Appendix A -WY COMPASS RFP__Requirements.docx

DOCX document 156 KB Posted

Attached to
COORDINATING OUTCOMES: MEMBER PATHWAYS, ADVOCACY, SUPPORT, AND STABILITY (C. O. M. P. A. S. S. )
Solicitation number
215582
Issued by
Natrona County, Wyoming

About this file

This is a requirements document for an RFP issued by the Wyoming Department of Health's A & I Procurement Office for care coordination services utilizing a high-fidelity wraparound model for Medicaid youth across the State of Wyoming. The solicitation seeks proposals from qualified providers to deliver comprehensive care coordination and wraparound services to eligible Medicaid-enrolled youth. Proposals must be submitted through the Public Purchase online bidding system no later than 2:00 p.m. Mountain Time on September 30, 2026. Prospective bidders may submit written questions through the Public Purchase system until 2:00 p.m. Mountain Time on September 15, 2026, with questions received after this deadline subject to non-acceptance. All submission materials must be uploaded completely by the deadline; incomplete uploads will result in responses being deemed non-responsive and eliminated from evaluation. Bidders are responsible for monitoring the Public Purchase portal for all procurement updates, answers to questions, addenda, and award information.

All documents must be submitted in PDF, Excel, or Microsoft Office format through the Public Purchase system. The procurement office will not distribute information through email, phone, fax, or mail, requiring all participants to actively manage their submissions and monitor the online portal. Prospective bidders can access registration and submission guidance through the Wyoming Procurement Office website at https://ai.wyo.gov/divisions/general-services/purchasing, where a step-by-step registration guide is available at no cost.

View the file

Other files

On GovTribe

Work with this file

  • Download the original file
  • Contacts named in this file
  • Similar government files
  • Ask GovTribe AI about this file

Text version

STATE OF WYOMING

DEPARTMENT OF ADMINISTRATION AND INFORMATION

PROCUREMENT SECTION

2800 CENTRAL AVENUE

CHEYENNE, WY 82002

REQUEST FOR PROPOSAL NUMBER #0049-N

THE WYOMING DEPARTMENT OF HEALTH

DIVISION OF HEALTHCARE FINANCING

COORDINATING OUTCOMES: MEMBER PATHWAYS, ADVOCACY, SUPPORT, AND STABILITY (C.O.M.P.A.S.S.)

RFP APPENDIX A: REQUIREMENTS

DEPARTMENT OF HEALTH, DIVISION OF HEALTHCARE FINANCING

REPRESENTATIVE: Brenda Stout

OVERVIEW

The Agency is issuing Appendix A to RFP 0049-N Coordinating Outcomes: Member Pathways, Advocacy, Support, and Stability (C.O.M.P.A.S.S.) also known as the Care Management Entity (CME) for Medicaid Children, to define requirements of the selected Contractor. The Proposer should utilize Appendix A to inform approach, scope, schedule, and budget.

Appendix A includes a comprehensive collection of Contract requirements. Requirements are grouped into categories to align with RFP Section 6. Requirement categories are further broken down into sub-categories of requirement topics. Each requirement has a unique identifier that aligns with the requirement category for reference purposes. Where appropriate, requirements include references to Contract deliverables (summarized in Appendix B), and performance related requirements (summarized in Appendix C).

Proposers should utilize Appendix A to provide a brief response in the Proposer’s Approach column to each Contract requirement to demonstrate the Proposer’s approach and compliance with the Contract requirements. The completed Appendix A should be included as an attachment to the Proposer’s Technical Proposal. This attachment will not be considered in the total page limit.

TABLE OF CONTENTS

OVERVIEW2
Section A- 1.Phase-Specific Requirements1
1.1.Start-Up Requirements1
1.2.Transition Requirements2
1.3.Turnover10
Section A- 2.General Requirements11
2.1.Location and Equipment11
2.2.Quality Assurance/Quality Control12
2.3.Deliverable Management12
2.4.Change Management13
2.5.Contract Communication14
2.6.Risk and Issue Management15
2.7.Standards and Compliance15
Section A- 3.Technology and Specifications24
3.1.Contractor Deployed IT Solution(s)24
3.2.Interaction with Agency and External Systems26
3.3.General IT and System Requirements27
3.4.Privacy and Security30
3.5.Business Continuity and Disaster Recovery32
Section A- 4.Staffing and Resource Management33
4.1.Key Personnel33
4.2.Providers and Support Staff35
4.3.Staffing and Resource Management40
Section A- 5.General Operational Functions43
5.1.Ongoing Operations43
5.2.Outreach and Communication50
5.3.Complaints, Appeals & Grievances50
5.4.Data Management and Reporting57
5.5.Financial Management63
Section A- 6.Member Management64
6.1.Member Eligibility and Enrollment64
6.2.Plan of Care (POC)65
6.3.Coordination of Care68
Section A- 7.Provider Training, Certification, and Monitoring69
7.1.Provider Training, Certification, and Monitoring69

RFP 0049-N, WY COMPASS RFP

Appendix A: Requirements

ID
CATEGORY
REQUIREMENT
PERFORMANCE EXPECTATION
PROPOSER APPROACH

Phase-Specific Requirements

Start-Up Requirements

PS 1-1.
Start-Up

Provide a revised Project Work Plan originally submitted as part of the Proposal Response to address the following:

A. One-time Start-Up and Transition schedule and milestones and deliverable dates;

B. A description of the administrative service model that describes the Contractor’s approach to operational requirements;

C. Resource and Staffing Management Plan that includes:

I. Personnel and level of effort in hours for Start-Up and Transition activities;

II. Personnel and level of effort in hours for Operational activities;

III. Approach for having key staff available at appropriate timeframes, as designated in the proposal;

IV. An Organization chart for both Transition and Operations, with hours by position;

V. Approach for demonstrating that staff is sufficiently hired, trained, and ready to perform activities associated with their position.

D. Approach for ongoing risk and issue management, including risk and issue identification and tracking, for both Start-Up and ongoing Operations;

E. Approach for ongoing quality assurance and quality control; and F. Change Management approach that conforms to Change Management requirements include in Appendix A, Section 2.4 (A-2.4).

Additional details on the proposal response requirement are included in RFP Section 7.

Provide a revised Project Work Plan within thirty (30) calendar days of the Contract Effective Date. The Project Work Plan shall be in place prior to serving children and youth.

See Deliverable: DEL-2

PS 1-2.
Start-Up
Obtain care coordination, waiver, and other HFWA related forms already established through the Agency’s Children Mental Health Waiver and HFWA approach.
PS 1-3.
Start-Up
Conduct a project Kick-Off meeting no more than ten (10) days after the Contract Effective date. Items to be covered in the Kick-Off meeting shall include, but not be limited to:

A. Introducing project teams and stakeholders and defining roles and responsibilities;

B. Determining format and protocol for project status meetings and reporting;

C. Defining lines of communication and reporting relationships;

D. Reviewing the project mission and guiding principles;

E. Reviewing the deliverable review process;

F. Discussing high-risk or problem areas and strategies for mitigation;

G. Describing the proposed issue resolution process; and H. Finalizing the project schedule and milestones.

The Kick-Off meeting shall be held no more than ten (10) calendar days after the Contract Effective Date.

See Deliverable: DEL-1

Transition Requirements

PS 1-4.
Transition

Provide a revised Transition Plan and Checklist originally submitted as part of the proposal response that details the Contractor’s approach to ensuring a seamless transition to providers, staff, and clients. At minimum, the Plan and Checklist shall include the Contractor’s approach to transitioning:

A. Current Plans of Care (POCs);

B. Member records and documentation;

C. Eligibility and enrollment forms and other forms deemed necessary for Operations;

D. Phone lines, website URL(s), and other IT infrastructure in accordance to the Project Work Plan;

E. Active member and provider roster;

F. Level of Care (LOC) and any other assessments;

G. Approach for conducting a knowledge transfer from the Incumbent Contractor to the new Contractor, if appropriate;

H. Entrance and exit criteria that reflect the approved SLA, where applicable; and I. Stabilization criteria that will demonstrate the Contractor is ready to transition to operations.

The Contractor shall leverage the Transition Checklist to demonstrate successful transition of the components required to support a seamless transition.

Additional details on the proposal response requirement are included in RFP Section 7.

Provide a revised Transition Plan and Checklist within thirty (30) calendar days of the Contract Effective Date.

See Deliverable: DEL-3

PS 1-5.
Transition

Develop a comprehensive Provider Training, Certification, and Monitoring Plan that includes, at minimum, the Contractor’s approach to:

A. Verifying qualifications of providers;

B. Monitoring provider geographic coverage and performance;

C. Authorizing POCs submitted by providers; and

Provide a Provider Training, Certification, and Monitoring Plan within forty-five (45) calendar days of the Contract Effective Date.

See Deliverable: DEL-7

PS 1-6.
Transition
During the Transition Phase, conduct weekly status meetings. The Contractor shall generate a Status Report as the basis for the status meeting. In the Status Report, the Contractor shall address:

A. Project schedule (current status of all activities);

B. Near term activities;

C. Key milestones and activities;

D. Deliverables (submitted, due, overdue, approval status, and payment status);

E. Staffing levels;

F. Project risks from the risk register, including mitigation status;

G. Issues from the issues tracking tool and H. Action items.

The Agency reserves the right to review and approve each Status Report and request that additional information be added to the report template at any point in the project.

Status Meetings will be held weekly during Transition. After Transition, the Contractor and Agency will schedule meetings, as necessary.

Distribute the status agendas at least one (1) business day in advance of the meeting.

Distribute minutes to the Agency within two (2) business days of the meeting.

See Deliverable: DEL-37

PS 1-7.
Transition

The Agency anticipates the following data to require migration into the Contractor’s IT solution:

A. Provider information, including eligibility B. Member information

C. POC

D. WrapTrack and survey information

Provide a Data Migration Plan that includes:

E. The approach and timeline for migration;

F. Extract, Load, Transform (ELT) approach; and G. Approach for testing and validating target vs. source data.

H. Propose acceptance criteria that should include record counts, hash totals, reconciliation thresholds, exception handling, rollback plan, data quality rules, and sign-off by Agency data owners.

Provide Data Migration Plan within ninety (90) calendar days of the Contract Execution Date.

See Deliverable: DEL-14

PS 1-8.
Transition
Provide the Agency with a Test Plan for conducting testing on any Contractor IT system that will house State data:

A. System requirement testing;

B. System integration testing;

C. Data migration testing;

D. Accessibility testing;

E. Security testing;

F. Regression testing; and G. User acceptance testing, where appropriate.

Provide the Test Plan within thirty (30) calendar days of the Contract Effective Date.

See Deliverable: DEL-5

PS 1-9.
Transition
Perform comprehensive testing in accordance with the approved Test Plan.
Provide the Testing Results, including Accessibility Test results, within one hundred and twenty days (120) calendar days of the Contract Effective Date.

See Deliverable: DEL-23

PS 1-10.
Transition
Conduct design sessions during Transition with the Agency to discuss and design the integration points between the Contractor’s IT solution and Agency enterprise architecture and systems. The Agency prefers to automate existing workflows and data collection to the extent possible to reduce administrative burden on providers.
Provide a proposed Design Session Schedule and Topics within thirty (30) calendar days of the Contract Execution Date.

See Deliverable: DEL-4

PS 1-11.
Transition
Provide a Solution Architecture Document that includes the detailed and technical explanation of all aspects of the Contractor’s IT solution, including detailed architectural diagrams, data flows, component specifications, COTS products, and integration with Agency systems.
Provide a Solution Architecture Document within sixty (60) calendar days of the Contract Execution Date.

See Deliverable: DEL-9

PS 1-12.
Transition
Establish and test the appropriate Information Technology and systems infrastructure necessary to manage and operate functions in accordance with the approved Solution Architecture Document. The Agency reserves the right to perform independent validation testing on all IT and systems that support the Contract.
Establish IT infrastructure necessary to support scope of work within sixty (60) calendar days of the Contract Effective Date.
PS 1-13.
Transition
Provide a Hosting Plan that includes a detailed list of all technical specifications related to hosting all system environments, third party agreements, hosting provider certifications, key personnel, disaster recovery processes and business continuity approach.
Provide Hosting Plan within sixty (60) calendar days of the Contract Execution Date.

See Deliverable: DEL-10

PS 1-14.
Transition
Document system workflows to inform system training and system design.
Provide Workflow documentation within ninety (90) calendar days of the Contract Execution Date.

See Deliverable: DEL-12

PS 1-15.
Transition
Provide Data Models and Data Management Plan that demonstrates:

A. The data structure of the Contractor’s IT solutions;

B. The approach for maintaining data integrity; and C. Delineation of the data table structure.

Provide a Data Management Plan and Data Models within sixty (60) calendar days of the Contract Execution Date.

See Deliverable: DEL-18

PS 1-16.
Transition
Provide Systems Operating Manual detailing the Contractor’s policies and procedures for operating internal IT systems.
Provide a Systems Operating Manual within twenty (120) calendar days of the Contract Execution Date.

See Deliverable: DEL-21

PS 1-17.
Transition
Attend question and answer sessions with the Incumbent Contractor, if necessary, and advise the Agency of any areas of concern based on previous presentations and reviews of documentation. The Incumbent Contractor, Agency, and the Contractor shall conduct knowledge sharing meetings as requested by either the Agency or the Contractor. The purpose of these meetings is to quickly resolve key issues that arise by assembling the appropriate Agency and Contractor staff to understand and resolve the issue. The Agency may propose a standing meeting schedule depending on the Start-Up and Transition needs.
PS 1-18.
Transition
Become familiar with Agency policies and services through research and interviews with Agency and Incumbent Contractor staff, if needed. The Contractor shall develop high-level overview of all applicable Agency policies and services identified in Contractor’s interviews.
PS 1-19.
Transition
Provide a Training Plan with the Contractor’s approach to training HFWA certified trainers, coaches, family care coordinators, respite providers, and Family and Youth Peer Support Partners.

Provider training shall span the minimum topics:

· HFWA principles and components;

· Behavioral and social needs of children and families, which includes coordination of a broad array of behavioral health services and social supports and coordination with the schools, courts, child welfare workers, juvenile probation, etc.

· Billing processes and payment models;

· An overview of common clinical diagnoses seen in members, including but not limited to abuse and neglect training, attachment disorders, and ADHD;

· Assessment requirements and processes, including CASII, ECSII, CANS, and ACE; and

· Motivational interviewing skills.

At minimum, the Plan shall include:

A. Approach to Tier One and Tier Two training requirements, as described in RFP Section 6.8;

B. Approach for training providers on minimum training topics above;

C. For FCCs, FSPs, and YSPs who are trained and certified prior to the start of the COMPASS’s Contract, how the FCCs, FSPs, and YSPs will be required to comply with any new training guidelines implemented by the Contractor through the yearly recertification process;

D. Approach to working with the Agency and DFS to cross-train providers as necessary to effectively support services;

E. Approach to initial training and certification, including the training schedule;

F. Approach to annual training to maintain certification;

G. Approach to required criminal background checks;

H. Use of classroom and online training;

I. Approach to and platform for providing online and on-demand training options for providers;

J. Approach to training materials. The Agency reserves the right to review and approve all related training materials;

K. Approach to keeping training current with the National Wraparound Initiative’s (NWI) curriculum and best practices and how the Contractor will implement new practices per the NWI as needed;

L. Approach for conducting ad hoc training and refresh training;

M. How the Contractor will leverage COMPASS coaches and customer service avenues to provide technical assistance to providers throughout the Contract term; and N. Approach to validating training was successful and staff are equipped to support the scope of services under this Contract.

Provide the Training Plan within sixty (60) calendar days of the Contract Effective Date.

Revise Training Plans and documents upon identification of recommendations and findings from Annual Report, as directed by the Agency. All approved revisions shall be implemented within thirty (30) calendar days upon delivery of the Annual Report. Additional details on the Annual Report are included in Appendix A, Section 5.4 (A- 5.4)

See Deliverable: DEL-13

PS 1-20.
Transition
Establish an online training platform, as outlined in the approved Training Plan that provides for online training and on-demand training modules for flexible use and access to Contractor trainings for providers.
Provide the Training Platform within ninety (90) calendar days of the Contract Effective Date.
PS 1-21.
Transition
Execute the initial training (Tier One Training) and certification of providers in order to support the COMPASS services by the start of operations, in accordance with the approved Training Plan. Provide a Training Report that summarizes the training, number of people training, and training outcomes. Specifically, report on the number of onboarded providers that resulted from training.
Complete initial training and certification of providers submit the Training Summary Report within one hundred twenty (120) calendar days of the Contract Effective Date.

See Deliverable: DEL-22

Tier One Training shall be completed for each provider within 30 days of the start of the training for 90% of providers.

PS 1-22.
Transition
Develop a Referral Process that includes referrals received by the COMPASS and referrals received by providers. The process should include triaging received referrals and coordinating referrals with community organizations, including schools, courts, and other community organizations as directed by the Agency.
Provide a documented Referral Process within sixty (60) calendar days the Contract Effective Date.

See Deliverable: DEL-8

PS 1-23.
Transition
Develop a Customer Service Plan in accordance with internal protocols. This shall include the Contractor’s approach for improving customer service options, and its approach to maintaining the toll-free number, public website, and any other public-facing self-service tools, as further detailed in Appendix A, Section 5.1 (A-5.1).
Provide the Customer Service Plan within ninety (90) calendar days of the Contract Effective Date.

See Deliverable: DEL-15

PS 1-24.
Transition
Conduct a formal operational readiness walkthrough with the Agency demonstrating that the Contractor is ready to begin operations. The Contractor must demonstrate that Exit and Entrance Criteria and Stabilization Criteria have been met and accepted by the Agency.
Conduct the operational readiness walkthrough with the Agency by April 30, 2027.

Turnover

PS 1-25.
Turnover
Prior to the conclusion of the Contract awarded through this procurement, provide, at no extra charge, assistance in turning over the final Contractor responsibilities to the Agency or its designee.
No less than five (5) months prior to the end of the base Contract period(s) or any extension thereof.
PS 1-26.
Turnover
Provide, at no additional cost, a Turnover Plan to the Agency. The plan shall include:

A. Proposed approach to Turnover;

B. Tasks and subtasks for Turnover;

C. Schedule for Turnover;

D. Documentation update procedures during Turnover; and E. Description of Contractor coordination activities that shall occur during Turnover to ensure continued system and services as deemed appropriate by the Agency.

No less than five (5) months prior to the end of the base Contract period(s) or any extension thereof.

See Deliverable: DEL-39

PS 1-27.
Turnover
Transfer to the Agency or its designee, as requested, a copy of all COMPASS related data on media determined by the Agency.
No less than one (1) month prior to the end of the base Contract period(s) or any extension thereof.
PS 1-28.
Turnover
Train Agency staff, or its designee, in relevant operations and activities of the COMPASS.
As requested, but approximately three (3) months prior to the end of the contract(s) or any extension(s) thereof.

Training shall be completed prior to the end of the contract or any extension thereof.

PS 1-29.
Turnover
Prior to the conclusion of the Contract awarded through this procurement, provide, at no extra charge, assistance in turning over the final Contractor responsibilities to the Agency or its designee.
No less than five (5) months prior to the end of the base Contract period(s) or any extension thereof.

General Requirements

1.1. Location and Equipment

GR 2- 1.
Location
Maintain the Contractor’s Wyoming operations within the continental United States.
GR 2- 2.
Location
The Contractor must serve all geographic areas and target populations within the State. Additional populations may be added or modified as appropriate and agreed upon by both parties in writing.
GR 2- 3.
Location
Key Personnel may be required to be onsite in Wyoming for certain Contractor responsibilities, such as status meetings. Contractor personnel who are not on-site in Wyoming must also be available to come to Wyoming if requested to attend meetings or for other on-site responsibilities.
GR 2- 4.
Equipment
Provide all electronic and telecommunications equipment needed to support Key Personnel and necessary administrative staff supporting this Contract, including personal computers, printers, fax machines, modems, routers and related equipment.
GR 2- 5.
Equipment
The Contractor shall bear the cost of establishing and maintaining leased lines, Internet or Intranet servers, virtual private networks, or any other communication devices or protocols used to support the Contract.

1.2. Quality Assurance/Quality Control

GR 2- 6.
Quality Assurance/

Quality Control Report all quality monitoring, assurance and improvement metrics to the Agency as outlined in the Social Security Act Sec. 1915(c) waiver, as applicable to the Contract. Metrics shall also be included in the Quarterly Report.

GR 2- 7.
Quality Assurance/

Quality Control Deploy methodologies for monitoring and assessing any changes to the Contractor’s service model. The monitoring and assessment methodologies must remain consistent to appropriately reflect impacts of the change implemented. Results of the changes will be communicated to stakeholders under direction of the Agency. The Agency reserves the right to participate in any change discussions as needed.

GR 2- 8.
Quality Assurance/

Quality Control The Contractor shall maintain a Quality Management Plan describing its approach to quality assurance, quality control, performance monitoring, corrective action, and continuous improvement for all services performed under this Contract. The Plan shall align with the Contractor's quality management, reporting, provider oversight, and performance monitoring activities described throughout this Appendix and shall be updated at least annually or upon Agency request.

Escalate areas of non-compliance or issues as part of the Monthly Report in accordance with the SLA included in Appendix C.

Submit and update the Plan annually and upon Agency request.

See Deliverable: DEL-11

1.3. Deliverable Management

GR 2- 9.
Deliverable

Management Adhere to the Agency's Deliverable Review Process. The Deliverable Review Process defines how deliverables are:

A. Submitted for review;

B. Reviewed;

C. Commented on;

D. How requests for changes are managed;

E. The schedule for review;

F. The schedule for updates; and G. Deliverables acceptance.

GR 2- 10.
Deliverable

Management Submit all deliverables included in the RFP within the Agency defined timeframes and in accordance with the deliverables document standards and acceptance form template provided in RFP Attachment V. A comprehensive list of Contract deliverables is included in Appendix B.

GR 2- 11.
Deliverable

Participate in deliverable walkthroughs when requested by the Agency.

GR 2- 12.
Deliverable

Correct any issues identified by the Agency relating to deliverables and engage in any investigation necessary to determine the source of such deficiencies, at no cost to the Agency.

GR 2- 13.
Deliverable

All deliverables will be in Microsoft Windows Suite; Word, Excel, MS Project, PowerPoint or, if applicable, Visio, or other industry standard tools. Deliverables shall not be submitted in PDF unless otherwise agreed to in advance. Graphics and drawings shall be in industry standard file format.

GR 2- 14.
Deliverable

Obtain written acceptance approval from the Agency on all final deliverables. Any payment tied to deliverables shall be based on the Agency’s written approval of the deliverable.

1.4. Change Management

GR 2- 15.
Change Management
Maintain a control change process in accordance with the approved Project Work Plan. The control change process must include:

A. The reason for the change;

B. A complete description of work to be performed;

C. An estimate of time and cost to complete the task;

D. A completion date for the change; and E. An impact analysis indicating ramifications or impact to the project.

GR 2- 16.
Change Management
If unforeseen circumstances arise where a dispute resolution might be needed, the Contractor will submit (in writing) a description of the problem and proposed resolution to the Agency contact for his/her consideration.

1.5. Contract Communication

GR 2- 17.
Contract

Communication Maintain communications as outlined in the approved Project Work Plan.

GR 2- 18.
Contract

Communication Conduct weekly operational calls as outlined in Appendix A, Section 5.1 (A-5.1) with the Agency Contract Manager during operations.

Distribute the agendas at least one (1) business day in advance of the meeting.

Distribute minutes to the Agency within two (2) business days of the meeting.

GR 2- 19.
Contract

Maintain regular telephone and email contact with the Agency’s designated Contract Manager and designated staff throughout the Contract period.

GR 2- 20.
Contract

Communication

Participate in any other meetings, as directed by the Agency. The Contractor shall produce and distribute minutes of the meeting unless otherwise directed by the Agency.
Distribute minutes to the Agency within two (2) days of the meeting.
GR 2- 21.
Contract

Provide the ability to use secure and encrypted email account(s) for the Contractor staff to report problems, questions or client issues to the Agency while safely exchanging PHI/PII, as required.

GR 2- 22.
Contract

Communication

Participate in annual Contract reviews. Work with the Agency to identify and propose annual Contract year goals, measures, Service Level Agreements and Performance Expectations, and timelines.
The review shall be conducted within thirty (30) days before the Contract review period.

1.6. Risk and Issue Management

GR 2- 23.
Risk Management
Maintain a Risk Register in accordance with the approved Project Work Plan tracks:

A. All COMPASS-related risks;

B. Initial risk prioritization (urgency), and potential risk impacts (each risk);

C. Risk responses for each risk;

D. A risk mitigation strategy for each risk; and E. Assignments and updated ownership, due dates, and status tracking notes to each risk.

Report on status of risks as part of routine Status Reports to the Agency. The Agency reserves the right to request access to the Contractor’s Risk Register.

Provide the Agency access to the Risk Register within three (3) business days of a request.

GR 2- 24.
Issue Management
Utilize a Project Control and Issue Tracking tool to collect and track reported Contract issues and resolutions in accordance with the approved Project Work Plan. The tool shall capture, at minimum:

A. All applicable information about the issue;

B. Initial issue prioritization (urgency), and potential impacts;

C. An issue resolution strategy for each issue; and D. Assignments and updated ownership, due dates, and status tracking notes to each issue.

Report on status of issues as part of routine Status Reports to the Agency.

1.7. Standards and Compliance

GR 2- 25.
Standards and Compliance
The Contractor shall comply with all applicable federal, State of Wyoming, Wyoming Department of Health, Medicaid, privacy, security, and information technology standards applicable to the services, systems, data, interfaces, hosting environments, operations, and deliverables under this Contract.

This includes:

Applicable State of Wyoming Enterprise Technology Services and CIO policies, WDH standards and best practices, CMS Medicaid enterprise system requirements, CMS life cycle and certification guidance, MITA, FAR 52.239-1, IRS Publication 1075 where Federal Tax Information is involved, ISO/IEC 27001 and 27002, NIST SP 800-53 Rev. 5, NIST SP 800-57 Rev. 5.

Also all applicable system interconnection, security, privacy, encryption, access control, audit logging, vulnerability management, incident response, contingency planning, and secure development requirements.

The Contractor shall provide documentation and evidence of compliance upon request and shall comply with current or successor versions of applicable standards unless otherwise directed by WDH in writing.

GR 2- 26.
Standards and Compliance
The Contractor shall comply with applicable CMS, CFR, federal, State of Wyoming, WDH, Medicaid, privacy, security, records, licensing, audit, and federal financial participation requirements applicable to the Contract, including: (A) 18 U.S.C. §641; (B) 18 U.S.C. §1905; (C) 21 CFR Parts 1–1499, as applicable; (D) 45 CFR Parts 160, 162, and 164; (E) ARRA/HITECH; (F) EMTALA, as applicable; (G) FISMA/Federal Information Security Modernization Act and OMB Circular A-130; (H) FOIA and Privacy Act, 5 U.S.C. §§552 and 552a; (I) HIPAA, P.L. 104-191; (J) Section 1011, as applicable; (K) Deficit Reduction Act; (L) ACA; (M) Sarbanes-Oxley, as applicable; (N) 42 CFR §433.112, 45 CFR Part 95 Subpart F §§95.615 and 95.617, and applicable CMS State Medicaid Manual requirements; (O) current federal award, cost, accounting, and administrative requirements, including 2 CFR Parts 200 and 300, as applicable; (P) Title 17 copyright and license requirements; and (Q) 42 CFR Part 431 Subpart F. The Contractor shall protect PHI, PII, confidential data, software, records, and documentation; maintain required licenses; support access to records, audits, CMS/WDH reviews, and compliance evidence; and comply with current or successor requirements unless WDH directs otherwise.
GR 2- 27.
Standards and Conditions
The Contractor shall comply throughout the Contract with HIPAA, HITECH, and 45 CFR Parts 160, 162, and 164 for all PHI/ePHI created, received, maintained, transmitted, accessed, used, or disclosed for the Agency. The Contractor shall comply with applicable HIPAA Administrative Simplification, transaction and code set, identifier, privacy, security, breach notification, and enforcement requirements; implement appropriate administrative, physical, and technical safeguards; and maintain policies, procedures, documentation, access controls, audit logs, risk management, data validation, encryption, secure transmission, incident response, mitigation, reporting, and corrective action processes. If the Contractor acts as a Business Associate, it shall execute and comply with the Agency’s BAA, including 45 CFR §164.504(e), and ensure subcontractors and downstream entities with PHI access are bound by written obligations at least as protective. The Contractor shall promptly report suspected or confirmed privacy or security incidents, breaches, unauthorized access, disclosure, loss, or compromise, including notices required under 45 CFR §164.410. The Contractor shall protect non-HIPAA confidential information and PII with comparable safeguards, train and bind its workforce and agents to confidentiality requirements, provide compliance evidence upon request, and acknowledge that noncompliance is a material breach subject to Agency remedies. The Contractor shall comply with current and successor privacy, security, and confidentiality requirements unless otherwise directed by the Agency.
GR 2- 28.
Standards and Conditions
The Contractor shall comply with applicable NIST, FIPS, CMS, State of Wyoming, WDH, and Contract security requirements to protect Wyoming Medicaid systems and data, including PHI, PII, and confidential information. Compliance includes WDH-approved security categorization, risk management, and control implementation using NIST SP 800-37, FIPS 199, FIPS 200, and NIST SP 800-53 Rev. 5; cryptographic protections using CMVP-validated FIPS 140-3 modules, or approved FIPS 140-2 transition modules, FIPS 186-5, FIPS 197/AES, NIST SP 800-57 Rev. 5, and NIST SP 800-131A; and identity, authentication, access control, and password management consistent with NIST SP 800-63-4 and SP 800-63B-4. The Contractor shall maintain risk assessment, continuous monitoring, incident response, contingency planning, vulnerability management, patch management, configuration management, audit logging, documentation, and corrective action processes consistent with NIST SP 800-30, SP 800-137, SP 800-61, and SP 800-34. The Contractor shall provide security documentation and control evidence upon request, shall not rely on withdrawn or superseded standards, including FIPS 31, 41, 73, 112, or 186-4, and shall comply with current or successor standards unless otherwise directed by WDH.
GR 2- 29.
Standards and Compliance
The Contractor shall comply with all additional standards, regulations, data-use restrictions, confidentiality, security, safeguarding, records-retention, and destruction requirements applicable to the COMPASS solution, services, systems, data, interfaces, environments, subcontractors, and deliverables. This includes, as applicable: 45 CFR §95.621(f) ADP system security and review requirements; Privacy Act requirements, including 5 U.S.C. §552a(o)(1)(F), (H), and (I); Computer Matching and Privacy Protection Act requirements; IRS Publication 1075 for Federal Tax Information; federal, State, Agency, Medicaid, audit, litigation hold, and records disposition requirements, including 44 U.S.C. §3303a; SSA data exchange, confidentiality, certification, and security review requirements for SSA-provided information; Children’s Online Privacy Protection Act and 16 CFR Part 312 for covered online services involving children under 13; and Title XIX Medicaid confidentiality requirements, including 42 CFR Part 431 Subpart F. The Contractor shall protect PHI, PII, FTI, SSA data, Medicaid applicant and beneficiary information, matching records, and other confidential data from unauthorized access, use, disclosure, duplication, re-disclosure, retention, loss, or destruction. The Contractor shall maintain policies, procedures, safeguards, documentation, audit evidence, and corrective action processes; cooperate with Agency, CMS, HHS, IRS, SSA, NARA, and audit reviews; and comply with current or successor requirements unless otherwise directed by the Agency.
GR 2- 30.
Standards and Compliance
The Contractor shall maintain audit, audit logging, records retention, records disposition, and destruction practices in compliance with applicable State of Wyoming policies and standards, WDH requirements, CMS/Medicaid requirements, HIPAA/HITECH requirements, and the Contract. Where requirements differ or conflict, the Contractor shall follow the more stringent requirement or longer applicable retention period, unless otherwise directed by WDH in writing or required by law.
GR 2- 31.
Standards and Compliance
The Contractor shall execute and comply with the Agency’s Business Associate Agreement before creating, receiving, maintaining, transmitting, accessing, using, or disclosing PHI or ePHI on behalf of the Agency. The BAA shall comply with HIPAA, HITECH, and applicable regulations at 45 CFR Parts 160 and 164, and shall address permitted uses and disclosures, safeguards, breach and security incident reporting, subcontractor obligations, and return or destruction of PHI. A sample BAA is included in RFP Attachment VI.
GR 2- 32.
Standards and Compliance
The Contractor shall maintain a documented quality management program appropriate to its responsibilities under the Contract, including provider training and certification, Plan of Care review, authorization, and related administrative functions. The program shall use recognized standards, evidence-based practices where applicable, internal controls, and performance monitoring to ensure services are accurate, timely, consistent, and compliant with Agency requirements.

Accreditation by URAC, NCQA, or another relevant accrediting body may be used to demonstrate applicable quality management processes but is not required. If accredited, the Contractor shall identify the accrediting body and scope, provide current accreditation documentation upon request, and notify the Agency of any status change.

If not accredited, the Contractor shall provide documentation upon request demonstrating that its quality assurance, Plan of Care review, provider certification, and related processes meet Agency-defined standards. The Agency may require corrective action for identified deficiencies, performance concerns, or noncompliance.

GR 2- 33.
Standards and Compliance
The Contractor shall ensure that all services, work products, system components, and final deliverables under the Scope of Work comply with applicable State and federal laws, statutory mandates, State of Wyoming CIO Promulgated Rules, State IT policies, RFP requirements, and Agency-defined hardware, software, security, and development standards. Compliance shall be maintained throughout the Contract term and confirmed at Agency acceptance, as applicable.
GR 2- 34.
Standards and Compliance
The Contractor shall comply with all applicable State, federal, Agency, and Contract technical standards, security policies, procedures, and industry-recognized best practices throughout the Contract term to protect Agency systems, services, and data.
GR 2- 35.
Standards and Compliance
The Contractor shall ensure that all electronic and information technology, web content, mobile applications, software, portals, documents, forms, reports, training materials, and support services provided under the Contract comply with applicable ADA requirements, Section 508 of the Rehabilitation Act, and WCAG 2.1 Level AA at minimum, or any higher/current accessibility standard required by the Agency. The Contractor shall submit a current Accessibility Conformance Report using the applicable VPAT template for each product, platform, or major release; provide independent accessibility testing or validation upon request and prior to acceptance; remediate identified accessibility defects within Agency-approved timeframes; and maintain accessibility compliance throughout the Contract term.
GR 2- 36.
Standards and Compliance
The Contractor shall report to the Agency annually and before any change in subcontracting organizations regarding its use of Subcontractors. The report shall identify each Subcontractor, describe the services performed, and certify that each Subcontractor complies with all applicable Contract requirements and federal and State employment laws, regulations, and practices. The Contractor shall flow down all applicable Contract obligations to its Subcontractors, hold Subcontractors to the same standards required of the Contractor, and remain responsible for Subcontractor performance, acts, omissions, and compliance.
GR 2- 37.
Standards and Compliance
The Contractor shall meet all applicable Service Level Agreements and provide the Agency, at the cadence requested, with all reports, metrics, data, and other information necessary to monitor the Contractor’s solution, performance, compliance, and service delivery.
GR 2- 38.
Standards and Compliance
Upon Agency request, the Contractor shall support the annual Wyoming State Auditor’s Office audit, including any independent third-party audit activities, by providing timely access to requested records, reports, documentation, data, systems, personnel, and explanations necessary to complete the audit. The Contractor shall cooperate with the Agency and auditor and promptly address any audit findings or corrective actions related to Contractor services.
GR 2- 39.
Standards and Compliance
The Contractor shall encrypt Agency data, including PHI, PII, and confidential information, at rest and in transit using FIPS 140-3 validated cryptographic modules and FIPS-approved algorithms. At a minimum, data-at-rest encryption shall use AES-256, and data-in-transit encryption shall use secure, current, Agency-approved protocols and configurations. The Contractor shall provide encryption and validation evidence upon request.
GR 2- 40.
Standards and Compliance
Except as permitted or required by law, the Contract, the BAA, or prior written Agency authorization, the Contractor shall not use or disclose any information related to an individual, including PHI, PII, Medicaid applicant or beneficiary information, or other confidential Agency data. The Contractor shall maintain written policies and procedures governing access, use, duplication, disclosure, dissemination, retention, return, and destruction of such information, and shall ensure its workforce, agents, and subcontractors comply with these requirements.
GR 2- 41.
Standards and Compliance
The Contractor shall ensure that all Contractor-deployed IT solutions and hosting environments that store, process, transmit, or support Agency data, including PHI, PII, and confidential information, are covered by a current independent third-party assurance report acceptable to the Agency. At minimum, the hosting environment shall maintain a current SOC 2 Type II report covering Security, Availability, and Confidentiality, or an Agency-approved equivalent SSAE 18 attestation. The Contractor shall provide the report, bridge letters, subservice organization details, identified exceptions, remediation status, and evidence of continued compliance upon request. For cloud hosting, FedRAMP Moderate Authorized status is preferred and may be required where applicable; if not FedRAMP Moderate Authorized, the Contractor shall document compensating controls and obtain Agency approval.

The Contractor shall provide to the Agency a Statement on Standards for Attestation Engagements (SSAE) No. 16/18, Reporting on Controls at a Service Organization SOC1 and SOC2 reports. Unabridged and/or non-redacted SOC1 and SOC2 reports shall be provided for the Contractor's hosting vendor, if separate from the Contractor, and for the services provided by the Contractor. The sharing of these documents shall not require any additional agreements or authorization.

The Contractor's hosting environment for all system environments shall be compliant with SSAE 16/18 Type 2 and have Federal Risk and Authorization Management Program (FedRAMP) Moderate certification. Contractor shall provide proof of a current SOC 2 Type II certification covering Security, Availability, and Confidentiality principles.

GR 2- 42.
Standards and Compliance
The Contractor shall ensure all Contractor-developed, configured, hosted, or deployed IT solutions, including web applications, APIs, portals, integrations, and supporting code, are designed, developed, tested, maintained, and remediated using secure coding practices that address the current OWASP Top 10 Web Application Security Risks and CWE/SANS Top 25 Most Dangerous Software Weaknesses in effect at proposal submission and throughout the Contract term. The Contractor shall perform application security testing, vulnerability scanning, code review, and timely remediation; document exceptions and compensating controls; and provide compliance evidence upon Agency request.

Technology and Specifications

1.8. Contractor Deployed IT Solution(s)

IT 3- 1.
Contractor Deployed IT Solution(s)
The Contractor’s IT solution shall support the services and business needs described in this RFP and the resulting Contract. The solution shall promote operational and provider efficiencies, maintain compliance with applicable State and federal laws, rules, regulations, and policies, and support all required Contract reporting, monitoring, and performance requirements.

Minimum required functions include, but are not limited to, the ability to:

A. Provide a correspondence module to support member and provider letters, notices, notifications, and other communications;

B. Support provider documentation, notes, and other Contract-required documentation;

C. Manage, track, and generate reports on required data sets, waiver performance measures, and other required metrics;

D. Track and report outcomes and performance metrics as required by the executed Contract;

E. Track and manage referrals;

F. Manage and report provider scorecards;

G. Manage, store, and track Plans of Care;

H. Manage, store, and track Prior Authorizations related to Plans of Care;

I. Track and manage provider compliance with required member and provider contact standards;

J. Track provider training, certification, compliance status, and related requirements;

K. Allow providers to upload training documentation and other required materials for trainer or Agency review;

L. Track utilization of services;

M. Track, manage, and report member and provider grievances, complaints, and appeals;

N. Support the generation and administration of surveys as required by Appendix A, Section 5.1;

O. Allow providers to capture meeting invitees and attendees;

P. Allow providers to document informal and formal supports;

Q. Monitor the use of formal and informal supports, including transitions from formal to informal supports;

R. Support critical incident reporting, tracking, monitoring, and follow-up; and S. Capture and track crisis support information.

IT 3- 2.
Contractor Deployed IT Solution(s)
The Contractor’s IT solution shall electronically store, manage, and track Plans of Care. Plan of Care data shall be captured in structured, discrete fields, rather than solely as scanned documents or free-text records, to support alerts, validations, workflow tracking, monitoring, and reporting on specific Plan of Care elements. The solution shall maintain appropriate access controls, audit history, status tracking, and reporting capabilities for electronic Plan of Care records.
IT 3- 3.
Contractor Deployed IT Solution(s)
The Contractor’s IT solution shall provide autofill functionality to streamline the data entry process for its providers.
IT 3- 4.
Contractor Deployed IT Solution(s)
The Contractor’s IT solution shall be compatible with current, vendor-supported operating systems and browsers used or approved by the State of Wyoming, WDH, and the Agency. At minimum, the solution shall support current supported versions of Windows, macOS, Microsoft Edge, Google Chrome, Mozilla Firefox, and Apple Safari, as applicable to the user population and solution design. The solution shall be standards-based and shall not require unsupported operating systems, unsupported browsers, browser plug-ins, legacy runtimes, or compatibility modes unless expressly approved by the Agency in writing for a limited transition purpose. The Contractor shall maintain and update a supported platform matrix, test major releases against Agency-approved platforms, and remediate compatibility issues that affect access, security, functionality, or performance within Agency-approved timeframes.
IT 3- 5.
Contractor Deployed IT Solution(s)
The Contractor’s IT solution shall support transitions between providers through Agency-approved role-based access controls. The solution shall allow temporary, limited, and auditable access for authorized outgoing and incoming providers during transition periods to support continuity of services. Access shall be limited to the minimum necessary information, time-bound, documented, monitored, and modified or terminated promptly when the transition is complete.
IT 3- 6.
Contractor Deployed IT Solution(s)
The Contractor’s IT solution shall integrate with, capture, store, manage, and report assessment data and results required under the Contract, including but not limited to CANS, ACE, and ECSII/CASII assessments. The solution shall support structured data entry, results tracking, status monitoring, alerts, reporting, and role-based access to assessment information. Assessment data shall be maintained in a secure, auditable manner and linked to the applicable member record, Plan of Care, authorization, service planning, and reporting workflows, as required by the Agency.
IT 3- 7.
Contractor Deployed IT Solution(s)
The Contractor’s IT solution shall provide configurable alerts, ticklers, reminders, and task notifications to support staff and provider workflow management. Alerts shall be role-based, timely, auditable, and capable of identifying missing, incomplete, overdue, or upcoming actions.

Alerts shall include, but are not limited to:

A. Monitoring compliance with assessment requirements and proactively alerting staff and providers when assessments are due, overdue, missing, or incomplete;

B. Alerting staff when no Plan of Care is on file or when required Plan of Care documentation is missing or incomplete;

C. Alerting staff to compliance issues related to minimum provider contact requirements with members;

D. Proactively alerting the Contractor and designated staff of upcoming WFI-EZ survey requirements; and E. Supporting follow-up, escalation, resolution tracking, and reporting for alerts and workflow tasks, as required by the Agency.

IT 3- 8.
Contractor Deployed IT Solution(s)
The Contractor shall provide a secure electronic referral tool, accessible through the Contractor’s website or other Agency-approved portal, to support the submission, receipt, intake, routing, tracking, and processing of referrals to the COMPASS. The tool shall allow authorized users to submit required referral information and supporting documentation, generate confirmation of receipt, track referral status, and support reporting on referral volume, timeliness, disposition, and outcomes. The tool shall protect PHI, PII, and other confidential information through appropriate access controls, encryption, audit logging, and HIPAA-compliant safeguards.

1.9. Interaction with Agency and External Systems

IT 3- 9.
Interaction with Agency and External Systems
The Contractor’s IT solution shall integrate with the WINGS Master Data Management Module to promote seamless exchange of member information.
IT 3- 10.
Interaction with Agency and External Systems

This is the start of the file's text. The full file is on GovTribe.

File details come from the government source that posted it. Updated .