RFP 6171 MMIS Controls Audit

The Oregon Health Authority is soliciting proposals through DAS Procurement Services under RFP 6171 for Medicaid Management Information System (MMIS) controls audit services, with questions due October 30, 2026 at 5:00 p.m. Pacific Time and proposals due November 23, 2026 at 3:00 p.m. Pacific Time through OregonBuys. The solicitation does not set aside work for certified firms. Its outreach plan requirement (Attachment F) encourages participation by COBID-certified firms, and that plan is not scored.

The auditor must produce System and Organizational Controls (SOC) Type 2 reports under AICPA standards for five fiscal years, July 1, 2026 through June 30, 2031. The examination covers controls at Gainwell, LLC, the incumbent MMIS contractor, with emphasis on the drug rebate subsystem. The environment runs on Red Hat Linux servers, Microsoft Windows, and Oracle databases, with applications developed in C# and .NET. Minimum qualifications require a Key Person who is a currently Oregon-licensed CPA. A public accounting firm proposer must also be licensed to perform audits in Oregon. Proposers with 50 or more full-time workers and a contract price above $500,000 must hold a current Pay Equity Certificate from DAS.

The contract runs five years with options to extend two additional years, for a seven-year total. Proposers submit a total, all-inclusive fixed cost for each annual audit report, covering labor, benefits, travel, per diem, materials, and expenses, in a separate electronic price file. Proposals remain firm for 180 days after the closing date. Evaluation allocates 50 points to Project Implementation Plan, 20 points to Key Person Experience, 20 points to Price, and 10 points to References. A Notice of Intent to Award is anticipated December 10, 2026, followed by a seven-calendar-day protest period.