ATTACHMENT A - Terms and Conditions - RFP 758 2700000012.pdf

ATTACHMENT A

Commonwealth of Kentucky Request for Proposal (RFP)

For

KY ENTERPRISE HUMAN CAPITAL MANAGEMENT (HCM)

ENTERPRISE RESOURCE PLANNING (ERP)

SYSTEM REPLACEMENT

PHASE I - BENEFITS ADMINISTRATION & BILLING

SOFTWARE SOLUTION AND SERVICES

RFP 758 2700000012

Release Date: July 23, 2026 CLOSING DATE AND TIME August 31, 2026 at 3:30pm ET

Issued by

The Finance and Administration Cabinet

Commonwealth Buyer:

Jenifer Taylor CPPB, KCPM

Assistant Director, IT Division

COMMONWEALTH OF KENTUCKY

FINANCE AND ADMINISTRATION CABINET

Office of Procurement Services 200 Mero Street, 5th Floor

Frankfort, KY 40622

(502) 564-6522

Jenifer.Taylor@ky.gov

TABLE OF CONTENTS

Proposal Submission Checklist Section 1 – Summary Section 2 – Introduction Section 3 – Scope of Work Section 4 – Commonwealth Office of Technology Requirements Section 5 – Procurement Requirements and Instructions Section 6 – Proposal Submission Section 7 – Proposal Evaluation Section 8 – Negotiations Section 9 – Contract Requirements Section 10 – Standard Terms and Conditions Section 11 – Attachments mailto:Jenifer.Taylor@ky.gov

PROPOSAL SUBMISSION CHECKLIST

The vendor MUST include the following with the proposal submission.

If the items highlighted below are not submitted with the proposal submission, the Commonwealth MUST deem the proposal non-responsive and SHALL NOT consider for award.

All other items MUST be submitted prior to award.

*PROPOSED TECHNICAL SOLUTION

*PROPOSED COST SOLUTION

TRANSMITTAL LETTER [see Section 6.7(A)]

MANDATORY REQUIREMENTS CHECKLIST [Attachment E]

REVENUE FORM 10A100 KENTUCKY TAX REGISTRATION APPLICATION

IF APPLICABLE (see Section 6.7 (C)]

CERTIFICATE OF AUTHORITY- REGISTRATION WITH SECRETARY OF STATE BY A FOREIGN

ENTITY IF APPLICABLE [see Section 6.7 (D)]

REQUIRED ANNUAL AFFIDAVIT AND OTHER AFFIDAVIT(S)

https://finance.ky.gov/office-of-the-secretary/FinanceForms/Annual%20Required%20Affidavit%20for%20Bidders%20Offerors%20and% 20Contractors.pdf https://finance.ky.gov/office-of-the-secretary/FinanceForms/Annual%20Required%20Affidavit%20for%20Bidders%20Offerors%20and%20Contractors.pdf https://finance.ky.gov/office-of-the-secretary/FinanceForms/Annual%20Required%20Affidavit%20for%20Bidders%20Offerors%20and%20Contractors.pdf https://finance.ky.gov/office-of-the-secretary/FinanceForms/Annual%20Required%20Affidavit%20for%20Bidders%20Offerors%20and%20Contractors.pdf

SECTION 1 - RFP SUMMARY

1.1 Estimated Schedule of RFP Activities

The following table presents the anticipated schedule for major activities associated with the RFP distribution, proposal submission, proposal evaluation process, and contract award. The Commonwealth reserves the right at its sole discretion to change the Schedule of Activities, including the associated dates and times.

Anticipated Schedule of Activities

Release of RFP

July 23, 2026

Vendors’ Conference will be conducted through video conferencing by the Commonwealth.

Location: Via MS Teams Time: 9:00am – 11:00am ET

Attendance is highly encouraged, as this will be the only opportunity to ask oral questions. The Commonwealth shall not be bound by oral answers to the questions presented at the Vendors’ Conference or oral statements made at any other time by any member of the Commonwealth’s staff.

Salient questions asked at the Vendors’ Conference and the responses will be reduced to writing and issued in an Addendum that shall be posted to the E-Procurement Page.

August 4, 2026

Vendors MUST email Jenifer.Taylor@ky.gov by 8:00am ET with their company name, contact name and email address to confirm attendance for the Vendor Conference in order to receive an email invitation for MS

TEAMS.

August 3, 2026

Vendors’ Written Questions due by 12:00 PM ET

(SUBMIT QUESTIONS ON ATTACHMENT D - VENDORS’ QUESTION

FORM)

August 6, 2026

Commonwealth’s Response to Vendors’ Written Questions

August 17, 2026

Proposals due by 3:30 PM ET

August 31, 2026

The Vendors’ Conference will be held as cited in this RFB. Attendance is highly encouraged as this will be the only opportunity to ask oral questions. The Commonwealth shall not be bound by oral answers to the questions presented at the Conference or oral statements made at any other time by any member of the Commonwealth’s staff. Salient questions asked at the Vendors’ Conference and the responses will be reduced to writing and issued in an Addendum that shall be posted to the E- Procurement Page.

Vendors shall provide the following information via email by 8:00 am ET, August 3, 2026:

Vendor/Company Name Vendor/Company Contact Vendor/Company email address This shall be sent to Jenifer.Taylor@ky.gov. This will confirm attendance for the Vendor Conference in order to receive an email invitation for MS TEAMS.

1.2 Issuing Office

The Commonwealth of Kentucky, Finance and Administration Cabinet, Office of Procurement Services, is issuing this RFP on behalf of the Personnel Cabinet. The Finance and Administration Cabinet is the only office authorized to change, modify, amend, alter, or clarify the specifications, terms and conditions of this RFP.

A contract, based on this RFP, may or may not be awarded. Any contract award from this RFP is invalid until properly approved and executed by the Finance and Administration Cabinet.

1.3 Agencies to Be Served

This contract shall be for use by the Personnel Cabinet. No shipments shall be made except upon receipt by vendor of an official delivery order from the using agency.

SECTION 2 - INTRODUCTION

2.1 Purpose

The purpose of this Request for Proposal (RFP) is to solicit proposals for competitive negotiations pursuant to 200 KAR 5:307.

This Request for Proposal (RFP) is to identify qualified Software Solution Providers (SSPs) that can provide, deliver, implement, and support a modern Benefits Administration and Billing solution for the Commonwealth of Kentucky’s Department of Employee Insurance. The Commonwealth may award multiple contracts.

The solution must manage benefits administration and premium billing, including payment collection, processing, and reconciliation. The Commonwealth is seeking a commercial off-the-shelf (COTS) product that requires minimal customization while meeting the requirements of Phase I of the Kentucky Enterprise Human Capital Management (HCM) Enterprise Resource Planning (ERP) System Replacement Project.

The Commonwealth currently uses SAP for its HCM ERP system. SAP has announced that mainstream support for SAP ECC 6.0 Enhancement Pack (EHP) 6, 7, and 8 will end on December 31, 2027. This impacts several SAP products currently used by the Commonwealth, including:

• SAP Business Suite 7.0

• SAP ECC 6.0 Enhancement Pack 7

• SAP NetWeaver

As a result, the Commonwealth is seeking a replacement solution that provides modern benefits administration and billing capabilities, along with implementation and consulting services to support deployment.

Project Goals

The Commonwealth is looking for a new technology solution that is:

• Simpler and easier to use

• Easier to maintain and support

• Aligned with business requirements

• Less complex and less costly to operate

The desired solution should eliminate unnecessary layers of technology, reduce over-engineering, and simplify system architecture to improve agility and lower the risk of future changes.

The Kentucky Employees' Health Plan (KEHP) currently serves approximately 192,000 members (300,000+ covered lives, including waivers, and 649 billed customers) with employee and employer contributions totaling over $2 billion.

2.2 Background

2.2.1 Project Overview

This project will replace KHRIS (Kentucky Human Resource Information System).

Phase I focuses on replacing the Department of Employee Insurance's current system for:

• Benefits administration

• Premium billing for multi-employer plans

• Reporting

• Financial reconciliation

• Program audits

The goal is to implement a single, modern technology solution that simplifies operations, improves efficiency, and supports the Department's benefits programs, policies, and processes.

2.2.2 Kentucky Employees' Health Plan (KEHP)

The Kentucky Employees' Health Plan (KEHP) is a self-funded health insurance program that serves:

• State employees

• School employees

• Retirees

KEHP provides a wide range of benefits, including:

• Medical coverage

• Prescription drug coverage

• Dental insurance

• Vision insurance

• Life insurance

The Department of Employee Insurance administers KEHP and is responsible for providing affordable, comprehensive health and wellness benefits to Kentucky's public workforce and retirees.

Because KEHP is self-funded, its financial resources come directly from the participating employers and members rather than an outside insurance company.

KEHP covers more than 300,000 members, including:

• State government employees

• Local school district employees

• Employees of certain quasi-governmental organizations

• Retirees from those groups

Benefits Offered Through KEHP Members may elect:

• Medical and prescription coverage

• Dental and vision coverage

• Life insurance

• Flexible Spending Accounts (FSAs)

• Wellness programs, including preventive care, diabetes prevention, and health coaching

Members also have access to tools such as Castlight and SmartShopper, which help them:

• Compare healthcare costs

• Find cost-effective providers

• Earn rewards for choosing lower-cost healthcare options

The Commonwealth is replacing its aging HR and benefits system. The first phase focuses on modernizing how employee benefits are managed, billed, reported on, and audited for the

Commonwealth’s health plan, which serves more than 300,000 employees, retirees, and their families.

Table 1: 2026 KEHP Number of Covered Lives

Type Participant Count

Employee 191,353

Spouses/Child/Other Dependent 121,506

Total 312,859

Table 2: 2026 KEHP - Employee Benefit Program Participation Statistics

Benefit Program Total Number of Participants as of 3/5/26

Program Description Participant Count

Life Insurance - Base 145,310 Life Insurance - Optional Planholder 34,734 Life Insurance - Optional Dependent 19,452 Vision 136,281 Dental 144,894 Health Care Flexible Spending (FSA) 25,738

Dependent Day Care Spending 1,435 Total Participants (not unique as participants may elect multiple benefit options) 507,844

SECTION 3 – SCOPE OF WORK

PROPOSALS THAT DO NOT MEET MANDATORY REQUIREMENTS WILL BE DEEMED NON-

RESPONSIVE AND WILL NOT BE CONSIDERED. REFER TO ATTACHMENT E – MANDATORY

REQUIREMENTS CHECKLIST.

Mandatory Requirement means a condition set out in the specifications or statement of work that must be met without exception.”

3.1 Scope of Work/Technical Requirements

The Commonwealth is seeking proposals that include:

1. Benefits Administration and Billing Software Solution, and

2. The implementation and deployment services required to deploy that solution.

Proposals that offer only software or only services will be considered non-responsive and will not be eligible for contract award.

Proposal Team Structure

Software Solution Providers (SSPs) must choose one of the following approaches:

• Option A: Partner with a single third-party Systems Integrator (SI) to provide implementation services.

• Option B: Provide implementation services directly. In this case, the SSP and SI are the same organization.

Systems Integrator Requirements

• Systems Integrators (SIs) shall not submit proposals independently.

• Each SI must partner with an SSP and submit a joint proposal that is owned by the

SSP.

Partnership Restrictions

• An SSP must partner with only one SI.

• An SI shall partner with only one SSP.

• Each SSP must submit only one proposal.

Proposal Content

Each SSP proposal must include all required components identified in Section 3.0 sub sections 3.1.A.1.1 and 3.1.A.1.2, recognizing that vendors may use different terminology for similar functions. Detailed instructions regarding Proposal Response can be found in Section 6 Proposal Submission.

3.1.A Business and Technical Requirements

3.1.A.1 Major functionality must include:

3.1.A.1.1 Benefits eligibility, open enrollment, mobility, numerous vendor integrations, decision support, benefits navigation, targeted messaging and support for member communications, end-to-end Affordable Care Act (ACA) administration, premium billing and reconciliation, COBRA administration and for the solution, support and services to be provided via the Benefits Administration & Billing Solution.

3.1.A.1.2 In each case, this includes the forms, business processes, workflow, business analytics and reporting, including but not limited to enrollment and participation cost and financials, billing and reconciliation, compliance and regulatory, along with operational and administrative, required to operate and support these components and related functionality. Additionally, custom dashboards and ad-hoc reporting capabilities are highly desired.

3.1.A.2 Each component of the proposed software solution must be fully integrated and must be provided by the same SSP, except that no more than one (1) of the areas of functionality listed in RFP Section 3.0 sub section 3.1.A.1.1 and 3.1.A.1.2 may be met by a third-party solution, tools or service.

3.1.A.3 If any Third-Party solution, tools or service is proposed to meet the Commonwealth’s requirements or substantially conform to specifications, the costs/fees associated with acquiring/licensing the product and the implementation costs associated with the third-party solution, tools or service must be included in the fixed fee bid submitted in the Cost Proposal.

3.1.A.4 The solution may be a cloud-based solution that is fully supported by the fixes/upgrades, hardware refresh cycles, backups, disaster recovery, and comprehensive technical staffing requirements. If so, the SSP must ensure FedRAMP requirements are met and provide associated hosting services for at least five (5) instances for the pre-production and production infrastructure to include sandbox, development (may be considered a second sandbox), preview, production and training.

3.1.A.5 The proposed solution must integrate with the Commonwealth’s existing ERP, KHRIS, and the future HCM ERP to be implemented as Phase II of the KY Enterprise HCM ERP System Replacement, to support HR, payroll, time, absence management and more.

3.1.A.6 The proposed solution must integrate to the Commonwealth's third-party payment engine solution provided via Tyler Technologies "Transaction Payment Engine", (TPE).

TPE supports electronic payments via credit card or ACH Debit and it uses SSL encryption for secure transactions.

3.1.A.7 The proposed solution must include a Benefits Billing Solution that supports non-employee participants of 700+ public sector participating employers (non-state paid) which are billed monthly.

3.1.A.8 The proposed solution will support both pre-tax and post-tax benefit options for Health, Dental, and Vision when planholder elects post-tax deductions.

3.1.A.9 The proposed solution must provide capability in the employee self-service enrollment process to include affidavits such as Tobacco Use, LivingWell Promise (e.g., questionnaire to qualify for premium rate reduction), or Waiver attestation of other health coverage.

3.1.A.10 The SSP’s proposed Benefits Administration & Billing Software Solution must have single sign-on (SSO) functionality and integrate with the Commonwealth’s standard SSO/Identity Access Management (IAM) service. Acceptable SSO industry standard protocols include OAuth 2.0 and OpenID Connect.

3.1.A.11 The SSP’s proposed Benefits Administration & Billing Software Solution must allow for ongoing configuration changes that can be performed by the Commonwealth or Commonwealth-designated resources without incremental cost to the Commonwealth.

3.1.A.12 The SI must agree to 25% overall of the SI’s time delivered on-site, but the

Commonwealth reserves the right to require less on-site time if the Commonwealth determines in its sole discretion that implementation is proceeding well.

3.1.A.13 The SI must agree to deliverable-based payments as stated in this section. The

Commonwealth will not make payments that are purely time-based; payments must be tied to the acceptance by the Commonwealth of agreed project Deliverables. The SI shall include in Attachment B, Cost Proposal, Schedule 6, Deliverable Payments, a list of the proposed Deliverables and (unless the Vendor would propose no payment would be associated with the Deliverable) the associated gross payment amount for that deliverable. Not every Deliverable must have payment associated. As a performance incentive, the Commonwealth will retain 15% of each deliverable payment and will pay the retainage to the SI upon final System Acceptance. SI shall ensure that the proposed cumulative gross payments for each month do not exceed the cumulative value of the service hours proposed for the corresponding month. The grand total of deliverable-based payments, including retainage, should equal the total services cost shown on Attachment B, Cost Proposal, Schedule 3, Implementation Services Costs.

3.2 Business and Technical Specifications

3.2.1 The Commonwealth has developed, Attachment F, Business & Technical

Questionnaire, which consists of questions regarding Benefits Administration, Benefits Accounting, General/Technical, Artificial Intelligence (AI) and Implementation Services. Additionally, high-level business and technical questions have been provided on the last four tabs of Attachment F, Business & Technical Questionnaire for the optional Value-Added Services (not scored) as referenced in Section 3.4.

3.2.2 The introductory text of Attachment F, Business & Technical Questionnaire is incorporated by reference into this Section of this RFP.

3.2.3 To ensure that potential Vendor(s) properly respond to these questions, the Commonwealth highlights the following requirement, which is also stated above in this RFP. The SSP shall respond to Attachment F, Business & Technical Questionnaire in one combined Excel workbook, using the Excel workbook supplied as Attachment F, Business & Technical Questionnaire. The SSP may include assistance from the SI in response to the Technical Questionnaire. The SI is solely responsible for completion of the response to the questions on the workbook tab Implementation Services.

3.3 Implementation Services

3.3.1 Comprehensive Implementation Services

3.3.1.1 The Commonwealth is seeking implementation consulting services from an SI who has experience implementing and deploying the proposed Benefits

Administration & Billing Software Solution in a public sector organization. Based on the scoping information provided in this RFP and its attachments, SIs will quote a fixed fee price for implementation and deployment services.

3.3.1.2 For SIs’ reference in preparing their response, the Commonwealth has included a model Statement of Work, as a sample only, as RFP, Attachment G, Model Statement of Work. The Statement of Work between the SI and the Commonwealth will be revised and finalized as part of the final Agreement between the Commonwealth and the SI.

3.3.1.3 The SI should propose all services necessary to deploy the scope proposed in the RFP whereby the Commonwealth desires to implement all functionality in Section 2.2.4. The SI must include all relevant Business Analytics & Reporting and Mobility, while ensuring security, compliance, and integration to the Commonwealth’s other enterprise systems as designated.

3.3.1.4 Data Conversion, Migration and Validation

3.3.1.4.1 Overview

The Commonwealth requires the Vendor to provide comprehensive data conversion and migration services to transition data from the Commonwealth’s existing systems, including but not limited to KHRIS (SAP HCM) and associated benefits administration and premium billing components, into the proposed solution per the scope as noted in Section 3.0 sub sections 3.1.A.1.1 and 3.1.A.1.2, along with the optional Value Add Services noted in sub section 3.1.A.2.

The Vendor shall be responsible for all activities necessary to successfully convert, validate, and load data required to support system implementation and ongoing operations.

3.3.1.4.2 Minimum Required Data Scope

At a minimum, the Vendor shall convert and validate the following data:

• All active Kentucky Employees’ Health Plan (KEHP) member demographic data, including employees, retirees, dependents, and beneficiaries

• All active benefit elections and plan enrollment data

• Associated eligibility data and coverage effective dates

• Current employer group and billing entity data

• Required identifiers necessary to maintain continuity across systems

The Commonwealth reserves the right to include additional data elements as part of final contract negotiations or project scoping.

3.3.1.4.3 Optional /Additional Data Conversion

The Vendor shall propose an approach and associated costs (if any) for conversion of additional historical data, such as examples below:

• Historical enrollment and coverage data

• Billing, payment, and reconciliation history

• Archived or legacy reporting datasets

3.3.1.4.4 Data Conversion Approach

The Vendor shall provide a detailed Data Conversion Plan that includes, at a minimum:

• Data discovery and assessment activities

• Data mapping from source to target systems

• Data cleansing and normalization approach

• Data transformation rules and logic

• Data validation and reconciliation processes

• Data migration tools and methodologies

• Roles and responsibilities (Vendor and Commonwealth)

3.3.1.4.5 Data Validation and Reconciliation

The Vendor shall perform and document data validation and reconciliation to ensure accuracy, completeness, and integrity of converted data.

At a minimum, the Vendor shall:

• Reconcile record counts between source and target systems

• Validate key data elements (e.g., member demographics, plan elections, coverage tiers)

• Support user acceptance testing (UAT) of converted data

• Provide reports documenting conversion results and discrepancies

The Commonwealth must approve all validation results prior to final data load and production go-live.

3.3.1.4.6 Data Conversion Cycles

The Vendor shall support multiple data conversion cycles, including:

• Initial test conversion

• At least 2-3 additional conversions must occur in non-production

• Final production conversion

The Vendor shall define the number, timing, and objectives of each cycle in the implementation plan.

3.3.1.4.7 Data Security and Confidentiality

All data conversion activities shall comply with Commonwealth security requirements, including handling of sensitive and highly restricted data. Vendor shall ensure that all data is securely transferred, stored, and processed in accordance with applicable policies and contractual requirements.

3.3.1.4.8 Data Retention and Legacy Strategy

The Vendor shall describe its recommended approach for:

• Retention of legacy data not converted into the new system

• Access to historical data for audit, reporting, and compliance purposes

• Support for data extraction and archival strategies

3.3.1.4.9 Responsibilities

The Vendor shall be responsible for the execution of all data conversion activities.

The Commonwealth will provide access to source systems, data extracts, and subject matter expertise as needed.

3.3.1.4.10 Acceptance Criteria

Data conversion shall be considered complete upon:

• Successful validation and reconciliation of required data

• Commonwealth approval of conversion results

• Successful use of converted data in system testing and operational readiness activities

3.3.1.5 Use of Artificial Intelligence (AI) in Delivery of Service The Vendor and its subcontractors may utilize Artificial Intelligence (AI), in the performance related to implementation of the software solution and the implementation services under this Contract, subject to the requirements below.

Also, the vendor and its subcontractors shall comply with the Commonwealth Office of Technology’s AI Policy - CIO-126, Artificial Intelligence Policy and usage must be approved by COT and the AI committee. (see Section 4.1 and 10.31 of this RFP)

3.3.1.5.1 Transparency and Disclosure

Vendor(s) shall disclose, upon request and at a minimum prior to implementation activities, any material use of AI in the delivery of services, including use in system configuration, development, implementation, testing, data analysis, or training material generation, or deployment. Disclosure shall include the general purpose of the AI use and whether third-party AI tools are utilized.

3.3.1.5.2 Data Protection and Confidentiality

Vendor(s) shall not input, transmit, or otherwise expose Commonwealth confidential, restricted, or sensitive data to any AI system that uses such data for training, model improvement, or retention outside the control of the Commonwealth, unless expressly authorized in writing. Vendor(s) shall ensure that any AI tools used comply with applicable data protection requirements and contractual confidentiality obligations.

3.3.1.5.3 Human Oversight and Accountability

All AI-assisted outputs (including configurations, code, test scripts/user scenarios, documentation, and training materials) shall be subject to appropriate human review and validation prior to use in production or delivery to the Commonwealth. Vendor(s) remain fully responsible for the accuracy, quality, and compliance of all deliverables.

3.3.1.5.4 Acceptable Use in Implementation and Testing

AI may be used to support activities such as code development, test automation, defect identification, and documentation generation, provided such use does not compromise system integrity, security, accessibility, or compliance requirements defined in this RFP.

3.4.1.5.5 Training and Knowledge Materials

Where AI is used to generate or assist in training materials, user guidance, or knowledge content, Vendor(s) shall ensure that materials are accurate, accessible, and aligned with Commonwealth policies and business processes.

3.4.1.5.6 Compliance with Commonwealth Policies

Vendor(s) shall comply with all applicable Commonwealth policies related to AI, data security, and information technology, including but not limited to enterprise security standards and acceptable use policies.

3.4.1.5.7 Issue Notification

Vendor(s) shall promptly notify the Commonwealth of any known issues, risks, or incidents arising from the use of AI that may impact data security, system performance, or service delivery.

Use of AI under this Contract shall not relieve the Vendor(s) of any obligations related to security, confidentiality, accuracy, or performance of services.

3.3.1.6 Meetings

The Vendor(s) shall meet with Cabinet personnel, or designated representatives, to resolve technical or contractual problems that may occur during the term of the Agreement. Project Governance Meetings will occur at least monthly (or as designated) or as problems arise and will be coordinated by the Commonwealth. SSP and SI will be given reasonable and sufficient notice of meeting dates, times, and locations. Weekly Project Status Meetings will also be planned to include Project Team members and key stakeholders.

Vendor also agrees to participate in meetings as requested by the Commonwealth/DEI to review system performance, change requests, or other relevant items (i.e., quarterly meetings, semi-annual performance review meetings and annual plan performance review meetings).

3.3.1.7 Vendor Staffing

All proposed Vendor staffing for Key Roles is subject to approval by Personnel.

Personnel reserves the right to reject the Vendor’s proposed individuals for Key Roles.

In such a case, the Vendor is required to provide an alternative staffing proposal for that Key Role. Personnel reserves the right to interview individuals proposed to Key Roles prior to approval of any staffing.

Personnel recognizes that changes in the Vendor’s level of staffing may happen due to a variety of unforeseen factors. The Vendor should maintain the appropriate staff experience levels throughout the project to ensure objectives of this project are met on time. Key or Lead personnel commitments contained in the Staffing Plan for all phases of the contract should not be changed without thirty (30)-calendar day advance notice and prior written approval of the Personnel contract administrator.

Changes due to the death, disability, medical leave, resignation, termination, or military recall of any key individual are exceptions. If an individual listed in the Vendor’s proposal becomes unavailable prior to award, the Vendor should immediately notify Personnel and a replacement of equal or greater qualifications should be in place within thirty (30) calendar days. The replacement individual should be approved by the agency designee, prior to placement on the project.

During the course of the awarded contract, Personnel reserves the right to require replacement of key or Lead personnel, or any Vendor employee or subcontractor employee found unacceptable to Personnel. The Vendor should remove the individual within two (2) calendar weeks of the request for removal and replace within thirty (30) calendar days after the position is vacated. If key or Lead personnel leave for any reason, the position should be filled within thirty (30) calendar days upon approval of Personnel.

3.4 Independent Verification and Validation (IV&V)

The Commonwealth intends to engage an independent Verification and Validation (IV&V) vendor to provide objective oversight of the implementation project. The IV&V vendor will operate independently of the awarded vendor(s) and subcontractors.

The IV&V vendor will be responsible for assessing project performance, including but not limited to:

• Project governance and management practices

• Schedule, scope, cost, and risk management

• System implementation and integration activities

• Testing strategy, execution, and defect management

• Data conversion and migration readiness

• Organizational change management and training readiness

• Compliance with Commonwealth policies, standards, and contractual requirements

The awarded vendor(s) shall:

• Cooperate fully with the IV&V vendor and provide timely access to project artifacts, environments, documentation, and personnel as reasonably requested

• Participate in IV&V led meetings, review and checkpoints

• Respond to IV&V findings, recommendations, and risk assessments within mutually agreed timeframes

• Support transparency in project status, risks, and issues.

The IV&V vendor will report independently to the Commonwealth. IV&V activities are intended to support project success through early identification of risks and continuous improvement and do not relieve the Vendor of any contractual responsibilities.

3.5 Value Added Services

Value-added services may be added to the contract with the prior approval by the Commonwealth Office of Technology and the Office of Procurement Services Buyer of Record. Upon approval, a formal modification will be made to add the service(s). No work shall begin until a contract modification is completed and notice provided by the OPS Buyer that work may begin.

3.5.1 Value Added Services may include, but not limited to:

3.5.1.1 Spending Account Administration (capacity for Flexible Spending Accounts (FSA), Dependent Care Flexible Spending Accounts (DCFSA) Health Reimbursement Accounts (HRA), and Health Savings Accounts (HSA) tracking and administration).

3.5.1.2 Dependent Eligibility Verification

The Commonwealth may be interested in optional dependent eligibility verification, including but not limited to, verification of spouses and newly added dependent children, as well as periodic reverification of spouses and stepchildren.

3.5.1.3 Call Center Support

The Commonwealth may be interested in optional call center and customer support services to assist with benefits administration and premium billing operations, particularly during high-volume periods such as open enrollment.

Vendors may propose call center services as an optional component of their solution.

3.5.1.4 Procurement options available with the proposed solution to provide for Low

Code/No Code capabilities.

Specific information regarding the Commonwealth’s specifications associated to the Value-Added Services are also noted in Attachment F, Business & Technical Questionnaire on the last 4 tabs. Response to Value-Added Services is optional and not scored.

SECTION 4 – COMMONWEALTH OFFICE OF TECHNOLOGY (COT)

REQUIREMENTS

4.1 Hosting

The Commonwealth is seeking a vendor who can provide a solution per the RFP requirements. The Vendor can use servers stood up by COT to house the solution or the vendor may propose a cloud-hosted solution. If the vendor is proposing a cloud solution, the Commonwealth prefers the proposed cloud solution to be hosted on an established Commonwealth Office of Technology (COT) managed cloud tenant. If a COT managed cloud tenant is not proposed, the vendor shall propose a commercial Federal Risk and Authorization Management Program (FedRAMP) - certified or HITRUST Cloud platforms. The proposed solution must accommodate COT oversight that includes an isolated tenant, cloud network access (peering connection) and monitoring solutions.

The Commonwealth reserves the right to host any proposed solution, at any time, if deemed in the best interest of the Commonwealth.

If vendor is using any type of Artificial Intelligence (AI) please indicate this in the RFP response.

Vendor shall comply with Section 10.31 regarding Artificial Intelligence

4.2 Commonwealth Information Technology Policies and Standards A. The vendor and any subcontractors shall be required to adhere to applicable Commonwealth policies and standards.

B. The Commonwealth posts changes to COT Standards and Policies on its Commonwealth Office of Technology - Home - Commonwealth Office of Technology (Kentucky) website.

Vendors and subcontractors shall ensure their solution(s) shall work in concert with all posted changes. Vendors or subcontractors that cannot comply with changes must, within thirty (30) days of the posted change, request written relief with the justification for such relief. The Commonwealth may: 1) deny the request, 2) approve an exception to the policy/standard, or

3) consider scope changes to the contract to accommodate required changes. Vendors or subcontractors that do not provide the response within the thirty (30) day period shall be required to comply within ninety (90) days of the change.

4.3 Compliance with Kentucky Information Technology Standards (KITS)

A. The Kentucky Information Technology Standards (KITS) reflect a set of principles for information, technology, applications, and organization. These standards provide guidelines, policies, directional statements and sets of standards for information technology. It defines, for the Commonwealth, functional and information needs so that technology choices can be made based on business objectives and service delivery. The vendor shall stay knowledgeable and shall provide a solution that works in concert with these standards for all related work resulting from this RFP.

https://technology.ky.gov/about-the-agency/Pages/kits.aspx

B. The vendor and any subcontractors may be required to submit a technology roadmap for any offered solution. Additional roadmaps will be submitted upon request of the Commonwealth.

If required, the roadmap shall include, but is not limited to, planned, scheduled and projected product lifecycle dates and historical release/patch or maintenance dates for the technology.

In addition, any guidance on projected release/revision/patch/maintenance schedules would be preferred.

4.4 Compliance with Industry Accepted Reporting Standards Based on Trust Service Principles and Criteria The vendor must employ comprehensive risk and threat management controls based on defined industry standards for service organizations such as ISO AICPA TSP section 100, Trust Services Principles and Criteria. The vendor must annually assert compliance and engage a third-party certification registrar to examine such assertions and controls to provide a Report, such as ISO 9000, ISO 14001, AT101 SOC 2 type 2, on Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, and Privacy, which contains an https://technology.ky.gov/Pages/index.aspx https://technology.ky.gov/Pages/index.aspx https://technology.ky.gov/about-the-agency/Pages/kits.aspx opinion on whether the operating controls effectively support the assertions. All such reports, including publicly available reports (i.e. AT 101 SOC 3) shall be made available to the Commonwealth for review.

4.5 System Vulnerability and Security Assessments

The Commonwealth reserves the right to conduct, in collaboration with the vendor, non-invasive vulnerability and security assessments of the software and infrastructure used to provide services prior to implementation and periodically thereafter. Upon completion of these assessments, the Commonwealth will communicate any findings to the vendor for action. Any cost relating to the alleviation of the findings will be the responsibility of the vendor. Mitigations will be subject to re-evaluation after completion. In cases where direct mitigation cannot be achieved, the vendor shall communicate this and work closely with the Commonwealth to identify acceptable compensating controls that will reduce risk to an acceptable and agreed upon level.

An accredited third-party source may be selected by the vendor to address findings, provided they will acknowledge all cost and provide valid documentation of mitigation strategies in an agreed upon timeframe.

4.6 Privacy Assessments

The Commonwealth reserves the right to conduct privacy assessments of the collection, use, maintenance and sharing of Commonwealth data by any vendor services, software, and infrastructure used to provide services prior to implementation and periodically thereafter. Upon completion of this assessment, the Commonwealth will communicate any findings to the vendor for action. Any cost relating to the alleviation of the findings will be the responsibility of the vendor. Mitigations will be subject to re-evaluation after completion. In cases where direct mitigation cannot be achieved, the vendor shall communicate this and work closely with the Commonwealth to identify acceptable compensating controls or privacy practices that will reduce risk to an acceptable and agreed upon level. An accredited third-party source may be selected by the vendor to address findings, provided they will acknowledge all cost and provide valid documentation of mitigation strategies in an agreed upon timeframe.

4.7 Privacy, Confidentiality and Ownership of Information

The Commonwealth is the designated owner of all Commonwealth data and shall approve all access to that data. The vendor shall not have ownership of Commonwealth data at any time.

The vendor shall not profit from or share Commonwealth data. The vendor shall be in compliance with privacy policies established by governmental agencies or by state or federal law. Privacy notice statements may be developed and amended from time to time by the Commonwealth and will be appropriately displayed on the Commonwealth portal (Ky.gov). The vendor should provide sufficient security to protect the Commonwealth and COT data in network transit, storage, and cache. All Commonwealth data, including backups and archives, must be maintained at all times within the contiguous United States. All Commonwealth data, classified as sensitive or higher, as defined in Enterprise Standards, must be encrypted in-transit from vendor’s network and at rest while stored on vendor’s laptops or other portable media devices.

4.8 EU GDPR Compliance

The Commonwealth of Kentucky requires all vendor contracts to comply to the extent applicable with the European Union’s General Data Privacy Regulation [Regulation (EU) 2016/679] (the “GDPR”) when the Commonwealth is a “controller” or “processor” of “personal data” from an individual “data subject” located in the European Union, as those terms are defined in the GDPR.

The vendor acknowledges and agrees that it is acting as a “processor” of “personal data” for the

Commonwealth under this Agreement and that all applicable requirements of the GDPR are incorporated by reference as material terms of this Agreement. The vendor represents and warrants that (1) it is aware of and understands its compliance obligations as a “processor” under GDPR; (2) it has adopted a GDPR compliant data privacy compliance policy/program, a summary of which has been provided to the Commonwealth; (3) it will process “personal data” only in accordance with the Commonwealth’s instructions; and (4) with regard to its obligations under this Agreement, it shall comply with all applicable requirements of the GDPR. Additionally, the vendor may be found liable to the Commonwealth for damages arising from any violation of applicable requirements of GDPR by the vendor in its performance of the services hereunder.

4.9 Data Quality

The vendor shall provide proposed levels of data quality per the following dimensions.

Data Quality is the degree to which data is valid, accurate, complete, unique, timely, consistent with all requirements and business rules, and relevant for a given use. The vendor shall provide data quality definitions and metrics for any data elements. Data has to be of the appropriate quality to address the needs of the Commonwealth of Kentucky. The following dimensions can be used to assess data quality:

• Validity – The data values are in an acceptable format.

• Accuracy – The data attribute is accurate.

• Completeness – There are no null values in a data field.

• Uniqueness – There are no duplicate values in a data field.

• Timeliness – The data attribute represents information that is not out-of-date.

• Consistency – The data attribute is consistent with a business rule that may be based on that attribute itself, or on multiple attributes.

• Adherence to business rules – The data attribute or a combination of data attributes adheres to specified business rules.

4.10 License Agreements

Any proposed software agreements, i.e. license agreement, subscription agreement, end-user license agreement, etc. shall include the following language, or similar, and must be submitted to the Commonwealth Office of Technology (COT) for review and approval prior to the award of the contract:

“Governing Law shall be the Commonwealth of Kentucky, Franklin County. All terms of the vendor/subvendor agreement/EULA shall be read as applicable only to the extent permitted by Kentucky law and no term in violation of the Kentucky law, inclusive of Kentucky Procurement Law, shall be given effect.”

Any third-party software licenses and cloud resources necessary for the proposed solution may be procured via the Commonwealth’s existing contracts.

4.11 Software Version Requirements

All commercially supported and Commonwealth approved software components such as Operating system (OS), Database software, Application software, Web Server software, Middle Tier software, and other ancillary software must be kept current. In the event that a patch interferes with the solution, the vendor must present a plan for compliance to the Commonwealth outlining the constraints and an appropriate plan of action to bring the solution into compliance to allow this patch to be applied in the shortest timeframe possible, not to exceed three (3) months, unless otherwise negotiated with the Commonwealth.

4.12 No Surreptitious Code Warranty

The vendor represents and warrants that no copy of licensed software provided to the Commonwealth contains or will contain any Self-Help Code or any Unauthorized Code as defined below. This warranty is referred to in this contract as the "No Surreptitious Code Warranty”.

As used in this contract, "Self-Help Code" means any back door, time bomb, drop-dead device, or other software routine designed to disable a computer program automatically with the passage of time or under the positive control of a person other than the licensee of the software.

Self-Help Code does not include Software routines in a computer program, if any, designed to permit an owner of the computer program (or other person acting by authority of the owner) to obtain access to a licensee's computer system(s) (e.g. remote access) for purposes of maintenance or technical support.

As used in this contract, "Unauthorized Code" means any malware designed to permit unauthorized access to disable, erase, or otherwise harm software, equipment, or data; or to perform any other such actions. The term Unauthorized Code does not include Self-Help Code.

In addition, vendor will use up-to-date commercial virus detection software to detect and remove any viruses from any software prior to delivering it to the Commonwealth.

The vendor shall defend the Commonwealth against any claim and indemnify the Commonwealth against any loss or expense arising out of any breach of the No Surreptitious Code Warranty.

4.13 Network Connection Requirements

A. Vendor shall work with COT to establish any network connections. If a secure site-to-site connection is required, the vendor shall employ a secure site-to-site connection procured by the Agency from COT.

B. Vendor shall, at COT’s discretion, provide appropriate access to enable the Commonwealth to perform additional security measures, such as decryption of the network traffic if required for inspection. If the proposed solution does not have the ability to meet this requirement, the vendor must provide an alternative such as audit reporting of this function.

C. Vendor should provide notifications to the Commonwealth Service Desk for unplanned outages within fifteen (15) minutes.

D. Vendor shall notify COT Change Management, through the Commonwealth Services Desk, a minimum of two (2) business days prior to any planned outage.

E. Vendor, in conjunction with the agency, shall provide a Business Impact Assessment (BIA) to appropriately classify all data before production/go-live.

F. Vendor shall include a Web Application Firewall when application houses any data classified as sensitive or higher as defined in KITS standards.

G. Vendor shall provide Recovery Time Objective (RTO) and Recovery Point Objective (RPO) services. Vendor shall provide those services to achieve those SLAs.

4.14 OS Requirements

A. Non-On Prem Solutions

1. No Commonwealth data shall be co-mingled with another entity, without the prior approval of the Commonwealth.

2. Vendor shall provide a solution to move data to the Commonwealth, if required by the Commonwealth.

a. At the end of the contract, the vendor shall provide all agency data in a useable standard data format (such as asci, csv, etc.) that can be converted to a subsequent system. The vendor shall cooperate to this end with the agency and/or a vendor of the agency’s choice, in a timely and efficient manner.

b. Vendor shall address the destruction of Commonwealth data as defined in CIO-092 and provide a certification of the complete and permanent deletion the Commonwealth data.

B. Infrastructure as a Service

1. Vendor shall work with the agency and COT to establish all administrative personnel engagements.

2. Vendor shall meet certification requirements for classification of data being stored.

3. Vendor shall, at COT’s request, provide appropriate access to enable the Commonwealth to perform additional security measures in compliance with Commonwealth Enterprise Policies, Standards, and/or any Federal or State requirements.

4. Vendor shall provide an Exit Strategy, to move all data to the Commonwealth Data Center, if required by the Commonwealth.

At the end of the contract, the vendor shall provide all agency data in a form that can be converted to any subsequent system of the agency’s choice. The vendor shall cooperate to this end with the vendor of the agency’s choice, in a timely and efficient manner.

4.15 Project Governance

Vendor shall work with the agency and appropriate COT offices, when needed, in the cases of data governance, security aspects, hosting, integration, etc., provided that such work does not expand the scope of the services as described in this RFP absent a corresponding change order agreed to by the parties reflecting such expansion.

4.16 Monitoring Requirements for On Premise and Cloud (SaaS)

Vendor shall work with the agency and COT to establish a monitoring solution. Vendors shall provide a view into their environment either by providing a COT and agency approved comprehensive dashboard or allow COT to install their KITS compliant infrastructure and application monitoring solution; to include but not limited to performance and availability. For a Cloud solution, Vendor is expected to provide a monitoring solution.

4.17 Application and Service Requirements

Current Enterprise Applications and Services

1. COT provides a number of Enterprise Shared Services to State agencies. Vendor shall use published IT Applications and Services provided on KITS for: Enterprise Service Bus, Enterprise Content Management, Data Warehousing, Data Analytics and Reporting, Business Intelligence, Web Services, GIS, unless explicitly approved by COT.

2. Vendor provided dedicated application components (i.e., Application Servers, Databases, etc.) shall comply with KITS or if the technology is not included in KITS, the technology must be accepted by the Commonwealth for inclusion in KITS or granted a written exception to KITS according to COT Information Technology Standards Policy currently

CIO-051.

3. Vendor applications must describe in detail all available features and functionality accessible via APIs.

4. All business applications must support the ability to use modern authentication for authentication and authorization. Modern authentication technologies would include SAML 2.0, WSFED, OAuth, or OpenID Connect.

4.18 Project Management Requirements

The COT Division of Governance and Strategy (COT-DGS) is responsible for overseeing large and complex technology projects throughout the Commonwealth. The vendor shall adhere to Project Management standards and reporting requirements established by COT-DGS, which are posted at https://technology.ky.gov/services-and-support/Pages/About-the-Project- Management-Branch.aspx.