30-270047-DMH - Controlled Substance Reporting System RFI

STATE OF NORTH CAROLINA
REQUEST FOR INFORMATION NO. 30-270047-DMH
Department of Health and Human Services
Due Date: September 21, 2026 at 5pm ET
Refer ALL Inquiries to: Issue Date: August 24, 2026
Kathryn Brown Commodity: 811620 - Cloud-based software as a service
Contract Specialist Using Agency Name:
(919) 855-4093 NC Department of Health and Human Services, Division of
kathryn.brown@dhhs.nc.gov Mental Health, Developmental Disabilities and Substance
Use Services (DMH/DD/SUS)
PURPOSE: The purpose of this Request for Information (RFI) is to survey the market for information and
recommendations for a Controlled Substance Reporting System solution. See Executive Summary below for additional
details.
QUESTIONS
Submit written questions via the Ariba Sourcing Tool by August 31, 2026 by 5:00pm Eastern Time. See Section 2.B
for complete instructions for submitting clarification questions.
DELIVERY INSTRUCTIONS: Submit one (1) signed, original Request for Information (RFI) via the Ariba Sourcing
Module. If confidential and proprietary information is contained in your RFI response, submit one (1) signed,
redacted copy and label the attached file "RFI-30-270047-DMH Vendor Name - REDACTED". The RFI response
must be submitted prior to the RFI due date provided above. It is the responsibility of the vendor to have their RFI
submitted by the specified date and time. See Section 2.C for complete response instructions.
NOTICE TO VENDOR:
Submission of a response does not create an offer, and no contract award will result by submitting a response. The State
of North Carolina shall not be liable for any costs incurred by respondents in developing or submitting a response to this
RFI. No information gathered from this RFI will result in the issuance of a Request for Quote (RFQ).
EXECUTION
VENDOR NAME: E-MAIL:
STREET ADDRESS: P.O. BOX: ZIP:
CITY & STATE: TELEPHONE NUMBER: TOLL FREE TEL. NO:
TYPE OR PRINT NAME & TITLE OF PERSON SIGNING: FAX NUMBER:
AUTHORIZED SIGNATURE: DATE:
RFI 30-270047-DMH Page 1 of 8 Rev 2017/02/27

Contents
1.0 EXECUTIVE SUMMARY ........................................................................................................................................ 3
1.1 Acronyms & Definitions ................................................................................................................... 4
1.2 Performance Requirements: ........................................................................................................... 4
1.3 Operations ...................................................................................................................................... 5
1.4 Security ........................................................................................................................................... 5
1.5 Financial / Total Cost of Ownership ................................................................................................ 5
1.6 Confidential Information .................................................................................................................. 6
2.0 RFI PROCEDURES ................................................................................................................................................ 6
A. Schedule .............................................................................................................................................. 6
B. Clarification Questions ......................................................................................................................... 6
C. Response............................................................................................................................................. 7
RFI 30-270047-DMH Page 2 of 8 Rev 2017/02/27

1.0 EXECUTIVE SUMMARY
North Carolina Department of Health and Human Services (NC DHHS), in collaboration with our partners, protects the
health and safety of North Carolinians and provides essential human services. NC DHHS is one of the largest, most
complex agencies in the state of North Carolina, having approximately 18,000 employees. The Department is
responsible for providing human services support for special populations including individuals who are deaf, blind,
developmentally disabled and mentally ill, and helping poor North Carolinians achieve economic independence.
NC DHHS administers the Prescription Drug Monitoring Program (PDMP) to perform its duties under Chapter 90
Article 5e Controlled Substances Reporting System Act. The PDMP is known as the North Carolina Controlled
Substances Reporting System (NC CSRS). The Department requires a third party-hosted solution to track dispensed
prescriptions for Schedule II-V drugs and drugs of concern, to assist licensed health professionals in making informed
pharmaceutical treatment decisions, and aid authorized regulatory bodies in identifying possible over prescribing, over
dispensing, and drug diversion. These services are provided by DHHS on behalf of persons and entities subject to the
provisions of NCGS Article 5E, Chapter 90, 90-113.71 et. seq.
NC DHHS, Division of Mental Health, Developmental Disabilities and Substance Use Services (DMH/DD/SUS) is in
the process of developing plans to purchase a Controlled Substances Reporting System solution.
This Request for Information (RFI) is intended to collect information and recommendations regarding:
The vendor's capacity and cost to provide the following:
1. Solution should be cloud based and a Software as a Service (SaaS).
2. Solution should be scalable for the capability to add modules, incorporate North Carolina specific
modifications or integrate with state and/or external systems. Capable of maintaining integrations with the
following interfaces:
a. American Society for Automation in Pharmacy (ASAP) Version 4.2 up to 5.0 and any future
versions within one year of their release
b. National Association of Boards of Pharmacy: Prescription Monitoring Program (PMP)
InterConnect
c. NC Health Information Exchange Authority: NC HealthConnex.
3. Solution should be capable of receiving, ingesting, and maintaining a large data set with new records
reported daily by system users; the solution must maintain 99% data quality through system functionality.
4. Solution should be capable of delivering data to the Department on a daily, weekly, monthly or quarterly
reporting cadence including the capability of data transfer via Secure File Transfer Protocol (SFTP).
5. Provide a system with 99.5% availability, operating 24 hours/day; except during scheduled maintenance,
and capable of recovering from issues within 1 hour. Helpdesk support should be available 24x7.
6. Solution should be capable of integrating its search function into all electronic health record and
electronic medical record systems, support interstate interoperability, and ensure a robust audit trail of
access and activity.
7. Provide a secure digital environment that provides access to over 95,000 registered users and complies
with all applicable federal, State, and departmental regulations, policies, standards and guidelines,
including but not limited to:
a. The North Carolina Controlled Substances Reporting System Act, Chapter 90, Article 5E
b. The Health Insurance Portability Accountability Act of 1996 (HIPAA), the Health Information
Technology for Economic and Clinical Health Act of 2009 (HITECH) and subsequent additions
c. 42 CFR Part 2, Confidentiality of Substance Use Disorder Patient Records regulation
d. The North Carolina Identity Theft Protection Act
e. NC DHHS Privacy & Security Policy
f. 42 USC 1396w-3a: Requirements relating to qualified prescription drug monitoring programs and
prescribing certain controlled substances
The State requests detailed point-by-point responses showing how your firm would address the items in the following
sections of this RFI:
Section: 1.0 through 1.6
RFI 30-270047-DMH Page 3 of 8 Rev 2017/02/27

1.1 Acronyms & Definitions
* CFR: Code of Federal Regulations
* CSRS: Controlled Substances Reporting System
* Department: North Carolina Department of Health and Human Services
* NC DHHS: North Carolina Department of Health and Human Services
* NC eVP: North Carolina electronic Vendor Portal located at https://evp.nc.gov/ - the North Carolina
system to connect vendors with state government organizations that purchase goods and services.
* NCAC: North Carolina Administrative Code at http://reports.oah.state.nc.us/ncac.asp
* NCGS: North Carolina General Statutes at https://www.ncleg.gov/Laws/GeneralStatutesTOC - the
official North Carolina legal code, a collection of the statewide laws in force at the time of publication.
* PDMP: Prescription Drug Monitoring Program
* PHI: Protected Health Information
* PII: Personally Identifiable Information
* PMP: Prescription Monitoring Program
* RFI: Request for Information
* RFP: Request for Proposal
* SaaS: Software as a Service
* SFTP: Secure File Transfer Protocol
1.2 Performance Requirements:
Respondents should provide detailed information regarding their solution and associated capabilities. Include
detailed descriptions of the specifications in the following areas:
a. Scalability of the solution to add modules, incorporate North Carolina specific modifications or integrate
with state and/or external systems. Describe the capability of the solution to maintain integrations with
the following interfaces:
1. American Society for Automation in Pharmacy (ASAP) Version 4.2 up to 5.0 and any future
versions within one year of their release
2. National Association of Boards of Pharmacy: Prescription Monitoring Program (PMP) InterConnect
3. NC Health Information Exchange Authority: NC HealthConnex
b. Describe the ability of the solution to maintain a large dataset with daily record ingestion and how it will
maintain data quality.
c. Describe the reporting capabilities to provide reports to the Department via SFTP daily, weekly, monthly
or quarterly.
d. Describe the capability of the solution to audit user access and activity; and its capability to integrate
searching into electronic health or medical record workflows with all vendors.
e. Describe the ability of the solution to handle over 95,000 registered users.
f. Describe the ability to comply with Section 1944(b) Section 5042 - Medicaid PARTNERSHIP Act CMS
FAQs-SUPPORT for Patients and Communities Act (42 USC 1396w-3a): Requirements relating to
qualified prescription drug monitoring programs and prescribing certain controlled substances.
g. Describe the solution's uptime availability, average planned downtime per month and response to issues.
h. Describe the availability of helpdesk support and priority response times.
i. Provide any License Agreements or Service Level Agreements (SLA) for the solution.
RFI 30-270047-DMH Page 4 of 8 Rev 2017/02/27

1.3 Operations
a. Describe the level of business resources the Department would need to implement, support, and
maintain Respondent's solution.
b. Describe the level of IT resources the Department would need to implement, operate, maintain, and
support the Respondent's solution.
1. Describe what portion of the system can be supported by state IT staff.
2. Describe all hosting options for the solution including whether the system can be vendor hosted
or state hosted. For vendor hosted options, describe how the hosting environment will be
maintained by the vendor.
3. Describe how the system can be configured by the vendor.
c. The State prefers cloud-based Solutions that can be operated and maintained either by the state or the
vendor.
d. Describe the Respondent's capability to provide issue or defect resolution.
1.4 Security
a. Describe if the solution provides a portal for end user access and, if so, how the Department and end
users would access the solution while maintaining security measures.
b. Describe the security features to protect Personally Identifiable Information (PII) and Protected Health
Information (PHI).
1. Describe the solution's compliance with NCGS Article 5E, Chapter 90, 90-113.71 et. seq.
https://www.ncleg.net/EnactedLegislation/Statutes/HTML/ByArticle/Chapter_90/Article_5E.html
2. Describe the solution's compliance with HIPAA regulations. https://www.hhs.gov/hipaa/for-
professionals/privacy/index.html
3. Describe the solution's compliance with 42 CFR Part 2. https://www.ecfr.gov/current/title-
42/chapter-I/subchapter-A/part-2
4. Describe the solution's compliance with GovRAMP. https://programs.govramp.org/the-state-of-
north-carolina/
c. Describe the Respondent's approach to comply with privacy and security terms and conditions.
1. Annual assessment for compliance with HIPAA privacy and security rules.
2. Annual Security and HIPAA training.
3. Ongoing vulnerability assessments and penetration testing.
4. Annual third-party assessment (GovRAMP is required). List all third-party assessments
performed annually for the solution.
d. Describe how the proposed solution complies with applicable security standards identified by the State:
The Department's Confidentiality, Privacy and Security policies and other applicable regulatory
requirements:
NC DHHS Privacy Manual and Security Manual, both located here:
https://policies.ncdhhs.gov/departmental/policies-manuals/section-viii-privacy-and-security
NC Statewide Information Security policies, located here:
https://it.nc.gov/statewide-information-security-policies
e. Describe the Respondent's disaster recovery process that includes back-up data and disaster recovery
location.
f. Describe the type and frequency of testing.
1.5 Financial / Total Cost of Ownership
The Department understands that any time or cost information in the Vendor's response does not constitute a
quote and is only a representation of average project timelines, costs, and ongoing annual license and
support costs. Respondents will not be held to pricing estimates provided in response to this RFI should the
Department decide to proceed with a competitive solicitation.
RFI 30-270047-DMH Page 5 of 8 Rev 2017/02/27

a. Respondents are asked to provide information regarding estimated costs to purchase, install, and
operate a Controlled Substances Reporting System as described in this RFI. This information will help
the Department understand acquisition and on-going costs and be used to support budget development
and funding requests.
b. Respondents are asked to provide cost information in the format of their choosing and, to the extent
possible, include the following:
1. An estimated cost model or likely range of costs to purchase, implement, and operate the
described solution; and
2. If pricing information is limited or unavailable, describe Respondent's preferred pricing model or
structure, including unit costs based on key variables.
3. An average project cost range to implement the solution, to include implementation services
and product pricing.
4. Describe the license model and pricing for the solution.
5. The average annual cost for ongoing support.
c. Describe, on average, a typical solution implementation timeline.
1.6 Confidential Information
In accordance with 09 NCAC 06B.0103 the State may maintain confidentiality of certain types of information
described in N.C. Gen. Stat. 132-1 et. seq. Such information may include trades secrets defined by N.C. Gen.
Stat. 132-1.2. Respondents may designate appropriate portions of its response confidential, consistent with and
to the extent permitted under the Rules and Statutes set forth above, by marking the pages containing confidential
information with boldface type at the top and bottom of each such page stating "CONFIDENTIAL." By so marking
any page, the Respondent warrants that it has formed a good faith opinion, having received such necessary or
proper review by counsel and other knowledgeable advisers that the portions marked confidential meet the
requirements of the Rules and Statutes set forth above. The State may serve as custodian of Respondent's
confidential information and not as an arbiter of claims against Respondent's assertion of confidentiality. If an
action is brought pursuant to N.C. Gen. Stat. 132-9 to compel the State to disclose information marked
confidential, the Respondent agrees that it will intervene in the action through its counsel and participate in
defending the State, including any public official(s) or public employee(s). The Respondent agrees that it shall
hold the State and any official(s) and individual(s) harmless from any and all damages, costs, and attorney's fees
awarded against the State or official or individual in the action. The State agrees to promptly notify the
Respondent in writing of any action seeking to compel disclosure of Respondent's confidential information. The
State shall have the right, at its option and expense, to participate in the defense of the action through its counsel.
The State shall have no liability to Respondent with respect to the disclosure of Respondent's confidential
information ordered by a court of competent jurisdiction pursuant to N.C. Gen. Stat. 132-9 or other applicable law.
All information received in response to the RFI that is marked Confidential will be handled accordingly. The
Department shall not be liable for or suffer any consequential damages for any proprietary information submitted
and not properly identified. Proprietary information will be safeguarded in accordance with the applicable state
regulations.
2.0 RFI PROCEDURES
A. Schedule
Respondents will have four weeks to prepare their submissions to this RFI. Responses must be received by the
date, time and the location specified on the cover sheet of this RFI. Respondents may also be invited to present
and discuss their submissions to DHHS Headquarters either in person or virtually. Respondents will be notified of
the specific date and time at least two weeks in advance of their presentation.
B. Clarification Questions
Clarification questions will be accepted until August 31, 2026 at 5:00pm Eastern Time submitted via the Ariba
Sourcing Tool by the date and time specified above. All questions must be submitted in writing. Vendors should
submit questions with the subject "Questions-30-270047-DMH. An addendum containing any general clarification
questions and their answers will be issued as an addendum to this RFI on the NC Electronic Vendor Portal (eVP)
with the responses.
RFI 30-270047-DMH Page 6 of 8 Rev 2017/02/27

The questions should be submitted in an editable MS Excel file in the following format using as many rows as
needed.
# SOW Page # / Section Vendor Questions
1
2
3
C. Response
The State recognizes that considerable effort will be required in preparing a response to this RFI. However,
please note this is a request for information only, and not a request for services. The Vendor shall bear all
costs for preparing this RFI.
1. Content and Format
The State expects concise, detailed, point-by-point responses to each of the RFI response items identified in
Sections 1.0 through 1.6 of this RFI. The State is not interested in brochures or "boilerplate" responses.
Instead, responses should clearly define how the vendor's proposed solution(s) would meet the State's
business requirements. Any issues or exceptions to the State's requirements should also be identified and
explained.
The response should also include annotated network drawings showing where each of the pieces of
equipment in the proposed solution would be located and how those devices would be interconnected.
The response should define all services that would be required by the proposed solution. The response
should also include:
* The vendor's understanding of the project and services by addressing the State's business requirements;
* An estimated total cost of ownership for the solution including continued compliance with emerging
industry standards.
* The proposed solution's ability to expand and evolve to serve other State's sites either inside the Raleigh
area or in other county locations and also meet all of the service and performance requirements identified
in this RFI.
2. Include the following in the RFI response:
a) Transmittal Letter in the form of a standard business letter and should be signed by a respondent-
authorized individual. It should note the following:
* A statement that deviations are included, if applicable
* A statement that proprietary information is included, if applicable
b) General Information
* Name of Company
* Contact Person
* Address, Phone Number, Email address
c) Information about Respondent
* Overview of company's history, scope of products and services offered, and locations of
operation;
* Describe their experience in providing solutions similar in size and scope to the solution desired;
* Primary customer base or market;
* List of States or Agencies which utilize the Respondent's solution in a manner that is the same or
similar to those required by this RFI. Response to include state/agency name, most recent
implementation, contract start and end date, description of scope of work, the duration of any
contracts, and the termination dates;
* Lessons learned from working with other States or Agencies to implement a solution of similar
size, scope and with requirements the same or similar to those required by the Department.
RFI 30-270047-DMH Page 7 of 8 Rev 2017/02/27

3. Instructions for Submitting Responses
Due Date: September 21, 2026
Time: 5:00PM Eastern Time
Responses, subject to the conditions made a part hereof, will be received until 5:00pm Eastern Time on the
day of opening and then opened.
a) Submit one (1) signed, original electronic offer through the Ariba Sourcing Module.
b) The Ariba Sourcing Module document number is: Doc2365935872.
c) All File names should start with the Vendor name first, in order to easily determine all the files to be
included as part of the vendor's response. For example, files should be named as follows: Vendor Name-
your file name.
d) File contents SHALL NOT be password protected, the file formats must be in .PDF, .JPEG, .DOC or .XLS
format, and shall be capable of being copied to other sources.
e) If the vendor's response contains any confidential information, then the vendor must provide one (1)
signed, original electronic response and one (1) redacted electronic copy.
For Vendor training on how to use the Ariba Sourcing Tool to view solicitations, submit questions, develop
responses, upload documents, and submit responses to the State, Vendors should go to the following site:
https://eprocurement.nc.gov/training/vendor-training
Questions or issues related to using the Ariba Sourcing Tool itself can be directed to the North Carolina
eProcurement Help Desk at 888-211-7440, Option 2. Help Desk representatives are available Monday through
Friday from 7:30 AM EST to 5:00 PM EST
When submitting a response, include all pages of the RFI, with the EXECUTION section on the cover page of
this RFI completed and signed.
4. Multiple Responses
Multiple responses will be accepted from a single vendor provided that each response is comprehensive,
meets all of the state's requirements, and is truly unique. Submit multiple responses separately and label the
file as "Response #1, Response #2, etc. after the "Vendor Name" as applicable.
REMAINDER OF PAGE INTENTIONALLY LEFT BLANK
RFI 30-270047-DMH Page 8 of 8 Rev 2017/02/27