Inactive

Pursuant to FAR Subpart 5.2 - Synopses of Proposed Contract Actions, the Department of Health and Human Services (HHS)/Centers for Medicare and Medicaid Services (CMS) hereby gives notice of a propose... Pursuant to FAR Subpart 5.2 - Synopses of Proposed Contract Actions, the Department of Health and Human Services (HHS)/Centers for Medicare and Medicaid Services (CMS) hereby gives notice of a proposed sole-source procurement for the program entitled, “Experian Remote Identity Proofing (RIDP) Services.” This opportunity will be tracked as Advance Procurement Plan (APP) #210532; a solicitation number will be assigned when the formal solicitation is released. This opportunity was previously identified on CMS’ Fiscal Year Forecast Opportunities listing as APP #201312. CMS intends to award a sole-source contract to provide the full scope of Experian Remote Identity Proofing (RIDP) services that CMS requires to Experian Information Solutions, Inc. located at 475 Anton Blvd, Costa Mesa, CA 92626. This acquisition will be conducted using non-competitive procedures under the authority of 41 U.S.C. 253 (c)(1) and FAR Subpart 6.302-1: Only one responsible source and no other supplies or services will satisfy agency requirements. The Centers for Medicare & Medicaid Services (CMS) is a federal agency that ensures health care coverage for more than 100 million Americans. CMS has established the Identity Management (IDM) services to provide its Business Partners with a means to apply for, obtain approval, and receive CMS-issued credentials for electronic access to one or more CMS business applications. The Experian RIDP services are a critical part of the distributed IDM solution. CMS applications can access the Experian RIDP services through the CMS Enterprise Portal or through other CMS portals, or may use the Experian RIDP services as a stand-alone self-service module. Additionally, CMS (and the contractors providing services to CMS) must adhere to White House and federal agency requirements that help protect citizens' identities, such as the Electronic Authentication Guideline (National Institute of Standards and Technology (NIST) SP 800-63) and its successors. CMS and its contractors must comply with larger IT security and data privacy regulations including Federal Information Security Management Act (FISMA) and the Health Information Portability and Accountability Act (HIPAA) of 1996. The Experian RIDP Services contractor will be responsible for providing CMS with all of the Experian RIDP services that CMS is currently utilizing. The contractor must demonstrate operational expertise and flexibility to support CMS as Remote Identity Proofing (RIDP) requirements evolve to meet new conditions, policy changes, and legislative mandates. The contractor shall assist CMS in ensuring that the RIDP services provided continue to adhere to Federal and agency requirements and industry best practices. The contractor shall provide Experian Professional Services support to applications requiring the Experian Remote Identity Proofing (RIDP) services. The contractor shall also provide effective, efficient, and user-friendly Electronic Authentication (E-Authentication) processes in accordance with NIST guidelines (including but not limited to NIST 800-63-2) for establishing confidence in user identities that are presented to CMS in online environments. The contractor shall also work with CMS to ensure the RIDP services provided are flexible and robust enough to meet both CMS’ current and future RIDP requirements, including but not limited to digital e-authentication and NIST 800-63 (including but not limited to NIST 800-63-3) or its successor. The contractor shall provide CMS with periodic analysis and recommendations regarding trends and improvements in the RIDP marketplace, industry best practices, and government mandates (whether in place now, proposed, or under discussion publicly). The contractor shall ensure the services provided are efficient and effective at meeting the varied and evolving CMS RIDP requirements while providing the best possible user experience. The key functionality being procured includes: Provide/maintain Level of Assurance 2 (LOA2) remote Identity Proofing based on the Risk Management Handbook Volume III Standard 3.1 CMS Authentication. Provide/maintain Level of Assurance 3 (LOA3) remote Identity Proofing based upon Risk Management Handbook Volume III Standard 3.1, CMS Authentication Standards. Actively retain transaction audit logs and provide auditing capabilities. Testing services for CMS applications integrating with the Experian RIDP Services. Present to CMS all data set types used in its identity proofing services. CMS shall have the option to restrict usage of any controversial public data sets for identity proofing services if deemed necessary. Tracking and reporting usage data at the individual application level. Maintain Spanish Call Center interpretation services, as customized for CMS, supporting the Experian phone-based identity proofing. Maintain Limited English Proficiency (LEP) interpretation services, as customized for CMS, supporting the Experian phone-based identity proofing services. Provide Experian Professional Services (PS) support to CMS applications integrating with the Experian RIDP services. Support CMS and other teams during audits, including but not limited to Security Impact Analyses (SIAs) and Adaptive Control Tests (ACTs). It is anticipated that CMS will award a sole source contract that will have a one-year base period and four (4) one-year option year periods. The PSC code applicable to this procurement is R615– Support-Administrative: Background Investigation. This announcement is not a Request for Proposal (RFP). CMS expects to release a formal RFP at the end of October 2020 and to make a single contract award around February 2021. All responsible sources may submit a capability statement, proposal or quotation, which shall be considered by the agency. All statements of interest and capability must be submitted in writing (via e-mail) to the Contracting Officer and Contract Specialist no later than 1:00pm E.S.T. on Wednesday, October 7, 2020. Telephone and fax inquiries will not be accepted. The Government is not obligated or committed to award any contract as a result of this notice.