On appeal from the Superior Court of New Jersey, Law Division, Mercer County, Docket No. L-0827-04.
The opinion of the court was delivered by: Cuff, P.J.A.D.
NOT FOR PUBLICATION WITHOUT THE APPROVAL OF THE APPELLATE DIVISION
Before Judges Cuff, Lintner and Gilroy.
Ernst & Young, L.L.P. (E&Y) was awarded a contract to provide services to two executive departments of the State of New Jersey regarding the obligations imposed on those departments by federal law to maintain privacy of personal medical records. When E&Y breached the agreement to provide services before it even commenced the contract, the State awarded the contract to another bidder at a significantly greater cost to the State. Although a judge entered summary judgment in favor of the State on liability, following a trial, the court declined to assess damages against E&Y because the State did not prove that it had mitigated its damages. We hold that the State is obliged to mitigate its damages and the State must make a reasonable effort to do so. Because the State did not demonstrate that it did so, we affirm.
As covered entities under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the New Jersey Department of Health and Senior Services (DHSS) and the Department of Human Services (DHS) are required to comply with the federal privacy regulations. In order to facilitate compliance with the regulations, DHSS and DHS decided to solicit proposals for professional advice and training regarding HIPAA.
A Request for Proposal (RFP) 03-X-34872 was issued on January 30, 2003. It states that its purpose "is to solicit proposals from qualified bidders to conduct a [HIPAA] privacy and security applicability analysis, gap analysis and risk assessment of existing [DHSS] and [DHS] policies, procedures and practices; to coordinate department-wide HIPAA evaluation activities"; to provide recommendations for implementation; and to assist "in the development of education and awareness training activities and materials."
The RFP includes both standard terms that appear in all State contracts and special terms that are unique to the HIPAA project. Included among the special terms are a description of the services required as related to the organizational structure of the departments, the scope of the work, and the time frame in which the project should be completed. The "contract effective date" listed on the first page of the RFP is April 1, 2003.
Several provisions of the RFP are relevant to the issues raised in this appeal. Section 2.2 of the standard terms is the State's general indemnification provision:
The contractor shall assume all risk of and responsibility for, and agrees to indemnify, defend, and save harmless the State of New Jersey and its employees from and against any and all claims, demands, suits, actions, recoveries, judgments and costs and expenses in connection therewith on account of the loss of life, property or injury or damage to the person, body or property of any person or persons whatsoever, which shall arise from or result directly or indirectly from the work and/or materials supplied under this contract. This indemnification obligation is not limited by, but is in addition to the insurance obligations contained in this agreement.
Among the special terms is section 1.4.4, which explains bidder responsibility:
The bidder assumes sole responsibility for the complete effort required in this RFP.
No special consideration shall be given after bids are opened because of a bidder's failure to be knowledgeable of all the requirements of this RFP. By submitting a proposal in response to this RFP, the bidder represents that it has satisfied itself, from its own investigation, of all of the requirements of this RFP.
Finally, there are two provisions that address timing aspects of the RFP. Section 4.4.4 states:
The bidder must submit all requested pricing information. Failure to submit all requested pricing information may result in the bidder's proposal being considered materially non-responsive. Each bidder must hold its price(s) firm for a minimum of ninety (90) days following bid opening to permit the completion of the evaluation of proposals received and the contract award process.
The term of the contract shall be for a period of one (1) year. The anticipated "Contract Effective Date" is provided on the cover sheet of this RFP. If delays in the bid process result in an adjustment of the anticipated Contract Effective Date, the bidder agrees to accept a contract for the full term of the contract. The contract may be extended for an additional two (2) periods of one (1) year or portion thereof, by mutual written consent of the contractor and the Director at the same terms and conditions. Prices shall be those quoted for the second year.
A mandatory pre-bid conference was held on February 21, 2003. At that time, a State representative told attendees that the "Contract Effective Date" of April 1, 2003, was only a target date and that it was subject to change. As a result of the conference, a written addendum to the RFP was issued on February 25, 2003. Neither the contract effective date nor any of the substantive provisions mentioned above were modified by the addendum.
Nine bid proposals were submitted in response to the RFP. An eight-member evaluation committee reviewed the proposals and scored each bid for cost and technical merit. Two bidders, CHC Healthcare Solutions and HIPAA Complete, were eliminated from consideration for submitting proposals that were deemed "materially non-responsive." Of the seven remaining bidders, the three lowest in cost were Covansys, E&Y, and BearingPoint.
Covansys submitted a bid of $644,480, and was ranked sixth in technical merit. The Committee's award report, signed May 22, 2003, stated that Covansys was not recommended for the contract award "because the bid proposal provides insufficient specificity to enable the Committee to have confidence that COVANSYS' methodologies and deliverables would be consistent with the procedures and end products the State envisioned in issuing the RFP." It further noted that the Covansys staff had, on the average, fewer than two years experience in HIPAA-related work and that the proposal offered no web-based training opportunities. The report nevertheless stated that "[t]he Committee's overall perception is that the bidder probably has technical competency appropriate to this RFP."
E&Y submitted a cost estimate of $650,000, and was ranked second in technical merit. The report praised E&Y for having superior public sector HIPAA assessment experience and for not proposing the use of any subcontractors. It commended several aspects of E&Y's approach as demonstrating flexibility, sensitivity to minimizing disruption in the workplace, and creativity in "training mode strategy alternatives." It also indicated the Committee's satisfaction with E&Y's proposed deliverables.
BearingPoint submitted a cost estimate of $1,209,000, and was ranked first in technical merit. The report noted that BearingPoint "has a strong Medicaid background, its training outline is good, and proposed deliverable databases are good." The report further stated, however, that
[t]he Committee views several aspects of the proposal negatively. The Committee does not intend this to be an all-inclusive list.
The bidder provides hourly rates that do not include expenses, and therefore the proposal is not fully loaded. The bidder is not registered under its new name as authorized to do business in New Jersey. The cost proposal indicates the assessment and gap analysis would not include any of the Departments' residential facilities. The cost proposal is prohibitive.
The Committee unanimously recommended awarding the contract to E&Y. Christine Weiland, a Team Leader Supervisor from the Division of Purchase and Property who acted as Committee chairperson, wrote a recommendation report noting that E&Y had the second lowest cost and the second highest technical rank of the responsive bidders. With regard to the Covansys proposal, Weiland stated that "[t]he Committee determined that [E&Y]'s second ranked technical score (6542.5) compared to COVANSYS' sixth ranked technical score (3987.5) outweighs the $5,520 cost difference. Therefore, the Committee determined that the bid proposal submitted by [E&Y] represents the best value to the State, price and other factors considered."
Weiland notified E&Y on May 22, 2003, that the State accepted its bid proposal. Louis H. Feuerstein, a partner at E&Y, telephoned Weiland several times in June and July, asking to negotiate certain contract terms. Finally, on July 11, 2003, Feuerstein wrote to Weiland stating that E&Y could not accept the contract award. He claimed that the lapses of time between the contract effective date of April 1, 2003, the HIPAA compliance date of April 14, 2003, and ...