Att 1 Template Statement of Work.docx

TEMPLATE STATEMENT OF WORK

BETWEEN

THE EXECUTIVE OFFICE OF HEALTH AND HUMAN SERVICES

AND

[VENDOR]

FOR THE

EHS COMPREHENSIVE ASSESSMENT SYSTEM (E-CAS)

1. INTRODUCTION

The following document will serve as a Statement of Work (“SOW”) between the Executive Office of Health and Human Services (“EOHHS”) of the Commonwealth of Massachusetts (“Commonwealth”) and [Vendor Name] (“Vendor”) to apply to the Implementation, Maintenance and Support of an assessment management software solution. Additional work in support of this solution may follow the initial work, at EOHHS’s option, upon the execution of a Change Order for such work. The entire agreement between the Parties (the “Contract”) consists of the following documents in the following order of precedence: (1) the Commonwealth Terms and Conditions; (2) the Commonwealth’s Standard Contract Form; (3) the RFR for the EHS Comprehensive Assessment System (e-CAS), Document #22EHSLCe-CASRFR, inclusive of all Attachments; (4) Data Management and Confidentiality Agreement (DMCA); (5) this SOW; and (6) the Vendor’s response to the RFR, inclusive of all attachments and modifications, as amended by any subsequent negotiations between the Parties.

2. DEFINITIONS

The following terms and acronyms are used throughout the RFR and Attachments and shall have the meaning stated in this section unless the context clearly indicates otherwise. Unless otherwise noted, capitalized terms in this RFR and its Attachments are defined in this Attachment 1, Statement of Work.

Accountable Care Organization (ACO): An entity that enters into a population-based payment model contract with EOHHS as an accountable care organization, wherein the entity is held financially accountable for the cost and quality of care for an attributed or enrolled member population.

Actionable Item: A score of 2 or 3 on a CANS item indicates the item requires “some action” from the Assessor.

Adverse Action: (1) EOHHS’s determination that a requested service is not a Medically Necessary PA-Covered Service, or (2) any action taken by the Vendor to deny, reduce, restrict, terminate, modify or suspend a PA-Covered Service.

Additional Charge: Payment in addition to the base contract value that EOHHS will pay the Vendor for Desired Service Level performance on Key Performance Indicators (KPIs).

Agile: Umbrella term for software development frameworks and practices based on the values and principles expressed in the Manifesto for Agile Software Development. It is an iterative approach to software delivery that builds software incrementally from the start of the project.

Aging Service Access Point (ASAP): Locally based private, non-profit corporations which contract with the Executive Office of Elder Affairs to provide community-based services to certain eligible individuals in accordance with M.G.L. c. 19A, § 4B.

Application Programming Interface (API): A computing interface that defines interactions between multiple software intermediaries. It defines the kinds of calls or requests that can be made, how to make them, the data formats that should be used, the conventions to follow, etc. An API can be entirely custom, specific to a component, or designed based on an industry-standard to ensure interoperability.

Appeal: A Member’s right to contest to the Office of Medicaid Board of Hearings (BOH) pursuant to 130 CMR 610.000, any Adverse Action.

Application: The Vendor-owned or licensed assessment management software solution, as well as any third-party components or open-source software contained therein, and any updates, upgrades, releases or enhancements thereto.

Approval (or Approve; Approved): Refers to EOHHS’s right under the Contract to approve, disapprove, or modify an action, request, document, or submission by the Vendor. EOHHS’s silence shall not constitute Approval by EOHHS. Neither EOHHS’ silence nor Approval related to Vendor’s action, request, document, or submission will operate to indemnify, modify liability, or otherwise absolve Contractor of any responsibility arising from its performance of the Contract, unless otherwise agreed upon by EOHHS and Vendor in writing.

Assessment Team: Group of Authorized Users, which may be configured and maintained by Primary Users for their Provider organization.

Assessment Tool: Clinical assessment conducted using the EHS Comprehensive Assessment System (e-CAS), including a question bank, workflows to facilitate the completion of assessments by Assessors, and Outputs calculated using System Logic. Examples of Assessment Tools include: the Uniform Core Assessment (UCA), the Child and Adolescent Needs and Strengths (CANS), and the Time-to-Task (TTT).

Assessor: Appropriately licensed individual, as determined by EOHHS, who administers an assessment to individuals as directed by EOHHS.

Authorized Representative: Individual authorized to act on behalf of a MassHealth applicant or Member pursuant to 130 CMR 501.000 and 515.000.

Authorized Users: All officers, directors and employees of EOHHS, each of whom is authorized to use and/or access the Application, as well as all agents, contractors, consultants, and their respective employees that EOHHS retains of grants any sublicense to hereunder in connection with the Services under the Contract and/or the Permitted Use. Authorized Users also include all officers, directors and employees of MassHealth Providers, Members, and Members’ Authorized Representatives to use and/or access the Application in connection with the Permitted Use.

Availability/Available: Available means the system services are operable for access and use by EOHHS and its Authorized Users over the Internet in material conformity with the agreed upon specifications. Availability has a correlative meaning. The Services are not considered Available in the event of a material performance degradation or inoperability of the system services, in whole or in part.

Bad Data: Data that contains errors related to data completeness, accuracy, consistency, validity, and/or integrity, as specified by the Parties for the purposes of Key Performance Indicators.

Base Contract Value: Value of e-CAS Contract that is agreed upon in the signed Contract between EOHHS and the Vendor. The Base Contract Value will be used to calculate the Phase 1 and 2 implementation Milestone amounts, Key Performance Indicator (KPI) withhold amounts, KPI Credits, and KPI Additional Charges. The Base Contract Value may be subdivided into amounts to be paid upon implementation Milestones, and still referred to as the “Base Contract Value”. When scope is added to the Contract via a Change Order, any additional corresponding costs will be added to the Base Contract Value. The value of any InterRAI licensing royalty payments as described in RFR Section 1.9 are excluded from the Base Contract Value.

Bidder: An entity that submits a Bid or Response to this EHS Comprehensive Assessment System RFR.

Business Day: All days except for weekends and Commonwealth holidays, as designated by the Secretary of the Commonwealth.

Business Hours: The hours during which Commonwealth business is normally conducted, which is 8:00 a.m. to 6:00 p.m. Eastern Standard/Daylight Savings (US).

Board of Hearings: The Board of Hearings within the Executive Office of Health and Human Services’ Office of Medicaid.

Calendar Day: Any day of the week regardless of whether work is performed, including weekends and Commonwealth holidays.

Centers for Medicare and Medicaid Services (CMS): The federal agency which oversees state medical assistance programs under Titles XIX and XXI of the Social Security Act and waivers thereof.

Center for Medicare and Medicaid Services (CMS) Data: CMS assessment data that is pertinent to the LTSS population, such as OASIS or MDS 3.0 assessments, which CMS makes available to states and their vendors on a regular basis via a variety of data exchange methods.

Change Order: An amendment to this Contract that modifies (or specifies additional) Tasks, Deliverables, or Services to be completed by Vendor under the terms of the Contract.

Change Request: Change Order requests from either Party proposing changes to the Services, Tasks, or Deliverables to be completed by Vendor under the terms of the Contract.

Child and Adolescent Needs and Strengths (CANS) Tool: A functional assessment tool developed to support decision-making, including treatment planning, facilitating quality improvement initiatives, and monitoring the outcomes of services. The tool collects information in a consistent manner and improves communication between those providing services and families receiving services. The CANS reviews the strengths and needs of a child/youth considering past behavior but focuses on the current needs to help the child/youth and family. The CANS has different sections, which have various items about the child/youth and family’s life.

Cloud Offering: Refers to Software-as-a-Service (SaaS), Infrastructure-as-a-Service (IaaS) and Platform-as-a-Service (PaaS).

Commonwealth: The Commonwealth of Massachusetts.

Commonwealth Data: All data used or owned by EOHHS or the Commonwealth to which the Vendor gains access through a contract resulting from this RFR. Subject to provisions in Attachment 1, Statement of Work, Section 5.

Commonwealth Property: As defined in Attachment 1, Statement of Work, Section 10.8.

Comprehensive Data Set (CDS) 3: Assessment used by the Executive Office of Elder Affairs, which includes Full, RN, and CM versions and is based on the InterRAI MDS-HC.

Configuration: Ability to change a software application’s features or behavior through the use of functionality, tools and/or utilities native to/built into the software application, i.e., without the need for custom programming or coding.

Consent: The assessed individual’s or the assessed individual’s legal guardian’s, as applicable, agreement to complete the assessment process with the Assessor and the Assessor’s organization or Assessment Team, as applicable.

Contract: The contract documents, including all attachments, appendices and amendments, if any, between the Vendor and EOHHS for the provision of services described within this RFR.

Credit: Payment that the Vendor will pay to EOHHS if the Minimum Service Level performance on one or more Key Performance Indicators is not met.

Customer Satisfaction Score (CSAT): A survey tool that measures customer satisfaction with a software interaction or system.

Customer Service Center (CSC): Unit operated by the vendor engaged by EOHHS to provide support to MassHealth Members and non-LTSS Providers.

Customization: A feature, extension or modification of a software application’s feature that requires custom programming or coding.

Defect: A nonconformity, error or deficiency in a deliverable or software product where it does not meet its requirements or specifications, which may be caused by an issue with the code, data, or requirements gathering.

Defect Severity Level: The classification of a Defect based on its level of destructive impact on the requirements specification of the software.

Definition of Done: The definition of done (DoD) is when all conditions, or acceptance criteria, that a software product must satisfy are met and ready to be accepted by a user, customer, team, or consuming system.

Degradation of Service (or Service Degradation): Decrease in functionality of e-CAS due to the system being unusable because it’s error-prone or too slow to use, or a key function is down or unusable. Degradation occurs when a service tests as fully operational but performs below the baselines established during acceptance testing, and includes but is not limited to slow performance and/or intermittent system errors.

Deliverable: Any work product, information, materials, software or other submissions the Vendor provides or is required to provide to EOHHS, as specified in the Contract. Subject to the provisions in Attachment 1, Statement of Work Template, Section 9. List of Deliverables provided in Attachment 3, e-CAS System Reports and Plans.

Department of Children and Families (DCF): EOHHS agency serving to keep children safe from abuse and neglect, providing supports and services for youth, parents and family members and if necessary provides foster care or new permanent families for children through kinship, guardianship or adoption.

Department of Developmental Services (DDS): EOHHS agency responsible for providing supports for individuals with intellectual and developmental disabilities, including Autism Spectrum Disorder, to enhance opportunities for them to become fully engaged members of their community.

Department of Mental Health (DMH): EOHHS agency that, as the State Mental Health Authority, assures and provides access to services and supports to meet the mental health needs of individuals of all ages, enabling them to live, work and participate in their communities.

Department of Youth Services (DYS): EOHHS agency serving as the State’s juvenile justice agency with the mission of making communities safer by improving outcomes for youth. Working with youth, families and communities, DYS provides a wide range of services to support youth in the community.

Desired Service Level: Highest level of performance on Key Performance Indicator (KPI) that Vendor may achieve.

Divert or Diversion: The transfer of Key Personnel by the Vendor or its Significant Subcontractor(s) to another assignment within the control of either the Vendor or Significant Subcontractor(s).

Documentation: All generally available documentation relating to the Application, including but not limited to all user manuals, operating manuals, and other instructions, specifications, documents, and materials, in any form or media, that describe any component, feature, requirement, or other aspect of the system, including any functionality, testing, operation, or use thereof.

Domain: In the CANS assessment tool, a grouping of variables by theme (e.g., life functioning).

Effective Date: The effective date of the SOW and the Contract, which shall be as set forth in the Commonwealth's Standard Contract Form.

EHS Comprehensive Assessment System (e-CAS): The system that will be designed, developed, implemented, and maintained by the Vendor. The system will house and operationalize the UCA, CANS, TTT and other Assessment Tools to assess individuals and MassHealth members who may be in need of EOHHS services or programs. The system will also provide workflows for users to create assessments and/or review assessment information, and a database with multiple interfaces to provide reporting to enable care planning, population health analytics, program and policy development, and program integrity efforts.

EOHHS Assets: All property, equipment and hardware owned by EOHHS, which EOHHS provides to Vendor solely for Vendor’s or its subcontractor’s use in the course of Vendor’s performance of Services under the Contract.

Error Rate: Website performance metric that tracks the number of problem web requests made by users of the website in relation with the total number of requests made by users. For the avoidance of doubt, a web request is a message that is transmitted between the user (web browsers) to the website servers; upon submission of a request, the server then retrieves the content requested by the user that will result in the webpages, images or interactive features displayed.

Executive Office of Elder Affairs (EOEA): The Executive Office of Elder Affairs, established pursuant to M.G.L. c. 19A § 1, is the Massachusetts state agency responsible for helping to support older adults and people with disabilities in the Commonwealth to live independently and with dignity in the settings of their choice.

Executive Office of Health and Human Services or EOHHS: Massachusetts state government secretariat responsible for health and human services. EOHHS is comprised of 12 agencies, in addition to two soldiers’ homes and the MassHealth program, pursuant to M.G.L. c. 6A, § 16, Titles XIX and XXI of the Social Security Act, M.G.L. c. 118E, and other applicable federal and state laws, regulations, waivers and demonstration projects.

Executive Office of Technology Services and Security (EOTSS): The secretariat responsible for instituting information technology (IT) and security policies, standards and strategic vision for Commonwealth agencies, and where the hardware and software for the MMIS are housed.

Force Majeure Event: As defined in Attachment 1, Statement of Work, Section 10.20.

Health Plan: A group of providers, hospitals, and other health care professionals who work together to meet enrollees’ health care needs. For purposes of the Contract, this refers to organizations contracted by MassHealth to provide health care and related services to enrollees, including ACOs, MCOs, the managed behavioral health contractor, SCOs, One Care Plans, and PACE organizations.

Home and Community-Based Services (HCBS) Waiver: A federally approved program operated under § 1915(c) of the Social Security Act that authorizes the U.S. Secretary of Health and Human Services to grant waivers of certain Medicaid statutory requirements so that a state may furnish home- and community-based services to certain Medicaid beneficiaries who need a level of care that is provided in a hospital, nursing facility, or Intermediate Care Facility.

Incident: Variation or deviation in system behavior or material failure to function in accordance with its requirements or an unplanned interruption or degradation in the performance of the Application.

InterRAI: Collaborative international network of researchers and practitioners committed to improving care for persons who are disabled or medically complex by promoting evidence-informed clinical practice and policymaking through the collection and interpretation of high-quality data about persons served across a variety of health and social services settings. Develops and maintains standardized clinical assessment instruments, such as the MDS-HC 2.0 and InterRAI Home Care 9.1.

Key Performance Indicator (KPI): Measurable value that demonstrates how effectively a system is achieving key system objectives. KPIs set minimum and desired service levels for a variety of Application functions and processes/tasks.

Key Personnel: Those individuals on the Vendor’s or a Significant Subcontractor’s staff determined by EOHHS to be critical to the successful performance of the Contract throughout the duration of the Contract, and whose replacements are subject to EOHHS Approval.

Linked Questions: Questions that are related to other questions in an assessment that users can click on to navigate quickly from one assessment section to another.

Long-Term Services and Supports (LTSS): A variety of services and supports delivered in facility-based or community-based settings that help older adults and individuals with disabilities meet their needs for assistance with activities of daily living, including but not limited to skilled nursing, durable medical equipment, home health, therapies, personal care, and support for everyday tasks such as laundry, shopping, and transportation.

Long-Term Services and Supports Management System (LTMS): The system designed and operated by the vendor designated by EOHHS as the MassHealth LTSS Third-Party Administrator (TPA) to support LTSS Providers.

LTSS Provider Service Center: Unit operated by the LTSS Third-party Administrator to provide support to LTSS Providers. The LTSS Provider Service Center will deliver front-line support to e-CAS end users and will escalate issues they are unable to resolve to the e-CAS Vendor.

LTSS Third-Party Administrator (TPA): The vendor designated by EOHHS to manage MassHealth LTSS Provider enrollment and credentialing, the LTSS Provider Service Center, LTSS Provider auditing and program integrity, and LTSS Prior Authorization.

MA-21 System: MassHealth system used to determine eligibility for certain MassHealth programs.

Maintenance and Support Services: Technical support services for the operation and maintenance of the Application as described in Sections 3.3 and 3.4 of the RFR and to be provided by Vendor.

Managed Care Organization (MCO): Any entity contracted with EOHHS as an MCO that provides, or arranges for the provision of, covered services under a capitated payment arrangement.

Massachusetts Medicaid Management Information System (MMIS): The state-operated system of automated and manual processes, certified by CMS, that meets the federal guidelines in Part 11 of the State Medicaid Manual, used to process Medicaid claims from Providers of medical care and services furnished to MassHealth Members, and to retrieve and produce service utilization and management information for program administration and audit purposes.

Massachusetts Rehabilitation Commission (MRC): The Massachusetts Rehabilitation Commission, established pursuant to M.G.L. c. 6 § 74, is the Massachusetts state agency that promotes equality, empowerment and independence of individuals with disabilities. These goals are achieved through enhancing and encouraging personal choice and the right to succeed or fail in the pursuit of independence and employment in the community.

MassHealth (also referred to as Medicaid): The Commonwealth’s Medicaid program and its Children’s Health Insurance Program (together, “MassHealth”) administered by EOHHS in accordance with M.G.L. c. 6A, § 16, Titles XIX and XXI of the Social Security Act, M.G.L. c. 118E, and other applicable federal and state laws, regulations, waivers and demonstration projects.

MassHealth Data Warehouse (DW): The enterprise database maintained by EOHHS that serves as the single repository for centralized agency health and human service information that receives data from key MassHealth and EOHHS systems, such as MMIS and MDM, on a regularly scheduled basis.

MassHealth Fee-for-Service (FFS) Program: Network of providers who contract directly with MassHealth and are paid directly by MassHealth, which may include State Plan LTSS or HCBS Waiver services.

Master Data Management (MDM) System: EOHHS implemented the Master Data Management (MDM) system to effectively manage master data (i.e., critical information that flows through EOHHS’s key business processes, and is located in disparate information silos and systems and may be isolated, incomplete or duplicated). The MDM is a set of processes that establishes and maintains consistency for common data elements, regardless of the source system. MDM uses technology and probabilistic data analytics to match clients of multiple agencies within EOHHS to create what is commonly called a 'single golden view' of EOHHS members. The MDM underpins EOHHS’s efforts to share information effectively between systems to enhance program integrity, assist with eligibility determinations and ultimately help improve services and outcomes, increase efficiency, and reduce duplication of efforts for both clients and the workforce.

MDS-HC2 Application: Virtual Gateway EOHHS application that allows completion of InterRAI Minimum Data Set-Home Care 2.0 (MDS-HC2) assessments on the Provider Online Service Center (POSC), which are saved directly into an EOHHS-owned database. The MDS-HC2 Application then sends information to MMIS to facilitate plan enrollment, capitation payments, and claims payments.

Medically Necessary (or Medical Necessity): The standard set forth in 130 CMR 450.204 or any successor MassHealth regulation.

Member: An individual determined by EOHHS to be eligible for and enrolled in MassHealth pursuant to the requirements set forth in 130 CMR 505.002 or 130 CMR 505.005.

Milestone: An event, Task, or Deliverable(s) described in the Project Plan that must be completed by the corresponding Milestone Date set forth therein.

Milestone Date: The date by which a particular Milestone must be completed as set forth in the Project Plan.

Milestone Payment: A defined payment amount associated with the completion of a particular Milestone.

Minimum Data Set-Home Care 2.0 (MDS-HC2): An InterRAI instrument used by EOHHS that informs and guides comprehensive care and service planning in community-based settings. It focuses on the person’s functioning and quality of life by assessing needs and facilitates referrals when appropriate. It can provide the basis for an outcome-based assessment of the person’s response to care or services and can be used to assess persons with chronic and post-acute care needs.

Minimum Service Level: Minimum level of performance on Key Performance Indicator (KPI) that Vendor must achieve in order to receive payment under the Contract.

Mobile-friendly: Web-based applications that provide information, including text, images, video, and links, that is easily and readily accessible across all different platforms and, most particularly, on the screens of smartphones and tablets.

Module: Within the CANS assessment tool, a series of items on a single topic, triggered to open by a score of a 2 or 3 on a designated variable (e.g., parenting skills).

One Care: An integrated care organization with a comprehensive network of medical, behavioral-health care, and long-term services and supports providers that integrates all components of care, either directly or through subcontracts, and has contracted with EOHHS and CMS to provide the full continuum of Medicare- and MassHealth-covered services to dual-eligible individuals 21 to 64 years of age at the time of enrollment.

Options Counselors: Trained, conflict-free individuals who provide person-centered decision support enabling individuals to make informed choices about services and/or programs for which they are clinically eligible as determined by the Outputs of the assessment.

Output: Score or other outcome calculated by the e-CAS using System Logic. Outputs may include the assessed individual’s level of care, payment level, referral to service, or clinical score (e.g., depression level).

Partner Systems: EOHHS or EOHHS vendor systems with which the e-CAS is required to share data or integrate, as directed by EOHHS, to support its functions, including SIMS or LTMS.

Party or Parties: As applicable, the Vendor and/or EOHHS.

Permitted Use: Use and/or access of the Application and related Documentation by any Authorized User in connection with the e-CAS and related services and support operations.

Primary Care Clinician (PCC) Plan: Managed care option administered by the MassHealth agency through which enrolled Members receive primary care and certain other medical services.

Primary Care Provider (PCP): The individual primary care provider or team of providers selected by the individual, or assigned to the individual, to provide and coordinate all of the individual’s health care needs and to initiate and monitor referrals for specialty services when required. PCPs include nurse practitioners practicing in collaboration with a physician under Massachusetts General Laws Chapter 112, Section 80B and its implementing regulations or physicians who are board certified or eligible for certification in one of the following specialties: Family Practice, Internal Medicine, General Practice, Adolescent and Pediatric Medicine, or Obstetrics/Gynecology (for women only). PCPs for persons with disabilities, including but not limited to, persons with HIV/AIDS, may include practitioners who are board certified or eligible for certification in other relevant specialties.

Primary Care Provider (PCP) Approval: Requirement for certain LTSS that a Member’s PCP must provide an order, referral, prescription, and/or informal approval in order for member to qualify for those LTSS.

Primary Users: User(s) established by Provider organizations to manage system access for Secondary Users within the organization.

Prior Authorization: The process by which a Medical Necessity determination is made, before services are delivered, in accordance with 130 CMR 450.000 including 450.204 and 450.303, and other MassHealth regulations and guidance applicable to a MassHealth FFS Program LTSS service or program.

Program of All-Inclusive Care for the Elderly (PACE): A Program of All-inclusive Care for the Elderly that is operated by an approved PACE organization and that provides comprehensive healthcare services to PACE participants in accordance with an agreement between the PACE organization, CMS and EOHHS.

Project Managers: A person responsible for leading or coordinating a project from its inception to execution, including planning, execution and managing the people, resources and scope of the project. Individuals from EOHHS and the Vendor will be identified and designated as Project Managers and shall perform project management on behalf of EOHHS and Vendor under the Contract.

Project Plan: The schedule setting forth the sequence of events for the performance of Services, including the Milestones and Milestone Dates thereunder, as further defined in the Contract.

Property: As defined in Attachment 1, Statement of Work, Section 10.8.

Protected Information: As defined in Exhibit B to Attachment 1, Statement of Work, Section 10.8.

Provider: An appropriately credentialed and licensed individual or entity that has signed a Provider agreement or other contract to provide services with EOHHS or EOHHS designee such as a Health Plan or Aging Service Access Point (ASAP).

Provider Online Service Center (POSC): MMIS system functionality used by Providers to conduct certain electronic transactions.

Release of Information (ROI): The assessed individual’s or the assessed individual’s legal guardian’s, as applicable, agreement for assessment information to be shared with specified Assessor organizations or Assessment Teams, as applicable, EOHHS state agencies, and/or other parties.

Request for Responses (RFR): Shall refer to the Request for Responses for the EHS Comprehensive Assessment System (e-CAS) Vendor procurement specification and referenced documents.

Requirements: The technical and functional requirements for the e-CAS incorporated into this RFR and Attachments, which may be modified and clarified as EOHHS as permitted under the RFR.

Response or Bid: Any information submitted by the Bidder in response to the Requirements outlined in this RFR, including any clarifying information provided by the Bidder if requested by EOHHS.

Rulebook: All documentation that supports the implementation and maintenance of the Application and database, including definitions, data models, processes, roles, responsibilities, and methodologies.

Secondary Users: Users who are added/deleted by Primary Users and have system access determined by Primary Users.

Selected Bidder, Contractor, or Vendor: Bidder who is selected and executes a contract or agreement for the provision of services described under this RFR.

Senior Care Options (SCO): An organization that participates in MassHealth under a contract with EOHHS to provide a comprehensive network of medical, health-care, and social-service providers that integrates all components of care, either directly or through subcontracts. SCOs are responsible for providing the full continuum of Medicare- and MassHealth-covered services to enrolled Members age 65 and over.

Senior Information Management System (SIMS): The Executive Office of Elder Affairs’ (EOEA) Information Technology and program management system. SIMS houses all information on consumers served by EOEA, including personal information, services received and program enrollment information, CDS-3 assessment data, and ongoing operational information, such as case notes.

Services: The activities engaged in by Vendor for the purpose of fulfilling its obligations under the terms of the Contract, which may or may not result in the creation of a Deliverable.

Skip Logic: A feature that changes what question or page a respondent sees next based on how they answer the current question. Also known as “conditional branching” or “branch logic,” skip logic creates a custom path through the survey that varies based on a respondent's answers.

Significant Subcontractor: Any entity with which the Vendor subcontracts for the provision of all or part of its Application, training, or hosting functions under the Contract.

Solution Architect: Individual from the Bidder that is responsible for the design and development of the Applications or Services.

State Medicaid Plan (or State Plan): An agreement between a state and the Federal government describing how that state administers its Medicaid and Children’s Health Insurance Program (CHIP) programs. It gives an assurance that a state will abide by federal rules and may claim federal matching funds for its program activities. The State Plan sets out groups of individuals to be covered, services to be provided, methodologies for providers to be reimbursed and the administrative activities that are underway in the state.

Statement of Work (SOW): A component of the Contract resulting from this procurement between the Vendor and EOHHS for the design, development, implementation, maintenance and support of the e-CAS, including any attachments or appendices thereto. Referred to as RFR Attachment 1.

System Logic: Software programming run to determine a variety of assessment Outputs, such as MassHealth Members’ health and functional needs, clinical eligibility for LTSS provided by MassHealth, and certain MassHealth Health Plans and programs for which they may also be eligible.

System Usability Scale (SUS): A simple, ten-item attitude Likert scale giving a global view of subjective assessments of website or software usability.

Task: A material activity engaged in by the Bidder for the purpose of fulfilling its obligations to EOHHS under the terms of this RFR, which may or may not result in the creation of a Deliverable.

Term: As defined in Attachment 1, Statement of Work, Section 3.2.

Time to Interact: The time between a user clicking to open the webpage and the moment when a user can interact with the webpage, such as clicking on links, typing in text fields or scrolling the page. Some elements such as scripts and trackers may continue to load during this period.

Time-to-Task (TTT) Tool or Time-for-Task Tool: An assessment tool used in conducting the evaluation for MassHealth Personal Care Attendant (PCA) services and aiding the determination of the scope and type of PCA services to be provided to a Member.

Trading Partner: Entities and systems that exchange data with the e-CAS, including but not limited to Health Plans and Providers. Trading Partners may send or receive data from the e-CAS.

Trigger (Identifier Variable): In the CANS assessment, a variable whose answer of a 2 or 3 opens a Module (e.g., trauma).

Uniform Core Assessment (UCA) Tool: EOHHS-developed comprehensive clinical assessment based on the InterRAI HC 9.1 that will be used for a variety of purposes, including but not limited to, assessing MassHealth Members’ health and functional needs, determining their clinical eligibility for LTSS provided by MassHealth, and identifying MassHealth Health Plans and programs for which they may also be eligible.

Variables: In the CANS assessment, single level data entry points (e.g., depression).

Vendor Property: As defined in Attachment 1, Statement of Work, Section 10.8.

Warranty Period: As defined in Attachment 1, Statement of Work, Section 10.2.

Waterfall: Software development model that follows a sequential process, where progress flows steadily toward the conclusion through the stages of a project (i.e., requirements gathering, design, development, testing).

3. OVERVIEW, EFFECTIVE DATE AND TERM

3.1 Services

EOHHS has engaged Vendor to provide Implementation and Maintenance and Support Services, and to perform any other work as requested by EOHHS for the project as forth in the Contract.

3.1.1 Implementation Services

Vendor shall provide implementation services with the Deliverables and Milestones as set forth in RFR Sections 3.2 and 3.4.

3.1.2 Application License Grant

Vendor shall provide EOHHS the rights to access the Application as follows:

(a) Application Access Rights. Vendor hereby grants to EOHHS a non-exclusive, royalty-free, irrevocable, transferable and sublicensable license for the Term to access and use the Application and related Vendor Documentation for the Permitted Use in accordance with the terms and conditions of the Contract. EOHHS, for itself and its Authorized Users, has the right and license to do each of the following for or in connection with the Permitted Use: (i) install, execute, and run an unlimited number of copies of the Application on a cloud network for use by an unlimited number of Authorized Users; (ii) have an unlimited number of Authorized Users access and use the Application by any means whatsoever, including via the internet or any WAN, LAN, or VPN, from any other device; (iii) generate print, copy, download and store all Commonwealth Data, information, and content, including all audio, visual, or digital and other displays and output, as may result from any execution or other use of the Application; (iv) prepare and use a reasonable number of copies of the Application and related Vendor Documentation as may be necessary or useful for the Permitted Use, including for purposes of: (a) operation with other software or systems; (b) hardware or system maintenance or repair; (c) software, hardware, or system testing; (d) disaster recovery; and (e) backup and archiving; and (f) to perform, and have Authorized Users perform, any other act, including the provision of any service, that is reasonably incidental to the operation of the Application for the Permitted Use.

(b) License and Access Restrictions. Except as the Contract expressly permits, or as reasonably necessary to make any use of the Application permitted by this Section 3.1.2 or elsewhere in the Contract, EOHHS shall not, and shall not permit others to: (1) modify, correct, adapt, translate, enhance, or otherwise prepare derivative works or improvements of the Application except as expressly permitted by the Contract; (2) rent, lease, lend, sell, distribute, publish, or otherwise make the Application available to any third party; or (3) reverse engineer, disassemble, decompile, decode, or adapt the Application, or otherwise attempt to derive or gain access to the source code of the Application, in whole or in part, except as and only to the extent: (a) this restriction is prohibited by applicable law; (b) such action is taken for purposes of ensuring or assessing interoperability or otherwise qualifies as a “fair use” under US Copyright Act or other applicable Law or; (c) with respect to open source components included in the Application, these acts are permitted under the applicable open source license.

(c) Grant of Use and Access for Authorized Users. Use and Access of the Application for Authorized Users will vary depending upon the specific user need and will be determined solely by the EOHHS Project Manager. Authorized Users may include internal EOHHS and EOHHS users (including third party service providers and vendors, as well as other agencies and programs within EOHHS and the Commonwealth), third party provider users and public users. Vendor is responsible for providing Authorized Users with access in accordance with its obligations as set forth in the applicable Project Plan, including credential requirements and response time, based upon the instruction of EOHHS’s Project Manager.

3.1.3 Hosting Services

Vendor shall provide EOHHS with Vendor-hosted services for the Application as further set forth in RFR Sections 3.3 and 3.4. Specific hosting standards shall be set forth as proposed by Vendor in its response to the RFR in accordance with RFR Section 4.3 and as negotiated by Parties prior to execution of this Contract, which shall be incorporated by reference into the Contract.

3.1.4 Maintenance and Support Services

Vendor shall provide EOHHS with Maintenance and Support Services as further set forth in (i) RFR Section 3.3 and 3.4 and (ii) as proposed by Vendor in its response to the RFR in accordance with RFR Section 4.3 and as negotiated by Parties prior execution of this Contract, which shall be incorporated by reference into the Contract. Specific Key Performance Indicators (KPIs) including Minimum Service Levels shall be as set forth in (i) Attachment 5, EOHHS Key Performance Indicators and (ii) as proposed by Vendor in its response to the RFR in accordance with RFR Section 4.3 and as negotiated by Parties prior to execution of this Contract, which shall be incorporated by reference into the Contract.

3.1.5 Services Documentation Obligations

Vendor shall be obligated to provide EOHHS with all Documentation relating to the Services within thirty (30) Business Days of acceptance of the Application or the applicable Deliverable by EOHHS, unless otherwise agreed upon by the Parties in the applicable Project Plan relative to the specific Deliverable. In the event the Documentation is not provided to EOHHS, EOHHS has the right to withhold payment of the applicable costs until receipt of such Documentation. All Documentation shall include all such information as may be reasonably necessary for the effective installation, testing, use, support, and maintenance of the Application, including the effective configuration, integration, and systems administration of the Application and performance of all other functions set forth in the Contract.

3.2 Term

Vendor has held itself out to EOHHS as qualified to provide such services under this Contract. The Contract will have an initial term of five (5) years, and may be extended for an additional five (5) years, in any time increment, at the discretion of EOHHS (collectively, the “Term”).

3.3 Survival

Notwithstanding the foregoing, the provisions of this Contract which by their nature would continue beyond any termination or expiration of this Contract, which shall include SOW Section 5 on System Security, SOW Section 10.2 on Warranty and SOW Section 10.3 on Title and Intellectual Property Rights, shall survive the expiration or any termination of the Contract to the extent necessary to permit their complete fulfillment or discharge.

4. POINTS OF CONTACT

4.1 Single Point of Contact

Vendor and EOHHS will each assign a single point of contact with respect to this Contract. It is anticipated that the contact person will not change during the Term of this Contract. In the event that a change is necessary, as a result of an emergent or unanticipated event, the Party requesting the change will provide prompt written notice to the other in accordance with the terms described in Section 9.1 of this SOW.

Vendor’s contact person is _______________________.

EOHHS’s contact person is _______________________.

5. SYSTEM SECURITY

As part of its work efforts under this Contract, Vendor will be required to use Commonwealth Data and IT resources. For purposes of this work effort, “Commonwealth Data” shall mean all data used or owned by EOHHS or the Commonwealth to which the Vendor gains access through the Contract, which may reside at a Commonwealth or EOHHS or Vendor location or an approved cloud implementation.

5.1 Commonwealth Data

In connection with Commonwealth Data, Vendor will implement commercially reasonable safeguards necessary to:

5.1.1 Prevent unauthorized access to Commonwealth Data from any public or private network;

5.1.2 Prevent unauthorized physical access to any information technology resources involved in the development effort; and

5.1.3 Prevent interception and manipulation of Commonwealth Data during transmission to and from any servers.

5.2 Commonwealth Personal Data

In addition to the above requirements for Commonwealth Data, Vendor may be required to use Commonwealth personal data under MGL Ch. 66A and/or personal information under MGL Ch. 93H, or to work on or with information technology systems that contain such data in order to fulfill part of its specified tasks, and such personal data shall be considered as “Commonwealth Data” as defined herein. For purposes of this work effort, electronic personal data and personal information includes data provided by EOHHS to Vendor which may physically reside at a Commonwealth or EOHHS or Vendor location or an approved cloud implementation. In connection with electronic personal data and personal information, Vendor shall implement the maximum feasible safeguards reasonably needed to:

5.2.1 Ensure the security, confidentiality and integrity of electronic personal data and personal information;

5.2.2 Prevent unauthorized access to electronic personal data or personal information or any other Commonwealth Data from any public or private network; and

5.2.3 Notify EOHHS immediately if any breach of such system or of the security, confidentiality, or integrity of electronic personal data or personal information occurs.

5.3 Software Integrity Controls

Address the following controls if applicable, usually in the case wherein the Vendor will be developing code and migrating that code to a production environment.

Vendor and EOHHS recognize the serious threat of fraud, misuse, and destruction or theft of data or funding. These threats could be introduced when unauthorized or inappropriate modifications are made to a production system. Vendor shall implement the following controls for the purpose of maintaining software integrity and traceability throughout the software creation life cycle, including during development, testing, and production:

5.3.1 Vendor shall configure the RFR required software and systems environments.

5.3.2 Vendor shall implement a change management procedure to ensure that activities in the non-production environments remain separate and distinct from the production environment. In particular, the change management procedure shall incorporate at least the following:

5.3.2.1 Segregates duties between development and testing of software changes and migration of changes to the production environment.

5.3.2.2 Implements security controls to restrict individuals who have development or testing responsibilities from migrating changes to the production environment.

5.3.2.3 Includes a process to log and review all source control activities.

5.3.3 Vendor shall implement a source control tool to ensure that all changes made to the production system are authorized, tested, and approved before migration to the production environment.

5.3.4 Vendor shall not make any development or code changes in a production environment.

5.3.5 Vendor shall implement additional internal controls as specified by EOHHS.

5.3.6 Security Controls Compliance and Audit Tasks

Once every three years, starting on the third year after the Effective Date, and at no additional cost to EOHHS, Vendor shall engage an independent third party auditor to conduct an audit of Vendor’s compliance with the standards defined in Attachment 4, EOHHS TECHNOLOGY OFFICE SECRETARIAT APPLICATION REFERENCE MANUAL. Such audit shall include, but not be limited to, an audit of the Vendor’s facilities where work is performed on behalf of EOHHS and its hosting facilities where Hosted Data resides. At the conclusion of such audit, the Vendor shall provide the EOHHS Project Manager the audit results and findings.

1. At EOHHS’s option and cost, EOHHS may enlist their own independent third-party auditor to conduct such audits. The Vendor must permit auditor access to its facilities and must cooperate with the auditor to ensure successful completion of the audit.

2. In the event the results of the third-party audit demonstrate that Vendor does not fully comply with the Standards or the Hosting Standards, Vendor must provide in writing a plan that includes and addresses such deficiencies. This plan should be included as an addendum to the Solution Operations and Hosting (O&H) Plan as defined in RFR Section 3.4.

3. On at least an annual basis and at no additional cost to EOHHS, the Vendor shall conduct a vulnerability assessment of the Vendor’s computing and hosting environments with respect to the services provided under this Contract. Such vulnerability assessment shall include a penetration test, using industry-standard methodology, of Vendor’s computing environment. The Vendor must provide the EOHHS Project Manager the findings of the vulnerability assessment and penetration test. If the findings demonstrate security vulnerabilities in the Vendor’s computing environment, the Vendor must provide in writing a plan that addresses such deficiencies. This plan should be included as an addendum to the Solution Operations and Hosting (O&H) Plan as defined in RFR Section 3.4.

Notwithstanding the foregoing, nothing contained in this Section 5.3.6 shall abrogate or restrict EOHHS’ ability to audit and inspect the Vendor’s facility, hosting facility or books and records, including but not limited to Vendor’s System Security Risk Management Plan, Data Security Plan, Continuity of Operations and Disaster Recovery Plan, or other documentation required to be maintained pursuant to the Standards and Hosting Standards or otherwise in this Contract. Such audit and/or inspection shall be conducted with reasonable notice and during Business Hours on a Business Day.

In the event EOHHS is assessed any fine, penalty, or monetary damages as a result of a finding or judgment based in whole or in part on the Vendor’s non-compliance with the Standards, inability to meet any part of the Implementation Timeline, inability to abide by the RFR, or any misstatements or omissions in the Vendor’s Response (collectively “Liabilities”), the Vendor will indemnify EOHHS for any such Liabilities and EOHHS will be entitled to reimbursement from the Vendor for any such Liabilities.