Erie County Department of Health, Juvenile Justice Services Case Management Platform (RFP #2026-052VF)

Recommendation: do not bid, unless Erie answers one question in our favour by tomorrow afternoon. The full RFP is now in hand and it resolves the check against us.

What the buyer is buying, in their own words

Erie County wants "a customizable case management platform for outcome tracking with justice involved juveniles to facilitate compliant data management and detailed case reporting". The platform supports the Juvenile Substance Use Services Coordination Program "through its pilot period and into its implementation phase".

The users are staff working with "at risk and justice involved youth with behavioral health needs including substance use disorder". The platform must also reach outward. Qualified respondents' software "should include means to contact clients, treatment providers, Probation Officers, Judges, and other outside providers".

Funding is small and stated plainly. The RFP "will fund one award for up to $17,000 in the first year to include the cost of software development and training", then "a maximum of $8,000 per year" for years two and three.

The answer to the check

The check asked whether identity-provider SSO and diversion workflows are mandatory or scored. They split, and the split is what decides the item.

preference.** Section VI.2.1, headed "Exclusive Authentication Source", says all County users "shall authenticate exclusively through the County's IdP using approved federation standards (SAML, OAuth2, or OpenID Connect)". Section VI.2.2 then prohibits the model Carepatron actually uses: "Vendor shall not create local usernames, local passwords, or proprietary identity systems for County user access."

Section VI.12 sets the consequence. "Non-compliance with any requirement in this Exhibit constitutes a material breach of the Agreement."

Carepatron cannot meet this. The library is unambiguous: Carepatron does not support SAML or OIDC enterprise single sign-on, and there is no SCIM provisioning (sso-no-saml-scim). Sign-in today is email and password with MFA, or Google and Apple SSO (sso-supported-login-methods). Accounts are created by invitation and managed in the workspace, which is the "proprietary identity system" the RFP bans.

response, which asks for "referral management, diversion management, family engagement and interaction, built in screening and assessment tools, document management, electronic signature capture". Programmatic carries the heaviest weight in the evaluation at 30 per cent. So diversion is not a gate, but it is the single largest block of marks, and Carepatron does not ship diversion management or intercept-based outcome tracking.

The score, and why

46 out of 100. That is up against a hard requirement we fail, and down against a buyer and a submission process that otherwise suit us well.

Three further requirements are stated and we do not meet them. Each traces to the library:

• Respondents "will include information on the respondent's frequency of software updates and a report of the percentage of down time over the last 2 years". Carepatron does not publish an uptime percentage or an uptime commitment (known-gap-no-published-uptime).
• The Technical response must cover "disaster recovery and management". Carepatron does not publish recovery time or recovery point objectives, or a disaster recovery test cadence (known-gap-no-rto-rpo).
• The US-only clause is absolute: "No County data may be transferred, accessed, stored, or backed up outside of the United States at any time", and the vendor must certify it. Carepatron hosts on AWS with infrastructure in the US, Australia and Europe, and cannot commit to a customer-selectable data region (known-gap-no-data-residency-choice). We could not sign that certification as written.

One requirement we would score well on, for the record. The RFP asks for "a list of included validated behavioral health screening tools included in the platform for youth and adolescents under the age of 25". Carepatron's template library includes GAD-7, PHQ-9, PCL-5, DASS-21, AUDIT, EPDS, ASRS-v1.1, the ACE questionnaire and ADHD screeners, with real-time scoring (clinical-template-library-assessments). Whether that set satisfies the under-25 framing would need confirmation with Glen.

Your one next action

Email health@erie.gov before 4:00 p.m. on Tuesday 22 September and ask one question:

Section VI.2 requires all County users to authenticate exclusively through the County's identity provider using SAML, OAuth2 or OpenID Connect, and prohibits vendor-managed local accounts. Will the County consider a proposal from a vendor whose platform authenticates users with email and password plus multi-factor authentication, or is IdP federation a threshold requirement for award?

The County posts answers on 24 September. If the answer is that federation is a threshold requirement, this is a clean no bid and needs nothing further from you. If Erie signals flexibility, the item is worth a second look, though the diversion and outcome-tracking gaps in the 30 per cent Programmatic block would still be working against us.

I have not sent this. The question is yours to send.

Source

The full RFP PDF was read from the mirror linked on the Bidscope listing. The solicitation is also listed on BidNet Direct as bidnet_direct:444166682920, whose detail page is subscription-locked; the mirror made that route unnecessary.