10.3.3 S2377 Requirements Matrix .xlsx
XLSX spreadsheet 34 KB Posted
- Attached to
- Centralized Credentialing
- Solicitation number
- 40DHHS-S2377
- Issued by
- Churchill County, Nevada
About this file
This document is a Requirements Matrix for a Credentialing Verification Organization (CVO) contract opportunity for the State of Nevada Division of Health Care Financing and Policy (DHCFP). The CVO must have a valid NCQA certification at contract start and maintain it throughout the contract term. The CVO will be responsible for primary source verification of provider information, determining credentialing and re-credentialing activities, performing site visits, developing a credentialing committee, supporting an appeals process, and producing regular reporting. Security requirements include data encryption, secure coding practices, and incident reporting. The CVO will be required to comply with state and federal laws, including the 21st Century Cures Act, and assist Nevada in reengineering business processes to align with industry best practices. The CVO system must meet availability, accessibility, and data migration requirements, and the vendor must support CMS certification and provide evidence of compliance.
The contract will be awarded to a single vendor. Pricing terms, set asides, and funding details are not provided in the document. The contract duration is not specified, but the CVO certification must be maintained for the entire life of the contract.
View the file
Other files
Show all 25
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Functional Vendor Shall: -Present the platform requirements for efficient operation of the system -Review the requirements matrix carefully to ensure that the proposed system design addresses all of the requirements -Tie each data element/function to the vendor’s project plan by task number and -Respond to all of the requirements by properly coding and indicating how the requirement is satisfied. the proposed costs and project plan shall reflect the effort needed to satisfy the requirements.
| Req # | Functional Requirements Language | Minimum Mandatory Requirement (Y/N) | Included in Fixed Price Cost Proposal (Y/N)* | Vendor Response (Y/N)* | Vendor Response Narrative |
| 1 | Have a valid certification as a Credentialing Verification Organization (CVO) from the National Committee for Quality Assurance (NCQA) at contract start date. This certification must be maintained for the duration of the contract. The certification must reflect the most up-to-date standards for a CVO as published by NCQA for the entire duration of the contract within six (6) months of the release of a new or modified standard. The certification must not lapse at any time during the life of the contract. | Y | |||
| 2 | Primary Source Verification via real time interfaces with all required licensing boards and authorities, including those in other states. These primary sources shall include, but not necessarily be limited to, a comparison of submitted information to the following databases: | Y | |||
| 2a. | The Social Security Administration, specifically the Social Security Death Master File (DMF) to verify social security numbers and dates of death. | Y | |||
| 2b. | The National Practitioner Data Bank (NPDB) and National Plan & Provider Enumeration System (NPPES) to review potential adverse actions related to health care practitioners, | Y | |||
| 2c. | The List of Excluded Individuals/Entities (LEIE) and the Excluded Parties List System (EPLS) to determine the exclusion status for enrolling/re-validating providers and persons with an ownership or control interest or who is an agent or managing employee of the provider. This requirement also includes a monthly check on all active providers, the person(s) with an ownership or control interest in the provider, and the agent(s) or managing employee(s) of the provider. | Y | |||
| 2d. | Provider Enrollment and Chain/Ownership System (PECOS) | Y | |||
| 2e. | CMS Preclusion List | Y | |||
| 2f. | National Medicare Opt Out Affidavits | Y | |||
| 2g. | DHCFP NV Exclusion List | Y | |||
| 2h. | Any other database required by State or Federal regulation, including, where required, criminal background checks | Y | |||
| 2i. | The System for Award Management (SAM) | Y | |||
| 3 | III. | Determine required credentialing and re-credentialing activities to be conducted by Provider Type, risk level and the Nevada Division of Health Care Financing and Policy (DHCFP) directives. | Y | ||
| 4 | Verify provider application information by conducting the following activities based on Provider Type, as part of the credentialing process: | Y | |||
| 4a. | Confirm the identity of the provider to ensure they may be considered for credentialing in accordance with State and Federal regulations | Y | |||
| 4b. | Verify practitioner Drug Enforcement Agency (DEA) and/or Controlled Dangerous Substance (CDS) certification if applicable. Establish a process for re-verification of these certifications at time of expiration | Y | |||
| 4c. | Verify all active licenses as applicable | Y | |||
| 4d. | Verify practitioner education and training | Y | |||
| 4e. | Collect work history | Y | |||
| 4f. | Verify practitioner malpractice insurance coverage | Y | |||
| 4g. | Verify hospital privileges | Y | |||
| 4h. | Verify National Provider Identification (NPI) | Y | |||
| 4i. | Verify Attestation Dates | Y | |||
| 4j. | Verify American Board of Medical Specialties (ABMS) | Y | |||
| 4k. | Verify Clinical Laboratory Improvement Amendments (CLIA) Certificate or Waiver | Y | |||
| 4l. | Verify practitioner medical board sanctions | Y | |||
| 4m. | Verify practitioner Medicare/Medicaid sanctions | Y | |||
| 4n. | Conduct review of fraud and abuse sanctions against the provider | Y | |||
| 5 | Perform site-visits of certain providers as required by NCQA requirements, State and Federal regulations, and as needed in response to recipient complaints or quality of care concerns. | Y | |||
| 6 | Periodically review and update credentialing and re-credentialing processes in accordance with NCQA recommended requirements. | Y | |||
| 7 | Perform continuous monitoring and verification of licenses, DEA certificate, board certifications, malpractice insurance, and convictions/sanctions as required by ACA. | Y | |||
| 8 | Develop a process to systematically retrieve the provider file from Nevada DHCFP, circulate credentialing documentation and communicate credentialing decisions to the provider, Nevada DHCFP and contracted MCEs securely. All data exchanges will be time-stamped, and an audit trail created for tracking purposes | Y | |||
| 9 | Work with Nevada DHCFP contracted MCEs to align credentialing dates with the goal that each provider has a single credentialing date. | Y | |||
| 10 | Develop, support, and facilitate a Credentialing Committee, consistent with NCQA requirements, to make credentialing decisions. The Credentialing Committee will meet at least monthly, but possibly more frequently depending on final requirements that are gathered and volume of providers. Support activities include, but are not limited to: | Y | |||
| 10a. | Maintaining policies and procedures for the committee. | ||||
| 10b. | Scheduling Credentialing Committee meetings | ||||
| 10c. | Developing agendas and distributing meeting materials in advance | ||||
| 10d. | Flagging specific provider records or files for review | ||||
| 11 | Support and assist in the development of an appeals process to afford providers any appeal rights to which they are entitled to if their application is denied. | Y | |||
| 12 | Maintain a tracking/monitoring system of all credentialing and re-credentialing activities. This status information will be accessible by the provider, the Contractor, the State, and the MCEs. The status information will include at a minimum: | Y | |||
| 12a | Status updates and results of credentialing and re-credentialing activities, including denial reasons | ||||
| 12b | Credentialing decisions | ||||
| 12c | Status and results of database checks | ||||
| 12d | Licensure and certification communications sent, communications received and documented result | ||||
| 12e | Status nd results of data matches with Social Security Administration, Nationa Practicioners Databank; National Plan and Provder Eumeration system; List of Excluded individuals/Entities; Exluded Parties List System; and other required data sources | ||||
| 12f | Status of appeals | ||||
| 12g | Ability for identified stakeholders to download complete credentialing packet/file | ||||
| 13 | Monitor, collect, and evaluate provider complaints. Develop, document, and implement an issue resolution process | Y | |||
| 14 | Produce regular electronic reports (weekly, monthly, quarterly) and ad-hoc reports upon request. The format, content and retention of reports shall be agreed upon during the report development process, however at a minimum, the following shall be reported on: | Y | |||
| 14a | Call Center statistics | Y | |||
| 14b | Provider Complaints | Y | |||
| 14c | Credentialing/Re-credentialing status, including ageing | Y | |||
| 14d | Credentialing activities completed and their timeliness and accuracy, including a comparison to previous time periods | Y | |||
| 14e | Provider Satisfaction | Y | |||
| 14f | System Adequacy | Y | |||
| 14g | Implementation status | Y | |||
| 15 | All records and data held by the Vendor as it relates to the contract will be retained and maintained as required by Nevada law, federal law, State and Department/Division record retention requirements and policies. | Y | |||
| 16 | Provide a Customer Support Call Center to assist providers in the credentialing and re-credentialing process. The Customer Support Call Center will also be utilized by stakeholders for process or technical assistance. | Y | |||
| 16a | Vendor must develop and submit for DHCFP review a development and training plan for Customer Support Call Center employees to ensure they remain current with the latest policies and procedures. | Y | |||
| 17 | Develop and implement an escalation process for communication between DHCFP and CVO, to ensure select applications can be prioritized for review and disposition as instructed. | Y | |||
| 18 | Provide stakeholder and provider training and education as mutually agreed to by the State and Vendor. | Y | |||
| 19 | Participate in collaborative meetings and annual Provider Workshops as requested by Nevada DHCFP. | Y | |||
| 20 | Maintain relevant manuals, modules, and other publications as they pertain to credentialing and re-credentialing. | Y |
Security
| Req # | Security Requirements Language | Minimum Mandatory Requirement (Y/N) | Included in Fixed Priced Cost Proposal (Y/N)* | Vendor Response (Y/N)* | Vendor Response Narrative |
| 1 | The CVO system shall meet federal and state security and privacy standards as outlined in 45 CFR Par 160, Part 164 Subparts A, C and E (HIPAA Security Rule and HIPAA Privacy Rule) and NRS 603A. Protection of Sensitive information shall include the following: | Y | |||
| 2 | Confidential or Sensitive data, in transit or at rest, shall be encrypted. | Y | |||
| 3 | Any electronic transmission of personal information shall comply with NRS 205.4742 and NRS 603A.215 (2 & 3). | Y | |||
| 4 | Evidence that government software development and maintenance organizations and contractors are conforming, in computer software coding, to available secure coding standards during software development, upgrade and maintenance activities. | Y | |||
| 5 | Sensitive information in existing legacy applications shall encrypt data as is practical. | Y | |||
| 6 | Compliance with records confidentiality according to NRS 422.290, Custody, Use, Preservation, and Confidentiality of Records, Files and Communications Concerning Applicants for and Recipients of Public Assistance or Assistance Pursuant to Children’s Health Insurance Program. | Y | |||
| 7 | All information technology services and systems developed or acquired by agencies shall have documented security specifications that include an analysis of security risks and recommended controls (including access control systems and contingency plans). | Y | |||
| 8 | Security requirements shall be developed at the same time system planners define the requirements of the system. Requirements shall permit updating security requirements as new threats/vulnerabilities are identified and/or new technologies implemented. | Y | |||
| 9 | Security requirements and evaluation/test procedures shall be included in all solicitation documents and/or acquisition specifications. | Y | |||
| 10 | Systems developed by either internal State or contracted system developers shall not include back doors, or other code that would cause or allow unauthorized access or manipulation of code or data. | Y | |||
| 11 | Security specifications shall be developed by the system developer for approval by the agency owning the system at appropriate points of the system development or acquisition cycle. | Y | |||
| 12 | All system development projects shall include a documented change control and approval process and shall address the security implications of all changes recommended and approved to a particular service or system. The responsible agency shall authorize all changes. | Y | |||
| 13 | Application systems and information that become obsolete and no longer used shall be disposed of by appropriate procedures. The application and associated information shall be preserved, discarded, or destroyed in accordance with Electronic Record and Record Management requirements defined in NRS and NAC 239, Records Management. | Y | |||
| 14 | Separate development, test and production environments shall be established on State systems. | Y | |||
| 15 | Processes shall be documented and implemented to control the transfer of software from a development environment to a production environment. New hardware/software is not introduced into a production environment until it is fully tested and accepted by the State. | Y | |||
| 16 | Development of software and tools shall be maintained on computer systems isolated from a production environment. | Y | |||
| 17 | Access to compilers, editors and other system utilities shall be removed from production systems. | Y | |||
| 18 | Controls shall be established to issue short-term access to development staff to correct problems with production systems allowing only necessary access. | Y | |||
| 19 | Security requirements and controls shall be identified, incorporated in and verified throughout the planning, development, and testing phases of all software development projects. Security staff shall be included in all phases of the System Development Lifecycle (SDLC) from the requirement definitions phase through implementation phase. | Y | |||
| 20 | The vendor shall report to the DHCFP within 1 (one) business day of discovery, any security incident of which the Vendor is aware. | Y |
System Technical_Services
| Req # | System Technical/Services Requirements Language | Area | Minimum Mandatory Requirement (Y/N) | Included in Fixed Price Cost Proposal (Y/N)* | Vendor Response (Y/N)* | Vendor Response Narrative |
| 1 | The vendor shall ensure that all activities are in alignment with State and Federal laws, rules, and policies, e.g. 21st Century Cures Act, NCQA and Nevada Open Meeting Law, and adjust to changes as necessary. | General | Y | |||
| 2 | Vendor must stay informed of national changes in the credentialing industry | General | ||||
| 3 | All documentation must be ADA compliant in line with State and Federal laws, as determined by the State, including but not limited to accessible to screen readers, optical character recognition (OCR), and image descriptions. | General | Y | |||
| 4 | Vendor shall follow the written deliverable review process outlined in the RFP. The State has the final decision on deliverable quality and review and approval timelines. | General | Y | |||
| 5 | Vendor shall perform according to approved project plans. | General | Y | |||
| 6 | Vendor shall follow the written deliverable review process outlined in the RFP. The State has the final decision on deliverable quality and review and approval timelines. | General | Y | |||
| 7 | All data remain the property of the State and will be provided upon request with no administrative barriers to provision. | General | Y | |||
| 8 | The vendor shall not enter into any third party agreements that restrict data sharing with the State. | General | Y | |||
| 9 | Nevada’s goal is to continuously reengineer business processes to align them to industry best practices. The Vendor is required to strive to reengineer business processes as well as enable and, as requested by the State, assist Nevada in reengineering State operated business processes utilizing the technology and tools available. The State expectations is that the Vendor has the necessary knowledge and experience in implementing and operating systems and services that fully meet the goals and objectives of the MITA business process model. The State expects that the Vendor will know and articulate explicitly how best to implement its processes to support this objective. | Services and System | Y | |||
| 10 | Changes and upgrades may require total outages and will be performed during off hours (not during production hours) and during agreed upon maintenance windows. | System | Y | |||
| 11 | Notification shall be communicated within one (1) hour to all CVO solution users when unscheduled system downtime occurs. | System | Y | |||
| 12 | Scheduled CVO Solution downtime notification reminders shall be communicated to all CVO Solution users forty-eight (48) hours prior to the scheduled downtime. | System | Y | |||
| 13 | The system will maintain availability of 98% | System | Y | |||
| 14 | System errors will result in an error code that will be communicated to the user. This code will be well documented in the help desk system to expedite support and incident resolution | System | Y | |||
| 15 | Access to the database will result in logs including a high priority alert tat is triggered for sensitive operations such as a database dump. | System | Y | |||
| 16 | Data Migration: Historical data will be accuratley migrated to the new system | System | ||||
| 17 | Data Quality: The Data migration will be confirmed | System | ||||
| 18 | Vendor shall ensure the system complies with all CMS Certification Requirements and provide evidence of compliance as requested by DHCFP. Certification will take place under the certification process identified by CMS at the time of the associated milestone review or implementation and may require ongoing reporting of performance indicators and proof of adherence to security standards. | Certification | Y | |||
| 19 | Appropriate vendor staff must be available to provide evidence of system functionality, reporting of key performance indicators, and adherence to security standards for each certification review, as required by CMS. Appropriate vendor staff must also be available to provide ongoing reporting of key performance indicators and adherence to security standards throughout the system maintenance and operations phase. | Certification | Y | |||
| 20 | Vendor shall submit a Business Continuity/Backup and Recovery Plan for approval within thirty (30) calendar days of contract signing, and update plan at least annually thereafter. | Services and System | Y |
File details come from the government source that posted it. Updated .