122125 O3 Alivia Analytics Attachment 3 - Technical Specifications_Proprietary Redacted File 2 of 4.pdf

Bidder’s Response As bidders prepare responses to each individual requirement, the responses are expected to address the individual requirement in a manner that demonstrates to the State that the bidder understands the requirement and how the bidder will meet the specific requirement. If the bidder’s response simply repeats the requirement, acknowledges, or adds sales materials in the Bidder’s response, the State will reserve the right to deem the response as a “Non-Responsive Solicitation Response”. However, if needed to appropriately explain bidder’s response, a mix of tables, graphical details, and written narrative is acceptable.

The bidder’s response to each requirement must include confirmation and a detailed explanation for the Implementation Approach taken. Bidders shall capture any assumptions, risks, or dependencies related to fulfilling each individual requirement.

Provide specifics, such as:

• Tools or methods used.

• Estimated effort for customizations/configurations.

Exhibit 1: Alivia’s Network Design and Application Data Flow Diagram

Assumptions:

ARCH-02

Describe the bidder solution to address the following:

* Type of Software – SaaS, PaaS or, IaaS

* Licensing Model- Perpetual or Subscription based licenses

* Single or Multi-Tenant architecture Met the requirement: YES

Implementation Approach: Out of Box (OOB) Confirmation:

ARCH-03

The bidder solution must be a cloud-based hosted environment with all components and data residing in the United States and consisting of ready-made software products that do not require major modifications but support customization to meet the functional requirements as outlined in Attachment 2 – Functional Requirements. Bidder must describe how their approach will meet these requirements.

Met the requirement: YES

ARCH-04

The bidder solution must provide multiple environments concurrently to support functions including but not limited to production, testing, and training. Bidder must describe how their approach will meet these requirements.

Met the requirement: YES

ARCH-05

Bidder shall review the accessibility requirements described in the following:

· Section 508 compliance standards https://www.section508.gov/manage/laws-and-policies/)

· 45 CFR Part 85 (https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-A/part-85)

· State of Nebraska Accessibility requirements (https://nitc.nebraska.gov/standards/index.html#2).

Bidder must indicate how your solution will meet such requirements as they relate to the accessibility requirements for each of the items listed above.

Met the requirement: YES

ARCH-06

The bidder’s solution must provide Scalability and High Availability Architecture. The bidder must describe how their solution will meet this requirement. The response must include, at a minimum the following details:

* The system architecture must support scaling with increased load.

* The system must provide high availability to support minimum disruptions to the business operations.

* The system must handle notifications when a component or interface endpoint is unavailable.

* The system must handle performance functionality and monitoring tools.

* The system must handle recovery of failed transactions because of a component failure.

* The system must be available online Monday to Friday 7AM to 6PM Central Time during State working days.

Met the requirement: YES

DM-03

The bidder’s solution must support data integration. The bidder must describe how their solution will meet this requirement. The response must include, at a minimum, the following details:

* Ability to import and export data using these file types (XML, JSON, CSV).

* Support for integration using industry standards approaches and principles for REST APIs and Webservices.

* Support for industry integration data standards for HealthLevel 7 (HL7), Fast Healthcare Interoperability Resources (FHIR), X-12, HIPAA.

Met the requirement: YES

DM-04 The bidder solution must securely dispose of State data from its systems upon request and in accordance with the National Institute for Standards and Technology (NIST) Special Publication 800-88 revision 1 (https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf) and must provide to the State of Nebraska a certificate of data destruction.

Bidder must describe how their approach will meet this requirement.

DM-05

Bidder shall review the data retention requirements described in the following:

· 45 CFR Part 164.316 (https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.316)

Bidder must meet all the capabilities and/or requirements as outlined for each of the items and indicate how your solution will meet such requirements as they relate to the data retention requirements.

Met the requirement: YES

• None known

Risks:

• None known

Dependencies:

SPC-02 The bidder must agree to conduct an independent, third-party penetration test for the solution in which they are offering within one year prior to the anticipated go-live date, that includes, at a minimum, the Open Web Application Security Project (OWASP) Top 10. Identified risks must be classified by severity and additional information must be provided for any risks identified as medium and above. This must be conducted at no additional charge to the State. Bidder must conduct this test at the appropriate time and describe how their approach will meet these requirements.

Met the requirement: YES

SPC-03

The bidder must agree to conduct an annual independent third-party penetration test of the solution that includes the Open Web Application Security Project (OWASP) Top 10. The report must provide details of the critical, high, and medium findings and associated risks. This must be conducted at no additional charge to the State. Bidder must conduct this test at the appropriate time and describe how their approach will meet these requirements.

SPC-04

The bidder must agree to conduct an independent, third-party security and privacy controls assessment that aligns with the National Institute for Standards and Technology (NIST) SP 800- 53 moderate standard, within one year prior to the go-live date. Identified security gaps must be classified by severity and additional information must be provided for any gap identified as medium and above. This must be conducted at no additional charge to the State. Bidder must conduct this assessment at the appropriate time and describe how their approach will meet these requirements Met the requirement: YES

Risks:

• None

SPC-05

The bidder must agree to conduct an annual independent third-party security controls assessment that meets the National Institute for Standards and Technology (NIST) SP 800-53 moderate standard. The report must provide details of the critical, high, and medium findings and associated risks. This must be conducted at no additional charge to the State. Bidder must conduct this assessment at the appropriate time and describe how their approach will meet these requirements.

Met the requirement: YES

SPC-06

Describe the bidder solution for the following:

* Support for self-service password activities.

* Automatic log-off procedures after determined time of session inactivity.

* Automatic account disablement after 120 days of inactivity.

* Administrators’ ability to lockout user(s).

* Support and approach for single sign-on with State Active Directory

* Support and approach for Multi-Factor Authentication

* Automatic locking of account after determined number of failed logon attempts.

SPC-07 The bidder solution must use role-based security. Bidder must describe how their approach will meet this requirement

Implementation Approach: Out of Box (OOB) Confirmation:

Alivia’s platform accommodates role-based security for access to both FWA Finder™ and Case Manager™.

Implementation Approach:

Risks:

• None known

SPC-08 Describe the bidder solution for the following:

* How user accounts are assigned and managed.

* How the system provides usage reports, such as a listing of all users and their last usage date.

* How the system supports authorization at an attribute/field level (e.g., edit, view).

Met the requirement: YES

Risks:

• None known

SPC-09

Bidder shall review the State DHHS Information Technology (IT) Audit Standards located at: (https://www.dhhs.ne.gov/ITSecurity).

Bidder must meet all the capabilities and/or requirements as outlined and indicate how your solution will meet such requirements. As a part of the bidder’s response, at minimum, the State desires specific information regarding the following elements:

· Detail the data elements that are audited.

· Outline the level of audit tracking being maintained.

· Provide a sample of their audit reports.

· Capabilities for automated audit log evaluation to identify security issues.

. How the bidder monitors, identifies, and reports on events impacting the system, such as attacks and other unauthorized use of the system.

Met the requirement: YES

Risks:

• None known

Risks:

• None known

OM-03

The bidder must agree to conduct an annual disaster recovery test for the solution and submit the annual results to the designated individual for the State of Nebraska. This must be conducted at no additional charge to the State. Bidder must conduct this test at the appropriate time and describe how their approach will meet these requirements.

Met the requirement: YES

OM-04

The bidder solution shall meet the following:

* Compliance with the Recovery Time Objective (RTO) of within twelve (12) hours when the system outage is declared as a disaster.

* Compliance with the Recovery Point Objective (RPO) of fifteen (15) minutes of data lost before the disaster event Met the requirement: MET WITH DEVIATION

OM-05

Describe the bidder solution for the following:

* Overall testing strategy and support for the following testing types: unit testing, system testing, integration testing, regression testing, user acceptance testing (UAT), parallel testing, performance and load testing, manual and automated and/or scripted testing, and end-to-end integration testing.

* Approach to planning and preparing the test/staging environment.

* Approach to conducting each test level.

* Approach for testing nonfunctional requirements (security, performance, etc.)

* Approach to test documentation (e.g., test cases, test scripts, test case matrices added as the design configuration progresses).

* Approach to quality control/quality assurance.

* Approach to test results reporting, traceability, and metrics Met the requirement: YES

• Utilization of synthetic data in some of the environments for testing and minimize risk of PHI in environments

• Limiting the data loaded into the environments to 3 years

OM-06

Describe the bidder solution for software maintenance processes that address the following:

* Approach to managing software versions to ensure bidder support.

* Approach to Change Management, including defects and enhancements.

* Approach to testing and release management.

* Approach to maintaining integrations with external and internal trading partners.

Met the requirement: YES versions.

Risks:

• None known

OM-07

Describe the incident management process that will be used to report business and security incidents (such as any unauthorized access to, or incidents where, data may have been compromised

OM-08

The bidder shall describe its approach on providing technical documentation that addresses the following.

• System Operation Manual

• Administrative Operations

• Documentation to support testing and collaboration with integrating systems.

• Documentation of the system's data dictionary which includes user-defined fields and tables.

Met the requirement: YES

• None known

OM-09

The bidder must describe its approach to use and integrate with the state JIRA infrastructure for the entire software development lifecycle.

Met the requirement: MET WITH DEVIATION

Implementation Approach: Configuration