RFP for NCQA-certified HEDIS measurement vendor

The Oregon Health Authority is requesting proposals for an NCQA-certified vendor to produce, certify, and report 30 HEDIS and 14 non-HEDIS measures for the Oregon Health Plan under RFP S-44300-00017084, with proposals due November 6, 2026 and a pre-proposal conference on October 8, 2026 at 1:00 PM PT.

The vendor must hold current NCQA certification — the central qualification filter. No set-aside or preference program is stated. Proposers must submit a certified disadvantaged business outreach plan identifying Oregon-certified minority-owned, woman-owned, service-disabled veteran-owned, and emerging small business firms available for subcontracting, though this is a non-scored evaluation component.

The scope encompasses data integration from OHA sources; certified measure calculations and validation; quarterly and annual reporting to OHA, Coordinated Care Organizations, and the Centers for Medicare & Medicaid Services; and maintenance of HIPAA and Oregon state security compliance. Key deliverables include a Project Management Plan within 20 business days of contract execution, initial HEDIS results within six months, achievement of a minimum 97% quality match for non-HEDIS measures within 12 months, and quarterly reports by the last business day of each reporting quarter. The vendor must implement comprehensive security controls per Oregon Statewide Information Technology Control Standards, NIST SP 800-53 revision 5, and CIS Level 1 Benchmarks, including multi-factor authentication, full-disk encryption, 15-character passwords with complexity requirements, weekly full-system backups, monthly vulnerability scanning with 30/90/180-day remediation timelines for high/moderate/low-risk findings, annual security assessments and penetration testing, and one-hour incident reporting.

The initial contract term is five years with options to renew up to a cumulative maximum of 10 years. The contract is structured as a fixed-price cloud-hosted SaaS delivery with pricing due in Round 2, evaluated against OHA's available budget for implementation, ongoing support, and flexibility to modify scope post-award. Round 1 evaluation spans 2,000 points across organizational profile, experience, key personnel, security and work requirements, and service level agreements. Round 2adds 2,000 points for live product demonstrations and cost/contracting flexibility, for a total of 4,000 points. Questions are due October 16, 2026 at 5:00 PM PT. Notice of Intent to Award is anticipated December 18, 2026, with a seven-calendar-day protest period. Proposals must be submitted electronically through OregonBuys.