RFP - prescription drug monitoring database for controlled substances tracking

The Oregon Health Authority is requesting proposals for a fully managed Software-as-a-Service solution to host, maintain, secure, and enhance the state's Prescription Drug Monitoring Program system, with proposals due September 21, 2026 at 12:00 p.m. Pacific Time and questions due August 28, 2026. The RFP encourages participation from Oregon-certified disadvantaged businesses, minority-owned businesses, women-owned businesses, service-disabled veteran-owned businesses, and emerging small businesses, though no set-aside or mandatory participation goal is stated.

The system must support over 34,000 authorized users and 21.4 million prescription records for controlled substances (Schedules II–V) across Oregon. The contractor must deliver secure, HIPAA- and 42 CFR Part 2–compliant infrastructure with integration to electronic health records, pharmacy systems, PMP InterConnect, and RxCheck; 99.9% uptime; real-time data collection and validation; provider and dispenser portals; administrative dashboards; and peer comparison reporting. Critical security requirements include SOC 2 Type 2 and HITRUST certification (or GovRAMP authorization, ISO 27001, or equivalent); NIST SP 800-53 Revision 5 "Moderate" standards compliance; data encryption in transit, at rest, and in use; multi-factor authentication; 15-character minimum password length; and vulnerability remediation within 30 days (high-risk), 90 days (moderate-risk), and 180 days (low-risk). All data must remain within the United States. Proposers must demonstrate successful delivery of at least three comparable state-level PDMP or similar health IT implementations. The system may be hosted in the Agency's Microsoft Azure tenancy or in a FedRAMP-authorized environment.

The initial contract term is five years with potential renewal based on performance, funding, and agreed terms. The apparent successful proposer will be subject to 120 days of contract negotiation. Evaluation criteria total 1,050 points: staffing (40), knowledge transfer (85), operations (150), enhancements (150), documentation (50), quality assurance (50), SLAs (85), escalation (50), service requirements compliance (100), and pricing (200), with security evaluated on pass/fail basis. Pricing will be scored using a comparative formula awarding maximum points to the lowest proposed cost.