STATEMENT_OF_WORK_(SOW)_-_HEALTHCARE_BENEFITS_ADMINISTRATION_SERVICES.docx

STATEMENT OF WORK (SOW)

HEALTHCARE BENEFITS ADMINISTRATION SERVICES

A. Introduction

The Government intends to procure contractor services that will administer a healthcare benefits program for the Corporation for National and Community Service (CNCS) in an efficient and timely manner for up to 8,000 AmeriCorps VISTA members and up to 2,200 AmeriCorps NCCC Traditional and FEMA Corps members annually throughout their terms of service. The actual number of members is dependent on CNCS’s appropriation from Congress; however, on average 5,500 AmeriCorps VISTA, 1,360 AmeriCorps NCCC Traditional, and 640 FEMA Corps members serve per month. CNCS requires assistance from the contractor for one base year with four option years (to include an additional six months for a transition period) in managing the cost of this health benefits program on a day-to-day and long-term basis (as outlined throughout this SOW).

The contactor must be able to provide:

· The staffing, supervision, supplies, services, materials, equipment, facility, information systems, and other infrastructure required to manage the benefits administration to AmeriCorps VISTA, NCCC Traditional, and FEMA Corps members

· Excellent project management and quality controls

· Excellent customer service with qualified, experienced staff in the healthcare field and with the Affordable Care Act (to include an understanding of the workings of the federal and state-based Health Insurance Marketplaces and other health care options available to members)

· A Preferred Provider Organization (PPO) or similarly effective network arrangement throughout the United States, District of Columbia, and all United States Territories

· Access to a pharmacy network throughout the United States, District of Columbia, and all United States Territories (with access to an optional mail-order prescription service for maintenance/non-critical medications)

· Access to a telehealth network, with medical and mental health coverage throughout the United States, District of Columbia, and all United States Territories

· FISMA Compliance and the ability to obtain from CNCS, an Authority to Operate (ATO) before production use/’go live’ date of the system

· Compliance with the Health Insurance Portability and Accountability Act (HIPAA)

· Compliance with all CNCS Personnel Security Policies as described in Section C.8.

· Quality administrative services through a cost competitive strategy which may include:

· Multiple Preferred Provider Organizations (PPOs) or Networks

· Negotiation of Claims (for claims over a certain threshold amount)

· Coordination of medical and pharmacy benefits

· A Federal Information Security Modernization Act (FISMA) fully compliant information system with an Authority to Operate (ATO) that is able to collect, process, monitor, report, and meet any other CNCS business requirement. Reference Information System Security and Privacy Requirements section for specific requirements.

· All other requirements as outlined in this Statement of Work.

The contractor will be required to sign a Conflict of Interest Statement to confirm their independence. CNCS reserves the right to approve the primary PPO network selected by the contractor.

Due to the nature of the Affordable Care Act, changes in CNCS’s policies, procedures, and guidelines are subject to change without notice; therefore, CNCS reserves the right to modify the terms of this contract and Statement of Work (SOW) at any time.

B. Background

The Corporation for National and Community Service is the federal agency responsible for domestic volunteer programs. Members of AmeriCorps are engaged in a term of national service and earn a small living allowance and education award. Most members live at the poverty level during their terms of service.

AmeriCorps VISTA

AmeriCorps VISTA (VISTA) is the national service program designed specifically to fight poverty. Founded as Volunteers in Service to America in 1965 and incorporated into the AmeriCorps network of programs in 1993, VISTA has been on the front lines in the fight against poverty in America for more than 45 years. VISTA members commit to serve full-time for a year at a nonprofit organization or local government agency, working to fight illiteracy, improve health services, create businesses, strengthen community groups, and much more. VISTA members serve throughout the United States and U.S. territories. VISTA members typically serve a 12-month term, but may extend their service or serve one or more additional terms.

AmeriCorps NCCC Traditional and FEMA Corps

AmeriCorps NCCC Traditional (NCCC) is a full-time, team-based residential program for men and women between the ages of 18–24. NCCC and FEMA Corps members serve all throughout the United States and U.S. territories. Members live on one of four campuses, located in Denver, Colorado; Sacramento, California; Vicksburg, MS; and Vinton, Iowa. Each campus supports the area programming for a regional area of the United States and due to availability of space or the desire of Congress, a campus may be directed to move within the region.

The mission of AmeriCorps NCCC Traditional is to strengthen communities and develop leaders through direct, team-based national and community service. In partnership with nonprofit organizations, state and local agencies, and faith-based and other community organizations, members complete service projects throughout the region they are assigned. AmeriCorps NCCC Traditional also implements a special service corps called FEMA Corps; this program began operation in 2012. Members in FEMA Corps are solely devoted to disaster preparedness, response, and recovery.

NCCC Traditional and FEMA Corps members complete an intensive, 10-12 month service commitment. Members may extend their terms of service with CNCS’s approval.

You will find additional information on the background of AmeriCorps and the Corporation for National and Community Service at the following website: http://www.americorps.gov/.

Diverse needs of AmeriCorps Members

All VISTA, NCCC, and FEMA Corps members are eligible for healthcare coverage during the time they are actively in service with AmeriCorps.

Each year and throughout the year, members leave and new members begin service. Member enrollment occurs several times throughout the year with the biggest/peak occurring during the August through October and January through February timeframes. Although some members serve beyond one year (by signing up for a new and often consecutive term of service), most do not and therefore each year, there is a large group of those new to the program (and to the AmeriCorps health benefits program) who will call with questions about healthcare systems, their benefits, the claims process, unpaid bills, etc. Many members will be unfamiliar with benefit terms, the process for submitting claims, and navigating throughout PPO networks and Pharmacy networks.

Members require patience and careful handling. CNCS considers customer service to be very important and expects the contractor to provide answers accurately, promptly, politely, patiently, and thoroughly, with sufficient information for the member to understand what is required of them.

Members earn a small living allowance and education award and most live at the poverty level during their term of service which can make the experience of obtaining healthcare coverage and covering the costs of healthcare premiums, co-pays, and deductibles, a challenge and financial burden.

AmeriCorps Members and the Affordable Care Act

The Affordable Health Care Act (ACA) reform was signed into law in 2010 and ensured that healthcare benefits are made available to all U.S. Citizens. Its implementation on January 1, 2014 required most Americans to have and maintain ACA compliant healthcare coverage, unless they met legal requirements to qualify for an exemption. That requirement was eliminated on January 1, 2019; however, many members do begin their service already covered by health insurance, such as the following:

· Family healthcare coverage: members who are 26 or younger and on a parent’s plan, or married and covered by a spouse’s plan

· Healthcare coverage purchased through the Health Insurance Marketplace (state or federal). AmeriCorps members are eligible for a special enrollment period[footnoteRef:1] (members have 60 days from their start of service and 60 day from the conclusion of service) to sign-up for healthcare coverage [1: http://www.cms.gov/CCIIO/Resources/Regulations-and-Guidance/Downloads/SEP-and-hardship-FAQ-5-1-2014.pdf ]

· Healthcare coverage purchased through a private insurance broker

· Medicaid, Medicare healthcare coverage or military healthcare benefits.

Due to the nature of the Affordable Care Act, changes in CNCS’s policies, procedures, and guidelines are subject to change without notice. Therefore, CNCS reserves the right to modify the terms of this contract and Statement of Work (SOW) at any time.

Currently, VISTA members are provided one of two health care healthcare benefits, depending on their circumstances:

· A supplemental healthcare reimbursement program for VISTA members who have their own health insurance that will cover cost-sharing associated with those benefit services (up to the federally mandated maximum out-of-pocket limit [$7,900 for 2019][footnoteRef:2] per member per service year unless otherwise directed by the COR); OR [2: https://www.healthcare.gov/glossary/out-of-pocket-maximum-limit/

· A self-funded basic health benefits plan for VISTA members who demonstrate they have no other coverage during their term of service.

NCCC and FEMA Corps members are only provided the self-funded basic health benefits plan. They do not have the supplemental healthcare reimbursement program

For specific information on health benefits program design and benefits, see section C.8.

C. CUSTOMER SERVICE

Each year and throughout the year, members leave and new members begin service. Although some members serve beyond one year, most do not and therefore each year, there is a large group of those new to the program who will call with questions about healthcare systems, their healthcare options, their benefits, the claims process, unpaid bills, etc. While members undergo training to include orientation to their health benefits, many will be unfamiliar with benefit terms, the process for submitting claims, navigating throughout PPO networks, and Pharmacy networks.

Members may also be unfamiliar with the United States healthcare systems to include the various healthcare coverage options that may be available to them during service. Members will require support in understanding how the Affordable Healthcare Act impacts them, understanding healthcare options available to them, how to obtain their own healthcare coverage (such as through federal/state health exchanges and/or private health insurance companies), and will require access to appropriate resources to allow them to obtain their own healthcare coverage (such as online resources like links to federal/state health exchanges and references to the types of documentation that will be needed to obtain healthcare coverage). The support of members finding healthcare options during and after service is a key component to the customer service needs of CNCS. As stated above, many members are unfamiliar with the healthcare systems, options, and laws in the United States and therefore navigating the online resources, federal/state health exchanges, and understanding the documentation needs are critical for the successful support and transition of AmeriCorps members.

Members will require patience and careful handling.

CNCS considers customer service to be very important and expects the contractor to provide answers accurately, promptly, politely, patiently, and thoroughly, with sufficient information for the member to understand what is required of them.

D. MEMBER ELIGIBILITY

AmeriCorps VISTA

All VISTA members are eligible for coverage by the AmeriCorps health benefits program during the time that they are actively serving. VISTA may have up to 8,000 members utilizing the benefit annually during the life of this contract with an average of about 5,500 members utilizing the benefit per month. Dependents or other family members of members are not covered by the healthcare program.

Understanding member eligibility requirements, monitoring changes in eligibility, determining which portion of the AmeriCorps Health Benefits Plan will apply to a particular member, and reporting changes in eligibility to CNCS, will be the responsibility of the contractor.

Through this procurement, CNCS will offer a health benefits program to include:

· A supplemental healthcare reimbursement program for AmeriCorps VISTA members that will cover cost-sharing associated with other healthcare coverage services (up to the federally mandated maximum out-of-pocket limit [$7,900 for 2019][footnoteRef:3] per member per service year unless otherwise directed by the COR) for members who have compliant coverage and demonstrate that participation in an ACA-compliant health insurance plan (at least bronze level coverage or higher) during their term of service; and, [3: https://www.healthcare.gov/glossary/out-of-pocket-maximum-limit/

· A self-funded basic health benefits plan for all NCCC and FEMA Corps members, and for VISTA members who demonstrate they have no other coverage during their term of service.

Member usage of this benefit program (specifically the two components above for VISTA members) may change during their term of service; participation will depend on the member’s individual circumstance. Members may enter the VISTA program outside of healthcare open enrollment periods requiring up to 60 days from service start to verify participation in a separate health insurance plan.

The AmeriCorps health benefits program is primary to Medicaid, Medicare, and Military benefits. The AmeriCorps health benefits program is secondary to all private/commercial health insurance plans. Coordination of medical and prescription benefits shall be handled by the contractor.

Upon implementation of this contract, currently serving AmeriCorps members will need to be transitioned into this health benefits program from the current health benefits program. Transition support from the current plan and incumbent will be the responsibility of the new contractor.

AmeriCorps NCCC and FEMA Corps NCCC Traditional and FEMA Corps members are eligible for coverage by the AmeriCorps health benefit plan during the time that they are actively serving. Dependents or other family members of members are not covered by the healthcare plan.

Upon entry into the program (during the Corps Training Institute - CTI), members will be required to provide documentation/verification of other creditable healthcare coverage they hold to the contractor; this information shall be used for Coordination of Benefits with the AmeriCorps Health Benefit Plan.

The AmeriCorps health benefits program is primary to Medicaid, Medicare, and Military benefits. The AmeriCorps health benefits program is secondary to all private/commercial health insurance plans.

Understanding member eligibility requirements, collecting verification of other creditable healthcare coverage, and coordinating benefits, will be the responsibility of the contractor.

E. ADMINISTRATION OF PROGRAM

The contractor is responsible to provide the following:

1. Member Access to Information

a. A toll-free number for members to call into (phone access shall be available for the hearing impaired)

b. A telephone system that is equipped with an automatic call distribution (ACD) system with sufficient capacity to maintain calls during peak times (Busy Hour Call Attempts (HBCA))

c. An after-hours telephone message system must be in operation where detailed messages can be left on the system

d. The telephone system shall have instructions available in Spanish

e. Telephone calls shall be returned within 8 business hours

f. Customer service representatives (CSRs) shall be available during the core hours of 9:00 am to 8:00 pm EST, Monday through Friday, to handle inquiries

i. At least one customer service representative fluent in Spanish must be available daily during core hours

ii. Customer service representatives knowledgeable in the Affordable Care Act and the workings of the state/federal marketplaces must be available to provide support to members in navigating the exchanges and applications for coverage and/or exemption

iii. Customer service representatives knowledgeable in the Federal Employment Compensation Act (FECA) and AmeriCorps eligibility for FECA support (while members are eligible for FECA, they are only able to utilize the benefit after service is completed) must be available to work with insurers who attempt to deny work-related injuries for active members

g. A tracking/ticketing system (approved by CNCS that):

i. Manages calls and inquiries, ensures that calls are logged and responded to in accordance with the timeframes listed in this SOW

ii. Contains access to member data, claims information, and other healthcare coverage information to allow the CSRs to respond to inquiries

h. Secured and dedicated fax line(s), sufficient to cover peak usage times (BHCA), must be available to applicants, providers, and other interested parties to submit claims and documentation

i. A dedicated email address must be available for members, providers and other interested parties to contact the CSRs and contractor’s staff with questions

j. A fully hosted, developed, and designed website must be provided, compatible with common Internet Browsers and Operating Systems, as well as common mobile devices, smartphones, or other platform(s) designated by CNCS. The website will follow the requirements outlined in the Information System Security and Privacy Requirements section of this SOW and must be:

i. Compliant with Section 508 of the Rehabilitation Act

ii. Available to members, providers and other interested parties

iii. Secure and operational within 60 days after contract award

iv. Provides a secure method to collect information from members

v. Outlines member eligibility requirements (as it pertains to location and other healthcare coverage for members), benefits plan description (via a Member Health Care Guide developed by the contractor which shall be available within 60 days of contract award), coordination of benefits information, provider network information and search function, pharmacy network information and search function, telehealth network information, forms (developed by the contractor), state/federal exchange contact information and links, important links and resources to support member’s medical health needs, contractor, contact information (for the contractor and other important contacts), etc.

vi. Easy to navigate to ensure that members, providers and other interested parties can easily find the information outlined in the section above and include search functions, tabs and highlighted links

vii. Include a secure system/component that will allow members and providers to submit and track claims, claim reimbursements, and other supportive documentation electronically and online, to include the submission of supportive documentation

viii. Include a computer ‘chat’ function to allow members to securely receive customer service support from CSRs

ix. Complies with Health Insurance Portability and Accountability Act (HIPPA

k. Forms and Documentation – the contractor shall make available the following fillable forms and documentation in both English and Spanish (at a minimum) electronically and online in order to utilize this benefit and the services outlined in this SOW. All forms must be approved by CNCS before distribution, must be made available 60 days from contract award, and must be compliant with Section 508 of the Rehabilitation Act:

i. Health benefits-enrollment packet

ii. Member Health Care Guide (in both English and Spanish) that explains the program, the benefits covered, all specific exclusions and any other information necessary to fully and clearly explain the coverage

iii. Other Health Care Coverage Form (to capture information on any other health care coverage the member may have)

iv. PPO/Network/Pharmacy Network Directories

v. Information on Mail Order Prescription Drug Services

vi. Accident/Injury Form

vii. Waiver of Coverage Form

viii. Release of Information Form

ix. Explanation of Benefits (EOB) Form – EOB forms for all claims shall be made available to members; however, at the contractor’s discretion, EOBs may be eliminated for claims which have been paid in full

x. Hard copies of the above shall be provided to members when requested.

2. Enrollment, Termination and Certification of Members in healthcare benefits program:

The contractor shall maintain enrollment, termination, and certification services for all members in the healthcare program.

a. If the contractor is not compliant with FISMA at the time of contract award, a detailed plan with specific dates to become compliant and receive, from CNCS, an Authority to Operate (ATO) will be required. This requirement must occur before the production use of CNCS information.

b. The contractor shall be notified of member eligibility via an ‘eligibility data file’ which shall be encrypted and transmitted electronically on a daily basis to include: member start dates, termination dates, DOB, gender, termination date, etc. CNCS and the contractor will agree to a secure method of transferring eligible member information.

3. Claims Processing System:

The contractor shall provide a claims processing system that contains complete definitions of all coverage in the Health Benefits Program (benefits are outlined below in ‘Plan Design’ section) to facilitate the application of benefits in a timely, efficient manner. Below is a sample of past work processes; however, the contractor may provide their own efficient approach for claims processing.

a. Claims Processing Time - Claims shall be processed according to the following averages:

i. Clean claims - ninety (90) percent within 14 days (clean claims are those for which all information necessary to make a decision on claim approval or denial has been received). The contractor will pay promptly the clean part of the claim that can be paid and set to pending the part of the claim for which more information is required

ii. Coordination of benefits claims - ninety (90) percent within 28 days (claims that are received for members who have other insurance)

iii. Ineligible claims - eighty-five (85) percent within 14 days (claims that are received for services that are not covered)

iv. Direct Deposit Payment shall be an option for payment made available to all members who submit claims for personal reimbursement for covered services they have paid for.

b. Coordination of Benefits Claims (COB) Processing – The contractor shall develop and provide a form to be completed by members to capture information on coverage for health care the member may have through some other plan.

i. The information from the completed form shall be entered into the claims processing system. COB information shall be updated according to statements indicated by the members on his/her claim forms. COBs shall be accepted from VISTA candidates as well as active members (COBs may be submitted by candidates up to 35 days prior to service start).

ii. COB information must be verified annually (or more often as needed) through the use of an automatically generated form. If the form is not answered by the member within 30 days, a follow up form shall be sent. If the second form is not answered by the member within 30 days, claims shall be denied until the completed form has been received from the member unless approval otherwise is provided by the COR.

iii. The claims processing system shall maintain all necessary information to automatically process claims involving coordination of benefits. The system shall refer to the members COB information stored on a single file. The file shall be referenced to determine if benefit payments need to be coordinated with another carrier, including Medicare, Medicaid and/or Military benefits.

iv. The claims processing system shall track the total costs paid out (and costs for denied claims) per member per service year and ensure that an excess of the maximum out-of-pocket limit is not paid out on behalf of VISTA members who have other healthcare coverage, unless otherwise approved by the COR.

c. Flagged Claims Processing - The claims processing system shall flag claims received which exceed expected amounts.

i. Place tolerance limits on the type of claim, line of business (hospital versus physician), type of service (surgery versus office visit), or cause (work-related injuries)

ii. Claims shall be suspended for quality review if the dollar tolerance limits are exceeded

iii. Flagged claims shall be reviewed for pre-payment accuracy on a daily basis by a claims processer

iv. Flagged claims that fall outside of the AmeriCorps Health Benefits Program requiring approval (such as large claims for work-related injuries or claims that are for non-medically necessary/elective services) shall be brought to the attention of the COR for review and final approval/denial.

d. Pre-existing Conditions Claims Processing

i. Claims that may include charges for pre-existing conditions shall be identified by the claims processing system. Within the system, all diagnoses which could be related to a pre-existing condition shall be flagged.

ii. The system shall set to pending any claims that are entered with these possible pre-existing diagnoses.

iii. The contractor shall investigate the claim for a previous diagnosis, treatment of the condition, and the effective date of the contract.

iv. A claim identified with a possible pre-existing condition shall be examined by the claims processors. The claims processor shall examine the member’s records to determine if the diagnosis on the claim is related to any previous cases for the same condition.

v. If a case is already being reviewed for the same diagnosis, the claims processor shall add this new information to the case.

vi. If the claim is a new pre-existing condition claim, the claims processor shall request medical documentation from the appropriate provider(s).

vii. When the medical documentation is received the claims processor shall determine if the diagnosis is pre-existing.

viii. The claim shall either be paid or denied based on the claims processor’s analysis and based upon plan design. The claims processing system shall track the number of and value of claims rejected or denied for pre-existing conditions.

4. Subrogation Services The contractor shall perform subrogation services on all claims that indicate potential liability by other parties. All funds received by the contractor for subrogation services will be returned to CNCS. The contractor will reflect these funds in the vouchers for reimbursement.

5. Appeal Process To resolve claim disputes, the contractor shall manage an appeal process where members may submit an appeal in writing or through a phone call to the toll-free number to the contractor.

a. Once the Customer Service Representative (CSR) receives the call or written appeal, he or she shall research the question or concern; retrieve copies of the claim in question, and retrieve other pertinent information.

b. Medical coding, benefit appropriateness, pricing, and patient historical data shall be verified and reviewed depending on the specific situation.

c. Once a complete evaluation is made, the CSR shall notify the member of the outcome.

d. If medical review is necessary, a nurse reviewer shall be assigned to the case. If a higher-level review is required, a physician consultant specializing in the services performed for the claim in question shall be assigned.

e. The average time to respond to an appeal request shall be ten (10) calendar days from the receipt of the claim.

6. Internal Claims Audit The contractor shall audit, on an annual basis through the claims processing system, an appropriate statistical sample of processed claims. The contractor shall also:

a. Maintain a daily log of all transactions entered into the system

b. Track by bill line within the claim: claims processor; type of transaction; and record modification

c. Track the date and time of the transaction.

7. Utilization Review Services The contractor shall provide utilization review services to monitor the use, delivery, and cost-effectiveness of medical services to include:

a. Pre-certification for Hospital Admission- This service shall be provided by the contractor after contract transition by using registered nurses to perform the utilization review function. The reviewers shall have online access to eligibility and plan design information and shall discuss with members seeking authorization for hospital admission the potential of claims payment denial due to an out-of-policy service (such a non-medically necessary/elective service that is not MEC).

b. If a member is out-of-area, or is admitted to a non-participating hospital (out of network), the member shall call the toll-free number to initiate review. If a member is admitted to a participating hospital (in network), it is the provider’s responsibility to notify the contractor of the admission of the member.

c. The contractor shall certify the hospital admission but not automatically certify a set number of days. Instead, days shall be approved in increments based on the patient’s condition, treatment plan, and other factors that can affect the length of hospitalization. A nurse reviewer shall continue to follow the case and certify days, as medically necessary. All cases shall be followed until the date of discharge. Typically, reviews shall be conducted telephonically. If necessary, the contractor shall conduct an on-site review to evaluate the treatment plan.

d. Review staff with medical/surgical clinical experience shall conduct reviews of medical/surgical cases. Staff with clinical experience in mental health shall conduct reviews of mental health cases. Two distinct sets of accepted criteria and/or guidelines shall be used to review medical/surgical and mental health cases. If the admission does not meet the criteria for medically appropriate care, or if the nurse reviewer has any questions about medical appropriateness, the nurse reviewer shall refer the case to a physician advisor of the appropriate specialty. The physician advisor shall review the case, contact the attending physician for additional information, if necessary, and render a decision. All cases with questions, concerns or denials shall be reviewed and certified by a physician.

e. The contractor’s utilization review services office shall be on-line with the contractor’s claims payment system. Information pertaining to utilization review and case management shall be automatically entered into the claims system and matched against claims prior to payment to ensure timely and accurate payment.

8. Consultation Services The contractor shall provide general consultation services to NCCC to include:

a. Consultation on individual member cases - medical and mental health (inclusive of psychiatric) consultation on individual member cases to provide appropriate education, advice, and information to NCCC staff on how to support members with a specific diagnosis and/or symptoms. Consultation services on individual cases will also be required to provide guidance on a member’s suitability to remain in the program with a specific diagnosis and/or symptoms.

i. AmeriCorps NCCC requires expert medical consultation on specific incidences which may require a medical officer/expert to provide information, guidance, or expertise related to a member’s medical condition on an as-needed basis

ii. These services would be in an on-call basis to address needs that arise during the member screenings and medical conditions which occur during a member’s service

iii. Medical experts may be required to speak to providers in regards to specific cases which require suitability determination in order to provide recommendations to AmeriCorps NCCC

iv. Deliverables will include consultation to NCCC by phone with a medical officer/professional who can assist with research, analysis and expert consultation on medical conditions inclusive of mental and behavior health

b. Professional advisement on policy and procedures - expert consultation services to assist and support the NCCC program in the assessment and development of internal program policies, procedures and guidance related to member support and make recommendations on possible improvements to policy/procedure based on industry best practices.

c. Consultation staff shall collectively possess adequate professional proficiency and qualifications/credentialing to provide services required in the statement of work; specific consultation expertise required in medical/surgical, mental health, counseling, and/or psychiatric fields.

9. Actuary services The contactor will provide professional actuary services for estimating future health care costs and analyzing past costs. The contractor will work with the actuary to ensure that all required data is provided to the actuary for an accurate report.

F. NETWORK AND FORMULATION ACCESS:

The contractor will ensure that at least 90% of all members will have access to one network primary care provider/hospital/mental health provider within 10 miles of an urban area. The contractor will ensure that at least 75% of all members will have prompt and timely access to one network primary care provider/hospital/mental health provider within 30 miles of a rural area. All hospitals serviced by the plan should be licensed and accredited as required by the Centers for Medicare and Medicaid Services (see https://www.cms.gov/Medicare/Provider-Enrollment-and-Certification/CertificationandComplianc/Hospitals.html for more information).

a. Member Coverage:

The contactor shall ensure that members are provided with the following:

i. Members shall be provided with twenty-four (24) hour daily coverage while in service

ii. Coverage shall be provided throughout each of the fifty (50) United States, the District of Columbia, and all United States territories

iii. Member coverage shall commence automatically on either the date of entrance into AmeriCorps service or on the date of entry into training should a medical situation/issues necessitate AmeriCorps health benefits, whichever is earlier

iv. Member coverage shall terminate automatically at midnight on the date of the termination of service of the member or termination of this contract, whichever date is earlier

v. Coverage can be waived by a member by signing a ‘Waiver of Coverage’ form (developed by the contractor)

vi. The contractor shall be notified of member eligibility via an eligibility data file which shall be transmitted electronically and encrypted daily to include: member start dates, termination dates, DOB, gender, termination date, etc.; additionally, the contractor will have access to eligibility data through a secure method of transferring eligible member information.

b. Healthcare Coverage Options Post-Service:

The contractor shall provide all members (regardless of service completion date) with customer service support that allows for information sharing on the healthcare coverage options available to members upon completion of service with AmeriCorps, to include how to obtain their own healthcare coverage. The contractor shall ensure that the customer service representative are knowledgeable in the Affordable Care Act and can explain options available to members to include directing members to appropriate resources (such as state and federal healthcare exchanges) to obtain their own healthcare coverage and providing documentation on their AmeriCorps Health Benefits should it be required. Resources can be shared via the contractor’s website and/or through other resources such as forms and the healthcare coverage guide.

All AmeriCorps members are eligible for a Special Enrollment Period[footnoteRef:4] (SEP) on the healthcare marketplace; the special enrollment period covers a 60-day period from the start of service in AmeriCorps in addition to a 60-day period from the completion of service. This SEP is important in particular for members exiting service and in preparation for their life after AmeriCorps. [4: https://marketplace.cms.gov/technical-assistance-resources/5-6-14-americorp-sepfinal.pdf ]

c. Certificate of Coverage:

Upon completion of service, members shall receive a ‘Certificate of Health Coverage’ provided by the contractor if they request one. This certificate shall contain at a minimum:

1. Name of member

2. Dates the member was covered (start date and termination date)

3. Name of the plan: AmeriCorps Health Benefits plan

4. Date the certificate was issued.

d. Verification of Coverage:

The contractor will provide such verification of coverage as may be required by a member to comply with the rules or regulations to which they are subject. Verification shall be provided via a letter or form developed by the contractor. Verification of coverage documentation shall be provided to a member within two (2) business days of receipt of a request.

G. INFORMATION SYSTEM SECURITY AND PRIVACY REQUIREMENTS

The following items are directly related to meeting the federal and CNCS requirements for an information system in regard to cybersecurity and privacy.

i. Required FAR Clauses The following FAR clauses are included by reference below, in all IT service and/or IT service-related solicitations and contracts:

· 52.224-1, Privacy Act Notification

· 52.224-2, Privacy Act

· 52.224-3, Privacy Training

· 52.202-1, Definitions

· 52.239-1, Privacy or Security Safeguards

· 52.204-21, Basic Safeguarding of Covered Contractor Information Systems

· 52.227-14, Rights in Data – General and Alternate V

ii. Laws, Standards, Policy, and Guidance The activities as required by this contract necessitate the Contractor’s access to Government Information, including Controlled Unclassified Information (CUI) and personally identifiable information (PII). The contractor shall meet and comply with all CNCS’ Information Technology (IT) security policy requirements, NIST standards and OMB guidelines, and other applicable Government-wide laws and regulations that apply to the protection and security of IT systems.

Contractors are required to comply with current IT security and privacy requirements as outlined in CNCS policies and Federal statutes, regulations, policies and guidance, as applicable. These requirements include but are not limited to:

· Federal Information Security Modernization Act of 2014 (FISMA), as amended

· Privacy Act of 1974, (5 U.S.C. § 552a)

· E-Government Act of 2002, Section 208

· Title V - Confidential Information Protection and Statistical Efficiency Act of 2002 of the E-Government Act of 2002 (CIPSEA)

· Executive Order 13556 for Controlled Unclassified Information (CUI)

· Clinger-Cohen Act of 1996 also known as the “Information Technology Management Reform Act of 1996”

· Office of Management and Budget (OMB) memorandums and circulars

· Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource”

· NIST Special Publication (SP) 800-18 (as amended), “Guide for Developing Security Plans for Federal Information Systems”

· NIST SP 800-30, “Guide for Conducting Risk Assessments”

· NIST SP 800-34, “Contingency Planning Guide for Federal Information Systems”

· NIST SP 800-37, (as amended), “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy”

· NIST SP 800-47, “Security Guide for Interconnecting Information Technology Systems”

· NIST SP 800-53 (as amended), “Security and Privacy Controls for Information Systems and Organizations”

· NIST SP 800-53A (as amended), “Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans”

· FIPS PUB 140-2, “Security Requirements for Cryptographic Modules”

· FIPS PUB 199, “Standards for Security Categorization of Federal Information and Information Systems”

· FIPS PUB 200, “Minimum Security Requirements for Federal Information and Information Systems”

· CNCS Privacy Policy

· CNCS Cybersecurity Policy

· Any other relevant Federal laws, regulations, policies and guidance that CNCS must adhere to in the agency’s IT acquisition efforts The Contractor and any subcontractor must not publish or disclose in any manner without prior written consent, the data/information to which the Contractor will have access because of this contract, as this is the sole property of CNCS. Contractors/subcontractors may be held responsible for any violations of confidentiality.

iii. Information System Security Requirements The Contractor shall comply with implementation of required security and privacy controls for protection of the CNCS information system based on the sensitivity of the data within the system as outlined by Federal, statutory and regulatory requirements and guidance, and CNCS policies and procedures. The Contractor facilities and IT systems shall meet the security requirements for the same impact level or greater as defined by the FIPS 199 as required for the protection of Government Information. The Contractor shall maintain the Authorization to Operate (ATO) under Ongoing Authorization for all federal information systems that operate under this contract. In accordance with CNCS OIT applicable policies and procedures the Contractor will report on the continuous monitoring of security controls and complete an annual assessment as directed by the Government. The Contractor shall prepare a new System Security Plan (SSP) that includes all aspects of the current (As Is) system configuration and architecture no later than 21 business days after award using guidance provided by the Government.

The Contractor at a minimum shall provide CNCS with the following security related positions as defined in NIST 800-37 rev2, Risk Management Framework for Information Systems and Organizations:

a. System Administrator

b. System Security Officer

c. System Privacy Officer

iv. Website Requirements The Contractor will apply the following requirements to their websites, as applicable.

1. If the website processes CUI it must use HTTPS and support HSTS.

a. The requirement to use only approved government domains (.gov) does not apply in circumstances where CNCS is a user/customer of a third-party website or service that resides on a non-governmental domain.

2. The Contractor shall participate in the General Service Administration’s (GSA) Digital Analytics Program (DAP) and deploy the DAP tracking code on all public facing websites that are operating on behalf of CNCS or CNCS is a customer.

3. The Contractor shall ensure the website is accessible, compatible and responsive on multiple mobile devices.

v. Privacy Impact Assessment The contractor must complete a Privacy Impact Assessments (PIAs) in accordance to the E-Government Act of 2002, sec. 208., and the Privacy Act of 1974, for contractor systems or new technologies that collect, maintains or disseminates personal identifiable information (PII) from 10 or members of the public.

In order to ensure the physical and information systems security of the confidential information, agencies shall conduct inspections of any off-site facility that harbors confidential information protected under CIPSEA.

vi. Privacy Breach Notification A breach is not limited to an occurrence where a person other than an authorized user potentially accesses PII by means of a network intrusion, a targeted attack that exploits website vulnerabilities, or an attack executed through an email message or attachment. A breach may also include the loss or theft of physical documents that include PII and portable electronic storage media that store PU, the inadvertent disclosure of PII on a public website, or an oral disclosure of PII to a person who is not authorized to receive that information. It may also include an authorized user accessing PII for other than authorized purpose. Often, an occurrence may be first identified as an incident, but later identified as a breach once it is determined that the incident involves PII, as is often the case with a lost or stolen laptop or electronic storage device.

In the event that the Contractor experiences a privacy breach that involves CNCS information, the Contractor is required to do the following:

· Notify CNCS’ POC or designee, within one hour of a suspected or confirmed breach, in any medium or form, including paper, oral, and electronic. If the CNCC POC or designee is unavailable, the contractor shall notify NCCIC/US CERT. Contractor shall provide at a minimum, the following information:

· Date and time the breach was discovered

· The type of information potentially compromised by the suspected or confirmed breach

· Number of individuals affected by the suspected or confirmed breach

· Steps taken to notify the individuals affected by the suspected or confirmed breach

· Identification of the breakdown in safeguards that led to the suspected or confirmed breach

· Any additional information relevant to the breach Understand that reporting a privacy breach shall not, by itself, be interpreted as evidence that the Contractor or its subcontractor (at any tier) failed to provide adequate safeguards for PII.

All determinations related to CNCS information incidents, including response activities, notifications to affected individuals and/or Federal agencies, and related services (e.g., credit monitoring) will be made in writing by the Contractor in consultation with the CNCS COR and/or Chief Privacy Officer.

The Contractor shall provide full access and cooperation for all activities determined by the CNCS to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents.

Incident response activities determined to be required by the CNCS may include, but are not limited to, the following:

a. Inspections

b. Investigations

c. Forensic reviews

d. Data analyses and processing CNCS, at its sole discretion, may obtain the assistance from other Federal agencies and/or third-party firms to aid in incident response activities.

vii. Notifying Individuals of a Privacy Breach The Contractor shall not proceed with notification unless the COR, in consultation with the CNCS Chief Privacy Officer, has determined in writing that notification is appropriate.

The notification method may consist of letters to affected individuals sent by first class mail, electronic means, or general public notice, as approved by CNCS. Notification may require the Contractor’s use of address verification and/or address location services. At a minimum, the notification shall include:

· A brief description of the incident

· A description of the types of PII

· A statement as to whether the PII was encrypted or protected by other means

· Steps individuals may take to protect themselves

· What the Contractor is doing to investigate the incident, to mitigate the incident, and to protect against any future incidents

· Information on how to obtain additional information

viii. Definitions The following definitions apply to this contract:

a. Breach: The loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose.

b. Controlled Unclassified Information (CUI): CUI is information that requires safeguarding or dissemination controls pursuant to and consistent with applicable law, regulations, and government-wide policies but is not classified under Executive Order 13526 or the Atomic Energy Act, as amended.

c. DAP: The Digital Analytics Program (DAP) offers advanced, easy Web analytics to federal agencies. The program is a hosted shared service provided by GSA’s Technology Transformation Service.

· More information about DAP can be found at https://https.cio.gov/faq/

d. HSTS: HTTP Strict Transport Security (HSTS) is a simple and widely supported standard to protect visitors by ensuring that their browsers always connect to a website over HTTPS. HSTS exists to remove the need for the common, insecure practice of redirecting users from http:// to https://URLs.

· More information about HSTS can be found at https://https.cio.gov/hsts/

e. HTTPS: Encrypts nearly all information sent between a client and a web service. When properly configured, an HTTPS connection guarantees three things:

· Confidentiality. The visitor’s connection is encrypted, obscuring URLs, cookies, and other sensitive metadata.

· Authenticity. The visitor is talking to the “real” website, and not to an impersonator or through a “man-in-the-middle”.

· Integrity. The data sent between the visitor and the website has not been tampered with or modified.

· A plain HTTP connection can be easily monitored, modified, and impersonated.

· More information about federal HTTPS requirements can be found at https://https.cio.gov/faq/

f. Information: This term is synonymous with the term Data. Both terms refer to single or multiple instances of facts, ideas, knowledge, instructions, etc. in any medium or form that can be stored, transferred, communicated, or process.

g. Incident: An occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

h. Information System: A discrete set of information resources organized for the collection,…