30-2025-009-DHB Asset Verification System RFP.pdf

Page 1 of 156 RFP #30-2025-009-DHB Asset Verification System Rev. April 21, 2025

STATE OF NORTH CAROLINA

Department of Health and Human Services

Division of Health Benefits

Request for Proposal #30-2025-009-DHB

Asset Verification System

Page 2 of 156 RFP #30-2025-009-DHB Asset Verification System Rev. April 21, 2025

Request for Proposal

#30-2025-009-DHB

For internal State agency processing, please provide your company’s Federal Employer

Identification Number or alternate identification number (e.g., Social Security Number). Pursuant to North Carolina General Statute 132-1.10(b) this identification number shall not be released to the public. This page will be redacted before the procurement file is made available for public inspection.

This page is to be filled out and returned with your Proposal.

ID Number:

Federal ID Number or Social Security Number

Offeror Name

Page 3 of 156 RFP #30-2025-009-DHB Asset Verification System Rev. April 21, 2025

FOR STATE USE ONLY: Offer accepted and Contract awarded this ____ day of _______________, 20____, by

(Authorized Representative of NC Department of Health and Human Services)

EXECUTION

In compliance with this Request for Proposal (RFP), and subject to all the conditions herein, the undersigned Offeror offers and agrees to furnish and deliver any or all services proposed, at the cost proposed and within the time specified herein. By executing this proposal, the Offeror confirms it has read, understands, and will comply with all specifications and requirements in the RFP and any addenda in the event of contract award. By executing this proposal, the undersigned Offeror certifies that this proposal is submitted competitively and without collusion (N.C. Gen. Stat. § 143-54), that none of its officers, directors, or owners of an unincorporated business entity has been convicted of any violations of Chapter 78A of the General Statutes, the Securities Act of 1933, or the Securities Exchange Act of 1934 (N.C. Gen. Stat. § 143-59.2), and that it is not an ineligible Contractor as set forth in N.C. Gen. Stat. § 143-59.1. False certification is a Class I felony. Furthermore, by executing this proposal, the undersigned certifies to the best of Offeror’s knowledge and belief, that it and its principals are not presently debarred, suspended, proposed for debarment, declared ineligible or voluntarily excluded from covered transactions by any Federal or State department or agency. As required by N.C. Gen. Stat. § 143-48.5, the undersigned Offeror certifies that it, and each of its subcontractors, for any Contract awarded as a result of this RFP, complies with the requirements of Article 2 of Chapter 64 of the NC General Statutes, including the requirement for each employer with more than 25 employees in North Carolina to verify the work authorization of its employees through the Federal E-Verify system. N.C. Gen. Stat. § 133-32 and Executive Order 24 (2009) prohibit the offer to, or acceptance by, any State Employee associated with the preparing plans, specifications, estimates for public Contract; or awarding or administering public Contracts; or inspecting or supervising delivery of the public Contract of any gift from anyone with a Contract with the State, or from any person seeking to do business with the State. By executing this proposal, you attest, for your entire organization and its employees or agents, that you are not aware that any such gift has been offered, accepted, or promised by any employees of your organization. Failure to execute/sign proposal prior to submission shall render proposal invalid and it WILL BE REJECTED. Late proposals will not be accepted.

OFFEROR:

STREET ADDRESS: P.O. BOX: ZIP:

CITY & STATE & ZIP: TELEPHONE NUMBER: TOLL FREE TEL. NO:

PRINCIPAL PLACE OF BUSINESS ADDRESS IF DIFFERENT FROM ABOVE

PRINT NAME & TITLE OF PERSON SIGNING ON BEHALF OF OFFEROR: FAX NUMBER:

OFFEROR’S AUTHORIZED SIGNATURE: DATE: EMAIL:

Offer valid for at least 240 calendar days from date of proposal opening unless extended by the State in writing. After this time, any withdrawal of offer shall be made in writing, effective upon receipt by the agency issuing this RFP.

ACCEPTANCE OF RESPONSE

If any or all parts of this proposal are accepted by the State of North Carolina, an authorized representative of the Department of Health and Human Services shall affix his/her signature hereto and this document and all provisions of this Request for Proposal along with the Offeror’s proposal, and the written results of any negotiations shall then constitute the written agreement between the parties. A copy of this acceptance will be forwarded to the successful Offeror.

Department of Health and Human Services

Refer ALL Inquiries regarding this RFP to:

Kevin Barlage, Contract Specialist Kevin.Barlage@dhhs.nc.gov

Request for Proposal # 30-2025-009-DHB

Date RFP Issued/Posted: 4/21/2025

Date RFP Submissions due to the Department: 6/20/2025 at 2:00 p.m. EST

Proposals will be opened: 6/20/2025

Contract Type: Open Market

Commodity Number: 811620 - Cloud-based software as a service

Description: Asset Verification System Using Agency: Department of Health and Human Services, Division of Health Benefits Requisition No.: N/A

Page 4 of 156 RFP #30-2025-009-DHB Asset Verification System Rev. April 21, 2025

Table of Contents

1.0 General Procurement Information and Notice to Offerors

1.1 Important Notices

1.2 Procurement Information

1.3 Request for Proposal Functionality and Related Notices

1.4 Schedule and Important Events

2.0 Purpose of RFP

2.1 Introduction

2.2 Contract Term

2.3 Contract Type

2.4 Agency Background

3.0 RFP Requirements and Specifications

3.1 Scope Of Work

3.2 General Requirements and Specifications

3.3 Security Specifications

3.4 Enterprise Specifications

3.5 Business and Technical Requirements

3.6 Business and Technical Specifications

3.7 Option Requirements and Specifications - Reserved

4.0 Cost of Vendor’s Offer

4.1 Offer Costs

4.2 Payment Schedule

5.0 Evaluation

5.1 Source Selection

5.2 Evaluation Criteria

5.3 Best and Final Offers (BAFO)

5.4 Possession And Review

6.0 Vendor Information and Instructions

6.1 General Conditions of Offer

6.2 General Instructions for Vendor

6.3 Instructions for Offer Submission

7.0 Other Requirements and Special Terms

7.1 Vendor Utilization Of Workers Outside of U.S

7.2 Financial Statements

7.3 Financial Resources Assessment, Quality Assurance, Performance and Reliability

7.4 Vendor’s License or Support Agreements

7.5 Resellers - Reserved

7.6 Disclosure Of Litigation

7.7 Criminal Conviction

7.8 Security and Background Checks

7.9 Assurances

7.10 Confidentiality of offers

7.11 Project Management

7.12 Meetings

7.13 Recycling and Source Reduction

7.14 Special Terms And Conditions

Attachment A: Definitions

Page 5 of 156 RFP #30-2025-009-DHB Asset Verification System Rev. April 21, 2025

Attachment B: Department of Information Technology Terms and Conditions Section 1: General Terms and Conditions Applicable to All Purchases Section 2: Terms and Conditions Applicable to Information Technology Goods and Services Section 3: Terms and Conditions Applicable to Personnel and Personal Services Section 4: Software as a Service (SaaS) Terms and Conditions (Only Applies to Proposed SaaS Solutions)

Attachment C: Agency Terms and Conditions Section 1: DHHS Division of Health Benefits (DHB) Section 2: DHHS Privacy and Security Office (PSO)

Attachment D: Description of Offeror Attachment E: Cost Proposal Attachment F: Vendor Certification Form Attachment G: Location of Workers Utilized by Vendor Attachment H: Vendor References/Past Performance Attachment I: Financial Review Form Attachment J: Enterprise Architecture Attachment K: Vendor Key Personnel Attachment L: Service Level Agreements Attachment M: Contract Administrators Attachment N: Deliverables And Milestones Schedule Attachment O: Business Continuity Plan Attachment P: Disaster Recovery Plan – Reserved Attachment Q: State Certifications Attachment R: Federal Certifications Attachment S: Business Associate Agreement Attachment T: Technical / Management Proposal Attachment U: Conceptual Architectural Diagrams Attachment V: Medicaid Integration Services Core Capabilities Attachment W: Work Products Attachment X: Request for Proposed Modifications to The Terms and Conditions Attachment Y: Minimum Qualifications Attachment Z: Historically Underutilized Businesses

Page 6 of 156 RFP #30-2025-009-DHB Asset Verification System Rev. April 21, 2025

1.0 GENERAL PROCUREMENT INFORMATION AND NOTICE TO OFFERORS

1.1 IMPORTANT NOTICES

Offerors are Cautioned to Read Carefully

1.1.1 READ, REVIEW, AND COMPLY

It shall be the Offeror’s responsibility to read this entire document, review all enclosures and attachments, and any addenda thereto, and comply with all requirements specified herein, regardless of whether appearing in these Instructions to Offerors or elsewhere in this RFP document.

1.1.2 EXECUTION OF PROPOSAL

Failure to sign the Execution Page in the indicated space and return all attachments, tables, charts, exhibits, diagrams, and appendices completed and signed where required shall render the proposal non-responsive, and the proposal may be rejected.

1.1.3 RESULTING CONTRACT

Under the State’s procurement process, any contract resulting from this RFP will consist of the RFP and the Offeror’s response, along with any addenda to the RFP, written Clarifications, Best and Final Offers (BAFO), and negotiation documents. The Contractor will be obligated to perform services as proposed in its offer, unless otherwise modified by Clarification, BAFO, negotiation, or Contract amendment, or superseded by a document with higher order of precedence. See Attachment C:

Agency Terms and Conditions, Section 1, Paragraph 14 Entire Agreement and Order of Precedence, of this document for more information and the order of precedence of the contract documents. See paragraph 1.3 Request for Proposal Functionality and Related Notices in this section for more information on the RFP, changes in specifications, and instructions regarding modifications to the terms and conditions.

1.1.4 POTENTIAL NEGOTIATIONS

The Department reserves the right to enter into negotiations with one or more Offerors to establish a contract that is in the best interest of the Department. Negotiations are specific to each Offer and shall be conducted to maximize the State's ability to obtain the most advantageous offer based on the evaluation factors set forth in the RFP. Such negotiations are at the Department’s sole discretion and may result in modifications to the RFP and/or Offeror’s proposal/response to the RFP.

1.1.5 EVENTS AND DEADLINES

a. Pre-proposal Conference will be hosted by the Department on the date and time indicated in the RFP Schedule in Section 1.4.1.

b. Questions concerning this RFP must be submitted in writing by the date and time indicated in the RFP Schedule in Section 1.4.1.

c. Submission of Proposals will be accepted until the date and time indicated in the RFP Schedule in Section 1.4.1.

1.2 PROCUREMENT INFORMATION

1.2.1 INFORMATION AND DESCRIPTIVE LITERATURE

The Offeror shall furnish all information requested as part of this RFP. Each Offeror shall submit detailed information with their proposal (e.g., narratives, diagrams, exhibits, examples, sketches, descriptive literature, complete specifications) to support the services and products offered.

1.2.2 HISTORICALLY UNDERUTILIZED BUSINESSES

Page 7 of 156 RFP #30-2025-009-DHB Asset Verification System Rev. April 21, 2025

Pursuant to General Statute §143-48 and Executive Order #25 (2017), the Department invites and strongly encourages participation in this procurement process by businesses owned by minorities, women, disabled, disabled business enterprises and non-profit work centers for the blind and severely disabled. Contractor agrees to make a good faith effort to seek out and pursue opportunities to utilize HUBs, as defined in N.C.G.S. § 143-128.4, within the scope of services, including the use of subcontractors owned by HUBs.

1.2.3 MISCELLANEOUS

Pronouns, whether masculine, feminine, or gender-non-specific, shall be read to be inclusive of all genders and shall be read to include the plural and vice versa.

1.2.4 INFORMAL COMMENTS

The Department shall not be bound by informal explanations, instructions or information given at any time by anyone on behalf of the Department prior to or during the competitive process or after award, including but not limited to policy papers or any written or verbal statements whatsoever made outside of this RFP and any formal Addenda issued herewith. The Department is bound only by information provided in this RFP and in formal Addenda issued.

1.2.5 OFFEROR’S REPRESENTATIVE

Each Offeror shall submit with its proposal the name, title, email address, physical address, and telephone number of the person(s) with authority to bind the Offeror and answer questions or provide clarification concerning the Offeror's proposal. This information must be included in the Offeror’s proposal and response

1.2.6 INSPECTION AT OFFEROR’S SITE - RESERVED

1.3 REQUEST FOR PROPOSAL FUNCTIONALITY AND RELATED NOTICES

1.3.1 RFP FUNCTIONALITY

a. This RFP serves two functions:

i. Define the specifications of the Solution sought by the Department; and

ii. Provide the requirements and terms and conditions of any contract resulting from this procurement.

b. All Terms and Conditions in this RFP shall be enforceable. The use of phrases such as “shall”, “will”, “must”, “required”, and “requirements” are intended to create enforceable Contract conditions. In determining whether proposals should be evaluated or rejected, the Department will take into consideration the degree to which the Offeror has proposed or failed to propose solutions that are responsive to the Department’s needs as described in this RFP.

1.3.2 NOTICES REGARDING RFP AND TERMS AND CONDITIONS

a. It is the Offeror’s responsibility to read all instructions, terms and conditions, specifications, requirements, attachments and appendices, and any other components made a part of this RFP and comply with all instructions and directives. The Offeror is responsible for obtaining and complying with all addenda and other changes that may be issued relating to this RFP.

b. All questions and issues regarding any term, condition, instruction, or other component within this RFP must be submitted in accordance with Section 6.2.2. Questions Regarding this RFP.

If the Department determines that any changes will be made because of the questions asked, then such decisions will be communicated in the form of an Addendum posted on eVP. The Department may also elect to leave open the possibility for later negotiation and amendment of specific provisions of the Contract that have been raised during the question-and-answer period.

Other than through this process, and except as provided in Section 1.3.3 Proposed Modifications to Terms and Conditions, the Department rejects and will not be required to evaluate or consider any additional or modified terms and conditions submitted with Offeror’s

Page 8 of 156 RFP #30-2025-009-DHB Asset Verification System Rev. April 21, 2025 proposal. This applies to any language appearing in or attached to the RFP document as part of the Offeror’s proposal that purports to vary any terms and conditions, or Offeror’s Instructions therein to render the proposal non-binding or subject to further negotiation.

c. The Offeror’s proposal to this RFP shall constitute a firm offer. By execution and delivery of a proposal to this RFP, the Offeror agrees that any additional or modified terms and conditions, whether submitted purposely or inadvertently, or any purported condition to the offer, shall have no force or effect, and will be disregarded. Noncompliance with, or any attempt to alter or delete, this paragraph shall constitute sufficient grounds to reject the Offeror’s proposal.

1.3.3 PROPOSED MODIFICATIONS TO TERMS AND CONDITIONS

a. Offerors are urged and cautioned to inquire during the question period, in accordance with the instructions in this RFP, about whether specific language proposed as a modification is acceptable to or will be considered by the Department.

b. Identification of objections or exceptions to the terms and conditions in the proposal itself shall not be allowed and shall be disregarded or the proposal rejected.

c. If the Offeror wishes to suggest changes to any of the terms and conditions included In Attachments B and C of this RFP, those must be submitted in Attachment X: Request for Proposed Modifications to the Terms and Conditions. The Department, in its sole discretion, may consider any proposed modifications identified by the Offeror. Where necessary, any modification(s) to the terms and conditions agreed upon by the Department may be incorporated as part of an Addendum to the RFP, BAFO, negotiation document, Execution of Contract, or Contract Amendment after award. Other than through this process, the Department rejects and shall not be required to evaluate or consider any additional or modified terms, conditions, or instructions included in the Offeror’s proposal.

1.3.4 CHANGES IN REQUIREMENTS AND SPECIFICATIONS

a. The Offeror is cautioned that the requirements of this RFP can only be altered by written

Addendum issued or other documents issued by the Department as described in this RFP, and that oral or emailed communications from whatever source(s) are of no effect.

b. Any modification to specifications will be specified in an Addendum which shall be posted to eVP prior to the opening of proposals or through Negotiation after opening the proposals.

1.4 SCHEDULE AND IMPORTANT EVENTS

1.4.1 ANTICIPATED PROCUREMENT SCHEDULE

The Department will make every effort to adhere to the schedule detailed below in Table 1: RFP Schedule. The Department reserves the right to adjust the schedule and will post an Addendum on eVP for any schedule changes occurring prior to the opening of proposals.

Action Responsible Party Due Date Time (ET)

RFP Issued Department 04/21/2025

Register for Pre-Proposal Conference Offeror(s) 04/23/2025 10:00 am

Pre-Proposal Conference Offeror(s) and Department

04/24/2025 2:00 pm

Written Questions Deadline Offeror(s) 05/02/2025 2:00 pm

Page 9 of 156 RFP #30-2025-009-DHB Asset Verification System Rev. April 21, 2025

Action Responsible Party Due Date Time (ET)

Agency’s Response to Written Questions / RFP Addendum Issued

Department 05/09/2025

Proposals Due Offeror(s) 06/20/2025 2:00 pm

Proposals Evaluation Begins Department 06/23/2025

Estimated Contract Award Department 10/17/2025

Protest Deadline Responding Vendors

15 days after award

Table 1. RFP Schedule

1.4.2 PRE-PROPOSAL CONFERENCE

a. The Department will hold a virtual Pre-proposal Conference on the date and time indicated in the RFP Schedule in Section 1.4.1 for one hour via Microsoft (MS) Teams. No purchase is required to use the MS Teams app.

b. The purpose of the conference is to allow the Department to review key priorities and objectives of the RFP and to review the submission requirements and instructions.

c. While attendees may ask questions at the Pre-proposal Conference, the Department is not required to respond during the conference. The Department will respond to written questions per the process described in this RFP.

d. Potential Offerors are not required to attend the Pre-proposal Conference to submit responses to this RFP; however, they are urged and cautioned to attend the Pre-proposal Conference to apprise themselves of the conditions and requirements of the submission.

e. To ensure receipt of the video conference invite and instructions for participation, interested parties are required to pre-register for the conference by sending an email to Medicaid.Procurement@dhhs.nc.gov stating the name of the potential Offeror, the names and email addresses of representatives who will attend, the current title or role of each representative, and requests for a sign language interpreter or other accommodations.

Interested parties must pre-register at this email address by the date and time indicated in the RFP Schedule in Section 1.4.1.

f. The Department limits the number of representatives attending on behalf of each Offeror or organization to two (2) representatives to ensure adherence to videoconference capacity limits.

g. Audio and video recording will not be permitted. Statements and materials discussed at the conference are informational only, are not binding upon the Department and do not replace reading, reviewing and complying with this RFP.

h. Attendees will be required to announce their name or otherwise confirm their presence via a roll call during the video conference.

1.4.3 TABULATION OF PROPOSALS

The Department will post a tabulation on eVP. The Tabulation will include the name of each Offeror for which a proposal was opened. The Department will not post information regarding Offerors’ cost proposals.

mailto:Medicaid.Procurement@dhhs.nc.gov

Page 10 of 156 RFP #30-2025-009-DHB Asset Verification System Rev. April 21, 2025

2.0 PURPOSE OF RFP

2.1 INTRODUCTION

The North Carolina Department of Health and Human Services (“NCDHHS” or “Department”), Division of Health Benefits (“DHB”) seeks to procure an Asset Verification System (AVS) software solution, along with support and maintenance, to provide asset verification services that promotes eligibility integrity and reduction of fraud, waste and abuse through the identification and verification of financial assets of the Aged, Blind and Disabled (ABD) population applying for or receiving Medicaid.

Title VII, Section 7001(d) of P.L. 110-252 (Supplemental Appropriations Act of 2008) added Section 1940 of the Social Security Act [42 U.S.C. 1396w] , which requires all states to implement an electronic Asset Verification System (AVS) to verify and identify assets held by financial institutions on behalf of applicants for, and beneficiaries of, North Carolina Medicaid who are in the Aged, Blind and Disabled (ABD) eligibility category. The Aged are individuals that are 65 years of age or older. The Department is seeking an automated AVS solution that obtains electronic financial information for ABD applicants and beneficiaries subject to redetermination by submitting requests and receiving responses through NC FAST.

An AVS provides more accurate disclosure of the financial information of ABD applicants and beneficiaries.

Additionally, an AVS automated software solution reduces the need for manual requests and follow-up by staff, applicants, and beneficiaries.

Medicaid eligibility determinations are performed solely by the State’s local County Departments of Social Services (CDSS). In 2023, a total of approximately 500,000 Asset verification requests were made by the CDSS to determine eligibility of ABD applicants. After the initial Medicaid eligibility is determined, the CDSS eligibility staff are responsible for performing a re-determination of eligibility at least every twelve (12) months for each Medicaid beneficiary. Asset verification is required for the determination of eligibility in the adult Medicaid categories.

2.2 CONTRACT TERM

A contract awarded pursuant to this RFP shall have an effective date as provided in the Notice of Award.

The initial term shall be three (3) years unless otherwise stated in the Notice of Award and unless otherwise terminated in accordance with the Contract. After the initial term, the State shall have the option to extend the Contract for two (2) additional one (1) year periods at its sole discretion. Each year that the Contract remains in effect shall be a “Contract Year.” The Department will give the Contractor written notice of its intent whether to exercise each option year no later than thirty (30) Calendar Days before the end of the Contract’s then current term.

2.2.1 EFFECTIVE DATE

This solicitation, including any Exhibits, or any resulting contract or amendment shall not become effective nor bind the State until the appropriate State purchasing authority / official, or Agency official has signed the document(s), contract or amendment; the effective award date has been completed on the document(s), by the State purchasing official, and that date has arrived or passed. The State shall not be responsible for reimbursing the Vendor for goods provided nor Services rendered prior to the appropriate signatures and the arrival of the effective date of the Agreement. No contract shall be binding on the State until an encumbrance of funds has been made for payment of the sums due under the Agreement.

2.3 CONTRACT TYPE

Definite Quantity Contract - This request is for a close-ended contract between the awarded Vendor and the State to furnish a pre-determined quantity of a good or service during a specified period of time.

Page 11 of 156 RFP #30-2025-009-DHB Asset Verification System Rev. April 21, 2025

The State reserves the right to make partial, progressive or multiple awards: where it is advantageous to award separately by items; or where more than one supplier is needed to provide the contemplated specifications as to quantity, quality, delivery, service, geographical areas; and where other factors are deemed to be necessary or proper to the purchase in question.

2.4 AGENCY BACKGROUND

The North Carolina Department of Health and Human Services (NCDHHS) manages the delivery of health-and human-related services for all North Carolinians, especially our most vulnerable citizens – children, elderly, disabled and low-income families. The Department works closely with health care professionals, community leaders and advocacy groups; local, state and federal entities; and many other stakeholders to make this happen. Within NCDHHS, NC Medicaid (Division of Health Benefits) is dedicated to providing access to physical and behavioral health care and services to improve the health and well-being of over

2.8 million North Carolinians.

The mission of the NCDHHS is, in collaboration with our partners, to protect the health and safety of all North Carolinians and provide essential human services. NCDHHS respects the dignity of individuals and provides individualized, compassionate, efficient, quality care to citizens of North Carolina with developmental disabilities, substance use disorders and psychiatric illnesses and whose needs exceed the level of care available in the community.

3.0 RFP REQUIREMENTS AND SPECIFICATIONS

3.1 SCOPE OF WORK

The AVS entity (“Contractor”) shall provide a software solution, along with support and maintenance, that promotes eligibility integrity and reduction of fraud, waste and abuse through the identification and verification of financial assets of the Aged, Blind and Disabled (ABD) population applying for or receiving Medicaid. The Contractor shall meet the requirements of Section 1940 of the Social Security Act (42 U.S.C 1396w) and the Gramm-Leach Bliley Act, Public Law 106-102, 113 Stat. 1338 (November 12, 1999), and the regulations promulgated there under.

3.1.1 IMPLENTATION OF ASSET VERIFICATION SYSTEM

The Department requires a Contractor who has the experience, knowledge, and resources to provide an AVS solution that identifies and verifies the financial assets of ABD Medicaid Applicants and Beneficiaries and supports the services defined herein.

3.1.2 ESTABLISH AND MANAGE A NETWORK OF FINANCIAL INSTITUTIONS

The Department requires a Contractor who has the experience, knowledge, and resources to establish and manage a network of Financial Institutions (FI’s) that are the source of asset information. The Contractor will develop and implement a plan to expand the FI network for FI’s not identified in the Contractor's North Carolina FI network.

3.1.3 TRACKING AND REPORTING

The Department requires an AVS solution that is capable of providing accurate asset verification information to the Department in a timely manner as defined herein. The AVS solution shall provide reporting and analytical functionality to the Department to ensure a complete and accurate disclosure of the current and historical financial assets of ABD Medicaid Applicants and Beneficiaries.

Page 12 of 156 RFP #30-2025-009-DHB Asset Verification System Rev. April 21, 2025

3.2 GENERAL REQUIREMENTS AND SPECIFICATIONS

3.2.1 REQUIREMENTS

A requirement is a function, feature, or performance that the system must provide.

3.2.2 SPECIFICATIONS

A specification documents the function and performance of a system or system component.

The apparent silence of the specifications as to any detail, or the apparent omission of detailed description concerning any point, will mean that only the best commercial practice is to prevail and that only processes, configurations, materials and workmanship of the first quality may be used. Upon any notice of noncompliance provided by the State, Vendor shall supply proof of compliance with the specifications. Vendor must provide written notice of its intent to deliver alternate or substitute Services, products, goods or other Deliverables. Alternate or substitute Services, products, goods or Deliverables may be accepted or rejected in the sole discretion of the State; and any such alternates or substitutes must be accompanied by Vendor’s certification and evidence satisfactory to the State that the function, characteristics, performance and endurance will be equal or superior to the original Deliverables specified.

3.2.3 SITE AND SYSTEM PREPARATION

Vendors shall provide the Purchasing State Agency complete site requirement specifications for the Deliverables, if any. These specifications shall ensure that the Deliverables to be installed or implemented shall operate properly and efficiently within the site and system environment. Any alterations or modifications in site preparation, which are directly attributable to incomplete or erroneous specifications provided by the Vendor, and which would involve additional expenses to the State, shall be made at the expense of the Vendor.

3.2.4 EQUIVALENT ITEMS

Whenever a material, article or piece of equipment is identified in the specification(s) by reference to a manufacturer’s or Vendor’s name, trade name, catalog number or similar identifier, it is intended to establish a standard for determining substantial conformity during evaluation, unless otherwise specifically stated as a brand specific requirement (no substitute items will be allowed). Any material, article or piece of equipment of other manufacturers or Vendors shall perform to the standard of the item named. Equivalent offers must be accompanied by sufficient descriptive literature and/or specifications to provide for detailed comparison.

3.2.5 ENTERPRISE LICENSING

In offering the best value to the State, Vendors are encouraged to leverage the State’s existing resources and license agreements, which can be viewed here:

https://it.nc.gov/resources/statewide-it-procurement/statewide-it-contracts

a. Identify components or products that are needed for your solution that may not be available with the State’s existing license agreement.

b. Identify and explain any components that are missing from the State’s existing license agreement.

c. If the Vendor can provide a more cost-effective licensing agreement, please explain in detail the agreement and how it would benefit the State.

d. Explain the transportability and transferability of the proposed license agreements.

3.2.6 ENTERPRISE ARCHITECTURE STANDARDS

The Department maintains a comprehensive set of Enterprise Architecture artifacts that must be created and maintained by vendors. The Department’s Enterprise Architecture is based on the Federal Enterprise Architecture framework and is aligned with the MITA framework. The Department’s https://it.nc.gov/resources/statewide-it-procurement/statewide-it-contracts

Page 13 of 156 RFP #30-2025-009-DHB Asset Verification System Rev. April 21, 2025 framework will leverage the MITA standards and additionally use standard conventions such as Unified Modeling Language (UML) 2 and Business Process Modeling and Notation (BPMN). The Department maintains the right to add or change its Enterprise Architecture artifacts as its needs change. The Vendor will be required to provide and maintain standard documentation. The details are referenced in Attachment J: Enterprise Architecture.

3.3 SECURITY SPECIFICATIONS

3.3.1 SOLUTIONS HOSTED ON STATE INFRASTRUCTURE - RESERVED

3.3.2 SOLUTIONS NOT HOSTED ON STATE INFRASTRUCTURE

The Asset Verification System will be required to receive and securely manage data that is classified as High Risk. Refer to the North Carolina Statewide Data Classification and Handling policy for more information regarding this data classification. The policy is located here:

https://it.nc.gov/document/statewide-data-classification-and-handling-policy.

To comply with the State’s Security Standards and Policies, State agencies are required to perform annual security/risk assessments on their information systems using National Institute of Standards and Technology (NIST) 800-53 controls. This requirement additionally applies to all Vendor-provided, agency-managed Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) solutions which will handle data classified as Medium Risk (Restricted) or High Risk (Highly Restricted) data.

a. Vendors shall provide a completed Vendor Readiness Assessment Report Non-State Hosted Solutions (“VRAR”) at offer submission. This report is located here:

https://it.nc.gov/documents/vendor-readiness-assessment-report

b. Vendors shall provide a current independent 3rd party assessment report in accordance with subparagraphs i)-iii) at the time of offer submission.

i. Federal Risk and Authorization Management Program (FedRAMP) certification, SOC 2

Type 2, ISO 27001, or HITRUST are the preferred assessment reports for any Vendor solutions which will handle data classified as Medium Risk (Restricted) or High Risk (Highly Restricted).

ii. A Vendor that cannot provide a preferred independent 3rd party assessment report as described above may submit an alternative assessment, such as a SOC 2 Type 1 assessment report. The Vendor shall provide an explanation for submitting the alternative assessment report. If awarded this contract, a Vendor who submits an alternative assessment report shall submit one of the preferred assessment reports no later than 365 days of the Effective Date of the contract. Timely submission of this preferred assessment report shall be a material requirement of the contract.

iii. An IaaS vendor cannot provide a certification or assessment report for a SaaS vendor UNLESS permitted by the terms of a written agreement between the two vendors and the scope of the IaaS certification or assessment report clearly includes the SaaS solution.

c. Additional Security Documentation. Prior to contract award, the State may in its discretion require the Vendor to provide additional security documentation, including but not limited to vulnerability assessment reports and penetration test reports. The awarded Vendor shall provide such additional security documentation upon request by the State during the term of the contract.

3.3.3 VULNERABILITY RISK RATINGS AND REMEDIATION

Where technically configurable, risk ratings shall be calculated based on active exploit threat, exploit availability, factors from the Common Vulnerability Scoring System (CVSS), and system exposure utilizing a scale of 0 to 10.0 as per the CVSS v3 “Qualitative Severity Rating Scale” for proper https://it.nc.gov/document/statewide-data-classification-and-handling-policy https://it.nc.gov/documents/vendor-readiness-assessment-report

Page 14 of 156 RFP #30-2025-009-DHB Asset Verification System Rev. April 21, 2025 prioritization. If the additional combined information above is not available then the CVSS score, exploitability information, or a vendor rating where appropriate risk is reflected may be used. For general vulnerabilities that do not easily relate back to a common vulnerability and exposure, such as unsupported software or encryption versions less than policy requirements, a vulnerability scanner rating that is above “info”, or a score of 0, may be used after appropriate review.

The risk ratings and remediation timelines are assigned to vulnerability follows:

a. Critical-level Risk (Priority/CVSS 9.0-10.0): A vulnerability that could cause grave consequences and potentially lead to leakage of sensitive data, if not addressed and remediated immediately. This type of vulnerability is present within the most sensitive portions of the network or IT asset, as identified by the data owner. Critical-level risk vulnerabilities must be, at a minimum, remediated within seven (7) days.

b. High-level Risk (Priority/CVSS 7.0-8.9): A vulnerability that could lead to a compromise of the network(s) and systems(s) if not addressed and remediated within the established timeframe.

High-level risk vulnerabilities must be mitigated or remediated within thirty (30) days.

c. Medium-level Risk (Priority/CVSS 4.0-6.9): A vulnerability that should be addressed within the established timelines. Urgency in correcting this type of vulnerability still exists; however, the vulnerability may be either a more difficult exploit to perform or of lesser concern to the data owner. Medium-level risk vulnerabilities must be mitigated or remediated within sixty

(60) days.

d. Low-level Risk (Priority/CVSS 0.1-3.9): A vulnerability that should be fixed; however, it is unlikely that this vulnerability alone would allow the network or IT asset to be exploited and/or it is of little consequence to the data owner. Low-level risk vulnerabilities must be mitigated or remediated within ninety (90) days.

3.4 ENTERPRISE SPECIFICATIONS

3.4.1 ENTERPRISE STRATEGIES, SERVICES, AND STANDARDS

Agencies and vendors should refer to the Vendor Resources Page for information on North Carolina Information Technology enterprise services, security policies and practices, architectural requirements, and enterprise contracts. The Vendor Resources Page can be found at the following link: https://it.nc.gov/vendor-engagement-resources. This site provides vendors with statewide information and links referenced throughout the RFP document. Agencies may request additional information.

3.4.2 ARCHITECTURE DIAGRAMS

The State utilizes architectural diagrams to better understand the design and technologies of a proposed solution. These diagrams are required at offer submission and can be found at the following link:https://it.nc.gov/resources/statewide-it-procurement/vendor-engagement-resources#Tab- Architecture-1192 There may be additional architectural diagrams requested of the Vendor after contract award. This will be communicated to the Vendor by the agency as needed during the project.

Please review Attachment U: Conceptual Architectural Diagrams for a detailed architecture of the future state.

3.4.3 IDENTITY, CREDENTIAL AND ACCESS MANAGEMENT - RESERVED

https://it.nc.gov/vendor-engagement-resources https://it.nc.gov/resources/statewide-it-procurement/vendor-engagement-resources#Tab-Architecture-1192 https://it.nc.gov/resources/statewide-it-procurement/vendor-engagement-resources#Tab-Architecture-1192

Page 15 of 156 RFP #30-2025-009-DHB Asset Verification System Rev. April 21, 2025

3.5 BUSINESS AND TECHNICAL REQUIREMENTS

The Vendor must provide a response in their offer to all requirements as part of the technical proposal as defined in Attachment T: Technical / Management Proposal. If any of the RFP requirements cannot be met, the State will disqualify the Vendor from further evaluation.

Note: The number assigned to each requirement in the following tables may not always be sequentially numbered. Any apparent gaps in the numbering sequence are intentional.

3.5.1 REQUIREMENTS

Table 1. Financial Institution Requirements

Requirement # Requirement Description

FIN-002 The Vendor solution must provide an option to allow for Department or CDSS staff to specify an

FI.

Table 2. Security Requirements

Requirement # Requirement Description

SEC-001 The Vendor solution must maintain and operate a secure web-based AVS that utilizes Internet/Cloud based applications and complies with the requirements of:

a. Section 1940 of the Social Security Act (42 U.S.C 1396w);

b. Any guidance issued by the Centers for Medicare and Medicaid Services; and

c. The Gramm-Leach Bliley Act, Public Law 106-102, 113 Stat. 1338 (November 12, 1999), and the regulations promulgated there under.

SEC-002 The Vendor must conduct annual independent third-party penetration testing and submit the test results and reports to the Department.

SEC-003 The Vendor's solution must ensure that all data containing PHI/PII, as defined by HIPAA, is secured through commercially reasonable methodologies in compliance with HITECH, such that PHI/PII data is rendered unusable, unreadable and indecipherable to unauthorized individuals through encryption or destruction.

SEC-010 The Vendor solution must follow regulations 42 CFR 431 Subpart F to safeguard information about applicants and beneficiaries. The following is the set of information that must be safeguarded:

a) Names and addresses;

b) Medical services provided;

c) Social and economic conditions or circumstances;

d) Agency evaluation of personal information;

e) Medical data, including diagnosis and past history of disease or disability; and

f) Any information received for verifying income eligibility and amount of medical assistance payments. Income information received from SSA or the Internal Revenue Service must be safeguarded according to the Requirements of the agency that furnished the data;

g) Any information received in connection with the identification of legally liable third-party resources;

h) Social Security Numbers.

Table 3. Enterprise Architecture Requirements

ARC-014 The Vendor solution user interfaces must be in alignment with, and incorporation of, industry standards adopted by the Office of the National Coordinator for Health IT in accordance with 45 CFR part 170, subpart B: The HIPAA privacy, security and transaction standards; accessibility standards established under section 508 of the Rehabilitation Act.

Table 4. Reporting Requirements

Page 16 of 156 RFP #30-2025-009-DHB Asset Verification System Rev. April 21, 2025

REP-001 The Vendor solution must provide reports of monthly balances held by Applicant/Beneficiary and spouse as a single or joint account holder for a sixty (60) month look-back period. If the Financial Asset has not been in existence for sixty (60) months, the Vendor solution reporting must list the monthly balance for each month of the Financial Asset’s existence. The monthly balance of a Financial Asset is the balance that existed as of 12:01 a.m. EST on the first day of the month in question.

REP-002 The Vendor solution must accept all individual queries and batch queries without any limitation on query volume or frequency.

REP-004 The Vendor solution must report on historical context (i.e., death, marriage, divorce, etc.) of individual financial balances, comparing different time intervals, when requested, regardless of account balances.

REP-005 The Vendor solution must provide a listing of existing Financial Institution (FI) networks that are geographically diverse and include cross state matching with FIs located outside of North Carolina.

REP-006 Vendor must submit complete and accurate reports, in accordance with the requirements and timeframes and in a format agreed upon by the Department, which may include MS Excel, MS Word or other formats based on the report data and requirements. For any reporting date that falls on a weekend or State holiday, the due date shall be the next State Business Day.

REP-007 Vendor must submit all reports electronically to the Contract Administrator for day-to-day activities.

REP-008 Vendor must make available the following reports on a monthly basis due on the fifteenth (15) of each month.

a. Transaction Requests - including each county and a grand total for the State.

b. Responses - including both open and closed accounts

c. Undisclosed Assets

d. FI Network Expansion Campaign - including FIs in network, FIs lost, and new FIs in the network

e. FI Network Unresponsive - Number of inquiries that did not receive a response.

f. Inbound and Outbound Calls - including first-call resolution rate, average response time, types of issues.

REP-009 Vendor must submit ad-hoc reports as requested within five (5) State Business Days of the Department’s request or within a timeframe mutually agreed upon between the Vendor and the Department.

Table 5. Operations Requirements

OPS-003 The Vendor solution must request information concerning both open and closed accounts for a sixty (60) month look-back period to determine if the Applicant’s or Beneficiary’s name appeared on any account as a single or joint owner during the look-back period.

OPS-004 The Vendor solution must indicate the type of account (checking, savings, investment accounts, IRAs, treasury notes, certificates of deposit, annuities, trusts, Direct Express accounts, and any other assets) that may be held or managed by an FI.

OPS-005 The Vendor solution must comply with the North Carolina Medicaid Beneficiary Due Process Rights and Prior Approval policies and procedures, found at:

https://medicaid.ncdhhs.gov/providers/programs-services/prior-approval-and-due-process

OPS-006 The Vendor must provide system configuration changes to the Department for approval prior to deployment. The Department reserves the right to request changes to the proposed configuration changes.

OPS-007 The Vendor must submit its notice within ninety (90) days of any system upgrades, new versions of product, or new APIs, to the Department for approval. The Vendor must provide an impact analysis to the Department how the changes or upgrades will impact the operation and functionality of the solution and provide the documented testing results.

OPS-008 The Vendor solution must process all search request reports and deliver search results electronically within ten (10) Calendar Days from the date of receipt of the request. Completed https://medicaid.ncdhhs.gov/providers/programs-services/prior-approval-and-due-process

Page 17 of 156 RFP #30-2025-009-DHB Asset Verification System Rev. April 21, 2025 searches should include a list of the balances of the financial instruments found by the search, or a statement that no financial instruments were found.

OPS-009 The Vendor must adapt the solution, as needed, in response to program or enrollment changes and incur and bear all costs related to updates in scalability and/or flexibility of the Contractor-provided components of the solution.

OPS-010 The Vendor must provide a Customer Support Representative who will be available every State Business Day from 7:00 a.m. – 6:00 p.m. ET, unless otherwise agreed upon by the Department, to provide support in problem solving for individual cases and programmatic matters.

OPS-012 The Vendor must provide a Root Cause Analysis (RCA) of any problems that interrupt or delay online inquiries or data transfers within the solution. The RCA must also include any issue mitigations and corrective actions to prevent future interruptions.

OPS-017 The Vendor must provide system maintenance which will include, at a minimum: service changes, system upgrades, correction of deficiencies, performance enhancements, script changes, system parameters, configuration changes, patching, and other activities required to meet the solution requirements.

OPS-018 The Vendor will be solely responsible for obtaining and maintaining all permits, approvals, licenses, certifications, and similar authorizations required by any local, State, or Federal entities for the project and maintaining them throughout the duration of the Contract.

OPS-019 The Vendor must include documentation of solution components and procedures such that the solution could be operated by a variety of contractors or other users.

Table 6. Project Management Requirements

PROJ-001 The Vendor must organize and participate in project-related meetings with the Department as required by the Department. Meetings must include the correct stakeholders; agendas must be provided 24 hours in advance of the meeting; and minutes from the meeting must be provided at least 48 hours after the meeting.

PROJ-002 The Vendor must support key project/program milestones such as UAT Sign-Off, ORR, and Go- Live.

PROJ-003 The Vendor must participate in an ORR prior to the solution implementation. The ORR involves validating all the operations and hardware, software, and the connectivity aspects of the solution.

This review must involve comparing all operational components of the replacement system against the ORR checklists.

PROJ-004 The Vendor must participate in the development and execution of Mitigation Plans, within defined timeframes, throughout the project lifecycle.

PROJ-005 The Vendor must provide all Deliverables to be approved by the Department in accordance with its formal deliverable review process and tools provided by the Department.

PROJ-006 The Vendor must provide its deliverable tracking method to ensure all Deliverables have been accounted for according to the scheduled due date and coordinated with the Medicaid Portfolio Management Office.

PROJ-007 The Vendor must follow the Department processes for the escalation of risks, issues and decisions during the project implementation and operations phases. The Vendor must adhere to the Department’s applicable change management, configuration management, incident management, and release management processes and tools.

PROJ-008 The Vendor must manage requirements and demonstrate requirements traceability throughout the life of the contract, to include providing product demonstrations, sprint reviews (post-development/configuration reviews), and Requirements Traceability Matrix (RTM) maintenance, to support project implementation, operations, certifications, and audits.

PROJ-009 The Vendor must provide a Deliverable Expectation Document (DED) for all Deliverables using the Department's standard template.

PROJ-010 The Vendor must develop and maintain a Project Work Plan…