{"Project Scope & Deliverables":"The vendor must design, develop, implement, host, and support a Medicaid Provider Enrollment and Management System (PEMS) that complies with state/federal rules, CMS Streamlined Modular Certification (SMC), and 42 CFR Part 455. Key deliverables include online provider enrollment, automated risk-based screening, a self-service portal, lifecycle workflows, and robust data exchanges.","References":"Offeror must provide three (3) references for similar projects. The Offeror must include contact information for each reference.","Client / End-User Profile (User Base)":"The system will support approximately 1,025 internal State users, 22,000 external provider users (3,300 group and 22,500 individual providers), 1,250 trading partners, and an average peak of 300 concurrent users. Annual volume estimates include 18,800 applications (4,000 initial, 2,500 revalidations), 12,000 maintenance updates, 150 suspensions, 150 terminations, 50 appeals, 10,500 letters, 6,000 call center inquiries, and 1,020 moderate/high-risk providers.\n\nPrice sheet - Proposed Licenses - Must support minimum of 500 users","Go-Live/Launch Timeline":"The contract is estimated to execute around August 6, 2027, with an approximate start date of August 20, 2027. A specific go-live deadline for the solution is not explicitly detailed in the RFP","Geographic / Offshore Resource Restrictions":"Staff can work remotely and be located in any of the States within the United States.","Hosting & Infrastructure Requirements":"Offerors may propose hosting on any compliant U.S.-based cloud platform (e.g., AWS, Azure, GCP) or a logically isolated multi-tenant SaaS deployment. The environment must comply with NIST standards, ARC-AMPE Version 1.02, FIPS 140-3, HIPAA/HITECH, WCAG 2.2 Level AA accessibility, and offer FedRAMP, HITRUST, or StateRAMP certification.","Legacy System":"Legacy System: Medicaid Management Information System (MMIS). Enterprise Content Management: IBM FileNet ECM","Data Migration":"The vendor is responsible for cleansing, normalizing, transforming, and validating legacy MMIS data covering approximately 70,000 active/inactive provider records (925 GB) and 15 years of history. Actual document attachments remain in the existing IBM FileNet repository; only metadata and document references (254,000 documents / 350 GB) are migrated.\n\nThe vendor must collaborate with existing MES and MMIS contractors to establish the necessary data exchange interfaces.","System Integrations":"Mandatory integration with the centralized System Integration Platform (SIP) built on InterSystems IRIS for Health, which supports HL7 v2.x, FHIR R4, and X12 EDI. The vendor must also integrate with core legacy modules, external MCOs/HIEs, and national validation databases (NPPES, PECOS, LEIE, SSA, OIG).\nIntegrations include legacy MMIS, IBM FileNet ECM, EDI Gateway (X12 270/271, 276/277, 837), PeopleSoft, Entra ID / Azure B2C, Genesys IVR, and national databases (NPPES, PECOS, LEIE, OIG, DEA, SSA).","Reporting & analytics":"The Offeror solution shall create and maintain a suite of State- and Offeror-defined online reports that allow authorized users to generate customized reports using predefined parameters (e.g., provider identifier, procedure code, date of service). These reports shall support monitoring of daily system operations and Fiscal Agent operations and shall leverage data across relevant modules, including Provider and Claims, as necessary to meet reporting requirements, subject to applicable security and data access controls.\n\nThe offeror's solution shall provide an online ad hoc reporting tool that allows authorized users access to provider and trading partner data (e.g., provider enrollment status, alphabetic and numeric provider listing, re-certification listing, revalidation listing, group affiliation listing, provider classification listing, and category of service listing).","Maintenance & Support (Post-Launch)":"The vendor must provide Maintenance & Operations (M&O) services for up to six years post-implementation, with potential State options to extend. \n\nThe vendor provides Level 2 and Level 3 technical support, defect resolution, bug fixes, minor enhancements, system monitoring, and infrastructure patching, while the State handles Level 1 call center support. Production support requires 24x7x365 helpdesk availability for critical issues, with SLAs specifying penalties for system availability falling below 99.9% (\"Three 9s\").","Training":"The vendor must deliver virtual end-user, system administrator, and train-the-trainer sessions for both internal State personnel and external providers. Accurate, up-to-date user manuals and training materials must be created and maintained for all participants following major software releases.","Proposal / Submission Requirements":"Proposals must be uploaded electronically via the NDBuys system. Technical and Cost proposals must be submitted as separate Excel/document files","Initial Contract Term":"The initial contract term covers the Implementation (DDI) phase, starting approximately August 20, 2027. Post-implementation M&O is structured as renewal options totaling 6 years (offered in three 24-month increments), with a potential 12-month extension option after renewals are exhausted.","Ongoing Project Management Obligations":"The vendor must comply with North Dakota Project Management Framework standards, providing status reporting to support the calculation of cost and schedule variance under N.D.C.C. § 54-59-23. If negative cost or schedule variance exceeds 20%, a formal corrective action plan report must be submitted.","Disclosed Budget or Contract Value":"The State explicitly stated that the appropriated budget and not-to-exceed contract value will not be disclosed.","Subcontracting & Teaming":"Subcontracting is permitted, but the prime contractor remains fully responsible for overall contract performance and compliance. Any apparent or actual conflicts of interest regarding subcontractors must be formally declared in the proposal cover letter.\nThe successful offeror is advised not to enter into subcontracts until the final contract is signed by the State.","Pricing Structure & Cost Format":"The contract is firm fixed-price covering all implementation, licensing, hosting, training, and M&O costs, with all price-per-unit items inclusive of direct, indirect, overhead, and travel expenses. Optional value-added services and future post-M&O changes are priced via an hourly rate Enhancement Pool.\n\nThe Cost Proposal must use Attachment B (Excel) to deliver a firm total price for the requested years, with a detailed itemization of implementation, M&O, expenses, and hourly rates.\n\nCONTRACTOR agrees that any change to the annual Maintenance Services fee may increase by not more than the lower of three percent (3%) or Consumer Price Index (CPI).","Diversity / Socioeconomic Preferences":"Preference laws apply during evaluation, giving statutory preference to resident North Dakota vendors in the event of tie evaluation scores. No specific set-asides or MWBE/SDVOB percentage goals.","E-Signature":"The offeror's shall provide a solution that will include a Content Management (CM) solution to support document workflows with review/approval ability with digital signature support","Escrow":"Not addressed in RFP or addenda.","Warranty":"The 365-day warranty begins after the State issues Final Acceptance and 60-day post-production acceptance.\nWarranty shall begin once final acceptance has been given by the State and successful completion of the 60-day post-production acceptance period.","Payment Terms":"The State will pay the vendor based on terms established in the final contract, with an absolute statutory prohibition against prepayment for goods or services. The State will not pay up front for product licensing fees if the solution requires customization, deliverables, or acceptance testing.","Withhold/Retainage":"All deliverable payments shall be subject to 20% retainage. Retained amounts shall be paid upon Final Acceptance, minus any amount(s), including withholdings or setoffs, due to State under this Contract.\n\nThe RFP notes that contractual retainage and liquidated damages provisions for project delays or breaches are exempt from standard limitation of liability caps.","Billing and Invoicing":"Invoices must be submitted following deliverable completion and formal State acceptance, itemized by unit price as defined in Attachment B. The State reserves the right to withhold any and all payments due if the vendor is alleged to be in contract breach.\nSTATE shall make payment under this Contract within forty-five (45) calendar days after receipt of an approved invoice.","Disaster Recovery And Business Continuity":"System targets require a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 12 hours. Disaster Recovery Plans (DRP) and Business Continuity Plans (BCP) may be submitted as two distinct documents aligning with ISO 22301 and NIST 800-34.","Security Requirements":"The solution must comply with NIST, HIPAA, HITECH, ACA, and ARC-AMPE standards. The State will accept formal FedRAMP, HITRUST, or StateRAMP certifications ; otherwise, vendors must complete a comprehensive Third-Party Security Questionnaire (TPSQ) and build any required risk remediation costs into their Best and Final Offers.","Change Request / Scope Change Handling":"Scope modifications during the M&O phase are governed by an Enhancement Pool Hours allocation billed at an hourly rate. All contract revisions or scope changes must be strictly reviewed by a project oversight committee and formally signed by the agency head and Chief Information Officer.","Mobile App":"Mobile-Responsive Access: The Provider Enrollment Management System (PEMS) web platform, self-service portals, dynamic forms, and dashboards must be fully responsive, enabling State administrators, reviewers, and external providers to access and complete tasks seamlessly across desktop, tablet, and mobile web browsers.","L-1 Support/Help Desk Support/Call Center":"No Provider enrollment or call center staff are in scope for this RFP. However, the staff required to support the ongoing maintenance and operations of the offer’s solution is in scope.\n\nThe State will provide Level 1 (end-user) support through our Provider Call Center and anything needing further triage or support will be escalated to the offeror. State’s preferred end-user support channel is via the provider call center, but the solution should have chatbot, email, and web portal options.","Intellectual Property Ownership":"The State retains ownership of custom work product, modified deliverables, data, and metadata generated under the contract. Contractors maintain ownership of pre-existing Background IP and standard commercial software, granting the State a non-exclusive, perpetual, irrevocable license to operate the PEMS; vendors must submit any requested exceptions or licensing agreements in technical proposal Section 3.","Commercial and Legal Risks (Liability caps, indemnity, liquidated damages, penalties, performance bonds, no exceptions)":"The State is legally prohibited from entering into clauses that require it to indemnify contractors against third-party claims. Contractors may negotiate a Limitation of Liability for direct damages up to twice the total contract value , but this cap cannot apply to fraud, willful misconduct, confidentiality breaches, property damage, personal injury , or liquidated damages.\n\nInsurance Mandatory Limits: High mandatory limits including $2M Commercial General Liability, $1M Professional E&O (maintained during term + 3 years), and $5M Cyber Liability / $1M First Party limit (including mandatory 1-year free credit monitoring for affected individuals in a data breach).\n\nLiquidated Damages & Penalties:Schedule Delays: Assesses liquidated damages per calendar day for failing to complete individual Deliverables or the overall Project on schedule.Payment Setoff & Withholding: The State reserves the right to deduct liquidated/other damages from any invoice or withhold payments completely upon breach, while requiring the Contractor to continue work without stoppage.\n\nIndemnity Obligations:General Indemnity: Contractor must defend, indemnify, and hold harmless the State against claims based on vicarious liability, including reimbursing all legal costs/attorneys' fees if the State prevails in litigating coverage.IP Infringement Indemnity: Contractor must defend and indemnify the State at its own expense against any third-party patent, copyright, or trade secret infringement claims.Confidentiality & Data Breach Indemnity: Uncapped indemnity for unauthorized disclosure of confidential info or data breaches arising from hosting/transmission of data.\n\nOfferors are required to state \"Agree\" or \"Propose Alternate Language\" for every section in the Contract. Any deviations/exceptions must be submitted via redline track-changes in the proposal stage","Staffing(Onsite, Resource availability, feasibility of onsite-offshore model)":"The project is heavily bound by North Dakota laws governing major IT projects (N.D.C.C. § 54-59-23), which mandate immediate reporting if budget or schedules fluctuate by 20% or more at milestones. The vendor must also maintain compliance with federal ADP security rules (45 CFR Part 95) , 42 CFR Part 455 , and state income tax withholding laws for on-site personnel.","Competition (Favoring a particular vendor, platform)":null,"Partnership Gaps (Lack of required local partner or sub-contractor)":null,"Independent Verification and Validation":null,"Compliance":"The vendor must comply with 42 CFR Part 455 (Subparts B & E), 42 CFR 433, 45 CFR 75/95, HIPAA/HITECH, Privacy Act of 1974, N.D.C.C. major IT project laws (§ 54-59-23/32), and register with the ND Secretary of State prior to contract execution.","RFP Document Folder Link":"https://drive.google.com/drive/folders/1sKwq51-oXbawAI5wrbCVzptY9awna1IM?usp=drive_link"}
Assumptions
- Cardinality Solution will be hosted on AWS Gov Cloud for production instance.
- AWS Hosting includes one production and five non-production instances - Development, Integration Testing, UAT, Staging and Disaster Recovery
- Cardinality SaaS license includes - Yearly 2 upgrades, monthly hot fixes and level 3 support
- All resources would be based out of the United States
- The Cardinality Saas license cost is provided for up to upto 1025 internal users and upto 22000 external users.
- Cardinality will leverage the DocuSign licenses of the Agency for e-signature
- Cardinality will provide a mobile responsive application. Development of a mobile app is not part of scope of work
- The Operations & Maintenance Support phase is assumed to start immediately after DDI phase of 18 months. The DDI Phase is followed by 2 months of acceptance and 12 months of warranty period which is assumed to be part of the O&M Phase
- Cardinality will provide Tier-2 and Tier-3 support during the M&O Phase. Tier-1 support will be provided by the Agency
- The O&M price above includes 10,000 hours of enhancement pool hours per year
- Training is based on two weeks of in‑person sessions for the staff. Additional sessions, if required, will be delivered virtually through instructor‑led classes or self‑paced modules.