5-JK26-10 Scope of Work.pdf

Scope of Work - Draft

Background and Overview

The Utah State Tax Commission has received funding for a project with the intent to find vehicles that are operating and stored in Utah, but not registered in Utah. There is believed to be a population of taxpayers that are registering vehicles in states where there is no or little sales tax in order to avoid paying sales tax in Utah. There is also a population of taxpayers that are registering vehicles outside of Utah in order to pay a lower registration fee to another state, in addition to possibly avoiding sales tax in Utah.

The scope of the contract is intended to find those vehicles, which will allow the Tax Commission to bring those vehicles and taxpayers into compliance with Utah law.

This contract will also capture vessels as part of the uninsured motorist program. The Tax Commission has received funding in order to identify vessels that are operating without insurance. This will have the same function as the DPS contract that covers vehicles, but only include the vessels in this scope of work.

Code References and Authorization

The Utah Driver License Division (DLD), a division of the Utah Department of Public Safety (DPS), is charged with administering the Uninsured Motorist Identification Database Program (the Program) created in Utah Code Annotated (UCA) 41-12a-803 with the assistance of the Utah Motor Vehicle Division (DMV), a division of the Utah State Tax Commission (USTC). The Program is authorized and the requirements are set forth in UCA 41-12a-801 through 41-12a-

806. The Program was established and has been functioning since July 1, 1996. In March of 2025, 41-1a-202 (3) was expanded to allow for the Tax Commission to contract with a designated agent to determine an address for which a contract for owner’s or operator’s security pertaining to a certain vehicle or vessel is tied. The Uninsured Motorist Identification Database (the Database) is used to verify compliance with motor vehicle owner's or operator's security requirements under UCA 41-12a-301, to assist in reducing the number of uninsured motor vehicles on the highways, to assist in increasing compliance with motor vehicle registration, sales and use tax laws, to assist in protecting a financial institution's (as defined in UCA 7-1-

103) bona fide security interest in a motor vehicle, and to assist in the identification and prevention of identity theft and other crimes. The Database consists of information provided by insurers under UCA 31A-22-315, by DLD under UCA 41-12a-803(6), and DMV under UCA 41-1a-120, and meets the requirements for the Program outlined in UCA 41-12a Part 8.

This scope of work is for the additional items as outlined in code 41-1a-202 only that were passed in the 2024 and 2025 general sessions.

Required Projects

Project 1 - Address Verification of Vehicles (SB 52 - 2025 general session)

Provide access to FTP server to the Utah State Tax Commission that contains records of vehicles and vessels that are insured and stored in Utah, but there is no active registration in Utah. Records will be provided to the Tax Commission on a monthly basis at a minimum. The Tax Commission reserves the right to request access to the FTP server. The FTP server will be maintained by the Contractor.

No letters are to be sent from the Contractor to the individuals identified through this verification process. All correspondence will be initiated from the Utah State Tax Commission.

● Note: DMV is already providing files containing all currently registered motor vehicles on a semi-monthly basis.

The FTP server must include at a minimum:

1. Owner’s Name

2. Owner’s Address

3. Driver’s License

4. Driver’s License State

5. Date of Birth

6. VIN

7. Vehicle Make

8. Vehicle Model

9. Vehicle Year

10. Garaged Address

11. Title Jurisdiction

12. Title Issue Date

13. Odometer Reading

14. Odometer Unit of Measurement

15. Insurer Name

16. Insurance Policy Number

17. Policy ID number

18. Policy effective date

19. Date policy was first submitted to Database

20. Date policy was most recently submitted to the Database

21. Policy scheduled expiration date

22. Policy cancellation date

23. Policy Type

24. State of Registrati on

25. Period of Registration

Project 2 - Vessels - (HB 184 - 2024 general session)

The intent of this project is to mimic the motor vehicle requirements already in place with the contract that is held by DPS, and it so only cover the addition of vessels.

1. Required Tasks

Task 1 - Receive and Match Files: Contractor shall develop and maintain a computer database from information provided by:

Subtask 1.1 DMV: A group of files will be provided semi-monthly by DMV containing information regarding all currently registered vessels. The files will be provided to the selected Contractor on a secure FTP server maintained by the Contractor.

Subtask 1.2 Insurance Companies: Insurance companies that issue a policy that includes vessels liability coverage, uninsured motorist coverage, under-insured motorist coverage, or personal injury coverage under UCA 31A-22 Part 3 shall submit a record of each vessel insurance policy in effect for vessels registered or garaged in Utah as of the previous submission that was issued by the insurer. Submissions from insurance companies will be provided at least twice a month (before the seventh and twenty-first day of each calendar month).

Subtask 1.3 Insurance Companies: Insurance companies that issue commercial Vessel insurance coverage shall submit a record of each commercial vessel’s insurance policy in effect for vessels registered or garaged in Utah as of the previous month that was issued by the insurer. A record of each commercial vessel insurance policy shall be submitted at least once a month (before the seventh day of each calendar month).

Subtask 1.4 Full book of business mandatory matching must be performed monthly. Full book of business means the Contractor must start over with a clean database each month when matching records. Records must be matched with a minimum accuracy rate of at least 95% with a goal of 98%.

Subtask 1.5 The system must generate multiple notices/letters to those that do not have insurance. The records of those owners that appear to be uninsured shall be transferred electronically to DMV weekly. Notices are to be sent in accordance with Utah law.

Task 2 Provide Information from the Database: Contractor shall provide information from the Database, in the formats and using security approved by Tax, to the following agencies, institutions or divisions.

Subtask 2.1 Law Enforcement Agencies: Insurance information specific to vessels must be available to officers with in-vehicle computers and dispatchers. The Database information must be available 24 hours a day, 7 days a week, and assist officers in deciding whether to issue a citation for operating a vessel without insurance. Accessing this information will be through services defined by the Tax Commission and must not require additional logons or keystrokes over those routinely performed during a stop.

Subtask 2.1.1 Provide ability to query insurance companies real-time to confirm the Database results. Also provide a separate service to allow law enforcement to initiate a broadcast inquiry to insurance companies to provide real-time insurance information.

Subtask 2.1.2 Provide information to assist in the identification and prevention of identity theft and other crimes as defined by the Tax Commission.

Subtask 2.2 DMV: The letter requests owners to provide insurance information for vessels identified as uninsured in the Database.

As specified in UCA 41-12a-804, the Contractor shall provide notice to the owner of a vessel that through comparison with insurance records is not insured for two consecutive months. This notice will provide that the owner of the vessel has 15 days to provide:

• Proof of owner’s or operator’s security [see UCA 41-12a-303.2(2)] or

• Proof of exemption from the owner’s or operator’s security requirements. If the owner of the vessel fails to provide the requested information a second notice is sent to the vessel owner that the owner has 15 days to provide:

• Proof of owner’s or operator’s security [see UCA 41-12a-303.2(2)] or

• Proof of exemption from the owner’s or operator’s security requirements.

For each notice information regarding the issuance of the notices and the owner of the vessel’s response or lack thereof shall be logged in the Database. Weekly, the Contractor will provide to DMV information regarding vessel owners who have failed to provide the information requested.

These notices must be mailed accurately and in a timely manner, with the ability to exclude from the mailings the following types: commercial and self-insured.

Subtask 2.3 Release of Information: Release of information shall be governed under provisions of UCA 41-12a-805.

Subtask 2.4 Financial Institutions: This group will use the Database for the purpose of protecting the financial institution’s bona fide security interest in vessels. The Contractor shall provide the data to these institutions. The means and security measures used for data and communications must be approved by the Tax Commission.

Task 3 Provide Reports: Contractor shall provide reports in a format pre-approved by the Tax Commission that will provide sufficient detail for the administration of UCA 41-12a-801 or other applicable statutes, regulations, policies or procedures.

Task 4 Security: The systems and environment provided by the Contractor must be secure and approved by the Tax Commission.

Task 5 Customer Service Center: Contractor shall provide a customer service center.

Task 6 Expert Witness Testimony: Contractor shall provide, at no cost to the state, expert witness testimony regarding information from the Database at the request of DPS, DMV or a prosecutor’s office.

Task 7 Audits: Contractor must agree to respond to audit requests. The Contractor must comply with the audit requirements under UCA 41-12a-803 and Utah Administrative Rule R33-3-808 and the provisions of Utah Administrative Rule R33-3-809 for books and records Retention.

Task 8 Training: Contractor must provide training which details their system and its functionality for users of the Program. Training must be performed throughout the contract in order to address system enhancements, legislative updates or other training required by the contract administrator.

Task 9 Data Transfer: Data maintained in the Database must be transferred in a manner and to a location defined by the contract administrator upon request and/or termination of the contract.

2. Receive and Match Files

2.1 DMV: A group of files will be provided semi-monthly by DMV containing information regarding all currently registered vessels. The files will be provided to the Contractor on a secure FTP server maintained by the Contractor.

2.2 Insurance Companies: Insurance companies that issue a policy that includes vessel liability coverage, uninsured motorist coverage, under-insured motorist coverage, or personal injury coverage under UCA 31A-22 Part 3 shall submit a record of each vessel insurance policy in effect for vehicles registered or garaged in Utah. Submissions from insurance companies will be provided at least twice a month (before the seventh and twenty-first day of each calendar month).

2.3 Insurance Companies: Insurance companies that issue commercial vessel insurance coverage shall submit a record of each commercial motor vehicles insurance policy in effect for vehicles registered or garaged in Utah. Record of each commercial vessel insurance policy shall be submitted at least once a month (before the seventh day of each calendar month).

2.4 Full Book of Business Matching: Full book of business mandatory matching must be performed semi-monthly. Full book of business means Contractor must start over with a clean database semi-monthly when matching records. Records must be matched with a minimum accuracy rate of at least 95% with a goal of 98%.

2.4.1 DMV – Match information provided by insurance companies against VIN/HIN.

2.4.2 Match on partial/incomplete data provided by insurance companies.

2.5 Notice to Vessel Owners: The system must generate notices/letters to the registered owner of vessels for which insurance cannot be verified through the Database as outlined in UCA 41- 12a-804. The notice must identify that the vessel that does not have a corresponding insurance policy in existence for three (3) consecutive months. These notices must be generated and mailed at no cost to the state.

2.5.1 Records of those owners that appear to be uninsured shall be transferred electronically to DMV weekly.

3. Providing Information from the Database

3.1 Law Enforcement Agencies: Provide inquiries to the Database by law enforcement agencies through the Utah Criminal Justice Information System (UCJIS).

3.1.1 Provide ability to query insurance companies real-time to confirm the Database results using the Insurance Industry Committee on Motor Vehicle Administration

3.1.2 Provide a separate service to allow law enforcement to initiate a broadcast inquiry to participating insurance companies to provide real-time insurance information.

3.1.3 System must have the capability to achieve and monitor response time and resource utilization. System will provide less than three (3) second response time for normal law enforcement queries (excluding 3.1.2).

3.1.4 The Database must be accessible to law enforcement 24/7.

3.2 Provide 24/7 high-availability infrastructure such as a FTP Server to provide querying functionality to the Utah DNR and other interested agencies. The FTP Server is to be maintained by the contractor.

3.3 Release of Information: Release of information shall be governed under provisions of UCA 41-12a-805 through the Tax Commission and provided at no additional cost. Information within the Database is owned by the providers of the information and shall not be used for any other purpose without express written consent of the Tax Commission or authorized by Utah Statute. Use of and access to the information shall be restricted to authorized personnel only.

Information from the Database shall be released:

3.3.1 For the purpose of investigating, litigating, or enforcing the owner's or operator's security requirement under UCA 41-12a-301, the Contractor shall verify insurance information through the state computer network for a state or local government agency or court.

3.3.2 For the purpose of investigating, litigating, or enforcing the owner's or operator's security requirement under UCA 41-12a-301, the Contractor shall, upon request, issue to any state or local government agency or court a certificate documenting the insurance information, according to the Database, of a specific individual or vessel for the time period designated by the government agency.

3.3.3 For the purpose of investigating, enforcing, or prosecuting laws or issuing citations by state or local law enforcement agencies related to the: registration and renewal of registration of a vessel under Title 41, Chapter 1a, Motor Vehicle Act; purchase of a vessel under Title 59, Chapter 12, Sales and Use Tax Act; and owner's or operator's security requirements under UCA 41-12a-301.

3.3.4 Upon request of a peace officer acting in an official capacity the Contractor shall, upon request through Tax, disclose relevant information for investigation, enforcement, or prosecution.

3.3.5 For the purpose of the state auditor, the legislative auditor general or other auditor of the state conducting audits of the program.

3.3.6 Upon request of a financial institution as defined under UCA 7-1-103 through a means approved by Tax for the purpose of protecting the financial institution's bona fide security interest in a vessel.

3.3.7 Upon request of a state or local law enforcement agency through Tax for the purpose of investigating and prosecuting identity theft and other crimes.

3.4 Financial Institutions: This group will use the Database for the purpose of protecting the financial institution’s bona fide security interest in a vessel. The Contractor shall provide the data on a specific vessel to these institutions. The means and security measures used for data and communications must be approved by Tax.

4. Providing Reports Contractor must meet the report requirements identified below.

REPORTS

Contractor must provide the following reports monthly, annually or on demand, DMV, the Insurance Commission, law enforcement or any other qualified government agencies.

Contractor must respond to each report type and describe in detail how the proposed system can furnish the following reports, monthly, annually, or on demand. Make sure the detail indicates the time it will take to produce an on-demand report. Contractor must include a prototype for each report.

Report 1 Required at least monthly.

● Number of current vessel registrations

● Number of probable uninsured registrations

● Approximate Uninsured Motorists Rate

● Number of Uninsured Notices Sent

● Number of probable uninsured registrations

● Approximate Uninsured Motorists Rate

● Total number of inquiries made by vessel information (VIN/HIN). These reports may be requested by day, week, and/or by hour.

● Total number of motorist contacts

● Total number of government contacts

● Total number of insurance company contacts

Report 2 Required current monthly totals, and showing monthly totals prior for at least 12 months.

● Number of current registrations, the amount of increase/or decrease from the prior month, and the percentage of increase/decrease from month to month.

● Number of insurance companies reporting, the count of usable policy records, the count of matched policy records, and the percentage of matched policies.

● Number of insured current registrations, registrations with unmatched policy records, total of probable insured registrations.

● Number of probable uninsured registrations, probable uninsured motorist rate.

● Total number uninsured letters sent.

● Total number of inquiries made by vessel information (HIN/VIN). These reports may be requested by day, week, and/or by hour.

● Total number of motorist contacts

● Total number of government contacts

● Total number of insurance company contacts

Report 3 Provided monthly, a match rate report by insurance company providing data.

● Company name, number of policy records provided, percent of total policy records provided, number of completed records, number matched, and the percent of matched records.

Report 4 Uninsured notices/letters status report, required at least monthly.

● A description of the mailing list number, the dates and type of notice sent, (first or second notice). The total number of notices/letters mailed, broken out by those revoked/revocable, and those not revoked/revocable, listing the reasons the registrations were/weren’t revoked/revocable. This report may be required by week, day, and/or by hour.

Report 5 Any reports the State, the courts or law enforcement deem to be necessary for workload studies, legislation, etc.

● These reports will be asked for upon demand, may be requested by month, day, week, and/or by hour.

Report 6 Ability to print a log of who in a financial institution is accessing the data, and what record (HIN/VIN/) was accessed, in a form approved by Tax.

● These reports will be asked for upon demand, may be requested by month, day, week, and/or by hour.

5. Security

5.1 Contractor must provide complete, fully redundant computer system (hardware, software and communications) to host the Database, with accommodations for secure off-site storage of back-ups. Contractor must describe in detail the computer environment, hardware, software, operating systems, networking, backup procedures and off-site storage capabilities for the Database.

5.2 The information must be stored at a secure facility. Contractor must describe the building security at the facility used to secure the hardware/software system of the Database.

5.3 The system must include proactive tools and procedures to guard against unauthorized access or data loss. Contractor must provide a detailed explanation of how they are securing the data, hardware and network, including, but not limited to; what virus scanning utilities they are using, firewalls, intrusion detection, etc.

5.4 Contractor must describe what measures they will use to establish and maintain a dissemination log of all queries and user access to the Database including: date, time, user ID, and file /record accessed.

5.5 System Incident Resolution: Contractor must notify the Tax Commission immediately of any successful unauthorized access to the system or information. Contractor must detail their incident response plan.

5.6 Contractor must fully describe how access security will be incorporated into all the Database applications. Details shall include authentication/authorization requirements roles, audit capabilities and user account management requirements.

5.7 Contractor shall provide a network diagram showing how their systems and services interact with State systems including edge devices such as firewalls, routers etc. A data-flow diagram must also be provided that depicts the flow of data.

5.8 Encryption: Information obtained for the Database must be encrypted at rest for all database instances. All information transmitted to and from Contractor’s systems shall be encrypted (minimum 128-bit).

5.9 Application development must follow system development best practices including code review, testing and change control.

5.10 Media containing restricted information must be properly disposed. Electronic media shall be wiped multiple times [standard of seven (7) times or more - DOD 5220.22.M] or physically destroyed. Physical documents should be shredded and mixed with other shredded documents prior to disposal.

5.11 Users handling restricted data need to be properly trained on the security and handling of confidential information.

5.12 Physical documents containing restricted data should be securely stored in a locked cabinet or other area where access is limited to approved individuals.

5.13 A log shall be used to track how physical data has been accessed or who has current possession of physically restricted data.

5.14 Information banners for electronic data or information labels for physical documents shall be implemented to remind users of the proper handling and security for each data set accessed.

5.15 System Availability and Maintenance:

5.15.1 Contractor’s technicians and programmers must have the ability to perform preventative or remedial maintenance on the system, software upgrades, updates, and periodic fixes.

5.15.2 Contractor must be able to respond to system outages within 30 minutes and notify the Tax Commission of any system outages within 10 minutes.

5.15.3 Contractor must ensure that their system will accommodate inquiry, vessel and driver growth rates.

5.15.4 Contractor must keep operating system and supporting applications current in accordance with State IT Terms and Conditions, Attachment A, Section 29.

5.16 Security Review/Verification: Contractor must submit annual verification of compliance with all security standards outlined in solicitation including those outlined in Attachment A and this scope of work. The State reserves the right, at any time, to visit the Contractor and conduct an audit of their IT security.

6. Customer Service Center

6.1 Contractor shall provide a customer service center with trained, experienced, and customer service oriented employees to receive, process and update customer records, and answer queries and complaints. Customer service personnel must be available during normal business hours Monday - Friday 8:00 a.m. – 5:00 p.m. Mountain Standard Time excluding State of Utah observed holidays.

6.2 Contractor must describe in detail how they operate the customer service center, inclusive of the equipment necessary to facilitate the center, the hours of service, office space, and personnel, upon request by the Tax Commission.

6.3 Contractor must provide automated services for customer support 24 hours a day, seven (7) days a week including, but not limited to interactive voice response, email, and web-based application. These services will allow the customer to respond to inquiry letters related to insurance coverage on specific vehicles.

6.4 When complaints are made against the system, Contractor must supply the Tax Commission the name and address of each person making a complaint, the nature of the complaint, and the Resolution.

7. Expert Witness Testimony Contractor shall provide, at no cost to the state, expert witness testimony regarding information from the Database at the request of the DMV or a prosecutor’s office.

8. Audits

8.1 Contractor shall archive the computer data files at least semi-annually for auditing purposes.

The archived data files must be in an electronic format compatible with DMV computer systems.

8.2 Contractor’s system must provide audit capability for systems audit trails, document control, access control and software change control.

8.3 Contractor must provide full access to its systems, databases and employees to the internal audit unit of the Tax Commission.

9. Training Contractor must provide training, at no additional cost to the state, at sites agreed upon by each user of the Database which may include the insurance industry. Contractor must provide yearly training at the Terminal Agency Coordinator (TAC) conference if requested.

10. Data Transfer Contractor must agree data maintained in the Database must be transferred in a manner and to a location defined by the contract administrator upon request and/or termination of contract. The contractor must be prepared to convert the statuses and histories from previous Databases of any motor vehicle owners who have failed to provide proper proof of insurance as defined in UCA 41-12a-804.

11. Other Requirements

11.1 New Technology: Contractor must be willing to make software/hardware enhancements to the system, when any legislation or the contract administrator of the Database requests or requires a change. These changes must be made in a timely manner as prescribed by the Tax Commission.

Pursuant to Utah Administrative Rule R33-12-502 the awarded contract(s) may be modified to incorporate new technology or technological upgrades associated with the procurement item being solicited, including new or upgraded: (i) systems; (ii) apparatuses; (iii) modules; (iv) components; and (v) other supplementary items. Further, a maintenance or service agreement associated with the procurement item under the resulting contract(s) may be modified to include any new technology or technological upgrades. Any contract modification incorporating new technology or technological upgrades will be specific to the procurement item being solicited and substantially within the scope of the original procurement or contract.