REQUEST FOR PROPOSALS - Ohio

1 State of Ohio: Department of Administrative Services Base RFP 0A1226 Data Anonymization & Correlation Solution, Pilot Implementation and Training Services & Correlation, Pilot Implementation and Training Services Page 1 of 110 REQUEST FOR PROPOSALS RFP NUMBER: 0A1226 DATE ISSUED: January 12, 2018 The State of Ohio, through the Department of Administrative Services, Enterprise IT Contracting is requesting PROPOSALS for: DATA ANONYMIZATION & CORRELATION SOLUTION, PILOT IMPLEMENTATION AND TRAINING SERVICES INQUIRY PERIOD BEGINS: January 12, 2018 INQUIRY PERIOD ENDS: February 7, 2018 OPENING DATE: February 16, 2018 OPENING TIME: 1:00 OPENING LOCATION: Department of Administrative Services Bid Room 4200 Surface Road Columbus, Ohio 43228 This RFP consists of five parts and ten attachments, totaling 109 consecutively numbered pages.

2 Supplements also are attached to this RFP with a beginning header page and an ending trailer page. Please verify that you have a complete copy. In lieu of taking exceptions to RFP requirements, including but not limited to terms and conditions, scope of work statements, service levels requirements, etc., or providing assumptions that may be unacceptable to the State, offerors are strongly encouraged to use the inquiry process in Part Three of the RFP. State of Ohio: Department of Administrative Services Base RFP 0A1226 Data Anonymization & Correlation Solution, Pilot Implementation and Training Services & Correlation, Pilot Implementation and Training Services Page 2 of 110 PART ONE: EXECUTIVE SUMMARY Purpose. This is a REQUEST for Competitive Sealed PROPOSALS ( RFP ) under Sections and of the Ohio Revised Code (the Revised Code ) and Section 123:5-1-8 of the Ohio Administrative Code (the Administrative Code ).

3 The Department of Administrative Services is soliciting competitive sealed PROPOSALS ( PROPOSALS ) for Data Anonymization & Correlation Solution, Pilot Implementation and Training Services (Supplement One), (the Work ). If suitable offers are made in response to this RFP, the State of Ohio (the State ), the Department of Administrative Services may enter into a contract (the Contract ) with one of the offerors (the Contractor ) to provide the Solution and perform the Work specified in this RFP for Supplement One. This RFP provides details on what is required to submit a proposal for the Work, how the State will evaluate the PROPOSALS , and what will be required of each Contractor in performing the Work. This RFP also gives the estimated dates for the various events in the submission process, selection process, and performance of the Work.

4 While these dates are subject to change, prospective offerors must be prepared to meet them as they currently stand. Once awarded, the term of the Contract will be from the award date until the Work is completed to the satisfaction of the State and the Contractor is paid or June 30, 2019, whichever is sooner. The State may renew this Contract for up to three (3) additional two-year term(s), subject to and contingent on the discretionary decision of the Ohio General Assembly to appropriate funds for this Contract in each new biennium. Any such renewal of all or part of the Contract also is subject to the satisfactory performance of the Contractor and the needs of the Department of Administrative Services. The State may reject any proposal if the offeror fails to meet a deadline in the submission or evaluation phases of the selection process or objects to the dates for performance of the Work or the terms and conditions in this RFP.

5 Background. The State maintains more than 1,600 IT systems which span and address the needs of Health and Human Services, Business and Industry, Administration and Finance, Public Safety and Criminal Justice and Infrastructure and the Environment. These IT systems organize and support State agencies in delivering services to the citizens and businesses of the State as well as serve as vital linkages between the public and the State to seek help and assistance, start and grow businesses, obtain services, work and live in our State. The use of State data assets to increase the well-being of Ohioans, their health, their property, security, livelihood, and prosperity is essential. In aggregate, these systems maintain a wealth of data and historically have been commissioned and operated expressly to serve the purposes of State agencies.

6 Unlocking this data would allow the State to identify and drive meaningful social change to make a difference for the citizens of Ohio fixing communities, restoring hope to those most in need, identifying inefficiencies, creating jobs and economic growth, adjusting policies, and predicting and preparing for otherwise unexpected events. Early 2017 and then again in late 2017, the State issued a competitive procurement designed to obtain access to pre-qualified firms with the expertise to perform data analytics projects (Exploratory Projects) on State data, build a State data analytics platform, obtain public cloud capabilities to perform data analytics (on non-sensitive data), and consulting expertise to assist agencies in the design/execution of Data Analytics projects including identifying, sourcing and loading of data onto these platforms for use in collaborative projects between expert firms and State Agencies.

7 Solution and Work Requirement Summary. Many State systems contain Sensitive Data that is protected and confidential under State and Federal Laws and industry standards including, but not limited to: State of Ohio: Department of Administrative Services Base RFP 0A1226 Data Anonymization & Correlation Solution, Pilot Implementation and Training Services & Correlation, Pilot Implementation and Training Services Page 3 of 110 HIPAA - Health Insurance Portability and Accountability Act of 1996 is legislation that provides data privacy and security provisions for safeguarding medical information. FERPA - The Family Educational Rights and Privacy Act (FERPA) is a privacy law that gives parents certain protections with regard to their children's education records, such as report cards, transcripts, disciplinary records, contact and family information, and class schedules.

8 PCI - The Payment Card Industry Data Security Standard (PCI DSS) is an information security standard for organizations that handle branded credit cards from the major card schemes. PHI - Protected health information (PHI) information about health status, provision of health care, or payment for health care that is created or collected by a Covered Entity (or a Business Associate of a Covered Entity), and can be linked to a specific individual. IRS Pub 1075 - Safeguards for Protecting Federal Tax Returns and Return Information. The State is committed to protecting the privacy, confidentiality and security of the above Sensitive Data and other similar Sensitive Data sources when used in a Data Analytics Exploratory Project under Contract 0A1199 Supplement Two as well as complying with all applicable laws pertaining to the use of State data.

9 Overview of the Project's Scope of Work. The scope of the RFP is organized and provided in Supplement 1 of this RFP. Data Anonymization & Correlation Solution: A Solution meeting the specified requirements, whether that solution be delivered as any of: commercial, off-the-shelf software; cloud-based software; a supported open-source software distribution; or as a Service by the Contractor. Solution Pilot Implementation: Installation of the aforementioned software, and as a Pilot implementation, process sample datasets provided by a variety of the State s Health and Human Services (HHS) Agencies to validate the solution capabilities both on an initial data loading basis as well as to process (operationally) ongoing updates to these datasets. State Knowledge Transfer and Training: The Contractor must convey all lessons learned, Ohio environment implementation and operational specific functional and technical knowledge as well as to Train DAS technical staff on the solution as to incorporate future datasets without the direct involvement of the Contractor.

10 Calendar of Events. The schedule for the RFP process and the Work is given below. The State may change this schedule at any time. If the State changes the schedule before the proposal due date, it will do so through an announcement on the State Procurement Website s question and answer area for this RFP. The Website announcement will be followed by an amendment to this RFP, also available through the State s Procurement Website. After the proposal due date and before the award of the Contract, the State will make schedule changes through the RFP amendment process. Additionally, the State will make changes in the Work schedule after the Contract award through the change order provisions in the General Terms and Conditions Attachment to this RFP. It is each prospective offeror s responsibility to check the Website question and answer area for this RFP for current information regarding this RFP and its Calendar of Events through award of the Contract.