121962 O3 F.H. Cann & Associates inc. Attachment 1.xlsx
XLSX spreadsheet 73 KB Posted
- Solicitation number
- 121962 O3
- Issued by
- Douglas County, Nebraska
About this file
This document is a technical response file from F.H. Cann & Associates, Inc. for a Nebraska Department of Labor (NDOL) Request for Proposal (RFP) for Unemployment Insurance call center support services. The contract involves providing comprehensive call center services to handle approximately 71,000 annual calls, including 5,000 non-English speaking inquiries, with services to be delivered from a secure, dedicated U.S. office operating Monday through Friday from 8:00 AM to 5:00 PM CST. The initial contract term is one year, with options to renew for four additional one-year periods, and the anticipated contract award date is September 10, 2025. Key performance requirements include maintaining an Average Speed to Answer of 3 minutes, Average Handle Time of 10 minutes, and a Customer Satisfaction Score of 85% or higher, with the vendor required to provide a Customer Relationship Management (CRM) system, handle callbacks, and integrate with NDOL's existing systems.
The proposal emphasizes multilingual support, with at least 10% of agents fluent in English and Spanish, and requires a comprehensive approach to workforce management, training, and quality assurance. While specific budget ranges are not explicitly stated, the RFP allows bidders to itemize expenses across various deliverable categories. The vendor must maintain secure workspaces, create and store call recordings, and provide real-time dashboards with comprehensive reporting capabilities. No specific set-aside designations or incumbent vendor were identified in the document. The solicitation focuses on selecting a vendor capable of providing a turnkey solution that includes trained staff, dedicated workspace, telephony equipment, and the ability to dynamically adjust staffing and resources to meet fluctuating demand and performance standards.
View the file
Other files
Show all 44
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instructions
| Instructions |
| Bidder must complete the following tabs. |
| The Minimal Requirements tab consists of yes/no questions. Bidder shall reply Yes or No in column C confirming if the bidder is able to meet requirements. Column A references the origin of the requirement in Section V. of the RFP. |
| The Required Response tab has a field with questions and spaces provided for bidder responses. Please be sure to address mandatory requirements referenced next to the questions in response. |
Minimal Requirements
| Bidder will indicate yes or no that bidder is able to meet Mandatory Minimum Requirements. | ||||
| RFP Section V Project Description and Scope of work | Mandatory Requirement | Bidder Respond: Yes or No | ||
| A. PROJECT OVERVIEW | ||||
| Additionally, the day following State holidays sees a significant increase in calls, which the vendor shall be prepared to manage effectively. | Yes | |||
| Callbacks shall be scheduled and tracked accurately, ensuring all necessary claimant information is captured and reported. | Yes | |||
| Given the high volume and fluctuating demand, the vendor shall operate an onshore call center from a secure, dedicated office within the United States. | Yes | |||
| The vendor shall ensure sufficient levels and resource allocation to maintain service levels during peak times and manage increased call volumes after State holidays. | Yes | |||
| B. | BUSINESS REQUIREMENTS: General Operational Requirements | |||
| 1.a. | 1. | Contractor Location and Eligibility | ||
| a. | The Contractor shall be based and operate within the United States. | |||
| Yes | ||||
| 3.a vi | vi. | Contractor shall provide an (800) number for routing of calls. Contractor shall also be able to work with an existing (800) number. | ||
| Yes | ||||
| 3.a vii | vii. | Contractor shall ensure all agents are supplied with telephony software, telephony equipment, computer equipment and software, including customer relationship software and all network infrastructure to provide the service. | Yes | |
| 4.a 4.b | 4. | Service Hours | ||
| a. | Contractor shall provide inbound call services for NDOL UI claimants from 8:00 AM to 5:00 PM CST, Monday through Friday, excluding State holidays as defined by state law. | |||
| b. | Any adjustments to service days or hours shall be mutually agreed upon in writing. | Yes | ||
| B. | BUSINESS REQUIREMENTS: Call Center Service Requirements | |||
| 1.b | b. | Contractor will integrate their system with NDOL’s phone system. | ||
| Yes | ||||
| 1.c | c. | Contractor shall develop call scripts. All scripts shall be approved by the State before being used by the contractor. | Yes | |
| 2.a | 2. | Data Entry Services | ||
| a. | Contractor shall input the name, address, claim number, phone number, mother’s maiden name, at a minimum into the contractors CRM as well as the NEworks | Yes | ||
| 5.a ii, iii | ii. | Contractor shall assign a dedicated contact who will serve as the primary point of contact for all program-related matters. This contact should have experience in managing call center operations, preferably in the government or public sector. | ||
| iii. | Contractor shall have a direct supervisor and quality assurance analyst onsite during service hours. | Yes | ||
| C. | SCOPE OF WORK | |||
| 3.A.x | x. | Contractor shall develop and implement an after-call survey. The survey shall be approved by the state before first utilization. Survey results will be provided to NDOL. | Yes | |
| 3.B.i | i. | Contractor shall provide and utilize a CRM system to document claimant information. | Yes | |
| 3.C. iii | iii. Callback details shall include the caller’s name, phone number, last four (4) of their social security number, the reason for the call (disposition), a summary of the issue, and, if applicable, the scheduled callback time. | Yes | ||
| 3.C. v. | v. | Callback resolution shall be tracked to ensure that NDOL Staff follows up promptly and effectively addresses customer inquiries | Yes | |
| 3. F.iii. | Established performance standards for call center services that shall be maintained throughout the term of the contract to provide acceptable customer service and satisfy the scope of work under the contract. | Yes | ||
| 3. G iii. | iii. | Contractor shall be available to meet in person with NDOL representatives on an as-needed basis for such situations as periodic updates and changes in unemployment insurance laws, rules, and claim processes. | Yes | |
| 3. H. i | Agency shall be entitled to “on site” as well as “on-line” monitoring of call center specialists and call center operations. | Yes | ||
| 3. H. ii | Contractor shall allow NDOL representatives to visit and observe the call center operation as needed. | Yes |
Required Responses
| RFP Section V Project Description and Scope of work | Mandatory Requirement | See also | Question | Bidder response | ||
| B. | BUSINESS REQUIREMENTS: General Operational Requirements | |||||
| 1.b. | b. | Contractor shall ensure that agents have a secure and dedicated workspace that prevents unauthorized access to claimant data. | Describe your site security and how you will maintain security. Both physical and technological security. Describe your experience handling Personal Protected Information (PPI) and sensitive information. Describe how you will ensure that any data resulting from services provided is properly secured according to the requirements in this RFP and is not used, accessed, or disseminated by any manor for any reason not authorized by NDOL. | IT/IS Team | ||
| 2.a | 2. | Legal Compliance | ||||
| a. | Contractor shall operate in full compliance with all applicable federal and state laws and regulations throughout the contract term. | IT/IS Team |
Our robust Information Technology and Information Security Teams consist of 23 full-time employees who support FHC’s Engineering, Development, Desktop Support, and Information Security activities. Our Chief Information Officer, Don Dittemore, leads this team, overseeing information security and security risks as well as monitoring compliance with all security policies and procedures to ensure the safety of all client and FHC data. Reporting to Don is Key Personnel Jeff Murphy, who leads the management and resolution of all technical elements that are utilized for the contact center services for NDOL. He collaborates with you and Account Manager Sara Alosa and to provide NDOL with necessary reporting on any FHC Performance Standards. Over the life of the contract, the IT and Information Security Team implement and maintain compliance following FHC and NDOL technology and security requirements.
Ongoing key qualifications and responsibilities include of this team include:
| ■ | Updating and implementing an organization-wide security program, overseeing the Secure System Lifecycle |
| ■ | Ensuring secure implementation and testing, including secure data transfers used for reporting mapping of files and data layouts |
| ■ | Monitoring and tracking all PII, PHI, PCI, and data provided by NDOL |
| ■ | Overseeing performance of IT Security Risk Assessments including SOC, NIST, and other external auditors |
| ■ | Performing vulnerability scanning, continuous monitoring, and penetration testing of the FHC Environment |
| ■ | Updating security awareness training through our HRIS for all employees, providing updates to NDOL’s specific security training only to CSRs working in the call center environment |
| ■ | Maintaining testing environments prior to use and rolling out to production |
| ■ | Managing change control processes, reviewing, approving, or disapproving changes |
| ■ | Updating and maintaining the inventory of system assets |
| ■ | Maintaining and testing FHC’s Business Contingency Plan and Disaster Recovery Plan |
Additional key capabilities of our IT Team include the ability to interface and integrate with client systems, troubleshooting user issues via our helpdesk, identifying and communicating any system connectivity issues, where the root cause originates, ability to learn and train on new software solutions, and most importantly, the ability to make recommendations to constantly improve the future state of the contact center so that customers continue to experience best-in-class customer service driven by innovative technology solutions.
Physical / Site Security
FHC has physical access controls to prevent unauthorized access to our onsite facilities. Functional areas within the company are separated by locked doors and require electronic photo ID badges by authorized employees to open them. All FHC employees must log off the system when leaving their workstation; workstations automatically go into lockdown mode after 15 minutes of inactivity. Employees are prohibited from using cellular phones in the office. The business complex our offices are located in are monitored with video surveillance and protected 24 hours a day by a private security firm.
The main access point to our offices have a private security camera and are locked at all times; entry is permitted only after visitors have identified themselves and an FHC staff member has released the lock. Our offices have video monitoring of all entry points to the office areas as well as motion-activated and real-time alerting of access to the server room.
Badging Human Resources personnel develop, approve, and maintain a list of individuals with authorized access to the FHC facilities. Facilities personnel issue authorized credentials for facility access for users as instructed by Human Resources. Employees have a photo on their badge to aid in confirmation by other employees. No employee can access our offices without unlocking the premises using their badge. Any new unused badge is stored in the Facilities area in a locked overhead bin. Photo ID badges are inactive until assigned to an individual's security authorization profile in the security system. Information Technology (IT) Risk Management performs a quarterly review of badge activation and deactivation reconciliation against employee statuses.
Visitor Access The FHC Primary Visitor control log is maintained at the main entrance of each facility. Government issued photo ID is required for any visitors. Visitors must always be escorted when in the facility by an authorized employee. All public areas are monitored by camera, and recordings are kept for a minimum of three months. Remote monitored alarm systems are in use at each location.
Members of management monitor the contact center CSR workstations to ensure adherence to FHC rules including our clean desk and no cell phone policies, with special attention to monitoring for any unauthorized personnel. Should a member of management not know a person they see, they are trained to approach the individual, ask for their name, position, and if applicable, reason for being on the contact center floor, and then confirm what the individual said is correct and their presence is warranted. If not, they immediately escalate the situation to a manager on duty while staying with the individual in question until the situation is resolved. Unauthorized individuals are escorted from FHC’s premises.
Network Closets Controlled access to all internal wiring closets and the secured data center is granted only to authorized personnel by role-based badge access. Personnel who do not have the appropriate security clearance, but require occasional or temporary access to internal wiring closets and the secured data center, have to sign in to this area on a control log, be escorted, and monitored continuously by appropriately cleared personnel.
Zones for Staff Pending Clearances Newly hired employees pending security clearance adjudication do not have physical security system badge access to secured areas within the facility. These employees have physical security system badge access to ingress/egress employee entrance doors, the café, and hallways leading to the training facility only.
Training Facility The Training Facility is physically secured by our electronic badge reader system and is always managed by designated trainers. New hires waiting for clearances do not have access to NDOL data and remain in the Training Facility until notice from Human Resources that security clearance adjudication has occurred.
Passwords All FHC employees are required to meet the following password requirements.
| ■ | Passwords must be a minimum of 16 characters |
| ■ | Passwords must include a combination of upper case, lower case, numeric, and special characters |
| ■ | Passwords shall not be set to previously compromised passwords |
| ■ | Password cannot match any prior password |
| ■ | Passwords shall not include context-specific words such as the service name, username, email address, or derivatives thereof |
Before employees can access any of FHC systems, they must pass a multi-factor authentication. First, they must access their device using a BitLocker encryption pin, and an RSA token authentication with an additional pin, then their company username and password. This password must be 16 characters long and include lower and uppercase letters, numbers, and symbols. The password cannot match any prior password. Once employees have accessed their computer, they must connect to FHC’s securely hosted Virtual Private Network (VPN) using another password.
After gaining access to the network, employees must provide usernames and passwords to any programs that contain PII before they can access such programs – ensuring robust protection of all data. All failed login attempts are logged. When an account locks, it also triggers an alert in LogRhythm, our Security Information and Event Management tool. The employee must then open a ticket with the IT Department by calling or emailing our Help Desk to unlock the account and reset their password. Jeffery Walter, Senior Director of Information Security, manages and updates our standard operating procedures and policy for password complexity.
Access to our systems is restricted to specific individuals, whose access is logged, monitored, and audited for compliance. Authorization for access begins with our UKG:Ascentis system of record and is provided in the principle of least privilege. Each employee is assigned an account by our automated access control system which assigns entitlements based on the user's department and division. Changes in departments within the UKG:Ascentis trigger automated workflows to remove entitlements that are no longer necessary and add those that are newly needed. Terminations within the UKG:Ascentis trigger accounts to be stripped and disabled within 15 minutes with no human intervention necessary. Multi-factor authentication to our network is provided by RSA tokens. IAL3 compliant PIV-I cards are used to further secure sessions by privileged users.
FHC employees are prohibited from saving any client or customer data to laptops and foreign removable media such as laptops, USB drives, mobile phones, USB sticks, and external hard drives are prevented from connecting to systems through FHC Security Controls. These protocols prevent the transfer of information from a computer via a removable storage device by encrypting all information upon attempted transfer. Only FHC’s Information Security Team has access to the decryption key, rendering the data useless without it.
Training Staff must pass annual mandatory testing, including semi-yearly and yearly Security Education Awareness Training, to ensure they comprehend industry and regulatory changes. If an employee does not pass with an acceptable score, they are retrained and must successfully pass their retest before being allowed back in the production/operations environment. FHC maintains electronic records of employee training programs and exam results through FHC’s Learning Management System UKG:Ascentis. Our training program utilizes UKG:Ascentis for accurate administration and record keeping of training activities and scores.
FHC partners with KnowBe4 HRM+, a platform that revolutionizes cybersecurity risk management through constantly updated video courses and comprehensive testing to ensure FHC personnel are at the forefront of information and cybersecurity awareness. In addition to physical protection measures, FHC champions employee training and certification regarding information security and phishing attempts that aim to introduce malware into our environment. To this end, employees undergo multiple Know Be4 training courses yearly, with the latest examples of phishing attempts, how to identify them, and how to report them to the Information Security Team.
We have Know Be4 phish alert buttons on all employee MS Outlook programs, and conduct simulated phishing attempts weekly to track the number of reported attempts and the number of successful simulated phishing attempts, if any. Employees are further trained to be aware of the human element of phishing that can introduce malware into our environment, including an immediate need for action, implied negative consequences for not acting immediately, and attempting to name drop prominent employees in hope of persuading the employee into clicking on hyperlinks or providing sensitive data. FHC employees are trained to identify these tactics and immediately report them to Information Security if there is any question about the authenticity of the message.
Security training modules include but are not limited to:
| ■ | Acceptable Use of Technology |
| ■ | Acceptable Use of Phones |
| ■ | Security (e.g., password protection, clean desk policy) |
| ■ | Information Security Training |
| ■ | Non-Public Personal Information Policy |
| ■ | Identification and Authentication Policy |
| ■ | User - Installed Software Policy |
| ■ | Enterprise Cyber Security and Information Protection |
| ■ | Proper Identification Requirements Training |
| ■ | Safeguarding Critical Assets Training |
| ■ | Phishing Prevention |
| ■ | Confidentiality and Security Requirements |
| ■ | Prohibitions of Browsing or Disclosing Claimant |
FHC’s Information Security Program FHC places a strong emphasis on safeguarding confidential information. As part of our onboarding process, employees are required to acknowledge and sign a Nondisclosure and Proprietary Information Agreement. Furthermore, for those assigned to support FHC’s NDOL project, there is an NDOL- approved Confidentiality Agreement form signed by agents. This step is essential prior to being allowed access to any of the NDOL platforms.
FHC maintains compliance with, and is externally assessed against, the FISMA NIST 800-53 rev 5 framework. As such, FHC provides NDOL with one of the most secure solutions in the industry.
FISMA / NIST Certification: FISMA has over 1000 controls based on the highly regarded National Institute of Standards (NIST) 800-53, which requires constant monitoring and periodic independent assessments.
SOC 1 Type II and Soc 2 Type II Certification: The primary purpose of a SOC 2 Type II and SOC 1 Type II report is to provide an independent assessment of FHC internal controls. FHC’s SOC 1 Type II assessment covers internal controls in the areas of risk management, logical access, change management, data security, and data availability. The report includes a description of the controls, the tests performed to assess them, the results of these tests, and an overall opinion on the design and operational effectiveness of the same. FHC first achieved SOC 1 Type II certification in 2018 and has maintained it through annual assessments since. The FHC SOC 1 report examination is performed by an independent third-party auditor per the Statement on Standards for Attestation Engagements (SSAE) 18. FHC completed our third-party SOC 2 Type II assessment in 2024, and will annually thereafter, in alignment with our SOC 1 Type II reporting period.
STIGs: FHC complies with Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs). These guidelines are the most stringent in the country and provide guidance by the United States Department of Defense on hardening systems against cybersecurity attacks.
IRS Pub 1075: FHC complies with IRS Pub 1075 to ensure the continued privacy and security of Federal Taxpayer Information (FTI). FHC extends these protections to our clients responsible for the privacy and security of customer information. Significant portions of IRS Pub 1075 are achieved through FHC’s compliance with NIST SP800-53 and additional clients, and IRS controls are layered into the security program as necessary and required.
NIST CSF: FHC includes the NIST Cybersecurity Framework (CSF) as a component of our information security program. The NIST CSF integrates industry standards and best practices using a common language to facilitate a shared understanding of cybersecurity risk. NIST CSF was developed in collaboration with both private-sector and government subject matter experts. The framework includes understanding and managing risks and threats, including the five core functions of Identify, Protect, Detect, Respond, and Recover.
FHC’s stringent Information Security Program safeguards all NDOL information and confidential data on our systems in adherence to the Federal Information Security Management Act (FISMA), SOC I Type II, SOC 2 Type II, and Applicable Laws and Regulations .Our security controls apply to all forms of Personally Identifiable Information (PII), Sensitive Personally Identifiable Information (SPII), Federal Taxpayer Information (FTI), Protected Health Information (PHI), Payment Card Information (PCI), Sensitive But Unclassified (SBU), Covered Data and Information (CDI), Criminal Offender Record Information (CORI), Social Security Administration Data (SSA), and Controlled Unclassified Information (CUI), including paper, oral, and electronic. In the last eight years, FHC has been granted five separate Authorizations to Operate (ATO) from the federal government, which certifies compliance with the Federal Information Security Management Act (FISMA), National Institute of Standards and Technology (NIST) 800-53, Gramm-Leach-Bliley Act (GLBA), as well as applicable state regulations. FHC’s annual Security Operations Center (SOC) 1 Type II and SOC 2 Type II audits, performed by an independent third party, confirms our internal controls in risk management, logical access, change management, data security, and data availability.
EXPERIENCE HANDLING PPI AND SENSITIVE INFORMATION
FHC demonstrates significant expertise in handling personal protected information (PPI) through a combination of rigorous training, secure practices, and a compliance-driven culture:
| ■ | Comprehensive Employee Training: Every member of our team is trained to handle personal information with the highest level of security. This includes understanding compliance requirements and best practices for data protection. |
| ■ | Industry Experience: With 25 years of experience in contact center operations, financial recovery, loan servicing, and business process outsourcing (BPO), FHC has developed robust systems for managing sensitive data across various sectors, including healthcare, government, and financial services. |
| ■ | Compliance and Security Focus: FHC emphasizes recovery with compliance, ensuring that all operations involving PPI are conducted within legal and regulatory frameworks. We will adhere to all standards of NDOL. |
| ■ | Customer-Centric and Transparent Approach: Our holistic, customer-focused strategies are designed to ensure transparency and accountability, which are critical when dealing with sensitive personal data. |
As a national presence in the call center, collections, and BPO space, FHC has experience handling sensitive information for millions of people since our inception in 1999, including social security numbers, dates of birth, home addresses, telephone numbers, checking account information, credit/debit card information, and other sensitive data. We have never had an individual’s sensitive data compromised. For our federal collections contract, FHC handled this sensitive data for more than 3.5 million accounts placed by the federal government. We regularly assist tens of thousands of callers per day for over 100 clients, gathering and accessing their sensitive information that is required for UI call centers and other government assistance programs.
ENSURING PROPERLY SECURED DATA
The FHC Data Integrity Plan includes the integrity of the systems, which store, process, and transmit sensitive information, the integrity of the information itself from an information security perspective, and the integrity of information from a privacy perspective. All three aspects of data integrity are equally important to FHC. Our System and Information Integrity Policy includes patching and flaw remediation and includes automated patch identification, testing, and deployment. Weekly vulnerability and compliance scans are performed as well as patch management reviews to ensure patching activities occur within documented service-level agreements. Identified variances or anomalies are entered into the vulnerability management program for tracking, reporting, and remediation. Our network is protected by enterprise-class firewalls, host-based firewalls, endpoint detection and response, and virus protection systems to prevent malicious code attacks. Systems are monitored in real-time by their native alerting and monitoring capabilities and all systems log to the FHC Security Information and Event Management System (SIEM), where additional alerting and monitoring has been established. Monitoring capabilities include dashboards, reports, email alerts, and other forms of communication based on criticality of the event in question. FHC subscribes to several trusted external sources of information to ensure we are aware of and acting upon the most recently identified threats. FHC has implemented a full data loss prevention program inclusive of protections against inbound email threats and attacks as well as potential data exfiltration.
The FHC privacy program explicitly addresses the integrity of the information itself. The program includes record retention and destruction. Also included is the accuracy, relevance, timeliness, and completeness of PII, SPII, FTI, PCI, and PHI. FHC has implemented processes for the correction or deletion of information as well as guidance regarding the collection of sensitive directly from the subject to the extent possible as well as validating the accuracy of information during communications with the subject. FHC data integrity procedures also include the maximization of data quality, utility, and objectivity of information. Sensitive information is checked throughout the information lifecycle for inaccurate or outdated data including upon receipt, during updates or transformation, as dispositions are applied, as the information moves through the systems and workflows, prior to reporting, prior to output, and after output. FHC has also onboarded trusted data matching service provides to help ensure the ongoing accuracy of information entrusted to FHC.
Strict Control Over System Access and Permission Each employee is assigned a password by the system administrator. Clerical staff, agents, and management have varying degrees of access and overriding abilities. Outside access is firewall protected, and data encrypted; public and private keys ensure that only authorized users can obtain access. It is further limited to viewing purposes only, with strictly no editing capabilities to non-management. Upon termination of any employee, passwords are immediately revoked, and all security precautions are taken.
Our servers are protected by enterprise-class firewall systems and scans are performed regularly to ensure that any vulnerabilities are quickly found and patched. All services have quick failover points and redundant hardware, with complete backups performed nightly.
Our confidential system component design uses multiple checks to certify that packets from one subsystem can only be received by a designated subsystem. Access to systems is severely restricted to specific individuals, whose access is monitored and audited for compliance. Customer and applicant data is processed (stored, collected, retrieved) only within our secure facilities within the United States.
FHC designed and implemented the information security program based on the following laws, regulations, and standards and regulations:
Regulations
| ■ | State of Nebraska |
| ■ | Nebraska Data Privacy Act (NDPA) |
| ■ | Information security policies, like those established by the Nebraska Information Technology Commission |
| ■ | Executive Order 14028 on Cybersecurity |
| ■ | Consumer Financial Protection Act |
| ■ | Federal Information Security Modernization Act (FISMA) |
| ■ | Health Insurance Portability and Accountability Act (HIPAA) |
| ■ | Graham-Leach-Bliley Act (GLBA) |
| ■ | Privacy Act |
Standards
| ■ | Americans with Disabilities Act (ADA) |
| ■ | NIST SP800-53 |
| ■ | NIST 800-88 |
| ■ | Payment Card Industry – Data Security Standard (PCI-DSS) |
| ■ | Internal Revenue Service Publication 1075 (IRS PUB 1075) |
| ■ | HITRUST |
| ■ | Cloud Controls Matrix (CCM) |
| ■ | International Organization for Standardization 27002 (ISO 27002) |
| ■ | System and Organizational Controls (SOC) 1 |
| ■ | System and Organizational Controls (SOC) 2 |
| ■ | NIST Cybersecurity Framework (NIST CSF) |
FHC’s stringent Information Security Program safeguards all confidential data on our systems in adherence with the Federal Information Security Management Act (FISMA). Security controls apply to all forms of PII, PHI, and PCI including paper, oral, and electronic. The program:
| ■ | Ensures the confidentiality, integrity, and availability of all NDOL and customer information |
| ■ | Detects and safeguards against anticipated threats to the security of the information |
| ■ | Protects against anticipated impermissible uses or disclosures |
All sensitive data is on a protected network segment, with firewall Access Control Lists (ACLs) built up from the default deny-all, allow by exception principle. Internet-facing services reside in a DMZ. Sensitive data is encrypted at rest in file systems via AES 256 bit encryption. Transmission of sensitive information across public networks is permitted only with transport-level security (TLS 1.2), Secure FTP (SFTP), or IPSEC VPN tunnels. Inbound and outbound email is inspected by M365 Exchange Online Protection for spam, malware, and other known threats. Additionally, outbound email is inspected by M365 Compliance for Data Loss Prevention through 18 separate policies. Our servers are protected by enterprise class firewalls, and scans are performed weekly of our entire infrastructure using Tenable Nessus to ensure that any vulnerabilities not addressed in our patch management program are quickly found and remediated.
Authorization for access begins with our HRIS system of record and is provided in the principle of least privilege. Each employee is assigned an account by our automated access control system which assigns entitlements based on the user's department and division. Changes in departments within our HRIS trigger automated workflows to remove entitlements that are no longer necessary and add those that are newly needed. Terminations within the HRIS trigger accounts to be stripped and disabled within 15 minutes with no human intervention necessary. Multi-factor authentication to our network is provided by RSA tokens. IAL3 compliant PIV-I cards are used to further secure sessions by privileged users.
Additionally, FHC has deployed a Network Access Control (NAC) system to validate not only that the user has appropriate credentials to access the network, but that the device being used was issued by FHC and is patched to current levels with up to date anti-virus definitions.
Employees are prohibited from using cellular phones in the office. Quality Assurance performs regular Clean Desk Checks.
FHC requires employees to acknowledge and sign an Acceptable Use Policy and Rules of Behavior at time of hire and annually thereafter. FHC executes Memorandums of Understanding (MOU) with all contractors and service providers containing security and privacy expectations and enrolls them in the Subcontractor Risk Management Program to ensure ongoing compliance with FHC requirements.
| 6.b | b. | Contractor shall supply a method of telephonic interpretation for non-English and non-Spanish language interpretation services. | |
| Describe your language capabilities, including the percentage of call center staff who are bilingual in English and Spanish, and any other languages available. Describe how you will ensure that call | |||
| center staff are able to communicate with individuals in multiple languages. | Language Capabilities |
FHC prides itself on our diverse workforce and has more than 20% of our employees self-identifying as Hispanic/Latino. FHC has access to CSRs who are fluent in both English and Spanish. Approximately 13% of our CSRs are bilingual, and of those bilingual CSRs, 80% are fluent in Spanish.
FHC has employees who are fluent in: Portuguese, Cantonese, Haitian Creole, Mandarin, Cape Verdean Creole, Vietnamese, Arabic, French, Khmer, Russian, Albanian, Somali, Italian, Greek, Polish, Hindi, Persian, Korean, Thai, Taishanese, and Tagalog. We provide multilingual staff and use a collaborative approach to ensure the successful delivery of your program. Our client-tailored model empowers customer-centric CSRs to provide the answers your customers are looking for quickly and efficiently.
FHC has deployed several contracts that required additional language requirements, such as U.S. Department of Education, Federal Student Aid, South Jersey Industries Gas, State of Illinois LIHEAP Department of Commerce & Economic Opportunity, Massachusetts Executive Office of Health and Human Services, Massachusetts Department of Unemployment Assistance, and New Hampshire Bureau of Financial Authority and Department of Public Health. The scope of these projects’ additional language requirements are the same as or higher than NDOL’s requirements. We see no issue in meeting the average 10% number of Spanish calls anticipated by the historical call center totals.
Ensuring Multiple Language Communication During the recruiting and onboarding phases, our Recruiting Specialists ask a series of questions related to job functions in our first initial screening. Recruiting confirms, prior to interview, if the individual seeking employment is fluent in English, Spanish, or any other languages. Once confirmed, management conducting second interviews ask potential employees questions related to the languages in which they listed as being fluent.
In addition, FHC’s QA team has dedicated Spanish speaking QA Agents and a QA Team Lead to ensure the Spanish language is being spoken correctly and in a professional manner. HR certifies an employee’s fluency in various languages during quarterly check-ins within our HR system.
FHC has robust capabilities for bilingual English and Spanish communication, including:
| ■ | Bilingual Staff: FHC employs bilingual agents, including those fluent in Spanish, to ensure effective communication with Spanish-speaking customers. We maintain at 10% bilingual Spanish CSR cohort for the NDOL call center. |
| ■ | Omni-Channel Support: Our bilingual services extend across multiple channels—voice, email, chat, and self-service—allowing Spanish-speaking clients to interact in their preferred format. |
| ■ | Inbound and Outbound Services: Bilingual agents are available for both inbound customer service and outbound outreach, ensuring consistent support across all customer touchpoints. |
| ■ | Tailored Training: We train our staff to meet specific client requirements, which includes cultural and linguistic sensitivity for Spanish and multilingual-speaking populations. |
At FHC, we believe in strength through diversity. Over 6% of our employees are disabled, and we aggressively recruit bilingual Spanish CSRs so that customers can speak in their native language when calling your UI call center. Under Massachusetts call center projects for the Department of Unemployment (DUA) and Executive Office of Health and Human Services (EOHHS), FHC maintained a 25% bilingual Spanish agent cohort to best serve constituents in their native language. We also attend and promote events that honor our nation’s veterans who proudly served our country, and recruit for veteran employees. In addition to being a woman-owned company, 78% of FHC’s workforce is female, and 76% of our workforce are minorities.
Lionbridge Interpretation Services We provide multilingual staff and use a collaborative approach to ensure the successful delivery of your program. Our client-tailored model empowers customer-centric CSRs to provide the answers your customers are looking for quickly and efficiently. In the event a customer does not speak English as a first language, and no bilingual CSRs are available for assistance, FHC uses the translation services of Lionbridge. Lionbridge can translate over 350 languages which ensures that our staff can service claimants for whom English is a second language. Lionbridge is equipped with touch to select popular language translation settings, enabling CSRs to select the most translated call center languages with the selection of a button. For less utilized languages, CSRs speak with a Lionbridge operator who immediately connects them with a translation services specialist for those rarer languages. Lionbridge covers the top ten non-English languages spoken in Nebraska and beyond in the event one of our bilingual CSRs is not available, including:
| ■ | Spanish |
| ■ | Vietnamese |
| ■ | Chinese |
| ■ | Arabic |
| ■ | French |
| ■ | German |
| ■ | Amharic |
| ■ | Swahili |
| ■ | Nepali |
| ■ | Tagalog |
| B. | BUSINESS REQUIREMENTS: Call Center Service Requirements | ||
| 3.a i thru iv | a. | The IVR shall: | |
| i. | Process calls per NDOL approved scripts | ||
| ii. | Offer multi-language support | ||
| iii. | Monitor system performance continuously | ||
| iv. | Provide detailed IVR reporting to NDOL. |
See also V.C.3.E.v The IVR shall provide monitoring and reporting capabilities to track the status and workload of agents, enabling management and NDOL to oversee queue performance and analyze key customer service metrics. Describe in detail your Interactive voice response system. Include the total capabilities and any self-service options. INTERACTIVE VOICE RESPONSE SYSTEM FHC’s omnichannel IVR solution through TCN is cloud based for easy configuration, and completely integrated with all communication channels including chat, SMS, email, and voice. Claimants can navigate through IVR menu options using the dial pad or using words and speaking naturally. Menu and routing options can be changed using intuitive templates. These intuitive templates utilize a variety of assets like voice recordings and call flow wizards that can put IVR scripts into production within minutes. Our IVR also offers voice-driven bots capable of navigating IVR systems and engaging in natural language conversations. Utilizing this feature allows for automated handling of phone-based interactions, improving accessibility and reducing wait times. Our IVR offers workflow/call process automation, intake and secure storage of payment information, redaction or white noise on call recordings to remove sensitive information from the recording, an agent assist tool, and a full suite of performance analytics.
Our IVR CSAT surveys were built to be configured or modified in minutes and designed to quickly gather input from individuals about the most simple or complex situations. These solutions also offer endless decision trees or branching based on customer responses or other actions while on the call.
Additional features include the ability to screen-pop a claimant’s account record if the phone number matches the one on file, and skills-based routing and overflow groups to answer calls timely and direct to the CSRs best capable of assisting the customer. FHC CSR groups and skills rank allow a CSR to quickly transfer a call to a group of CSRs meeting the required skill set and enable the first available CSR to assist the customer quickly and efficiently. To ensure timely answering, if the preferred group of CSRs does not answer, routing sends the call to an overflow group.
Additional out-of-the-box features include:
| ■ | User-friendly visual IVR builder without the need for coding |
| ■ | Routing claimants to their preferred CSR with skill-based routing |
| ■ | Create and build custom messages with Message Manager |
| ■ | Custom dispositions |
| ■ | Automated manual campaign dialing speed (for outbound calls) |
| ■ | Automated campaign scheduling with linked campaigns (for outbound calls) |
| ■ | Resend unconnected calls to increase effectiveness (for outbound calls) |
| ■ | Time savings with quick-to-deploy standard templates |
| ■ | Call recordings |
| ■ | Group agents with similar skills and aptitudes |
| ■ | Save CSRs time by connecting CSRs to the line as soon as the claimant connects |
| ■ | Allow claimants to receive a callback and save their spot in the queue rather than remaining in long hold queues |
| ■ | Automatically detect voice machines or live customers and complete specific actions |
The IVR is fully customizable to meet all NDOL needs.
Our IVR processes all calls per NDOL requested prompts and scripts. Our Account Manager and Development Manager meet with NDOL representatives during implementation to complete the development and set up of all IVR and scripts. Our IVR includes multi-language support where callers may select a number to speak with a representative in English, Spanish, or another language. We offer bilingual CSRs and Lionbridge interpretation services for callers to speak in their preferred language.
FHC develops an NDOL specific IVR to accept calls during and after business hours. Our on-premises telephony platform easily accommodates inbound volumes of callers and can be scaled up with no additional technology expenditure. The IVR begins with the option for customers to select their preferred language (English or Spanish) and fully informs them of other resource options we customize with NDOL. Self-service features are easy to design and implement with endless possible decision trees.
The TCN Operator provides the following capabilities:
| ■ | Process calls per NDOL approved scripts |
| ■ | Offer multi-language IVR support |
| ■ | Monitor system performance continuously |
| ■ | Provide detailed IVR reporting to NDOL |
| ■ | Monitoring and reporting capabilities to track the status and workload of agents, enabling management and NDOL to oversee queue performance and analyze key customer service metrics |
| ■ | Unified Interface: TCN Operator brings all communication channels (voice, email, SMS/text) together into one easy-to-use interface for both CSRs and managers |
| ■ | Intuitive Design: The platform features an intuitive interface with automated agent tools and advanced apps designed for ease of use |
| ■ | Real-time Monitoring: Managers can monitor operations from virtually anywhere |
| ■ | Accessibility: TCN Operator is accessible to agents with visual impairments |
| ■ | Agent Management Interface: The Agent Management interface allows managers to skill and manage CSRs individually and in bulk |
| ■ | Workforce Management Insights: The platform provides data showing call center contact volume and patterns to predict interactions, which can be viewed through dashboards |
| ■ | Integrated Views: Dashboards, KPIs, and drill-down reports are accessible within the tools you already use, such as Workforce Management (WFM) and Workforce Optimization (WFO) |
| ■ | Consolidated Data: The platform consolidates all communication data into one user-friendly interface for enhanced operational efficiency |
TCN Operator enables high-volume inbound and outbound calls, Interactive Voice Response (IVR), client specific customer satisfaction surveys (CSATs), automatic call distribution (ACD), skills-based routing, automatic number identification (ANI) call monitoring technology through the TCN Analytics Dashboard, customizable fields, disposition codes, comprehensive reporting, and additional capabilities and functionalities outlined in section 2a – Technology of our proposal.
This platform provides a full suite of reporting capabilities but also allows for extreme customization by our in-house development team, fluent in the programming language SQL, allowing for FHC to run a wide range of analytics including but not limited to Call Volume, Average Speed to Answer (ASA), Average Hold Time (AHT), Average Handle Time, Abandoned (dropped/missed calls) calls, calls in the queue awaiting a CSR, and any metric NDOL requests. The telephony platform logs and tracks up to 91 different metrics during the life of a call. Data begins to accumulate from the moment a call hits the system until the call is disconnected allowing for reporting in virtually any format. Our telephony platform is compliant all relevant laws (federal and state), along with industry best practices and client requirements.
In addition to inbound inquiries, TCN and Artiva can be programmed to provide outbound outreach campaigns, if needed. For example, FHC can proactively perform outbound calling campaigns to stagger the number of incoming calls before important deadlines, application follow up, and missing documentation. Furthermore, we offer these services to NDOL in the form of email reminders, texts, and digital letter delivery at no extra cost.
Our IT Team monitors system uptime such as our Telephony and IVR Systems continuously. Our controls to ensure continuous system uptime include:
| ■ | Overseeing dialer patching by our third party servicer TCN, patching windows and security monthly and critical patches within 24 hours |
| ■ | Supporting the Database and Operations Teams in updating IVR and dialer logic as needed |
| ■ | Completing server maintenance monthly |
| ■ | Tracking telephony hardware with an automated phone service that prompts an email if they are unable to connect |
| ■ | Using the Paessler Router Traffic Grapher (PRTG) monitoring system for uptime and downtime, ensuring the dialer is connecting to the network as intended and tracking its performance and saturation in real-time |
■ Completing annual reviews for system testing, load testing, and other change management initiatives to NDOL.
| 5.b. iii a) thru e) | iii. | The Contractor shall train and manage agents assigned to the call center as follows: | ||
| a) | Develop, conduct, and maintain a comprehensive and continuous training program providing agents with the appropriate knowledge and current information to perform services required by the State Agency. | |||
| b) | Ensure that all agents are trained in Federal, State, and Local policies, procedures, and State Agency operations, with approval/agreement by the State agency. | |||
| c) | Develop and update training manuals and training records for the State Agency’s review and approval. | |||
| d) | Provide copies of all training materials to the State Agency on an ongoing basis. | |||
| e) | Implement a procedure and schedule for ongoing training, refresher training, and have a dedicated trainer onsite to conduct trainings that will be monitored by the State Agency. | Describe your capacity of in-house trainers and approach to on-boarding new call center staff to the project. | Led by Training Manager Lisa Reams, FHC has ten corporate trainers in-house, allowing us to conduct training in smaller classroom sizes with a more personalized approach, yielding CSRs with superior UI knowledge. With over 20 years of experience, she brings valuable contact center training and operations experience. She manages and oversees all training for FHC, including complex training courses through train-the-trainer methods. |
TRAINING AND DEVELOPMENT APPROACH
From the time of hire and throughout the careers of our professionals, our comprehensive training and development program drives accountability at all organizational levels. FHC has developed a comprehensive staff development program aligned with company policies, contract requirements, as well as applicable federal, state, and local regulations.
The program we design for you includes intensive training that emphasizes friendly, effective customer service. The objective of the training plan is to enable our staff to learn the skills and techniques required to not only succeed at their job but to fully understand applicable regulatory laws and client-specific needs. The key to our comprehensive training plan is our focus on rigorous project management blended with exemplary instructional design. The training process is ongoing, multi-channeled, and focuses on system-specific instruction, NDOL’s rules, and standards, understanding of metric measures, scored call monitoring, and coaching. Multi-channeled training includes instructor-led training, e-Learning, required reading, simulation employee training, hands-on training, role-playing, group discussion, live call coaching, and collaborative mentorships with accomplished senior CSRs.
During phase-in the Training Manager, Lisa Reams oversees the development of a comprehensive and customer-focused Training Plan, with particular emphasis on communicating your brand, increasing claimant understanding, alleviating pain points, and ensuring a consistent experience. FHC trainers participate in train-the-trainer sessions with NDOL to ensure each is proficient with the specific policies, procedures, and requirements needed to accurately train staff before the implementation of your project. As veterans of high volume Unemployment Insurance call center projects since 2020, FHC understands the knowledge and aptitude needed to support the complexities of a UI call center, and we provide feedback for continuous improvement of training and documentation to ensure consistency and efficiency. Training staff continue to work concurrently with your standards while staying abreast of all changes, regularly contributing to the development and maintenance of contact scripts, desktop guides, training material, training curriculum, and tools. We design and develop all training materials and submit them to NDOL for review and approval prior to administering, and we provide copies of all training materials to NDOL on an ongoing basis to further refine and improve our curriculum.
TRAINING METHODS
We use guided content (instructor-led training (ILT), video, and computer-based training (CBT) to convey information and quizzes, role plays, teach backs, gamification where appropriate, call reviews, and simulations to reinforce and apply information. Applying a large group/small group model, we provide instruction and application of knowledge, starting with the most basic ideas and building to the more complex topics.
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .