C260493_RFP_Exhibit_A,_SOW.pdf

RFP 260493

EXHIBIT A

SCOPE OF WORK

Centers for Medicare & Medicaid Services (CMS) Medicare Section 111 Reporting Services

Non-Group Health Plan Liability Claims

1. Background, Purpose, and Workload

The Orange County Transportation Authority (OCTA) is fully self-insured and self-administers its liability claims. OCTA is the Responsible Reporting Entity (RRE) for applicable Non-Group Health Plan (NGHP) liability reporting under Section 111 of the

Medicare, Medicaid, and State Children's Health Insurance Program (SCHIP) Extension

Act. OCTA seeks a qualified contractor to serve as its CMS reporting agent for liability claims only and to provide managed compliance, technical, submission, correction, and support services.

OCTA’s current reporting arrangement with Verisk is expected to end December 31, 2026.

The replacement service shall be fully operational no later than January 1, 2027. Origami

Risk will remain OCTA’s claims system of record and primary operational interface. The contractor shall integrate with Origami and shall not replace it. As part of implementation, the contractor shall coordinate the orderly transfer and reconciliation of OCTA’s existing

CMS Section 111 reporting data and available historical Insurance Services Office, Inc.

(ISO) ClaimSearch results from Verisk into Origami. OCTA will retain final responsibility as the RRE; the contractor will perform the reporting-agent services necessary to support timely, accurate, documented compliance.

Loss Fiscal Year (FY) ISO Claim Searches* Medicare-Eligible Claims

FY 2021–22 22 4

FY 2022–23 19 3

FY 2023–24 12 4

FY 2024–25 5 2

FY 2025–26 7 0

Five-Year Total 65 13

*Included only as workload context. Ongoing ISO ClaimSearch services are outside this procurement;

the limited one-time migration of available historical ISO results is included. Counts are grouped by loss-date fiscal year (July 1–June 30). Historical volumes are estimates and do not guarantee future work.

2. Objectives and Governing Requirements

• Maintain uninterrupted Section 111 reporting during transition from the incumbent provider and throughout the contract term.

• Submit complete and accurate liability-claim data, correct errors promptly, and preserve auditable proof of transmissions, CMS responses, corrections, and acceptance.

• Use Origami as the primary source/interface and minimize manual duplicate entry through secure, tested data exchange, and clear exception workflows.

• Preserve reporting continuity by migrating and reconciling existing Verisk-managed

CMS records and available historical ISO results into Origami before production cutover.

• Monitor and implement then-current CMS NGHP User Guide requirements, alerts, technical specifications, reporting thresholds, and civil-money-penalty compliance expectations.

3. Scope of Services

1. Transition and implementation. Assign a project manager; conduct kickoff; inventory current RRE configuration, Taxpayer Identification Number (TIN)/reference data, open reportable claims, submission history, and unresolved errors; prepare and execute a transition plan; coordinate with OCTA, Origami, CMS, and the incumbent; complete mapping, testing, user acceptance, training, cutover, and contingency planning without a reporting lapse.

2. Incumbent data migration and reconciliation. Coordinate with OCTA, Verisk, and

Origami to obtain, securely transfer, map, test, load, validate, and reconcile OCTA’s existing CMS Section 111 reporting data into Origami. The migration shall include, to the extent maintained by Verisk and made available to OCTA, Medicare eligibility/query history; claim input files; CMS response and disposition files; accepted, rejected, and pending record statuses; open errors; TIN reference information;

Ongoing Responsibility for Medicals (ORM) and Total Payment Obligation to Claimant

(TPOC) history; RRE configuration; submission receipts; correction history; and audit-support records. The contractor shall also coordinate a one (1)-time migration into

Origami of available historical ISO ClaimSearch results or related OCTA claim-level

ISO data that Verisk is legally and contractually permitted to provide. The contractor shall prepare source-to-target control totals, identify duplicates and gaps, maintain an exception log, resolve discrepancies within its control, and certify in writing that migrated records are complete, readable, traceable, and usable in Origami. Any item that cannot be transferred shall be documented with the reason, impact, and recommended disposition. Ongoing ISO ClaimSearch services are not included.

3. Origami integration. Design, configure, test, document, and maintain secure

Application Programming Interface (API), Secure File Transfer Protocol (SFTP), or other mutually approved exchange with Origami. Map required eligibility/query, claim, TIN, ORM, TPOC, diagnosis, response, disposition, and error fields. Return response files, statuses, error messages, and actionable correction instructions to Origami or another OCTA-approved workspace. Provide a controlled manual fallback for outages.

4. RRE and account administration. Support OCTA’s existing RRE registration and reporting profile; maintain required account representative/account manager information at OCTA’s direction; manage reporting-agent access; maintain TIN reference files; calendar submission windows; and assist with annual profile validation, certifications, and attestations. OCTA shall remain the owner of its RRE credentials and data. No registration or contact change may be made without OCTA’s written approval.

5. Eligibility and production reporting. Process Medicare eligibility/query activity and produce, validate, transmit, and reconcile all required liability claim and TIN files.

Support applicable ORM and TPOC reporting, updates, deletes, terminations, and resubmissions. Confirm receipt and acceptance and retain traceable control totals and file histories.

6. Pre-submission edits and error resolution. Apply meaningful validation before transmission, including required-field, date, threshold, duplicate, diagnosis/International Classification of Diseases, Tenth Revision (ICD-10), amount, TIN, and cross-field logic. Translate CMS error codes into claim-specific instructions, identify the responsible party, track aging, and correct and resubmit until accepted.

Distinguish contractor/integration defects from OCTA data decisions.

7. Compliance monitoring and advisory support. Monitor applicable CMS guidance and alerts, explain operational impact, update validation/submission processes, and give OCTA written notice of material changes. Flag records that may approach a reporting deadline or civil-money-penalty exposure and preserve documentation supporting timely compliance. Provide technical/compliance guidance, not legal advice.

8. Operational support and quality control. Provide named account and technical contacts; user training and job aids; periodic data-quality reviews; reconciliation of source, transmitted, rejected, and accepted records; and documented root-cause/corrective-action analysis for recurring defects.

9. Audit, inquiry, and transition-out support. Support CMS or OCTA inquiries and audits with file histories, receipts, correction logs, process documentation, and relevant correspondence. At contract end, provide a complete, usable export and cooperate with OCTA and any successor so that OCTA retains uninterrupted access and reporting continuity.

4. Deliverables and Schedule

Deliverable Minimum Content / Acceptance Evidence Due / Frequency

Project

Initiation

Project manager, kickoff, data request, detailed transition plan

Within ten (10) business days after Notice to

Proceed (NTP)

Configuration

& Mapping

Data map, secure transfer design, validation rules, RRE/TIN configuration

Within thirty (30) calendar days after NTP

Incumbent

Data

Migration

Verisk data inventory; CMS and available historical ISO extracts; mapping; test and production loads; source-to-target reconciliation; exception log; completion certification

Migration plan within fifteen (15) business days after NTP; complete by

December 15, 2026

Testing &

Readiness

Test files, defect log, User Acceptance

Testing (UAT) support, production-readiness certification

Complete by

December 15, 2026

Production

Service

Monthly eligibility/query processing;

quarterly claim/TIN submissions; response files; correction and resubmission

Go-live no later than

January 1, 2027;

thereafter per CMS schedule

Operational

Reporting

Submission receipts, open/error inventory, timeliness, pending OCTA actions, compliance risks

Dashboard within five (5) business days of each

CMS response; quarterly summary

Deliverable Minimum Content / Acceptance Evidence Due / Frequency

Regulatory

Support

Change notices, implementation guidance, RRE profile/attestation support, audit response package

Notice within five (5) business days of material guidance; support as required

Exit

Assistance

Current data, file history, mapping, credentials-transfer checklist, and successor coordination

Within thirty (30) days of request or contract end

5. Performance Standards and Service Levels

• Timeliness: One hundred percent (100%) of required submissions shall be made within the applicable CMS window when OCTA has supplied necessary data and decisions by the agreed cutoff. The contractor shall immediately document and escalate any threatened deadline.

• Accuracy and reconciliation: Each production cycle shall reconcile source records, transmissions, responses, accepted records, rejected records, and pending OCTA actions. Contractor or integration-caused defects shall be corrected at no additional charge.

• Migration acceptance: Migrated data shall reconcile to Verisk source extracts by record count and status. Any variance shall be listed in an exception log and accepted in writing by OCTA. Production readiness shall not be certified until OCTA approves the migration reconciliation and confirms that required records are accessible in Origami.

• Continuity: Maintain documented backup, recovery, and alternate-submission procedures sufficient to meet CMS deadlines. Planned maintenance affecting OCTA shall be communicated at least five business days in advance when practicable.

Priority Example Minimum Response

Critical Submission failure, security incident, or issue threatening a CMS deadline

Acknowledge within one (1) business hour; continuous work until stabilized

High Rejected production file, recurring integration failure, or material data defect

Acknowledge within four (4) business hours; action plan same business day

Priority Example Minimum Response

Routine User question, report request, or non-urgent correction

Acknowledge within one (1) business day; target resolution within three (3) business days

6. Roles and Responsibilities

Contractor responsibilities include the services, staffing, tools, testing, secure connectivity, reporting-agent expertise, quality controls, documentation, incumbent-data migration, reconciliation, and coordination required by this Scope of Work (SOW). OCTA will provide timely access to authorized data and personnel, authorize Verisk to release OCTA-owned or transferable records, make claim and legal/reportability decisions reserved to the RRE, review migration exceptions, approve material configuration changes, and coordinate

Origami access. The contractor shall lead migration coordination and provide technical specifications, mapping, validation, reconciliation, and certification. Origami will provide the authorized import method and reasonable technical coordination under OCTA’s separate arrangement. Completion dates dependent on Verisk or Origami cooperation shall be promptly escalated, but the contractor remains responsible for managing and documenting the transition.

7. Data Security, Privacy, and Records

• Use OCTA data solely to perform this SOW and only to the minimum extent necessary.

Do not sell, mine, combine, or use the data for unrelated analytics, product development, or advertising.

• Encrypt protected and confidential data in transit and at rest; use role-based access, multi-factor authentication, logging, secure development/change control, vulnerability management, backups, and documented incident response. Provide current independent security assurance (such as System and Organization Controls [SOC] 2

Type II or equivalent) upon request.

• Notify OCTA immediately, and no later than twenty-four (24) hours after discovery, of any suspected unauthorized access, disclosure, loss, or material security event involving

OCTA data; preserve evidence; investigate; mitigate; and provide written updates and a final root-cause report.

• Use subcontractors/cloud providers only as reasonably necessary and approved or disclosed as required by the agreement. Bind them to confidentiality, security, privacy, retention, and deletion obligations at least as protective as the contractor’s. The contractor remains responsible for their acts and omissions.

• Retain reporting records for the period required by then-current CMS guidance and the agreement and return or securely destroy OCTA data at contract end, subject to documented legal retention obligations.

8. Assumptions and Exclusions

Assumptions. One (1) OCTA RRE; an anticipated initial three (3)-year term with one, two (2)-year option; one (1) production Origami environment plus reasonable testing; low and variable claim volume; remote service unless OCTA approves otherwise; OCTA remains the final decision-maker for reportability and source-data accuracy; OCTA shall provide necessary authorizations for Verisk and Origami coordination; Verisk shall make

OCTA-owned or otherwise transferable data available in a commercially reasonable electronic format; and Origami shall provide an authorized import method.

Excluded services. Workers’ Compensation reporting (handled separately by OCTA’s

Third-Party Administrator (TPA); Medicare Set-Asides; Conditional Payment Resolution;

Medicare Advantage/Part C or Part D lien resolution; general claims administration or adjusting; legal advice; ongoing ISO ClaimSearch searches, licensing, or subscription services; Origami licensing; and unrelated recovery, lien, or settlement services. The one

(1)-time migration and reconciliation of available historical ISO results or related OCTA claim-level ISO data from Verisk into Origami is included.

9. Acceptance, Change Control, and Contract Closeout

• Acceptance: Deliverables are accepted when they materially conform to this SOW, agreed specifications, test cases, and security requirements. OCTA will identify material deficiencies; the contractor shall correct them promptly and resubmit without additional charge.

• Migration acceptance: The incumbent-data migration is accepted only after OCTA receives and approves the final data inventory, mapping, test results, source-to-target reconciliation, exception log, and contractor certification, and confirms that required CMS records and available historical ISO results are accessible and usable in Origami.

• Change control: No material change to data use, architecture, hosting, subcontractors, RRE configuration, transmission method, deliverables, schedule, or price is effective without OCTA’s prior written approval through the agreement’s change process.

• Closeout: OCTA owns its claim data, RRE information, configuration decisions, submission/response histories, reports, and OCTA-specific documentation. The contractor shall provide these in commonly usable formats and complete orderly knowledge transfer and access termination.