Appendix G - Medicaid Enterprise Technical Requirements.docx

Appendix G Medicaid Enterprise Technical Requirements for the MassHealth Provider Services Module Replacement Architecture and Platform Requirements The Contractor shall deliver a Provider Services Module that conforms to modern, scalable, and secure architectural standards required by the Commonwealth.

The solution shall be cloud‑native or cloud‑ready, supporting containerization, autoscaling, and managed cloud services consistent with EOTSS Cloud Policies.

The solution shall employ a modular, service‑oriented or microservices architecture with independently deployable components for enrollment, screening, maintenance, and revalidation.

The solution shall include a configurable business rules engine enabling MassHealth to modify provider eligibility, screening logic, and workflow rules without code changes.

The solution shall support high availability and disaster recovery meeting or exceeding Commonwealth RTO/RPO requirements and supporting multizone failover.

Integration and Interoperability Requirements The Contractor shall ensure seamless interoperability across the Medicaid Enterprise.

1. The solution shall expose standards‑based APIs (REST, FHIR, and SOAP where required) and secure batch interfaces for high‑volume transactions.

The solution shall integrate with all relevant MassHealth MMIS, including but not limited to: Member, Managed Care, EVS, Claims, TPL, Financials, and the Data Warehouse.

The solution shall support integration with federal and national data sources, including NPPES, PECOS, SAM.gov, SSA Death Master File, and OIG LEIE.

The Contractor shall maintain versioned, backward compatible interfaces and participate in cross vendor integration governance to ensure interoperability in a multivendor ecosystem.

The solution shall comply with the requirements set forth in 42 CFR Subparts B and G, 42 CFR 457.1233, and any other integration and interoperability standards required by federal or state laws and regulations, as applicable.

Provider Enrollment, Screening, and Maintenance Requirements The Contractor shall implement comprehensive provider lifecycle management capabilities.

1. The solution shall support risk‑based screening in accordance with 42 CFR 455 Subparts B and E.

The solution shall provide a self‑service provider portal with configurable workflows by provider type, classification, and role.

The solution shall automate revalidation, reenrollment, and maintenance activities, including notifications, workflow routing, and exception handling.

The solution shall integrate with the EOHHS Electronic Document Management to support capabilities with secure upload, OCR, metadata tagging, and full audit trails.

Data Management, Quality, and Governance Requirements The Contractor shall ensure data integrity, auditability, and alignment with Commonwealth data governance standards.

1. The solution shall maintain a Master Provider Index serving as the authoritative source of provider data across Medicaid Enterprise.

1. The solution shall include automated data validation, cleansing, and deduplication capabilities.

1. All provider data changes shall be fully auditable, including timestamps, user attribution, and immutable change logs.

1. The Contractor shall comply with MassHealth data governance processes, including data quality reviews, stewardship activities, and metadata standards.

Security and Privacy Requirements The Contractor shall meet all Commonwealth, federal, and CMS security requirements.

1. The solution shall comply with NIST 800‑53, CMS MARS‑E, HIPAA, and all EOTSS security standards.

1. The solution shall implement role‑based access control (RBAC) with granular permissions for state staff, vendors, and providers.

1. All data shall be encrypted in transit and at rest using FIPS‑validated cryptographic modules.

1. The Contractor shall support continuous monitoring, SIEM integration, vulnerability management, and incident response processes aligned with Medicaid Enterprise.

CMS Modularity and Certification Requirements The Contractor shall support CMS certification and modularity expectations.

1. The solution shall align with MITA 3.0 business, information, and technical architecture maturity goals.

1. The Contractor shall provide all artifacts required for CMS Outcomes Based Certification, including traceability, evidence generation, and testing documentation.

1. The Contractor shall support APD development and updates, including documentation required for enhanced federal match.

Testing, Validation, and Quality Assurance Requirements The Contractor shall participate fully in Medicaid Enterprise’s testing and validation processes.

1. The Contractor shall support end‑to‑end testing across all impacted modules and systems.

1. The Contractor shall provide automated regression testing for each release.

1. The Contractor shall conduct performance and load testing to validate system responsiveness during peak provider enrollment periods.

1. The Contractor shall participate in Medicaid Enterprise IT Intake, governance, and test validation procedures, including defect triage and legacy system testing cycles.

DevOps, Release Management, and Environment Requirements The Contractor shall implement modern DevOps practices and maintain consistent environments.

1. The solution shall support CI/CD pipelines with automated builds, deployments, and security scans.

1. The Contractor shall maintain environment parity across Dev, Test, UAT, Pre‑Production, and Production.

1. The Contractor shall maintain version control for all code, configuration, and interface specifications and provide release notes for all deployments.

Service Levels, Performance Metrics, and Operational Requirements The Contractor shall meet or exceed the following performance expectations.

1. Provider enrollment processing times for initial enrollment, revalidation, and maintenance.

System uptime and response times, including portal responsiveness and API latency.

Defect resolution timelines based on severity levels defined by Medicaid Enterprise.

Data accuracy and timeliness for provider file updates and downstream system impacts.

Documentation, Knowledge Transfer, and Governance Participation The Contractor shall provide complete documentation and participate in Medicaid Enterprise governance.

1. The Contractor shall integrate with EOHHS Electronic Document Management system, and produce architecture diagrams, data dictionaries, interface control documents.

1. The Contractor shall participate in Medicaid Enterprise IT Governance, including architecture reviews, security reviews, and change control boards.

Data Migration, Coexistence, and Transition Requirements The Contractor shall support a safe and orderly transition from legacy systems.

1. The Contractor shall provide a data migration strategy supporting incremental migration and parallel operations.

1. The Contractor shall provide data reconciliation tools for matching, exception handling, and audit reporting.

1. The Contractor shall support coexistence with legacy systems during phased implementation.

Provider Experience and Accessibility Requirements The Contractor shall ensure a modern, accessible, and user‑friendly provider experience.

1. The provider portal shall comply with WCAG 2.1 AA accessibility standards.

1. The portal shall be mobile‑responsive and optimized for common devices and browsers.

1. The solution shall support multilingual content where required by MassHealth.

Appendix G, Attachment A Model Contract MassHealth Business Support Services RFR Page 1 of 1