RFP Sourcing Event - Data Analytics Platform - DAP

The Department of Health and Human Services for North Carolina is seeking a modern Data Analytics Platform to enhance the efficient extraction, analysis, and reporting of Medicaid data, supporting program oversight, policy evaluation, and data-driven decision-making. The solution must improve transparency, operational efficiency, reporting accuracy, and healthcare outcomes while ensuring full compliance with federal and state regulatory requirements. The solicitation, identified as Doc2067427817, was posted on May 11, 2026, with proposals due by July 17, 2026, and is targeted at vendors providing IT services under NAICS code 518210. The procurement follows a best-value trade-off approach, not lowest price technically acceptable, and places equal emphasis on technical and business specifications, corporate background and past performance, and total cost of ownership across the full contract term, including base and option years. The estimated contract value is $6.5 million, encompassing fixed-price and variable-cost components for implementation, operations, maintenance, consulting labor, and cloud infrastructure. Submissions must be structured in two electronic files via the Ariba Sourcing Tool and include comprehensive technical and management proposals, along with a formatted cost workbook detailing fully burdened labor rates, licensing, hosting, and ongoing support costs. Key deliverables include project and quality management plans, data governance frameworks, system migration artifacts, and certified data products aligned with Medicaid Enterprise Solution standards. Vendors must demonstrate secure, compliant architectures using FIPS 140-2/3, NIST RMF, OWASP TOP 10, and CMS guidelines, with stringent data security obligations including HIPAA, HITECH, and incident reporting mandates—24-hour notification for general breaches and one hour for incidents involving SSA, IRS, or CMS data. Key personnel require pre-approval for substitution, must maintain continuous coverage, and are defined by strict experience thresholds. Security attestations, third-party audits (FedRAMP, SOC 2, HITRUST), and full access for government-led assessments are required. The contract prohibits use of state branding without approval, mandates compliance with state insurance requirements, and enforces strict confidentiality and conflict-of-interest controls. Proposals must also disclose use of generative AI and lobbying activities, affirm non-debarment status, and confirm financial stability. All work is performance-based in North Carolina, with inspection and acceptance controlled solely by the state, and no physical packaging or military standards apply since the deliverables are digital systems and services.