J.6 Contractor Furnished Property.docx

Attachment J.6 Contractor Furnished Property

RFP # 75FCMC19R0023

C.5.3.2.2.2 Combined Common Edits and Enhancement Module (CCEM) Software components and hardware

Combined CCEM Software Requirements (supports Part A and Part B processing)

The Application and Data Zones need to support:

· JVM (Java Virtual Machine) 1.6

· JMS (Java Messaging Service)

Application Server It is recommended that CEM run on a true application server. The following servers are supported:

· JBoss EAP is the preferred server

· The following servers are also supported:

· Websphere 8.5.5*

· JBoss Wildfly v10 or v11 Final

· JBoss EAP v7

Separate instances should be created for Production processing of Part A and Part B transactions.

Database System CCEM requires an Registered Diagnostic Medical Sonographer (RDMS), and will be tested with the following:

Oracle 11g and 12cicrosoft (MS) Structured Query Language (SQL) Server 2008 and 2014

Operating System CCEM will support:

RedHat Linux v5.9/6*indows Server 2003 and 2008 R2

· AIX 6.1/7.*(not preferred)

The maintainer does not recommend running CCEM in an International Business Machines (IBM) z/OS environment.

Combined CCEM Hardware Requirements

Central processing unit (CPUs) and Memory:

The number of CPUs that the Application and Data servers contain will be directly related to the claims volume processed and the amount of multi-tasking and multi-threading anticipated. Recommended:

· CPU Speed: 1.8GHz – 3+ GHz

· Number of CPU: 1 - 8

· Number of Cores: 2 - 8

· Memory: 3 - 128 The greater the CPU speed, more CPUs, Cores, and memory, the faster the application will perform. More Memory will allow caching of some of the database tables and will increase throughput.

I/O Files and Disk Space:

· CCEM Input files - 837P, 837I and 276 flat files created by the Electronic Data Interchange (EDI) translator. (CCEM requires TRIPLE the disk space usually required by these files.)

CCEM Output files – 837P, 837I and 276 flat files to be sent to the Virtual Data Center (VDC), plus 277CA flat files to return to the EDI translator. (CCEM requires DOUBLE the disk space usually required by these files.)

· CCEM Receipt/Control/Balancing module input from the 277 and 835 flat files

The following files will be extracted from Multi Carrier System (MCS) and shared by both Part A and Part B processing:

· Claim Adjustment reason codes

· Country codes

· Country subdivision codes

· International Classification of Diseases (ICD)-10 diagnosis codes

· Not Otherwise Classified (NOC) procedure codes

· Remittance Advice Remark Codes

· State codes

· Taxonomy codes

· Zip codes

The following files will be extracted from the Fiscal Intermediary Standard System (FISS) files and downloaded:

· Admission source codes

· Admission type codes

· Health Care Common Procedure Coding System (HCPCS) codes

· ICD-9 diagnosis and procedure codes

· ICD10 procedure codes

· Medicare Beneficiary Identifier (MBI) transition dates

· Modifier codes

· National Uniform Billing Committee (NUBC) condition codes

· Occurrence codes

· Occurrence span codes

· Patient Status codes

· Subset of Provider data

· Revenue codes

· Type of Bill codes

· Type of Bill frequency codes

· Value codes

The following files will be extracted from the MCS files and downloaded:

· Anesthesia modifiers

· National Provider Identifier (NPI) crosswalk

· HCPCS codes

· ICD9 diagnosis codes

· Internal Control Number (ICN) generator file

· ICN generator2 file (for transitioning new Medicare Administrative Contractors (MACs) only)

· Mammography certification codes

· MBI transition dates

· Modifier codes

· NUBC condition codes

· Plan information

· Place of Service (POS) codes

· Provider control

The following tables are updated and maintained by the CCEM:

· Accepted claims (Part A only)

· Assigned ICNS (Part B only)

· Audit trail

· Claim 277CA Balancing

· Control record (CTR)

· Duplicate reject

· Duplicate tracking

· Error record (ERT)

· Invalid ICD codes

· MBI Claim counts

· System Activity log

The following tables are updated and maintained by the contract running the CCEM software:

· Business days

· Document Control Number (DCN) sequences (Part A only)

· End of Day (EOD) Schedule

· ICN Date (Part B only)

· Load Balance

· Notification

· Purge processes

· Report Management

· Scheduled activity table

· Table of Cycles

· Table of Folders

· Table of Instances

· Table of Properties

· Table of Tables

Disk space: 100 MB available Memory: 1 GBrowser: Internet Explorer 10 (or higher version) NOTE: More than one instance of NGD open at a time is not supported.

Monitor: 21”

1. Pointing device: mouse with scroll

2. Network interface: network interface card compatible with the call center Local Area Networks (LAN), which will ultimately allow workstation access to CMSNET

3. Word processor: Microsoft Word 2010 (or higher version) — required only for generation of correspondence.

4. Viewers: Microsoft Word Viewer and Adobe Acrobat Reader are required

Non-CMS-issued computers are not supported by the Centers for Medicare & Medicaid Services (CMS) Information Technology (IT) Service Desk. If your organization’s IT service professional has determined that a particular problem is not related to your hardware or software, and is directly related to CMS application access or functionality, your organization’s IT service professional should contact the CMS IT Service Desk for assistance.

1.2 Additional Hardware Requirements

The CMS Virtual Private Network (VPN) client requires a token to be registered and activated by Leidos, or a CMS Personal Identity Verification (PIV) Card to be issued by the Badging Office, for each contractor to access the VPN. The token authorized for use on the CMS VPN is the Rivest, Shamir, & Adleman (RSA) Model SID800.

1.3 Additional Software Requirements

The CMS AnyConnect VPN client installation attempts to install the various components on the C:\ drive of the target machine.

Any other VPN client software (i.e., SafeNet, Nortel, etc.) must be removed from the target machine before installation of the Cisco VPN client. If a different version of Cisco AnyConnect is installed, it may still be used, but the Contractor assumes responsibility for any conflicts related to the non-CMS version being used.

The following software is required:

It is assumed that the Program Files/Program Files (x86) folder is located on the C: drive.

Microsoft Windows 7 (32-bit or 64-bit), Windows 8/8.1, or Windows 10 must be used.

Microsoft Transmission Control Protocol (TCPP)/ Internet Protocol (IP) must be installed (normally this is installed by default).

Anti-virus software must be present, running, and current. Although Cisco advertises support for a wide array of A/V products, the following five enterprise anti-virus products have been tested and are known to work with the CMS VPN: McAfee, Norton, Trend Micro, CA, and Panda. The most current version should be used, unless otherwise advised to be incompatible with the current CMS National Advocacy Center (NAC) environment.

All current Microsoft service packs, hotfixes, and patches must be installed.

All installed software must be current with security patches.

If the VPN gateway detects that anti-virus software or security patches are either missing or outdated, access to the CMS network will be denied. The user is responsible for obtaining updated software. See Section 2.5 for additional detail.

1.4 Computer Security Requirements

The following security requirements must be met:

A separate operating system partition (dual boot) or a dedicated computer must be used for CMS VPN access. Virtual machines may be used, but are not supported by CMS.

Federally-mandated Federal Desktop Core Configuration (FDCC) settings must be adhered to as specified in CMS’s Minimum Security Configuration Standards for Operating Systems document.

The CMS Wireless Client Access Policy must be adhered to.

The hard drive(s) of the machine used for VPN connection must be encrypted using software that is compliant with Federal Information Processing Standard (FIPS) 140-2 requirements. In addition, the system must encrypt any data transferred to removable media (also via FIPS 140-2 compliant encryption software).

After 30 minutes of inactivity, the VPN connection must be terminated. If the computer is left unattended, the screen must be locked.

CMS retains the right to request that a contractor computer pass verification testing. As part of the verification, CMS will verify that all of the hardware, software, and security requirements have been met.

Prior to logging into the CMS network via the VPN, contractors shall submit a signed copy of the CMS Rules of Behavior document titled “Centers for Medicare and Medicaid Services (CMS) Rules of Behavior (ROB) Security Agreement for Interconnection to CMS Networks.”

The VPN machine cannot be connected to a corporate domain when connected to the CMS VPN.

Laptops must be physically secured (i.e. locked to a desk with a cable lock) at all times unless being transported by the user, in which case it must remain in the user’s possession.

The CMS password policy must be adhered to for all accounts used to access the CMS VPN. Federal Information Security Management Act of 2002 (FISMA)/ United States Government Configuration Baseline (USGCB)/ Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) requirements must be met for the local administrator account.

Two-factor token-based user authentication plus Active Directory authentication must be used.

A Secure Sockets Layer (SSL) tunnel will be used for data confidentiality.

Split tunneling will be disabled when connected to the CMS VPN if connecting from any network other than the CMS Central Office network.

All non-VPN traffic will be blocked by the VPN client when connected. This may cause some processes to run slowly or not at all.

The contractor shall monitor and adhere to all Information Technology (IT) policies, standards, procedures, directives, templates, and guidelines that govern the CMS Information Security Program. CMS IT Security Policy documents (such as the Acceptable Risk Safeguards (ARS), Policy for the Information Security Program (PISP), and Minimum Security Configurations, Wireless Access Policy) can be accessed at Information Security (http://www.cms.gov/informationsecurity).

1.5 Validation of Secure Computer

The Cisco Identity Service Engine (ISE) provides the ability to check security requirements on client computers and laptops. The AnyConnect ISE Posture Module will be installed on the computer during the client installation to facilitate communication with the ISE on the CMS VPN network. The ISE automatically updates itself daily to ensure client machines are checked against the most recent hot fixes and virus signature files. The ISE evaluates all requirements to determine whether access should be granted.

1.6 Pre-installation Requirements

Prior to installing this product and attempting to use it, please ensure that the following conditions are met:

Your machine is running the Microsoft Windows 7, Windows 8/8.1, or Windows 10 operating systems.

A separate operating system partition (dual boot) or a dedicated computer is being used for VPN access. Note: Machines imaged with a corporate image have proven problematic in the past, especially if a security suite (Trend Micro, Symantec, etc.) has been installed. If you are having trouble installing the Cisco AnyConnect VPN client on a corporate-imaged machine, please revert to a machine or boot partition running a “vanilla” copy of the OS.

All firewalls, including the Microsoft firewall, have been disabled. You can and should re-enable them after the installation is complete.

The VPN machine is not connected to a corporate network/domain.

No other VPN clients are installed on your computer.

You have verified that your Internet connection is functioning properly, and that Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) port 443 is permitted.

You have successfully completed the CMS VPN request process and you are approved to use CMS VPN services. See Section 1.1 of this document for full details regarding obtaining access to the CMS VPN.

You have an authorized RSA Token activated by Leidos, or a CMS-issued PIV Card.

You have administrator access to your local machine’s operating system (i.e. Windows 7, Windows 8/8.1, or Windows 10).

You have the latest Operating System (Windows 7, Windows 8/8.1, or Windows 10) security updates/patches.

Your anti-virus software and signature files are up to date (within 3 days of connection time).

Note:

Currently, the Cisco AnyConnect VPN Client for Windows 7 and Windows 8/8.1 have been fully tested for use on the CMS VPN. The Cisco AnyConnect VPN Client for Windows 10 OS is known to also function on the CMS VPN, but has not been fully vetted.

Certain security requirements will be validated and enforced by Cisco’s AnyConnect Identity Service Engine (ISE) Posture module (System Scan). If the machine does not meet the security requirements, it will be denied access until all requirements are met.

1.7 Computer System Requirements

The CMS AnyConnect VPN Client minimum system hardware requirements are as follows:

Intel Pentium-class processor or greater (or Advanced Micro Devices' (AMD) equivalent)

512 MB RAM

100 MB of available hard disk space Ethernet card and/or high speed connection (i.e., T1, Digital Subscriber Line (DSL), Cable Modem) to the Internet Microsoft Internet Explorer 7.x or later Super Video Graphics Array (VGA) (800 × 600) or higher-resolution video adapter CD-ROM or DVD drive RSA SID800 Token OR CMS-issued PIV Card

January 10, 2019 Page 9 of 9