ($1 million combined single limit), cyber/privacy liability ($3 million claim and aggregate), professional liability ($2 million), and umbrella liability ($3 million). All policies must include thirty-day cancellation notice and waive subrogation in favor of HHSC.

Respondents must complete a Data Use Agreement acknowledging access to confidential information including communications, investigations, protected health information, personally identifiable information, and Social Security Administration data; comply with CAPTA, HIPAA, FERPA, the Privacy Act, FBI Criminal Justice Information Services guidelines, and NIST Cybersecurity Framework standards; and destroy all DFPS data upon contract termination per NIST SP 800-88 standards. Contractors must certify compliance with extensive state and federal requirements including prohibitions on abortion provider transactions, artificial intelligence use without written consent, child support delinquency, human trafficking convictions, and conflicts of interest.