In compliance with the Americans with Disabilities Act, this document is available in alternate formats such as Braille, large

print, audiotape, oral presentation and electronic format. To request an alternate format, please send an e-mail to DHS.Forms@state.or.us or contact the Office of Document Management at 503-3783486, and TTY at 503-378-3523. The State of Oregon, Department of Human Services Office of Contracts & Procurement On behalf of the Oregon Health Authority Office of Information Services Issues the Following REQUEST FOR PROPOSALS for Oregon HIE Solution RFP 3261

Date of Issuance: Questions Due:

July 19, 2011 3:00 P.M. Local Time, August 1, 2011. Questions must be submitted (email, fax, or US mail) in writing to the Sole Point of Contact listed below. 3:00 P.M. Local Time August 18, 2011 at the issuing office. Postmarks, electronic transmissions, and faxes will not be considered. 3:00 P.M. Local Time, August 18, 2011 at the issuing office.

Proposals Due by:

Proposal Public Opening:

Issuing Office & Sole Point of Contact: Ellen Price, Procurement and Contracts Specialist Office of Contracts and Procurement 800 NE Oregon, STE 550 Portland OR 97232 Telephone: 503-741-6711 Fax: 971-673-0583 Email: ellen.d.price@state.or.us

Table of Contents
SECTION 1 – PURPOSE/OVERVIEW ..................................................................................................... 4 1.1 Introduction ................................................................................................................................. 4 1.2 Background ................................................................................................................................. 5 1.4 Definitions................................................................................................................................... 8 1.5 Authority ................................................................................................................................... 17 SECTION 2 – MINIMUM QUALIFICATIONS ..................................................................................... 17 SECTION 3 – SCOPE OF WORK ........................................................................................................... 17 3.1 HIE Core Services........................................................................................................................... 18 3.1.1 Trust Services.................................................................................................................... 18 3.1.2 Provider Directories .......................................................................................................... 19 3.1.3 Directed Exchange Services ............................................................................................. 21 3.2 Minimum Oregon HIE System Support Requirements ............................................................ 22 3.2.1 HIE Participant Services ................................................................................................... 22 3.2.2 Configuration and Implementation Services .................................................................... 24 3.2.3 Maintenance and Support Services ................................................................................... 25 3.3 Optional Services and Tools .......................................................................................................... 28 3.5 Schedule of Milestones ............................................................................................................. 29 3.6 Deliverable Format, Submission, and Review.......................................................................... 30 SECTION 4 – RFP PROCESS ................................................................................................................. 30 4.1. Sole Point of Contact (SPC) ..................................................................................................... 30 4.2 Timeline for RFP and Proposal Submission ............................................................................. 30 4.3. Closing Date for Submittal of Proposals .................................................................................. 31 4.4. Pre-proposal Questions Relating to This RFP .......................................................................... 31 4.5 Public Opening.......................................................................................................................... 31 SECTION 5 – PROPOSAL REQUIREMENTS ...................................................................................... 32 5.1 Overview ................................................................................................................................... 32 5.2 Proposal Requirements ............................................................................................................. 32 5.2.1 Proposal Cover Sheet ........................................................................................................ 32 5.2.2 Proposer’s Designation of Confidential Materials--OPTIONAL ..................................... 32 5.2.3 Proposer’s References ....................................................................................................... 33 5.2.4 Minimum Qualifications & Insurance Requirements ....................................................... 33 5.2.5 Organizational Capacity & Experience ............................................................................ 33 5.2.6 Key Persons & Staffing Approach .................................................................................... 34 5.2.7 Trust Services & Privacy and Security ............................................................................. 35 5.2.8 Provider Directories .......................................................................................................... 36 5.2.9 Directed Exchange Services ............................................................................................. 36 5.2.10 Web Portal Access to Directed Exchange and Provider Directory Services .................... 37 5.2.11 HIE Participant Support Services ..................................................................................... 38 5.2.12 Maintenance and Support Services ................................................................................... 38 5.2.13 Proposed Project Implementation Plan ............................................................................. 39 5.2.14 Proposed Licenses and Agreements.................................................................................. 40 5.2.15 Glossary ............................................................................................................................ 40 5.2.16 Optional Services and Tools ............................................................................................. 40 5.2.17 Cost Proposal .................................................................................................................... 41 SECTION 6 – PROPOSAL EVALUATION ........................................................................................... 41 6.1 Pass/Fail Items .......................................................................................................................... 41 6.2 Proposal Review Criteria .......................................................................................................... 42 6.3 Evaluation and Points Summary ............................................................................................... 44 6.4 Competitive Range Determination ........................................................................................... 44
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 2 of 113

6.5 Competitive Range Protests ...................................................................................................... 45 6.6 Best and Final Offer Process.................................................................................................... 45 6.7 Final Selection and Award ........................................................................................................ 45 6.8 Disqualification ......................................................................................................................... 46 SECTION 7 – GENERAL INFORMATION ........................................................................................... 46 7.1 Changes/Modification and Clarifications ................................................................................. 46 7.2 Reservation of Agency Rights .................................................................................................. 46 7.3 Protest of RFP ........................................................................................................................... 46 7.4 Award Notice ............................................................................................................................ 47 7.5 Protest of Award ....................................................................................................................... 47 7.6 Modification or Withdrawal ..................................................................................................... 47 7.7 Release of Information .............................................................................................................. 47 7.8 Public Information .................................................................................................................... 47 7.9 Cost of Proposals ...................................................................................................................... 48 7.10 Statutorily Required Preferences .............................................................................................. 48 7.11 Contract Period ......................................................................................................................... 48 7.12 Contractual Obligation .............................................................................................................. 48 7.13 Contract Documents.................................................................................................................. 48 ATTACHMENT 1 - Proposal Cover Sheet .............................................................................................. 50 ATTACHMENT 2 - Proposer’s Designation of Confidential Materials .................................................. 51 ATTACHMENT 3 – References .............................................................................................................. 53 ATTACHMENT 4 – Cost Proposal.......................................................................................................... 54 ATTACHMENT 5– Form Contract.......................................................................................................... 55 ATTACHMENT 6 – HIE in Oregon ...................................................................................................... 100 ATTACHMENT 7 – Provider Directory Support .................................................................................. 110 ATTACHMENT 8 – Vendor Hosting Requirements ............................................................................. 113

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 3 of 113

SECTION 1 – PURPOSE/OVERVIEW
1.1 Introduction

The Oregon Department of Human Services (DHS)’ Office of Contracts & Procurement (OCP), on behalf of the Oregon Health Authority (OHA), Office of Information Services (OIS), Office of Health Information Technology (OHIT), hereinafter referred to as “DHS,” “OHA,” or “Agency,” seeks Proposals from qualified individuals and organizations to provide an Oregon Health Information Exchange (HIE) Solution to act as a Health Information Services Provider (HISP) for statewide HIE. The Oregon HIE Solution will: 1. Serve as the platform for routing messages among all HIE Participants (such as hospitals, public health agencies, Accountable Care Organizations (ACOs) and Health Information Organizations (HIOs)), 2. Provide the capability for Eligible Professionals (EPs) and Eligible Hospitals (EHs) to meet criteria to receive the Centers for Medicare and Medicaid Services’ (CMS) Meaningful Use incentive payments; and 3. Provide services necessary for participation in HIE by those individuals and organizations that may not qualify for Meaningful Use incentive payments, but would like to participate in HIE. All persons or firms submitting proposals are referred to as “Proposers” in this Request for Proposals (RFP); after execution of a contract, if any, the awarded Proposer or Proposers will be designated as Contractor. The parties will negotiate the final Statement of Work, and other terms and conditions, including any service level agreements, to be included in the contract to be awarded as a result of this RFP (hereinafter, “ Contract.”) Agency intends to award one contract to a single Proposer that is most advantageous to the State of Oregon. Agency reserves the right to make multiple contract awards if appropriate to best accomplish HIE goals. Agency anticipates the cost of services for the initial contract term, which is expected to be September 23, 2011 through August 30, 2013, to not exceed $2,000,000. The total value of the contract(s) awarded pursuant to this RFP will not exceed $5,000,000. The successful Proposer shall provide a comprehensive Oregon HIE Solution that will enable the implementation and operation of statewide HIE. OHA presumes that the Oregon HIE Solution will be a “thin layer” externally-hosted and operated web-based solution. The successful Proposer’s solution must provide at least all minimum components of the Oregon HIE Solution described in this RFP, including support services such as resource consultation, implementation, outreach and engagement of stakeholder groups. Proposers may need to develop collaborative affiliations with other organizations as subcontractors to address the requirements identified in the RFP. Core HIE Services (described in the Scope of work of this RFP) must be operational on or about November 14, 2011. The contract(s) awarded as a result of this RFP may be amended to include additional services reasonably within the scope of this solicitation, including ongoing HIE System maintenance, support, and hosting; services relating to controls audit activities; increasing or decreasing services; adding additional service modules; data and application migration; modification of services and their delivery to reflect best practices and emerging HIE service models; self-supported financing requirements; interstate HIE; and to include work relating to state and federal HIT and healthcare initiatives.

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 4 of 113

OHA anticipates that management of the contract for Oregon’s HIE Services will be transferred from OHA to a State Designated Entity (SDE) responsible for administration of Oregon’s HIE services during the term of the successful Proposer’s contract, but not before April 2012. 1.2 Background

The Oregon HIE Solution will be a building block in the evolution of Oregon’s Health Information Technology (HIT) infrastructure. HIT will be an important tool in improving access, quality, and value in the health care system. In the 2009-2010 session, the Oregon Legislature approved an ambitious health reform law, House Bill 2009, which created the Oregon Health Authority (OHA). Additional information about OHA can be found at: http://www.oregon.gov/OHA/. Oregon’s health reform law also anticipated many of the health care innovations contained in the federal American Reinvestment and Recovery Act (ARRA) and in national health reform legislation (the Patient Protection and Affordable Care Act). Congress made the acceleration of HIT an urgent priority in early 2009; it included the HITECH Act as part of its economic recovery legislation. Oregon’s HIE planning and implementation activities to be funded by the federal Office of National Coordinator (ONC), State Health Information Exchange Cooperative Agreement Program, are expected to have a substantial positive impact on health, healthcare quality, costs, and coordinated care. Oregon created the Health Information Technology Oversight Council (HITOC) to guide HIT efforts within Oregon. Additional information about HITOC can be found at: http://www.oregon.gov/OHA/OHPR/HITOC/. OHA’s Office of Health Information Technology (OHIT), is the designated coordinator of Oregon’s HIT activities, and does so under the direction and guidance of HITOC. One of HITOC’s early focuses was on the creation of strategic and operational plans for statewide Health Information Exchange (HIE). It oversaw the creation of Oregon’s Strategic and Operations Plans for HIE (“Oregon’s HIE Plans”). HIE is the movement of health care information (e.g., clinical records, lab reports) electronically across and between organizations. The goal of Oregon’s HIE activities is to facilitate access to and retrieval of clinical data to provide safe, timely, efficient, effective, equitable, patient-centered care. HIE policies and HIT infrastructure will provide the capability to electronically move clinical information between disparate health care information systems while maintaining the meaning of the information being exchanged. HIE infrastructure will allow Eligible Professionals (EP) and Eligible Hospitals (EH) to demonstrate Meaningful Use of Electronic Health Records (EHR) necessary to receive federal incentive payments. Further, Oregon’s HIE will serve as a foundation for Oregon’s health system transformation goals. Additional information about these goals can be found at: http://www.oregon.gov/OHA/health-system-transformation.shtml. Oregon’s HIE Plans include a phased approach to services implementation, as well as a prioritization of services within each phase. Phase 1, which includes the initial services period for the Contract OHA intends to award via this RFP, will focus on technology and business services that adhered to nationally recognized standards and processes, and that facilitate widespread HIE between organizations and providers within the state of Oregon. Oregon has identified three Core HIE Services (Trust Services, Provider Directories, and Messaging Services) that will provide the minimum functionality necessary for Oregon Eligible Professionals and Eligible Hospitals to meet Stage 1 Meaningful Use criteria (as defined at http://healthit.hhs.gov/portal/server.pt?open=512&objID=2996&mode=2), as well as provide
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 5 of 113

the opportunity and capability for any and all potential HIE Participants to utilize the services, regardless of their eligibility for Meaningful Use incentive payments. Phase 2 will broaden HIE, and may incorporate additional services into the Contract resulting from this RFP. Phase 2 may include the successful Proposer implementing services that provide opportunistic revenue, or that are of strategic importance for meeting future HIE objectives. Further information regarding these services can be found on pages 33-34 of Oregon’s Strategic Plan for HIE. A link to this plan is at the end of this Background Section. Oregon’s HIE approach anticipates that the Oregon HIE Solution will use a federated data model that ensures HIE will be conducted via secure messaging, using a provider directory for discovery of participants. Oregon has elected to support secure transmittal of HIE messages using protocols and standards defined by the Direct Project (www.directproject.org). Oregon’s commitment to ensure high security standards for its Core HIE Services will be further reinforced through he successful Proposer’s Oregon HIE Solution being certified as HIEAP (Health Information Exchange Accreditation Program) Version 1.0 compliant. (http://www.ehnac.org/index.php?option=com_content&view=article&id=57&Itemid=60). For more information, please see the following: • Health Information Exchange: A Strategic Plan for Oregon: http://www.oregon.gov/OHA/OHPR/HITOC/Documents/SandOpPlans201008/HIEStrategicPlan OR.pdf For a more comprehensive overview of the Direct Project, visit: http://www.google.com/url?q=http%3A%2F%2Fwiki.directproject.org%2Ffile%2Fview%2FDir ectProjectOverview.pdf&sa=D&sntz=1&usg=AFQjCNFdutoWxZXTZh5pDnSLCJ3DMAfWghttp://wiki.directproject.org/file/view/DirectProjectOverview.pdf Attachment 6 to this RFP, HIE Background and Environmental Scan ONC HIE priorities: http://statehieresources.org/hie-priorities/ Additional information about OHA: http://www.oregon.gov/OHA/ Additional information about HITOC http://www.oregon.gov/OHA/OHPR/HITOC/ Additional information about Oregon’s health system transformation goals: http://www.oregon.gov/OHA/health-system-transformation.shtml

• • • • •

1.3

Overview of Oregon’s HIE Model

Oregon desires a comprehensive Oregon HIE Solution that will enable the implementation and operation of statewide HIE. The successful Proposer will act as a statewide HISP. OHA presumes that the Oregon HIE Solution will be a “thin layer” externally-hosted and operated web-based solution, represented in the following graphic:

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 6 of 113

The key principles for Oregon’s HIE Solution are: 1) An infrastructure that is secure and protects the privacy of consumers, providers, and other HIE Participants. HIE Participants will be confident that their health care data is secure, private, and appropriately accessed. 2) HIE will improve the health care delivery process in Oregon by providing information when and where it is needed. 3) Best practices and national standards for information technology infrastructure will be utilized to the extent possible and practical in the implementation of the Oregon HIE. 4) Technical infrastructure will attempt to leverage existing sources of health information to the extent possible and capitalize on current health exchange solutions or components of solutions. 5) Architecture will support an incremental deployment (i.e. scalable and configurable) of a statewide exchange capability. 6) Technical infrastructure will expand as rapidly as technologically and operationally feasible within the financial constraints of the project. 7) Technical infrastructure will provide messaging infrastructure with guaranteed, secure information delivery. The critical requirements for Oregon’s Core HIE Services are for the Oregon HIE Solution to include: 1) Trust Services that provide the framework and controls for secure HIE.
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 7 of 113

2) Health Information Provider Directories (both Entity Level Provider and Individual Level Provider) for the identification and location of trading partners. 3) HIE Messaging Services that comply with Direct Project standards and protocols. 4) Administrative and managerial support of HIE operation and related services. 5) Services and tools necessary to support the qualification, on-boarding, and enrollment of HIE Participants. 1.4 Definitions

For purposes of this RFP and the resulting Contract, the terms below shall have the following meanings: “Acceptance” means written confirmation by Agency that Contractor has completed a Deliverable according to the Acceptance Criteria and it is accepted for purposes of interim payment. The term is distinct from “Final Acceptance.” “Acceptance Criteria” means the criteria for accepting Deliverables required by this Contract, including but not limited to all specifications and requirements in the Statement of Work, and the Performance Warranties set forth in Section 8.2 of the Contract. “Acceptance Tests” means those tests which are intended to determine compliance of Deliverables with the Acceptance Criteria of this Contract. “Accountable Care Organization” (ACO) means a local health care organization that is accountable for 100% of the expenditures and care of a defined population of patients. Depending on the sponsoring organization, an ACO may include primary care physicians, specialists and, typically, hospitals that work together to provide evidence-based care in a coordinated model. The three major foci of these organizations are: 1) Organization of all activities and accountability at the local level, 2) Measurement of longitudinal outcomes and costs, and 3) Distribution of cost savings to ACO members. ACO provisions were included in the final legislation of the Patient Protection and Affordable Care Act (ACA) of 2010. “Agency Intellectual Property” means any intellectual property that is owned by Agency. Agency Intellectual Property includes any derivative works and compilations of any Agency Intellectual Property. “American Recovery and Reinvestment Act” (ARRA) means PL 111-5, and is commonly referred to as the “Stimulus” or “Recovery Act.” ARRA was signed into law February 17, 2009 and provides $787 billion to promote economic recovery. "Application Programming Interface" (API) means a set of rules and specifications that software programs can follow to communicate with each other. It serves as an interface between different software programs and facilitates their interaction, similar to the way the user interface facilitates interaction between humans and computers. “Authentication/Identity-proofing” means the process of establishing that individuals, organizations, or things are who or what they claim to be. In the context of a PKI, authentication can be the process of establishing that an individual or organization applying for or seeking access to something under a certain name is, in fact, the proper individual or organization (This is sometimes referred to as “identity-proofing”). Authentication can also refer to a security service that provides assurances that individuals, organizations, or things are who or what they claim to
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 8 of 113

be or that a message or other data originated from a specific individual, organization, or device. Thus, it is said that a digital signature of a message authenticates the message's sender. “Authorized Representative” means a person representing a party to this Contract who is authorized to make commitments and decisions on behalf of the party regarding the performance of this Contract. Contractor’s Authorized Representative is the person so identified in Exhibit E of the Contract. Agency’s Authorized Representative is the person so identified in Exhibit F of the Contract. “Business Associate” (BA) means a HIPAA Business Associate as defined under the HIPAA Security Rule. “Business Days” means Monday through Friday, 8:00 a.m. to 5:00 p.m., Pacific Time, excluding State of Oregon holidays and business closure days. “Certificate Authority(ies)” (CA) is the entity(ies) that issues digital (X.509v3) certificates to entities and individuals for the purposes of conducting secure information exchange in a PKI framework. A CA is the issuing CA with respect to the certificates it issues and is the subject CA with respect to the CA certificate issued to it. CAs may be organized in a hierarchy in which an organization's CA issues certificates to other CAs operated by subordinate organizations, such as a branch, division, or department within a larger organization. “Change Order” means a form of Contract amendment pursuant to Section 17 of the Contract that makes changes or modifications to the Statement of Work within the Scope of this Contract. “Confidential Information” is defined in Section 7.1 of the Contract. “Continuity of Care Document” (CCD) means the specification that is an XML-based markup standard intended to specify the encoding, structure and semantics of a patient summary clinical document for exchange. “Continuity of Care Record” (CCR) means the XML-based markup standard (ASTM E2369-05) and related standards for health data exchange. It is a way to create flexible documents that contain the most relevant and timely core health information about a patient, and to send these electronically from one caregiver to another. It contains various sections such as patient demographics, insurance information, diagnosis and problem list, medications, allergies and care plans. These represent a "snapshot" of a patient's health data that can be useful or possibly lifesaving, if available at the time of clinical encounter. “Coordinated Care Organization” (CCO) means a multi-specialty medical group, physician organization, or health system that strives to integrate and coordinate the work of a community of physicians and health care professionals to provide comprehensive outpatient services for patients. These health care professionals work in teams and are supported by the organization’s workflow processes, communications procedures, and payment systems to easily get patients the care they need when they need it. “Contract” means all terms and conditions herein and all Exhibits attached to the Contract. “Contractor Intellectual Property” means any intellectual property that is owned by Contractor and contained in or necessary for the use of the Deliverables or System. Contractor Intellectual
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 9 of 113

Property includes software (including Commercial Off the Shelf--COTS) owned by the Contractor, Documentation, and derivative works and compilations of any Contractor Intellectual Property. “DAS” means the Oregon Department of Administrative Services. “Day” or “Days” mean Business Days, unless otherwise specified. “Deliverables” means all Services and Work Product Contractor is required to deliver to Agency under the Contract, including Work Product. “Delivery Schedule” means that attribute of the Statement of Work setting forth the completion date of each Milestone and the delivery date for each Deliverable. “Directed Exchange” means a standard way to send messages incorporating security protocols and data transmission standards that is established or endorsed by the Office of the National Coordinator for Health IT. “Direct Project” means the national initiative that specifies a simple, secure, scalable, standards-based way to send authenticated, encrypted health information directly to known, trusted recipients over the Internet. The Direct Project focuses on the technical standards and services necessary to securely push content from a sender to a receiver and not the actual content exchanged. However, when these services are used by providers and organizations to transport and share qualifying clinical content, the combination of content and Direct-Project-specified transport standards may satisfy some Stage 1 Meaningful Use requirements. http://directproject.org/content.php?key=overview “Direct Messaging” or “Directed Messaging” means a message created and sent using the specifications and protocols defined by the Direct Project. “Documentation” means all documents, including documents that are Deliverables described in the Statement of Work and includes any and all operator’s and user’s manuals, training materials, guides, commentary, listings, requirements traceability matrices and other materials that are to be delivered by Contractor under this Contract. “DOJ” means the Oregon Department of Justice. “Electronic Exchange of Clinical Lab Results means the service that enables an HIE Participant to electronically order clinical lab tests and deliver clinical lab tests to another HIE Participant “Electronic Exchange of Patient Care Summaries” means the service that enables a HIO provider to electronically transmit a patient’s summary record to other providers and organizations including, at a minimum, diagnostic results, problem list, medication list, medication allergy list, and procedures. “Electronic Health Record” (EHR) or “Electronic Medical Record” (EMR) mean the collection and storage of relevant patient health information electronically. EHRs may include computerized physician order entry, electronic prescribing, and decision-support functionality to improve patient safety and quality of care.
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 10 of 113

“Electronic Healthcare Network Accreditation Commission” (EHNAC) means a nationally-recognized organization that provides security certification programs for Health Information Exchanges (HIEs) and Heath Information Service Providers (HISPs). http://www.ehnac.org/ “Electronic Prescribing” means the ability of an HIO provider to generate and transmit permissible prescriptions electronically. “Eligible Hospital” (EH) means a hospital that is considered eligible to be a Meaningful Use EHR user. “Eligible Professional” (EP) means a hospital-based health care professional that is considered eligible to be a Meaningful Use EHR user. “Effective Date” means the date on which the Contract is fully executed and approved according to applicable laws, rules and regulations. “Entity Level Provider Directory” (ELPD) means a centralized directory of entities that are HIE Participants that allows for the authentication and validation of participants to exchange health information. This type of provider directory will facilitate direct messaging to and amongst healthcare providers. “Federal Bridge” or “FBCA” means the US Federal Bridge Certification Authority. http://www.idmanagement.gov/fpkipa/drilldown_fpkipa.cfm?action=pa_welcome_page “Final Acceptance” is defined in Section 2.3.4 of the Contract. “Health Information Exchange” (HIE) means the act of exchanging electronic health information among clinical and population health settings. Oregon’s plan for statewide HIE will provide services to any and all HIE Participants in Oregon. “Health Information Exchange (HIE) Participant” means a party that is the sender or recipient of exchanged health information (i.e., party that initiates a transaction or the party to which the transaction is directed). The party may be an organization (e.g., provider, diagnostic laboratory testing company, health plan, HIO, CCO) or part of an organization. “Health Information Service Provider” (HISP) means both a function (the management of security and transport for Directed Exchange and an organizational model (an organization that performs HISP functions on behalf of the sending or receiving organization or individual; for example that provide health domains, health domain email addresses and services). “Health Information Technology Oversight Council” (HITOC) means the council created by Oregon House Bill 2009 to coordinate Oregon’s public and private statewide efforts in electronic health records adoption and the development of a statewide system for electronic health information exchange. "Health Information Technology Policy Committee" (HITPC) means the Office of the National Coordinator's Federal Advisory Committee on HIT Policy. The HITPC makes recommendations to the National Coordinator for Health IT on a policy framework for the development and adoption of a nationwide health information infrastructure, including standards for the exchange of patient medical information.
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 11 of 113

http://healthit.hhs.gov/portal/server.pt?open=512&objID=1269&parentname=CommunityPage &parentid=5&mode=2 "Health Information Technology Standards Committee" (HITSC) means the Office of the National Coordinator's Federal Advisory Committee on HIT Standards. The HITSC makes recommendations to the National Coordinator for Health IT on standards, implementation specifications, and certification criteria for the electronic exchange and use of health information. http://healthit.hhs.gov/portal/server.pt?open=512&objID=1271&parentname=CommunityPage &parentid=6&mode=2 “Health Information Organization” (HIO) means an organization that oversees and governs the exchange of health-related information among otherwise unaffiliated organizations according to nationally recognized standards. May also be referred to as an RHIO. “Health Information Security and Privacy Collaboration” (HISPC) HISPC refers to a multi-state, collaborative project funded by the Agency for Health Care Research and Quality. HISPC has worked to address the privacy and security challenges presented by electronic health information exchange across the country. “Health Information Technology” (Health IT or HIT) means the range of electronic or computerized tools, such as EHRs and a statewide HIE, that enable healthcare providers to access and share electronic health information. “Health Information Technology for Economic and Clinical Health Act” (HITECH) means Title XIII of Division A and Title IV of Division B of ARRA, which is the section of the ARRA stimulus bill under which $19.2 billion in funding for HIT was provided. HITECH adds adding a number of funding opportunities to advance HIT. The provisions of the HITECH Act are specifically designed to work together to provide the necessary assistance and technical support to providers, enable coordination and alignment within and among states, establish connectivity to the public health community in case of emergencies, and assure the workforce is properly trained and equipped to be meaningful users of EHRs. http://healthit.hhs.gov/portal/server.pt?open=512&objID=1487&mode=2 “Health Level 7” (HL7) refers to the ANSI-approved technology standards (http://www.hl7.org/implement/standards/ansiapproved.cfm?ref=nav) that define the format and content of messages health application systems may use to share information between disparate systems. “HIE Core Services” means the identified in the Oregon HIE Strategic and Operational Plans. HIE Core Services are: Trust Services, Provider Directories, and Direct Messaging Services. “HIE Participant” means any individual or organization that exchanges health information electronically, including healthcare providers, laboratories, hospitals, pharmacies, and patients. It includes ACO and CCO participants. Participation in HIE is not limited those individuals and organizations that qualify for Meaningful Use incentives. “HIEAP Certification” means the Health Information Exchange Accreditation Program Certification from the Electronic Healthcare Network Accreditation Commission (EHNAC), found online at: http://www.ehnac.org/index.php?option=com_content&view=article&id=57&Itemid=14.
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 12 of 113

“HIPAA Security Rule” means the federal regulations regarding privacy and security of Protected Health Information through the use of technology or methodology by means of encryption and destruction in accordance with 45 CFR Parts 160, 162, 164, including any future amendments. “Hospital” or Healthcare System” means an organization that: 1. Provides in-patient services; 2. Is not owned, maintained, or operated by the federal government or an agency of the federal government; and 3. Has a current state-issued hospital license and is in good standing with its hospital accreditation entity. “Identity-proofing:” See “Authentication. “Individual Level Provider Directory” (ILPD) means a centralized directory of individual HIE Participants that allows for the authentication and validation of participants to exchange health information. The provider directory will facilitate Directed Exchange to and amongst healthcare providers. “Intellectual Property Rights” is defined in Section 10.2 of the Contract. “Interoperable” or “Interoperability” means the ability of health information systems to work together within and across organizational boundaries in order to advance the effective delivery of healthcare for individuals and communities. “Key Persons” means Contractor’s Authorized Representative, the Project Manager and all other Contractor personnel designated in Exhibit E of the Contract. “Maximum Not-To-Exceed Compensation” is defined in Section 5.1 of the Contract. “Meaningful EHR User” means an entity that has met Meaningful Use criteria as defined by https://www.cms.gov/ehrincentiveprograms/. A Meaningful EHR user meets the following requirements: (i) use of a certified EHR technology in a meaningful manner, which includes the use of electronic prescribing; (ii) use of a certified EHR technology that is connected in a manner that provides for the electronic exchange of health information to improve the quality of health care; and (iii) use of a certified EHR technology to submit information on clinical quality and other measures as selected by the Secretary of HHS. “Meaningful Use” means the Incentive Program for Electronic Health Records as issued by the Centers for Medicare & Medicaid Services (CMS) and the Standards and Certification Criteria for Electronic Health Records a issued by the Office of the Nation Coordinator for Health Information Technology. Together these programs are the foundation for Meaningful Use Incentive Program that provides incentive payments to Eligible Professionals (EPs) and Eligible Hospitals (EHs). http://www.cms.gov/ehrincentiveprograms/ “Milestone” means a specific group or Tasks or Deliverables identified as a Milestone in the Statement of Work. “Nationwide Health Information Network” (NwHIN) means the organization being developed by the federal Department of Health and Human Services to provide an infrastructure for secure,
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 13 of 113

interoperable, nationwide health information exchange. See: http://www.hhs.gov/healthit/healthnetwork/background/ “Office of the National Coordinator for Health Information Technology” (ONC) means the program within the Office of the Secretary for the U.S. Department of Health and Human Services. ONCHIT is the federal entity responsible for coordination of nationwide efforts for implementation and use of electronic health information exchange. See: http://healthit.hhs.gov/portal/server.pt/community/healthit_hhs_gov__home/1204 “Operating Environment” means the hardware, programming languages, software (including operating system software), system architecture, and firmware necessary for the System to operate in accordance with its specifications. “Optional System Feature” or “Optional System Function” means a feature or function that Agency desires that the Oregon HIE Solution has, but is not considered to be a Mandatory Requirement. “Oregon Health Authority” (OHA) is the Oregon state agency created by House Bill 2009 to bring most health-related programs in the state of Oregon into a single agency to maximize its purchasing power. The OHA works with a nine-member, citizen-led board called the Oregon Health Policy Board. “Oregon Health Information Technology Extension Center” (O-HITEC) means Oregon’s Regional Extension Center. “Participant” means an HIE Participant using the services of the Oregon HIE Solution. “Patient Protection and Affordable Care Act” (ACA or PPACA) means PL 111-148, as defined by which is the federal statute signed into law by President Obama on March 23, 2010. The laws focus on reform of the private health insurance market, provide better coverage for those with pre-existing conditions, improve prescription drug coverage in Medicare and extend the life of the Medicare Trust fund by at least 12 years. http://www.healthcare.gov/law/introduction/index.html “PCI Data Security Standards” (PCI-DSS) means the current standards promulgated by the PCI Security Standards Council, which offers standards and supporting materials to enhance data security. https://www.pcisecuritystandards.org/security_standards/ “Protected Health Information” (PHI) is defined under HIPAA at 45 CFR 160.103, and means any information about health status, provision of healthcare, or payment for healthcare that can be linked to a specific individual. “Physician” means all physicians licensed with the Oregon Medical Board that are actively practicing. Locum Tenens, those that indicate “Not in Practice” in the Directed Exchange Practice Address field, and those with a Practice Type of “Not in Practice” or “Unknown” are excluded. “Privacy” means the definition in the ONC’s December 15, 2008 “Nationwide Privacy and Security Framework for Electronic Exchange of Individually Identifiable Health Information:” “An individual’s interest in protecting his or her individually identifiable information and the corresponding obligation of those persons and entities that participate in a network for the
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 14 of 113

purposes of electronic exchange of such information, to respect those interests through fair information practices.” “Project Manager” unless otherwise specified, means Contractor’s representative who manages the processes and coordinates the Services with Agency’s Authorized Representative to ensure delivery of the Deliverables and completion of Milestones. Contractor’s Project Manager is the person so identified in Exhibit E of the Contract. “Proposal” means the successful Proposer’s final proposal in response to the RFP. Provider Directories: means both the Entity-Level Provider Directory (ELPD) and the Individual-Level Provider Directory (ILPD). “Public Key Infrastructure” (PKI) means the a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. A PKI is an arrangement that binds user identities by means of a Certificate Authority (CA). The user identity must be unique within each CA domain. The binding is established through the registration and issuance process, which, depending on the level of assurance the binding has, may be carried out by software at a CA, or under human supervision. The PKI role that assures this binding is called the Registration Authority (RA). “Quality Assurance Contractor” (QA Contractor) refers to the contractor engaged by Agency to perform quality management services for Agency relating to the Oregon HIE Solution. “Regional Extension Center” (REC) is defined at the ONC’s website http://healthit.hhs.gov/portal/server.pt/community/hit_extension_program/1495/home/17174 as organizations which “support and serve healthcare providers to help them quickly become adept and meaningful users of electronic health records (EHRs). RECs are designed to make sure that primary care clinicians get the help they need to use EHRs.” Regional Extension Centers provide critical hands-on support to providers adopting electronic health records and beginning to use a statewide HIE. “Regional Health Information Organization” (RHIO) means a HIO that brings together health care stakeholders within a defined geographic area and governs health information exchange among them for the purpose of improving health and care in that community. “Registration Authority” (RA) is an entity that is responsible for one or more of the following functions in a PKI model: the identification and authentication of certificate applicants, the approval or rejection of certificate applications, initiating certificate revocations or suspensions under certain circumstances, processing subscriber requests to revoke or suspend their certificates, and approving or rejecting requests by subscribers to renew or re-key their certificates. RAs, however, do not sign or issue certificates (i.e., an RA is delegated certain tasks on behalf of a CA). The term Local Registration Authority (LRA) is sometimes used for the same concept. “RFP” means this Request for Proposal 3261. "S & I Framework" means the ONC Standards and Interoperability Framework. The S & I Framework is a set of integrated functions, processes, and tools being recommended by the healthcare and technology industry to achieve harmonized interoperability for healthcare information exchange.
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 15 of 113

“Schedule of Deliverables” means that attribute of the Statement of Work that describes each Task, and Deliverable, measurable attributes of each Deliverable and Milestone with identification of the Services activities that are associated with them, and a completion date for each Milestone and Deliverable. “Services” means all effort to be expended by Contractor as set forth in the Statement of Work and the Subscription Agreement, including but not limited to the Subscription Services, and other services such consulting, implementation, configuration and customization to be provided to Agency by Contractor under this Contract. “Services Retention Amount” is defined in Section 5.3.1 of the Contract. “State Designated Entity” (SDE) means the entity designated by the state as eligible to receive grant funds from the ONC State HIE Cooperative Agreement Program. The SDE may be a public or private entity. “Software” is an all-inclusive term that refers to any computer programs, routines, and subroutines that are supplied by the Contractor, including Software as a Service, operating software, programming aids, application programs, and software products. “Software as a Service” “SaaS Software Application” and “SaaS Software” mean the computer software listed in Exhibit A to which Provider has granted Client access and use as part of a subscription. This includes any customization, other derivative works, upgrades, releases, fixes, patches, etc. related to the software that Provider develops or deploys during the term of this Contract, together with all documentation provided by or otherwise required of Provider for any of the software, customization, other derivative works, upgrades, releases, fixes, patches, etc. “State HIE Cooperative Agreement Program” means the grant program initiated by the HITECH Act to fund state, territory, or SDE efforts to rapidly build capacity for exchanging health information across the health care system both within and across states by planning and implementing HIEs. The State Health Information Exchange Cooperative Agreements Program was authorized by Section 3013 of the PHSA as amended by ARRA. Additional information can be found at: http://statehieresources.org/ “Statement of Work” means the document that describes the Services to be provided by Contractor including the Tasks, Deliverables and Milestones, the measurable attributes of each Deliverable, identification of the Deliverables and Services that are associated with each Task, and a completion date for each Milestone and Deliverable, the Payment Schedule for each Deliverable and Milestone, and any other items as agreed by the parties including Amendments. “Subscription Agreement” is the agreement governing the use of the Subscription Services set forth in Exhibit G, attached to this Contract and incorporated by this reference. “Subscription Services” means Agency’s access to and use of and Contractor’s provision of the SaaS Software Applications. “System” means the array of software-based Services and outcomes provided by Contractor as the “Oregon HIE Solution.” The System is the sum of the Services, Developments, Contractor Intellectual Property, Software, COTS Software, Hardware, and Documentation described in the Statement of Work that comprise the information system that Contractor will deliver, configure, and implement under the Contract.
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 16 of 113

“Task” means a segment of the Services to be provided by Contractor under the Contract. “Third Party Intellectual Property” means any intellectual property owned by parties other than Agency or Contractor and contained in or necessary for the use, or optimal use, of the Deliverables. Third Party Intellectual Property includes COTS Software owned by Third Parties, and derivative works and compilations of any Third Party Intellectual Property. “Trust Services” means the combined technical and business practices that the successful Proposer will deliver to protect Personal Health Information (PHI), via strong information security in Directed Exchange. These include the HIPAA Security Rule and sections of the PCI Data Security Standards (PCI-DSS) relevant and consistent with the HIPAA Security Rule. “Warranty Period” means the period that begins upon execution of this Contract, and ends 365 calendar days after the date of Final Acceptance. “Work Product” means every invention, modification, discovery, design, development, customization, configuration, improvement, process, software program, work of authorship, documentation, formula, datum, technique, know-how, secret, or intellectual property right whatsoever or any interest therein (whether patentable or not patentable or registerable under copyright or similar statutes or subject to analogous protection) that is specifically made, conceived, discovered, or reduced to practice by Contractor or Contractor’s subcontractors or agents (either alone or with others) pursuant to the Contract. Notwithstanding anything in the immediately preceding sentence to the contrary, Work Product does not include any Agency Intellectual Property, Contractor Intellectual Property or Third Party Intellectual Property. 1.5 Authority DHS issues this RFP under the authority of Department of Administrative Services (DAS) Delegation 306-08 (as amended), Non-Client Services.

SECTION 2 – MINIMUM QUALIFICATIONS
Proposers must meet all of the following minimum qualifications: 2.1 Demonstrate in its Technical Proposal that Proposer, its Key Persons, or proposed subcontractors have at least 5 years’ experience in the HIT industry. Demonstrate in its Technical Proposal that Proposer, its Key Persons, and/or proposed subcontractors have a minimum of one HIE deployment for each of the HIE Core Services (Trust Services, Provider Directories, and Directed Exchange Services) within the past three years. Demonstrate in its Technical Proposal that Proposer, its Key Persons, and/or proposed subcontractors have a minimum of two years experience working in healthcare information exchange services providing operations and support for each of the Core HIE Services listed in this RFP.

2.2

2.3

SECTION 3 – SCOPE OF WORK
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 17 of 113

The successful Proposer shall deliver a hosted Oregon HIE Solution that will allow OHA to provide a HISP to enable statewide HIE. The successful Proposer shall configure, test, and implement HIE Core Services, and support and maintain an Oregon HIE Solution that complies with the key principles discussed in Section 1.3 of this RFP. The successful Proposer’s services shall include the HIE Participant and maintenance and support described in this Scope of Work. Components of the Oregon HIE Solution may be provided directly by the successful Proposer or by one or more authorized subcontractors. HIE Core Services must be available to all EPs and EHs in time for EPs and EHs to meet Stage 1 Meaningful Use criteria on or before December 31, 2011. Proposer must perform in accordance with the highest standards prevalent in the project management, solutions development, system deployment, and product support fields. The Agency-designated HIE Project Manager will be the successful Proposer’s primary point of contact during the course of performance. 3.1 HIE Core Services The successful Proposer shall deliver Core HIE Services that meet or exceed the below-listed minimum requirements. 3.1.1 Trust Services The successful Proposer shall provide Trust Services that provide the framework and controls for secure HIE. “Trust Services” are the technical and business practices, and related business services, that protect Personal Health Information (PHI), via strong information security in Directed Exchange activities. The Trust Services component of the successful Proposer’s HIE Core Services will include at least the Business Services described below, and meet at least the Technical and Business Standards below. 1. Business Services: a. Certificate Authority. The successful Proposer shall provide Certificate Authority services for Oregon HIE Participants. Certificate Authority services include issuing and managing x.509v3 digital certificates. b. Registration Authority Support. The successful Proposer shall provide services in support of the OHA's role as a Registration Authority for Participants. Such services may include: i. Collection of information required for organizational or individual identity verification (i.e., identity proofing) ii. Assistance with validation or identity proofing of Participants c. HIE Participant Qualification and Enrollment Process. The successful Proposer shall administer the OHA-approved HIE Participant Qualification Program, including the HIE Participant enrollment process, in accordance with OHA-approved processes. These will include at least processes and procedures necessary to populate and maintain the ELPD and ILPD. Services must include gathering information and listing entities and individuals in each Provider Directory, and enrolling HIE Participants for HIE Messaging Services. i. The successful Proposer’s enrollment process may facilitate its Registration Authority support role, depending on the operational characteristics of the enrollment tools and processes. OHA will retain the Registration Authority role and final approval of Participants for listing in the Provider Directories. ii. The successful Proposer will provide consultation services to OHA to finalize standards, procedures, and processes for the HIE Participant Qualification Program, including
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 18 of 113

processes and procedures for the HIE Services Enrollment program, and as other processes and procedures necessary for the successful Proposer’s Registration Authority role. 2. Technical and Business Standards. a. Security Standards. The successful Proposer shall maintain compliance with the the security standards specified in Section 3.2.3.4, and the below-listed security standards for its Trust Services (as the standards exist as of the Effective Date of the Contract, and then as amended or updated, throughout the course of performance: i. HIPAA Security Rule. ii. Sections of the PCI Data Security Standards (PCI-DSS) that are relevant and consistent with the HIPAA Security Rule. b. HIEAP Certification Activities. The successful Proposer shall complete at least a HIEAP selfassessment for its Trust Services on or before the Statewide Services Implementation date referenced in Section 3.4. Information on HIEAP (Health Information Exchange Accreditation Program) Certification from the Electronic Healthcare Network Accreditation Commission (EHNAC) can be found online at: http://www.ehnac.org/index.php?option=com_content&view=article&id=57&Itemid=14. c. Best Practices. Trust Services must be provided in accordance with Direct Project Best Practices, found online at http://wiki.directproject.org/Best+Practices+for+HISPs, as they exist as of the Effective Date of the Contract, and then as amended or updated, throughout the course of performance. d. HIPAA Business Associate Agreements. As per the Direct Project Best Practices for HISPs (http://wiki.directproject.org/Best+Practices+for+HISPs), the successful Proposer is required to have HIPAA Business Associate Agreements (BAAs) with Participants that are HIPAA Covered Entities and shall ensure that any agent, including any subcontractor, to whom it provides PHI received from, or created or received by the Proposer on behalf of a Covered Entity agrees to the same restrictions and conditions that apply to a Business Associate with respect to such information. 3.1.2 Provider Directories The successful Proposer shall provide two types of Provider Directories: an Entity Level Provider Directory (ELPD) and an Individual Level Provider Directory (ILPD). Both will be used in support of Directed Exchange Services. OHA’s presumption is that both directories will be centralized. These Provider Directories will distinguish between organizations and individual health information providers that participate in HIE, and will allow (participants to locate and send messages to providers within the Oregon HIE Solution. The Provider Directory component of the successful Proposer’s HIE Core Services will include at least the Business Services described below, and meet at least the Technical and Business Standards below. 1. Business Services a. User Tools and Support. The successful Proposer’s Provider Directories must include the tools and infrastructure (e.g. a web-based form and supporting business processes) necessary for HIE Participants to enroll in and be qualified for access and use of Oregon’s HIE Solution. c. Directed Exchange Services. The successful Proposer’s Provider Directories must support and facilitate the Directed Exchange Services described in Section 3.1.3, including the ability of Participants to search for, locate, and transmit messages to and receive messages from other Participants. d. Reporting. The successful Proposer’s Provider Directories must generate OHA-approved standardized and ad-hoc reports to track and assess HIE participation, including the number of
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 19 of 113

e.

f.

Participants listed in each directory, age of information associated with Participants, and additional reporting capabilities necessary for assessment by OHA and its federal partners. For purposes of this RFP, Proposers may assume that utilization reports will be generated monthly. Population of Provider Directories. The successful Proposer shall populate and maintain entries in the ELPD and the ILPD using Participant Qualification and Enrollment services discussed in Section 3.1.1, Trust Services. Application Programming Interfaces (APIs). The successful Proposer's Provider Directories must support import and export of information for entities and individuals using open and documented APIs.

2. Technical and Business Standards. a. Security Standards. The successful Proposer’s Provider Directories must conform to the security standards specified in Section 3.2.3.4. b. Trust Framework. The successful Proposer’s Provider Directory services must be provided within the framework of the successful Proposer’s Trust Services. c. The successful Proposer shall maintain compliance with the below-listed standards for its Provider Directories as the standards exist as of the Effective Date of the Contract, and then as amended or updated, throughout the course of performance: i. S&I Framework Provider Directories Initiative standards, specifications, and schema: (http://wiki.siframework.org/PD+-+Sprint+Team). ii. HIT Standards Committee standards, specifications, and schema: (http://healthit.hhs.gov/portal/server.pt/community/healthit_hhs_gov__health_it_standard s_committee/1271). The June 22, 2011, recommendations from the HIT Standards Committee specify: (a) Provider Directories to structure and encode information within web pages using standard schema and vocabulary (i.e., Semantic Web support). (b) Provider Directories to support queries via standard web search. (c) DNS as the mechanism used to retrieve digital certificates for published service address names (including Direct Project addresses) embedded in the Provider Directories web pages. d. Entity-Level Provider Directory (ELPD). Oregon estimates a range of 200 to 5,000 entities that are HIE Participants will be listed in the ELPD. The type of entities whose information will be included in the ELPD will be approved by OHA. Entities whose information will be in the ELPD include: i. Health care provider organizations (i.e., hospitals, clinics, nursing homes, pharmacies, labs, etc.), ii. Other health care organizations (i.e., health plans, public health agencies), iii. Health Information Organizations (i.e., regional HIE operators, health information service providers), and iv. Other organizations involved in the exchange of health information (business associates, clearinghouses). e. Individual Level Provider Directory (ILPD). OHA estimates that approximately 50,000 individual HIE Participants will be listed in the ILPD. The type of individuals whose information will be included in the ILPD will be approved by OHA. i. The ILDP must include technical and policy limitations on access to potentially sensitive identifiers (such as state license numbers, DEA numbers, etc.) to minimize the risk of fraud and identity theft. ii. The types of Individual Providers listed in the ILPD must conform to federal and state rules on who is licensed or otherwise authorized to provide health care services, or
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 20 of 113

individuals authorized to provide or access health information, e.g., public health workers. 3.1.3 Directed Exchange Services The successful Proposer shall provide messaging services as Directed Exchange Services that provide all Oregon HIE Participants at least one option for exchanging health information across unaffiliated organizations. The Directed Exchange Services component of the successful Proposer's HIE Core Services will include at least the Business Services described below, and meet at least the Technical and Business Standards below. 1. Business Services. a. The successful Proposer's Directed Exchange Services must be made available to any and all Oregon HIE Participants, regardless of their eligibility for Meaningful Use incentives or their participation in HIOs or ACOs/CCOs. b. The successful Proposer shall offer access to its Directed Exchange Services via: i. A web portal branded for the Oregon HIE, and ii. HIE Participants' EHR systems. c. The successful Proposer shall maintain and operate Directed Exchange Services as a Direct Project HISP (Health Information Service Provider), including: providing and managing Participant health domains, providing and managing Participant Direct Addresses, providing Direct message mailboxes for Participants, and publishing Participant digital certificates. d. Reporting. The successful Proposer's Directed Exchange Services must generate OHA-approved standardized and ad-hoc administrative reports to track and assess HIE participation, including the number of assigned Direct Exchange addresses, number of Direct Exchange messages sent, number of Direct Exchange messages received, activity for a Direct Exchange address or Direct Exchange domain (e.g., number of messages sent and received, addresses and domains to which messages were sent or received) and additional reporting capabilities necessary for assessment by OHA and its federal partners. 2. Technical and Business Standards. a. Security Standards. The successful Proposer's Directed Exchange Services must conform to the security standards specified in Section 3.2.3.4. b. Trust Framework. The successful Proposer's Directed Exchange Services must be provided within the framework of the successful Proposer's Trust Services. c. Direct Project Specifications and Best Practices. The successful Proposer's Directed Exchange Services must be provided as Direct Project HISP (Health Information Service Provider) services in accordance with the below-listed Direct Project specifications and Best Practices, as those standards and Best Practices exist as of the Effective Date of the Contract, and then as they are amended or updated, throughout the course of performance: i. Support for all Direct Project user stories: http://wiki.directproject.org/User+Stories. ii. Specifications for Secure Health Transport as defined in the Direct Project's Applicability Statement for Secure Health Transport (http://wiki.directproject.org/Applicability+Statement+for+Secure+Health+Transport), including supporting certificate discovery via DNS as specified in that document. iii. Interoperability with IHE-based (Integrating the Healthcare Enterprise) statewide HIE Participants. Such interoperability will be via Direct Project specifications for XD* Conversion (also known as "step-up/ step-down") as detailed in the Direct Project's XDR and XDM for Direct Messaging (http://wiki.directproject.org/XDR+and+XDM+for+Direct+Messaging).
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 21 of 113

d.

Addressing and transport specifications for the Direct Project as listed at: http://wiki.directproject.org/Specifications+and+Service+Descriptions v. Direct Project's Best Practices for HISPs: (http://wiki.directproject.org/Best+Practices+for+HISPs). Web Portal. The successful Proposer's Directed Exchange Services must be accessible via a web portal that supports branding for the Oregon HIE. The web portal at minimum must enable Participants to: receive and access stored Direct Exchange messages, construct new Direct Exchange messages, attach any number of structured and unstructured documents (regardless of format) to these messages, send constructed Direct Exchange messages, and access the successful Proposer's Provider Directory Services to look up and select Direct Addresses of desired Direct Exchange message recipients. Minimum Oregon HIE System Support Requirements

iv.

3.2

The successful Proposer shall provide business services supporting OHA staff and HIE Participants’ use of the successful Proposer’s HISP services, and maintenance and support for the Oregon HIE Solution. Services may be provided in accordance with one or more service level agreements, which will be incorporated into the Contract. 3.2.1 HIE Participant Services

The successful Proposer shall support the enrollment, engagement, and use of the HIE Core Services by HIE Participants. Deliverables for this Task must be developed iteratively in consultation with the HIE Program Manager, other OHA-approved staff, and other contractors, and meet the final Schedule of Milestones summarized in Section 3.4 of this Scope of Work. These HIE Participant Services must include at least: 1. Outreach and Engagement. The successful Proposer shall conduct outreach to HIE Participants to educate them about and engage them in the services offered through the Oregon HIE Solution, in accordance with an OHA-approved Outreach and Engagement Plan (Deliverable 1). The successful Proposer shall update this Deliverable at least annually to address refinements to services, any additional services, and developments in HIE Core Services. a. This Plan must include a schedule of activities, Key Person(s) and other persons responsible for the work, estimates of time (hours or FTE) to complete the work, coordination of activities with O-HITECH, and for the initial Contract period, specifically address support for EPs and EHs to achieve Meaningful Use by December 31, 2011. b. Services will include OHA-approved outreach and marketing campaigns developed by the successful Proposer to increase enrollment and utilization of HIE Core Services. The successful Proposer shall develop and deliver materials for use in these campaigns, which may include web-based information, materials for in-person presentations, and other documentation developed in support of OHA-approved outreach strategies. The successful Proposer shall deliver all final materials as Deliverable 2, Outreach and Engagement Materials. The successful Proposer shall update this Deliverable at least annually. Business Services described in Section 3.1.1, Trust Services, 3.1.2, Provider Directories, and 3.1.3, Directed Exchange Services. The successful Proposer shall develop and deliver materials that document the successful Proposer’s processes and procedures as Deliverable 3. Requirements for these materials will be negotiated with the successful Proposer, but must at
Page 22 of 113

2.

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

least comply with the final OHA-approved service requirements and framework. The successful Proposer shall update this Deliverable at least annually to address refinements to services, any additional services, and developments in HIE Core Services. 3. Training. The successful Proposer shall provide training to HIE Participants, OHA staff, and OHA-designated contractors in accordance with an OHA-approved Training Plan (Deliverable 4). This Training Plan must include a training schedule, estimated number of trainees via each modality, Key Person(s) and other staff responsible for the work, and curriculum materials. The successful Proposer shall update this Deliverable at least annually to address refinements to services, any additional services, and developments in HIE Core Services. Training may be offered as online support, phone and email support, on-site training, or any combination thereof. At a minimum, training topics must include: a. Enrollment b. HIE Services c. Registration d. Managing ILPD/ELPD entries e. Updating ILPD/ELPD entries f. Logging into the system g. Sending and receiving secure messages Customer Service. The successful Proposer shall provide customer service and support, in accordance with any service level agreement incorporated into the Contract (or as otherwise agreed upon in the Contract), for the Customer Service elements described in Section 3.2.3, Maintenance and Support Services. Deliverable 1: The successful Proposer shall prepare and submit an Outreach and Engagement Plan within 20 days of receiving a Notice to Proceed (or as otherwise negotiated and approved by OHA) and annually thereafter. Contractor must obtain written approval of the Project Plan from the HIE Program Manager before commencing work under the Plan. Any Plan updates or revisions shall be submitted to and approved in writing by the HIE Program Manager. Deliverable 2: The successful Proposer shall prepare and submit Outreach and Engagement Materials no later than 45 days after receiving a Notice to Proceed (or as otherwise negotiated and approved by OHA) and annually thereafter. Contractor must obtain written approval of the Deliverable from the HIE Program Manager before utilizing the Deliverable. Any Deliverable updates or revisions shall be submitted to and approved in writing by the HIE Program Manager. Deliverable 3: The successful Proposer shall prepare and submit HIE Participant Services Materials by a date (or dates, if delivery is phased) to be negotiated with the successful Proposer and approved by OHA, and annually thereafter. Contractor must obtain written approval of the Deliverable from the HIE Program Manager before commencing work under the Deliverable. Any Deliverable updates or revisions shall be submitted to and approved in writing by the HIE Program Manager. Deliverable 4: The successful Proposer shall prepare and submit a Training Plan, inclusive of curriculum materials, by a date to be negotiated with the successful Proposer and approved by OHA, and annually thereafter. Contractor must obtain written approval of the Deliverable from the HIE Program Manager before commencing work under the Deliverable. Any Deliverable updates or revisions shall be submitted to and approved in writing by the HIE Program Manager.
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 23 of 113

4.

Acceptance Criteria: Each Deliverable must meet its requirements specified in this Task, and all other Contractual requirements, including Performance Warranties (Section 8.2 of the Contract). Agency will review the received Deliverable in accordance with Section 2.3 of the Contract. 3.2.2 Configuration and Implementation Services

The successful Proposer shall provide configuration and implementation services for the Oregon HIE Solution that meet the final Schedule of Milestones in Section 3.4 of this Scope of Work. The successful Proposer will conduct implementation activities in compliance with the OHA-approved Project Implementation Plan. The successful Proposer’s Project Implementation Plan will comply with the Project Management Institute’s Project Management Body of Knowledge (PMBOK). All Deliverables will be developed iteratively in consultation with the HIE Program Manager. Tasks include at least: 1. Developing Deliverable 5, Project Implementation Plan, and updating the Plan at the request of the HIE Program Manager. The Plan must incorporate and comply with the final Schedule of Milestones summarized in Section 3.4 of this Scope of Work. The Project Implementation Plan must address: a. Tasks for configuring and implementing HIE Core Services, and developing and delivering the Deliverables required under Section 3.2.1, HIE Participant Services. b. Acceptance Testing. OHA anticipates a phased rollout of services, including two stages of testing activities (“alpha” and “beta” testing). Elements of the Project Implementation Plan addressing Acceptance Testing must include the successful Proposer’s testing plan, service level agreements for use during Acceptance Testing (if specific to testing activities), change management plan, and processes for addressing feedback from Participants, OHA, and OHA-designated contractors. OHA designated contractors will include technical consultants and the OHA QA Contractor. c. Rollout of HIE Participant Services. d. How and when HIE Core Services would be available to allow EPs and EHs to meet Stage 1 Meaningful use criteria on or before December 31, 2011. e. Statewide Services Implementation launch plan. The successful Proposer will complete configuration and installation activities required to commence Acceptance Testing on the date specified in the final Schedule of Milestones in Section 3.4 of this Scope of Work Acceptance Testing. The successful Proposer will begin providing the HIE Core Services and Participant Support Services, in accordance with any service level agreements, on or around November 14, 2011. This “go live” date will begin Acceptance Testing for the Oregon HIE Solution. a. Acceptance Testing will be conducted with an OHA-approved set of HIE Participants. For purposes of this RFP, Proposers may assume that testing group(s) will consist of at least one HIE Participant from each type of HIE Participant (see Attachment 6). b. OHA anticipates that Acceptance Testing will be a phased implementation of the Oregon HIE Solution, with at least two stages (“alpha” and “beta” tests). Implementation and testing will be negotiated with the successful Proposer. For purposes of this RFP, OHA anticipates that the successful Proposer shall administer an initial testing phase, and then incorporate feedback from Participants into and administer at least a second testing
Page 24 of 113

2.

3.

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

c.

phase. The “beta” test phase will include a greater number of Participants than the “alpha” test phase. The successful Proposer will develop and deliver implementation artifacts as Deliverable 6. Implementation Artifacts must include: service level agreement performance metrics; compiled feedback from Participants, OHA, and OHA-designated contractors; and documentation demonstrating feedback was evaluated and incorporated (as appropriate and agreed to by OHA) into the Oregon HIE Solution on or before Statewide Services Implementation.

4.

Statewide Services Implementation. The successful Proposer will begin providing the HIE Core Services and HIE Participant Support Services to all OHA-authorized HIE Participants on or around March 30, 2012. Deliverable 5: The successful Proposer shall prepare and submit a Project Implementation Plan within 15 days of receiving a Notice to Proceed. Contractor must obtain written approval of the Project Plan from the HIE Program Manager before commencing work under the Plan. Any Plan updates or revisions shall be submitted to and approved in writing by the HIE Program Manager. Deliverable 6: The successful Proposer shall prepare and submit Implementation Artifacts by a date to be negotiated with the successful Proposer and approved by OHA. Acceptance Criteria: Each Deliverable must meet its requirements specified in this Task, and all other Contractual requirements, including Performance Warranties (Section 8.2 of the Contract). Agency will review the received Deliverable in accordance with Section 2.3 of the Contract.

3.2.3

Maintenance and Support Services

The successful Proposer shall provide technical and business support for the Oregon HIE Solution. 1. Service Levels. The successful Proposer shall provide maintenance and support services in accordance with the service level agreement(s) that will be incorporated into the Contract, or as otherwise agreed upon in the Contract. Any service level must address at least the elements described in this Section, and include commitments for each service level, capabilities for tracking and reporting performance, and other information necessary for determining service level performance for the Oregon HIE Solution. Business Support Services. The successful Proposer shall provide business services sufficient to reliably operate the Oregon HIE Solution and provide account management services, including the following: i. Key Persons. OHA anticipates that the successful Proposer shall provide at least the following Key Persons to provide account management and oversight: (a) Account Manager or Program Manager (b) Quality Control Manager (c) Compliance Manager (including Security) (d) HIE System Configuration Manager (e) System and Web Architect (f) Customer Engagement/Outreach Manager

2.

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 25 of 113

ii.

iii. iv.

Reports. The successful Proposer shall provide monthly usage reports and performance reports to the HIE Program Manager. Content of the reports shall be negotiated with the successful Proposer. The successful Proposer shall provide timely notification to the HIE Program Manager of any challenges or issues with HIE Participants. Customer Service. Minimum requirements for customer service for OHA staff and HIE Participants are: (a) Toll-free telephone customer and technical support. (b) Telephone customer and technical support availability offered at least during normal business hours (8am-5pm, Monday through Friday, Pacific Time). (c) 24x7 emergency telephone support access to OHA representatives. (d) Web-based technical and customer support resources. (e) Single point of contact assigned to OHA for problem tracking and resolution. (f) Guaranteed technical and customer support response time.

3.

Technical Services Requirements. a. Maintenance. The successful Proposer shall perform regular and routine maintenance of the hardware and software associated with the Oregon HIE Solution. Maintenance notifications shall be distributed via email no less than 7 calendar days prior to scheduled maintenance and as soon as reasonably possible prior to unscheduled maintenance. b. Upgrades. The successful Proposer shall install upgrades to the software associated with the Oregon HIE Solution as approved by OHA. New versions of Oregon HIE components that are issued by the successful Proposer within the first Contract year (365 days following Effective Date) will be implemented as part of the Oregon HIE within 60 calendar days of release as upgrades at no additional cost to OHA. c. Response Time. Response time to connect with Proposer's web-based modules should support optimal User-Computer Interaction (UCI) experience, such as 3 seconds or less for no less than 90% of the time, 24 hours per day, 7 days per week, less Excluded Down Time agreed to by OHA. d. Access. Oregon HIE Solution components must be accessible via industry standard browsers, or at least the current versions plus at least one previous release of Microsoft Internet Explorer, Firefox, Google Chrome, Safari, and Opera. e. Excluded Down-Time. Excluded Down-Time is the number of minutes of any planned or scheduled down-time, inclusive of a three-hour standard maintenance window once per week, such as Mondays from 12:00am to 3:00am, Pacific Time. OHA will receive no less than 24 hours advance notice of any planned or scheduled down-time required outside the standard maintenance window, and immediate notice of any emergency down-time. The successful Proposer will negotiate with Agency for time of any additional down-time whenever the total number of down-time hours outside the standard maintenance window exceeds 7 hours per calendar month. Clustered servers are to be measured together as a single unity for calculating down-time measurements. Hosting and Security. The successful Proposer shall host the systems associated with the Oregon HIE Solution, and comply with all privacy and security requirements for the operation of an HIE. a. At a minimum the successful Proposer shall: i. Employ automated system monitoring to ensure service availability and to detect anomalous system behavior and service interruptions. ii. Examine system and error logs at least daily to minimize and predict system problems and initiate appropriate action.
Page 26 of 113

4.

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

iii.

b.

c.

Host the systems associated with the Oregon HIE Solution on dedicated hardware (e.g., not on a partitioned server), meaning no server is shared with any other client of Proposer. iv. House all servers and equipment in an operational environment that meets OHAaccepted industry standards, including climate control, fire and security hazard detection, electrical needs, and physical security. v. Provide a technical architecture that ensures private and secure HIE using Direct Project specifications, including those for NwHIN participants, HIEs located in other states, and with multiple EHR systems. vi. Meet at least the hosted security requirements listed in Section 2 of Attachment 8, Vendor Hosting Requirements, including access, authentication, authorization and audit. vii. Secure all Protected Health Information through the use of technology or methodology by means of encryption and destruction in accordance with 45 CFR Parts 160, 162, 164. This includes notification and accounting of disclosures of PHI. viii. Certify that Proposer will not sell or otherwise share any data it receives access to or maintains as part of the Oregon HIE Solution, or any of its participating HIE Participants, facilities, and consumers, to any third party. ix. Ensure protections against unauthorized third parties accessing user information or monitoring use of services are in place at all times, including security measures to protect against unauthorized access, such as: (a) Protecting data in transit through the use of network encryption via SSL/TLS. (b) Providing the capability to restrict access to system components and functions to specific users or groups of users. The Oregon HIE Solution must adhere to state and federal laws and regulations, and DHS, OHA, and DAS policies for IT services and security (CIPA, HIPAA, CCC, IPV6), as summarized in Attachment 8, and as those laws, regulations, and policies are updated. The successful Proposer shall complete an EHNAC self-assessment of all Pass/Fail requirements with a plan to have all Pass/Fail requirements completed prior to the System Implementation Date listed in Section 3.4.

5.

Business Continuity and Disaster Recovery. The successful Proposer shall ensure that the Oregon HIE Solution is protected against natural disasters, hardware and software failures, human error, and other contingencies that could interrupt services. The successful Proposer shall maintain a Business Continuity Plan (BCP) that includes a Disaster Recovery Plan. The BCP may be provided either as a service level agreement or as a deliverable. a. The BCP must be reviewed and updated by the successful Proposer at least annually to ensure it is up to date with services and best practices. b. The successful Proposer shall test its BCP at least annually. c. The BCP must address recovery of business functions, human resources, and technology infrastructure associated with the Oregon HIE Solution, including at least the following: i. Threat considerations -- including natural, technical, and human -- with impact assessments. ii. Strategies for recovery of facilities, hardware, software, data, customer services, and key personnel responsible for the strategies. iii. Procedures to recover facilities, hardware, software, data, customer services, and key personnel responsible for the procedures. iv. Data backup, retention, and restoration.
Page 27 of 113

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

v.

Testing procedures for the BCP.

3.3 Optional Services and Tools The successful Proposers may be requested to propose additional Oregon HIE Solution components that support the expansion of statewide HIE and related communications with federal agencies, and support other federal and state HIT initiatives. OHA also anticipates that other services will be offered in the community (e.g., repositories and applications). Agency may elect to include none or one or more of the proposed optional services in the initial Contract period. The successful Proposer may also be requested to provide a supplemental proposal for one or more additional components during the Contract period. Agency reserves the right to seek resources other than those proposed by the successful Proposer to support the HIE activities referenced in this section. Proposers are requested to provide information on products that support these functions, and information on the interfacing methods used to support the functionality (including API): 1. Federal Bridge. The successful Proposer may be required to be “cross-certified” by the Federal Bridge Certification Authority (FCBA). Direct-Based Standards to Communicate with Federal Agencies. The successful Proposer’s Oregon HIE Solution may be required to comply with technology and process requirements promulgated by the following, for purposes of allowing Participants to communicate with federal agencies: a. Direct Project community (http://wiki.directproject.org/Direct+Federal+Community), b. S&I Framework Certificate Interoperability Initiative (http://wiki.siframework.org/Certificate+Interoperability), and c. the HIT Policy Committee Privacy & Security Tiger Team (http://healthit.hhs.gov/portal/server.pt?open=512&mode=2&objID=2833&PageID=19421). Master Person Index (MPI). The successful Proposer may be requested to provide services relating to MPI. MPI is a database that maintains a unique index (or identifier) for every patient registered at a health care organization. The MPI is used by each registration application (or process) within the HCO to ensure a patient is logically represented only once and with the same set of registration demographic / registration data in all systems and at an organizational level. It can be used as enterprise tool to assure that vital clinical and demographic information can be cross-referenced between different facilities in a health care system. An MPI correlates and cross-references patient identifiers and performs a matching function with high accuracy in an unattended mode. An MPI is considered an important resource in a healthcare facility because it is the link tracking patient, person, or member activity within an organization (or enterprise) and across patient care settings. Record Locator Service. The successful Proposer may be requested to provide services relating to a Record Locator Service (RLS). RLS is a key infrastructure component to support interoperability in a decentralized healthcare environment. The RLS provides pointers to the location of patient information across the extended network, enabling users to access and integrate healthcare data from distributed sources without relying on National Patient Identifiers or centralized databases. With user-defined relationships, organizations can use the RLS to
Page 28 of 113

2.

3.

4.

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

correlate records of any type. For example, Patient-Physician relationships can be established by correlating Patient records with Provider records. 5. Public Health. The successful Proposer may be requested to provide services relating to facilitating system-to-system connectivity for electronic reporting of reportable disease data to public health authorities (e.g., certain abnormal lab test results or diagnoses), syndromic surveillance data, and submission of immunization data and other registry data. ILPD. The successful Proposer may be requested to provide services relating to expansion of the ILPD. Oregon does not intend to use external data sources, directories, or data feeds for the initial rollout of HIE Core Services, but may leverage existing provider directories as data sources in the future, specifically the Provider Directories for other uses within the state (such as the Health Insurance Exchange (HIX), using other provider directories and data sources within the state as “feeds” for the provider directories (e.g. MMIS), and the effort necessary to integrate multiple directories into a comprehensive provider directory for the State. Expanded Participant Base. The successful Proposer may be requested to provide services relating to offering additional services to the existing ecosystem of HIE Participants, as well as expanding the definition of Participants to include other organizations and individuals (e.g., consumers, quality reporting agencies, human services programs, and others). Intersection with HIX. The successful Proposer may be requested to support common services between HIE and HIX, the Oregon Health Insurance Exchange. As part of Oregon’s ongoing Health Reform initiative, it is contemplated that the HIE and HIX programs may share common services if the opportunity arises. Intersection with MMIS. The successful Proposer may be requested to provide services relating to Oregon’s ongoing health reform activities, such as the MMIS serving as a “feed” for populating and/or verifying information stored in the ELPD and ILPD. MMIS is aligning to the MITA (Medicaid Information Technology Architecture) Framework. Electronic Health Records. The successful Proposer may be requested to provide services based in its available HER services. Schedule of Milestones

6.

7.

8.

9.

10.

3.5

The requested timeline for implementation of services is below. In order for Oregon to provide Eligible Professionals (EPs) and Eligible Hospitals (EHs) the services necessary to meet the Meaningful Use criteria with health information exchange components, the HIE Core Services must be operational such that providers may qualify for Meaningful Use incentives during calendar year 2011. The critical milestones are: Direct Services Implementation Task/Milestone Due Date* Notes 15 days after receipt of Notice to Proceed (or as negotiated with the 14-Oct-11 successful Proposer) 20 days after receipt of 21-Oct-11 Notice to Proceed (or as
Page 29 of 113

HIE Core Services Implementation Project Plan submitted and approved HIE Core Services Outreach and Engagement Plan submitted and approved
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

HIE Participant Services Materials approved HIE Core Services Training Plan and Materials approved HIE Core Services launched (“go live”), Acceptance Testing to begin. EP and EH must meet Meaningful Use Stage 1 Criteria Statewide Services Implementation of HIE Core Services (available to all HIE Participants)

negotiated with the successful Proposer) 45 days after receipt of Notice to Proceed (or as negotiated with the 31-Oct-11 successful Proposer) As negotiated with the 14-Nov-11 successful Proposer 14-Nov-11 31-Dec-11 31-Mar-12 90 days duration

* Assumes Notice to Proceed issued no later than September 23, 2011. 3.6 Deliverable Format, Submission, and Review The following Deliverable Review and Submission Process supplements the process described Section 2.3 of the Sample Contract, which is Attachment 5 of this RFP: 1. Contractor shall provide iterative reviews of draft versions of each initial Deliverable to the OHA-designated HIE Program Manager prior to formal submission of each Deliverable.

SECTION 4 – RFP PROCESS
4.1. Sole Point of Contact (SPC) Ellen Price, Procurement and Contracts Specialist (or alternate) Office of Contracts and Procurement 800 NE Oregon, STE 550 Portland OR 97232 Telephone: 503-741-6711 Fax: 971-673-0583 Email: ellen.d.price@state.or.us TTY: 503-378-3523 All communications with Agency concerning this RFP must be directed only to the SPC named above. Any unauthorized contact regarding this RFP with other State employees or officials may result in proposal rejection. Any oral communications will be considered unofficial and non-binding. The Oregon Procurement Information Network (ORPIN) will be used to distribute all information regarding this RFP. Any additional information received in writing from the SPC is also considered official. 4.2 Timeline for RFP and Proposal Submission RFP Opens ........................................................................................ July 19, 2011 RFP Questions Due ............................. August 1, 2011, 3:00 P.M. (Local Time)
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 30 of 113

RFP Answers Returned (estimated date) ....................................... August 4, 2011 RFP Closes. Proposals Due Wednesday, August 18, 2011, 3:00 P.M. (Local Time) Public Opening ............... Wednesday, August 18, 2011, 3:00 P.M. (Local Time) Public Opening Location ............................................... Issuing Office Room 550 Notice of Competitive Range (optional; estimated date) ............. August 29, 2011 BAFO Proposals Due (optional; estimated date) ..................... September 5, 2011 Notice of Intent to Award (estimated date)............................ September 12, 2011 Proposed Contract Effective Date .......................................... September 23, 2011 HIE Service Start Date ............................................................ November 14, 2011 4.3. Closing Date for Submittal of Proposals

The Office of Contracts and Procurement must receive Proposals by the date and time specified in section 4.2, “Timeline for RFP and Proposal Submission.” Proposals shipped must be addressed as follows: RFP 3261 ATTN: Ellen Price, Procurement and Contracts Specialist Office of Contracts and Procurement 800 NE Oregon, STE 550 Portland OR 97232 Hand delivery of proposals is optional. Hand delivered proposals must be received at the above address by the date and time specified in section 4.2. All Proposals hand-delivered must have a completed receipt of delivery, which will be provided at the time of delivery. Proposals must be submitted in a sealed package addressed as shown above with the name of the SPC and the RFP number visible on the outside of the package. Proposals received after the closing date and time are late and will not be evaluated. Postmarks, or faxed or electronic Proposals, will not be considered. 4.4. Pre-proposal Questions Relating to This RFP

Questions about this RFP document, including the Scope of Work, Contract terms and conditions, or the RFP process, must be submitted in writing to the SPC. Faxes are acceptable (please include Proposer fax number) and must be received by the SPC by the date and time specified in section 4.2. Notification of any substantive clarifications provided in response to any question will be provided and published at the ORPIN web site. For complete RFP documentation please go to the ORPIN web site: http://orpin.oregon.gov/open.dll/welcome and view RFP 3261. Agency will not automatically mail copies of any addenda or answers but will publish Addenda and Questions and Answers on ORPIN. Addenda may be downloaded off ORPIN. Proposers are responsible to frequently check ORPIN until date of RFP Closing. 4.5 Public Opening

In accordance with ORS 279B.060(5)(a) and OAR 125-247-0450 a public opening will be held on the date and time, and at the location, stated on the first page of this RFP, unless changed by addendum. The Proposals received will not be opened except to identify Proposer if the Proposer's name is not otherwise identifiable. Only the name of the Proposer will be read at the opening; no other information
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 31 of 113

will be made available at that time. Proposals received will not be available for inspection until after the notice of intent to award is issued or this RFP is canceled.

SECTION 5 – PROPOSAL REQUIREMENTS
5.1 Overview

Proposals must be submitted using only 8 ½" x 11" white paper. Proposals should be typed but without extensive art work, unusual printing or other materials not essential to the utility and clarity of the Proposals. All Proposal information and documents must be submitted on or before the Closing Date and Time. Late proposals cannot be accepted. Submissions in response to this RFP must be in the form of a Proposal Package containing the Proposal and all required supporting information and documents, and must be contained in a sealed package addressed to the SPC and clearly marked "PROPOSAL TO RFP 3261."A representative authorized to bind Proposer must sign one copy of the Proposal with an original signature (in ink) on Attachment 1, Proposal Cover Sheet. The signed original Proposal must be marked “MASTER.” Failure of the authorized representative to sign the Proposal may subject the Proposal to rejection by Agency. A signed original “MASTER,” 7 complete hard copies, and one electronic copy of the Proposal on CD, are required. Envelopes, package,s or boxes containing the original and the copies should be marked. If discrepancies are found between the copies, or between the original and copies, the original “MASTER” will provide the basis for resolving discrepancies. If one document is not clearly marked “MASTER,” Agency reserves the right to use any other signed original as the Master. If no document can be identified as an original, Proposer’s Proposal may be rejected at the discretion of Agency. Proposals must address all Proposal and submission requirements set forth in this RFP and must describe how the services will be provided. Proposals that merely offer to provide services as stated in this RFP shall be considered non-responsive to this RFP and will not be considered. Proposals will be evaluated on overall quality of content and responsiveness to the purpose and requirements of this RFP. 5.2 Proposal Requirements

General Requirements. All Proposals must include the items listed in this section, unless an item is specifically noted as optional. All materials must be in tabbed, marked sections in the order listed below. Page limits are noted, when relevant, and assume single-spaced lines. Unless otherwise specified, no particular form is required. Do not include any materials not requested in this RFP. 5.2.1 Proposal Cover Sheet Complete all sections of the Proposal Cover Sheet (Attachment 1) including an original signature from the authorized representative on at least the Master Proposal. This page must be included as the top page of the Proposal. 5.2.2 Proposer’s Designation of Confidential Materials--OPTIONAL
Page 32 of 113

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

If applicable, provide a completed Proposer’s Designation of Confidential Materials form (Attachment 2). 5.2.3 Proposer’s References Provide a completed Reference List (Attachment 3). List the business name, contact person (including phone number and email), the dates of service, and a brief summary of the project (including outcomes). Agency may contact these clients for references. If services were terminated early, include an explanation as to why. 5.2.4 1. Minimum Qualifications & Insurance Requirements Provide a summary of how Proposer meets the minimum qualifications listed in Section 2. Reference any relevant materials submitted as part of the Proposal. Only information provided by Proposer as part of the Proposal will be considered in evaluating if Minimum Qualifications are met. Describe your current insurance coverage for the following types of insurance: general liability, automobile liability, professional liability, and workers’ compensation. The coverage Agency intends to require for any contract resulting from this RFP is set forth in Exhibit B of Attachment 5 (Form Contract).If Proposer does not currently possess insurance as described in the Form Contract, Proposer must include a statement that it will secure such insurance prior to execution of the Contract, or propose an alternative insurance or bonding instrument and articulate a justification for the alternative.

2.

5.2.5 1.

Organizational Capacity & Experience Provide an Executive Summary. Provide a narrative summary of Proposer’s Proposal that describes the proposed project approach, identifies the goods and services being offered, and that summarizes Proposer’s understanding of Agency’s needs. Summarize Proposer’s business experience. Include: a. How long Proposer has been in its current business form, and any relationships with parent companies, subsidiaries, or subcontractors, and major product offerings. b. Proposer’s strategies for how services will be delivered, including any proposed subcontracts. c. The number of years in the Healthcare Information Technology business. d. The number of years in Health Information Exchange business. e. Total Health Information Exchange staffing resources (including staff, contractors, and subcontractors). f. The number of Health Information Exchange deployments over last three years. Provide customer name(s) and location(s), and deployed services. g. The number of Health Information Exchange licensed users, broken out by each deployment. Specify number of sites and providers at each site. h. The average number of transactions per month, per deployment.
Page 33 of 113

2.

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

3.

Provide information to demonstrate financial stability, specifying breadth and depth of experience with HIE systems and solutions. Proposer must describe its current methods of ensuring that the Proposer conducts business in a fiscally responsible manner and remains financially solvent through the proposed contract period. If Proposer is a corporation (as opposed to an individual), identify staff or board members that have fiscal responsibilities. Proposer must disclose any current litigation, litigation resolved, and defaulted or terminated contracts having occurred within the last three (3) years. Attach audited financial statements for the previous three completed fiscal years as an appendix to the Proposal, or if Proposer is a newly constituted business, provide a copy of a business plan completed within the last year in lieu of any years for which financial statements are not available. If subcontractors are proposed to provide one or more components of the Oregon HIE Solution, provide a list of the services and which organizations or subcontractors will provide them. Describe how the products and services are integrated. For each proposed subcontractor, Proposer must provide the following information: a. Subcontracting firm name. b. Complete address of the subcontractor. c. Services to be provided by the subcontractor. d. Number of years direct collaboration with the subcontractor. e. Percentage of total services the subcontractor will be providing. f. A written statement, signed by a representative authorized to bind the subcontractor, that states that the subcontractor is committed to rendering the services required by this RFP. g. A written statement indicating the number of subcontracting employees who are directly involved with the project and percentage of work on the overall project expected to be completed by the subcontractor. Describe Proposer’s experience and capacity to provide the services described in this RFP, specifically addressing experience and successes with HIE architecture projects involving Direct Project specifications, and completing required self-assessment activities. System Architecture. Provide a detailed description of your system architecture, including component level specifics for the following: a. Business (or business process) architecture b. Application architecture c. Data architecture d. Technical architecture e. Security architecture f. Other Key Persons & Staffing Approach Describe your proposed staffing approach. Specify Key Persons to be assigned, roles to which they will be assigned, and include a resume (not to exceed 3 pages each) for each proposed Key Person that demonstrates qualifications and experience for the requested services. The following information must be included in the resumes: a. Full name.
Page 34 of 113

4.

5.

6.

5.2.6 1. 2.

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

b. c. d. e. f.

Education, including degrees and relevant certifications, and the institution from which they were obtained. Years of experience and employment history particularly as it relates to the requirements of the RFP. Names and locations of employers for at least the past 5 years, including the dates. Specify the employment status of the Key Person (e.g., subcontractor, employee of the contractor) Location from where the Key Person is proposed to perform applicable services (e.g., Agency facility, remote Contractor facility, offsite facility).

3.

OHA reserves the right to use any information or additional references deemed necessary to establish the ability of the Proposer to perform the conditions of the contract. Submit an organizational chart that addresses all services in Proposer’s Proposal and includes all proposed Key Persons (identified by name). The chart must show the functional structure of the organization and the flow of the “chain of command” with lines to identify persons who are responsible for major functions. Trust Services & Privacy and Security

4.

5.2.7

Describe your proposed Trust Services, and privacy and security approach. Specifically: 1. Detail your Certificate Authority capabilities, including level of support for X.509v3 digital certificates and the use of such certificates to support Direct Project-compliant communication. Describe your proposed solution and processes for providing at least the Trust Services described in the Scope of Work, specifically describing the proposed support for the Registration Authority role. Describe your approach to meeting the security standards referenced in the Scope of Work, specifically addressing the provision secured transmission of data for the Oregon HIE Solution and your experience providing similar transmission for other healthcare clients. If your approach varies from the requirements referenced in the Scope of Work, provide a justification. Describe your approach to meeting current HIPAA and HITECH regulations, and future reporting obligations that may become required under federal or state law, such as accounting for disclosures. Describe your plan for completing the EHNAC HIEAP self-assessment. If one has been completed, describe outcomes and any course of action resulting from the self-assessment. Specify your organization’s process for addressing security breaches. Detail ANY disclosure of any privacy or security breaches you (or any of your proposed subcontractors) has experienced with any of clients in the past three (3) years. How did your organization resolve or address the issues? Did your organization receive any fines for or penalties from such breach(es)?

2.

3.

4.

5.

6. 8.

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 35 of 113

5.2.8

Provider Directories

Describe your proposed Provider Directories solution. Specifically: 1. Describe the data fields captured in your Provider Directories. Please use Attachment 7, Provider Directory Support, to indicate what data fields are supported by your solution. If your solution supports data fields that are not included in Attachment 7, please list those data fields as an attachment to the completed Attachment 7. Describe how HIE Participants can use the Provider Directories to enroll or update their information. Describe how you develop and implement your enrollment process, including forms, unique URLs, and qualification process. Provide screenshots of sample forms. Describe the functionality available to HIE administrators (contractor and OHA) to manage and query the Provider Directories. Detail the standards your Provider Directories support and how your solution supports the standards, specifications, and schema in the June 22, 2011, recommendations from the HIT Standards Committee Include what information can be included for an entity or individual and any customization or configuration options available. If your solution does not yet support this functionality, include a timeline for implementation and rollout of this capability. Describe how your solution adheres to or meets requirements and/or guidance for provider directories set forth by the HITPC Provider Directory Task Force, the HIT Standards Committee, and the Standards and Interoperability Framework (S&I) Provider Directories Initiative. Describe your tracking mechanism to identify when people “fall off/quit” the enrollment process. Describe the mechanism by which information stored in the Provider Directories can be copied or exported, including a brief description of available APIs. Provide a description for the process by which the data is exported and the format of resulting data export. Describe the mechanism by which information from other sources can be imported or copied into the Provider Directories, including a brief description of available APIs. Provide a description for the process by which the data is imported and the supported formats of data import. Describe how your Provider Directories interacts or integrates with the Directed Exchange Services. Specify if your proposed solution provides at least the services and meets at least the requirements described in the Scope of Work. If your approach varies from the requirements referenced in the Scope of Work, provide a justification. Directed Exchange Services

2.

3.

4.

5.

6.

7. 8.

9.

10.

11.

5.2.9

Provide a detailed description of your Directed Exchange Services solution. Specifically:
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 36 of 113

1. 2.

Describe how your solution supports secure messaging. Describe your solution’s compliance with Direct Project specifications for Secure Health Transport. Are there ANY Direct Project specifications or standards that are not supported? Describe how Participants will connect and use your solution. Detail any hardware, middleware, and software requirements. Describe the document and content standards that your solution accepts for Direct message attachments (sending and receiving), and indicate if there are any standards specifically not supported. Describe your solution’s Direct Project HISP Services including: a. Health domain and Direct Address assignment b. Digital certificate publication c. Routing and transport Describe your solution’s support for Direct Project User Stories. Describe your solution’s capability to support Direct Project XD* Conversions. Specify how your solution supports the capability to test for Meaningful Use transactions. Detail your solution’s reporting capabilities for Directed Exchange Services. Specify if your proposed solution provides at least the services and meets at least the requirements described in the Scope of Work. If your approach varies from the requirements referenced in the Scope of Work, provide a justification.

3.

4.

5.

6. 7. 8. 9. 10.

5.2.10 Web Portal Access to Directed Exchange and Provider Directory Services 1. 2. 3. Describe the options available to a user to authenticate to the web portal. Detail the secure messaging services functionality supported within the web portal. Describe the document and content standards that the web portal accepts for Direct message attachments (sending and receiving), and indicate if there are any standards specifically not supported. Describe the document and content standards that the web portal can render in a human-friendly manner, and indicate if there are any standards specifically not supported. Detail the provider directory functionality supported within the web portal. Specify if the web portal component of your proposed solution meets at least the requirements described in the Scope of Work. If your approach varies from the requirements referenced in the Scope of Work, provide a justification.

4.

5. 6.

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 37 of 113

5.2.11 HIE Participant Support Services Describe your proposed approach for supporting the enrollment, engagement, and use of the HIE Core Services by HIE Participants. Specifically describe: 1. The proposed approach for Outreach and Engagement Services. Include any analytics, survey methodologies, reporting, and campaign management tools and support that you may employ. Attach up to 4 examples of past engagement and outreach work as an appendix to the Proposal. Each example must not exceed 5 pages each. If examples are not available in 8 ½” x 11” format, Agency reserves the right to determine in its discretion if an example adheres to this page limit. References to web sites or materials external to the Proposal will not be accepted as examples. The proposed approach for supporting HIE Participant use of Trust Services, Provider Directories, and Directed Exchange Services, and other customer service issues specific to HIE Participants. Attach up to 4 examples of customer service materials (such as screen shots or information on services) as an appendix to the Proposal. Each example must not exceed 5 pages each. If examples are not available in 8 ½” x 11” format, Agency reserves the right to determine in its discretion if an example adheres to this page limit. References to web sites or materials external to the Proposal will not be accepted as examples. The proposed approach for Training Services. Provide an overview of the proposed schedule and modalities. Attach up to 4 examples of training services work (such as screen shots, course materials, sample agendas) as an appendix to the Proposal. Each example must not exceed 5 pages each. If examples are not available in 8 ½” x 11” format, Agency reserves the right to determine in its discretion if an example adheres to this page limit. References to web sites or materials external to the Proposal will not be accepted as examples.

2.

3.

5.2.12 Maintenance and Support Services 1. Describe your proposed approach to providing business services sufficient to reliably operate the Oregon HIE Solution and provide account management services. Specifically describe: a. How Proposer will ensure that it keeps current with the recommendations and required specifications and standards associated with Trust Services, Provider Directories, and Directed Exchange Services, and how OHA will receive value from those activities b. Proposed reports, their content, and their frequency. Describe your tools and frameworks available for use by you customers for reporting and measurement of the effectiveness and utilization of the solution. Attach examples, if available, as an appendix to the Proposal. c. Proposed technical and customer support for the Oregon HIE Solution, including: i. Details of your technical and customer support options, including telephone and web-based resources. ii. Details of your emergency support access options for OHA. iii. Details of your technical and customer support response time (service level agreements), with any severity-based response levels. iv. Details of your issue reporting mechanisms and resolution procedures, including any tracking software used. Describe the proposed approach for technical services and hosting of the Oregon HIE Solution. Specifically:
Page 38 of 113

2.

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

a. b. c. d. e. f. g. h.

i.

j. k.

l.

Detail the response times users may experience when interacting with the Oregon HIE Solution. State web browsers supported. Describe necessary down-time (i.e., excluded down-time) required for the Oregon HIE Solution. Provide a Provide the location(s) of the primary hosting site and secondary hosting facilities. Describe Proposer’s remote hosting experience and capabilities. Describe the proposed plan for hosting the applications, data, and components necessary to enable the proposed solution. Proposed hardware and system components, and how they can be scaled over time as participation in state-level HIE network increases. Proposer’s approach to managing system change and version control effectively, and your approach to addressing upgrades and their expected frequency and type, typical downtime expected for upgrades, and other relevant information. Management of operational and external interruptions –how your hosting operations workflow and management team will maintain operations without interruption or delay – 24x7. Proposer’s approach to meeting the Vendor Hosting Requirements described in Attachment 8 of this RFP. Provide a proposed Business Continuity Plan, inclusive of Disaster Recovery Services, for the Oregon HIE Solution that meets at least the requirements stated in the Scope of Work. Specify service option levels (e.g. timeline for recovery, redundancies, etc.), if more than one option is available. Specify if your proposed solution provides at least the services and meets at least the requirements described in the Scope of Work. If your approach varies from the requirements referenced in the Scope of Work, provide a justification.

5.2.13 Proposed Project Implementation Plan Provide a proposed Project Implementation Plan that addresses all elements described in Section 3.2.2, Configuration and Implementation Services. Specifically describe, either in the proposed plan, in a supporting narrative, or via references to other sections of the Proposal: 1. 2. Proposed Deliverables, their content, and their planned submission dates. How Proposer will ensure that milestones are met. Reference the milestones listed in the Scope of Work. Provide an explanation for any variance from the dates for these milestones. How Proposer will identify issues and risks in deploying the HIE Services and strategies to mitigate or minimize risks to successful deployment. How Proposer plans to conduct testing of HIE Core Services, new interfaces, and other transactions prior to state-wide implementation of services, including but not limited to: user acceptance testing, what test machines (separate from production systems) will be used, and how the proposed Oregon HIE Solution will be load tested. State resources (staff, network access) Proposer expects to engage during configuration and implementation activities, and how Proposer will work with the OHA (the HIE Program
Page 39 of 113

3.

4.

5.

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Manager, other OHA staff, and designated contractors, including the QA Contractor) in refining and implementing services, including the qualification and on-boarding process for HIE Participants. 6. Proposer’s solution for enrolling and onboarding HIE Participants, including how HIE Participants will be signed up for the HIE Core Services. Proposer’s process for populating the Provider Directories using the Enrollment process. All other assumptions, constraints, and dependencies.

7. 8.

5.2.14 Proposed Licenses and Agreements Provide the proposed license terms and maintenance and support agreements for the Oregon HIE Solution. 5.2.15 Glossary Glossary. Provide a glossary of all abbreviations, acronyms, and technical terms used in Proposer’s Proposal. This glossary must be provided even if included terms are described or defined at their first use in the Proposal. 5.2.16 Optional Services and Tools The Oregon HIE is a phased program. OHA envisions future work to build out additional services, potentially including a Master Provider/Person Index (MPI) and a Record Locator Service. Proposers should provide information related to the items described in the Scope of Work, specifically in Section 3.3, Optional Services and Tools, that they either own or that they interface with, and that meet the requirements and OHA business needs described in this RFP and in the Oregon Strategic Plan for HIE. 1. 2. Describe your ability to adapt the proposed Oregon HIE Solution to meet evolving needs. Describe your ability and willingness to adapt the engagement, enrollment, and provider and customer support services as needed to maximize HIE success. Address: a. Capacity and approach to working with the State to utilize your solution for facilitating system-to-system connectivity for electronic reporting of reportable disease data to public health authorities (e.g., certain abnormal lab test results or diagnoses), syndromic surveillance data, and submission of immunization data and other registry data. b. Any Master Provider/Person Index. If so, please describe your solution or plan for the solution. c. Any Record Locator Service (RLS). Describe how it works. Provide background on record matching logic available, number of clients using the solution, and percent record match based on lives and match factors. Describe the granularity of your RLS (e.g. search by provider, date, type of service). d. Describe your experience developing, managing, integrating with, or drawing data from MMIS.
Page 40 of 113

3.

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

e. 4.

Other optional services and tools available from or through Proposer.

Provide information on any “creative” or “innovative” ideas you may have and how your organization can assist Oregon HIE to achieve its goals.

5.2.17 Cost Proposal a. Provide a detailed cost proposal, substantially in the form of Attachment 4, Cost Proposal, that includes identifiable costs for the work contained in the Scope of Work, arranged by service and/or Deliverable, a maximum proposed cost for the initial Contract period, and maximum proposed costs for two additional state fiscal years. The format of the cost proposal is provided as a convenience; Proposers are expected to provide a Cost Proposal that reflects all pricing elements within their usual pricing methodology. Minimally, Proposers should specify if each cost is a fixed cost or a maximum cost, unit rates, and include a narrative that summarizes the work contained in each identified cost (referencing the Scope of Work and Proposer’s Proposal), including key activities. Include a schedule of all-inclusive labor rates. These rates may be used to negotiate an agreement for custom software and content development. Proposers are encouraged to submit pricing for proposed optional services and tools.

b.

c.

SECTION 6 – PROPOSAL EVALUATION
Proposals must be complete at the time of submission and include the required number of copies. Agency will conduct a comprehensive and impartial evaluation of the proposals received. Proposals that meet all pass/fail criteria will be evaluated by a Review Panel selected by Agency. The Review Panel will evaluate the proposals and rank them according to the scoring system described below. Proposals must provide a concise description of the Proposer’s ability to satisfy the requirements of the RFP with emphasis on completeness and clarity of content. Evaluators will consider brevity and clarity of responses in scoring Proposals. Proposals will be scored on a scale of 0 to 1,000 points at the Technical Proposal review phase, with a total of 200 points available. Maximum point values and evaluation criteria for each section are described below. After the evaluation of Proposals, the Competitive Range will be determined, and evaluation will continue in accordance with Section 6.4. Award, if one is made, will be made to the highest ranked responsive, responsible Proposer subject to Section 6.7. 6.1 Pass/Fail Items

All proposals received by the Proposal Due Date/Time per Section 4.2 will be scored on a pass/fail basis for the following items:
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 41 of 113

• • •

Proposal is complete and responsive to Section 5 Requirements, Proposal includes a completed Proposal Cover Sheet (Attachment 1), and Proposer meets the Minimum Qualifications listed in Section 2.

All responsive proposals receiving a “pass” score on the above items will be further impartially and objectively evaluated by a review panel chosen by Agency. The panel will review the proposals using the criteria described in Section 6.2. 6.2 Proposal Review Criteria 6.2.1 Insurance Coverage. Does Proposer carry or include a statement that it will secure the insurance described in Exhibit B of Attachment 5 (Form Contract), or propose an alternative insurance or bonding instrument and articulate a justification for the alternative that is satisfactory to Agency and sufficiently protects Agency’s interests? Organizational Capacity & Experience: Business Experience. How well does Proposer’s description of business experience and strategies for how services will be delivered (including subcontracts) indicate successful support for Agency’s needs for the Oregon HIE Solution described in this RFP? Organizational Capacity & Experience: Fiscal Stability. How well does Proposer’s description of its fiscal history and management, and financial statements (or business plan) demonstrate financial stability? Organizational Capacity & Experience: System Architecture. How well does Proposer’s description of its system architecture demonstrate capacity to provide the level of anticipated service, required security, and system stability required for the Oregon HIE Solution described in this RFP? Key Persons. Did Proposer identify key personnel to be assigned to the project and include resumes that speak to qualifications and experience relating to the requested services? Staffing Approach. How well does Proposer’s planned staffing approach demonstrate an understanding of Agency’s needs for the solution described in this RFP, and reflect the ability to respond effectively to business or technical issues? Trust Services & Privacy and Security. How well does Proposer’s experience and proposed Trust Services, and privacy and security approach, reflect the requirements for these elements of the Oregon HIE Solution? Does the described approach to meeting security standards provide reasonable assurance that compliance is met and will be maintained? Does the proposed plan for completing the EHNAC HIEAP self-assessment provide reasonable assurance that the self-assessment will be completed on or before the date requested? Does the described process for addressing security breaches, including the management of any prior breaches, indicate successful delivery of these services? Provider Directories. Does the proposed Provider Directories solution, including the completed Attachment 7, meet at least the requirements for these elements of the Oregon HIE Solution? Does the proposed approach to enrollment and Participants’ access of the Provider Directories indicate successful delivery of these services? Do the described
Page 42 of 113

6.2.2

6.2.3

6.2.4

6.2.5

6.2.6

6.2.7

6.2.8

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

API’s, integration with Direct Exchange services, and functionality demonstrate an understanding of Agency’s needs, both short- and long-term, for these services? 6.2.9 Directed Exchange Services. Does the proposed Directed Exchange solution meet at least the technical and business requirements for this element of the Oregon HIE Solution? Does the proposed approach to HISP services, support for testing of Meaningful Use, document and content standards, support for Direct Project user stories, and capability to support conversions demonstrate an understanding of Agency’s needs, both short- and long-term, for these services?

6.2.10 Web Portal Access. Does the capabilities and approach to the proposed web portal functionalities indicate successful support for the technical and service elements of the Oregon HIE Solution requested in this RFP? 6.2.11 HIE Participant Support Services. Does Proposer’s discussion of outreach, customer support, and training issues indicate that Proposer will be successful in delivering the services requested to support HIE Participants? Do the samples and proposed approach for Outreach and Engagement Services indicate successful delivery of those services? Do the proposed training modalities and sample materials indicate that training services will be reasonably available to HIE Participants, OHA staff, and OHA-designated contractors, and that training materials will provide information on the requested topics and successfully support use of the Oregon HIE Solution? 6.2.12 Maintenance and Support Services: Account management and customer support. How well do the proposed account management services demonstrate an understanding of Oregon’s short- and long-term goals for HIE? Do the proposed customer service and support services, including any proposed service levels, indicate successful delivery of services? Does Proposer support at least all required hosting and security requirements, including the requirements summarized in Attachment 8, or provide an acceptable alternative? Does Proposer’s Business Continuity Plan indicate successful, timely recovery and assurance of service availability for the Oregon HIE Solution? 6.2.13 Project Implementation Plan. Does the proposed Project Implementation Plan address all elements described in Section 3.2.2, Configuration and Implementation Services? Do the proposed deliverables, timelines, and activities indicate successful testing and implementation of Core HIE Services sufficient to allow EPs and EHs to demonstrate Stage 1 Meaningful Use on or before December 31, 2011? Does Proposer indicate timely and effective communications with HIE Participants, OHA staff, and other contractors, including the QA Contractor? Does the Proposer’s plan demonstrate the ability to successfully meet the milestone dates in Section 3.4 of the Scope of Work? 6.2.14 Technical Proposal. How well has the Proposer demonstrated an understanding of the purpose, scope, and timelines relating to the services requested under this RFP? 6.2.15 Optional Services and Tools. Does Proposer’s information as to optional services and tools, including those specifically referenced in the Scope of Work, indicate that the proposed Oregon HIE Solution is scalable, flexible, and will be responsive to OHA’s future needs for HIT services?

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 43 of 113

6.2.16 Cost Proposal. Does Proposer’s Cost Proposal contain all required elements, and are all costs easily identifiable? Does the Cost Proposal reflect all services in Proposer’s Proposal, and indicate effective service delivery? Does the Cost Proposal reflect the value of the goods or services offered? How well does the Cost Proposal values compare to the values of similar or equivalent goods or services offered in other Proposer’s Cost Proposals? Did Proposer submit prices for optional services and tools it proposed, and, if so, do such prices offer value to the State for future scalability, flexibility, and other State goals? 6.3 Evaluation and Points Summary Each Proposal must clearly meet the pass/fail criteria and address the scored criteria. Evaluation factors and maximum points are presented below.
PASS OR FAIL CRITERIA 1. Proposal is responsive to Section 5 Requirements 2. Completed Proposal Cover Sheet (Attachment 1) 3. Proposer meets Section 2 Minimum Qualifications Technical Proposal Evaluation

6.2.1 Insurance Coverage 6.2.2 Organizational Capacity & Experience: Business Experience 6.2.3 Organizational Capacity & Experience: Financial Stability 6.2.4 Organizational Capacity & Experience: System Architecture 6.2.5 Key Persons 6.2.6 Staffing Approach 6.2.7 Trust Services & Privacy and Security 6.2.8 Provider Directories 6.2.9 Directed Exchange Services 6.2.10 Web Portal Access 6.2.11 HIE Participant Support Services 6.2.12 Maintenance and Support Services: Account management and customer support 6.2.13 Project Implementation Plan 6.2.14 Technical Proposal 6.2.15 Optional Services and Tools 6.2.16 Cost Proposal
TOTAL

Pass or Fail Pass or Fail Pass or Fail Maximum Points Available 5 10 25 50 15 10 90 90 90 50 75 125 50 15 75 225 1,000

6.4

Competitive Range Determination

After the evaluation of Proposals, Agency must determine and rank the Proposers in the Competitive Range. The 3 highest scoring Proposals will constitute the Competitive Range. Agency may increase the number of Proposers in the Competitive Range if Agency’s evaluation of Proposals establishes a natural break in the scores of Proposers indicating a number of Proposers greater than the initial range are closely competitive, or have a reasonable chance of being determined the most advantageous Proposer, for the scope proposed. Agency may decrease the number of Proposers in the initial range
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 44 of 113

only if the excluded Proposers have no reasonable chance to be the most advantageous Proposer. Agency may establish a Competitive Range of all Proposers to enter into Discussions for Revisions and Negotiations with Proposers for the purpose of correcting deficiencies in Proposals. Agency shall provide written notice to all Proposers identifying Proposers in the Competitive Range. The establishment of the Competitive Range presents Agency with the following options: 6.4.1 In the event the scoring reflects no close competition from the lower-ranking Proposer(s), dispense with any further evaluation and proceed to a Notice of Intent to Award to the topranking Proposers, or if Agency determines it is in the State’s best interest to award more than one Contract, to the top-ranking Proposers that, when combined, offer the fullest range of services sought under this RFP; or Proceed to a Best and Final Offer (BAFO) process with the Competitive Range Proposers following evaluation of Technical Proposals, and proceed to a Notice of Intent to Award to the top-ranking Proposer after the BAFO process is complete; and Engage in Revisions and Negotiations at any point in the post-Competitive Range establishment evaluation process, as deemed necessary and appropriate in the sole discretion of Agency, in compliance with the Multistep Solicitation Rule OAR 125-247-0261. Competitive Range Protests

6.4.2

6.4.3

6.5

AFFECTED PROPOSERS MAY PROTEST EXCLUSION FROM THE COMPETITIVE RANGE IN ACCORDANCE WITH OAR 125-247-0720. PROTESTS MUST BE IN WRITING, MUST SPECIFY THE GROUNDS UPON WHICH THE PROTEST IS BASED, AND MUST BE DELIVERED TO THE AGENCY SOLE POINT OF CONTACT BY THE DEADLINE SET FORTH IN SECTION 4.2 . AGENCY RESERVES THE RIGHT TO DEFER THE COMPETITIVE RANGE PROTEST PERIOD UNTIL AFTER ANY NOTICE OF INTENT TO AWARD IS ISSUED. 6.6 Best and Final Offer Process

Agency reserves the right to initiate a Best and Final Offer (BAFO) process in compliance with the Multistep Solicitation Rule OAR 125-247-0260 following the establishment of the Competitive Range and any further evaluation of Competitive Range Proposers. The manner and means of conducting the BAFO will be reflected in an Addendum that will be distributed to Competitive Range Proposers for their review, comment and action. 6.7 Final Selection and Award

All costs for submitting a response to this RFP shall be borne by the Proposer. Award, if one is made, will be made to the highest ranked Proposer, or if Agency determines it is in the State’s best interest, to the top-ranked Proposers that represent the fullest range of services sought under this RFP. Proposer ranking will be determined by the sum of its scores on the Technical Proposals. Agency will enter into negotiations with the highest ranked Proposer(s) with verifiable references. References for the highest ranked Proposer(s) may be contacted to verify that each Proposer has the skills and requirements that Proposer has included in its Proposal. Agency may choose to not award a Contract. In the event that Contract negotiations with the highest ranked Proposer(s) are not successful within a reasonable time frame, Agency reserves the right to terminate negotiations with the highest ranked Proposer(s), and negotiate with the next highest ranked Proposer and so on, until successful negotiations are completed or Agency decides to terminate all negotiations and cancel the solicitation. The determination of what
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 45 of 113

constitutes a reasonable time frame for purposes of this paragraph shall be solely at the determination of Agency. This protocol will be followed until a Contract has been signed. If all Proposals are rejected, Proposers will be promptly notified. 6.8 Disqualification

Any attempt by a Proposer to influence a member of the evaluation committee during the Proposal review and evaluation process will result in the elimination of that Proposer’s Proposal from consideration.

SECTION 7 – GENERAL INFORMATION
7.1 Changes/Modification and Clarifications

When appropriate, Agency will issue revisions, substitutions, or clarifications as addenda to this RFP. Changes/modifications to the RFP shall be recognized only if in the form of written addenda issued by Agency and posted on ORPIN Site. 7.2 Reservation of Agency Rights

Agency reserves all rights regarding this RFP, including, without limitation, the right to: • • • • • • • • • • 7.3 Amend or cancel this RFP without liability if it is in the best interest of Agency to do so, in accordance with ORS 279B.100; Reject any and all Proposals received by reason of this RFP upon finding that it is in the best interest of Agency, in accordance with ORS 279B.100 to do so; Waive any minor informality; Seek clarification of each Proposal; Reject any Proposal that fails to substantially comply with all prescribed solicitation procedures and requirements; Negotiate the statement of work within the scope of work described in this RFP and to negotiate the rate; Amend or extend the term of any Contract that is issued as a result of this RFP; Engage Contractor by selection or procurement for different or additional services independent of this RFP process and any contracts/agreements entered into pursuant hereto; Enter into direct negotiations to execute a Contract with a responsive Proposer, in the event that the Proposer is the sole Proposer to this RFP, and Agency determines that the Proposer satisfies the minimum RFP requirements; Reject any Offer upon finding that to accept the Offer may impair the integrity of the procurement process or that rejecting the Offer is in Agency’s best interest. Protest of RFP

Subject to OAR 125-247-0730, any prospective Proposer may submit a protest of this RFP no later than 10 calendar days prior to the close of the RFP and the protest shall contain the following: (a) Sufficient information to identify the solicitation that is the subject of the protest;

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 46 of 113

(b)

(c) (d)

The grounds that demonstrate how the procurement process is contrary to law or how the solicitation document is unnecessarily restrictive, is legally flawed or improperly specifies a brand name; Evidence or supporting documentation that supports the grounds on which the protest is based; and The relief sought to include the desired changes which the Proposer believes will remedy the conditions upon which the protest is based. Award Notice

7.4

The apparent successful Proposer shall be notified in writing and Agency will set the time lines for Contract negotiation. 7.5 Protest of Award

Every Proposer shall be notified of its selection status. A Proposer shall have seven calendar days after the date of the notice of intent to award to submit a protest to Agency in writing, subject to OAR 125247-0740, and shall specify the grounds for the protest , if: (a) The Proposer is adversely affected because the Proposer would be eligible to be awarded the public contract in the event that the protest were successful; and (b) The reason for the protest is that: (1) All higher ranked Proposals are nonresponsive; (2) Agency has failed to conduct the evaluation of proposals in accordance with the criteria or processes described in the RFP; (3) Agency has abused its discretion in rejecting the protestor’s Proposal as nonresponsive; or (4) Agency’s evaluation of Proposals or subsequent determination of award is otherwise in violation of ORS chapter 279A or ORS Chapter 279B. 7.6 (a) Modification or Withdrawal Modifications. A Proposer may modify its Proposal in writing prior to the closing. A Proposer must prepare and submit any modification to its Offer to Department in accordance with Paragraph 4.3, above. Any modification must include the Proposer's statement that the modification amends and supersedes the prior Proposal. The Proposer must mark the submitted modification “Proposal Modification, RFP 3261” and be addressed to the attention of the SPC. Withdrawals. A Proposer may withdraw its Proposal by Written notice submitted on the Proposer's letterhead, Signed by an authorized representative of the Proposer, delivered to the SPC in person or in the same manner as set forth in Paragraph 4.3, above. The Proposer must mark the written request to withdraw “Proposal Withdrawal, RFP 3261.” Release of Information

(b)

7.7

No information shall be given to any Proposer (or any other individual) relative to their standing with other Proposers during the RFP process. 7.8 (a) Public Information All Proposals are public information after the Proposals have been opened, and all protests are public information after the protest period ends. If any part of a Proposal or protest is considered a trade secret, the Proposer shall, at the time of submission, clearly designate that portion as
Page 47 of 113

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

confidential in order to obtain protection, if any, from disclosure. See Oregon Revised Statutes 192.501(2) and 646.461 to 646.475. Application of the Oregon Public Records Law shall determine if the confidential information claimed to be exempt is in fact exempt from disclosure. (b) Any person may request copies of public information. However, copies of Proposals will not be provided until the evaluation process has been completely closed and an apparent successful Proposer has been selected. Requests for copies of public information shall be in writing. Requestors will be charged according to the current Agency policies and rates for public records requests in effect at the time Agency receives the written request for public information. Fees, if applicable, must be received by Agency before the records are delivered to the requestor. Cost of Proposals

7.9

All costs incurred in preparing and submitting a Proposal in response to this RFP will be the responsibility of the Proposer and will not be reimbursed by Agency. 7.10 Statutorily Required Preferences

The following Preferences and rules apply to this Procurement: (a) Preference for Oregon Supplies and Services, pursuant to ORS 279A.120 and OAR 125-2460300 and 125-246-0310; (b) Preference for recycled materials, pursuant to ORS 279A.125 and OAR 125-246-0320 through 125-246-0324; and (c) Performance within the state of public printing, binding and stationery work, pursuant to ORS 282.210. (d) Proposers shall use recyclable products to the maximum extent economically feasible in the performance of the Contract work set forth in this document. Proposers must also comply with OAR 125-247-0260(2)(d). 7.11 Contract Period

Initial term of the Contract shall be for the period stated in Section 1.1. If Agency determines that the work performed has been satisfactory, Agency may at its option, amend or extend the Contract for additional time and for additional dollars without further solicitation. Modifications or extensions shall be by written amendment duly executed by the parties (see Form Contract, Attachment 5). 7.12 Contractual Obligation

All Proposers who submit a Proposal in response to this RFP understand and agree that Agency is not obligated thereby to enter into a Contract with any Proposer and, further, has absolutely no financial obligation to any Proposer. 7.13 Contract Documents

The final Contract will be based on the Contract form, which is attached as Attachment 5 to this RFP, and will include all exhibits and attachments identified in the Contract, including this RFP and the successful Proposer’s Proposal. The below-listed terms and conditions are subject to negotiation: 1. Term of Contract (Length of Contract) 2. Extensions 3. Prices or Consideration as it is affected by the results of negotiating the statement of work or other negotiated considerations
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 48 of 113

4. 5. 6. 7. 8. 9. 10. 11. 12. 13.

Schedules Payment methodology Statement of Work, within the Scope of Work identified in the RFP Specifications Ownership of Intellectual Property Limitations of Liability Professional Liability Insurance minimum policy limits, including coverage for information security and cyber liability Indemnity Delivery/Acceptance Warranty

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 49 of 113

ATTACHMENT 1 - Proposal Cover Sheet
RFP 3261 Organization Name: Primary Contact Person: Address: City, State, Zip: Telephone: E-mail Address: Name and title of the person(s) authorized to represent the Proposer in any negotiations and sign any Personal Services Contract that may result: Name: Title: By signing this page and submitting a Proposal, the official certifies that the following statements are true: 1. 2. No attempt has been made or will be made by the Proposer to induce any other person or organization to submit or not submit a Proposal. Proposer does not discriminate in its employment practices with regard to race, creed, age, religious affiliation, sex, disability, sexual orientation or national origin, nor has Proposer or will Proposer discriminate against a subcontractor in the awarding of a subcontract because the subcontractor is a minority, women or emerging small business enterprise certified under ORS 200.055. Information and costs included in this Proposal shall remain valid for 90 days after the Proposal due date or until a contract is approved, whichever comes first. The statements contained in this Proposal are true and complete to the best of the Proposer’s knowledge and accepts as a condition of the contract, the obligation to comply with the applicable state and federal requirements, policies, standards, and regulations. The undersigned recognizes that this is a public document and open to public inspection. The Proposer acknowledges receipt of all addenda issued under this RFP. If the Proposer is awarded a contract as a result of this RFP, the Contractor will be required to complete, and will be bound by, a Contract as attached to this RFP and found on the ORPIN website. At the time of signing the contract with Agency the Contractor will be required to provide their Federal Employer Identification Number (FEIN) or Social Security Number (SSN), as applicable, to Agency. Pursuant to ORS 279B.055 (2) the contractor agrees to meet the highest standards prevalent in the industry or business most closely involved in providing the appropriate goods or services as stated in the scope of work. Date: Fax: Title:

3. 4.

5. 6.

7.

Signature: (Official Authorized to Bind Proposer)

Printed Name and Title: *** THIS PAGE MUST BE THE TOP PAGE OF THE PROPOSAL ***

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 50 of 113

ATTACHMENT 2 - Proposer’s Designation of Confidential Materials
RFP 3261 Proposer Name: ______________________________ Instructions for completing this form: As a public entity, Agency is subject to the Oregon Public Records Law, which confers a right for any person to inspect any public records of a public body in Oregon, subject to certain exemptions and limitations. See ORS 192.410 through 192.505. Exemptions are generally narrowly construed in favor of disclosure in furtherance of a policy of open government. Your proposal will be a public record that is subject to disclosure except for material that qualifies as a public records exemption. It is Agency’s’ responsibility to redact from disclosure only material exempt from Oregon’s Public Records law. It is the Proposer’s responsibility to only mark material that legitimately qualifies under an exemption from disclosure. To designate a portion of a Proposal as exempt from disclosure under the Oregon Public Records Law, Proposer should do the following steps: 1) Clearly identify in the body of the Proposal only the limited material that is a trade secret or would otherwise be exempt under public records law. If a Proposal fails to identify portions of the Proposal as exempt, Proposer is deemed to waive any future claim of non-disclosure of that information. 2) List, in the space provided below, the portions of your Proposal that you have marked in step 1 as exempt under public records law and the public records law exemption (e.g. a trade secret) you believe applies to each portion. If a Proposal fails to list in this exhibit a portion of the Proposal as exempt, Proposer is deemed to waive any future claim of non-disclosure of that information. 3) Provide, in your response to this exhibit, justification how each portion designated as exempt meets the exemption criteria under the Oregon Public Records Law. If you are asserting trade secret over any material, please indicate how such material meets all the criteria of a trade secret listed below. Please do not use broad statements of conclusion not supported by evidence. Application of the Oregon Public Records Law shall determine whether any information is actually exempt from disclosure. Prospective Proposers are advised to consult with legal counsel regarding disclosure issues. Proposer may wish to limit the amount of truly trade secret information submitted, providing only what is necessary to submit a complete and competitive proposal. In order for records to be exempt from disclosure as a trade secret, the records must meet all four of the following requirements: • • • • The information must not be patented; It must be known only to certain individuals within an organization and used in a business the organization conducts; It must be information that has actual or potential commercial value; and, It must give its users an opportunity to obtain a business advantage over competitors who do not know or use it.

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 51 of 113

Keep in mind that the trade secret exemption is very limited. Not all material that you might prefer be kept from review by a competitor qualifies as your trade secret material. Agency is required to release information in the Proposal unless it meets the requirements of a trade secret or other exemption from disclosure, and it is the Proposer’s responsibility to provide the basis for which an exemption should apply. In support of the principle of an open competitive processes, “bottom-line pricing” – that is, pricing used for objective cost evaluation for award of the RFP or the total cost of the contract or deliverables under the contract – will not be considered as exempt material under a public records request. Examples of material that we would also likely not consider a trade secret would include résumés, audited financial statements of publicly traded companies, material that is publicly knowable such as a screen shot of a software interface or a software report format. To designate material as confidential and qualified under an exemption from disclosure under Oregon Public Records Law, a Proposer must complete this exhibit form as follows: Part I: List all portions of your Proposal, if any, that Proposer is designating as exempt from disclosure under Oregon Public Records Law. For each item in the list, state the exemption in Oregon Public Records Law that you are asserting (e.g. trade secret).
“This data is exempt from disclosure under the Oregon Public Records Law pursuant to [insert specific exemption from ORS 192, such as a “ORS 192.501(2) ‘trade secret’”] , and is not to be disclosed except in accordance with the Oregon Public Records Law, ORS 192.410 through 192.505.”

In the space provided below, state Proposer’s list of material exempt from disclosure and include specific pages and section references of your Proposal. 1. 2. 3. This list may be expanded as necessary. Part II: For each item listed above, provide clear justification how that item meets the exemption criteria under Oregon Public Records Law. If you are asserting trade secret over any material, state how such material meets all the criteria of a trade secret listed above in this Exhibit. In the space provided below, state Proposer’s Justification for non-disclosure for each item in the list in Part I of this Attachment: 1. 2. 3. This list may be expanded as necessary.

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 52 of 113

ATTACHMENT 3 – References
RFP 3261 Proposer Name: ______________________________ Provide at least three references with telephone numbers (please verify numbers). References must be able to verify the quality of your previous work in the proposed area of work.
REFERENCE No. 1: Organization Name: __________________________________________ Contact Person: __________________________________________ Project Title, Summary, and Outcomes: Telephone: __________________________ Fax: _______________________________ Email: _____________________________ Dates of Service (project start/end dates):

REFERENCE No. 2: Organization Name: __________________________________________ Contact Person: __________________________________________ Project Title, Summary, and Outcomes:

Telephone: __________________________ Fax: _______________________________ Email: _____________________________ Dates of Service (project start/end dates):

REFERENCE No. 3: Organization Name: __________________________________________ Contact Person: __________________________________________ Project Title, Summary, and Outcomes:

Telephone: __________________________ Fax: _______________________________ Email: _____________________________ Dates of Service (project start/end dates):

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 53 of 113

ATTACHMENT 4 – Cost Proposal
This format is provided as a courtesy and available as an Excel file via ORPIN.
RFP 3261 Cost Proposal Format SFY 2011-2012* Item Item Name 1 Trust Services X.509v3 Digital Certificates (if separate) 2 Provider Directories 3 Directed Exchange Services 4 Web Portal Provider Directory access Directed Exchange access 5 HIE Participant Support Services Outreach and Engagement Deliverable 1 (Outreach and Engagement Plan)
Deliverable 2 (Outreach and Engagement Materials)

SFY 2012-2013 Year 2 (Initial Contract)

SFY 2013-2014 Year 3 (Potential Additional Year)

SFY 2014-2015 Year 4 (Potential Additional Year) Totals 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00

Cost Type**

Unit Rate

Number of Units

Testing Period (Initial Contract)

Year 1 (Partial, Initial Contract)***

Business Services
Deliverable 3 (HIE Participant Services Materials)

Training Services
Deliverable 4 (Training Plan)

6 Configuration and Implementation Services Project Implementation Deliverable 5 (Project Implementation Plan) Deliverable 6 (Implementation Artifacts) 7 Maintenance and Support Services Business Support Services Technical Support Services Maintenance Upgrades Hosting and Security EHNAC Self-Assessment/Certification Business Continuity Plan Services Cost Per State Fiscal Year Totals $0 $0 $0 $0 $0

Proposed Costs, Initial Contract Period (Effective Date through June 30, 2013) Proposed Costs, Potential Additional Contract Periods (July 2013-June 2015) Total Proposed Costs, 2011-2015 8 Attach a schedule of rates and fees for for custom software and content development beyond items listed in RFP. SFY = State Fiscal Year: July 1 - June 30 * Effective Date of Contract (assumed to be September 23, 2011, unless Proposer states otherwise) through June 30, 2012. ** Cost Type may include: Flat Fee, Maximum Charge at hourly rates, per unit charges, other (if other, explain). Please attach a schedule if more than one rate applies, and indicate the maximum cost proposed for the service. *** For the purposes of this Cost Proposal, assume a Statewide Services Implementation date of March 31, 2012.

0.00 0.00 0.00

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 54 of 113

ATTACHMENT 5– Form Contract
Contract Number 000000 State of Oregon Personal/Professional Services Contract INFORMATION TECHNOLOGY SYSTEM ACQUISITION

In compliance with the Americans with Disabilities Act, this document is available in alternate formats such as Braille, large print, audiotape, oral presentation and electronic format. To request an alternate format, please send an e-mail to DHS.Forms@state.or.us or contact the Office of Document Management at 503-378-3486, and TTY at 503-3783523.
This Contract is between the State of Oregon, acting by and through its Department of Human Services, hereinafter referred to as “DHS” or “Agency” and Contractor d.b.a. Facility or Assumed Name Address Address Telephone: (optional) Facsimile: (optional) E-mail address: (optional) Contractor’s home page URL, if applicable (optional) hereinafter referred to as “Contractor.” Work to be performed under this Contract relates principally to Agency’s (Fill in with name of Office, Program, etc.) (Insert address) (Insert city, state, zip) Contract Administrator: (Insert Name) or delegate Telephone: (Insert) Facsimile: (Insert) E-mail address: (Insert)

RECITALS A. Agency desires to engage a Contractor to provide and related Services as set forth in the Statement of Work to enable Agency to achieve specific business and Agency mission objectives as defined in this Contract, including implementation and testing of the System (as defined below). To that end, Agency issued RFP 3261.
Page 55 of 113

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

B.

Contractor is the successful Proposer to the RFP and Agency desires to engage Contractor to perform the Services. Contractor desires to perform the Services for Agency.

C.

In consideration of the foregoing Recitals and the mutual terms and conditions set forth below, Agency and Contractor agree as follows: 1. DEFINITIONS

See RFP 3261, Section 1. 2. SCOPE OF SERVICES 2.1 Performance 2.1.1 Responsibilities of Contractor. Contractor shall perform the Services in accordance with the Statement of Work and the Subscription Agreement.

2.2

Responsibilities of Agency. If this Contract requires Agency to provide any resources, and Agency fails to provide the requisite quality or quantity of such resources, or fails to provide such resources in a timely manner but for a period not to exceed 30 calendar days, Contractor’s sole remedy shall be an extension of the applicable delivery dates corresponding to the delay caused by Agency’s failure. If Agency’s failure to provide such resources exceeds 30 calendar days and Contractor can show to the reasonable satisfaction of Agency that the Agency’s failure has resulted in an unavoidable increase in the cost of the Services required for the Statement of Work, then Contractor shall be entitled to recover from Agency the reasonable amount of such increased costs. Contractor’s right to delay applicable delivery dates may be exercised only if Contractor provides Agency with reasonable notice of Agency’s failure and Contractor uses commercially reasonable efforts to perform notwithstanding Agency’s failure to perform. Delivery and Review of Deliverables 2.3.1 Contractor shall deliver Deliverables and complete Milestones as set forth in the Statement of Work by no later than the date or dates set for delivery in the Statement of Work. Delivery dates, both critical and non-critical, are set forth in the Statement of Work and are subject to Agency performing its responsibilities in a timely manner. Contractor shall provide written notice to Agency upon delivery of a completed Deliverable to Agency. By no later than 20 calendar days after receipt of such notice Agency shall determine whether the Deliverable meets Acceptance Criteria set forth in the Contract including the Statement of Work. If Agency determines that the Deliverable meets, in all material respects, the Acceptance Criteria, Agency shall notify Contractor of Agency’s Acceptance. Agency’s Acceptance of any Deliverable will not be construed as a waiver of Agency’s rights under this
Page 56 of 113

2.3

2.3.2

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Contract for any defect that was not discovered, or reasonably could have been discovered, by Agency in reviewing such Deliverable. 2.3.3 If the Agency determines that a Deliverable does not meet the Acceptance Criteria, in all material respects, Agency shall notify Contractor in writing of Agency’s rejection of the Deliverable, and describe in reasonable detail in such notice the Agency’s basis for rejection of the Deliverable. Upon receipt of notice of nonacceptance, Contractor shall, within a 15 calendar day period, modify or improve the Deliverable at Contractor’s sole expense so that the Deliverable meets the Acceptance Criteria, in all material respects, and notify the Agency in writing that it has completed such modifications or improvements and re-tender the Deliverable to Agency. Agency shall thereafter review the modified or improved Deliverable within 15 calendar days of receipt of the Contractor’s delivery of the Deliverable. Failure of the Deliverable to meet the Acceptance Criteria, in all material respects, after the second submittal shall constitute a default by Contractor. In the event of such default, Agency may either: (i) notify Contractor of such default and instruct Contractor to modify or improve the Deliverables as set forth in this Section 2.3.3, or (ii) notify Contractor of such default and instruct Contractor to cease work on the Deliverable, in which case Contractor shall refund to Agency all amounts paid by Agency related to such Deliverable. Such refund shall be in addition to, and not in lieu of, any other remedies Agency may have for Contractor’s default.

2.4

Acceptance Testing 2.4.1. User Acceptance Testing. Contractor shall provide written notice to Agency upon complete customization, installation and configuration of the System, as set forth in Exhibit A. Agency will test the entire System (“User Acceptance Testing”) via the Acceptance Testing activities set forth in Exhibit A, including the approved Deliverable 5, Project Implementation Plan, in order to determine if it meets, in all material respects, the Acceptance Criteria. If the System fails to conform to or perform according to the Acceptance Criteria, Agency will notify Contractor, in writing, specifying the manner in which it fails to comply. Upon receipt of such written notice, Contractor shall correct any such failure within ten (10) business days from the date of receipt of Agency’ notice or such later date as Agency shall specify in its notice, and shall resubmit the corrected System to Agency for retesting according to this section, all at no additional charge to Agency.

2.4.2. Acceptance Period. Upon completion of User Acceptance Testing, Agency shall use the System for the transformation and processing of System data in a live production environment for a period of 90 calendar days. At the end of such 90 day period, there shall be no known unresolved System Errors, as communicated in writing from Agency to Contractor. For the purpose of this Section 2.4.3, "unresolved System Errors" are errors that prevent the System from meeting the Acceptance Criteria of this Contract. If the System materially fails to conform to or perform in the Acceptance Criteria, Agency will notify Contractor, in writing, specifying in reasonable detail the manner in which it fails to comply. Upon receipt of such written notice, Contractor shall correct any such failure within five (5) business days from the date of receipt of Agency’ notice or such later date as Agency shall
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 57 of 113

specify in its notice, and shall resubmit the System to Agency for reevaluation, all at no additional charge to Agency. Thereafter, if the System fails to conform or perform as required, Agency may allow Contractor to continue to correct the System or Agency may declare a material breach of this Contract by Contractor. 2.5 Final Acceptance. “Final Acceptance” of the System will occur when, the following events have occurred or conditions exist: 2.5.1. Agency has notified Contractor that the System meets all Acceptance Criteria and all Acceptance Tests required pursuant to Section 2.4 have been successfully completed for the System; 2.5.2. All System database inventories and configuration files are complete and operating correctly; 2.5.3. All items of System Documentation are complete, inventoried and accepted by the Agency. Contractor shall provide all text Documentation both in hard copy and in an electronic format as specified in the Statement of Work; 2.5.4. All Documentation, Software, configuration data, and System configuration information are complete and are stored and controlled under a configuration management system as specified in the Statement of Work; and 2.5.5. Contractor has delivered all source code and Documentation in accordance with the terms of the Contract including the Statement of Work. 3. CONTRACTOR’S PERSONNEL 3.1 Project Manager. Contractor shall designate one of the Key Persons as Project Manager for the Services. The Project Manager shall be familiar with Agency’s business objectives of this Contract. The Project Manager will participate with Agency in periodic review sessions and will provide at Agency’s request detailed progress reports that identify completed tasks and the status of the remaining Services as set forth in the Statement of Work. Contractor’s Employees and Subcontractors. Contractor shall not use subcontractors to perform the Services unless specifically authorized to do so by Agency. Contractor represents that any employees assigned to perform the Services, and any authorized subcontractors performing the Services shall perform the Services in accordance with the warranties set forth in Section 8 of this Contract. Key Persons. Contractor acknowledges and agrees that Agency selected Contractor, and is entering into this Contract, because of the special qualifications of Contractor’s Key Persons identified in Exhibit E. Contractor’s Key Persons shall not delegate performance of their powers and responsibilities they are required to provide under this Contract to another Contractor employee(s) without first obtaining the written consent of Agency. Further, Contractor shall not re-assign or transfer the Key Persons to other duties or positions such that the Key Persons are no longer available to provide the Agency with
Page 58 of 113

3.2

3.3

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

their expertise, experience, judgment, and personal attention, without first obtaining the Agency’s prior written consent to such re-assignment or transfer, which Agency shall not unreasonably withhold or delay. Notwithstanding the foregoing, Contractor may replace Key Persons without Agency’s consent in the event any Key Persons are no longer available due to death, illness or termination of employment with Contractor. In the event Contractor requests that the Agency approve a re-assignment or transfer of the Key Persons, or if Contractor must replace Key Persons due to death, illness or termination of employment with Contractor, the Agency shall have the right to interview, review the qualifications of, and approve or disapprove the proposed replacement(s) for the Key Persons. Any such replacement shall have substantially equivalent or better qualifications than the Key Person being replaced. Any replacement personnel approved by Agency shall thereafter be deemed a Key Person for purposes of this Contract and Exhibit E shall be deemed amended to include such Key Person. 4. TERM This Agreement shall be effective on the Effective Date, and shall terminate on [insert end date], unless this Agreement has extended or terminated earlier in accordance with its terms. 5. COMPENSATION 5.1 Maximum Payment Amount. Notwithstanding any other provision of this Contract to the contrary, the maximum, not-to-exceed compensation that Agency will pay to Contractor is _____Dollars ($_____) (the “Maximum Not-To-Exceed (NTE) Compensation”), which includes payment for any allowable expenses for which Contractor may request reimbursement under this Contract. Payments. (TBD.)

5.2

5.3

Retention. Agency shall be permitted to hold back an amount (the “Services Retention Amount”) of not more than 10% of all amounts invoiced and payable by Agency to Contractor for the below-listed Deliverables prior to Final Acceptance. Agency shall pay the then-accrued Services Retention Amount to Contractor within 30 calendar days following Final Acceptance. Deliverable for which Agency will retain a Services Retention Amount are: Deliverable 1: Outreach and Engagement Plan Deliverable 2: Outreach and Engagement Materials Deliverable 3: HIE Participant Services Materials Deliverable 4: Training Plan Deliverable 5: Project Implementation Plan Deliverable 6: Implementation Artifacts

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 59 of 113

5.4

Expenses. Agency will not pay or reimburse any expenses incurred by Contractor during the completion of the Services except as authorized in the Statement of Work. Any such authorized expenses for travel shall comply with the Oregon Travel Policy. Invoices. Agency shall pay Contractor not more than once each month upon Contractor’s submission of a detailed invoice that sets forth the Services performed and Deliverables accepted by Agency. Such invoices shall comply with the requirements of Sections 5.2, 5.3, and 5.4 and shall identify the Deliverables completed and Accepted by Agency for which Contractor seeks compensation, and shall itemize and explain all authorized expenses for which reimbursement is claimed. The invoices also shall include the total amount invoiced to date by Contractor prior to the current invoice. Contractor shall submit invoices to Agency’s Authorized Representative. Agency will have the right to review each such invoice for compliance with the requirements of this Section 5.5 and any other relevant provisions of this Contract. All payments to Contractor are subject to ORS 293.462. Limit on Payments. Contractor shall not submit invoices for, and Agency shall not pay, any amount in excess of the Maximum Not-To-Exceed Compensation. If this maximum amount is increased by amendment of this Contract, pursuant to Section 17.15, the amendment must be fully effective before Contractor performs Services or delivers goods subject to the amendment. No payment will be made for any Services performed or goods delivered before the Effective Date or after termination of this Contract. Payment Method. Payments under this Contract will be made by Electronic Funds Transfer (EFT), unless otherwise mutually agreed, and shall be processed in accordance with the provisions of OAR 407-120-0100 through 407-120-0380 or OAR 410-120-1260 through OAR 410-120-1460, as applicable, and any other OHA Oregon Administrative Rules that are program-specific to the billings and payments. Upon request, Contractor shall provide its taxpayer identification number (TIN) and other necessary banking information to receive EFT payment. Contractor shall maintain at its own expense a single financial institution or authorized payment agent capable of receiving and processing EFT using the Automated Clearing House (ACH) transfer method. The most current designation and EFT information will be used for all payments under this Contract. Contractor shall provide this designation and information on a form provided by OHA. In the event that EFT information changes or the Contractor elects to designate a different financial institution for the receipt of any payment made using EFT procedures, the Contractor shall provide the changed information or designation to OHA on a OHAapproved form. OHA is not required to make any payment under this Contract until receipt of the correct EFT designation and payment information from the Contractor.

5.5

5.6

5.7

6.

OWNERSHIP RIGHTS AND LICENSE IN DELIVERABLES 6.1 Contractor Intellectual Property. Contractor retains ownership of all Contractor Intellectual Property pursuant to the Services performed under this Contract. Contractor grants Agency a license to Contractor Intellectual Property as set forth in the Subscription Agreement, attached as Exhibit G. Work Product.
Page 60 of 113

6.2

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

6.2.1

Generally. Except as specified below in Section 6.2.2, Contractor owns all Work Product. Contractor grants Agency a perpetual non-exclusive, irrevocable, royalty-free, world-wide license to use, copy, display, distribute, transmit and prepare derivative works of Work Product, and to authorize others to do the same on Agency’s behalf.

6.2.2 Documentation. 6.2.2.1 If Documentation has been developed and delivered by Contractor as a Deliverable to Agency under this Contract, and such Documentation have been funded by Agency, to any extent, with either state or federal funds, then to the extent that the Documentation does not include pre-existing materials generally licensed by Contractor, then Agency shall have all right, title, and interest (including ownership of copyright and trademark) to such Documentation, and Agency grants to Contractor an irrevocable, nonexclusive, worldwide, fully paid-up license to use, modify, execute, reproduce, display, perform and distribute copies of such Documentation to other governmental entities. 6.2.2.2 Notwithstanding any other term in this Contract, any Contractor rights to Documentation are subject to the limitation that Contractor may not charge a development, licensing or user fee to any state, federal, or local governmental entity when distributing copies of, and transferring/sublicensing rights to, the Documentation to such entity. Contractor’s exercise of its right to transfer/sublicense according to this Section 6.2.2 shall be considered an activity performed by Contractor under this Contract 6.3 Third Party Intellectual Property. Unless otherwise specified in Exhibit A, Agency, on its own, will acquire and obtain a license to Third Party Intellectual Property. Contractor shall secure on Agency’s behalf, in the name of Agency and subject to Agency’s approval, a license to Third Party Intellectual Property sufficient to fulfill the business objectives, requirements and specifications identified in this Contract. Agency Intellectual Property; Data and Background Information. Agency owns all Agency Intellectual Property and Agency data and background information provided to Contractor pursuant to this Contract. Agency grants Contractor a non-exclusive, royaltyfree, world-wide license to use, copy, display, distribute, transmit and prepare derivative works of Agency Intellectual Property and Agency data and background information only to fulfill the purposes of this Agency’s license to Contractor is limited by the term of the Contract and the confidentiality obligations of this Contract. No Rights. Except as expressly set forth in this Contract, nothing in this Contract shall be construed as granting to or conferring upon Contractor any right, title, or interest in any intellectual property that is now owned or subsequently owned by Agency. Except as expressly set forth in this Contract, nothing in this Contract shall be construed as granting to or conferring upon Agency any right, title, or interest in any Contractor Intellectual Property that is now owned or subsequently owned by Contractor.
Page 61 of 113

6.4

6.5

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

6.6

Competing Services. Subject to the provisions of this Section 6, and Contractor’s obligations with respect to Confidential Information, as defined in Section 7, nothing in this Contract shall preclude or limit in any way the right of Contractor to: (i) provide the services similar to those contemplated in this Contract, or, consulting or other services of any kind or nature whatsoever to any individual or entity as Contractor in its sole discretion deems appropriate; or (ii) develop for Contractor or for others, deliverables or other materials that are competitive with those produced as a result of the Services provided hereunder, irrespective of their similarity to the Deliverables. Each party shall be free to utilize any concepts, processes, know-how, techniques, improvements or other methods it may develop during the course of performance under this Contract free of any use restriction or payment obligation to the other. Neither party grants the other the right to use its trademarks, trade names, service marks or other designations in any promotion or publication without prior written consent. Each party grants only the licenses and rights specified in this Contract.

6.7

7.

CONFIDENTIALITY AND NON-DISCLOSURE; SECURITY 7.1 Confidential Information Generally. Contractor acknowledges that it and its employees or agents may, in the course of performing the Services under this Contract, be exposed to or acquire information that is confidential to Agency or Agency’s clients. Any and all information of any form obtained by Contractor or its employees or agents in the performance of this Contract shall be deemed to be confidential information of Agency (“Confidential Information”). Any reports or other documents or items (including software) that result from the use of the Confidential Information by Contractor shall be treated in the same manner as the Confidential Information. Confidential Information shall be deemed not to include information that: (a) is or becomes (other than by disclosure by Contractor) publicly known or is contained in a publicly available document; (b) is furnished by Agency to others without restrictions similar to those imposed by this Contract; (c) is rightfully in Contractor’s possession without the obligation of non-disclosure prior to the time of its disclosure under this Contract; (d) is obtained from a source other than Agency without the obligation of confidentiality; (e) is disclosed with the written consent of Agency, or; (f) is independently developed by employees, agents or subcontractors of Contractor who can be shown to have had no access to the Confidential Information. Non-Disclosure. Contractor agrees to hold Confidential Information in strict confidence, using at least the same degree of care that Contractor uses in maintaining the confidentiality of its own confidential information, and not to copy, reproduce, sell, assign, license, market, transfer or otherwise dispose of, give, or disclose Confidential Information to third parties (other than its subcontractors) or use Confidential Information for any purposes whatsoever other than the provision of Services to Agency hereunder, and to advise each of its employees and agents of their obligations to keep Confidential Information confidential. Contractor shall use its commercially reasonable efforts to assist Agency in identifying and preventing any unauthorized use or disclosure of any Confidential Information. Without limitation of the foregoing, Contractor shall advise Agency immediately in the event Contractor learns or has reason to believe that any person who has had access to Confidential Information has violated or intends to violate
Page 62 of 113

7.2

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

the terms of this Contract and Contractor will at its expense cooperate with Agency in seeking injunctive or other equitable relief in the name of Agency or Contractor against any such person. Contractor agrees that, except as directed by Agency, Contractor will not at any time during or after the term of this Contract disclose, directly or indirectly, any Confidential Information to any person, except in accordance with this Contract, and that upon termination of this Contract or at Agency’s request, Contractor will turn over to Agency all documents, papers, and other matter in Contractor's possession that embody Confidential Information. 7.3 Identity Theft. In the performance of the Contract, Contractor may have possession or access to documents, records or items that contain “Personal Information” as that term is used in ORS 646A.602(11), including Social Security numbers. Personal Information is a type of Confidential Information that is highly sensitive and subject to additional protection. Therefore, prior to the receipt of, and during the period in which Contractor has possession of or access to, any Personal Information, Contractor shall have in place, a formal written information security program that provides safeguards to protect Personal Information from loss, theft, and disclosure to unauthorized persons, as required by the Oregon Consumer Identity Theft Protection Act, ORS 646A.600-646A.628. 7.3.1 In addition to, and without limiting the generality of, Sections 7.1 and 7.2, Contractor shall not breach or permit breach of the security of any Personal Information that is contained in any document, record, compilation of information or other item to which Contractor receives access, possession, custody or control under this Contract. Contractor shall not disclose, or otherwise permit access of any nature, to any unauthorized person, of any such Personal Information. Contractor shall not use, distribute or dispose of any Personal Information other than expressly permitted by Agency, DAS, required by applicable law, or required by an order of a tribunal having competent jurisdiction. Contractor shall promptly report to Agency any breach of security, use, disclosure, theft, loss, or other unauthorized access of any document, record, compilation of information or other item that contains Personal Information to which the Contractor receives access, possession, custody or control in the performance of this Contract. Contractor shall require the compliance of its employees and agents (including subcontractors) with this Section 7.

7.3.2

7.3.3

7.4

Security Policies / Non-Disclosure Agreement; Information Privacy/Security/Access. 7.4.1 Contractor at all times shall comply with Agency’s security policies, including AS-090-001 through AS-090-006, AS-100-01 through AS-100-06, and AS-10009. Copies of these policies are available from Agency on the web: • Security policies: http://www.dhs.state.or.us/policy/admin/infosecuritylist.htm • Privacy policies: http://www.dhs.state.or.us/policy/admin/privacylist.htm

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 63 of 113

Contractor shall upon Agency’s request provide a written non-disclosure agreement and obtain such from Contractor’s employees and subcontractors (if any) performing Services under this Contract. 7.4.2 Information Privacy/Security/Access. If the Work performed under this contract requires Contractor or, when allowed, its subcontractor(s), to have access to or use of any Agency computer system or other Agency Information Asset for which Agency imposes security requirements, and Agency grants Contractor or its subcontractor(s) access to such Agency Information Assets or Network and Information Systems, Contractor shall comply and require all subcontractor(s) to which such access has been granted to comply with OAR 407-014-0300 through OAR 407-014-0320, as such rules may be revised from time to time. For purposes of this Section, “Information Asset” and “Network and Information System” have the meaning set forth in OAR 407-014-0305, as such rule may be revised from time to time. Confidential Information includes, but is not limited to, Individually Identifiable Health Information, as set forth in Exhibit H, Section 6.

7.4.3

7.5

Injunctive Relief. Contractor acknowledges that breach of this Section 7, including disclosure of any Confidential Information, will cause irreparable injury to Agency that is inadequately compensable in damages. Accordingly, Agency may seek and obtain injunctive relief against the breach or threatened breach of the foregoing undertakings, in addition to any other legal remedies that may be available. Contractor acknowledges and agrees that the covenants contained herein are necessary for the protection of the legitimate business interests of Agency and are reasonable in scope and content Publicity. Contractor agrees that news releases and other publicity relating to the subject of this Contract will be made only with the prior written consent of Agency.

7.6

8.

CONTRACTOR’S REPRESENTATIONS AND WARRANTIES 8.1 Contractor’s General Representations and Warranties. Contractor represents and warrants to Agency that: 8.1.1 8.1.2 Contractor has the power and authority to enter into and perform this Contract; This Contract, when executed and delivered, will be a valid and binding obligation of Contractor enforceable according to its terms; Contractor will, at all times during the term of this Contract, be qualified to do business in the State of Oregon, professionally competent and duly licensed to perform the Services; Contractor is not in violation of, charged with, nor to the best of Contractor’s knowledge, under any investigation with respect to violation of any provision of any federal, state, or local law, ordinance, or regulation, or any other requirement or order of any governmental or regulatory body or court or arbitrator that is
Page 64 of 113

8.1.3

8.1.4

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

applicable to provision of the Services, and Contractor’s provision of the Services shall not violate any such law, ordinance, regulation or order. 8.1.5 Contractor’s performance under this Contract to the best of Contractor’s knowledge creates no potential or actual conflict of interest, as defined by ORS 244, for either Contractor or any Contractor personnel that will perform the Services under this Contract. The Contractor Data and Tax Certification in the form attached hereto as Exhibit C and the Certification Statement For Independent Contractor in the form attached hereto as Exhibit D, if applicable, are true and accurate as of the Effective Date, and Contractor will notify Agency in writing if any such data or certifications change during the term of this Contract such that the attached Exhibits C or D, if applicable, are no longer true and accurate.

8.1.6

8.2

Contractor’s Performance Warranties. Contractor represents and warrants to Agency that: (1) Contractor has the skill and knowledge possessed by well-informed members of its trade or profession, and Contractor will apply that skill and knowledge with care and diligence so that Contractor, Contractor’s employees, and any authorized subcontractors perform the Services described in this Contract in accordance with the highest standards prevalent in the industry or business most closely involved in providing the Services that Contractor is providing to Agency pursuant to this Contract, and (2) following the date of completion of the Services, the Work Product, and the Deliverables will conform to the Statement of Work and the Acceptance Criteria. Contractor specifically warrants that as to any Deliverable hereunder such Deliverable shall: (a) be free from material errors caused by Contractor’s failure to fulfill its obligations under this Contract, and (b) materially conform to all requirements and specifications contained in the Statement of Work and the Acceptance Criteria. 8.2.1 So long as Agency has paid fees for the Subscription Services, the System provided by Contractor to Agency to deliver the Subscription Services, shall materially conform to the Acceptance Criteria set forth in this Contract, including the Statement of Work and any Documentation provided by Contractor, shall be free from error or defect that materially impairs their use, and shall be free from defects in materials, workmanship and design. Except as otherwise set forth in this Contract, any subcontractors performing work for Contractor under this Contract have assigned all of their rights in the Deliverables to Contractor or Agency and no third party has any right, title or interest in any Deliverables supplied to Agency under this Contract. Contractor represents and warrants that it will maintain, operate and enforce, prior to the receipt of, and during the period in which Contractor has possession of or access to, any Personal Information, an active and effective information security program that at minimum complies with the requirements of the Oregon Identity Theft Protection Act (ORS 646A.600 to .628) to preserve the security and confidentiality of all Personal Information that is contained in any document,
Page 65 of 113

8.2.2

8.2.3

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

record, compilation of information or other item to which Contractor receives access, possession, custody or control. 8.2.4 Contractor represents and warrants that at the time of implementation of the Subscription Services shall be free of what are commonly defined as viruses, backdoors, worms, spyware, malware, and other malicious code that will hamper performance of the software, unlawfully collect information on users, unlawfully collect personally identifiable information on users or clients, or prevent the Solution from performing as required under the terms and conditions of this Contract. Nothwithstanding the foregoing, this representation and warranty does not include a disabling device that limits, suspends, or ends use of the Solution expressly permitted by the terms and conditions of the license(s) under which the Solution was provided. Warranties Cumulative. Contractor’s warranties provided in this Section 8 are in addition to and not in lieu of any other warranties provided in this Contract, including any in the Proposal. All warranties provided for in this Contract shall be cumulative, shall be deemed consistent and not in conflict, are intended to be given full force and effect and to be interpreted expansively to give the broadest warranty protection to Agency.

8.2.5

8.3

WARRANTIES EXCLUSIVE; DISCLAIMERS. THE WARRANTIES SET FORTH IN THIS CONTRACT ARE EXCLUSIVE AND IN LIEU OF ALL OTHER WARRANTIES, WHETHER EXPRESS OR IMPLIED, AND CONTRACTOR EXPRESSLY DISCLAIMS ALL OTHER WARRANTIES, INCLUDING ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. CONTRACTOR DOES NOT WARRANT THAT THE AGENCY’S USE OF THE PRODUCTS WILL BE UNINTERRUPTED OR ERROR FREE. The warranties stated above will not apply to the extent that there has been misuse, accident, modification, unsuitable physical or operating environment, operation in other than the specified operating environment, improper maintenance by Agency or a third party, or failure or damage caused by a product for which Contractor is not responsible.

8.4

8

LIMITATION OF LIABILITY 9.1 EXCEPT FOR LIABILITY ARISING OUT OF OR RELATED TO (i) SECTION 10.1, (ii) SECTION 10.2, (iii) SECTION 7, OR (v) CLAIMS FOR PERSONAL INJURY, INCLUDING DEATH, OR DAMAGE TO REAL PROPERTY OR TANGIBLE PERSONAL PROPERTY ARISING FROM THE NEGLIGENCE, RECKLESS CONDUCT OR INTENTIONAL ACTS OF CONTRACTOR, ITS OFFICERS, EMPLOYEES OR AGENTS, CONTRACTOR’S LIABILITY FOR DAMAGES TO THE STATE FOR ANY CAUSE WHATSOEVER SHALL BE LIMITED TO ONE AND ONE TIMES THE MAXIMUM-NOT-TO-EXCEED AMOUNT OF THE CONTRACT. EXCEPT FOR LIABILITY TO THIRD PERSONS ARISING OUT OF OR RELATED TO: (i) SECTION 10.1, (ii) SECTION 10.2, (iii) SECTION 7, OR (v) CLAIMS FOR
Page 66 of 113

9.2

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

PERSONAL INJURY, INCLUDING DEATH, OR DAMAGE TO REAL PROPERTY OR TANGIBLE PERSONAL PROPERTY ARISING FROM THE NEGLIGENCE, RECKLESS CONDUCT OR INTENTIONAL ACTS OF CONTRACTOR, ITS OFFICERS, EMPLOYEES OR AGENTS. NEITHER PARTY IS LIABLE FOR ANY LOST PROFITS, LOST SAVINGS, LOST DATA, PUNITIVE, INDIRECT, EXEMPLARY, CONSEQUENTIAL OR INCIDENTAL DAMAGES.

9

INDEMNIFICATION 10.1 General Indemnity. Contractor shall defend, save, hold harmless, and indemnify the State of Oregon and Agency and their officers, employees and agents from and against all third party claims, suits, actions, losses, damages, liabilities, statutory penalties, costs and expenses for personal injury, including death, damage to real property and damage to tangible personal property resulting from, arising out of, or relating to the intentional, reckless or negligent acts or omissions of Contractor or its officers, employees, subcontractors, or agents under this Contract; provided that Contractor shall have no obligation to indemnify Agency or the State of Oregon from and against any claims, suits, actions, losses, damages, liabilities, costs and expenses attributable solely to the acts or omissions of Agency or the State of Oregon, and their officers, employees or agents. IP Indemnity. In addition to and without limiting the generality of Section 10.1, Contractor expressly agrees to, indemnify, defend and hold the State of Oregon and its agencies, subdivisions, officers, directors, employees and agents harmless from any and all third party claims, suits, actions, losses, damages, liabilities, costs and expenses of any nature whatsoever resulting from, arising out of or relating to any claims that the Deliverables or use thereof infringe or violate any patent, copyright, trade secret, trademark, trade dress, mask work, utility design, or other proprietary right (collectively, “Intellectual Property Rights”) of any third party. If Contractor believes at any time that the Deliverables infringe a third party’s Intellectual Property Rights, Contractor may upon receipt of Agency’s prior written consent, which Agency shall not unreasonably withhold: (i) replace an infringing item with a non-infringing item that meets or exceeds the performance and functionality of the replaced item; or (ii) obtain for Agency the right to continue to use the infringing item; or (iii) modify the infringing item to be noninfringing, provided that, following any replacement or modification made pursuant to the foregoing, the Deliverables continue to meet the requirements, specifications and Acceptance Criteria of this Contract. Contractor’s failure or inability to accomplish any of the foregoing shall be deemed a material breach of this Contract, and Agency may pursue any rights and remedies available to it under this Contract, including termination. 10.2.1 Contractor shall not be liable under this Section 10.2 for any claim for infringement based solely on the following: 10.2.1.1 Agency’s modification of the Deliverables or the System/Solution other than as contemplated by this Contract, a Deliverable, or the System specifications; or as otherwise authorized by Contractor in writing.

10.2

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 67 of 113

10.2.1.2 Use of the Deliverables or the System in a manner other than as contemplated in this Contract, a Deliverable, or the System specifications; or as otherwise authorized by Contractor in writing. 10.2.1.3 Use of the Deliverables or the system in combination, operation, or use with other products other than as contemplated by this Contract, by a Deliverable, or the System specifications; or as otherwise authorized by Contractor in writing. 10.3 Control of Defense and Settlement. Contractor’s obligation to indemnify Agency as set forth in Sections 10.1 and 10.2 is conditioned on Agency providing to Contractor prompt notification of any claim or potential claim of which Agency becomes aware that may be the subject of those Sections. Contractor shall have control of the defense and settlement of any claim that is subject to Section 10.1 or Section 10.2; however, neither Contractor nor any attorney engaged by Contractor shall defend the claim in the name of the State of Oregon or any agency of the State of Oregon, nor purport to act as legal representative of the State of Oregon or any of its agencies, without the approval of the Attorney General, nor shall Contractor settle any claim on behalf of the State of Oregon without the approval of the Attorney General. The State of Oregon may, at its election and expense, assume its own defense and settlement in the event that the State of Oregon determines that Contractor is prohibited from defending the State of Oregon, is not adequately defending the State of Oregon’s interests, or that an important governmental principle is at issue and the State of Oregon desires to assume its own defense. Damages to State Property and Employees. Contractor shall be liable for all claims, suits, actions, losses, damages, liabilities, costs and expenses for personal injury, including death, damage to real property and damage to tangible personal property of the State of Oregon or any of its employees resulting from, arising out of, or relating to the intentional, reckless or negligent acts or omissions of Contractor or its officers, employees, subcontractors, or agents under this Contract. Insurance. Contractor shall provide insurance as required by Exhibit B.

10.4

10.5 10

EVENTS OF DEFAULT 11.1 Default by Contractor. Contractor shall be in default under this Contract if: 11.1.1 Contractor institutes or has instituted against it insolvency, receivership, or bankruptcy proceedings which are not dismissed within 60 Business Days of their commencement, makes an assignment for the benefit of creditors, or ceases doing business on a regular basis; or 11.1.2 Contractor no longer holds a license or certificate that is required for Contractor to perform the Services and Contractor has not obtained such license or certificate within 30 Business Days after delivery of Agency’s notice or such longer period as Agency may specify in such notice; or 11.1.3 Contractor commits any material breach of any covenant, warranty, obligation or certification under this Contract, fails to perform the Services in conformance with

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 68 of 113

the specifications and warranties provided herein, or clearly manifests an intent not to perform future obligations under this Contract, and such breach or default is not cured, or such manifestation of an intent not to perform is not corrected by reasonable written assurances of performance within 30 Business Days after delivery of Agency’s notice or such longer period as Agency may specify in such notice. 11.2 Default by Agency. Agency shall be in default under this Contract if: 11.2.1 Agency fails to pay Contractor any amount pursuant to the terms of this Contract, and Agency fails to cure such failure within 30 Business Days after delivery of Contractor’s notice or such longer period as Contractor may specify in such notice; or 11.2.2 Agency commits any material breach or default of any covenant, warranty, or obligation under this Contract, fails to perform its commitments hereunder within the time specified or any extension thereof, and Agency fails to cure such failure within 30 Business Days after delivery of Contractor’s notice or such longer period as Contractor may specify in such notice. 11 REMEDIES FOR DEFAULT 12.1 Agency’s Remedies. In the event Contractor is in default under Section 11.1, Agency may, at its option, pursue any or all of the remedies available to it under this Contract and at law or in equity, which include, without limitation: 12.1.1 Termination of this Contract under Section 13.2; 12.1.2 Withholding all monies due for Services that Contractor is obligated but has failed to perform within 30 Business Days after Agency has notified Contractor of the nature of Contractor’s default; 12.1.3 Initiation of an action or proceeding for damages, specific performance, declaratory or injunctive relief; and 12.1.4 Exercise of its right of setoff. 12.2 Remedies Cumulative. These Agency remedies are cumulative to the extent the remedies are not inconsistent, and Agency may pursue any remedy or remedies singly, collectively, successively or in any order whatsoever. If it is determined for any reason that Contractor was not in default under Section 11.1, the rights and obligations of the parties shall be the same as if this Contract was terminated pursuant to Section 13.1. Contractor’s Remedies. In the event Agency terminates this Contract as set forth in Section 13.1, or in the event Agency is in default under Section 11.2 and whether or not
Page 69 of 113

12.3

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Contractor elects to exercise its right to terminate the Contract under Section 13.3, Contractor’s sole monetary remedy shall be a claim for: (i) any unpaid invoices for Deliverables completed, delivered and accepted; and, (ii) for all other incomplete Deliverables an amount calculated by determining the percentage of Services completed for each unpaid Deliverable and applying that percentage to the fixed price for the Deliverable and any authorized expenses incurred. If previous amounts paid to Contractor exceed the amount due to Contractor under this Section 12.3, Contractor shall pay any excess to Agency upon written demand. 12 TERMINATION 13.1 Agency’s Right to Terminate. Agency may, at its sole discretion, terminate this Contract, as follows: 13.1.1 Agency may terminate this Contract for its convenience upon 30 calendar days’ prior written notice to Contractor. 13.1.2 Agency may terminate this Contract if Agency fails to receive funding, appropriations, limitations or other expenditure authority at levels sufficient to pay for Contractor’s Services; 13.1.3 Agency may terminate this Contract if federal or state laws, regulations, or guidelines are modified or interpreted in such a way that the performance of the Services under this Contract is prohibited or Agency is prohibited from paying for such Services from the planned funding source; 13.1.4 Agency’s Right to Terminate for Cause. In addition to any other rights and remedies Agency may have under this Contract, Agency may terminate this Contract, in whole or in part, immediately upon Contractor’s default under Section 11.1. 13.2 Contractor’s Right to Terminate for Cause. Contractor may terminate this Contract upon Agency’s default under Section 11.2. Return of Property. Upon termination of this Contract for any reason whatsoever, Contractor shall immediately deliver to Agency all of Agency’s property (including without limitation Agency’s Confidential Information or any Deliverables for which Agency has made payment in whole or in part) that are in the possession or under the control of Contractor in whatever stage of development and form of recordation such Agency property is expressed or embodied at that time. Any property or Deliverable returned or delivered to Agency pursuant to this Section shall be provided without the warranties set forth in Section 8.2, unless Agency has accepted the Deliverable pursuant to Section 2.3.

13.3

13

INDEPENDENT CONTRACTOR; TAXES AND WITHHOLDING 14.1 Independent Contractor. Contractor shall perform all Services as an independent contractor. Although Agency reserves the right to determine and modify the delivery
Page 70 of 113

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

schedule for Services and to evaluate the quality of the completed performance, Agency cannot and will not control the means or manner of Contractor’s performance. Contractor is responsible for determining the appropriate means and manner of performing the Services. 14.2 Declaration and Certification. Contractor by execution of this Contract declares and certifies that (i) its performance of the Services creates no potential or actual conflict of interest as defined by ORS Chapter 244, for Contractor or any Contractor personnel who will perform Services under this Contract, and (ii) in the event that Contractor or its personnel are either employed by or performing services for the federal government, that no rules or regulations of the agency for which Contractor or its personnel work or are employed prohibit Contractor or its personnel from providing the Services under this Contract. Contractor also declares and certifies by execution of this Contract that it is not an “officer,” “employee,” or “agent” of Agency, as those terms are used in ORS 30.265. Responsible for Taxes. Contractor shall be responsible for all federal and state taxes applicable to compensation and other payments paid to Contractor under this Contract and, unless Contractor is subject to backup withholding, Agency will not withhold from such compensation and payments any amount to cover Contractor’s federal or state tax obligations. Contractor is not eligible for any social security, unemployment insurance, or workers’ compensation benefits from compensation or payments paid to Contractor under this Contract, except as a self-employed individual.

14.3

14

COMPLIANCE WITH APPLICABLE LAW. Compliance with Law Generally. Contractor shall comply with all federal, state and local laws, regulations, executive orders and ordinances applicable to the Contract. Without limiting the generality of the foregoing, Contractor expressly agrees to comply with the following laws, regulations and executive orders to the extent they are applicable to the Contract: (i) Titles VI and VII of the Civil Rights Act of 1964, as amended; (ii) Sections 503 and 504 of the Rehabilitation Act of 1973, as amended; (iii) the Americans with Disabilities Act of 1990, as amended; (iv) Executive Order 11246, as amended; (v) the Health Insurance Portability and Accountability Act of 1996; (vi) the Age Discrimination in Employment Act of 1967, as amended, and the Age Discrimination Act of 1975, as amended; (vii) the Vietnam Era Veterans’ Readjustment Assistance Act of 1974, as amended; (viii) ORS Chapter 659, as amended; (ix) all regulations and administrative rules established pursuant to the foregoing laws; and (x) all other applicable requirements of federal and state civil rights and rehabilitation statutes, rules and regulations. These laws, regulations and executive orders are incorporated by reference herein to the extent that they are applicable to the Contract and required by law to be so incorporated. Agency’s performance under the Contract is conditioned upon Contractor’s compliance with the obligations of contractors under ORS 279B.220, 279B.230 and 279B.235, which are incorporated by reference herein. DISPUTE RESOLUTION 16.1 Litigation. Any claim, action, suit, or proceeding (collectively, “Claim”) between Agency (or any other agency or department of the State of Oregon) and Contractor that arises from or relates to this Contract shall be brought and conducted solely and exclusively within the Circuit Court of Marion County for the State of Oregon; provided, however, if a Claim must be brought in a federal forum, then it shall be brought and conducted solely and
Page 71 of 113

15

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

exclusively within the United States District Court for the District of Oregon. In no event shall this section be construed as a waiver by the State of Oregon of any form of defense or immunity, whether sovereign immunity, governmental immunity, immunity based on the eleventh amendment to the Constitution of the United States or otherwise, from any claim or from the jurisdiction of any court. CONTRACTOR BY EXECUTION OF THIS CONTRACT HEREBY CONSENTS TO THE IN PERSONAM JURISDICTION OF THE COURTS REFERENCED IN THIS SECTION 16.1. 16.2 Governing Law. This Contract shall be governed by and construed according to the laws of the State of Oregon without regard to principles of conflict of laws.

16

MISCELLANEOUS PROVISIONS 17.1 Order of Precedence. This Contract consists of the following documents that are listed in descending order of precedence: (a) the terms and conditions of this Contract, less its Exhibits; (b) Exhibit H; (c) the Statement of Work, Exhibit A; (d) Exhibit G, and (e) Exhibits B, C, D, E and F. The aforementioned Exhibits are by this reference incorporated in the Contract. Recycling. Contractor shall, to the maximum extent economically feasible in the performance of the Contract, use recycled paper (as defined in ORS 279A.010(1)(gg)), recycled PETE products (as defined in ORS 279A.010(1)(hh)), and other recycled plastic resin products and recycled products (as “recycled product” is defined in ORS 279A.010(1)(ii).

17.2

17.3

Subcontracts and Assignment. Contractor shall not enter into any subcontracts for any of the Services required by this Contract or assign or transfer any of its interest in this Contract without Agency’s prior written consent. Any proposed use of a subcontractor which is located outside the United States or use of subcontract labor or facilities located outside the United States must be called to the specific attention of Agency. Agency’s consent to any subcontract or assignment shall be timely and not unreasonably withheld. Agency consent to a subcontract or assignment does not relieve Contractor of any of its duties or obligations under this Contract. The assignment of this Contract, in whole or in part to a successor organization by merger or acquisition does not require the consent of the other. Contractor is also permitted to assign its rights to payments without obtaining Agency’s consent. The parties expressly agree Agency may in its sole discretion assign this Contract, including any service agreement, hosting agreement or maintenance agreement, and including transfer of all necessary licenses, to any successor entity that assumes operation, in whole or in part, of the HIE.

17.4

Successors and Assigns. The provisions of this Contract shall be binding upon and shall inure to the benefit of the parties hereto and their respective successors and permitted assigns, if any. No Third-Party Beneficiaries. Agency and Contractor are the only parties to this Contract and are the only parties entitled to enforce its terms. Nothing in this Contract gives, is intended to give, or shall be construed to give or provide any benefit or right, whether directly, indirectly, or otherwise, to third persons unless such third persons are
Page 72 of 113

17.5

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

individually identified by name herein and expressly described as intended beneficiaries of the terms of this Contract. 17.6 Funds Available and Authorized. Contractor shall not be compensated for Services performed under this Contract by any other agency or department of the State of Oregon. Agency believes it has sufficient funds currently available and authorized for expenditure to finance the costs of this Contract within Agency’s biennial appropriation or limitation. Contractor understands and agrees that Agency’s payment of amounts under this Contract is contingent on Agency receiving appropriations, limitations, or other expenditure authority sufficient to allow Agency, in the exercise of its reasonable administrative discretion, to continue to make payments under this Contract. Records Maintenance; Access. Contractor shall maintain all fiscal records and other records relating to its performance under this Contract in accordance with generally accepted accounting principles and in such a manner as to clearly document Contractor’s performance. Contractor acknowledges and agrees that Agency, the Oregon Secretary of State and the federal government and their duly authorized representatives shall have reasonable access, at their own cost and expense and only following reasonable notice to Contractor, to such records, in paper or electronic form, to perform examinations and audits and make excerpts and transcripts, Contractor shall retain and keep accessible all such fiscal records, books, documents, papers, plans, and writings for a minimum of 6 years, or such longer period as may be required by applicable law, following termination of this Contract, or until the conclusion of any audit, controversy, or litigation arising out of or related to this Contract, whichever date is later. Foreign Contractor. If Contractor is not domiciled in or registered to do business in the State of Oregon, Contractor shall promptly provide to the Oregon Department of Revenue and the Secretary of State, Corporation Division, all information as required by those agencies relative to this Contract. Contractor shall demonstrate its legal capacity to perform the Services under this Contract in the State of Oregon before entering into this Contract. Survival. All rights and obligations shall cease upon termination or expiration of this Contract, except for the rights and obligations and declarations set forth in Sections 5, 6, 7, 8, 9, 10, 12, 13, 14 and 16, and Sections 14.3, 17.1, 17.4, 17.5, 17.7, 17.9, 17.12, 17.13, 17.18, 17.19, 17.20 and 17.21.

17.7

17.8

17.9

17.10 Time Is of the Essence. Contractor agrees that time is of the essence under this Contract for critical path Deliverables or Milestones as set forth in the Statement of Work. 17.11 Force Majeure. Neither Agency nor Contractor shall be liable to the other for any failure or delay of performance of any obligations hereunder when such failure or delay shall have been wholly or principally caused by acts or events beyond its reasonable control, including without limitation acts of God, acts of civil or military authority, fires, floods, earthquakes or other natural disasters, war, riots or strikes. Both parties shall, however, make all reasonable efforts to remove or eliminate such a cause of delay or default and shall, upon the cessation of the cause, diligently pursue performance of its obligations under this Contract.
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 73 of 113

17.12 Notices. Except as otherwise expressly provided in this Contract, any communications between the parties hereto or notices to be given hereunder shall be given in writing by personal delivery of, facsimile transmission of, or mailing the same (postage prepaid) to Contractor at the address or number set forth on Exhibit E, and to Agency at the address or number set forth on Exhibit F, or to such other addresses or numbers as either party may hereafter indicate pursuant to this Section 17.12. Any communication or notice so addressed and mailed shall be deemed to be given 5 calendar days after mailing. Any communication or notice delivered by facsimile shall be deemed to be given when the transmitting machine generates receipt of the transmission. To be effective against Agency, such facsimile transmission must be confirmed by telephone notice to the Agency Authorized Representative. Any communication or notice by personal delivery shall be deemed to be given when actually received by the appropriate Authorized Representative. 17.13 Severability. The parties agree that if any term or provision of this Contract is declared by a court of competent jurisdiction to be illegal or in conflict with any law, the validity of the remaining terms and provisions shall not be affected, and the rights and obligations of the parties shall be construed and enforced as if this Contract did not contain the particular term or provision held to be invalid. 17.14 Counterparts. This Contract may be executed in several counterparts, all of which when taken together shall constitute one Contract binding on all parties, notwithstanding that all parties are not signatories to the same counterpart. Each copy of this Contract so executed shall constitute an original.

17.15 Amendments 17.15.1 Generally. This Contract may be amended, modified, or supplemented only by a written amendment signed by Agency and Contractor that has been approved by DAS and DOJ, if required by applicable law. Any amendment that provides for additional Services may only provide for Services directly related to the scope of Services described in the RFP, and no amendment shall be effective until all requisite signatures and approvals are obtained. Anticipated Amendments. The parties have determined that during the term of the Contract, the parties may need to modify selected terms, conditions, price(s) and types of Services under circumstances related to the following illustrative, although not exhaustive, categories of anticipated amendments: 17.15.2.1 Amendments required as a result of necessary changes in the State's business process that may restructure a State Agency; 17.15.2.2 Amendments to the Statement of Work to add Services within the scope of the RFP and the Contract; 17.15.2.3 Amendments to delete Services from the Statement of Work of the Contract;
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 74 of 113

17.15.2

17.15.2.4 Amendments to extend the term of the Contract; and 17.15.2.5 Amendments to change pricing. 17.15.3 Change Control Procedures 17.15.3.1 Written Change Requests. Either Agency or Contractor may request a change to this Contract, including all Exhibits hereto, by submitting a written change request describing the change requested. Agency’s and Contractors’ Authorized Representatives will review the written change request and either mutually approve it for further analysis or reject it. 17.15.3.2 Analysis of Change Requests; Change Orders. The party to whom the written change request has been submitted, if it has not been rejected pursuant to Section 17.15.3.1, shall analyze such change request to determine the effect that the implementation of the change will have on the Statement of Work. If any change is approved, the party that submitted the request for the change shall prepare a written change order, detailing all modifications to the scope, price, Delivery Schedule or other terms (the “Change Order”). A Change Order at a minimum shall contain the following information: 17.15.3.2.1 17.15.3.2.2. The date of issuance of the Change Order; A detailed description of the Services to be performed under the Change Order; The particular specification or matter set forth in the applicable Statement of Work which will be altered and the precise scope of that alteration; The cost of the Services to be performed pursuant to the Change Order; and The cumulative cost of all Change Orders previously issued.

17.15.3.2.3

17.15.3.2.4

17.15.3.2.5 17.15.4

A Change Order shall alter only that portion of the Statement of Work to which it expressly relates and shall not otherwise affect the terms and conditions of this Contract. Both parties must sign the Change Order to authorize the Services described therein and incorporate the changes into this Contract. No Services shall be performed pursuant to the Change Order and no payment shall be made on account of the Change Order until the Change Order is fully executed and approved as set forth in Section 17.15. Payments. Subject to the foregoing Sections of this Section 17.15 and performance of the Services, Agency shall pay for Services performed
Page 75 of 113

17.15.5

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

pursuant to a Change Order according to the acceptance and payment procedures set forth in this Contract. 17.16 Disclosure of Social Security Number. Contractor must provide Contractor’s Social Security number unless Contractor provides a federal tax identification number. This number is requested pursuant to ORS 305.385, OAR 125-246-0330(2)(d), and OAR 150305.100. Social Security numbers provided pursuant to this authority will be used for the administration of state, federal, and local tax laws. 17.17 Waiver. The failure of either party to enforce any provision of this Contract or the waiver of any violation or nonperformance of this Contract in one instance shall not constitute a waiver by the party of that or any other provision nor shall it be deemed to be a waiver of any subsequent violation or nonperformance. No waiver, consent, modification, or change of terms of this Contract shall bind either party unless in writing and signed by both parties and, with respect to Agency’s waiver or consent, all necessary State of Oregon approvals have been obtained. Such waiver, consent, modification, or change, if made, shall be effective only in the specific instance and for the specific purpose given. 17.18 Headings. The headings in this Contract are included only for convenience and shall not control or affect the meaning or construction of this Contract. 17.19 Integration. This Contract and attached Exhibits constitute the entire agreement between the parties on the subject matter hereof. There are no understandings, agreements or representations, oral or written, not specified herein regarding this Contract. 17.20 No Partnership. This Contract is not intended, and shall not be construed, to create a partnership or joint venture between Agency and Contractor. Nothing in this Contract shall be construed to make Agency and Contractor partners or joint venture participants. 17.21 Publicity. Contractor agrees that it will not disclose the form, content or existence of this Contract or any Deliverable in any advertising, press releases or other materials distributed to prospective customers, or otherwise attempt to obtain publicity from its association with Agency or the State of Oregon, whether or not such disclosure, publicity or association implies an endorsement by Agency or the State of Oregon of Contractor’s services, without the prior written consent of Agency. 17.22 Stop Work Order. Agency may, at any time, by written notice to the Contractor, require the Contractor to stop all, or any part of the Services required by this Contract for a period of up to 90 days after the date of the notice, or for any further period to which the parties may agree through a duly executed amendment. Upon receipt of the notice, Contractor shall immediately comply with the Stop Work Order terms and take all necessary steps to minimize the incurrence of costs allocable to the work affected by the Stop Work Order notice. Within a period of 90 days after issuance of the written notice, or within any extension of that period to which the parties have agreed, Agency shall either: 17.22.1.1 or
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 76 of 113

Cancel or modify the Stop Work Order by a supplementary written notice;

17.22.1.2

Terminate Contractor’s Services as permitted by either the Default or the Convenience provisions of Section 11 through 13, Events of Default; Remedies for Default; Termination.

If the Stop Work Order is canceled, Agency may, after receiving and evaluating a request by the Contractor, make an adjustment in the time required to complete this Contract and the Contract price via a duly executed amendment.

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 77 of 113

CONTRACTOR, BY EXECUTION OF THIS CONTRACT, HEREBY ACKNOWLEDGES THAT CONTRACTOR HAS READ THIS CONTRACT, UNDERSTANDS IT, AND AGREES TO BE BOUND BY ITS TERMS AND CONDITIONS. CONTRACTOR: YOU WILL NOT BE PAID FOR SERVICES RENDERED BEFORE NECESSARY AGENCY APPROVALS. Signatures: Contractor:

Authorized Signature Printed Name and Title: AGENCY:

Date

Authorized Signature Printed Name and Title:

Date

Department of Administrative Services: Exempt per Delegation #306-08, as amended

Authorized Signature Printed Name and Title: Approved for Legal Sufficiency:

Date

Name

Assistant Attorney General

Date

DHS Office of Contracts and Procurement:

Authorized Signature Printed Name and Title:

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 78 of 113

EXHIBIT A Part 1 Statement of Work See RFP 3261, Scope of Work.

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 79 of 113

EXHIBIT A Part 2 Consideration 1.1 TBD 1.2 Travel and Other Expenses (Optional) Payment Provisions

Agency shall not reimburse Contractor for any travel or additional expenses under this Contract.

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 80 of 113

EXHIBIT A

Part 3 Special Provisions

1.

Vendor or Sub-Recipient Determination In accordance with the State Controller’s Oregon Accounting Manual, policy 30.40.00.102, and DHS procedure “Contractual Governance,” Agency determination is that: Contractor is a sub-recipient; OR Contractor is a vendor. Catalog of Federal Domestic Assistance (CFDA) #(s) of federal funds to be paid through this Contract: 93.778

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 81 of 113

EXHIBIT B INSURANCE Required Insurance: Contractor shall obtain at Contractor’s expense the insurance specified in this Exhibit B, prior to performing under this Contract and shall maintain it in full force and at its own expense throughout the duration of this Contract and all warranty periods. Contractor shall obtain the following insurance from insurance companies or entities that are authorized to transact the business of insurance and issue coverage in the State of Oregon and are acceptable to Agency. 1. Workers Compensation: All employers, including Contractor, that employ subject workers, as defined in ORS 656.027, shall comply with ORS 656.017 and shall provide workers’’ compensation insurance coverage for those workers, unless they meet the requirement for an exemption under ORS 656.126(2). Contractor shall require and ensure that each of its subcontractors complies with these requirements. Professional Liability: Required by Agency Not required by Agency

2.

Contractor shall obtain and maintain at its own expenses for the duration of this Contract Professional Liability Insurance wit h a combined single limit, or the equivalent, as set forth below. This is to cover damages caused by error, omission or negligent acts related to the professional services to be provided under this Contract. Full limits can be obtained by the purchase of one primary policy or a primary and excess policy as needed to provide the full policy limits. Such policy shall include coverage for losses arising from the breach of information security or cyber liability (including Technology Errors & Omissions, Network Security and Privacy Liability and Media Liability), whether combined with the Professional Liability policy or placed as a separate policy, but carrying the same limits of liability. Such coverage shall insure damage caused by error, omission, or negligent acts, including all prior acts without limitation, related to the professional services to be provided under this Contract. The Policy shall be amended to include Independent Contractors providing Professional Services on behalf of or at the direction of Contractor. The definition of Contractual Liability shall be amended to state that liability under a contract of professional services is covered. Further, coverage shall be afforded for fraudulent acts, misappropriation of trade secrets, internet professional services, computer attacks, personal injury, regulatory actions, known wrongful acts, contractual liability, privacy policy, and insured versus insured. Per occurrence limit for any single claimant: $2,500,000. AND Per occurrence limit for multiple claimants: $5,000,000. 3. Commercial General Liability: Required by Agency Not required by Agency Commercial General Liability Insurance covering bodily injury, death and property damage in a form and with coverages that are satisfactory to the State. This insurance shall include personal injury liability, products and completed operations. Coverage shall be written on an occurrence
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 82 of 113

basis. Contractor shall provide proof of insurance of not less than the following amounts as determined by the Agency: Per occurrence limit for any single claimant: From commencement of the Contract term to June 30, 2012: $1,700,000. July 1, 2012 to June 30, 2013: $1,800,000. July 1, 2013 to June 30, 2014: $1,900,000. July 1, 2014 to June 30, 2015: $2,000,000. July 1, 2015 and thereafter the adjusted limitation as determined by the State Court Administrator pursuant to ORS 30.273(3). Per occurrence limit for multiple claimants: From commencement of the Contract term to June 30, 2012: $3,400,000. July 1, 2012 to June 30, 2013: $3,600,000. July 1, 2013 to June 30, 2014: $3,800,000. July 1, 2014 to June 30, 2015: $4,000,000. July 1, 2015 and thereafter the adjusted limitation as determined by the State Court Administrator pursuant to ORS 30.273(3). AND Property Damage: Per occurrence limit for any single claimant: From July 1, 2011 through June 30, 2012: $101,400. From July 1, 2012 and every year thereafter the adjusted limitation as determined by the State Court Administrator pursuant to ORS 30.273(3). Per occurrence limit for multiple claimants: From July 1, 2011 through June 30, 2012: $500,900. From July 1, 2012 and every year thereafter the adjusted limitation as determined by the State Court Administrator pursuant to ORS 30.273(3). 4. Automobile Liability Insurance: Required by Agency Not required by Agency Automobile Liability Insurance covering all owned, non-owned, or hired vehicles. This coverage may be written in combination with the Commercial General Liability Insurance (with separate limits for “Commercial General Liability” and “Automobile Liability”). Contractor shall provide proof of insurance of not less than the following amounts as determined by the Agency: Bodily Injury/Death: Per occurrence limit for any single claimant: From commencement of the Contract term to June 30, 2012: $1,700,000. July 1, 2012 to June 30, 2013: $1,800,000. July 1, 2013 to June 30, 2014: $1,900,000. July 1, 2014 to June 30, 2015: $2,000,000. July 1, 2015 and thereafter the adjusted limitation as determined by the State Court Administrator pursuant to ORS 30.273(3). Per occurrence limit for multiple claimants: From commencement of the Contract term to June 30, 2012: July 1, 2012 to June 30, 2013:
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

$3,400,000. $3,600,000.
Page 83 of 113

July 1, 2013 to June 30, 2014: $3,800,000. July 1, 2014 to June 30, 2015: $4,000,000. July 1, 2015 and thereafter the adjusted limitation as determined by the State Court Administrator pursuant to ORS 30.273(3). AND Property Damage: Property Damage: Per occurrence limit for any single claimant: From July 1, 2011 through June 30, 2012: $101,400. From July 1, 2012 and every year thereafter the adjusted limitation as determined by the State Court Administrator pursuant to ORS 30.273(3). Per occurrence limit for multiple claimants: From July 1, 2011 through June 30, 2012: $500,900. From July 1, 2012 and every year thereafter the adjusted limitation as determined by the State Court Administrator pursuant to ORS 30.273(3). 5. Additional Insured: The Commercial General Liability insurance and Automobile Liability insurance required under this Contract shall include the State of Oregon, its officers, employees and agents as Additional Insureds but only with respect to Contractor's activities to be performed under this Contract. Coverage shall be primary and non-contributory with any other insurance and self-insurance. 6. Notice of Cancellation or Change: There shall be no cancellation, material change, potential exhaustion of aggregate limits or nonrenewal of insurance coverage(s) without 60 days’ written notice from this Contractor or its insurer(s) to Agency. Any failure to comply with the reporting provisions of this clause shall constitute a material breach of Contract and shall be grounds for immediate termination of this Contract by Agency. 7. Proof of Insurance: Contractor shall provide to Agency information requested in Data Certification for all required insurance before delivering any Goods and performing any Services required under this Contract. Contractor shall pay for all deductibles, self-insured retention and self-insurance, if any. 8. “Tail” Coverage: If any of the required liability insurance is on a “claims made” basis, Contractor shall either maintain either “tail” coverage or continuous “claims made” liability coverage, provided the effective date of the continuous “claims made” coverage is on or before the effective date of this Contract, for a minimum of 24 months following the later of: (i) Contractor’s completion and Agency’s acceptance of all Services required under this Contract, or, (ii) The expiration of all warranty periods provided under this Contract. Notwithstanding the foregoing 24-month requirement, if Contractor elects to maintain “tail” coverage and if the maximum time period “tail” coverage reasonably available in the marketplace is less than the 24-month period described above, then Contractor shall maintain “tail” coverage for the maximum time period that “tail” coverage is reasonably available in the marketplace for the coverage required under this Contract. Contractor shall provide to Agency, upon Agency’s request, certification of the coverage required
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 84 of 113

under this Section 8.

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 85 of 113

EXHIBIT C CONTRACTOR DATA AND TAX CERTIFICATION 1. Contractor shall provide information set forth below. This information is requested pursuant to ORS 305.385 and OAR 125-246-0333(5). 1.1 Contractor Data and Insurance Information. Please print or type the following information:

Name (exactly as filed with the IRS) Address E-mail address: Telephone: ( ) Nonresident alien [ ] YES Proof of Insurance: Workers Compensation Insurance Company Policy # Professional Liability Insurance Company Policy # General Liability Insurance Company Policy # Auto Insurance Company Policy # Business Designation: [ ] Professional Corporation [ ] Partnership [ ] Limited Partnership [ ] Limited Liability Company [ ] Limited Liability Partnership [ ] Corporation [ ] Sole Proprietorship [ ] Other 1.2 2. The above information must be provided prior to Contract execution. Contractor shall provide proof of insurance upon request by Agency or Agency designee. Expiration Date: Expiration Date: Expiration Date: Expiration Date: [ ] NO Facsimile: ( ) DUNS Number: -

Certification. By signature on this Contract, the individual signing on behalf of Contractor hereby certifies and sears under penalty of perjury to the best of the individual’s knowledge that: 2.1 2.2 The information shown in Contractor Data and Certification above is Contractor’s true, accurate and correct information; Contractor is not subject to backup withholding because: 2.2.1 Contractor is exempt from backup withholding;

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 86 of 113

2.2.2 2.2.3 2.3

Contractor has not been notified by the IRS that Contractor is subject to backup withholding as a result of a failure to report all interest or dividends; or The IRS has notified Contractor that Contractor is no longer subject to backup withholding.

The individual signing on behalf of Contractor is authorized to act on behalf of Contractor, has authority and knowledge regarding Contractor’s payment of taxes, and that Contractor is, to the best of the undersigned’s knowledge, not in violation of any Oregon Tax Laws, including without limitation the following pursuant to OAR 150305.385()-(B): For purposes of this certificate, `Oregon tax laws' means the state inheritance tax, gift tax, personal income tax, withholding tax, corporation income and excise taxes, amusement device tax, timber taxes, cigarette tax, other tobacco tax, 9-1-1 emergency communications tax, the homeowners and renters property tax relief program and local taxes administered by the Department of Revenue (Multnomah County Business Income Tax, Lane Transit District Tax, Tri-Metropolitan Transit District Employer Payroll Tax, and Tri-Metropolitan Transit District Self-Employment Tax); Contractor is an independent contractor as defined in ORS 670.600.

2.4 3.

Contractor is required to provide its Federal Employer Identification Number (FEIN) or Social Security Number (SSN), as applicable, to Agency. By Contractor’s signature on this Contract, Contractor hereby certifies that the FEIN or SSN provided is true and accurate. If this information changes, Contractor is also required to provide Agency with the new FEIN or SSN within 10 calendar days.

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 87 of 113

EXHIBIT D

CERTIFICATION STATEMENT FOR INDEPENDENT CONTRACTOR (Contractor completes if Contractor is not a corporation or is a professional corporation.) A. CONTRACTOR IS AN INDEPENDENT CONTRACTOR. Contractor certifies that Contractor meets the following standards: 1. I am registered under ORS chapter 701 to provide labor or services for which such registration is required. I have filed federal and state income tax returns in the name of my business or a business Schedule C as part of the personal income tax return, for the previous year, or expect to file federal and state income tax returns, for labor or services performed as an independent contractor in the previous year. I will furnish the tools or equipment necessary for the contracted labor or services. I have the authority to hire and fire employees who perform the labor or services. I represent to the public that the labor or services are to be provided by my independently established business because 4 or more of the following circumstances exist. Please check 4 or more of the following: _____A. The labor or services are primarily carried out at a location that is separate from my residence or is primarily carried out in a specific portion of my residence, which is set aside as the location of the business. Commercial advertising or business cards are purchased for the business, or I have a trade association membership; Telephone listing is used for the business that is separate from the personal residence listing. Labor or services are performed only pursuant to written contracts. Labor or services are performed for two or more different persons within a period of one year. I assume financial responsibility for defective workmanship or for service not provided as evidenced by the ownership of performance bonds, warranties, errors and omission insurance or liability insurance relating to the labor or services to be provided. Date

2.

3. 4. 5.

_____B. _____C. _____D. _____E. _____F.

Contractor Signature Printed Name and Title:

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 88 of 113

(Agency completes B below when Contractor completes Section A above.) B. AGENCY APPROVAL. ORS 670.600. Independent Contractor Standards. As used in various provisions of ORS chapters 316, 656, 657 and 701, an individual or business entity that performs labor or services for remuneration shall be considered to perform the labor or services as an “independent contractor” if the standards of this Section are met. Agency certifies the contracted work meets the following standards: 1. The Contractor is free from direction and control over the means and manner of providing the labor or services, subject only to the specifications of the desired results. 2. The Contractor is responsible for obtaining all assumed business registrations or professional occupation licenses required by state law or local ordinances. 3. The Contractor furnishes the tools or equipment necessary for the contracted labor or services. 4. The Contractor has the authority to hire and fire employees to perform the labor or services. 5. Payment to the Contractor is made upon completion of the performance or is made on the basis of a periodic retainer. Agency Signature Printed Name and Title: (Agency’s certification is solely for the Agency’s benefit and internal use) Date

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 89 of 113

EXHIBIT E CONTRACTOR PERSONNEL Authorized Representative: Name Title Email Telephone Mobile Telephone Address Facsimile Project Manager: Name Title Email Telephone Mobile Telephone Address Facsimile Other Key Persons: Name Title Email Telephone Mobile Telephone Address Facsimile

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 90 of 113

EXHIBIT F AGENCY PERSONNEL Authorized Representative/Contract Administrator: Name Title Email Telephone Mobile Telephone Address Facsimile Project Manager: Name Title Email Telephone Mobile Telephone Address Facsimile Other Key Persons: Name Title Email Telephone Mobile Telephone Address Facsimile

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 91 of 113

EXHIBIT G SUBSCRIPTION AGREEMENT FOR SOFTWARE AS A SERVICE

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 92 of 113

EXHIBIT H

REQUIRED FEDERAL TERMS AND CONDITIONS Unless exempt under 45CFR Part 87 for Faith-Based Organizations (Federal Register, July 16, 2004, Volume 69, #136), or other federal provisions, Contractor shall comply and, as indicated, cause all subcontractors to comply with the following federal requirements to the extent that they are applicable to this Contract, to Contractor, or to the Work, or to any combination of the foregoing. For purposes of this Contract, all references to federal and state laws are references to federal and state laws as they may be amended from time to time. 1. MISCELLANEOUS FEDERAL PROVISIONS Contractor shall comply and require all subcontractors to comply with all federal laws, regulations, and executive orders applicable to the Contract or to the delivery of Work. Without limiting the generality of the foregoing, Contractor expressly agrees to comply and require all subcontractors to comply with the following laws, regulations and executive orders to the extent they are applicable to the Contract: (a) Title VI and VII of the Civil Rights Act of 1964, as amended, (b) Sections 503 and 504 of the Rehabilitation Act of 1973, as amended, (c) the Americans with Disabilities Act of 1990, as amended, (d) Executive Order 11246, as amended, (e) the Health Insurance Portability and Accountability Act of 1996, (f) the Age Discrimination in Employment Act of 1967, as amended, and the Age Discrimination Act of 1975, as amended, (g) the Vietnam Era Veterans’ Readjustment Assistance Act of 1974, as amended, (h) all regulations and administrative rules established pursuant to the foregoing laws, (i) all other applicable requirements of federal civil rights and rehabilitation statutes, rules and regulations, (j) all federal law governing operation of Community Mental Health Programs, including without limitation, all federal laws requiring reporting of Client abuse. These laws, regulations and executive orders are incorporated by reference herein to the extent that they are applicable to the Contract and required by law to be so incorporated. No federal funds may be used to provide Work in violation of 42 USC 14402. 2. EQUAL EMPLOYMENT OPPORTUNITY If this Contract, including amendments, is for more than $10,000, then Contractor shall comply and require all subcontractors to comply with Executive Order 11246, entitled “Equal Employment Opportunity,” as amended by Executive Order 11375, and as supplemented in Department of Labor regulations (41 CFR Part 60). 3. CLEAN AIR, CLEAN WATER, EPA REGULATIONS If this Contract, including amendments, exceeds $100,000 then Contractor shall comply and require all subcontractors to comply with all applicable standards, orders, or requirements issued under Section 306 of the Clean Air Act (42 U.S.C. 1857(h)), the Federal Water Pollution Control Act as amended (commonly known as the Clean Water Act) (33 U.S.C. 1251 to 1387), specifically including, but not limited to Section 508 (33 U.S.C. 1368), Executive Order 11738, and Environmental Protection Agency regulations (2 CFR Part 1532), which prohibit the use under non-exempt Federal contracts, grants or loans of facilities included on the EPA List of Violating Facilities. Violations shall be reported to OHA, HHS and the appropriate Regional Office of the Environmental Protection Agency. Contractor shall include and require all subcontractors to include in all contracts with subcontractors receiving more than $100,000, language requiring the subcontractor to comply with the federal laws identified in this Section. 4. ENERGY EFFICIENCY
Page 93 of 113 RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Contractor shall comply and require all subcontractors to comply with applicable mandatory standards and policies relating to energy efficiency that are contained in the Oregon energy conservation plan issued in compliance with the Energy Policy and Conservation Act (Pub. L. 94-163). 5. TRUTH IN LOBBYING Contractor certifies, to the best of the Contractor’s knowledge and belief that: a. No federal appropriated funds have been paid or will be paid, by or on behalf of Contractor, to any person for influencing or attempting to influence an officer or employee of an agency, a Member of Congress, an officer or employee of Congress, or an employee of a Member of Congress in connection with the awarding of any federal contract, the making of any federal grant, the making of any federal loan, the entering into of any cooperative agreement, and the extension, continuation, renewal, amendment or modification of any federal contract, grant, loan or cooperative agreement. If any funds other than federal appropriated funds have been paid or will be paid to any person for influencing or attempting to influence an officer or employee of any agency, a Member of Congress, an officer or employee of Congress, or an employee of a Member of Congress in connection with this federal contract, grant, loan or cooperative agreement, the Contractor shall complete and submit Standard Form LLL, “Disclosure Form to Report Lobbying” in accordance with its instructions. The Contractor shall require that the language of this certification be included in the award documents for all subawards at all tiers (including subcontracts, subgrants, and contracts under grants, loans, and cooperative agreements) and that all subrecipients and subcontractors shall certify and disclose accordingly.

b.

c.

This certification is a material representation of fact upon which reliance was placed when this Contract was made or entered into. Submission of this certification is a prerequisite for making or entering into this Contract imposed by Section 1352, Title 31 of the U.S. Code. Any person who fails to file the required certification shall be subject to a civil penalty of not less than $10,000 and not more than $100,000 for each such failure. 6. HIPAA COMPLIANCE OHA is a Covered Entity for purposes of the Health Insurance Portability and Accountability Act and the federal regulations implementing the Act (collectively referred to as HIPAA). OHA must comply with HIPAA to the extent that any Work or obligations of OHA arising under this Contract are covered by HIPAA. Contractor shall determine if Contractor is subject to HIPAA in the performance of any Work or other obligations under this Contract. To the extent that Contractor is subject to HIPAA, Contractor shall comply and cause all subcontractors to comply with the following: 6.1 Privacy and Security of Individually Identifiable Health Information. Individually Identifiable Health Information about specific individuals is confidential. Individually Identifiable Health Information relating to specific individuals may be exchanged between Contractor and OHA for purposes directly related to the provision of services to Clients which are funded in whole or in part under this Contract. However, Contractor shall not use or disclose any Individually Identifiable Health Information about specific individuals in a manner that would violate OHA Privacy Rules, OAR 407-014-0000 et. seq., or OHA Notice of Privacy Practices, if done by OHA. A copy of the most recent OHA Notice of Privacy Practices is posted on the OHA web site at http://dhsforms.hr.state.or.us/Forms/served/DE2090.pdf, or may be obtained from OHA.
Page 94 of 113

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

6.2

Data Transactions Systems. If Contractor intends to exchange electronic data transactions with OHA in connection with claims or encounter data, eligibility or enrollment information, authorizations or other electronic transaction, Contractor shall execute an EDI Trading Partner Agreement with OHA and shall comply with OHA EDI Rules. Consultation and Testing. If Contractor reasonably believes that the Contractor’s or OHA’ data transactions system or other application of HIPAA privacy or security compliance policy may result in a violation of HIPAA requirements, Contractor shall promptly consult the OHA Information Security Office. Contractor or OHA may initiate a request for testing of HIPAA transaction requirements, subject to available resources and the OHA testing schedule.

6.3

7.

RESOURCE CONSERVATION AND RECOVERY Contractor shall comply and require all subcontractors to comply with all mandatory standards and policies that relate to resource conservation and recovery pursuant to the Resource Conservation and Recovery Act (codified at 42 USC 6901 et. seq.). Section 6002 of that Act (codified at 42 USC 6962) requires that preference be given in procurement programs to the purchase of specific products containing recycled materials identified in guidelines developed by the Environmental Protection Agency. Current guidelines are set forth in 40 CFR Part 247.

8.

AUDITS 8.1 Contractor shall comply and, if applicable, require a subcontractor to comply, with the applicable audit requirements and responsibilities set forth in the Office of Management and Budget Circular A-133 entitled “Audits of States, Local Governments and Non-Profit Organizations.” Sub-recipients shall also comply with applicable Code of Federal Regulations (CFR) Sections and OMB Circulars governing expenditure of federal funds. State, local and Indian Tribal Governments and governmental hospitals must follow OMB A-102. Nonprofits, hospitals, colleges and universities must follow 2 CFR Part 215. Sub-recipients shall monitor any organization to which funds are passed for compliance with CFR and OMB requirements.

8.2

9.

DEBARMENT AND SUSPENSION Contractor shall not permit any person or entity to be a subcontractor if the person or entity is listed on the non-procurement portion of the General Service Administration’s “List of Parties Excluded from Federal Procurement or Nonprocurement Programs” in accordance with Executive Orders No. 12549 and No. 12689, “Debarment and Suspension”. (See 2 CFR Part 180.) This list contains the names of parties debarred, suspended, or otherwise excluded by agencies, and contractors declared ineligible under statutory authority other than Executive Order No. 12549. Subcontractors with awards that exceed the simplified acquisition threshold shall provide the required certification regarding their exclusion status and that of their principals prior to award.

10.

DRUG-FREE WORKPLACE Contractor shall comply and cause all subcontractors to comply with the following provisions to maintain a drug-free workplace: (i) Contractor certifies that it will provide a drug-free workplace by publishing a statement notifying its employees that the unlawful manufacture, distribution, dispensation, possession or use of a controlled substance, except as may be present in lawfully prescribed or over-the-counter medications, is prohibited in Contractor’s workplace or while providing services to OHA clients. Contractor’s notice shall specify the actions that

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 95 of 113

will be taken by Contractor against its employees for violation of such prohibitions; (ii) Establish a drug-free awareness program to inform its employees about: The dangers of drug abuse in the workplace, Contractor’s policy of maintaining a drug-free workplace, any available drug counseling, rehabilitation, and employee assistance programs, and the penalties that may be imposed upon employees for drug abuse violations; (iii) Provide each employee to be engaged in the performance of services under this Contract a copy of the statement mentioned in paragraph (i) above; (iv) Notify each employee in the statement required by paragraph (i) above that, as a condition of employment to provide services under this Contract, the employee will: abide by the terms of the statement, and notify the employer of any criminal drug statute conviction for a violation occurring in the workplace no later than 5 days after such conviction; (v) Notify OHA within 10 days after receiving notice under subparagraph (iv) above from an employee or otherwise receiving actual notice of such conviction; (vi) Impose a sanction on, or require the satisfactory participation in a drug abuse assistance or rehabilitation program by any employee who is so convicted as required by Section 5154 of the Drug-Free Workplace Act of 1988; (vii) Make a good-faith effort to continue a drug-free workplace through implementation of subparagraphs (i) through (vi) above; (viii) Require any subcontractor to comply with subparagraphs (i) through (vii) above; (ix) Neither Contractor, or any of Contractor’s employees, officers, agents or subcontractors may provide any service required under this contract while under the influence of drugs. For purposes of this provision, “under the influence” means: observed abnormal behavior or impairments in mental or physical performance leading a reasonable person to believe the Contractor or Contractor’s employee, officer, agent or subcontractor has used a controlled substance, prescription or non-prescription medication that impairs the Contractor or Contractor’s employee, officer, agent or subcontractor’s performance of essential job function or creates a direct threat to OHA clients or others. Examples of abnormal behavior include, but are not limited to: hallucinations, paranoia or violent outbursts. Examples of impairments in physical or mental performance include, but are not limited to: slurred speech, difficulty walking or performing job activities; (x) Violation of any provision of this subsection may result in termination of the contract. 11. PRO-CHILDREN ACT Contractor shall comply and require all subcontractors to comply with the Pro-Children Act of 1994 (codified at 20 USC Section 6081 et. seq.). 12. MEDICAID SERVICES Contractor shall comply with all applicable federal and state laws and regulation pertaining to the provision of Medicaid Services under the Medicaid Act, Title XIX, 42 USC Section 1396 et. seq., including without limitation: 12.1 Keep such records as are necessary to fully disclose the extent of the services provided to individuals receiving Medicaid assistance and shall furnish such information to any state or federal agency responsible for administering the Medicaid program regarding any payments claimed by such person or institution for providing Medicaid Services as the state or federal agency may from time to time request. 42 USC Section 1396a (a)(27); 42 CFR 431.107(b)(1) & (2). Comply with all disclosure requirements of 42 CFR 1002.3(a) and 42 CFR 455 Subpart (B). Maintain written notices and procedures respecting advance directives in compliance with 42 USC Section 1396(a)(57) and (w), 42 CFR 431.107(b)(4), and 42 CFR 489 subpart I.
Page 96 of 113

12.2 12.3

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

12.4

Certify when submitting any claim for the provision of Medicaid Services that the information submitted is true, accurate and complete. Contractor shall acknowledge Contractor’s understanding that payment of the claim will be from federal and state funds and that any falsification or concealment of a material fact may be prosecuted under federal and state laws. Entities receiving $5 million or more annually (under this contract and any other Medicaid contract) for furnishing Medicaid health care items or services shall, as a condition of receiving such payments, adopt written fraud, waste and abuse policies and procedures and inform employees, contractors and agents about the policies and procedures in compliance with Section 6032 of the Deficit Reduction Act of 2005, 42 USC § 1396a(a)(68).

12.5

13.

AGENCY-BASED VOTER REGISTRATION Contractor shall comply with the Agency-based Voter Registration Sections of the National Voter Registration Act of 1993 that require voter registration opportunities be offered where an individual may apply for or receive an application for public assistance.

14.

SOFTWARE AND OWNERSHIP RIGHTS Agency has included terms at Section 6.2.2 in accordance with 45 CFR 95.617, which specifies that Agency shall have all ownership rights in software or modifications thereof, and associated documentation, that is designed, developed, or installed with federal financial participation. If the federal Department of Health and Human Services (DHHS) funds are paid to Contractor, including any subcontractor, under this Contract, then Contractor agrees and shall cause all subcontractors to agree to comply with the Federal License provisions in 95.617(b), which states that DHHS reserves a royalty-free, non-exclusive and irrevocable license to reproduce, publish, or otherwise use and to authorize others to use for Federal Government purposes, such software, modifications, and documentation.

15.

COMPLIANCE WITH ARRA REQUIREMENTS The requirements contained in this Section 14 apply to all funding under this Contract that is provided under the American Recovery and Reinvestment Act of 2009, Pub.L.111-5 (“ARRA” or “the Act”), 15.1 Compliance with ARRA Requirements Contractor specifically agrees to comply with all requirements of the American Recovery and Reinvestment Act of 2009, Pub.L.111-5 (“ARRA” or “the Act”) and the ARRArelated terms and conditions of this Contract. Contractor understands and acknowledges that the federal stimulus process is still evolving and that new requirements relating to ARRA compliance may still be forthcoming from the federal government and the State of Oregon. Accordingly, Contractor specifically agrees that both it and its subcontractors will comply with all current requirements and all future requirements of the federal government and the State of Oregon while the Contract is in force. 15.2 Registration Under Section 1512 of the Act, Contractor shall obtain a Dun and Bradstreet Data Universal Numbering System (“DUNS”) number, and have registered with the Central Contractor Registration (“CCR”), on or before full execution of this Contract. Contractor shall keep its DUNS and CCR information current, while the Contract is in force. 15.3 Reporting
Page 97 of 113

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Under Section 1512 of ARRA, state agencies receiving ARRA funds must submit a report to the federal government no later than ten (10) calendar days after the end of each calendar quarter. Accordingly, Contractor agrees to provide the State with any information within the scope of Contractor’s Contract that is requested by OHIT for its ARRA reporting on or before the third day following the end of the calendar quarter, in order for the State to timely provide the required information to the federal government. 15.4 Whistleblower Protection Contractor shall, and in its subcontracts shall require its subcontractor to, comply with Section 1553 of ARRA, which prohibits all non-federal contractors of ARRA funds, including the State of Oregon, and all contractors of the State, form discharging, demoting or otherwise discriminating against an employee as a reprisal for the employee’s disclosure of information that the employee reasonably believes is evidence of: (1) gross mismanagement of a contract or grant relating to ARRA funds; (b) a gross waste of ARRA funds; (c) a substantial and specific danger to public health or safety related to the implementation or use of ARRA funds; (d) an abuse of authority related to implementation or use of ARRA funds; or (e) a violation of law, rule or regulation related to an agency contract (including the competition for or negotiation of a contract) or grant, awarded or issued relating to ARRA funds. Contractor shall, and in its subcontracts shall require its subcontractors to, post notice of the rights and remedies available to employees under Section 1553 of ARRA. 15.5 Prohibition on Use of ARRA Funds Under Section 1604 of ARRA, Contractor agrees that none of the funds made available under this contract may be used for any casino or other gambling establishment, aquarium, zoo, golf course, swimming pools or similar projects. 15.6 Inspection of Records 15.6.1 Contractor shall comply with Section 902 of ARRA, which grants the U.S. Comptroller or its designated representatives the authority “to examine any records of the contractor or any of its subcontractors, or any state or local agency administering such contract, that directly pertain to, and involve transactions relating to, the contract or subcontract;” and “to interview any officer or employee of the contractor or any of its subcontractors, or of any state or local government agency administering the contract, regarding such transactions.” 15.6.2 Contractor shall comply with Section 1515 of ARRA, which grants the Inspector General or its designated representatives the authority “to examine any records of the contractor or grantee, any of its subcontractors or subgrantees, or any state or local agency administering such contract that pertain to, and involve transactions relating to, the contract, subcontract, grant, or subgrant;” and “to interview any officer or employee of the contractor, grantee, subgrantee, or agency regarding such transactions.” 15.7 Signage In addition to any other signage requirements that OHA may require, Contractor shall post ARRA signage to designate the project as a federal stimulus recovery project. The following website contains the ARRA logo: http://www.recovery.gov/?q=node/203. 15.8 False Claims Act
Page 98 of 113

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Contractor shall promptly refer to an appropriate federal inspector general any credible evidence that a principal, employee, agent, subcontractor or other person has committed a false claim under the False Claims Act (31 U.S.C. 15.9 Enforceability Contractor agrees that if Contractor or one of its subcontractors fails to comply with all applicable federal and state requirements governing the use of ARRA funds, the federal agency or the State may withhold or suspend, in whole or in part, funds awarded under the program, or recover misspent funds awarded under the program, or recover misspent funds following an audit. This provision is in addition to all other remedies available to the State under all applicable State and federal laws. 15.10 Segregation of Funds Contractor shall segregate obligations and expenditures of ARRA funds from other funding. No part of funds made available under ARRA may be commingled with any other funds or used for a purpose other than that of making payments for costs allowable under ARRA. 15.11 Sub-recipient Agreements Contractor shall include these standard terms and conditions, including this requirement, in any of its subcontracts in connection with projects funded in whole or in part with funds available under ARRA. 15.12 Conflicting Provisions Contractor agrees that, to the extent ARRA requirements conflict with State requirements, the ARRA requirements control. 15.13 State of Oregon Worksource Posting Requirements Contractor shall list any job openings at Contractor’s firm/business through WorkSource Oregon. Contractor shall also require its subcontractors and sub-Contractors to list any jobs openings at the subcontractor’s/sub-Contractor’s firms/business through WorkSource Oregon. Contractor is not required to list job openings (or require listing by Contractor’s subcontractors or sub-Contractors), where an employer, contractor, or subcontractor of an ARRA-funded State contract intends to fill the job opening created by ARRA funding with a present employee, a laid-off former employee, or a job candidate from a previous recruitment.

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 99 of 113

ATTACHMENT 6 – HIE in Oregon
Oregon’s HIE Background and Environmental Scan (June 2011)1 Background of HIE In Oregon Health Information Infrastructure Advisory Committee (HIIAC) In parallel to the work of the Oregon Health Fund Board (OHFB), the Health Information Infrastructure Advisory Committee was established in May 2008 by Executive Order 08-09. It was tasked with making policy recommendations to: reduce barriers to health information exchange, while maintaining privacy and security of individuals’ health information; establish an appropriate role for the state in maintaining and building health information infrastructure; facilitate the adoption of infrastructure, standards and interoperability requirements; facilitate collaboration between statewide partners; and develop evaluation metrics to measure the implementation of health information technology and the efficiency of health information exchange in Oregon. In November 2008, the HIIAC produced a report to the governor and the OHFB exploring challenges in the current health care system, opportunities to transform the system through wider adoption and utilization of HIT and recommendations to facilitate and accelerate this transformation. Those recommendations were adopted into the OHFB plan for health reform and incorporated into legislative proposals for consideration by the 2009 Oregon Legislature. Health Information Security and Privacy Collaboration (HISPC) Even prior to these health reform actions, Oregon was active in a national effort to further health information exchange policy. Oregon was involved with the Health Information Security and Privacy Collaboration (HISPC) from 2006 to 2009. Oregon participated in the HISPC Consumer Education and Engagement Collaborative. Working with seven other HISPC states (Colorado, Georgia, Kansas, Massachusetts, New York, Washington and West Virginia), Oregon contributed to the development of an educational resource toolkit for general use by other states and organizations to educate and engage consumers about health information technology and health information exchange. When HIIAC was formed it took over this health information exchange policy work. House Bill 2009 (HB2009) The Oregon Health Fund’s report, “Aim High: Building a Healthy Oregon,” including the work of HIIAC, was the foundation for major legislation before the 2009 Oregon Legislature. In June 2009, the
1

Data presented in this Appendix was summarized from the following reports: • Health Information Exchange (HIE): A Strategic Plan for Oregon; August 23, 2010 (http://www.oregonsurplus.com/OHA/OHPR/HITOC/Documents/hitoc_reports.shtml) • Health Information Exchange: An Operational Plan for Oregon; August 23, 2010 (http://www.oregonsurplus.com/OHA/OHPR/HITOC/Documents/hitoc_reports.shtml) • Oregon Local Health Department HIE Survey; September 2010 (http://www.oregonsurplus.com/OHA/OHPR/HITOC/Documents/hitoc_reports.shtml) • David M. Witter, Jr., Witter & Associates; Oregon Hit Environmental Assessment; Updated February 2010 (http://www.oregonsurplus.com/OHA/OHPR/HITOC/Documents/hitoc_reports.shtml) • Oregon HIE Response to the Office of the National Coordinator for HIT: Addendum to Strategic and Operational Plans; November 19, 2010 (http://www.oregonsurplus.com/OHA/OHPR/HITOC/Documents/hitoc_reports.shtml)
Page 100 of 113

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Oregon Legislature passed HB2009 establishing the Oregon Health Authority (OHA) and Oregon Health Policy Board (OHPB), which are leading the work to improve the affordability and quality of health care for all Oregonians. The Oregon Health Authority is charged with focusing on quality, costs and the health of the population, using seven strategic building blocks for change (see illustration above). This comprehensive health reform package incorporated specific elements around health information technology and health information exchange. Health Information Technology Oversight Council (HITOC) HB2009 also established the Health Information Technology Oversight Council (HITOC) to coordinate Oregon’s public and private statewide efforts in health information technology, including electronic health records adoption, developing a strategic plan for a statewide system for electronic health information exchange, setting technology standards, ensuring privacy and security controls and developing a sustainable business plan to support meaningful use of HIT to lower costs and improve quality of care. HITOC will also consider options to encourage provider adoption of EHR, and will work to support the Medicaid Transformation Grant and its health profile effort. HITOC will also help Oregon meet federal requirements so that providers may be eligible for millions of federal health information technology stimulus dollars. With the establishment of HITOC, the HIIAC concluded its work at its August 20, 2009, meeting. The legislature included a 2009-2011 budget of $300,000 for the staffing and meeting costs of HITOC, allowing for early planning of health information exchange in Oregon to begin. The ONC cooperative agreement funds also supported the HIE planning efforts. In addition, key stakeholders including the Northwest Health Foundation, Oregon Association of Hospitals and Health Systems and other health care stakeholders provided seed money. In addition to the $8.58 million ONC cooperative agreement funds, more funding for implementation will be needed to ensure that statewide HIE is implemented and its full potential realized. Because of both the critical role HIE can play in advancing health reform efforts, and because of the private, state and federal dollars available for HIE planning efforts, HITOC’s initial focus has been on the development of Oregon’s statewide strategic and operational HIE plans. The approach envisioned by Oregon’s leaders is to begin by building on the many investments in the building blocks of statewide HIE: the burgeoning local and regional HIOs, the vertically-integrated HIE within health systems, the investments in EHRs by Oregon hospitals and many clinicians and the myriad public health information systems, from the Medicaid Management Information System (MMIS) to Oregon’s immunization and communicable disease registries, in addition to numerous others. Oregon’s strategic and operational plans seek to protect these investments while working to ensure interoperability. HITOC, in collaboration with O-HITEC, the Regional Extension Center (REC), will employ a staged approach to working with HIE stakeholders to bring their systems into compliance with meaningful use requirements, as these rules become more stringent over time. For providers not connected to a regional or local HIO or a health system, HITOC will develop a strategy for broader adoption—to fill in geographic gaps and support providers serving vulnerable populations to ensure that these populations benefit from HIE. The planning and implementation activities to be funded by this cooperative agreement are expected to have a substantial positive impact on health, health care quality, costs and coordinated care. The strategies set forth in this plan would use ONC funding to support the Oregon Health Authority’s efforts to develop and advance private, secure, standards-based statewide HIE and to support Oregon’s health reform goals.
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 101 of 113

Goals of HITOC 1) To ensure patients have safe, secure access to their personal health information and the ability to share that information with others involved in their care. 2) To engage in an open, inclusive, and collaborative public process that supports widespread electronic health record (EHR) adoption and robust, sustainable statewide coverage. 3) To improve population health. 4) To improve health care outcomes and reduce costs. 5) To integrate and synchronize the planning and implementation of HIE and health IT in the public and private sectors, including Medicaid and Medicare provider incentive programs, the Regional Extension Center, local and regional HIOs and other efforts underway. 6) To ensure accountability in the expenditure of public funds Health Information Infrastructure Development Plans As a recognized leader in health information technology adoption and health care delivery reform, Oregon has a robust foundation upon which to build comprehensive statewide health information exchange (HIE). Supported by the rapid adoption of HIT among Oregon’s health systems, hospitals, and ambulatory care providers, a promising opportunity has emerged to advance intra- and interstate HIE. Given Oregon’s history as an innovative state for its health reform policies and a recognized national leader for a number of its health IT initiatives, the state was well-positioned when the federal HITECH Act became public law in 2009 as part of the federal stimulus package, the American Reinvestment and Recovery Act (ARRA). In 2009, an extensive survey of EHR adoption and usage was commissioned by the Office of Oregon Health Policy and Research. This survey included hospitals and health systems, ambulatory care providers, nursing homes and long-term care facilities. The findings of this study revealed that Oregon had a higher rate of EHR adoption than found in other states. As part of HITECH and integral to the success of HIT Adoption and utilization of HIE by a broad base of participants, Oregon’s Regional Extension Center (REC), O-HITEC, has been working with providers and providers’ groups to increase EHR adoption amongst Oregon’s eligible providers. In March 2011, O-HITEC provided an update on their program to HITOC. This update confirmed the information revealed by the 2009 Environmental Scan that Oregon displays wide adoption of EHRs both in number and in Proposer product. Business Case for HIE Federal funds were made available on February 17, 2009 when President Obama signed the American Recovery and Reinvestment Act of 2009 (ARRA). Title XIII of Division A and Title IV of Division B of ARRA, together cited as the Health Information Technology for Economic and Clinical Health Act (HITECH Act), include provisions to promote Meaningful Use of health information technology to improve the quality and value of American health care. The HITECH Act authorizes incentive payments for eligible Medicare and Medicaid providers’ Meaningful Use of certified electronic medical record (EMR) technology. By 2015, providers are expected to adopt and be using a certified EMR in compliance with the “Meaningful Use” definition or they will be subject to financial penalties under Medicare (per Sections 4101(b) and 4102(b) of ARRA).

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 102 of 113

To help facilitate mechanisms through which individuals, health care providers, and health organizations can share health-related information, Section 3013 of ARRA laid out a plan to award state grants to promote health information technology adoption. The planning effort for statewide HIE began in earnest in late 2009 upon the approval of the State Health Information Exchange Cooperative Agreement Program from the ONC. Through that planning effort, the mission and goals for HIE in Oregon were established. HIE Mission: Information, when and where it is needed, to improve health and health care. CMS’ Meaningful Use Incentive Program One of the main drivers behind the HIE efforts within Oregon, and other states, is the Meaningful Use initiative. This program was put in place to drive the adoption and Meaningful Use of EHRs by providers and hospitals that see significant populations of Medicaid and Medicare beneficiaries. Since HIE is a key component of the Meaningful Use criteria, the Technology Plan emphasized the needs of providers and hospitals. By adopting standardized services for message transport and provider discovery, and adopting best practices for security, Oregon will provide a mechanism for all eligible providers to qualify for their Meaningful Use payments. The Oregon HIE will work with the O-HITEC (Oregon’s REC) to assist providers with achieving Meaningful Use. O-HITEC will assist its client providers who seek full function EMR/EHR with the selection and adoption of these systems and connection to the Oregon HIE. Consequently, in order to minimize perceived competition with or duplication of services already available to stakeholders, the Oregon HIE has made providing physicians or stakeholders with a full-function, hosted EMR or EHR system a lower priority than providing HIE Core Services. Oregon’s Health Information Organization (HIO) Landscape In Oregon, a number of HIE activities are supported by private, non-profit and public sector organizations. As of February 2010, there were several HIOs considered as operational or soon-to-be operational. Concurrently, there are eight health systems in Oregon currently offering limited HIE services among hospitals, affiliated clinics, and/or providers. These efforts are at different stages of maturity and focus on a range of exchange activities. Although several HIOs are operational and have started to provide value-added services, only a few of these organizations are close to providing comprehensive exchange services. As Oregon’s providers continue to focus their efforts on achieving Meaningful Use objectives, it seems reasonable to anticipate that local HIOs within the state will both increase services and expand geographically, primarily driven by designated medical service area(s). The technologies and exchange connections already in use may serve as models and offer solutions for HIE for other HIOs to build upon. At present, however, only a small percentage of eligible providers in Oregon have access to HIE services offered through a regional or local HIO. Interstate HIE Oregon has significant trading partners and patient referral patterns with its neighbors (see Diagram 2 of this appendix). In order to ensure proper care coordination of its health care consumers, Oregon’s technology plan includes the capability to exchange health information across state lines. Therefore, any Proposer selected must incorporate the adoption of national standards and best practices in order to ensure that Interstate exchange is possible.
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 103 of 113

Oregon has applied for additional grant funding to develop a cooperative approach to Interstate HIE with several other states. This grant funding will support the planning for cooperation and information sharing in order to easily and efficiently share health information across state lines.

Medicaid Management Information System (MMIS) To comply with Medicaid Information Technology Architecture (MITA) requirements, Medicaid service providers must meet stringent systems management and healthcare guidelines. At the same time, to maintain a reasonable staff workload, these providers need automated claims processing and information-retrieval systems, along with public payer solutions that help them work efficiently and cost effectively. In an effort to achieve these goals, MMIS is an integrated group of procedures and computer processing operations (subsystems) developed at the general design level to meet principal objectives. The objectives of this system and its enhancements include the Title XIX program control and administrative costs; service to recipients, providers and inquiries; operations of claims control and computer capabilities; and management reporting for planning and control. Although not a “Core Technology Service” for this RFP, the Oregon HIE is aware of and may ultimately collaborate with other programs building efficiencies through Medicaid management information system (MMIS) solutions based on a connected health and human services (HHS) framework compliant with MITA standards which reduce administrative costs, improve delivery of essential services. Emergence of ACOs/CCOs and Oregon’s Health System Transformation While the exact details of the transformation from a fee-for-service model of health care delivery have yet to be determined, the introduction of ACOs at the national level and the recommendation of a CCObased model of health care delivery in Oregon do not change Oregon’s HIE strategy or planned HIE services. ACOs and CCOs are HIE Participants, as defined in the Oregon Strategic Plan, just as hospitals, health systems, and providers are today. They will both supply and consume health information as do other HIE participants. Budget The total grant award for the Oregon HIE project is $8.58 million. The grant will cover the majority of the project components identified in Section 3 of the RFP including the implementation of the HIE Core Services and its monthly operational costs during the grant period. A specific allocation of funds for supporting the contract awarded under this RFP has not been determined nor has the balance of budgeted funds between requested services been defined. The financing and organizational auspices for continuing operation of the HIE after the grant completion are not known at this time. Recent state and federal health reform efforts have created imperatives and some short-term financing sources to accelerate the adoption of EHRs and health information exchange among health care organizations and providers. Priorities in designing ways to pay for exchange include maximizing Meaningful Use for providers, being equitable among stakeholders in costs and benefits, utilizing user fees and ensuring those fees have broad benefit. State contracts can be modified to provide incentives for providers and payers to participate in exchange. Specific financing sources for HIE are expected to include Office of the National Coordinator for Health Information Technology (ONC) Cooperative Agreement funds, Medicaid 90/10 money, philanthropic and stakeholder contributions, and revenue from some HIE services.

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 104 of 113

Determination of the funds available for contracting is dependent on the scope of the pricing proposals for implementation and operational costs. The available budget may also be affected by the longer-term approaches taken for financing the ongoing operations of the HIE including future funding sources from DHS for HIE services to related to OHP/Medicaid clients, the capability for HITOC to assess fees for services, and potential philanthropic funding sources.

Oregon’s HIE Environmental Scan Oregon is a geographically diverse state with nearly 3.8 million residents spread across urban, rural, and remote areas each of which have highly varying degrees of HIT capabilities. Further, these citizens are supported by an equally diverse healthcare delivery model totaling nearly 8,400 licensed Physicians in more than 2,100 practice or clinic organizations. Oregon’s health care providers
Es timated Total Phys icians Es timated Total Practices S olo 1501 1501 Partners hip 3-10 Phys icians 522 2959 261 493 11-50 Phys icians 1862 74 >50 phys icians 1536 10 Total 8380 2339

Office Practice or Clinic Community or Public Health Clinics Hospital or Health System Clinics Subtotal Other Practice Settings (1) Total Physicians

Esimtated Physicians by Practice Size Solo 3-10 Physicians >10 Physicians 1294 2038 1450 27 267 70 41 269 314 1362 2574 1834 139 907 1565 1501 3481 3399

Total 4782 364 624 5770 2611 8381

Office Practice or Clinic Community or Public Health Clinics Hospital or Health System Clinics Subtotal Other Practice Settings (1) Total Practices or Clinic Organizations

Estimated Number of Practice or Clinic Organizations Solo 3-10 Physicians >10 Physicians Total 1294 291 73 1658 27 38 4 69 41 38 16 95 1362 367 93 1822 139 130 78 347 1501 497 171 2169

(1) Includes hospitals, emergency rooms, hospital or ASC anesthesiology, imaging, and laboratories.

Oregon’s health care facilities • 23 federally qualified health centers (FQHCs) with 155 sites. • 53 rural health clinics. • 58 general acute care hospitals (ACHs). In 2009, they accounted for more than 347,000 inpatient discharges and more than 8.4 million outpatient and emergency visits. • 25 critical access hospitals (CAHs) out of a total of 58 acute care hospitals in the state. • 9 multiple-hospital systems representing 35 hospitals from the subset of 58 ACHs. 7 health systems, which include hospital operations and medical group practices or employed physicians and other clinicians.

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 105 of 113

Geographic distribution of Oregon's providers and health care facilities (highest to lowest population per county)
A re a - S qu a r e M il e s TO TA L MULT NO MA H WA S HING TON CLA CKAM AS LAN E MARIO N JA CKS O N DES CHU TES LIN N DO UG LA S YAMH I L L BENTO N JOS E PH INE UMAT I LA L PO LK KLA MAT H CO O S CO LU MBI A LIN COL N CLA TS O P MALH E UR CRO O K TIL LA MO OK UNI O N WA S C O JE FE F RS O N HO O D R IVER CUR RY BAK E R MO RR O W HAR NE Y LAK E GRA NT WA LL O W A GIL LIAM S HERMAN WH E ELER 9 7,1 30 46 5 72 7 1,8 79 4,6 20 1,1 94 2,8 01 3,0 55 2,2 97 5,0 71 71 8 67 9 1,6 41 3,2 31 74 5 6,1 35 1,6 29 68 7 99 2 84 3 9,9 26 2,9 91 1,1 25 2,0 38 2,3 96 1,7 91 53 3 1,6 48 3,0 89 2,0 49 1 0,2 28 8,3 59 4,5 28 3,1 53 1,2 23 83 1 1,8 13 P opu l ati on J ul y 1 , 2 009 3,82 3,464 7 24 , 8 0 6 5 27 , 3 9 1 3 79 , 4 5 8 3 47 , 9 0 6 3 18 , 7 0 1 2 07 , 1 1 0 1 70 , 0 5 7 1 10 , 6 5 8 1 05 , 9 4 3 95 ,250 86 ,726 83 ,666 72 ,430 68 ,785 66 ,350 63 ,066 48 ,410 44 ,699 37 ,839 31 ,720 27 ,185 26 ,129 25 ,470 24 ,229 22 ,715 21 ,726 21 ,339 16 ,450 12 ,540 7,71 6 7,60 0 7,52 5 7,10 0 1,88 5 1,83 0 1,58 5 P o pul at io n pe r S quar e M il e 39.36 1 ,558 .45 7 25.09 2 02.15 75.26 2 66.47 73.91 55.88 48.27 20.78 1 32.66 1 27.73 50.98 22.42 92.33 10.81 38.71 70.47 45.06 44.89 3.20 9.09 23.23 12.50 10.11 12.68 40.76 12.95 5.33 6.12 0.75 0.91 1.66 2.25 1.54 2.20 0.87 1 3 Phy s ic ia ns MD / DO O c t obe r 2009 9,710 3,486 1,258 703 830 620 508 430 146 195 166 251 145 100 58 141 135 19 65 58 59 17 33 51 72 18 63 23 24 5 7 5 5 10 2 2 1 1 1 1 1 1 1 1 1 1 1 1 1 1 58 8 2 2 5 3 3 2 2 2 2 1 1 2 1 1 3 6,298 2,288 622 157 572 478 446 309 92 166 128 134 103 50 6 100 173 50 50 49 25 25 25 49 25 25 24 25 21 25 15 16 25 H os pi t al s De c e m be r 2 009 Avai l abl e B e ds De c e m be r 2009 A c ut e D is c har ge s C Y20 09 3 34,05 9 1 20,17 3 34,29 7 8,02 6 35,07 1 24,96 3 21,22 5 16,18 6 5,20 3 8,16 0 6,22 3 7,93 9 7,37 9 4,00 6 93 6,06 6 8,75 9 2,65 9 2,73 9 2,83 6 75 8 1,10 2 1,71 8 2,27 7 1,11 3 1,67 4 75 3 75 4 74 54 9 43 6 36 6 48 2 -

Electronic Health Record adoption by Oregon's providers and health care facilities Oregon displays a higher rate of EHR adoption than found in other states and that generally, providers have adopted certified technology.
Provider Type Acute Care Hospitals Critical Access Hospitals # of Clinic Sites Table 5. Higher Rates of HER Adoption in Oregon 47 of Oregon’s 58 acute care hospitals (ACHs) either have or are implementing EHRs by mid-2010, representing 95% of Oregon ACH discharges in 2008. 17 of Oregon’s 25 critical access hospitals (CAH) operate an EHR, representing 76% of 2008 Oregon CAH discharges. Practices with more than one location have higher rates of EHR adoption (range of 40% for two locations to 69% for five or more locations).
Page 106 of 113

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Larger Practices Specialty Care Providers

Practices with 50 or more clinicians (79% adoption rate) and practices with 59 clinicians (50% adoption rate) have higher rates of EHR adoption. Multispecialty and mixed primary care practices have higher EHR adoption rates.

Summary of hospitals and non-hospital providers in Oregon currently using CCHIT-certified EHR vendor/products • 81 commercial vendor/product lines in use in Oregon. • Eight vendor/products are used by 83% of clinicians. • All 47 Oregon hospitals with EHRs use a range of CCHIT products. • 81% of practices and clinics with EHRs (88% of clinicians) use a product where one or more versions in the product line have received certification from CCHIT. Identified HIO and local HIE efforts • Bay Area Community Health Information Agency (BACIA)—Coos and Curry Counties • St. Charles Health System—Deschutes, Crook, and Jefferson Counties • Douglas County Independent Practice Association (DCIPA)—Douglas County • Gorge Connect—Gilliam, Hood River, Sherman, and Wasco Counties • Jefferson HIO—Jackson and Josephine County • Northeast Oregon Network (NEON)—Baker, Union, and Wallowa Counties • Oregon Community Health Information Network (OCHIN)--Statewide • PeaceHealth—Lane County • Portland-Vancouver Metro HIE—Clackamas, Multnomah, and Washington Counties • Salem Area Community Health Information Exchange (SACHIE)—Marion and Polk Counties • Samaritan Health Systems—Linn, Benton, and Lincoln Counties

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 107 of 113

Diagram 1: Oregon’s HIO Coverage

Interstate HIE Oregon has significant trading partners and patient referral patterns with its neighbors. In order to ensure proper care coordination of its health care consumers, Oregon’s technology plan must include the capability to exchange health information across state lines.

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 108 of 113

Diagram 2: Oregon’s Hospital Referral Regions

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 109 of 113

ATTACHMENT 7 – Provider Directory Support
This attachment is to be used in completing Proposer’s Proposal.
Supported Not Supported

Entity-Level Provider Directory (ELPD)
Characteristics Support various types of entities, including but not limited to: Hospitals Clinics Nursing homes and other long-term care facilities Pharmacies Diagnostic Testing Laboratories Health Plans Public Health Agencies Health Information Organizations Health Information Service Providers HIPAA Business Associates Claims Clearinghouses Quality Reporting Organizations Prescription Drug Monitoring Programs Storage of entity information Demographics Legal Name Other familiar names Physical Address Human Contact Information (name, phone number and email address) Relevant domains and website addresses, including Direct health domains Supported communication protocols and standards for exchange services (or pointers to those data) Security credentials (e.g., X.502v3 digital certificates) or pointers to those credentials Capability to support additional functionality as defined and recommended by HITSC and S&I Framework Files associated with entities (e.g. certifications or licenses) Pointers to additional entity information Supported Functionality Directed exchanges of information – Direct
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 110 of 113

Directed exchanges of information - NwHIN Exchange Discoverability of an entity Discoverability of an entity's information exchange capabilities Discoverability of an entity's security credentials (e.g., X.509v3 digital certificate) Ability for an entity's approved representative to review and modify (or request modification through a change management process) the entity's information Discoverability and linkage to associated listing(s) in the ILPD

Individual-Level Provider Directory (ILPD)
Characteristics Demographics First Name Last Name Specialty(ies) Name(s) of practicing location(s) Address(es) of practicing location(s) Telephone number(s) of practicing location(s) Email address(es), including Direct address Hospital affiliation(s) Sensitive identifiers and license numbers (NPI, DEA, State licenses, other) please list Capability to support additional functionality as defined and recommended by HITSC and S&I Framework Files associated with individuals (e.g. certifications or licenses) Pointers to additional information Supported Functionality Directed exchanges of information – Direct Directed exchanges of information - NwHIN Exchange Discoverability of an individual provider Discoverability of an individual provider's practice location(s) Multi-level query of provider information Discoverability and linkage to associated listing(s) in the ELPD Audit capability

Reporting Capability (including but not limited to)
Number of entries in each directory (ELPD and ILPD) Listing of entries and ability to generate reports based individual characteristics (e.g. ZIP code) Number of messages sent by each participant (ELPD and ILPD) Number of messages received by each participant (ELPD and ILPD) External access
RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911 Page 111 of 113

Ad-hoc reporting

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 112 of 113

ATTACHMENT 8 – Vendor Hosting Requirements
(Please see separate PDF document, hereby incorporated by this reference.)

RFP 3261 Oregon HIE Solution 071911 / (EP) DOJ 071911

Page 113 of 113

Sign up to vote on this title
UsefulNot useful