RFP 6171 MMIS Controls Audit

The Oregon Health Authority is soliciting proposals under RFP 6171 (S-44300-00018176) for the MMIS Controls Audit. The contract involves conducting audits for five fiscal year periods starting July 1, 2026, with an initial term of five years and potential extensions for an additional two years. The selected contractor must perform audits in accordance with AICPA SSAE No. 18, GAGAS, and AT-C Section 320 standards. Key requirements include the assignment of a Certified Public Accountant licensed in Oregon and adherence to strict confidentiality and data security protocols, including IRS Publication 1075 for personnel accessing Federal Tax Information. The award will be granted to the highest-ranking responsible proposer based on a 100-point scale evaluating the project implementation plan (50 points), key person experience (20 points), price (20 points), and references (10 points). Proposers must submit a technical proposal and a separate all-inclusive fixed-cost price proposal via OregonBuys by November 23, 2026. The contract is governed by Oregon law and requires compliance with various state and federal regulations, including the Civil Rights Act, the Rehabilitation Act, and federal whistleblower protections. Mandatory insurance coverages include Commercial General Liability, Professional Liability, and Workers Compensation.