ARG ACTION REVIEW GROUP RFQ 3140004550 DISABILITY PROPOSAL.pdf

Public Employees’ Retirement System of Mississippi

Disability Determination and Disability Appeal Services

Due Diligence Search

RFQ #3140004550

Cover Letter

Disability Determination and Disability Appeal Services

Due Diligence Search

RFQ #3140004550

IV. SCOPE OF SERVICES

PERS is conducting a due diligence search and review of their disability determination and disability appeal services. Interested bidders are allowed to submit responses to bid on all or one service. Upon complete review of this

RFP, please indicate in your proposal response which services your company is bidding on as specified below:

All Services: Disability Determination and Disability Appeal Services

Disability Determination Services only

Disability Appeal Services only

ARG is bidding on Disability Determination Services only.

Work Plan

The Scope of Services listed below represents the best practices for services contemplated in this RFP.

Responders to this RFP will provide a work plan that addresses these program and statutory requirements.

ARG will implement a structured work plan with defined workflows, timelines, staffing responsibilities, and quality controls to meet all program and statutory requirements established by the Public Employees’ Retirement System of Mississippi (PERS). Our work plan aligns with required program activities, including intake, outreach, clinical triage, claim development, recommendation, periodic review, escalation, reporting, and appeals support.

Program Structure and Staffing

ARG utilizes a defined organizational structure to support contract oversight, workflow management, case processing, clinical review, and compliance monitoring. Functions include program leadership, operations management, case management, clinical review, vocational assessment, quality assurance, and administrative support.

David Genaro serves as Director of ARG and is a senior operational leader responsible for the successful delivery and performance of disability determination programs. He provides overall operational oversight, performance monitoring, and strategic direction across ARG’s contracts. Mr. Genaro is directly accountable for ensuring service quality, efficiency, and compliance with program requirements, while maintaining strong performance against contractual metrics. He will provide direct leadership to the Program Director, and his role is included in our indirect cost rate, not charged directly as a line item in a resulting contract budget.

The Program Director provides contract oversight and serves as the primary liaison to PERS.

The Operations Manager oversees daily workflow, staffing coordination, and performance monitoring. Case Managers lead intake, documentation tracking, and coordination across all parties. Clinical review is supported by nursing staff and licensed physicians responsible for

Disability Determination and Disability Appeal Services

Due Diligence Search

RFQ #3140004550

independent determinations. Vocational Counselors provide occupational analysis, and quality assurance staff validate accuracy, completeness, and compliance prior to submission.

Workflow and Case Management

ARG executes a phased workflow with defined service levels, decision controls, and documentation standards to support timely and defensible determinations.

Intake and Case Initiation (Same Day):

Our intake process is designed to ensure immediate case accountability, accuracy, and timely progression. Each case is assigned a unique identifier, enabling full tracking and visibility from intake through final disposition.

On the day of referral, the intake staff conducts a thorough review to confirm that all required information is present. All referrals are logged upon receipt, assigned a unique identifier, and reviewed for completeness. This includes verifying referral details, medical documentation, authorization forms, and any additional materials needed to move the case forward. Standardized intake checklists are used to promote consistency and reduce the risk of omissions.

Missing documentation is identified and tracked at intake to establish full case accountability from initiation. When required documentation is missing or incomplete, the intake team issues a same-day deficiency notice outlining the specific items needed. These deficiencies are tracked within our internal case management system, with automated reminders and follow-up activities to ensure timely resolution. All outreach and follow-up activities are documented within our case management system, and required documentation is uploaded to the state system to maintain a complete and auditable record for case completion.

At intake, cases are also evaluated to determine type, urgency, and program requirements.

This allows for appropriate prioritization and routing. Cases meeting minimum requirements are advanced immediately, while those awaiting documentation remain active in intake and are monitored until complete.

Once the review is finalized, cases are assigned the same day to the appropriate staff or functional team — such as a case manager or medical review coordination unit — based on program guidelines and workload balancing. This approach minimizes delays and ensures timely progression into the next phase of review.

All intake activities are captured within our internal case management system through timestamps, validation checks, and user-level tracking, providing real-time visibility and accountability. Required documentation and final case records are maintained in the Board-designated state system to ensure full audit readiness. This process establishes clear ownership from day one, supports compliance with program requirements (including HIPAA-aligned data handling), and creates a strong foundation for efficient case management, reporting, and quality oversight.

Applicant Outreach and Case Development (Within two Business Days): Case Managers initiate applicant outreach to confirm contact information, explain the process, and identify

Disability Determination and Disability Appeal Services

Due Diligence Search

RFQ #3140004550

treating providers. Documentation collection begins immediately and is tracked to ensure completeness. Case Managers reach out to applicants the same day a case is assigned to confirm contact details and initiate the determination workflow right away. Once initial contact is made, requests for any needed documentation are sent out immediately so there’s no unnecessary delay in moving the case forward. All outreach and follow-up activities are tracked in our internal case management system to help keep timelines on track.

During their first conversation, Case Managers walk applicants through the process in clear, straightforward terms. They provide guidance around what to expect, key timelines, and what is needed from them. Contact information is confirmed to avoid communication issues later. The Case Manager also works with the applicant to identify all treating providers early, making sure no important sources of medical information are missed. Document collection also begins right away. The team uses standard checklists and templates to make sure nothing is overlooked and that every case is handled consistently. All requested records, including medical documents, provider details, and other supporting information, are tracked in our internal case management system, so it’s always clear what’s been received and what’s still outstanding.

Cases are reviewed regularly to prevent slowdowns caused by missing information. Our internal case management system flags outstanding items, and Case Managers follow up with both applicants and providers as needed. If responses are delayed, escalation steps are taken to keep the case moving and avoid impacting overall timelines. Every outreach, provider identification, and document requests is recorded with timestamps and linked to the staff member completing the work. This creates a clear record of activity, supports compliance requirements, and ensures full visibility into the status of each case at any point in time.

Clinical Triage and Evidence Review (Within 21 Calendar Days): Once documentation begins to come in, the case moves into clinical review. Clinical staff carefully review all medical records and supporting materials to understand the full picture of the applicant’s condition, treatment history, and functional impact. As part of this review, they look for any gaps in the evidence, such as missing records, incomplete treatment history, or outdated information that could impact the determination. These gaps are clearly identified and flagged early so they can be addressed without delaying the overall timeline. At the same time, each case is assessed for complexity and categorized accordingly. Factors such as medical severity, number of providers, type of condition, and completeness of records are considered. Based on this, the case is prioritized and routed into the appropriate review pathway, ensuring that more complex cases receive the level of attention they require while straightforward cases continue to move efficiently.

For cases where the documentation is complete and supports a thorough evaluation, the file is advanced directly to physician review without delay. This helps maintain momentum and supports timely decision-making.

If the documentation is not yet sufficient, the case is routed back for additional development. The clinical team works closely with case management staff to specify exactly what is needed, whether that is updated records, additional provider input, or clarification

Disability Determination and Disability Appeal Services

Due Diligence Search

RFQ #3140004550

on existing documentation. These requests are tracked and followed until the file is complete and ready to move forward.

Throughout this process, case status, review decisions, and outstanding needs are tracked within our internal case management system to maintain visibility and accountability.

Required documentation and final case actions are recorded in the Board-designated state system to ensure a complete and auditable record. This ensures transparency, keeps cases progressing within the 21-day review window, and supports consistent, well-informed clinical determinations.

Supplemental Evaluations and Vocational Analysis (As Needed): When additional evidence is required, ARG coordinates Independent Medical Examinations (IME), Independent

Psychological Evaluations (IPE), and Functional Capacity Evaluations (FCE). Applicant contact is initiated within one business day of determination. Vocational assessment evaluates functional capacity, work history, and transferable skills to inform the determination.

Physician Review and Determination: Independent medical reviews are conducted and determinations rendered based on clinical evidence, functional limitations, and statutory disability criteria. Each determination includes a documented rationale and supporting evidence. As documentation is received, each case moves into clinical triage, where our clinical team, made up of licensed physicians, reviews the full record to understand the individual’s medical condition, treatment history, and functional limitations. This is not just a checklist review; instead, the team is looking at how the evidence fits together and whether it tells a complete, supportable story.

Part of this process is identifying what’s missing. If there are gaps, such as incomplete records, outdated information, or missing provider input, those are flagged early so they can be addressed before a physician review takes place. This helps avoid rework and keeps the case moving within the 21-day timeframe. Cases are also reviewed for complexity at this stage. We look at things like the number of providers involved, the nature of the condition, and how straightforward (or not) the medical evidence is. Based on that, the case is prioritized and routed into the appropriate review path so that more complex cases receive the right level of clinical attention. When a case has sufficient, high-quality documentation, it is moved forward to physician review without delay. Our goal is to ensure that physicians are reviewing truly ready cases, allowing them to focus on making a well-supported determination. If the documentation is not yet complete, the case is sent back for further development with clear direction on what is needed. Our clinical team works closely with case management to specify the gaps, whether that’s updated records, additional testing, or clarification from a treating provider.

At ARG, our rationale is built around defensible, evidence-based decision-making. Every determination is supported by a clear explanation that ties directly to the medical record.

Rather than relying on general conclusions, our clinicians outline how the evidence supports or does not support the level of impairment being evaluated. This includes referencing key findings, functional limitations, and any inconsistencies in the record. This approach ensures that each case is reviewed thoroughly and that the final determination is well-documented, consistent, and able to withstand audit or external review.

Disability Determination and Disability Appeal Services

Due Diligence Search

RFQ #3140004550

Quality Assurance Review: Before any case is finalized and submitted, it undergoes a thorough quality review within each department to make sure everything is accurate, complete, and in line with PERS requirements. This is a standard step for every case, not just select files. Each reviewer looks at the full case to confirm that all required documentation is included, that the clinical rationale is clear and supported by the record, and that all steps in the process have been properly followed. They also check for consistency, making sure the findings, documentation, and final recommendation all align.

If anything is missing or unclear, the case is sent back for correction or additional development before it moves forward. This helps catch issues early and prevents rework later in the process. Timelines are also reviewed as part of our quality assurance process to ensure cases are moving within required turnaround expectations. Any delays or gaps are flagged so they can be addressed quickly. All quality assurance activity is documented, so there is a clear record of what was reviewed, any changes made, and who completed the review. This creates transparency, supports audit readiness, and ensures that every case submitted meets program expectations.

Submission and Case Closure: Once a case has completed clinical review and successfully passed quality reviews, final determination packages are prepared for submission to PERS.

At this stage, the file is reviewed one final time to confirm that all required elements are included: supporting documentation, medical evidence, and a well-documented clinical rationale that clearly explains the determination. The submission package is compiled in the required format and organized to ensure ease of review. All key components are clearly labeled and structured so that PERS staff can quickly access the information needed, including the clinical findings, supporting records, and final recommendation.

Cases are then transmitted to PERS through the designated submission method, whether that is a secure portal, file transfer, or other approved channel, while maintaining strict adherence to data security and confidentiality requirements. Submission details, including date and time of transmission, are logged in the case management system to ensure full tracking and accountability. This allows the team to confirm that timelines have been met and provides a clear record for audit purposes.

If any issues are identified post-submission, such as requests for clarification or additional information, the team responds promptly to ensure continuity and avoid delays in the overall decision-making process. This approach ensures that every case submitted to PERS is complete, clearly supported, and easy to review, helping to facilitate efficient and consistent determinations. All case records are also finalized and maintained to support audit requirements and follow-up actions.

Ongoing Case Management and Oversight

ARG maintains structured processes to support continued program compliance and visibility.

Periodic Eligibility Reviews: Follow-up reviews are conducted based on program requirements, incorporating updated medical documentation, treatment verification, and functional reassessment.

Disability Determination and Disability Appeal Services

Due Diligence Search

RFQ #3140004550

Escalation and Status Monitoring: Non-compliance, missed examinations, incomplete documentation, and other risk indicators are escalated within one business day. Material status changes, including return to work or withdrawal, are reported immediately.

Reporting: Quarterly reporting includes claim volume, processing timelines, outcomes, utilization of evaluations, escalation activity, and performance trends.

Appeals Support

ARG supports the appeals process beginning within one business day of notification.

Activities include review of prior case materials, evaluation of new evidence, preparation of documentation, and participation in administrative hearings when requested.

Quality, Technology, and Performance Controls

ARG integrates quality assurance, technology, and performance monitoring into all phases of the work plan. Case activity is managed through a secure system with role-based access, audit tracking, and real-time status visibility.

Performance is monitored against defined service levels, including:

• Outreach within two business days

• Clinical triage within 21 calendar days

• Escalation within one business day

• Timely reporting and delivery

Quality reviews, audit checks, and performance tracking support ongoing compliance with

PERS requirements and statutory disability criteria.

End-to-End Disability Determination Process

Disability Determination and Disability Appeal Services

Due Diligence Search

RFQ #3140004550

Required Attachments

Attachment A – PERS Contract

Per RFP requirements, ARG has reviewed Attachment A and will execute upon award.

Disability Determination and Disability Appeal Services

Due Diligence Search

Attachment B

Disability Determination and Disability Appeal Services

Due Diligence Search

RFQ #3140004550

Attachment C

PERS Confidentiality and Information Protection Acknowledgement

Per RFP requirements, ARG has read and reviewed PERS Confidentiality and Information

Protection Acknowledgement and will comply and sign upon award.

Disability Determination and Disability Appeal Services

Due Diligence Search

Disability Determination and Disability Appeal Services

Due Diligence Search

RFQ #3140004550

Independent Medical Reviewer Cybersecurity & Privacy Practices Questionnaire

Per RFP requirements, ARG has read and reviewed the Independent Medical Reviewer

Cybersecurity & Privacy Practices Questionnaire and will comply and sign upon award.

Disability Determination and Disability Appeal Services

1. Scope and Nature of PERS Access

• Describe how and when you access PERS disability case information, including frequency of reviews and typical duration of access.

ARG accesses PERS disability case information through secure, web-based systems or designated PERS data portals. Access is controlled, auditable, and limited to authorized personnel in accordance with confidentiality and security requirements.

Timing and Method of Access

• Initial access: Case information is accessed upon receipt from PERS. Cases are logged and reviewed on the same business day to initiate intake and verify completeness.

• Ongoing access: Case data is accessed throughout the lifecycle of each claim to support case development, documentation tracking, and workflow management.

• Frequency of review:

o Active cases are reviewed daily to monitor progress, update documentation, and track outstanding requirements.

o Additional access occurs at key workflow milestones, including clinical triage, physician review, quality assurance validation, and final submission.

Duration of Access

Case access is maintained from intake through final determination and submission to PERS.

Access may extend beyond the initial determination to support:

• Appeals processing, where prior case materials are reviewed

• Periodic eligibility reviews, where updated medical documentation is incorporated

Following case closure, records remain accessible in accordance with PERS retention policies and contractual requirements to support audit and reporting needs.

Access Controls and Monitoring

Access to case information is governed by role-based permissions, ensuring only authorized personnel can view or update data. All system activity is logged and time-stamped, creating a complete audit trail of access and actions. Data access is further secured through encryption, multifactor authentication, and safeguards aligned with privacy and security requirements.

• Describe the physical environment where reviews take place (e.g., private office, shared workspace, supervised environment).

ARG conducts all disability case reviews within a secure, professional office environment using private offices or controlled workspaces designed to protect confidentiality and prevent unauthorized viewing or overhearing of sensitive information. When shared workspaces are used, safeguards are applied to maintain privacy between users, including

Disability Determination and Disability Appeal Services screen privacy controls, physical separation of work areas, and user-specific access sessions. Workstations are configured to restrict visibility and access to authorized users only. Access to review environments is limited to authorized personnel, and workspaces are maintained in accordance with HIPAA-aligned security requirements. Staff are required to secure workstations when not in use and to log out of all systems at the conclusion of each review session.

• Describe the equipment used during reviews (PERS-provided workstation, personal device, or both) and explain why.

ARG will conduct all disability determination reviews using organization-issued, centrally managed workstations. Personally owned devices are not permitted for any program activities. All user workstations are owned, configured, and maintained by ARG. This includes installation of required applications, security controls, updates, and monitoring. Devices are configured to meet program, contractual, and HIPAA requirements for the handling of sensitive personal and medical information.

This model provides:

• Full administrative control over device configuration and security settings

• Consistent enforcement of access controls, authentication protocols, and system updates

• Protection of applicant data through managed endpoints and controlled network access

• Complete auditability of system access and user activity

By restricting work to ARG-managed equipment, all case review activities are conducted within a controlled environment that supports data security, system integrity, and compliance with PERS requirements.

Confirm whether any PERS data is ever removed from PERS facilities. If so, describe the circumstances and controls in place.

ARG does not remove PERS data from PERS facilities except in limited circumstances where retention is contractually or legally required. In those cases, hardcopy files or required electronic media are transferred to a secure, third-party storage facility under contract with

ARG. This facility maintains documented chain-of-custody records and provides controlled access to archived materials for retrieval when needed. All transfers are conducted using established handling procedures and tracking protocols to preserve data integrity and confidentiality. Stored materials remain protected within a controlled environment that supports secure retention, monitoring, and access management in accordance with program requirements.

Disability Determination and Disability Appeal Services

2. Device and Endpoint Security Practices

Describe the devices you use for professional work, including device type and operating system.

ARG personnel utilize organization-issued laptops running Windows 11 for all professional work. Devices are centrally managed, configured, and patched by ARG’s IT department. Each laptop includes whole disk encryption, a Trusted Platform Module (TPM) for secure storage of encryption keys, host-based firewalls, and advanced Endpoint Detection and Response

(EDR) software. A Secure Access Service Edge (SASE) solution supports secure remote access, web filtering, and network protection. Peripheral devices, including printers and mobile phones, are organization-owned and secured through managed network controls and mobile device management tools. Personally owned devices are not permitted.

• Explain how your devices are protected from unauthorized access, including:

ARG devices are secured through centralized identity and access management controls, endpoint protections, and enforced security configurations. Access is managed through

Microsoft Entra using a cloud-based identity model, with multifactor authentication required for all users. Devices are configured with automatic screen lock after periods of inactivity and require reauthentication for access. Encryption, endpoint monitoring, and network protections are applied across all devices to protect sensitive data and restrict unauthorized use.

o Authentication methods (password, PIN, etc.)

Authentication is performed using multifactor authentication through Microsoft

Authenticator with code pinning enabled. Windows Hello for Business is implemented to provide secure, phishing-resistant, passwordless access using device-based credentials such as PIN or biometric authentication. These controls are supported by TPM-backed key storage to protect authentication credentials and prevent unauthorized access.

o Automatic screen locking

Devices are configured with automatic screen lock after seven (7) minutes of inactivity.

Users are required to reauthenticate using secure credentials to regain access, preventing unauthorized viewing or use when devices are unattended.

o Physical safeguards when not in use

ARG-issued devices are maintained in controlled environments with restricted access. When not in use, devices are secured within office locations or approved workspaces. Access to facilities is limited to authorized personnel, and devices are not left unattended in unsecured areas. Mobile devices, when issued, are managed and controlled through centralized mobile device management tools to enforce security policies and data protection.

Disability Determination and Disability Appeal Services

• Describe how operating system and software updates are applied to your devices.

All device patching is managed remotely by ARG’s corporate IT team using commercial management tools. Standard patching intervals align with manufacturer release schedules.

Systems that issue monthly updates, such as Microsoft products, are patched monthly, while platforms with quarterly release cycles are patched quarterly. Critical and out-of-band patches are prioritized based on risk. For internet-facing systems, patches are assessed within 24 hours and applied within 48 hours of release. For non-internet-facing systems, critical patches are assessed within three days and applied within seven days. User laptops are treated as internet-facing under this policy.

• Explain what security protections are in place (e.g., antivirus, built-in system protections, firewall).

ARG devices include layered security protections across all endpoints. These include:

• Advanced Endpoint Detection and Response (EDR) software to identify and mitigate threats

• Host-based firewalls enabled on all devices

• Whole disk encryption to protect data at rest

• TPM for secure storage of encryption keys and credentials

• Secure network access through a SASE solution, providing web filtering, firewall-as-a-service, and protected remote connectivity

These protections work together to secure devices, monitor for threats, and safeguard sensitive data across all program activities.

3. Data Handling and Confidentiality

• Describe how PERS disability case information is reviewed (electronic, paper, or both).

ARG reviews PERS disability case information primarily through secure, web-based systems or designated PERS data portals. Electronic records are accessed within controlled environments that support role-based access, audit tracking, and secure document handling. Paper records, when required, are handled within secure office environments and maintained in accordance with established documentation management procedures. Access to both electronic and hardcopy materials is limited to authorized personnel and restricted to the minimum necessary for case review activities. These review practices align with established workflow processes, documentation controls, and secure system use to support confidentiality and compliance throughout the case lifecycle.

• If notes are taken:

o Describe the type of information recorded

Any notes taken during case review are limited to information necessary to support case processing, including documentation tracking, clarification of medical or vocational findings, and review observations tied to the disability determination process. Notes do not include

Disability Determination and Disability Appeal Services unnecessary duplication of records and are maintained in alignment with minimum necessary access standards.

o How notes are protected while on-site

Notes are protected through secure handling practices within controlled work environments.

Electronic notes are maintained within secure systems that apply role-based access controls, audit tracking, and authentication requirements. Any physical notes are kept within restricted workspaces, not left unattended, and secured when not in use.

o How and when notes are destroyed

Notes are retained only as required to support case processing and are disposed of in accordance with established document retention and disposal procedures. Physical notes are securely destroyed using approved methods, and electronic notes are managed within controlled systems where retention and deletion follow defined protocols.

• Explain how you ensure that no screenshots, photographs, copies, or recordings of PERS information are made.

ARG prevents unauthorized duplication of PERS information through controlled system access, device restrictions, and policy enforcement. Access to PERS data is limited to approved, managed devices configured with security controls that restrict unauthorized data capture or transfer. Staff are prohibited from creating screenshots, photographs, recordings, or unauthorized copies of PERS information. Compliance is reinforced through training, monitored system access, and enforcement of acceptable use policies. All activity is tracked within secure systems, supporting oversight and accountability.

• Describe how you prevent unauthorized individuals from viewing or overhearing sensitive information during reviews.

ARG prevents unauthorized viewing or disclosure of sensitive information through controlled work environments and defined operational practices. Reviews are conducted in private offices or restricted workspaces designed to limit visibility and access. Additional safeguards include screen privacy controls, physical spacing in shared environments, and requirements to secure workstations when not actively in use. Access to work areas is limited to authorized personnel, and staff follow procedures to ensure that sensitive information is not exposed during discussions or visible on screens. These practices are applied consistently across all phases of case review to protect confidentiality and maintain compliance with program requirements.

4. Access Control and Authentication

• Describe how access to PERS systems or records is granted to you.

Access to PERS systems and records is granted through a controlled, role-based process, with provisioning managed by PERS in coordination with authorized program personnel.

Access is assigned based on defined job responsibilities and restricted to the minimum necessary to perform required duties. User accounts are created only after appropriate

Disability Determination and Disability Appeal Services

Due Diligence Search

RFQ #3140004550

authorization and verification, and permissions are configured to limit access to only the systems, data, and functions required for the assigned role. Access is provided through secure authentication processes and is subject to ongoing monitoring and control. Changes to access rights, including modifications or revocation, are managed through formal processes to ensure that access remains aligned with current job responsibilities. This includes immediate updates when roles change or access is no longer required.

• Explain how you ensure:

o Only you use your assigned access

ARG enforces strict access control and individual accountability to ensure that only authorized users access PERS systems and data. Credential sharing is strictly prohibited by policy, and each user is assigned unique credentials that must remain under their sole control. Credentials are not shared, stored in unsecured locations, or transmitted to others.

Access is controlled through centralized identity management using Microsoft Entra, with conditional access rules that monitor and restrict login activity based on risk indicators such as device compliance, location, and unusual access behavior. These controls detect and block unauthorized or anomalous access attempts in real time. Authentication requirements include strong password standards and multifactor authentication, with device-based verification to prevent unauthorized access. All system activity is attributable to individual user credentials, reinforcing accountability for all actions performed within the system.

Additional safeguards include:

• Required use of ARG-issued, managed devices for all system access

• Automatic session controls, including screen locking and user reauthentication

• User responsibility to log out of systems when not in use

• Ongoing awareness of phishing and social engineering risks, with required reporting of suspicious activity

• Routine audits and quality control reviews to monitor compliance with security protocols and identify potential risks or gaps

Through these controls, ARG maintains secure access management, ensures traceability of all user activity, and prevents unauthorized use of assigned credentials.

o Access is terminated or logged out at the conclusion of each review session

ARG ensures that access to PERS systems is terminated at the conclusion of each review session through enforced session management protocols and user accountability requirements. Staff are required to manually log out of all PERS systems and applications immediately upon completing a review session to prevent any active sessions from remaining open. This requirement applies to all environments and is reinforced through user training and standard operating procedures.

Disability Determination and Disability Appeal Services

Automatic session controls provide an additional layer of protection. Systems are configured with timeout features that log users out after periods of inactivity, reducing the risk of unauthorized access if a session is left unattended. Workstations must be secured when not in active use. Users are required to lock their devices when stepping away, even for short periods, and access can only be resumed through reauthentication. Prior to ending each session, staff ensure that all applications are closed appropriately and that sensitive information, including any protected health information, is no longer visible or accessible on the screen. System access is limited to approved, managed devices, ensuring that session controls, authentication requirements, and security policies are consistently enforced.

• If shared workstations are used, describe how privacy between users is maintained.

While ARG assigns individual workstations to each staff member, shared workstation scenarios are still protected through user-level access controls and system configuration.

Each user is assigned a unique account, and when accessed on an ARG-issued laptop, the system creates a distinct user profile tied to that individual. User profiles maintain separate storage environments, including dedicated OneDrive access, email accounts, desktop configurations, and application settings. Access controls within the operating system restrict visibility between user profiles. When different users access the same device at different times, each user can only view their own profile and authorized shared resources. Data associated with other user accounts is not accessible. This structure maintains privacy between users and ensures that sensitive information remains isolated and protected, even if a device is used by more than one authorized individual.

5. Privacy Awareness and Regulatory Understanding

• Describe your understanding of patient privacy obligations and how they apply to disability case reviews.

ARG understands that patient privacy obligations require strict protection of all sensitive information, including Protected Health Information (PHI), in accordance with applicable laws such as HIPAA and PERS requirements. In the context of disability case reviews, this includes maintaining confidentiality of all records, limiting access to the minimum necessary information, and using secure systems and environments for all data handling activities.

Access to PHI is restricted to authorized personnel and limited to activities required to perform assigned duties. ARG applies safeguards for the storage, transmission, and disposal of sensitive information to prevent unauthorized or accidental disclosure. All system activity is auditable, and staff are required to report any suspected incident or unauthorized access.

Describe any training, education, or professional experience that informs how you protect confidential medical information.

ARG ensures that all staff handling confidential medical information complete required security and confidentiality training during onboarding and at least annually thereafter, with periodic reinforcement conducted throughout the year. Training is delivered through multiple

Disability Determination and Disability Appeal Services formats, including the organization’s Learning Management System (LMS), internal communications, and instructor-led sessions. Completion of all required coursework is tracked and reported within the LMS to ensure compliance. Required training topics include protection of customer confidentiality, security awareness, information technology policies, and organizational standards for ethical conduct. Staff also complete training related to the responsible use of digital tools and emerging technologies. These courses establish expectations for handling Protected Health Information (PHI), identifying risks, and maintaining compliance with applicable privacy and security requirements.

In addition to formal coursework, ARG conducts ongoing awareness activities, including simulated phishing exercises, to reinforce secure behaviors and reduce the risk of credential compromise or unauthorized access. Supplemental communications and periodic training sessions are used to address updates to policies, emerging threats, and evolving regulatory expectations.

• Explain how privacy and confidentiality considerations are incorporated into your professional practices.

ARG incorporates privacy and confidentiality requirements into daily operations through established case management procedures, controlled system access, and staff accountability requirements. Protected Health Information (PHI) is accessed only by authorized personnel and limited to activities required to perform assigned duties, consistent with defined roles and responsibilities within the review process. Confidentiality controls are embedded across the case lifecycle, including intake, documentation management, clinical review, and reporting. Case information is maintained within secure systems that support role-based access, audit tracking, and controlled document handling.

All activity is recorded and auditable to support compliance monitoring and review. These practices align with established workflow controls, documentation standards, and security requirements governing the handling, storage, and transmission of sensitive information during disability case reviews.

6. Incident Awareness and Reporting

• Describe how you would recognize a potential security or privacy incident (e.g., unauthorized access, accidental disclosure, loss of notes).

ARG recognizes potential security or privacy incidents through defined indicators that signal a risk to the confidentiality, integrity, or availability of sensitive information, including

Protected Health Information (PHI). Staff maintain awareness of these indicators and apply established criteria to identify potential issues during daily operations.

Potential incidents include:

• Unauthorized access: Attempts or successful access by individuals without appropriate authorization, including unusual login activity, credential misuse, or access outside assigned roles

Disability Determination and Disability Appeal Services

• Accidental disclosure: Unintentional sharing of confidential information, such as misdirected emails, incorrect attachments, or exposure of information in non-secure settings

• Loss or misplacement of information: Missing physical documents, lost notes, or misplaced devices that may contain sensitive data

• Data integrity or system anomalies: Unexpected changes to records, data discrepancies, or abnormal system behavior indicating potential compromise or unauthorized modification

• Improper handling or storage: Failure to follow established protocols for securing, transmitting, or disposing of information

Recognition of these indicators is reinforced through required training, security awareness activities, and adherence to established policies and procedures. Staff are required to immediately report any suspected or confirmed incidents in accordance with defined incident reporting protocols to support timely containment, investigation, and resolution.

• Explain the steps you would take if you suspected an incident, including who you would notify and how quickly.

ARG follows defined incident response procedures to ensure timely identification, reporting, and containment of potential security or privacy incidents. Upon identifying a suspected or confirmed incident, staff are required to immediately cease any activity that could contribute to further exposure and take steps to secure affected systems, data, or physical materials.

The incident is reported without delay through established internal reporting channels, including notification to program management and designated IT/security personnel responsible for incident response. Where PERS data or systems are involved, notification is escalated in accordance with contract requirements and applicable reporting protocols.

Initial reporting occurs immediately upon identification of the issue. Incident response personnel assess the situation, initiate containment measures, and determine next steps for investigation, remediation, and required notifications. All actions are documented to support resolution, auditability, and compliance with program and regulatory requirements.

• Describe any prior experience responding to confidentiality or data protection concerns, if applicable.

ARG personnel are trained and experienced in identifying and responding to confidentiality and data protection concerns through established security and compliance practices. Staff routinely apply incident recognition criteria, escalation procedures, and documentation requirements when addressing potential risks to sensitive information. This experience includes responding to situations such as suspected unauthorized access, misdirected communications, and handling of sensitive information in accordance with privacy and security policies. In each case, staff follow defined procedures to report the issue, secure affected information, and support investigation and resolution efforts. Response activities are reinforced through required annual compliance training, including IT Security Awareness

Disability Determination and Disability Appeal Services and Safeguards, as well as ongoing security awareness programs and routine monitoring practices such as phishing simulations and compliance reviews. These activities ensure that staff remain prepared to identify, report, and respond appropriately to confidentiality or data protection concerns within the operational environment.

7. Professional Responsibility

• Describe the steps you personally take to ensure confidentiality and reasonable cybersecurity hygiene in your professional work.

ARG staff maintain confidentiality and cybersecurity hygiene through daily adherence to established security practices, defined procedures, and individual accountability requirements. Sensitive information, including Protected Health Information (PHI), is accessed only for authorized purposes and limited to the minimum necessary to perform assigned duties. Staff use only approved, organization-issued devices and secure systems to access PERS data. Workstations are secured when unattended, and all sessions are properly terminated after use to prevent unauthorized access. Credential management practices are strictly followed, including protection of unique login credentials and compliance with authentication requirements. Additional practices include maintaining awareness of potential threats such as phishing or unauthorized access attempts, verifying appropriate handling of sensitive information during all phases of case review, and reporting any suspected security or privacy concerns in accordance with established procedures.

These actions support secure handling of data and reinforce individual responsibility for protecting confidential information.

• Identify any additional safeguards or practices you believe help reduce cybersecurity or privacy risk during PERS disability case reviews.

ARG incorporates additional safeguards within daily operations to reduce cybersecurity and privacy risk. All access to PHI is limited to a minimum-necessary basis and conducted through approved systems and secure communication channels.

Operational practices reinforce these controls and include:

• Maintaining strong credential management and protection of authentication factors

• Using only managed devices with enforced security configurations

• Remaining vigilant to potential security threats, including phishing and social engineering attempts

• Securing workstations and information when unattended

• Applying consistent documentation and handling practices to prevent accidental disclosure

Any suspected privacy or security incident is reported immediately through established incident reporting protocols, allowing for timely escalation, investigation, and resolution.

These safeguards support consistent protection of sensitive information throughout the disability case review process and align with HIPAA requirements and PERS expectations.

Disability Determination and Disability Appeal Services

Due Diligence Search

Attachment D

Disability Determination and Disability Appeal Services

Due Diligence Search

Attachment E