Clarification to Bidders Batch no.: 4 RFP No. 38/S/HAAD/PT/ Patient ID Authentication Clarification issue date : 01-February- 2015

Transcription

1 Q. Sr. Questions & Answers 1. Q. Does HAAD currently have ESB, Application Server and they prefer to use them or the vendor must propose and provide new software/hardware A: We have the ESB in our organization however as a part of this project we need a separate ESB to have less reliability. 2. Q: What is the database which currently installed in HAAD and can the vendor use it? A: Vendor should use new database for this solution and vendor should size storage properly for at least 5 years and it should be scalable for long term. 3. Q: Does HAAD have stress testing tools or the vendor should propose and provide the new tools? A: Vendor should provide testing and stress tools 4. Q: Are you expecting the APIs to be a programming language APIs (i.e. Java,.Net etc ) or independent platform Proxy such as WebServices or rest services? A: Web Services or RESTful services 5. Q. Does the health application already exist or a new simple application which shows how applications communicate with the proxy. If its current application who will do the changes on the application? A: The objective of the sample end-user application is to help the Healthcare Entities to integrate their systems with HAAD standard proxy API. It should provide a working example of the use of all functionality available within the HAAD Standard proxy API with documented source code. The application needs to demonstrate the connectivity and data access functionalities only. 6. Q. "The vendor should build the web screen in a current interface like portal or web site or the vendor should provide a stand alone web interface? A: We are expecting the vendor to provide the Web service (for mature healthcare entities) as well as the web client application (for small healthcare entities). 7. Q: reading from card will be developed by the end user application or its part of the project scope? A: The standard component/ API should be able to read the information from EIDA Card using EIDA APIs. 8. Q: "What is the scope of the following: 1- HAAD hosted End User Application available via Internet 2- HAAD hosted 'Status' notification and inquiry service" A: Scope already defined in the BRD for further details HAAD team will discuss with the selected bidder. 9. Q: Is the implementation required to be onsite or HAAD can provide remote access for offshore development? A: "1. On site and remote support require as per RFP, however we expect the vendor to provide the service using onshore model within UAE. 2. No off shore development ( major security concern )" 10. Q. Is the support required to be onsite or it can it be offshore? A: We expect the vendor to provide the service using onshore model within UAE. 1 / 5

2 11. Q. Does HAAD have a reporting engine which we should build the reports in or the vendor shall propose and provide their recommended reporting engine as a part of the solution? A: Vendor should propose the reporting tool. 12. Q: What are the availability requirements for this solution, is HAAD looking for an "Active- Active" deployment? A: Please note that the solution should be highly available in all aspects, scalable and properly sized for next 4-5 years. Moreover, whole solution design meet DR and BC with minimum RPO & RTO 13. Q: Does HAAD allow deployment of Virtual Machines in the DMZ Zone, i.e., is Virtualiztion accepted in the DMZ Zone as per HAAD Security policies? A: Virtualization is not discouraged, however, we desire to have physical deployments. If vendor solution is based on virtualization approach, vendor cannot adopt complete virtualization, and shall have physical isolation on each environment. 14. Q: How many environments is needed outside of Production (i.e. Dev, UAT etc) A: Refer to article 6C.k 15. Q: How will all the end user (payer and provider) of the system be registered to use the system? A: We would like vendor to recommend the solution for this requirement. 16. Q: What is Shafafiya? A: refer to Q: Do you have specific Back up requirement proposed in the solution? A: InfoSec response: Vendor shall identify specifics of back-up needs, that will complement Recovery Point Objective and other identified operational needs of the project. Operation Section response: It should be as per HAAD backup policies. - Daily Backup : Incremental & differential - Weekly / Monthly / Yearly Full 18. Q: Do you have any requirement on retention period and archival of data on tape? A: InfoSec response: At least 7 years, recommend legal advice 19. Q. Do you need back up for staging environment? A: Yes 20. Q: Back up support o Oracle DB (RAC) -database level back up o Oracle Service Bus (OSB) -NLB o OHS -file level up o WLSHost -file level back up A: Vendor need to provide backup support in all layers (web,app,db,file) in the solution/ project. 21. Q: Do you need AV services at host level? Injazat strongly recommends AV services? A: Vendor can use HAAD antivirus servers, however, vendor needs to propose new licenses for Symantec for all new servers. Q: We understand share storage is requirement for Oracle RAC. Please confirm 2 / 5

3 22. However please confirm do you need SAN storage for following services in production as well as in Staging o OSB o WLS o OHS and monitoring solution We don't recommend SAN storage unless there is some application/database level clustering required or application demands it. Please advice A: All layers (web,app,db, file ) of the solution/ project should be high available. 23. Q. What are RPO, RTO requirement for DR services? A: It should be as minimum as possible. Vendors proposing lowest RPO and RTO will be given preference. 24 Q. Does HAAD required dedicated security and network equipment for this application Assuming that the HAAD provides the dedicated internet links A: InfoSec response: shared model for security services is fine, with complete visibility and access to alerts and logs, relevant to the project scope. Yes, Vendor will use HAAD Internet Links. 25. Q: How much will be the calculated bandwidth required for the internet. A: Vendor has to provide estimates. 26. Q: If the WAN (ADNET) link goes down, does the application required to be authenticated with EIDA (VG Service) through internet. A: Please refer to the Business Requirements Document, section 5.2. Authentication Process Diagram 27 Q: Verifying the validity of the card and the fingerprint data requires reading of biometric data from the Emirates Id and then compare the same with the individual carrying the card. This requires connectivity with EIDA s validation gateway. A: InfoSec response: there shall be redundant provision, complementing all business continuity challenges/criteria s identified. HAAD is dependent on ADNET for Internet connectivity, Info Sec team to confirm if HAAD is allowed to use Internet connectivity for any application without ADNET 28. Q. Does HAAD required a dedicated NTP server or used the existing HAAD NTP server A: Vendor can use HAAD NTP server. 29 Q. It is assumed that the support services for 3 years will commence post implementation completion (3-4Months from project start) and this will be in parallel to the roll out period. Please confirm? A: Support should start after post implementation & official Go Live 30. Q: It is assumed that vendor is expected to manage the DR solution and infrastructure, please confirm? A: Vendor will be responsible for the supply, installation, configuration, testing, maintenance, warranty and support for whole solution in primary and DR sites. Vendor also needs to propose quote for required rack and will be responsible for required cabling work (if any) for the whole solution. Vendor must mention required rack space for whole solution. Vendor will be able to use HAAD active network and security infrastructure. 3 / 5

4 31. Q. In case the assumption is in correct and support needs to commence after the rollout Completion (9-10 Months from project start) please clarify and who will support the infrastructure & entities Gone Live during Pilot phase in this period. A: Vendor will support whole solution as contract period with clear SLA defined 32. Q. What is the support required from Vendor in the rollout phase,the scope needs to be clearly defined as this needs to be captured as part of the effort from vendor and will vary with the expectation from HAAD? A: Vendor should comply all RFP requirements 33 Q: Please confirm the number of entities and Biometric devices to be rolled out during the pilot phase. A: Vendor should comply all RFP requirements 34 Q: As per the clarification vendor is expected to quote for Rack space is the understanding correct or it s for aphysical rack? A: Vendor has to propose required racks/rack rental/ network port charges depending upon data center policy of primary and DR sites. Vendor will also be responsible for physical connectivity of proposed solution to existing HAAD infrastructure in primary and DR sites. 35. Q. As per the RFP vendor is expected to procure and deliver 200 card readers to HAAD, is there any other expectation from vendor, like to setup or configure these Card readers? A: Vendor should comply all RFP requirements and prepare price list in case for any new requirements 36. Q:Attach BRD v1.9 signed version as PDF Appendix A please provide us soft copy of it? A:Please note the Appendix is available as signed copy only to be collected by the bidders who purchased the RfP 37. Q:Kindly provide the estimated value of the project and the number of applications to be considered for integration A:It is not allowed to reveal the estimated value of the project as for the number of application please refer to the RfP and issued clarification. 38. Q: Our will be travelling from outside of UAE so please provide details of documents required? Please advise concerning the copies of the below documents requested as per the RfP for the employees assigned for this project as mandated by Executive Council: 1. Health insurance cards 2. Valid passports & residency 3. Proof of applying the wages protection system as per the Ministry of Labour, A: Please note the company should be based in UAE and the documents requested for the employees of the company working in UAE. 39. Q: Business references for at least three (3) projects of similar nature executed in the UAE/GCC that shows that the bidder has a satisfactory performance record. Can we provide references for PKI projects done globally too A: It is a requirement that vendor should have experience in UAE/GCC as per RFP requirements. 4 / 5

5 36 Q. Kindly share the BRD document soft copy so we can extract the compliance matrix. A: the BRD is available only in PDF format. End of Clarification no. 04 ***************************************************** 5 / 5