Second Amendment to the Iowa Department of Health and Human Services 
HCBS Learning Management System  Request for Proposal

This Amendment to RFP Number MED-24-008 is effective as of October 2, 2023.  The RFP is amended as follows:

Revision 1.  Section 1.3.1.5.A is deleted and replaced as follows: 
A.	The platform must have the ability to support 30,000 users per year with the ability to increase the number of users per year in accordance with the system Service Levels listed in 1.3.1.6.C. 

Revision 2.  Section 1.3.1.5.D is deleted and replaced as follows: 
D.	Provide Agency approved system testing no later than the timeframe set forth in Section 1.3.2. System testing shall demonstrate readiness to fulfill deliverables defined within the Contract and system service levels defined in 1.3.1.6.C. The Bidder shall outline testing systems, processes, responsibilities, and available test cases that will be utilized. The Vendor's completed testing document shall be submitted to the Agency within timeframes, indicated in Performance Measure 1.3.2.C, and demonstrate system implementation readiness. 

Revision 3.  Section 1.3.1.6.C is hereby amended as follows: 
C.	The Contractor shall ensure minimum system service levels. The Contractor shall propose service level standards that meet or exceed the minimum standards noted below: 

Revision 4.  Section 1.3.2, Performance Measures, is deleted and replaced as follows: 
A.	General Requirements
1.	Achieve the system service levels as identified in 1.3.1.6.C. 
2.	Achieve a minimum of 85% satisfaction as evidenced as "strongly agree" or "agree" from participant feedback surveys that Contractor provided training modules are effective, meet the needs of all participants, and are useful to their job on completed evaluations.
3.	The Contractor Account Manager, or designee, shall meet in-person or virtually with the Agency Contract Manager as scheduled during each SFY to review Deliverables, milestones, and system performance.  
B.	Project implementation
1.	The Contractor shall submit an Agency approved project implementation plan by January 16, 2024. 
C.	System testing
1.	The Contractor shall complete Agency approved system testing by January 29, 2024.
D.	Go live date
1.	The Contractor shall go live with Agency approval by February 16, 2024.
E.	Agency content upload
1.	The Contractor shall upload initial Agency created content accessible by LMS users by February 29, 2024.
F.	User training 
1.	The Contractor shall complete Agency approved user training by March 28, 2024.

Revision 5.  Section 1.3.3.3, Milestone Payments, is deleted and replaced as follows: 
Payment is dependent upon the successful completion and Agency acceptance of the following payment milestones. The Contractor shall not be entitled to any additional reimbursements including, but not limited to, travel for work related to these milestones. Milestones shall be invoiced upon Agency acceptance of Key Deliverables. The Contractor shall Invoice the Agency on the state approved form within thirty calendar days of the following completed milestones: 
A.	The Contractor shall submit an Agency approved project implementation plan by January 16, 2024. The milestone payment shall be $250,000.
B.	The Contractor shall complete Agency approved system testing by January 29, 2024. The milestone payment shall be $250,000. 
C.	The Contractor shall go live with Agency approval by February 16, 2024. The milestone payment shall be $250,000.
D.	The Contractor shall upload initial Agency created content accessible by LMS users by February 29, 2024. The milestone payment shall be $250,000.  
E.	The Contractor shall complete Agency approved user training by March 28, 2024. The milestone payment shall be $250,000.

Revision 6.  Section 3.1, Bid Proposal Formatting, first table is deleted in its entirety.  The second table remains in its entirety. 

Revision 7.  Section 3.3, Cost Proposal, is deleted and replaced as follows:  
Pricing Restrictions. 
Contract Budget.

The Agency is limiting the funding that is available for these services. Funding available for the Learning Management System includes: 
1.	Development and implementation costs between January 1, 2024 and March 31, 2024 are not to exceed $1,250,000. These costs include development and implementation milestones. 
2.	Operational costs between January 1, 2024 and December 31, 2024 are not to exceed $150,000.
3.	Subsequent contract year operational costs are not to exceed $150,000 per year.
4.	Total not to exceed cost is $2,750,000. 

Content and Format.
The Bidder shall provide the following information in the Cost Proposal: 

The bidder’s Cost Proposal shall be submitted using the pricing worksheet set forth in Attachment G of this RFP. 

Revision 8.  Attachment G, Cost Proposal, the Implementation Costs (Section 3.3.1) cell, is hereby amended as follows: 
Implementation Costs       (Section 3.3.1)   January 1, 2024-March 31, 2024

Revision 9.  Attachment H, Vendor Security Questionnaire, is hereby added as follows: 

State of Iowa Department of Human Services
Vendor Security Questionnaire

Vendor Name:	Completed by:	Date:	
		Updated:	
Question	Response	
Data Protection	
1	In what geographic location(s) will DHS data be stored? Specify the timeframe in which DHS will be notified if this changes.		
2	How does the vendor detect changes to the integrity of DHS data and what measures are in place to ensure DHS data is not lost, modified or destroyed?     		
3	How does the vendor ensure deleted data cannot be recoverable?		
4	How does the vendor detect degradation of DHS data?		
5	Define a security incident. 		
6	Describe the vendor’s incident response and reporting program. 		
Cloud Service Providers	
7	Will DHS data be stored in a cloud? 		
8	Who is the cloud service provider?		
9	Is the cloud service provider FedRAMP authorized and if so, specify the impact level.		
10	If not FedRAMP authorized, specify the security framework for which the cloud service provider is certified.  		
11	How can DHS be assured cloud service providers meet the same security standards as that of the vendor?		
Access Control	
12	Who has access to the systems providing DHS data and services? How is this access controlled?		
13	What authentication method is required to access DHS data and applications (e.g. username and password)?	

14	Which multi-factor authentication methods does the vendor support?	

15	Does the vendor allow the use of personal devices for access to DHS data?		
16	Specify the frequency vendor staff access to DHS data is reviewed.		
17	Which access control methodology does the vendor support: Role-based access control (RBAC), mandatory access control (MAC), or discretionary access control (DAC)? Define how you meet this methodology.		
Regulatory Compliance	
18	Is the vendor a HIPAA covered entity?  		
19	Is the vendor a business associate of DHS? If yes, does the vendor have downstream business associate agreements with subcontractors?		
20	Define the vendor’s HIPAA training. List the training modules and the time allotted for each module.		
21	Is the vendor audited or assessed by a third party? If yes, specify the security framework.  		
22	Explain how the vendor performs an information security risk assessment. What is the frequency?	

23	Explain how the vendor manages their information security risk assessment program.		
Business Continuity and Resiliency	
24	Does the vendor have a business continuity plan? 		
25	How often is the business continuity plan tested?	

26	How does the vendor ensure DHS can continue doing business at all times, even if there is a permanent catastrophic failure or natural or man-made disaster where DHS data or services are located?	

27	What guarantees does the vendor provide for recovery time objectives (RTO) and recovery point objectives (RPO)?	

Service and Data Integrity	
28	Is DHS data encrypted in transit? If so, specify the encryption algorithm and cipher strength. 
Who owns the encryption key?		
29	Is DHS data encrypted at rest? Is so, specify the encryption algorithm and cipher strength. 
Who owns the encryption key?		
30	Specify the network security tools used to monitor data flow into the vendor’s network for malware or cyber-attacks.		
31	What tools and procedures does the vendor utilize for intrusion detection and at what frequency? How is this capability tested for functionality at the hardware, network, and database levels?   		
Multi-Tenancy	
32	How does the vendor separate DHS data and services from those of other clients?	

33	In what ways could the vendor’s other client’s affect the quality of the service or service levels provided to DHS?	

34	What resources will DHS share with other clients?	

Infrastructure and Application Security	
35	Who owns and operates the vendor’s data centers and what physical and environment security measures are in place?	
	
36	What parts of the vendor’s infrastructure are owned and operated by the vendor and what parts are obtained from a colocation service?	

37	What standards are followed for hardening network equipment, operating systems, and applications?	

38	Specify the tools used to perform vulnerability scans and the frequency. What is the timeframe to re-mediate high and critical findings?	

39	Specify the frequency of third party penetration tests to assess infrastructure security. Include the type of third party report received. 	

40	What specifications does the vendor follow to purge data when equipment is retired or replaced? How does the vendor purge any resident DHS data?		
41	Does the vendor utilize a web application for this service? If so, does the vendor follow the OWASP Top 10 List?		
Non-production Environment Exposure	
42	Is DHS data loaded to a test environment? If so, who has access to the test environment?		
43	Which copies are de-identified and which are not?		
44	Is live DHS data used in testing?