A2-ATTM026.xlsx
XLSX spreadsheet 35 KB Posted
- Attached to
- HEALTH AND WELFARE CRITICAL INCIDENT MAN
- Solicitation number
- 5400027650
- Issued by
- Richland County, South Carolina
About this file
This file is a Questions and Answers document for the Health and Welfare Critical Incident Management (HWCIM) system procurement issued by the South Carolina Department of Health and Human Services (SCDHHS). The RFP seeks a comprehensive critical incident management solution to consolidate functionality currently distributed across multiple agencies, including the Phoenix system used by SCDHHS and the Incident Management System (IMS) used by the South Carolina Department of Disabilities and Special Needs (DDSN). The solution must perform analytical procedures on Medicaid claims data to identify unreported critical incidents, interface with the SCDHHS MES Core enterprise information hub, and comply with the CMS Access Rule requirements. The system is expected to serve approximately 1,030 active users in year two of operations, handling both state and federal funding sources. Offerors must demonstrate implementation experience in at least three federal, state, local, or private healthcare environments, successful implementation in a state environment, and completion of federal approvals (including CMS Operational Readiness Review or Certification Review, or equivalent federal agency approvals). The proposed project manager must have a minimum of three years of experience with the critical incident management solution platform, with at least two years in health and human services.
The RFP specifies stringent service level agreements including response times not exceeding three seconds for simple queries and five seconds for complex queries exceeding 3,000 rows, critical incident notification within 30 minutes with resolution planning within two hours, and disaster recovery restoration within eight hours. The State will not amend RFP terms to allow vendor exceptions and will not consider modifications to liquidated damages provisions, default termination reciprocity, or extended incident resolution timelines. Security and privacy controls must comply with CMS Minimal Acceptable Risk Safeguard for Exchanges (MARS-E) version 2.2, HIPAA, NIST 800-63 standards (minimum IAL2, AAL2, FAL2), and Section 508 accessibility requirements. The State confirmed it does not anticipate Social Security Administration data handling and will provide office and conference room space for vendor personnel onsite in Columbia, SC. The State disclosed no defined budget or funding cap and will not disclose budget information; offerors are instructed to provide their best pricing for the implementation period and four-year base term.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| A2-Amendment.docx | DOCX document | |
| ATTM004-PDF.pdf | ||
| Award Posting Extension.doc | DOC document | |
| ATTCH005.docx | DOCX document | |
| A2-ATTM013.xlsx | XLSX spreadsheet | |
| Attachments.zip | ZIP file | |
| Public Library.zip | ZIP file |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| ATTM 026 - QUESTIONS and ANSWERS | ||||||
| Question # | RFP Page # | RFP Subsection | RFP Language | Questions | SCDHHS Response | |
| 1 | 24 | 3.1.1 1915(C) Home- and Community-Based Waiver Health and Welfare Assurance and Subassurances | "...the Contractor shall implement a critical incident management solution which must: Perform analytical procedures, such as data matches, on Medicaid claims data to identify any unreported critical incidents and investigate as needed" | Because this is a requirement, can the State please identify the corresponding item number in the Requirements Response Book matrix (ATTM 013) that specifically requires data matches on Medicaid claims? Or does the State prefer to reword an item number in the Requirements Response Book matrix to include the language as stated in sections 3.1.1 and Table 4.1.3.2.9-1 (ID#4) that the solution must perform analytical procedures, such as data matches, on Medicaid claims data to identify any unreported critical incidents and investigate as needed? | Refer to ATTM 013 Requirements Response Book, Requirement ID #75. | |
| 1a | 53 | Table 4.1.3.2.9-1 (ID #4) | Describe your system’s ability to perform analytical procedures such as data matches on Medicaid claims data to identify any unreported critical incidents that may warrant further investigation. | Same as above | Refer to ATTM 013 Requirements Response Book, Requirement ID #75. | |
| 2 | 39 | 3.2.4.1.9.2-1 CEFs Table: Ref #5 | The State owns any software that is designed, developed, installed, or improved with 90 percent (90%) FFP. | For COTS or SaaS software that will be licensed to the state, can the State please confirm that this is not applicable? | SCDHHS owns any custom developed software. SCDHHS executes software licensing agreement for COTS/SaaS. See Attachment 024 South Carolina Standard Amendment to End User License Agreement for Commercial Off-The-Shelf Software - Single Agency. | |
| 3 | 39 | 3.2.4.1.9.2-1 CEFs Table: Ref #6 | The Department has a royalty free, non-exclusive, and irrevocable license to reproduce, publish, or otherwise use and authorize others to use, for Federal Government purposes, software, modifications to software, and documentation that is designed, developed, installed or enhanced with 90 percent (90%) FFP. | For COTS or SaaS software that will be licensed to the state, can the State please confirm that this is not applicable? | See response to Question #2. | |
| 4 | 45 | 5. | 3.2.8.1 Security and Privacy Controls | Contractor shall develop and maintain a security and privacy program with effective security and privacy controls compliant with recognized security operating controls, including but not limited to: (bulleted list follows) | This section currently includes the phrase “including but not limited to.” Can the State please clarify the wording of this requirement to inform offerors of the specific security and privacy controls that are required? | Refer to Amendment 1, Section 3, Provision 3.2.8.1 Security and Privacy Controls, as amended. |
The specific security and privacy controls are listed inside of Centers for Medicare and Medicaid Service's (CMS) Minimal Acceptable Risk Safeguard for Exchanges (MARS-E), current version 2.2.
The phrasing "including but not limited to" of this requirement accounts for changes of data contained within the system and any changes to acts, regulations, and standards which may occur during the term of the Contract.
| 5 | 57 | 4.1.3.4.1 Section D1. Corporate Background – Bullet 5 | Offeror has completed at least one (1) Operational Readiness Review (ORR) or final Certification Review (CR) with CMS. A combined ORR/CR attempt may satisfy this requirement | Given how recently the CMS Access Rule was released and how this RFP specifically relates to the provisions of the Access Rule, would the State consider removing this requirement or changing it so that the offeror will complete an ORR or CR with CMS if awarded the contract? | No. |
| 6 | Requirements Response Book | Requirements #72 and 73 | 72: The system shall have the ability to display information in the form of a dashboard with various snippets of information, including but not limited to: existing dashboards that are currently being used by the agencies and information related to pending tasks, incident details, participant details, addendums, dispositions, workflow details, claims data match details, workload details, tracking, and trending details. |
| 73: The system shall allow authorized users to view details for each item displayed within the dashboard. | Requirements matrix items #72 and #73 refer to the importance of data analytics. Does this include the ability of the solution to provide predictive analytics or anomaly detection? | The Offeror should describe how their analytical tools or solutions meets the Requirements. | |||
| 7 | n/a | General - Budget | n/a | 1)Does SCDHHS have a defined budget or funding cap for the Health and Welfare Critical Incident Management (HWCIM) project? |
| 2)If so, could you provide guidance on the range or allocation for implementation, integration, and ongoing operations and maintenance? | No. | ||||
| 8 | n/a | General - Funding | n/a | 1) Are there specific funding constraints or caps that bidders should be aware of when proposing solutions or pricing? |
2)What is the anticipated funding source for this Health and Welfare Critical Incident Management (HWCIM) project? 1) No.
2) State and Federal funding.
| 9 | n/a | General - Prior Demonstrations | n/a | Has the State already seen demonstrations for technology as required by this RFP and if so, from whom? | Question is not relevant to this solicitation. |
| 10 | 24 | 3.1.1 1915(C) Home- and Community-Based Waiver Health and Welfare Assurance and Subassurances | CMS final rule, "Ensuring Access to Medicaid Services" (see 89 FR 40542) aims to improve access to care, quality of care, and Beneficiary health and quality of life outcomes, particularly for Home and Community-Based Services (HCBS). This rule includes significant provisions that impact critical incident reporting for HCBS waivers. | As required by the Access Rule (section 441.302(a)(6)(i)(D)), states are required to use Medicaid Fraud Control Unit (MFCU) data to identify unreported critical incidents. How many years of experience does an offeror need to have with MFCUs and/or MFCU data? | Offeror, must comply with the "Ensuring Access to Medicaid Services" rule. |
| 11 | n/a | General - Data Analytics | n/a | Does the State envision using the data analytics solution for broader Medicaid program insights beyond incident management, such as quality of care evaluation or cost containment strategies? | SCDHHS is seeking a solution to meet stated requirements. |
| 12 | 25-26 AND 93 | Table: 3.1.2.1.1-1: Incident and User Volume – Phoenix AND Table: 3.1.2.1.2-1: Incident and User Volume – SCDDSN IMS AND 8.1.4.1 Total All-Inclusive Evaluated Price | The current operations for critical incident management is spread across multiple agencies. In addition, some functionality is part of larger systems with many users. This situation has made it difficult to estimate the number of possible users for this system. SCDHHS has provided, within the price spreadsheet, the number of users to use when estimating annual operational price. The number of users identified in the price spreadsheet is not a guarantee of the actual number of users. This Total All-Inclusive Evaluated Price is used when evaluating each Price Proposal. | Tables 3.1.2.1.1- and 3.1.2.1.2-1 on pages 25-26 set forth a current active user count of approximately 1,592. Tab 4 of Attachment 8 sets forth an anticipated user count in year 2 of 1,030 active users. Is this a discrepancy in anticipated user counts and should respondents proceed with the estimated users provided in Attachment 8? | Offerors should utilize the count specified in ATTM 008. The count specified in ATTM 008 is based on the anticipated combined active user count. |
| 13 | General | General | General | The State has conveyed in the evaluation criteria that it seeks a financially strong and stable vendor to serve as a long-term partner with SCDHHS and a vendor that has successfully delivered and maintained projects project of the size, scope, and complexity of the SCDHHS effort. However, the terms throughout the RFP include seemingly non-negotiable provisions that large, financially strong and proven vendors in this space would deem too risky to accept and seem misaligned with the types of solutions or engagements this RFP solicits. This may limit the competitive nature of the bid by financially strong vendors electing not to participate. It may also result in the State effectively assuming all risk associated with the project by awarding to smaller, less stable and proven vendors who will agree to all terms to obtain State business without resources to adequately support obligations, both financially and technically. |
| Will the State amend the RFP to provide vendors an opportunity and format to request reasonable exceptions without being deemed unresponsive? | No. SCDHHS will not Amend the Solicitation. | |||||
| 13Continued | Will the State amend the RFP to provide vendors an opportunity and format to request reasonable exceptions without being deemed unresponsive? | No. SCDHHS will not Amend the Solicitation. | ||||
| 14 | 63 | 6.4 DISCUSSIONS AND NEGOTIATIONS - OPTIONAL | Negotiations may involve both price and matters affecting the scope of the Contract, so long as Changes are within the general scope of the request for proposals. If negotiations are conducted, the State may elect to disregard the negotiations and accept your original proposal | In effort to not limit the competitive nature of the bid by deeming financially strong vendors who seek to negotiate a modest number of provisions in the RFP as being unresponsive, will the State amend Section 6.4 to remove the final sentence that allows the state to disregard negotiations and accept the original proposal and clarify that the State will negotiate in good faith? | No. SCDHHS will not Amend the Solicitation. | |
| 15 | 66 | Section 7 TERMS AND CONDITIONS -- A. GENERAL | General | Will the state confirm that the State does not seek to "own" a vendor's intellecutal property? | Refer to Amendment 1, Section 7C, Provision 7.65 OWNERSHIP OF DATA (SCDHHS) | |
| 16 | 39 | 3.2.4.2 Data Conversion Phase | The Data Conversion Phase shall include all actions necessary to accomplish the conversion of legacy data into data for the Contractor system and the physical loading of converted data into the Contractor system. | Will the State please provide a database schema and/or listing of the specific data elements needed from the SCDHHS – Incident Management System (Phoenix) and SCDDSN – Incident Management System (IMS) systems so vendors can adequately scope / estimate the level of effort required for data conversion? | The Solicitation provides record counts. A detailed database schema will be provided to Contractor after award. | |
| 17 | 96 | ATTM 013 Requirements Response Book | ||||
| # 46 | The system shall allow authorized users to soft delete an unresolved incident report. | Will the State please provide / describe the use case / scenario whereby an unresolved incident should be soft deleted? | Incidents can evolve and shift into different categories and sub-categories from initial to final reporting. Example: Critical Incident leading to Death. | |||
| 18 | 96 | ATTM 013 Requirements Response Book | ||||
| # 70 | The system shall capture all data elements related to Critical Incident Management including, but not limited to, that are currently being used in the Phoenix system. | Will the State please provide a database schema and/or listing of the specific data elements needed from the Phoenix system so vendors can adequately scope/estimate data capture requirements? | Refer to response to Question 16. | |||
| 19 | 96 | ATTM 013 Requirements Response Book | ||||
| # 71 | The system shall capture all data elements related to Critical Incident Management including, but not limited to, that are currently being used in the Incident Management System (IMS). | Will the State please provide a database schema and/or listing of the specific data elements needed from the Incident Management System (IMS) system so vendors can adequately scope/estimate data capture requirements? | Refer to response to Question 16. | |||
| 20 | 32 | 3.2.4.1.4 | SCDHHS MES Core serves as the SCDHHS enterprise information hub for providing a consistent way of integrating with the different components in the Enterprise Architecture. The Contractor shall coordinate all data transfers and interfaces with the SCDHHS MES Core. | Will the State please provide documentation / specifications for the SCDHHS MES Core integration hub so vendors may adequately scope / estimate data transfer and interface requirements? | Solicitation includes specific requirements for interfaces. Refer to ATTM 013 Requirement Response Book. |
More detailed information will be provided to Contractor after award.
| 21 | 96 | ATTM 013 Requirements Response Book | |
| # 93, 95, 96 | Contractor shall interface with MES Core to obtain (Claims / Medicaid and Non-Medicaid Participant / Provider) data from (MMIS, Provider portal, Phoenix, and Consumer Data Support System (CDSS)) using Fast Healthcare Interoperability Resources (FHIR) standards... | Will the State please provide documentation / interface or file specifications / required data elements / etc. for the MMIS, Provider portal, Phoenix, and Consumer Data Support System (CDSS) systems so that vendors may adequately scope/estimate data transfer and interface requirements? | Solicitation includes specific requirements for interfaces. Refer to ATTM 013 Requirement Response Book. |
More detailed information will be provided to Contractor after award.
| 22 | 56 | 4.1.3.3.2 | A description of proposed work locations of the staff during the various phases of the Contract and while conducting various tasks. Be sure to identify which activities Offeror’s staff will perform onsite in Columbia, SC | Will the State provide office and/or conference room space when vendor's personnel are onsite? | Yes. | |
| 23 | 96 | ATTM 013 Requirements Response Book | ||||
| # 115, 128 | The system shall have the ability to generate a report listing participants with incident details that are scheduled to be purged. | Requirement #115 seems contradictory to #128 which indicates a data retention period of ten (10) calendar years from the incident report last updated date. |
Please describe the use case / scenario / circumstance whereby a record would be 'purged'. ATTM 013 Requirements Response Book, Requirements ID #115 and #128 do not contradict each other.
Data in IMS must be purged in accordance with SCDHHS data retention policy guidelines. For HWCIM, the data retention period is ten (10) years, as specified in Requirement #128.
Users need to be informed about the data scheduled for purging. Requirement #115 will provide users with this information.
| 24 | 96 | ATTM 013 Requirements Response Book | |
| # 136 | The system shall have the ability to capture the agency name and contact details when an incident report is assigned to an external agency. | 1) Are the external agencies described expected to be users within the CIMS system? |
2) If so, please provide information on the specific agencies/user roles. 1) Yes
2) At this time there are no immediate plans to provide access to any agency other than SCDHHS and Disabilities and Special Needs (DDSN).
| 25 | 43 | 3.2.7 | ||
| SLA 3 | Response time for SCDHHS user-initiated functionality related to the HWCIM database including simple queries shall not exceed three (3) seconds and for complex queries whose output is greater than three thousand (3,000) rows shall not exceed five (5) seconds of the time, excluding batch interface updates. Performance is measured by predefined sample (that is defined and agreed upon by SCDHHS and the Contractor within the System Deployment Plan - Technical Deliverable) measuring timestamp data as defined from the time that the request packet reaches HWCIM system to the time that response packet exits the HWCIM system. | How is the predefined sample selected? | Predefined sample is selected as described in the SLA 2. | |
| 26 | 54 | Table 4.1.3.2.9-1: Use Cases | 16. Approach to Project Management. Describe your understanding of the DASH project management processes and the Offeror’s proposed approach to meeting the expectations outlined in: |
ATTM 015 PGM.PLAN.0002 - REQUIREMENTS MANAGEMENT PLAN
ATTM 016 PGM.PLAN.0003 - RISK MANAGEMENT PLAN
ATTM 017 PGM.PLAN.0004 - COMMUNICATIONS MANAGEMENT PLAN
ATTM 018 PGM.PLAN.0005 - ISSUE MANAGEMENT PLAN
ATTN 019 PGM.PLAN.0006 - CHANGE MANAGEMENT PLAN
ATTM 020 PGM.PLAN.0007 - SCHEDULE MANAGEMENT PLAN
ATTM 021 PGM.PLAN.0010 - MASTER TEST PLAN
ATTM 022 PGM.PLAN.0011 - TRAINING PLAN
17. Approach to Project Management. The Contractor will be expected to abide by the project management plans developed by DASH. Describe the Offeror’s understanding of the DASH project management processes and the Offeror’s proposed approach to meeting the expectations outlined in Section 3.2.
| Please describe the difference in use cases 16 and 17 in the use cases table. Both appear to ask for vendors to describe their understanding of DASH's project management processes and the proposed approach to meeting the processes. | Refer to Amendment 1, Table 4.1.3.2.9-1 as amended | |||||
| 27 | 34 | 3.2.4.1.8 Training Phase | • | SCDHHS project staff, program staff, and operations staff on the operation of the application such that they are capable of performing and executing their assigned responsibilities in support of the development, testing, deployment, and operations activities | How many project staff, program staff, and operations staff will be involved in project activities? | We estimate that no more than forty (40) staff in this category will require training. |
| 28 | 34 | 3.2.4.1.8 Training Phase | Training Phase | 1) If the contractor proposes instructor-led training, does the State have available training facilities? |
2) If so, how many users can be accomodated in the facility? 1)Yes.
2) SCDHHS has access to training facilities to accommodate max training classroom size as described in ATTM 022 PGM Plan.0011 - Training Plan.
| 29 | 35 | 3.2.4.1.8 Training Phase | Contractor shall provide alternate training schedules to allow for normal business operations. | Does "alternate training schedules" mean multiple training sessions available for the same audience? | Yes. | |
| 30 | 44 | 3.2.8.1 | • | SCDHHS requires that all application users are identified to at least Identity Assurance Level 2 (IAL2) as defined in Electronic Authentication Assurance Level Guidelines for ACA Administering Entity Systems and use only approved MFA methods. All applicable mandated compliance requirements shall be achieved. Any exceptions to this must be documented and approved by SCDHHS. | Can the State provide the approved MFA methods? | Refer to Amendment 1, Section 3, Provision 3.2.8.1, Security and Privacy Controls. |
The MFA method must be compliant with at a minimum levels IAL2, AAL2, FAL2, and associate sub requirements, as defined by NIST 800-63.
31 45 3.2.8.1 • Develop and provide a SCDHHS currently adopted version of MARS-E and HIPAA compliant System Security Plan (SSP) which outlines the safeguards implemented to support the protection of government data. Can the State clarify what the current adopted version of MARS-E and HIPAA compliant SSP means? Refer to Amendment 1, Section 3, Provision 3.2.8.1, Security and Privacy Controls.
The phrasing of this requirement accounts for any potential updates to the SSP, security framework, and/or security controls.
The currently adopted version of MARS-E SSP is version 2.2 released February 23, 2021, which meets the HIPAA requirement.
| 32 | 96 | 9.1, ATTM 025 | SOFTWARE TABLE | Confirm that this attachment does not have to be completed and submitted with the proposal. | Refer to Amendment 1, Section 4, Provision 4.1.3.1 as amended. | |
| 33 | 96 | 9.1 | ||||
| ATTM 025 | Software Table | Confirm if this attachment is to be completed and submitted with the proposal. If so, what section of the response should it be included in? | Refer to Amendment 1, Section 4, Provision 4.1.3.1 as amended. | |||
| 34 | 42 | 3.2.7 | Service Level Agreements (SLAs) | Would the State consider a monthly or other limit on the total amount of Liquidated Damages assessed during a given period? | No. | |
| 35 | 42 | 3.2.7 | Service Level Agreements (SLAs) | Would the State consider adding a provision applicable to all SLAs that provides contractors the ability to recoup assessed damages for the failure to meet an SLA if the contractor is able to show it can successfully meet that SLA without fail for a period of time? | No. | |
| 36 | 42 | 3.2.7-1 | Contractor is not responsible for loss or degradation of system access for reasons beyond Contractor's control, such as State network outages or State performance issues, or problems that arise in the State's infrastructure. | May offerors assume the principle (that Contractor is not responsible for missed SLAs for reasons beyond the Contractor’s control) apply to the remaining SLAs? | No. | |
| 37 | 76 | 7.33 | (a) (1) The State may, subject to paragraphs (c) and (d) of this clause, by written notice of default to the Contractor, terminate this Contract in whole or in part | Will the State consider a mutual termination for default provision to address potential breaches by the State? | No. | |
| 38 | 2 | ATTCH005 |
HIPAA BAA
C.E.1. (1) If the Business Associate receives or accesses Social Security Administration (SSA) owned data from the Covered Entity, the Business Associate will report any breaches of which it becomes aware of within 1 hour of discovery. Does the State expect Social Security Administration Data to be handled under this Agreement?
No, SCDHHS does not expect Social Security Administration Data to be stored, transmitted or housed in the system.
39 43 3.2.7-1 SLA 3 Contractor shall notify SCDHHS of and resolve Incidents as follows:
Critical Incident: An outage with severe security, financial or productivity implications to the solution users where there is no workaround (a Critical Incident) caused by the Contractor and their Subcontractor(s): Notification to SCDHHS within thirty (30) minutes of Contractor becoming aware of such Critical Incident. Resolution or plan for the resolution within two (2) hours of the Contractor becoming aware of such a Critical Incident.
| Major Incident: An event causing disruption to the solution users or SCDHHS business where there is no alternative workaround, with major material negative productivity or financial implications to the SCDHHS, caused by the Contractor and their Subcontractor(s). Notification to SCDHHS within one (1) hour of the Contractor becoming aware of a Major Incident. Resolution or plan for resolution within one (1) calendar day of the Contractor becoming aware of such a Major Incident. | Will the State consider adding language to this SLA to allow for a longer period of time for resolution of Critical Incidents and Major Incidents if agreed to by both Parties? | No. | ||||
| 40 | 44 | 3.2.7-1 SLA 5 | On the occurrence of a disaster, Contractor will restore essential Services, irrespective of the time the incident occurred, in less than eight (8) hours. | Would the State consider a longer time to restore essential Services? | No. | |
| 41 | 44 | 3.2.7-1 SLA 8 | Calls shall be answered by an agent within one (1) minute. The expected call answer rate service level is 80% at one (1) minute or less. |
Call Answer Rate = (Calls answered within one (1) minute or less / Total number of calls received) * 100
First contact resolution rate shall be 75% or higher per month.
First Contact Resolution = (Total number of call resolved on first attempt (not transferred) / Total number of calls received) *100
Call abandonment rate for Help Desk calls shall not exceed 8% per month.
| How is resolution defined in this instance? | Callers needs/issues are addressed in the initial call requiring no further follow-up. | ||||
| 42 | 1 | Pre-Proposal Conference | Will slides or a recording from the pre-proposal conference be made available to thoes unable to attend? | No. | |
| 43 | 25 | Solution Environment | Phoenix system | 1) Why is the state abandoning Phoenix for a new system. |
| 2) What are the limitations or learnings from Phoenix that the state is aiming to address. | Question is not relevant to this solicitation. | |||||
| 44 | 94 | Prices and Costs | Total All-Inclusive Evaluated Price | What is the budget or budget range for the implementatino period and the four-year base term? | Budget information will not be disclosed. Offerors are to provide their best pricing. | |
| 45 | Requirements Response | The system shall allow a logged-in user to access emails, including sent and received. | What are the current email providers that the state agencies use that might require interfacing? | Refer to Requirement ID #147 in ATTM 013 Requirements Response as amended. | ||
| 46 | Page 57 | Section 4.1.3.4.1 1st Bullet | Clarification on minimum requirements | If a vendor is proposing a Commercial Off-The-Shelf (COTS) solution that is configurable for critical incident management, is it sufficient to demonstrate that the prime contractor implemented the COTS solution in at least three (3) federal, state, local, or private healthcare environments, even if it has not specifically been configured for incident management in previous implementations? | Yes. | |
| 47 | Page 57 | Section 4.1.3.4.1 3rd Bullet | Specificity on term Solution used here - "Solution proposed by Offeror has been previously implemented successfully in a state environment" | If a vendor is proposing a COTS solution that can be configured for critical incident management, is it sufficient to demonstrat that the COTS solution has been successfully implemented in a state environment, even if it wasn't used for incident management in that environment? | Yes | |
| 48 | Page 57 | Section 4.1.3.4.1 5th Bullet | Offeror has completed at least one (1) Operational Readiness Review (ORR) or final Certification Review (CR) with CMS. A combined ORR/CR attempt may satisfy this requirement | If a vendor has completed other federal approvals with federal agencies, or has successful implementations for other federal agencies (HHS, CMS, FDA, VA, USDA, etc), but has not completed an Operational Readiness Review (ORR) or final Certification Review (CR) with CMS, would proof of these other federal approvals and successful implementations be acceptable in lieu of the ORR/CR requirement? | Yes | |
| 49 | Page 57 | Section 4.1.3.4.1 6th Bullet | Offeror’s proposed Project Manager has a minimum of three (3) years of experience with the respondents proposed critical incident management solution, of which at least two (2) years were in health and human services | Can you clarify how the vendor is expected to demonstrate the required three (3) years of experience for the proposed Project Manager | The Offeror is expected to demonstrate the required three (3) years of experience for the proposed Project Manager by complying with Section 4, Provision 4.1.3.3 Section C. Project Organization and Staffing. | |
| 50 | Page 57 | Section 4.1.3.4.1 6th Bullet | Offeror’s proposed Project Manager has a minimum of three (3) years of experience with the respondents proposed critical incident management solution, of which at least two (2) years were in health and human services | Additionally, does the Project Manager need to have three (3) years of experience specifically with the proposed critical incident management (CI) solution, or can it be demonstrated through experience with the underlying platform solution that supports the CI solution? | SCDHHS will accept three (3) years of experience with underlying platform solution that supports the Critical Incident Management (CIM) solution. | |
| 51 | Page 45 | Section 3.2.8.1 | Compliance clarification | What type of documentation or certification will be required to ensure compliance with the following security and privacy controls: Health Insurance Portability and Accountability Act (HIPAA), CMS Minimum Acceptable Risk Standards for Exchanges (MARS-E), National Institute of Standards and Technology (NIST) Special Publication 800 series, Federal Risk and Authorization Management Program (FedRAMP), and Family Educational Rights and Privacy Act (FERPA)? |
See ATTM 011 DASH Consolidated Deliverables Management List (CDML), D-033, D-034, D-035, D-036, D-037, and section 3.2.8.3 for independent assessment of security and privacy controls.
FedRAMP certification is performed via FedRAMP certification process, not performed by SCDHHS.
52 Page 45 Section 3.2.8.1 Compliance clarification 1)What specific accessibility features should the vendor highlight in their proposal to demonstrate Section 508 compliance?
2)Additionally, should the vendor include results from accessibility testing tools or third-party audits to validate that their solution is fully accessible to individuals with disabilities? 1) It would include things such as alt text for images, color contrast, screen reader accessible PDFs and other documents, keyboard accessibility, captions and audio descriptions on videos.
2) Yes. Additionally, refer to ATTM 011 DASH Consolidated Deliverables Management List (CDML), D-038, if a audit is performed.
53 Page 24 3.1.2.1.1 Providers and other external users—including care givers/case managers, and nurses—access the Phoenix system through the Provider Portal which is driven by the Phoenix case management system using near real time data transfer via Representational State Transfer (REST) Application Programming Interfaces (APIs) using the JavaScript Object Notation (JSON) format. 1) Does the State require the critical incident management system to be accessible in languages other than English?
2) If so, which languages are expected, and which parts of the system should be available in those languages? 1) No
2) N/A 54 Page 23 3.1.1 Perform analytical procedures, such as data matches, on Medicaid claims data to identify any unreported critical incidents and investigate as needed…. 1) Will the Critical Incident Management system need to be capable of incorporating artificial intelligence (AI)?
2) If so, could you please specify the desired AI functionalities, such as data analysis, predictive analytics, automated alerts, and notifications?
3) Should the system have out-of-the-box AI capability? 1) No. The system does not need to be capable of incorporating artificial intelligence (AI).
However, Offeror may offer a system that is capable of incorporating AI and SCDHHS must approve the usage of AI functionalities.
2) & 3) N/A
| 55 | Page 38 | Table 3.2.4.1.9.2-1: CEFs | The system is compatible with the claims processing and information retrieval systems used in the administration of Medicare for prompt eligibility verification and for processing claims for persons eligible for both programs. | Should the vendor demonstrate how their proposed system will ensure compliance with the access rule by having successfully utilized claims data, Medicaid fraud control unit data, or data from other State agencies, to identify unreported critical incidents? | Yes |
| 56 | Page 58 | Section 4.1.3.4.2 Section B | Clarifications on References included | Does the vendor need to provide references for all terminated critical incident (CI) contracts, or for all terminated state contracts and only with in a specific time period? | Yes |
| 57 | Page 58 | Section 4.1.3.4.2 Section B | Clarifications on References included | Additionally, is the vendor required to disclose terminated contracts that were hosted on the underlying platform solution, even if they were not specifically for critical incident management? | Yes |
File details come from the government source that posted it. Updated .