RFP HSA Administrator

The Office of Management and Enterprise Services (OMES) Central Purchasing division is requesting proposals for HSA Administrator services on behalf of the Oklahoma Health Care Authority Employees Group Insurance Division, with proposals due July 20, 2026 at 3:00 p.m. Central Standard Time. Questions may be submitted through July 7, 2026. The contract calls for an indefinite-delivery, indefinite-quantity firm fixed-price agreement with no minimum or maximum services guaranteed; payment is contingent upon satisfactory performance and proper documentation.

The scope encompasses HSA administrative services and account access for approximately 15,292 primary members and 11,296 dependents enrolled in the HealthChoice High Deductible Health Plan (HDHP) who establish individual trust agreements. Required capabilities include 24/7 online account access, debit card functionality, investment options with rate-of-return details, rollover processing from other HSAs, tax reporting (1099-SA and Form 5498-SA at no additional cost), pre-tax and post-tax contribution handling across more than 900 separate payroll systems and Section 125 plans, representative availability for member educational meetings at no cost, and comprehensive customer service through multiple channels with specified response times. The awardee must execute a Business Associate Agreement compliant with HIPAA (45 CFR Parts 160 and 164), maintain security incident reporting within 72 hours of discovery, and handle sensitive data subject to HIPAA/ePHI, CJIS, FERPA, IRS Publication 1075, SSA, and 42 CFR Part 2 requirements. All IT assets and contracts are owned by OMES IS; data must be encrypted at rest and in transit and stored and processed in the United States only.

The initial contract term is one year with four one-year renewal options. The current TPA is UMR (UnitedHealth Group company) and the current PBM is CVS Caremark. No minimum or maximum amount of services is guaranteed, and EGID will not seek appropriations if revenue shortfalls occur. Funds are non-appropriated. The awardee receives no direct compensation from EGID; all fees are established in individual agreements between the HSA Administrator and members. Bidders must submit Authority to Operate (ATO) or ATO-request confirmation, three years of audited financial statements, the most recent SSAE 18 SOC1 audit report, and current Oklahoma business authorization. Commercial general liability insurance of at least $2 million per occurrence and security and privacy liability insurance of $5 million per occurrence are required. Pricing must remain firm for a minimum of 120 days following the bid due date and is not confidential. Solicitation EV00000906 includes IT components utilizing federal funds. No commissions or finder's fees shall be paid to any subcontractor, broker, or agent.