04/23/151HHSC Procurement and Contracting Services

Preview:

Citation preview

HHS Approval Process to Initiate a Procurementand

Approval to Advertise

(For Purchases that Exceed $25,000)

04/23/15 1HHSC Procurement and Contracting Services

Action Memorandum, January 14, 2015◦ Re: Signature Delegation – Solicitation advertising Approval

for Deputy Executive Commissioner, PCS Executive Memorandum, January 14, 2015◦ Re: Signature Delegation – Solicitation advertising Approval

for Associate Commissioner, PCS Procurement Initiation◦ PCS 146, Procurement Initiation/Approval to Advertise Form

Phase 1: Procurement/Solicitation Approval Phase 2: Approval to Advertise

Topics

04/23/15 2HHSC Procurement and Contracting Services

Action Memorandum, January 14, 2015◦ Signature Delegation – Solicitation Advertising Approval for

Deputy Executive Commissioner, PCS Align policies and procedures with Procurement and

Contracting Services (PCS) consolidations◦ PCS and ASD (Administrative Services Division) merger

effective 9/1/2012◦ Agency procurement services departments consolidated with

PCS effective 4/1/2013 Further clarify the roles and responsibilities of PCS◦ Achieve further efficiencies

Executive Action Memorandum

04/23/15 3HHSC Procurement and Contracting Services

These forms are no longer required for HHSC Programs to initiate a procurement:◦ Requisition Approval Memo (RAM)◦ HHSC Contract Planning Questionnaire (CPQ) – CPP0401◦ HHSC Key Procurement Provisions Summary (KPPS) – CPP0403◦ Approval To advertise the Procurement/Solicitation – CPP0403

Efficiencies Achieved

04/23/15 4HHSC Procurement and Contracting Services

Delegates authority to the PCS DEC for approval to advertise RFPs and other solicitation documents.◦ This authority is delegated to the PCS Associate Commissioner

if the PCS DEC is unavailable.

This process does NOT apply to Proprietary/Sole Source or Emergency procurements.

Executive Memorandum

04/23/15 5HHSC Procurement and Contracting Services

Procurement Initiation(Phase 1)

PCS 146, Procurement Approval to Initiate

To document a summary of the procurement/solicitation for HHS Agency/Program Signature Authority approval for new procurements/solicitations not for renewals or amendments.

To document PCS DEC or PCS Associate Commissioner review and approval of the development and issuance of a procurement/solicitation; and subsequent advertising of the procurement/solicitation.

Purpose of the PCS 146, Procurement Initiation/Approval to Advertise Form

04/23/15 7HHSC Procurement and Contracting Services

Example 1: ◦ If the initial term of the contract is for one year w/4-year

option, then the PCS 146 approval is applicable to the one year initial term. Approval is not required for the 4-year option – just the initial term of the contract.

Example 2:

PCS 146 is for Approval of Procurements/Solicitations Not for Renewals or Amendments

04/23/15HHSC Procurement and Contracting Services 8

Identifies a need for procurement/purchase (good and or/service) that exceed $25,000

Determines if confidential Information will be accessed. Coordinates and documents the approval for the request

through HHS Agency/Program Signature Authority using PCS 146, Procurement Initiation/Approval to advertise Form◦ Completes PCS 146, Sections 1-5◦ Signature Authority: http://hhscx.hhsc.state.tx.us/admin/purch/SignatureAuthority.shtml

Forwards electronic copy of PCS 146 with the requisition request via HHSAS◦ HHSC ONLY: Forwards Pre-requisition Form (PRF) and PCS 146 to the HHSC Requisitions Mailbox.

Procurement Initiation/Approval to Advertise Sections 1-5: HHS Agency/Program

04/23/15 9HHSC Procurement and Contracting Services

Procurement Initiation/Approval to Advertise FormSection 1-5: HHS Agency/Program

04/23/15HHSC Procurement and Contracting Services 10

Texas Penal Code Sec. 37.10. TAMPERING WITH GOVERNMENTAL RECORD

04/23/15HHSC Procurement and Contracting Services 11

Texas Penal Code Sec. 37.10. TAMPERING WITH GOVERNMENTAL RECORD

04/23/15HHSC Procurement and Contracting Services 12

Sec. 37.10. TAMPERING WITH GOVERNMENTAL RECORD. (a) A person commits an offense if he:

(1) knowingly makes a false entry in, or false alteration of, a governmental record;(2) makes, presents, or uses any record, document, or thing with knowledge of its

falsity and with intent that it be taken as a genuine governmental record;(3) intentionally destroys, conceals, removes, or otherwise impairs the verity,

legibility, or availability of a governmental record;(4) possesses, sells, or offers to sell a governmental record or a blank

governmental record form with intent that it be used unlawfully;(5) makes, presents, or uses a governmental record with knowledge of its falsity;

or(6) possesses, sells, or offers to sell a governmental record or a blank governmental record form with knowledge that it was obtained unlawfully.

If the PCS 146 is not attached to the requisition, the requisition will be returned to the Agency/Program by the Requisition Intake Team (RIT) with a request to PCS 146, Sections 1-5, prior to initiation of the procurement.

If the RIT cannot determine if the procurement/solicitation is for an initial procurement/solicitation or a renewal/amendment, the Purchaser will contact the Agency/Program.

PCS 146, Procurement Initiation/Approval to Advertise FormNot Received by PCS Purchaser

04/23/15 13HHSC Procurement and Contracting Services

Reviews the requisition and PCS 146 for compliance and content and verifies the Signature Authority

http://hhscx.hhsc.state.tx.us/admin/purch/SignatureAuthority.shtml

Contacts PCS Director to obtain Agency/Program’s Total Appropriation; documents Total Appropriations and Maximum Contract Amount in Section 6.

If the initial term of the resulting contract is $5 million or over, enters the recommended procurement method on the PCS 146

Forwards the PCS 146 to the PCS Associate Commissioner mailbox for review .HHSC PCS Associate Commissioner Review

Procurement Initiation/Approval to Advertise FormSection 6: PCS Purchaser

04/23/15 14HHSC Procurement and Contracting Services

Procurement Initiation/Approval to Advertise FormSection 6: PCS Purchaser

04/23/15HHSC Procurement and Contracting Services 15

Approves or denies the request to initiate the procurement

Approves or denies the recommended procurement method (for procurements $5 million or over)◦ Completes PCS, Section 6.

Returns the PCS 146 to the PCS Purchaser.

Procurement Initiation/Approval to Advertise FormSection 6: PCS DEC or PCS Associate Commissioner

04/23/15 16HHSC Procurement and Contracting Services

If the request is approved by the PCS DEC or PCS Associate Commissioner, the Purchaser proceeds with the procurement.

If the request is denied – returns PCS 146 to HHS Agency /Program and cancels requisition.

Procurement Initiation/Approval to Advertise FormSection 7: PCS Purchaser

04/23/15 18HHSC Procurement and Contracting Services

The Advertisement ProcessUpon approval of the procurement/solicitation, the Purchaser coordinates with the HHS Agency/Program to development the solicitation advertisement before proceeding.

04/23/15HHSC Procurement and Contracting Services 19

Procurement Approval to Advertise (Phase 2)

PCS 146, Procurement Approval to Advertise

PCS Purchaser signs PCS 146, Section 7 to acknowledge they received assistance and approval with drafting development of the procurement/solicitation the:◦Office of General Counsel (OGC)◦ Historically Underutilized Business (HUB)◦ Budget; and/or ◦ any other affected Division/Program (e.g. Civil Rights, HHSC

Information Technology)

Sends the approved PCS 146 to the Agency Project Lead, or person(s) designated (see Section 5), authorized to approve the advertisement.

Procurement Initiation/Approval to Advertise FormSection 7: PCS Purchaser

04/23/15 21HHSC Procurement and Contracting Services

Procurement Initiation/Approval to Advertise FormSection 7: PCS Purchaser

04/23/15 22HHSC Procurement and Contracting Services

Signature Authority (identified in Section 5) signs PCS 146, Section 8 to approve advertisement of solicitation.

Sends the PCS 146 to the PCS Purchaser.

Procurement Initiation/Approval to Advertise FormSection 8: HHS Agency/Program Signature Authority

04/23/15 23HHSC Procurement and Contracting Services

Procurement Initiation/Approval to Advertise FormSection 8: HHS Agency/Program

04/23/15 24HHSC Procurement and Contracting Services

PCS Purchaser forward PCS 138, Electronic State Business Daily Solicitation Approval Form, and PCS 146 to PCS Manager for approval.◦ Completes PCS 146, Section 9

Forwards manager-approved PCS 146 to PCS DEC or PCS Associate Commissioner for approval.

Procurement Initiation/Approval to Advertise FormSection 9: PCS Purchaser

04/23/15 25HHSC Procurement and Contracting Services

Procurement Initiation/Approval to Advertise FormSection 9: PCS Manager

04/23/15HHSC Procurement and Contracting Services 26

Review PCS 146 and forwards to PCS DEC or PCS Associate Commissioner for approval or denial to advertise.

Procurement Initiation/Approval to Advertise FormSection 9: PCS Manager

04/23/15 27HHSC Procurement and Contracting Services

Approves or denies the request to advertise the procurement/solicitation.◦ Completes PCS 146, Section 9◦ Returns the PCS 146 to the PCS Purchaser.

Procurement Initiation/Approval to Advertise FormSection 9: PCS DEC or PCS Associate Commissioner

04/23/15 28HHSC Procurement and Contracting Services

Procurement Initiation/Approval to Advertise FormSection 9: PCS DEC or PCS Association Commissioner

04/23/15HHSC Procurement and Contracting Services 29

If request to advertise is approved, proceeds to advertise the procurement/solicitation.

Procurement Initiation/Approval to advertise FormSection 9: PCS Purchaser

04/23/15 30HHSC Procurement and Contracting Services

PCS Purchaser places completed PCS 146 in the procurement file.

Procurement Initiation/Approval to Advertise FormSection 9: PCS Purchaser

04/23/15 31HHSC Procurement and Contracting Services

Data Use Agreement (DUA)Access to Confidential Information

Procurement Initiation/Approval to Advertise FormSection 4: HHS Agency/Program

04/23/15HHSC Procurement and Contracting Services 33

Section 4: If the contractor will access

confidential information the Agency Programs

will answer “Yes” to the question. And, specific actions must be taken.

The purpose of the DUA is to facilitate creation, receipt, maintenance, use, disclosure or access to Confidential Information (CI) with a CONTRACTOR.

The DUA describes the CONTRACTOR’S rights and obligations with respect to the CI and the limited purposes for which the CONTRACTOR may create, receive, maintain, use, disclose or have access to CI.

Purpose of the DUA

04/23/15HHSC Procurement and Contracting Services 34

The DUA applies to both CONTRACTORS AND BUSINESS ASSOCIATES who create, receive, maintain, use, disclose or have access to CI on behalf of HHS, its programs or clients as described in the Base Contract.◦ applies to health/non-health-related CI.

As of the Effective Date of the DUA, if any provision of the Base Contract, including any General Provisions or Uniform Terms and Conditions (UTCs), conflicts with the DUA, the DUA controls.◦ Reference: http://www.hhsc.state.tx.us/about_hhsc/BusOpp/data-use-agreement.pdf

DUA Applicability

04/23/15HHSC Procurement and Contracting Services 35

The DUA takes precedence if there are conflicting terms in the Base Contract.

The DUA also describes HHS’s remedies in the event of CONTRACTOR’s non-compliance with its obligations under the DUA.

DUA Takes Precedence

04/23/15HHSC Procurement and Contracting Services 36

Data Use Agreement: The general version that should be used for all contractors who access agency CI, as referenced in the UTCs, is now available on the DUA website: http://www.hhsc.state.tx.us/about_hhsc/BusOpp/data-use-agreement.pdf◦ Note: The DUA is now referenced in the agency’s UTCs and PCS 111, Terms and Conditions.

Data Use Agreement (DUA)

04/23/15HHSC Procurement and Contracting Services 37

Understanding the DUA: This presentation provides information to explain the terms of the DUA and what laws require us to protect and safeguard agency confidential data. http://hhscx.hhsc.state.tx.us/data-use-agreement-compliance/docs/understanding-dua.pdf

Online Presentation: Internal HHS Data Use Agreement

04/23/15HHSC Procurement and Contracting Services 38

Agency/Program – Will Identify Contractors Who Will Access Confidential Information (CI)

04/23/15HHSC Procurement and Contracting Services 39

Procurement Initiation/Approval to Advertise FormSection 4: HHS Agency/Program

04/23/15HHSC Procurement and Contracting Services 40

HHS DUA Attachment 2: Information Security and Privacy Initial Inquiry (SPI)

If a data usage agreement

04/23/15HHSC Procurement and Contracting Services 42

Completed by Applicant/Bidder◦ Section A: Applicant/Bidder Information◦ Section B: Privacy Risk Analysis and Assessment◦ Section C: Security Risk Analysis and Assessment

For any ‘No’ answers to questions in SECTION B and SECTION C, the Applicant/Bidder must correct any ‘No’ response before Applicant/Bidder can submit a response or a complete application.◦ http://www.hhsc.state.tx.us/about_hhsc/BusOpp/HHS_SPI.pdf

Information Security and Privacy Initial Inquire (SPI)

04/23/15HHSC Procurement and Contracting Services 43

DUA and SPI Process for Procurement

Effective April 6, 2015

DUA and SPI Process for ProcurementEffective April 6, 2015

04/23/15HHSC Procurement and Contracting Services 45

DUA and SPI Process for ProcurementEffective April 6, 2015

04/23/15HHSC Procurement and Contracting Services 46

DUA and SPI Process for ProcurementEffective April 6, 2015

04/23/15HHSC Procurement and Contracting Services 47

DUA and SPI Process for ProcurementEffective April 6, 2015

04/23/15HHSC Procurement and Contracting Services 48

DUA and SPI Process for ProcurementEffective April 6, 2015

04/23/15HHSC Procurement and Contracting Services 49

DUA and SPI Process for ProcurementEffective April 6, 2015

04/23/15HHSC Procurement and Contracting Services 50

DUA and SPI Process for ProcurementEffective April 6, 2015

04/23/15HHSC Procurement and Contracting Services 51

DUA and SPI Process for ProcurementEffective April 6, 2015

04/23/15HHSC Procurement and Contracting Services 52

DUA and SPI Process for ProcurementEffective April 6, 2015

04/23/15HHSC Procurement and Contracting Services 53

THE END!

PCS 111 Terms and Conditions

Section 8.2, Security of Information

04/23/15HHSC Procurement and Contracting Services 54

8.2. By entering into contract, or purchase order, with a Texas Health & Human Services agency, you agree to be bound by the terms of the HHS Data Use Agreement (HHS-GC.DUA) Data Use Agreement: This is the general version that should be used for all contractors who access agency confidential information. It is available on the DUA website: http://www.hhsc.state.tx.us/about_hhsc/BusOpp/data-use-agreement.pdf. Information that explains the terms of the DUA and what laws require us to protect and safeguard agency confidential data can be found at: http://hhscx.hhsc.state.tx.us/data-use-agreement-compliance/docs/understanding-dua.pdf

◦ 8.2.1. If this box is checked, Section 8.2 does not apply to the ☐contract, or purchase order, because the contractor will not have access to confidential information.

PCS 111, Section 8.2, Security of Information

04/23/15HHSC Procurement and Contracting Services 55

PCS DUA and SPI Process for Competitive Purchases

04/23/15HHSC Procurement and Contracting Services 56

Licensed medical professionals providing only clinical services DARS Disability Determination Services (DDS) Program Non-IT Goods Administrative furniture and equipment Janitorial services Fire alarm services Facility construction/renovation services Food and beverages for client facilities Durable medical equipment Medical consumables Pharmaceuticals and vaccines Laboratory equipment and consumable supplies Conference services

List of Exempt Procurements from the DUA and SPI Form Process:

04/23/15HHSC Procurement and Contracting Services 57

PCS DUA and SPI Process for Competitive Purchases

Request for Proposal (RFP)

04/23/15HHSC Procurement and Contracting Services 58

PCS Form 146 or "I'm your Purchaser” email will ask the question of whether an awarded vendor(s) will have access to Confidential Information (CI) - to determine if the DUA referenced language is needed in the solicitation document.

If yes, the DUA’s provisions will be in the agency’s UTCs as a reference (the DUA will not require a signature) - (If DUA is negotiated, and legal approves, then the amended DUA doc is signed and put in the contract file and uploaded to HCATS.)

If no, a check box will be checked by the purchaser at the agency’s UTC’s section of the DUA indicating the DUA provisions do not apply for the solicitation.

RFP

04/23/15HHSC Procurement and Contracting Services 59

PCS Purchaser includes appropriate language in the solicitation document, including the SPI form, if the DUA provisions apply to the solicitation. If a DUA is required for the solicitation, and the resultant responder(s) must submit the SPI form.

PCS Purchaser will insert in the SOW section or special provision section of the solicitation the following statement: “The respondents to the RFP must submit the SPI form with their proposal.”

RFP

04/23/15HHSC Procurement and Contracting Services 60

PCS advertises the solicitation including the SPI form, and receives the submitted proposals.

PCS purchaser will pre-screen the submitted SPI form. If the SPI is not submitted, or any answer on the form’s section B or C is ‘No’ – the proposal will be disqualified. Disqualified responder(s) will be notified, per PCS policy, by only advertising the awarded vendor(s).

RFP

04/23/15HHSC Procurement and Contracting Services 61

Upon award and the execution of the contract, the PCS purchaser will email the submitted SPI form (by scanning if it was not received electronically) and the executed contract to the contract manager and the CISO at infosecurity@hhsc.state.tx.us.

As appropriate, the CISO will determine what HHS agency the procurement was for, and assign the SPI to the agency ISO.

RFP

04/23/15HHSC Procurement and Contracting Services 62

PCS Purchaser ensures this transmittal email to the CISO and SPI form are filed in the procurement file.

Upon receiving the SPI form from the CISO, each HHS agency ISO will work with the vendor’s ISO to assess the risk and determine mitigation actions, as needed. If mitigation actions do not adequately mitigate the risks of information breaches, appropriate action will be taken.

RFP

04/23/15HHSC Procurement and Contracting Services 63

PCS DUA and SPI Process for Competitive Purchases

Enrollment

04/23/15HHSC Procurement and Contracting Services 64

PCS Form 146 or "I'm your Purchaser” email will ask the following questions to the contact name on the requisition: a) who is the contract manager, or staff person, that would know about the enrollment’s confidential information? – and b) whether an awarded vendor(s) will have access to Confidential Information (CI)? - to determine if the DUA referenced language is needed in the enrollment solicitation document.

If yes, the DUA’s provisions will be in the HHS agency’s UTCs as a reference (the DUA will not require a signature). (If DUA is negotiated, and legal approves, then the amended DUA doc is signed and put in the contract file and uploaded to HCATS).

If no, a check box will be checked by the purchaser at the HHS agency’s UTC’s section of the DUA indicating the DUA provisions do not apply for the enrollment solicitation.

Enrollment

04/23/15HHSC Procurement and Contracting Services 65

PCS Contract Services notifies the applicant the rejection if there issues with their application, or if the SPI ‘No’ issues cannot be cured.

If the SPI passes, and if the application(s) is complete and pre-checked, PCS CS will then pass the enrollment package(s), and the SPI form, on to the agency to review, and enter into a contract, if accepted.

Enrollment

04/23/15HHSC Procurement and Contracting Services 66

Agency enters into contract, if accepted, or notifies PCS why they are not entering into contract.

If not accepted, PCS documents reason; agency notifies unsuccessful applicant.

If accepted, agency will ensure the submitted SPI form is scanned and emails the form, and the executed contract, to the contract manager and the CISO at infosecurity@hhsc.state.tx.us.

Enrollment

04/23/15HHSC Procurement and Contracting Services 67

As appropriate, the CISO will determine what HHS agency the enrollment was for, and assign the SPI to the HHS agency ISO.

Upon receiving the SPI form from the CISO, each HHS agency ISO will work with the vendor’s ISO to assess the risk and determine mitigation actions, as needed. If mitigation actions do not adequately mitigate the risks of information breaches, appropriate action will be taken.

Enrollment

04/23/15HHSC Procurement and Contracting Services 68

Purchaser includes appropriate language in the enrollment solicitation document, including the SPI form, if the DUA provisions apply to the solicitation. If a DUA is required for the enrollment solicitation, and the resultant applicant(s) must submit the SPI form, the Purchaser will insert in the SOW section, or special provision section of the solicitation, the following statement: “The respondents to this enrollment, must submit the SPI form with their application.”

Enrollment

04/23/15HHSC Procurement and Contracting Services 69

PCS advertises the enrollment solicitation and includes the SPI form, and receives the submitted applications.

PCS Contract Services (CS) team will pre-screen the received applications and the submitted SPI form. If the SPI is not submitted, or any answer on the form’s section B or C is ‘No’ – the application will be disqualified, if the issues on the SPI cannot be cured by contacting the applicant.

Enrollment

04/23/15HHSC Procurement and Contracting Services 70

PCS DUA and SPI Process for Competitive Purchases

IFB >$25K

04/23/15HHSC Procurement and Contracting Services 71

PCS Form 146 or "I'm your Purchaser” email will ask the following questions to the contact name on the requisition: a) who is the contract manager, or staff person, that would know about the procurement’s confidential information? – and b) whether an awarded vendor(s) will have access to Confidential Information (CI)? - to determine if the DUA referenced language is needed in the solicitation document.

If yes, the DUA’s provisions will be in the IFB’s PCS Form 111 Terms and Conditions as a reference via a link to the DUA (the DUA will not require a signature). - (If DUA is negotiated, and legal approves, then the amended DUA doc is signed and put in the contract file and uploaded to HCATS.) - For client services, or client goods, the HHS agency’s UTCs will be utilized – not the PCS Form 111.

If no, a check box will be checked by the purchaser on the HHS agency’s UTCS, or on PCS Form 111, DUA Section, indicating the DUA provisions do not apply for the IFB.

IFB >$25K

04/23/15HHSC Procurement and Contracting Services 72

PCS Purchaser includes appropriate language in the IFB solicitation document, including the SPI form, if the DUA provisions apply to the solicitation. If a DUA is required for the solicitation, and the resultant bidder(s) must submit the SPI form, the Purchaser will insert in the SOW section, or special provision section of the solicitation, the following statement: “The respondents to this IFB must submit the SPI form with their bid.”

IFB >$25K

04/23/15HHSC Procurement and Contracting Services 73

PCS advertises the solicitation, and the SPI form, and receives the submitted bids.

PCS purchaser will pre-screen the submitted SPI form. If the SPI is not submitted, or any answer on the form’s section B or C is ‘No’ – the bid(s) will be disqualified and disqualified responder(s) will be notified, per PCS policy, by advertisement of the awarded vendor(s).

IFB >$25K

04/23/15HHSC Procurement and Contracting Services 74

Upon award and the execution of the contract, or Purchase Order (PO), the PCS purchaser will insert on the PO the following statement – By performing this purchase order, vendor agrees to be bound by the provisions of the DUA, found at this link - http://www.hhsc.state.tx.us/about_hhsc/BusOpp/data-use-agreement.pdf

Additionally, the PCS purchaser will scan the submitted SPI form from the awardee(s) and emails the form to the contract manager and the CISO at infosecurity@hhsc.state.tx.us.

IFB >$25K

04/23/15HHSC Procurement and Contracting Services 75

As appropriate, the CISO will determine what HHS agency the procurement was for, and assign the SPI to the agency ISO.

Purchaser ensures this transmittal email to the CISO and SPI form are filed in the procurement file.

Upon receiving the SPI form from the CISO, each HHS agency ISO will work with the vendor’s ISO to assess the risk and determine mitigation actions, as needed. If mitigation actions do not adequately mitigate the risks of information breaches, appropriate action will be taken.

IFB >$25K

04/23/15HHSC Procurement and Contracting Services 76

PCS DUA and SPI Process for Competitive Purchases

Informal bids - telephone bids <$25K

04/23/15HHSC Procurement and Contracting Services 77

Upon receipt of the requisition, the assigned PCS purchaser will send the "I'm your Purchaser” email and will ask the following questions to the contact name on the requisition: a) who is the contract manager, or staff person, that would know about the procurement’s confidential information? – and b) whether an awarded vendor(s) will have access to Confidential Information (CI)? - to determine if the DUA referenced language is needed in the solicitation document. If yes, the DUA’s provisions will be in the IFB’s PCS Form 111 Terms

and Conditions as a reference via a link to the DUA (the DUA will not require a signature). (the DUA will not require a signature) - (If DUA is negotiated, and legal approves, then the amended DUA doc is signed and put in the contract file and uploaded to HCATS.) - For client services, or client goods, the HHS agency’s UTCs will be utilized – not the PCS Form III.

If no, a check box will be checked by the purchaser on the HHS agency’s UTCS, or on Form 111’s section of the DUA indicating the DUA provisions do not apply for the IFB.

Informal bids - telephone bids <$25K

04/23/15HHSC Procurement and Contracting Services 78

PCS Purchaser includes appropriate language in the solicitation document, including the SPI form, if the DUA provisions apply to the solicitation. If a DUA is required for the solicitation, and the resultant bidder(s) must submit the SPI form, the Purchaser will insert in the SOW section, or special provision section of the solicitation, the following statement: “The respondents to this IFB must submit the SPI form with their bid.”

PCS sends out the informal bids, and the SPI form, to the identified bidders. The PCS purchaser receives the submitted bids.

The PCS purchaser will pre-screen the submitted SPI form. If the SPI is not submitted, or any answer on the form’s section B or C is ‘No’ – the bid(s) will be disqualified.

Informal bids - telephone bids <$25K

04/23/15HHSC Procurement and Contracting Services 79

Upon award and the execution of the contract, or Purchase Order (PO), the PCS purchaser will insert on the PO the following statement – By performing this purchase order, vendor agrees to be bound by the provisions of the DUA, found at this link: http://www.hhsc.state.tx.us/about_hhsc/BusOpp/data-use-agreement.pdf

Additionally, the PCS purchaser will scan the submitted SPI form from the awardee(s) and emails the form to the contract manager and the CISO at infosecurity@hhsc.state.tx.us.

Informal bids - telephone bids <$25K

04/23/15HHSC Procurement and Contracting Services 80

As appropriate, the CISO will determine what HHS agency the procurement was for, and assign the SPI to the agency ISO.

Purchaser ensures this transmittal email to the CISO and SPI form are filed in the procurement file.

Upon receiving the SPI form from the CISO, each HHS agency ISO will work with the vendor’s ISO to assess the risk and determine mitigation actions, as needed. If mitigation actions do not adequately mitigate the risks of information breaches, appropriate action will be taken.

Informal bids - telephone bids <$25K

04/23/15HHSC Procurement and Contracting Services 81

PCS DUA and SPI Process for Competitive Purchases

Small Purchases <5K

04/23/15HHSC Procurement and Contracting Services 82

Upon receipt of the requisition, the assigned PCS purchaser will send the "I'm your Purchaser” email and will ask the following questions to the contact name on the requisition: a) who is the contract manager, or staff person, that would know about the procurement’s confidential information? – and b) whether an awarded vendor(s) will have access to Confidential Information (CI)? - to determine if the DUA referenced language is needed in the solicitation document.

If yes, the DUA’s provisions will be in the IFB’s PCS Form 111 Terms and Conditions as a reference via a link to the DUA (the DUA will not require a signature). - (If DUA is negotiated, and legal approves, then the amended DUA doc is signed and put in the contract file and uploaded to HCATS.) - For client services, or client goods, the HHS agency’s UTCs will be utilized – not the Form III.

If no, a check box will be checked by the purchaser on the HHS agency’s UTCS, or on Form 111’s section of the DUA indicating the DUA provisions do not apply for the IFB.

Small Purchases <5K

04/23/15HHSC Procurement and Contracting Services 83

Purchaser includes appropriate language in the solicitation document, including the SPI form, if the DUA provisions apply to the solicitation. If a DUA is required for the solicitation, and the resultant bidder(s) must submit the SPI form, the Purchaser will insert in the SOW section, or special provision section of the solicitation, the following statement: “The respondents to this IFB must submit the SPI form with their bid.”

PCS sends out the <$5k bids, and the SPI form, to the identified bidders. The PCS purchaser and receives the submitted bids.

  PCS purchaser will pre-screen the submitted SPI form. If the SPI is not

submitted, or any answer on the form’s section B or C is ‘No’ – the bid(s) will be disqualified.

Small Purchases <5K

04/23/15HHSC Procurement and Contracting Services 84

Upon award and the execution of the contract, or Purchase Order (PO), the PCS purchaser will insert on the PO the following statement – By performing this purchase order, vendor agrees to be bound by the provisions of the DUA, found at this link - http://www.hhsc.state.tx.us/about_hhsc/BusOpp/data-use-agreement.pdf

  Purchaser will scan the submitted SPI form from the awardee(s) and

emails the form to the contract manager and the CISO at infosecurity@hhsc.state.tx.us.

As appropriate, the CISO will determine what HHS agency the procurement was for, and assign the SPI to the agency ISO.

Small Purchases <5K

04/23/15HHSC Procurement and Contracting Services 85

Purchaser ensures this transmittal email to the CISO and SPI form are filed in the procurement file.

Upon receiving the SPI form from the CISO, each HHS agency ISO will work with the vendor’s ISO to assess the risk and determine mitigation actions, as needed. If mitigation actions do not adequately mitigate the risks of information breaches, appropriate action will be taken.

Small Purchases <5K

04/23/15HHSC Procurement and Contracting Services 86

PCS DUA and SPI Process for Competitive Purchases

DIR

04/23/15HHSC Procurement and Contracting Services 87

IT Team will handle all procurements using the PCS DUA and SPI Process and the required purchasing method

(i. e. Informal Bid, Small Purchases <5K).

DIR

04/23/15HHSC Procurement and Contracting Services 88

PCS DUA and SPI Process for Competitive Purchases

Sole Source

04/23/15HHSC Procurement and Contracting Services 89

PCS Form 146 or "I'm your Purchaser” email will ask the following questions to the contact name on the requisition: a) who is the contract manager, or staff person, that would know about the procurement’s confidential information? – and b) whether an awarded vendor(s) will have access to Confidential Information (CI)? - to determine if the DUA referenced language is needed in the solicitation document.

If yes, the DUA’s provisions will be in the IFB’s PCS Form 111 Terms and Conditions as a reference via a link to the DUA (the DUA will not require a signature). If DUA is negotiated, and legal approves, then the amended DUA doc is signed and put in the contract file and uploaded to HCATS.) - For client services, or client goods, the HHS agency’s UTCs will be utilized – not the Form III.

If no, a check box will be checked by the purchaser on the HHS agency’s UTCs, or on PCS Form 111, Terms and Conditions DUA Section, indicating the DUA provisions do not apply for the IFB.

Sole Source

04/23/15HHSC Procurement and Contracting Services 90

Purchaser includes appropriate language in the IFB solicitation document and includes the SPI form, if the DUA provisions apply to the solicitation. If a DUA is required for the solicitation, and the resultant sole source bidder must submit the SPI form, the Purchaser will insert in the SOW section, or special provision section of the solicitation, the following statement: “The respondents to this IFB must submit the SPI form with their bid.”

If the sole source is over $25K, PCS advertises the solicitation and includes the SPI form – if <$25K, the purchaser will email the sole source bid to the vendor. The PCS purchaser receives the submitted source bids.

Sole Source

04/23/15HHSC Procurement and Contracting Services 91

The PCS purchaser will pre-screen the submitted SPI form. If the SPI is not submitted, or any answer on the form’s section B or C is ‘No’ – management will be notified to determine whether the award should proceed. If it does not proceed, the bid will be disqualified.

Upon award and the execution of the contract, or Purchase Order (PO), the PCS purchaser will insert on the PO the following statement "By performing this purchase order, vendor agrees to be bound by the provisions of the DUA, found at this link: http://www.hhsc.state.tx.us/about_hhsc/BusOpp/data-use-agreement.pdf"

Sole Source

04/23/15HHSC Procurement and Contracting Services 92

The PCS purchaser will scan the submitted SPI form from the awardee and email the form to the contract manager and the CISO at infosecurity@hhsc.state.tx.us.

As appropriate, the CISO will determine what HHS agency the procurement was for, and assign the SPI to the agency ISO.

Purchaser ensures this transmittal email to the CISO and SPI form are filed in the procurement file.

Sole Source

04/23/15HHSC Procurement and Contracting Services 93

Upon receiving the SPI form from the CISO, each HHS agency ISO will work with the vendor’s ISO to assess the risk and determine mitigation actions, as needed. If mitigation actions do not adequately mitigate the risks of information breaches, appropriate action will be taken.

Sole Source

04/23/15HHSC Procurement and Contracting Services 94

PCS DUA and SPI Process for Competitive Purchases

Emergency

04/23/15HHSC Procurement and Contracting Services 95

Upon receipt of the requisition, PCS will send "I'm your Purchaser” email and will ask the question of whether the identified emergency vendor(s) will have access to Confidential Information (CI) - to determine if the DUA referenced language is needed in the Purchase Order (PO). If yes, the DUA’s provisions will be in the PCS Form 111 Terms

and Conditions as a reference, via a link to the DUA (the DUA will not require a signature) – and will be attached to the emergency PO. If DUA is later negotiated, and legal approves, then the amended DUA doc is signed and put in the procurement file.

If no, a check box will be checked by the purchaser on PCS Form 111 section of the DUA indicating the DUA provisions do not apply for the emergency award.

Emergency

04/23/15HHSC Procurement and Contracting Services 96

Purchaser includes appropriate language in an emergency PO package, including the SPI form, if the DUA provisions apply to the solicitation. If a DUA is required for the emergency PO, and the resultant awardee(s) must submit the SPI form as soon as possible, the Purchaser will insert in the PO, the following statement: “The awardee of this emergency PO must submit the SPI form as soon as possible.” – and - "By performing this emergency purchase order, vendor agrees to be bound by the provisions of the DUA, found at this link - http://www.hhsc.state.tx.us/about_hhsc/BusOpp/data-use-agreement.pdf"

Emergency

04/23/15HHSC Procurement and Contracting Services 97

Once the SPI form is received, the PCS purchaser will screen the submitted SPI form. If any answer on the form’s section B or C is ‘No’ – the vendor will NOT be disqualified.

Purchaser will scan the submitted SPI form from the emergency vendor and emails the form to the contract manager and the CISO at infosecurity@hhsc.state.tx.us.

As appropriate, the CISO will determine what HHS agency the procurement was for, and assign the SPI to the agency ISO.

Emergency

04/23/15HHSC Procurement and Contracting Services 98

Purchaser ensures this transmittal email to the CISO and SPI form are filed in the procurement file.

Upon receiving the SPI form from the CISO, each HHS agency ISO will work with the vendor’s ISO to assess the risk and determine mitigation actions, as needed. If mitigation actions do not adequately mitigate the risks of information breaches, appropriate action will be taken.

Emergency

04/23/15HHSC Procurement and Contracting Services 99

Q&A

04/23/15HHSC Procurement and Contracting Services 100

PCS 146, Procurement Initiation/Approval to Advertise Form

DUA/SPI Process for New Procurements Flowchart, Effective April 6, 2015

PCS DUA and SPI Processes Attachment 2, HHS Enterprise Data Use Agreement

(DUA) Information Security and Privacy Initial Inquiry (SPI)

Handouts

04/23/15 101HHSC Procurement and Contracting Services

Recommended