Privileged Access Management Solution

UW Medicine Supply Chain is conducting a Request for Proposals (RFP No. 5022) to procure a Privileged Access Management (PAM) Solution for Information Technology Services across multiple Washington counties and jurisdictions. The procurement seeks an automated solution to manage the entire lifecycle of privileged accounts and access requests, emphasizing security best practices and least privilege access controls. Vendors must provide a commercial off-the-shelf solution that supports centralized management of local and domain administrative accounts, with capabilities including user authentication, audit trails, session monitoring, and credential management. Minimum bidder qualifications include 5 years of healthcare implementation experience, HIPAA compliance, cyber risk insurance of at least $2 million per claim, and ability to provide role-based administration and real-time session monitoring. Key dates include a questions submission deadline of February 21, 2025, UW Medicine's response by February 28, 2025, proposal due date of March 14, 2025 at 3:00 PM Pacific Time, oral presentations and demonstrations scheduled for April 14-25, 2025, and notification of the Apparent Successful Bidder by May 16, 2025.

The RFP includes provisions for potential MWBE and Small Business participation, though specific goals are not explicitly stated. The initial contract term will be three years (August 1, 2025 through July 31, 2028) with potential extensions up to 9 years total. The solution must support integration with existing systems including Epic EHR, ServiceNow, CrowdStrike, and Sailpoint, and begin with a three-month pilot phase evaluating 230 privileged accounts with 5 solution users, scaling to 700 accounts and 20 users for full launch. Pricing requirements mandate no price increases during the initial term, with subsequent annual increases limited to 2%. The total project will involve one-time implementation costs, recurring costs, and on-demand professional services, with the solution required to meet HIPAA compliance, cyber-risk insurance requirements, and WCAG 2.1 Level AA accessibility standards by April 2026. While specific budget ranges are not explicitly detailed, the comprehensive technical requirements and multi-year contract structure suggest a significant investment in enterprise-level privileged access management technology.