2013-10-30_-_NPR_Sources_Sought_NPR_FINALv2.pdf

SHIP Performance Measurement and Reporting System

Sources Sought

(October 2013)

This is a SMALL BUSINESS SOURCES SOUGHT NOTICE. This is NOT a solicitation for proposals, proposal abstracts, or quotations. The purpose of this notice is to obtain information regarding the availability and capability of qualified small businesses (e.g., 8(a), service-disabled veteran owned small businesses, HUBZone small businesses, small disadvantaged businesses, veteran-owned small businesses, and women-owned small businesses) that can provide performance measurement data reporting, data system maintenance, and support to the current SHIP National

Performance Measurement and Reporting System (SHIP NPR). The SHIP NPR supports all 54 State Health Insurance Assistance Programs (SHIPs) their 3,100 local SHIP sponsoring sites, and the CMS Division of SHIP Relations (SHIP Grant Administrator).

The SHIP NPR is a web based system which provides direct data entry from most states.

However, about one-third of some states provide batch uploads from their states’ proprietary systems. The SHIP NPR resides on CMS servers managed by an external contractor. The SHIP NPR application utilizes Object Oriented Programming, .NET, C#, Microsoft SQL Server 2008, Visual Studio 2005/2008/2010, Model view controller pattern, Microsoft SQL Server Reporting Services, Microsoft Internet Information

Service (IIS), and Microsoft Access.

BACKGROUND

The State Health Insurance Assistance Program is a state-based program that offers local one-on-one counseling and assistance and outreach to people with Medicare and their caregivers. Through CMS funded grants directed to states, SHIPs provide free counseling and assistance via telephone and face-to-face interactive sessions, public education presentations and programs, outreach events, and media activities. CMS funds 54 SHIPs in the 50 states, the District of Columbia, Puerto Rico, Guam, and the Virgin Islands. In

FY2013, the SHIP program was funded $45.1 million as a result of the federal sequestration budget. This includes direct grants to states and support contracts including the SHIP National Resource Center contract and the SHIP National Performance

Measurement and Reporting contract.

The SHIP network is comprised of paid staff, approximately 3,100 local sponsoring organizations, and 14,500 counselors (approximately 57% of which are volunteers).

CMS expects SHIPs to provide access to SHIP services to beneficiaries statewide;

provide access at the local level; provide access to hard-to-reach populations; have a well-trained workforce (paid and volunteer); provide accurate and timely information to beneficiaries; participate in CMS education and communication activities; and report activities to CMS through an established CMS data system. In the grant year ending

March 31, 2013, SHIPs provided one-on-one counseling to approximately 2.5 million people and over 82,000 public and media events.

Please see Attachment 1 for additional Security & Technical Requirements.

REQUIREMENTS OVERVIEW

The following provides an overview of the types of services and support that would be required from potential responders. Note that although this is an extensive list, it is not meant to be all inclusive.

The SHIP Performance Measurement and Reporting System contractor (the Contractor) must have specific expertise to provide various services to the SHIP program in the areas including, but not limited to:

system development, maintenance and support;

system security;

information management and communication;

data analysis;

peer-to-peer program assessment;

training;

interpretation of data and information for program improvement;

performance measures development and benchmarking;

website application development;

assessing, developing and implementing grant funding methodologies; and budget and administrative support.

The Contractor must demonstrate knowledge and experience with the SHIP program or other federally regulated, and/or non-profit volunteer or community-based consumer education program(s) similar in scope and size to the SHIP network. The Contractor must demonstrate the ability to draw upon resources to respond to a rapidly changing programmatic environment and have knowledge of the issues associated with the aging network and the health insurance industry, including Medicare and Medicaid.

It is critical that the Contractor have a complete, thorough and functional understanding of service delivery through a volunteer-based network, as well as the strategic outreach, educational and assistance efforts promoted by CMS in association with Medicare and

Medicaid services. The Contractor should also have knowledge of similar industry efforts and must demonstrate experience in identifying/developing program benchmarks and implementing systems to monitor programs. The Contractor must also be able to assess impacts of quality improvement initiatives.

The complexity of state level environments, and the variety of methods that can be used across states to administer those grants within the grant goals, provide a level of complexity that requires the Contractor to have general knowledge of the SHIP NPR system and the organization of data delivery systems from state to state.

CAPABILITY STATEMENT INFORMATION

Please address your knowledge and experience within the last three (3) years and how you will provide each of the following points. Where applicable, please reference specific items from the Requirements Overview in demonstrating your ability to effectively perform the following functions:

1. Provide 24/7 maintenance support for the SHIP National Performance Measurement and Reporting System and the SHIPtalk.org website. Develop system enhancements as approved by CMS. Requirements include:

a) Demonstrated experience in website application development;

b) Demonstrated experience with Object Oriented Programming, .NET, C#, Microsoft SQL Server 2008, Visual Studio 2005/2008/2010, Model view controller pattern, Microsoft SQL Server Reporting Services, Microsoft SQL, Microsoft IIS (Internet Information Service), and Microsoft Access;

c) Demonstrated experience with the Software Development Life Cycle;

d) Demonstrated ability to administer security and access rights to the data system; and

e) Demonstrated ability to develop enhancements to improve data submissions and quality of data submitted by batch upload entities.

2. Provide a secure environment which meets HHS/CMS information security requirements for the database containing personally identifiable information (PII).

Requirements include:

a) Demonstrated knowledge of and experience assessing the National Institute of

Standards and Technology (NIST) SP 800 Series, with emphasis on NIST

800-53 publication;

b) Demonstrated knowledge and experience with the Federal Information

Security Management Act (FISMA);

c) Demonstrated experience with all aspects of CMS Information Security requirements including the CMS’s Risk Management Framework;

d) Demonstrated experience with the CMS Security Assessment and

Authorization process including creating program documentations (e.g., System Security Plan, Contingency Plan, Information System Risk

Assessment and other related documents); and

e) Information Security personnel must possess a current Information Security industry recognized security certification (e.g., A+, CISSP).

3. Provide training and technical assistance to the 14,500+ system users for web-based input and reporting at over 3,100 locations. Requirements include:

a) Demonstrate the ability to develop training documents for presentation (e.g., Power Points and other handouts);

b) Demonstrate the ability to provide technical assistance to SHIPtalk.com NPR users through a HELP Desk, at least Monday through Friday, from 9:00 am to

5:00 pm, EST;

c) Provide training through webinars, phone and/or on-site visits;

d) Demonstrated experience in user manual development;

e) Demonstrated experience in providing local SHIP training support on the

SHIP National Performance Reporting system and the use of this system for program improvement;

f) Demonstrated experience in providing SHIP National Performance Reporting system training during the annual New SHIP Directors’ training; and

g) Demonstrated experience in providing Peer-to-Peer program assessment.

4. Provide in-depth data analysis to assist CMS and SHIPs in monitoring and supporting state based programs. Requirements include:

a) Demonstrated ability and experience in preparing analytic and research reports;

b) Demonstrated experience in analyzing the effectiveness of locally-based, grant funded, and social service programs;

c) Demonstrated ability to review and interpret reported data and translate into program development/improvement plans;

d) Demonstrated ability to analyze information using accepted research methodologies;

e) Demonstrated experience in developing local measures for benchmarking;

f) Demonstrated experience in developing process measures, quality measures, efficiency measures, and effectiveness and outcome measures for the SHIP program and/or other federally regulated, or non-profit volunteer or community-based consumer education program similar to the

SHIP network in scope and size;

g) Demonstrated ability to work with CMS in the development of enhancements to the current data elements, performance measures, reports, and benchmarks/goals/targets for the NPR measures.

h) Demonstrated ability to communicate, verbally and in writing, the presentation of analysis of large data sets, technical analysis, findings, and preparation of final reports and special studies; and

i) Demonstrated ability to provide interpretation of data and information for program improvement.

5. Produce reporting in existing format to CMS and to the states and territories, and special purpose reporting for CMS to assess program performance. Requirements include:

a) Demonstrated experience with Microsoft Access, Excel and Word; and

b) Demonstrated ability to compile national and state-specific performance measurement reports based on NPR data.

6. Support timely transfers of data from state proprietary systems and provide technical support for that purpose. Requirements include:

a) Demonstrated ability to provide data upload file specifications to the batch upload entities and their database vendors;

b) Demonstrated ability to provide on-going assistance with batch upload entities to ensure accurate, complete, and timely data submission;

c) Demonstrated ability to improve the ease of use and functioning of the batch upload protocols;

d) Demonstrated ability to troubleshoot and work with various State Information

Technology (IT) vendors to ensure proper data submissions; and

e) Demonstrated ability to develop system specifications.

7. Research, assess, and analyze methods to demonstrate programmatic impact, outcome, and quality using current data submitted and recommendations for enhancements to the data. Requirements include:

a) Demonstrated experience in using workgroups consisting of users and industry experts to assess and/or validate current methods of assessment; and

b) Demonstrated ability to develop new quantifiable performance benchmarks and indicators that will demonstrate programmatic impact and the quality improvement outcomes.

8. Develop SHIP funding methodologies. Requirements include:

a) Demonstrated ability to develop, analyze, and implement factors to develop and/or enhance SHIP funding opportunities;

b) Demonstrated familiarity with critical data sources; and

c) Demonstrated ability to work with and support Workgroups to develop methodologies.

9. Communicate with CMS for policy guidance and approval, as required.

Requirements include:

a) Demonstrated ability to produce products and/or protocols for communication with CMS on contract issues.

10. Develop and manage budgets based on federal guidelines, and employ administrative processes and reporting. Requirements include:

a) Demonstrated ability to use federal budgets and budget processes and proficiency in use of federal (CMS) contracting systems.

b) Demonstrated processes to efficiently communicate with Contracting Officer

Representative (COR).

The Contractor must have the ability to successfully complete the functions outlined above, as well as the capacity to perform additional tasks which require skill sets similar to those mentioned above.

ADDITIONAL INFORMATION REQUESTED:

Interested parties having the capabilities necessary to perform this requirement may submit a written capability statement via email to Ryan Kaufman

(ryan.kaufman@cms.hhs.gov). CAPABILITY STATEMENTS MUST

DEMONSTRATE THE MINIMUM REQUIREMENTS OUTLINED ABOVE.

Please address each in the order listed above under “Capability Statement Information.”

Capability Statements shall be limited to fifteen (15) pages and shall designated any/all teaming arrangements, and the work to be performed by each team member.

Capability Statements should also include the following information, if applicable:

1) DUNS;

2) Tax ID;

3) Company Name;

4) Company Address;

5) Company Point of Contact, Phone and Email Address;

6) Current GSA Contracts;

a) Schedule

b) 8(a) STARS GWAC

c) Vets GWAC

7) Do you have a Government approved accounting system? If so, please identify the agency that approved the system;

8) Business Size Status (e.g., small business, 8(a), woman owned, veteran owned, etc.) as validated via the Small Business Administration Central Contractor

Registration (CCR) for the applicable NAICS code 541611 – Administrative

Management and General Consulting Services (Size Standard - $6.014.0

Million). Additional information on NAICS codes can be found at www.sba.gov.

9) Point of Contact, Phone and Email Address of individuals who can verify the demonstrated capabilities identified in the responses.

Responses must be submitted no later than 12:00 PM EST on November 12, 2013.

Capability statements will not be returned and will not be accepted after the due date.

The purpose of this Sources Sought synopsis is to identify potential qualified small business contractors only and does not constitute a Request for Proposal, and is not to be construed as a commitment by the Government. Specifically, this notice does not obligate the Government to award a contract or otherwise pay for the information provided in response. The Government reserves the right to use information provided by respondents for any purpose deemed necessary and legally appropriate. Any organization responding to this notice should ensure that its response is complete and sufficiently detailed to allow the Government to determine the organization’s qualifications to perform the work. Respondents are advised that the Government is under no obligation to acknowledge receipt of the information received or provide feedback to respondents with respect to any information submitted. After a review of the responses received, a pre-solicitation synopsis and solicitation may be published on the Federal Business mailto:ryan.kaufman@cms.hhs.gov

Opportunities website. However, responses to this notice will not be considered adequate responses to a solicitation.

CONFIDENTIALITY

No proprietary, classified, confidential, or sensitive information should be included in your response. The Government reserves the right to use any non-proprietary technical information in any resultant solicitations.

Questions concerning submission requirements may be directed to Ryan Kaufman, Contract Specialist, (410) 783-2353, ryan.kaufman@cms.hhs.gov. CMS will not entertain questions related to contracting strategy.

mailto:ryan.kaufman@cms.hhs.gov

SOURCES SOUGHT – ATTACHMENT 1

Security & Technical Requirements:

The Contractor shall:

i. Implement Section 508 compliant systems and electronic information materials.

ii. Implement and maintain systems under FISMA moderate level compliance and pass security, ST&E, and certification & accreditation audits and processes following federal government standards and regulations.

iii. Provide necessary premise-based network-communications equipment required to connect contractor facilities to the AT&T Global Network Service (AGNS) network or other CMS-chosen network. This includes, but is not limited to, LAN, firewalls, hubs, patch panels, and necessary cabling.

iv. Ensure hardware and software are properly maintained to support interoperability between production components and CMS provided infrastructure. Typical tasks may include, but are not limited to:

a. Monitoring system operations and performance

b. Addressing and correcting system errors

c. Implementing software maintenance programs

d. Scheduling deployments and upgrades for minimal project disruptions

e. Installing software upgrades

f. Providing performance tuning

g. Providing on-site and off-site maintenance

h. Providing on-site after hour and weekend support

i. Providing maintenance to environmental systems including; power, HVAC, UPS, and fire suppression equipment

v. Correct any security deficiencies, conditions, weaknesses, findings, or gaps identified by all audits, reviews, evaluations, tests and assessments, including but not limited to, the Statement on Auditing Standards (SAS) -70 Reviews, Inspector

General Audits, self-assessments, and Vulnerability Assessments in a timely manner.

vi. Develop & provide corrective action plans and quarterly progress reports to CMS in accordance to the Business Partner System Security Manual (BPSSM) or otherwise as directed by CMS.

vii. Comply with the CMS Certification & Accreditation (C&A) methodology, policies, standards, procedures, and guidelines for contractor facilities and systems. The CMS C&A methodology can be found on the CMS web site www.cms.gov/InformationSecurity.

viii. Conduct or undergo an independent evaluation and test of systems security program in accordance with section 912 of the MMA.

ix. Conduct, at a minimum, annual vulnerability assessment including penetration tests of the Contractor’s systems, program, and facility.

x. Support CMS validation and accreditation of contractor systems and facilities in accordance with CMS C&A methodology.

http://www.cms.gov/InformationSecurity

xi. Provide necessary staff to maintain equipment, and must be made available 24x7 if necessary to troubleshoot problems with CMS or other contractor staff.

xii. Develop & adhere to a Telecomm and IT Systems plan that outlines the approach and processes that will be used to manage these requirements, as well as a monthly Telecomm/IT Systems Outage Report that describes, at a minimum, the outage, the duration, the cause and the resolution.

Security:

The Contractor shall comply with the applicable security requirements related to the operation of the alternate format production and distribution operations under the contact center operations program defined in the Business Partner System Security Manual

(BPSSM) (also known as IOM Publication 100-17), the Core Security Requirements and its operational appendices (A, B and C), found at http://www.cms.gov/Manuals/IOM/.

The Contractor shall implement a security program that adheres to CMS security standards. The Info Security Library can be found at http://www.cms.gov/InformationSecurity/ISD/list.asp. The Contractor shall fully cooperate with CMS audits, reviews, evaluations, tests, and assessments of contractor systems, processes, and facilities. The following security regulations, policies, and guidelines are applicable to all CMS contractors:

(I.) Public Law 93-579, The Privacy Act of 1974, as amended

(II.) Public Law 99-474, Computer Fraud & Abuse Act of 1986

(III.) Public Law 100-235, Computer Security Act of 1987

(IV.) Public Law 104-13, Paperwork Reduction Act of 1978, as amended in 1995, U.S.

Code 44 Chapter 35

(V.) Public Law 104-106, Clinger-Cohen Act of 1996 (formerly known as the

Information Technology Management Reform Act)

(VI.) Public Law 104-191, Health Insurance Portability and Accountability Act, 1996

(formerly known as the Kennedy-Kassenbaum Act)

(VII.) Public Law 107-347, E-Government Act of 2002, Federal Information Systems

Management Act (FISMA)

(VIII.) Presidential Decision Directive/NSC-63 (PDD 63), Critical Infrastructure

Protection, May 22, 1998

(IX.) Office of Management and Budget (OMB) Circular No. A-123, Management

Accountability and Control, June 21, 1995

(X.) OMB Circular A-130, Management of Federal Information Resources, Transmittal 4, November 28, 2000

(XI.) Appendix III to OMB Circular No. A-130, Security of Federal Automated

Information Resources, November 28, 2000

(XII.) GAO/AIMD-12.19.6, Federal Information System Controls Audit Manual

(FISCAM), January 1999

(XIII.) CMS Business Partners System Security Manual, March 5, 2004

(XIV.) CMS Information System Security Policy, Standards and Guidelines handbook

(The Handbook), version 1.2, July 19, 2004

(XV.) CMS System Security Plan Methodology, version 3.0, November 6, 2002

(XVI.) CMS Risk Assessment Methodology, version 2.1, April 22, 2005 http://www.cms.gov/Manuals/IOM/ http://www.cms.gov/InformationSecurity/ISD/list.asp