Attachment C - Service Level Agreement.docx

Attachment C: Service Level Agreements (SLAs) The Agency will monitor the Vendor’s performance throughout the contract period. Each SLA defines the minimum acceptable performance level in a specific area. The Vendor shall measure and report on each SLA monthly. Failure to meet any SLA may result in financial retainage as outlined below.

Right to Retainage The Agency and the Vendor agree that failure to meet SLA performance standards results in a measurable loss to the Agency. The Agency may retain a percentage of the monthly subscription invoice, as specified in each SLA, and deduct that amount from payments due to the Vendor.

I. SLA – System Availability and Downtime

a. Definition: The IIS must be available 24/7/365. Downtime is defined as any period during which the system or any of its components is not accessible or functional for its intended use.

· Scheduled Downtime: Must be pre-approved by the Agency and occur outside of standard business hours (Monday – Friday 8:00-17:00 Eastern).

· Unscheduled Downtime: Any unapproved interruption in service.

b. Performance Standard:

· Monthly uptime must be ≥ 99.9% (Down less than 43 minutes and 50 seconds per month).

c. Retainage:

· 99.0%–99.89% uptime: 5% of monthly invoice

· 95.0%–98.99% uptime: 25% of monthly invoice

· < 95.0% uptime: 100% of monthly invoice

II. SLA – Issue Tracking and Defect Management

a. Definition: The Vendor must provide tools to track defects from identification through resolution, including testing and verification. All issues must be documented in a Corrective Action Plan (CAP) and shared with the Agency.

b. Performance Standard:

· All defects (Agency-identified, Vendor-identified, or user-reported) must be logged and included in a CAP submitted weekly or more frequently upon request.

c. Retainage:

· 2% of the monthly invoice if the standard is not met.

III. SLA – Issue Response and Resolution

a. Definition: Issues must be categorized by severity and addressed within defined timeframes:

· Critical Severity

· Definition: An issue that causes a complete system outage or renders the IIS unavailable for all users. Includes failures that prevent immunization data exchange with CDC IZ Gateway or other critical interfaces, or any security incident that compromises data integrity or confidentiality.

· Impact: Immediate and widespread disruption to Agency operations, public health reporting, or compliance.

· High Severity

· Definition: An issue that significantly impairs system functionality for a large group of users or a major module but does not cause a full system outage. Examples include failure of data migration processes, inability to generate required reports, or degraded performance that prevents timely immunization record access.

· Impact: Major disruption to Agency operations or compliance obligations, but partial functionality remains available.

· Medium Severity

· Definition: An issue that affects specific features, workflows, or a subset of users, but has a viable workaround. Examples include errors in non‑critical modules, minor interface malfunctions, or delays in non‑urgent data processing.

· Impact: Moderate disruption to operations; Agency can continue core functions with workarounds until resolution.

· Low Severity

· Definition: An issue that has minimal impact on system functionality or user experience. Examples include cosmetic defects, minor documentation errors, or isolated user account issues.

· Impact: Limited or no disruption to Agency operations; resolution can be scheduled without urgency.

b. Retainage:

· 5% of the monthly invoice if any response or resolution timeframes are not met.

IV. SLA – System Compatibility and Accessibility

a. Definition: The IIS must meet the following compatibility and accessibility standards:

· Be fully cloud-hosted by the Vendor.

· Support major, up-to-date browsers (Chrome, Firefox, Edge, Safari).

· Operate efficiently on standard desktop/laptop hardware without requiring specialized software.

· Be accessible without elevated user permissions or local installations.

b. Performance Standard:

· 100% compliance with all compatibility and accessibility requirements as defined in Section 4.2.3.2 of the RFP.

c. Retainage:

· 5% of the monthly invoice for each month in which any compatibility or accessibility requirement is not met.

V. SLA – Technical Support and Hours of Operation

a. Performance Standard:

· Support must be available daily from 8:00 AM to 17:00 PM Eastern.

· After-hours and holiday on-call support must be available for critical issues.

· 95% of support requests must receive a response within 15 minutes.

· Support must be available in the caller’s preferred language or with interpretation services.

b. Retainage:

· 5% of the monthly invoice if the standard is not met.

VI. SLA – Monthly Reporting

a. Performance Standard:

· Reports due by the 15th of each month must include:

· System uptime metrics

· CAP with new and outstanding issues

· Issue response/resolution metrics

· Support response metrics

b. Retainage:

· 2% of the monthly invoice if the report is incomplete or late.

VII. Corrective Action Plan (CAP) For any missed SLA, the Vendor must submit a CAP with the monthly report that includes:

· The missed SLA and issue description

· Root cause analysis

· Risks and impacts

· Resolution steps and any failed attempts

· Proposed preventive actions (subject to Agency approval) The Agency reserves the right to request a meeting to review the CAP and may require revisions before implementation.

VII. SLA – CDC Compliance and Interoperability

a. Definition: The IIS must maintain full compliance with CDC IZ Gateway specifications, including HL7 messaging standards, transport protocols, and required data elements. The system must support bidirectional exchange with CDC and other authorized entities.

b. Performance Standard:

· 100% of required CDC data exchanges must be successfully transmitted and acknowledged within the CDC-defined reporting intervals.

· Any CDC specification updates must be implemented within 90 calendar days of formal notification.

c. Retainage:

· 5% of the monthly invoice for each month in which compliance or exchange timeliness is not met.

VIII. SLA – Data Exchange Timeliness

a. Definition: The IIS must support timely data exchange with external systems including EHRs, HIEs, school systems, and other state-authorized partners. This includes both inbound and outbound HL7 messages and batch file transfers.

b. Performance Standard:

· 95% of HL7 messages must be processed and acknowledged within 60 seconds of receipt.

· 100% of scheduled batch file exchanges must be completed within the designated window (e.g., nightly, weekly).

c. Retainage:

· 3% of the monthly invoice if HL7 or batch exchange thresholds are not met.