RFP691 - 2027 Client Management Software System

The Atlanta Regional Commission (ARC) is soliciting proposals for a Client Management Software System to support its behavioral health coaching and enhanced case management programs, as well as fee-for-service operations from private payors, under its role as the federally designated Area Agency on Aging. The system must deliver comprehensive functionality for intake, assessments, service planning, approvals, follow-up workflows, billing, and financial reconciliation while ensuring high data quality, auditability, and regulatory compliance. Proposals must be submitted as a single document by July 13, 2026, through the ARC Procurement website, with a strict 15-page limit excluding covers, end sheets, and budget exhibits, and must adhere to minimum 11-point font requirements. The solicitation mandates prior registration and approval on the ARC site before submission. The contract will have an initial one-year term with the option to renew for up to four additional years, contingent on funding and performance, and requires the system to be fully operational by January 1, 2027. The award will be made on a best-value basis, evaluating proposers based on functional fit (25%), security compliance (20%), reporting capabilities (20%), implementation approach and support (15%), integrations and technical merit (5%), SLA reliability (5%), vendor experience (5%), and cost and value (5%). Proposals must include detailed pricing with line items and assumptions, demonstrate compliance with HIPAA, SOC 2 Type II, ISO 27001, CJIS, and NIST controls, and provide evidence of encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access control with fine-grained permissions, multi-factor authentication, immutable audit trails, configurable retention policies, and secure key and vulnerability management. The system must include RESTful APIs, SDKs, webhooks, and robust reporting tools with an ad hoc report builder, and implementation must follow defined phases including discovery, configuration, integration, data migration, testing (unit, system, UAT, performance, security), training (including train-the-trainer), go-live, stabilization, and ongoing support with defined SLAs. A secure data destruction certification is required upon contract termination, and all submissions are subject to Georgia Open Records Law, with confidential markings required for proprietary information to be honored. ARC reserves the right to reject all proposals, negotiate with multiple respondents, waive minor irregularities, conduct interviews, or award to the next most qualified proposer if the