Request for Information (RFI) for Surveillance and Utilization Review Subsystem (SURS) OCMP 27-25703

The Maryland Department of Health, Office of the Inspector General for Health is issuing a Request for Information on a Surveillance and Utilization Review Subsystem (SURS) for the Maryland Medicaid program, with responses due August 31, 2026. This is market research and not a procurement solicitation; it does not constitute a commitment to issue a formal RFP, award a contract, or reimburse response costs.

SURS is a federally mandated component of the Medicaid Management Information System (MMIS) required to comply with 42 CFR Parts 433, 455, and 456. The existing legacy system—IBM's Java JSURS hosted on Windows Server 2016—reaches end-of-support in January 2027 and requires modernization to address technology obsolescence, manual workflows, data quality gaps, and the absence of advanced fraud analytics. The system currently serves approximately 1.3 million Medicaid enrollees, 70,000 providers, and processes approximately 8.5 million claims and encounters monthly.

MDH strongly prefers a proven Commercial Off-The-Shelf (COTS) or Software as a Service (SaaS) solution and requires that vendors demonstrate prior statewide Medicaid SURS implementations as a mandatory minimum qualification. The future-state vision prioritizes a modern, API-driven, modular architecture compliant with CMS Medicaid Enterprise Systems Modularity Rules, advanced analytics and machine learning capabilities, flexible reporting algorithms, and vulnerability assessments aligned with CMS Streamlined Modular Certification (SMC) requirements. MDH's baseline preference is a vendor-hosted SaaS model meeting Maryland Department of Information Technology security standards, NIST 800-53 controls, HIPAA requirements, and CMS SMC outcomes.

The RFI requests information on company background, solution capabilities, integration methods, technical architecture, security compliance, deployment options, implementation services, training approaches, and support models. Respondents should not provide pricing or bids. Written questions were due August 21, 2026. Addendum #1 was posted August 30, 2026. MDH may invite selected respondents for presentations or demonstrations following the response deadline. Final technical specifications, contract term, transition timeline, and service-level agreements will be established in a future Request for Proposals.