SF 30 w Continuation Amendment 0001_09.13.24.pdf

(x)

2031JW24R00002

x x copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted ; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGEMENT TO BE

RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR

OFFER. If by virtue of this amendment you desire to change an offer already submitted , such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

x

OCC

Washington DC 20219

400 7TH STREET SW

Acquisitions Management Comptroller of the Currency

09/06/20240001

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS. IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

12. ACCOUNTING AND APPROPRIATION DATA (If required) is not extended.is extended, Items 8 and 15, and returning

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended , by one of the following methods: (a) By completing

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

FACILITY CODE CODE

10B. DATED (SEE ITEM 13)

10A. MODIFICATION OF CONTRACT/ORDER NO.

9B. DATED (SEE ITEM 11)

9A. AMENDMENT OF SOLICITATION NO.

CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP Code)

7. ADMINISTERED BY (If other than Item 6)CODE 6. ISSUED BY

PAGE OF PAGES

4. REQUISITION/PURCHASE REQ. NO.3. EFFECTIVE DATE2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO. (If applicable)

1. CONTRACT ID CODE

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

09/06/2024

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority) appropriation data, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

E. IMPORTANT: Contractor is not is required to sign this document and return __________________ copies to the issuing office.

ORDER NO. IN ITEM 10A.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

The purpose of this amendment is to make changes to the RFP.

Sections B - M of the continuation pages of this amendment replace Sections B - M of the original solicitation in their entirety.

Period of Performance: 04/01/2025 to 03/31/2026

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)15A. NAME AND TITLE OF SIGNER (Type or print)

15C. DATE SIGNED 16B. UNITED STATES OF AMERICA 15B. CONTRACTOR/OFFEROR 16C. DATE SIGNED

(Signature of person authorized to sign) (Signature of Contracting Officer)

JOEY BARDEN

STANDARD FORM 30 (REV. 11/2016)

Prescribed by GSA FAR (48 CFR) 53.243

Previous edition unusable

Except as provided herein, all terms and conditions of the document referenced in Item 9 A or 10A, as heretofore changed, remains unchanged and in full force and effect .

Dental Insurance Solicitation

2031JW24R00002

PART I – THE SCHEDULE

SECTION B – SUPPLIES OR SERVICES AND PRICES / COSTS

B.1 See Attachment (1) Price Proposal Spreadsheet for the Contract Line-Item Number (CLIN) structure.

SECTION C – DESCRIPTIONS / SPECIFICATIONS / STATEMENT OF WORK

1.0 GENERAL

The Contractor shall provide the services specified herein for a 12-month base period and nine one-year option periods (if exercised) at the rates specified in each CLIN.

The Contractor shall underwrite and administer the Office of the Comptroller of the Currency’s (OCC) Dental Insurance Program for OCC employees, retirees, and their eligible family members as well as employees of the Office of Financial Research (OFR) and their dependents.

1.1 PRICING SCHEDULE FOR DENTAL INSURANCE PROGRAM

The Contractor shall underwrite and administer insurance for two different dental plans, Preferred Provider Organization (PPO) and Dental Health Maintenance Organization (DHMO).

The OCC pays 100 percent of the premium for its active employees (OCC and OFR), disabled retirees (OCC only), and buyouts/survivors (OCC only). Retirees pay 100% of the premium based on the coverage tier they elect, which can be retiree only, retiree plus one, or retiree and their eligible family members.

The number of eligible employees enrolled in the DHMO and PPO plans is estimated and used for the purpose of establishing a funding amount for each performance period. The OCC employee population may fluctuate within each performance period resulting in an increase or decrease throughout the year (i.e., there may be a variation in quantity). The number of eligible employees enrolled in the DHMO and PPO plans is also subject to change. The OCC will remit premium payment based on actual enrollment for that month at the performance period’s fixed unit rate. Retirees will be invoiced monthly directly by the contractor.

As noted in the SOW section to follow, the OCC is considering two plan designs, Attachment (2) is the Current Plan Design and Attachment (3) is the Enhanced Plan Design, which consists of the current plan design with two changes – increases in the calendar year maximum and orthodontic lifetime maximum. The Government will identify the chosen plan design at the time the contract is awarded.

1.2 CLIN DESCRIPTION AND ARRANGEMENT

The contract type will be Fixed-Price with prospective price redetermination. The base and option year 1 CLIN rates are fixed; however, the total price for each CLIN could increase or decrease depending on changes in the number of eligible OCC and OFR employees, and OCC retirees. Insurance rates for option CLINs 2001 through 9001 will be negotiated prior to exercise but may not exceed the capped amount to be established. Additionally, there will be a transition period (date of award through June 30, 2025) to enroll employees into the dental plan, which will not be separately priced (i.e., at no additional cost to the Government) and will be included in the base year. See Attachment (1), Price Proposal Spreadsheet, for the CLIN structure.

At any time during the contract’s period of performance, the OCC may negotiate with the Contractor for changes to the insurance plans that would provide more benefits to beneficiaries of the plans (lower co-pays, more services covered, lower deductibles, etc.), provided the cost to the OCC for such increases in benefits do not exceed 20% of the fixed and/or capped price rates for the associated year(s) of coverage.

1.3 INTRODUCTION

The OCC is a non-appropriated federal financial regulatory agency of the Department of the Treasury. The OCC supervises national banks, federal savings associations, and federal branches and agencies of foreign banks that serve consumers, businesses, and communities across the United States and conducts approximately 70% of banking activity in the country.

These banks range from community banks serving local neighborhood needs to the nation’s largest most internationally active banks.

The OCC Headquarters is in Washington D.C., with four district offices in New York, Chicago, Dallas, and Denver. The OCC employs about 3,600 employees nationwide in offices throughout the contiguous United States with most employees located in Washington, D.C. This population count changes throughout the year. The OCC is unique from most other federal government agencies because it has independent authority to offer its employees compensation and benefit programs that are not offered by other agencies. The OCC-sponsored benefit programs include, but are not limited to, dental insurance, AD&D, flexible spending accounts, short and long-term disability and 401(k) programs.

The OCC, for purposes of its governmental plans, is specifically exempted from Title I of the Employee Retirement Income Security Act.

1.4 SCOPE OF WORK

1.4.1 BACKGROUND

The OCC needs a contractor (i.e., a qualified insurance company – not insurance brokers/agencies) to provide for underwriting and administration of these benefits.

The Contractor shall provide a dental insurance program for the agency’s employees, retirees, and their eligible family members, as well as employees of the OFR and their dependents. OFR was established because of the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank”), as a small office (maximum headcount of 250 employees) within the Department of the Treasury, but was given the same independent authority as the OCC. Since the OFR determined that they would not be able to obtain reasonable dental rates due to their small size, they determined that they would be best served if they joined with another governmental agency and became a part of their existing contract. In 2011 (when they were established) they chose to be a participant on the OCC’s dental insurance contract.

1.4.2 GENERAL

It is the intent of the OCC to provide a dental benefits program that will help to promote and maintain healthy living for its program participants. In support of the OCC’s efforts to educate employees on healthy living and their benefit options, the successful Contractor shall perform the following:

▪ Attend an onsite or virtual health benefits fair that is generally held on multiple days from November through December of every year. When providing on-site fairs, the Contractor must supply handouts and giveaways (ancillary dental items such as toothbrushes, floss, etc.) and be prepared to answer employee questions concerning the OCC Dental Insurance program. Travel reimbursement is not authorized and will not be paid by the Government.

▪ Support an OCC wellness fair at OCC’s headquarters location (Washington, DC) by arranging for the attendance of a professional in the health field (at no additional cost to the OCC) who must provide free demonstrations of their services or products. In the year that the OCC hosts a wellness fair, the OCC will notify the Contractor within 90 days of the event date. Travel reimbursement is not authorized and will not be paid by the Government.

▪ Host a bi-annual online seminar to educate employees on the dental benefits and, claims process, and full-time student verification process.

Dental Insurance Plan Options. Employees are offered a choice between a dental Nationwide PPO option or a DHMO option. Regardless of the option selected or the number of persons covered, the OCC pays 100% of the premium. However, retirees pay 100% of the premium based on the coverage tier they elect, which can be retiree only, retiree plus one, or retiree and their eligible family members.

Dental Insurance Program Guide. The Contractor shall provide a detailed dental insurance program guide that outlines all program benefits to include, but is not limited to, plan design, program requirements, limitations, and exclusions. The program guide will be identified as the official statement of benefits.

The Contractor shall provide services in accordance with this SOW regardless of the actual number of services or fluctuation in services. Any information in this SOW regarding estimated or historical services is intended to aid the Contractor in understanding the requirements associated with the services.

1.4.3 ELIGIBILITY

All full-time and part-time employees who are hired on an appointment that is expected to last more than one year are offered the opportunity to enroll in the program. OCC and OFR employees can elect coverage for their eligible dependents as follows:

• A lawful spouse or domestic partner (same or opposite sex);

• Children (defined as a natural, step, foster, legally adopted, or child of the domestic partner) up to age 22 26, no requirements to be a full or part-time studentor up to age 25 if the child is a full-time student; and

• A child that has been deemed “disabled” under the certification guidelines of the Federal Employees Health Benefits program. Eligibility must be established before the child obtains age 2226, and the disability must be certified by a physician that a child is permanently and totally disabled and incapable of self-support.

1.4.4 ENROLLMENTS AND EFFECTIVE DATES

Below is a chart that identifies all the enrollment opportunities.

Life Event Description Time Limit Effective Date

New Hire

Initial enrollment opportunity to select the dental option of choice and to enroll dependents without the submission of proof of relationship documentation*

60 days from date of hire

First of the month following receipt of enrollment form

Change in Employment Status from Non- Benefit Eligible to Benefit Eligible

Initial enrollment opportunity to select the dental option of choice and to enroll dependents without the submission of proof of relationship documentation*

60 days from date of change in employment status

First of the month following receipt of enrollment form

Gaining a New Dependent

Marriage, establishment of domestic partner relationship, birth, adoption, placement of foster child, stepchild or child of a domestic partner and it requires the submission of documentation to verify the event

60 days from date of the event

First of the month following receipt of enrollment form

Open Season

Annual period identified by the OCC which allows for the addition of dependents to be added without proof of relationship documentation* - OR – the opportunity to change options

Generally, a 4-week period between November and December

January 1 of the year following the open season period

Moving at least 30 miles outside of the DHMO servicing area

Opportunity to change from the DHMO to

PPO

60 days from the date of change in address

First of the month following receipt of enrollment form

*Except for domestic partnerships and the enrollment of a disabled dependent or a dependent child aged 22 or older who is a full-time student.

Additionally, there are a few other events that may occur which will allow an employee to change their enrollment in the program. They are as follows:

Event Description Time Limit Effective Date

Retirement

Employee elects to receive an immediate annuity from one of the federal retirement systems and they can elect the PPO option

60 days from date of retirement

First of the month following receipt of enrollment election

Approval of Disability Retirement

Office of Personnel Management (OPM) approves an employee’s claim to receive disability retirement benefits

Immediately upon receipt of OPM approval notification

Day following the employee’s date of separation

Buyout

Employee terminates from the OCC under a “severance” type of agreement and continues coverage for six months

60 days from the date of separation

Day following the employee’s date of separation

1.4.5 TERMINATION OF ENROLLMENT

When an employee’s employment ends, their coverage terminates on the date of their separation.

A separated employee is not extended the option to continue coverage beyond their date of separation unless one of the following occurs:

1. Employee retires from the OCC on an immediate annuity;

2. Employee is approved for disability retirement by OPM;

3. Employee is offered a “buyout” by the OCC; or

4. Employee dies and any dependents enrolled on their plan will be extended 24 months of coverage, at which time the policy will terminate.

Coverage for a dependent will terminate when:

1. The employee’s coverage is terminated;

2. The dependent child attains age 22 26 or if certified as a full-time student on their 25th birthday;

3. A dependent child under age 25 26 gets married;

4. The dependent dies;

5. The employee divorces their spouse or terminates their relationship with their domestic partner;

6. A stepchild or a child of the domestic partner is no longer in a “parent-child relationship” with the employee; or

7. The employee chooses to drop the dependent from coverage during open season or outside of open season. In this scenario, the employee can re-enroll the dependent during any open season only.

1.4.6 SURVIVOR BENEFITS

Upon the death of an employee or disabled retiree, the surviving dependents that are enrolled on the employee’s plan will be extended 24-months of coverage, at which time the policy will terminate.

1.4.7 STUDENT VERIFICATION

The OCC requires that once a dependent child attains age 22, verification of enrollment in an accredited college or university is required. The responsibility for requesting, reviewing, and updating the dependent child’s continued eligibility is that of the Contractor. The Contractor shall send employees email notifications of the requirement to supply the student verification documentation of full-time student status 30, 60, and 90 days prior to the dependent child’s 22nd birthday. The notification is to address, at a minimum, the following:

1. Identify the minimum number of hours per semester that qualifies as a “full-time” student for both undergraduate and graduate enrollment.

2. Identify any specific information that must be contained in the documentation.

3. Identify where to submit the documentation and due date for submission.

The Contractor shall provide an online method for employees to safely and securely submit documentation, including Personally Identifiable Information (PII), to the Contractor directly. Once documentation is received, the Contractor is to update the dependent child’s eligibility with some type of full-time student indicator. The Contractor shall notify the employee of its decision for continuation of coverage. The Contractor shall collaborate with the OCC on all notices to employees. The Contractor shall provide notices and reports as described below and, in the chart, labeled required program deliverables. The Contractor shall manage this process for new hires, open season, and annual recertification.

Student Verification Task Requirement Summary Action Requirement

Contractor shall administer the full-time student verification requirement of this contract.

Offeror’s student verification report that identities the following:

• Name and date of birth of dependent child

• Employee’s name

• Date of coverage termination

• Date of reinstatement of coverage due to receipt of student verification documentation

• Date email notifications sent to employee (30, 60, 90-day notices)

• Send written notification to the employee at least 30, 60, and 90 days prior to the dependent child’s upcoming coverage termination.

• Administer the coverage eligibility of a dependent child attaining age 22 or extend coverage beyond age 22 up to age 25 if full-time student requirement is met.

1.4.87 FUNDING AND PAYMENT SCHEDULE

The program is fully insured, and the OCC pays 100% of the premium for both the PPO and DHMO options for active employees, disabled retirees, survivors, buyout employees and OFR active employees (this also includes employee who are in a leave without pay status or on military leave) and dependents. The monthly premium is “composite rated.” However, the OCC does not share in the cost of the premium for the non-disabled retirees and their premium rate consist of a 3-tier rate (Single, 2-Person, and Family) for which participants pay 100% of the premium. Attachment (4) includes further details on premium rate history.

The Contractor shall invoice the OCC monthly for payment for services for OCC and OFR active employees, OCC disabled retirees, survivors, and buyout employees. Non-disabled retirees shall be directly billed by the Contractor and the Contractor shall give them flexible payment options.

The OCC has a unique funding arrangement for its dental program which is a fully insured participating arrangement with a Premium Stabilization Reserve (PSR) account that is held by the Contractor. If claim costs are less than the premium paid for the year, then the extra money (after administrative expenses and profit are deducted) is held in the PSR and used for future rate reductions or a premium holiday. The contractor shall comply with this funding arrangement. Attachment (5), PSR Funding Agreement, provides further details regarding the specifics of the agreement.

Funds will be obligated at time of award for the base period (or at the time each option period is exercised if the Government chooses to exercise an option). Funds will be added to the contract by modification for eligible employees who are hired after July 1 of that period of performance, if needed. The Contractor agrees this incremental funding may be added by OCC via unilateral modification. The Contractor shall notify the Contracting Officer (CO) when 75% of the funds on any CLIN have been invoiced to the OCC. The Contractor shall provide an estimate of additional funds required for the remainder of the period of performance. The Contractor shall invoice the OCC monthly for payment for services for OCC and OFR active employees, OCC disabled retirees, survivors, and buyout employees in accordance with the PPO and DHMO plans outlined in Attachments (2) and (3). Non-disabled retirees shall be directly billed by the Contractor, and the Contractor shall give them flexible payment options.

1.4.98 PLAN DESIGN

The Contractor must provide dental insurance benefits with a plan design that covers a Preferred Provider Organization (PPO) plan option and a Dental Health Maintenance Organization (DHMO) plan option.

1.4.10 9 WEBSITE AND ENROLLMENT ADMINISTRATION TOOLS

Benefits Administration Tool. At a minimum, the Contractor shall provide a safe and secure electronic system to maintain enrollment data. The Contractor shall provide the OCC’s Human Capital (HC) staff access to the system for the purpose of processing new hire enrollments, qualifying life events, and open season changes. The Contractor shall provide training (and training materials) to the OCC’s HC staff on the use of their system. The Contractor shall troubleshoot any issues with processing enrollments.

The Contractor shall provide information about their capability to provide a self-service electronic enrollment tool to facilitate new hire elections, qualifying life events, and open season changes.

The Contractor shall provide an electronic method for non-disabled retirees to elect the dental PPO option, and provide payment options for the non-disabled retirees to pay directly to the Contractor.

Website. The Contractor shall provide a customized and accessible website for the OCC dental insurance program. At a minimum, this website shall have the capability for enrollees to search for PPO in-network and out-of-network dentists, DHMO dentists, options to print ID cards, plan information, Frequently Asked Questions, program guide, and voluntary retiree information. The Contractor shall also provide an electronic method for employees to upload documents related to the verification of full-time student status to the Contractor directly.

Member Portal. The Contractor shall provide the capability for employees to register and access their member record. At a minimum, the portal shall include demographic information, options to view/print explanation of benefits (EOB), view/print ID cards, list dependents, and show a summary of dental plan option benefits. See section 1.11 below for specific security requirements.

Data File Exchanges. The Contractor shall have the capability to exchange data files with the OCC via a Secure File Transfer Protocol site established by the Contractor. The Contractor shall have the capability to generate an alternate ID number to use in lieu of employees’ Social Security Number (SSN). The Contractor shall not use full or partial SSNs as the employees’ alternate ID. The Contractor shall collaborate with the OCC IT Data Warehouse to establish data files necessary to administer the program. The Contracting Officer’s Representative (COR) will provide contract information for the Data Warehouse points of contact to the Contractor.

Future OCC Benefits Enrollment Platform. At any point during the period of performance, the OCC reserves the right to implement its own benefits enrollment platform to manage dental enrollment data for its dental insurance program. If the OCC implements its own benefits enrollment platform at any future date, the Contractor shall collaborate with the OCC to transition enrollment data and participate on the project team to ensure there is a smooth transition.

1.5 KEY PERSONNEL REQUIREMENTS

The Contractor shall provide a single point of contact that will serve as a liaison to the OCC to address day-to-day matters, per 1052.215-8003 Key Personnel, referred to as the “account manager”. This person must ensure that all issues are addressed and responded to in a timely manner, including tracking issues electronically (i.e., incident log), until the issues are resolved.

If an issue cannot be resolved by the next business day, then the person must provide the OCC with a reasonable date that the issue will be resolved. This individual shall have a minimum of three years of account management experience in the insurance industry.

Action Requirement Offeror’s day-to-day point of contact shall be responsive to the OCC in a timely manner.

Offeror’s day-to-day point of contact's electronic incident log which is to be sent to the OCC on a quarterly basis.

Respond to any issues brought to their attention by the next business day (if not with a resolution, should at least provide an acknowledgement of the issue and next steps);

• Ensure that eligibility and retiree billing issues are resolved in a satisfactory manner; and

• Ensure that the OCC is notified of any system outages at the earliest possible time but no later than on the day that the outage occurs.

1.6 CLAIMS EXPERIENCE

The Contractor shall process all claims accurately and in accordance with the time limit listed below. The Contractor shall provide OCC employees with written notification of its claims appeal process. The Contractor shall also ensure that employees have access to a safe and secure online system where they can view the status of a claim and print copies of the EOB statements for previously filed and adjudicated claims. The Contractor must have an option to opt out of paper mailings for claims and EOBs. The Contractor shall provide a method for the employee to obtain a pre-treatment estimate.

Action Requirement Contractor is to adjudicate claims timely and accurately with no more than a 1% error rate:

• Ensure that claim determinations are made within 14 calendar days of receipt, but no more than 30 calendar days; and

• EOB statements are mailed to the claimant's address on file within 5 business days of claims adjudication.

Offeror’s Claims Turnaround Report (CTR) that identifies the following:

• Date of receipt of claim,

• Date the claim was adjudicated, and

• Date the EOB was mailed.

The CTR is to be sent to the OCC monthly.

1.7 PERIOD OF PERFORMANCE

The OCC is awarding a contract with a 12-month base period and nine one-year options.

There shall be a three-month transition period (date of award April 1, 2025, through June 30, 2025) included in the base period. There will be a line-item, that is not separately priced, for the transition period from the date of award to June 30, 2025, to facilitate the enrollment of OCC and OFR employees. Insurance coverage services shall commence on July 1, 2025. See clause OCC 1052.242-8002 for period of performance dates and details.

1.8 PLACE OF PERFORMANCE

The Contractor shall perform all its duties relating to this contract at the Offeror’s work location.

1.9 DELIVERABLES

The Contractor shall produce the following items:

Program Deliverables Description Due Date

Dental Program Guide Official statement of benefits outlining all program details

Annually by the first month of the active period of performance

Claims Expense Summary Lists the total claim dollars paid and broken out by primary member and dependents.

Quarterly within the first 30 days of the quarter

Enrollment Summary Identifies active primary members and their dependents.

Monthly within 30 days of the initial report

Member Termination Report

Identifies members that were terminated within the reporting Period.

Monthly within 30 days of the initial report

New Member Report Identifies all new enrollments or reinstated enrollments.

Monthly within 30 days of the initial report

Implementation Plan Lays out al I of the tasks involved in the execution of the implementation of this contract.

During the transition period and before services start 7/1/2025

Implementation Communication Materials

Flyers and email communication documents that describe the process for handling any services that started prior to 7/1/2025

During the transition period and before services start 7/1/2025

Student Verification Notice

Written notice to primary member that their dependent child's eligibility will end on the child's 22nd birthday if verification of full-time student enrollment is not received within 30, 60, and 90 days of the date of the notification.

Notices should also be sent to new hires and each year after the initial notice of approval.

30, 60, and 90 days prior to the child's 22nd birthday;

within 30 days of a new hire enrollment; annually after initial notice

Student Verification Report

List the applicable information for a dependent child who is age 22 or older and is required to submit full-time student verification documentation. Report should include all data points related to this process.

Monthly within 30 days of the initial report

Dependent Age 22 Report List of dependent children who will turn age 22 each year Annually – January 1

Direct Billing Invoices Notices to non-disabled retirees of the required premium to be paid.

Monthly within 30 days of the initial report

Annual Premium Notices Letter to non-disabled retirees notifying them of premium rates in effect for the year.

Annually- November 1st

Claims Turnaround Report Identifies the PPO and DHMO claims received and turnaround information on the claims adjudication process.

Monthly within 30 days of the initial report

Day-to-Day Contact's Incident Log

Identifies each time contact is made by the OCC of a request of notification of an issue that needs to be resolved.

Quarterly within the first 30 days of the quarter

1.9.1 ACCEPTANCE/REJECTION PROCEDURES

The COR will review all deliverables to ensure accuracy, functionality, completeness, professional quality, and overall compliance with the guidelines/requirements. The Contractor shall ensure the accuracy and completeness of all deliverables. Unless otherwise indicated, the Government will require ten (10) business days to review and/or comment on or accept deliverables. Errors, misleading or unclear statements, incomplete or irrelevant information, and/or excessive rhetoric, repetition, and/or "padding", shall be considered deficiencies and shall be subject to correction by the Contractor, at no additional cost to the Government. If the deliverable does not meet the noted criteria, the Government will return it for correction at no cost to the OCC.

If the COR rejects any deliverable, that rejected document will be handled in the following manner:

1.9.1.1 After notification that the deliverable did not meet the acceptance criteria, the Contractor shall re-submit an updated/corrected version within five 5 business days after receipt of Government comments. The Government will provide specific details as to why the deliverable is not acceptable.

1.9.1.2 Upon re-submission by the Contractor, the Government will reapply the same acceptance criteria. If the deliverable does not meet the acceptance criteria a second time, in addition to the Contractor being required to again fix the deficiencies, the incident may adversely impact the Contractor’s Contractor Performance Assessment Reporting System (CPARS) rating.

1.10 SECTION 508

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to, and use of, information and data that is comparable to people without disabilities. As such, the following requirements apply to this solicitation:

1. Products, platforms, and services delivered as part of this work statement that are ICT, or contain ICT, must conform to the Revised 508 Standards, which are located at 36 C.F.R.

§ 1194.1 & Apps. A, C & D, and available at https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines.

2. E102 / 702.10 – Web Content Accessibility Guidelines (WCAG) 2.0 guidelines success criteria level A & AA are incorporated as a requirement. The referenced WCAG criteria is available at http://www.w3.org/TR/WCAG20/.

3. A completed Accessibility Conformance Report (ACR) found at https://www.itic.org/policy/accessibility/vpat, using Voluntary Product Accessibility Template (VPAT) Revised Section 508 Edition, Version 2.5, is required to assist the Government in determining that the ICT products or services support Section 508 accessibility standards.

4. E202 – General Exceptions Authorized by OCC as applicable.

The following items are identified as containing ICT:

• Software Applications & Operating Systems

• Web-based Intranet and Internet Information and Applications

• Information, Documentation, and Support

Applicable Functional Performance Criteria: All functional performance criteria apply when using an alternative design or technology that achieves substantially equivalent or greater accessibility and usability by individuals with disabilities than would be provided by conformance to one or more of the requirements in Chapters 4-6 of the Revised 508 Standards, or when Chapters 4-6 do not address one or more functions of ICT.

Applicable requirements for software and Web products:

• E207 – WCAG Level A & AA Success Criteria

• E302 – Functional Performance Criteria

• E502 – Interoperability with Assistive Technology

• E503 – Application

Applicable requirements for electronic documents and/or support services:

• E205 – WCAG Level A & AA Success Criteria

• E302 – Functional Performance Criteria

• E602 – Support Documentation

• E603 – Support Services

1.11 SECURITY AND PRIVACY REQUIREMENTS

A. Compliance with Applicable Laws, Regulations, and Standards https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines http://www.w3.org/TR/WCAG20/ https://www.itic.org/policy/accessibility/vpat

Secure User-to-Cloud Communications Standards. All user-to-cloud service communications (e.g., via internet) must be encrypted with the latest industry standard browser protocol.

B. General Requirements

Location. Information collected, viewed, used, stored, maintained, or otherwise processed by the contractor in the performance of this contract shall be accessed, transferred, stored or processed only within the United States. In addition, the maintenance and support operations of the Offeror’s technology and information must take place, and originate from, within the United States.

US Persons: Federal employees, contractors, subcontractors, experts, consultants, and paid/unpaid interns hired for work within the United States or its territories and possessions and who require access to sensitive Controlled but Unclassified Information (CUI), like Personal Identifiable Information (PII), IT systems or security items or products, shall either be U.S.

citizens or have lawful permanent resident alien status (green card holders).

The contractor shall not host any portion of the information, information system, infrastructure, or environment in facilities outside the contiguous United States, Alaska, Hawaii, and other U.S.

Territories.

Authorization to Use, Store, or Share Sensitive Information. The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The contractor shall also protect all government data, equipment, etc. by treating the information as Controlled but Unclassified (CUI) information. All information gathered or created under this contract shall be considered as (CUI). It is anticipated that this information will be gathered, created, and stored within the primary work location. If contractor personnel must remove any information from the primary work area, they shall protect it to the same extent they would their proprietary data and/or company trade secrets.

Confidentiality. The contractor agrees to assume responsibility for protecting the confidentiality of government records and data associated with this contract, which are not public information.

Deliverables. The deliverables in this contract will be considered CUI and shall not be shared with any other organization without prior written approval from the Information System Security Officer (ISSO).

C. Security and Privacy Authorization

Authorization Boundary. The contractor shall provide a security architecture diagram(s) specific for the OCC, that clearly demarcates the information system authorization boundary and depicts all of its connections, ports, protocols, functions, services, and components, including the means for monitoring and controlling communications at the external boundary and at key internal boundaries within the system. The contractor shall address all components, connections, ports, protocols, security controls, and managed interfaces of the information system authorized for operation (e.g., routers, firewalls). The diagram must include a predominant border drawn around all system components and services included in the authorization boundary. If there are OCC-specific components (e.g., components developed or customized for the OCC, OCC-hosted components, etc.) and/or other components supporting this solution that are not in the scope of the Offeror’s existing security documentation, then identify those components in the diagram as well, as part of a separate OCC-specific boundary since those are unique to OCC and shall be part of the OCC-specific security authorization. The diagram must be easy to read and understand. Formal names of components as they are known at the service provider organization in functional specifications, configuration guides, other documents and live configurations shall be named on the diagram and described. The contractor shall provide a key for symbols used.

This diagram shall be delivered to the Everbridge COR, Enterprise Architect, and Information System Security Officer.

External Service Provider Compliance & Monitoring Background. The FISMA and OMB policies require that federal agencies using external service providers to process, store, or transmit federal information or operate information systems on behalf of the federal government, assure that such systems meet the information security protections commensurate with the information and system sensitivity. Federal agencies are responsible and accountable for the information security risk incurred by the use of information system services provided by external providers.

Such risk is addressed by incorporating the Risk Management Framework (RMF)1 and security requirements for external information systems and services as part of the terms and conditions of the contracts with external providers. Federal agencies can also require external providers to provide appropriate evidence to demonstrate that they have complied with protecting federal information. Prior to the implementation of the Offeror’s system or services, the OCC ensures compliance with the RMF by issuing an Authorization to Operate (ATO) or Authorization to Use (ATU), based on its review and analysis of the external provider's security documentation (described in detail in the next section) and assessment of customer (OCC's) security responsibilities.

1. NIST Special Publication 800-37, as amended, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy.

Non-Federal External Service Provider Security Documentation. Non-federal organizations with primarily non-federal customers have limitations with respect to complying with all federal requirements. As a result, the OCC obtains assurance through other industry standard security reviews, including Statement on Standards for Attestation Engagements (SSAE) No. 19.

a. Statement on Standards for Attestation Engagements (SSAE) No. 19 Requirements. The contractor shall provide the OCC with an SSAE No. 19 System and Organization Controls (SOC) 2 Type 2 Report on an annual basis for services provided.

b. The preferred coverage period for the report is July 1 through June 30 with a bridge letter covering the three months to September 30.

c. For any gaps in the fiscal year coverage period (October 1 - September 30), the OCC will work with the contractor to complete the internal controls assessment by relying on the work performed by the Offeror’s competent and objective internal audit function per Statement on Auditing Standards No. 128, Using the Work of Internal Auditors.

d. The submission of the results of the SSAE No. 19 SOC 2 Type 2 Report shall be as instructed per the "Security and Privacy Vendor Deliverables" section.

e. If SOC 2 Type 2 reports are not available within the last three years, the contractor shall inform the OCC to determine if there is a suitable alternative with similar level of information and detail.

f. If any portion of standard security objectives (e.g., contingency planning controls, etc.)

were not in the scope of the independent auditors testing, then the contractor shall provide a bridge letter to identify the type of test, date of test, and third party who performed the testing of those security objectives not covered by the SOC 2 Type 2 report. The contractor shall also summarize any deficiencies identified by the auditor in the bridge letter.

2. OCC Security Authorization to Use. The determination of whether to issue an OCC security authorization will be made by the OCC based on the identified risks to the OCC's data and operations. These risks include: (1) deficiencies noted in the Offeror’s most recent SOC 2 Type 2 Report, (2) the gaps identified in the IT security and privacy control assessments performed specific to OCC customer responsibility implementations as designated in the CRM.

D. Configuration Management

Security Configuration Settings. The contractor shall establish and enforce security configuration settings for information technology products employed in the ISSO.

Security Updates and Patches. The contractor shall ensure that the Dental IT system is properly maintained and monitored, to include immediate response to critical security patches, routine maintenance windows to allow for system updates, and compliance with the defined configuration management and change control processes. All patches and system updates shall be properly tested in a development environment before being implemented in the production environment.

Least Functionality. The contractor shall restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services for information technology products employed in the Dental IT system.

E. Continuous Monitoring

Compliance Reviews and Audits. The contractor shall permit and support compliance reviews and audits under applicable laws to allow the OCC to meet legal and compliance obligations and shall implement processes that allow visibility into the privacy and security controls employed and their effectiveness. The contractor shall provide the OCC or authorized designated officials with information requested by auditors in a timely manner, consistent with the respective auditor's deadline, in support of security compliance reviews and various annual audits, e.g., FISMA, Financial Statement Audit, A-123, etc.

In addition, the contractor shall provide the OCC or authorized designated officials logical and physical access to the Offeror’s facilities, installations, technical capabilities, operations, records, and databases pertinent to this contract within seven (7) calendar days upon request for these purposes.

Annual SOC 2 Type 2 Reviews. As mentioned in this SOW. "Security and Privacy Authorization," under SSAE No. 19 requirements, the contractor shall provide the annual SSAE No. 19 SOC 2 Type 2 report to the OCC for review in support of continuous monitoring activities. If any portion of standard security objectives (e.g., contingency planning controls, etc.) were not in the scope of the independent auditor's testing, then the contractor shall provide a bridge letter to identify the type of test, date of test, and third party who performed the testing of those security objectives not covered by the SOC 2 Type 2 report. The contractor shall also summarize any deficiencies identified by the auditor in the bridge letter.

Logging. The service provider must provide OCC audit access to any FIPS 199 Moderate, or higher data encrypted at rest and in motion in the commercial cloud at an Event Logging (EL) maturity level of EL3. An example of EL2 requirements, which is required to be satisfied for EL3, can be found in the Copy of CISA Enterprise Logging Data Convention Link. Detailed EL3 requirements are listed in OMB Memorandum M21-31.

The service provider shall forward all required logging data, in near real-time and on an automated basis, to centralized systems responsible for security, information, and event monitoring Security Event and Incident Management (SEIM) e.g., SPLUNK; bulk storage; and other analytical workflows or services. Data must be encrypted in transit between its source and destination.

F. Data Protection

Data Encryption. Where encryption is required, as specified by the OCC, the contractor shall ensure that encryption is established and maintained for data at rest and in transit for the duration of the contract. The encryption employed shall be equivalent to those approved in Federal Information Processing Standards (FIPS) Publication 140-2 or 140-3.

Need to Know. CUI/Sensitive information, data, and/or equipment will only be disclosed to authorized personnel on a Need-To-Know basis. The contractor shall ensure that appropriate administrative, technical, electronic, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected.

Such measures include controls listed in NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, as amended, in the following areas:

Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, and System and Information Integrity.

Data Separation. Unless otherwise directed by the OCC and/or controls are implemented to ensure adequate separation, any storage of data shall be contained within the resources allocated by the contractor to support the OCC and may not be on systems that are shared with other commercial or government clients.

General Use of Controlled Unclassified Information (CUI). The contractor shall not use any CUI or CUI subcategories, including, Personally Identifiable Information (PII) or low-sensitivity PII (e.g., E-mail Groups and Lists), for any purpose other than those activities necessary to the performance of this contract.

Use of Contractor Equipment. Use of contractor-owned laptops or other equipment (e.g., media storage devices, servers, etc.) to process, transmit, or store OCC information or to access the OCC network or other OCC information resources without OCC's formal approval is prohibited. This restriction does not apply to the use of non-OCC laptops or PCs to use OCC-approved virtual desktop infrastructure to remotely access the OCC network.

G. Incident Response

Notification. The contractor must report all information security incidents that potentially or actually cause the compromise of OCC information, even if the contractor believes the security incident may be limited, small, or insignificant with respect to OCC data or systems. The OCC will determine when the Offeror’s reported security incident requires additional focus and attention.

Within one hour from the time the contractor validates that an information security incident has occurred, the contractor must report the security incident information to the OCC Cyber Defense Center (CDC): Computer.Security@occ.treas.gov, (202) 649-7930, regardless of day or time.

The contractor must provide any supplementary information or reports related to a previously reported incident directly to the OCC CDC with the following text in the subject line of the email: “Supplementary Information/Report related to previously reported incident # [insert number].”

Do NOT include any Sensitive Information in the subject or body of any e-mail. To transmit Sensitive Information, use FIPS 140-2 compliant encryption methods to protect Sensitive Information in attachments to email. Passwords must not be communicated in the same email as the attachment.

When notifying the OCC CDC, copy the Contracting Officer if possible or, if reporting by phone or Contracting Officer's email is not immediately…