CASA SSN_Final.pdf

SSN 261097 - CASA

THIS IS NOT A REQUEST FOR PROPOSAL (RFP) OR SOLICITATION | Page 1

SOURCES SOUGHT NOTICE (261097)

Medicare Fee-For-Service Corrective Action Strategic Analysis (CASA)

THIS IS NOT A REQUEST FOR PROPOSAL (RFP) OR SOLICITATION AND DOES NOT

COMMIT CMS TO AWARD A CONTRACT NOW OR IN THE FUTURE.

PURPOSE

This Sources Sought Notice (SSN) is being issued to determine the availability and capability of potential small businesses (SBs) including 8(a), Service-Disabled Veteran-Owned Small Businesses (SDVOSBs), HUBZone Small Businesses, Small Disadvantaged Businesses (SDBs), Veteran-Owned Small Businesses (VOSBs), and Women-Owned Small Businesses (WOSBs) to support the Centers for Medicare & Medicaid Services (CMS), and specifically the Center for Program Integrity (CPI) / Provider Compliance Group (PCG), in its Medicare Fee-For-Service (FFS) Corrective Action Strategic Analysis (CASA) work.

The CASA work focuses on identifying, measuring, and preventing improper payments in the Medicare FFS program by conducting data analysis amongst PCG corrective action activities, corrective action strategy development and assessment, and internal stakeholder engagement and support activities. The desired outcomes of these efforts are to:

• Characterize Comprehensive Error Rate Testing (CERT) data into functional templates to identify the highest-value corrective action strategies;

• Reduce provider burden, reduce appeals, and reduce improper payments in the Medicare FFS program;

• Support CMS in meeting its obligations under the Payment Integrity Information Act of 2019 (PIIA); and

• Provide actionable recommendations to PCG programs and CMS leadership.

Contractors must be registered in the System for Award Management (SAM) database located at https://sam.gov/ prior to award, during performance, and through final payment of any contract. Contractors may obtain information on SAM registration by visiting:

https://sam.gov/entity-registration.

This announcement is a Sources Sought Notice (SSN) for planning purposes only. CMS is reviewing responses from eligible small businesses under the NAICS code listed below. This is not an invitation for bid, request for quote, or other solicitation and in no way obligates the Government to award a contract. CMS will not entertain questions regarding this market research.

PROGRAM HISTORY

CMS has traditionally used contractor support to analyze Comprehensive Error Rate Testing (CERT) data to develop and assess corrective action strategies to reduce improper payments in the Medicare FFS program. The CERT program, implemented in compliance with the Payment Integrity Information Act (PIIA), selects a stratified random sample of approximately 37,500

THIS IS NOT A REQUEST FOR PROPOSAL (RFP) OR SOLICITATION | Page 2 claims submitted to Part A/B Medicare Administrative Contractors (MACs) and Durable Medical Equipment MACs (DMACs) during each reporting period.

The CASA work supports the PCG's mission by:

• Analyzing CERT data to identify top drivers of improper payments;

• Assessing the alignment of CPI corrective action activities with the national improper payment rate;

• Assessing the effectiveness of current CPI corrective action strategies;

• Developing strategic recommendations to reduce the Medicare FFS improper payment rate;

and

• Supporting provider education through the Provider Compliance Tip Tool Enhancement.

The annual Medicare FFS improper payment rate is published in the Health and Human Services (HHS) Agency Financial Report (AFR). CMS seeks to continue and enhance this analytical support through a new contract for the 2026–2028 period of performance.

INSTRUCTIONS FOR RESPONDING

To respond to this notice, contractors must demonstrate experience and/or the ability to provide support for the six numbered capabilities listed below.

Responses based upon anticipated teaming arrangements and Joint Ventures are acceptable.

The prime contractor must independently demonstrate all four MANDATORY capability areas. Teaming partners and subcontractors may supplement MANDATORY capability areas where the prime demonstrates a strong foundational capability, and may fully support PREFERRED capability areas. The capability of each team member (prime contractor and subcontractors) shall be demonstrated relative to the anticipated functions/roles to be performed by each.

Contractors must provide sufficient detail, so the response clearly indicates knowledge and experience relevant to the requirements described below.

Global Past Performance Thresholds (apply to all capability areas)

All past performance examples cited in response to this SSN must meet the following minimum thresholds:

Threshold Requirement

Minimum contract value $2,500,000 total contract value (prime or subcontract)

Recency Performed within the last six years

Contract type Federal government prime contract or subcontract

Scope Medicare FFS, Medicaid, CHIP, or analogous federal healthcare payment integrity

THIS IS NOT A REQUEST FOR PROPOSAL (RFP) OR SOLICITATION | Page 3

Note: Respondents may cite up to two analogous federal healthcare program examples (e.g., Medicaid PERM, CHIP, VA healthcare, TRICARE) per capability area where direct Medicare FFS experience is limited, provided the respondent clearly explains the transferability of skills and methodology.

For each past performance example cited, respondents must utilize the provided Structured Capability Response Matrix (see below) to provide the required information: contract number, agency name, period of performance, total contract value, and a brief description of work performed.

Capability 1 — Medicare FFS Claims Data Analysis and CMS Data Systems Access

[MANDATORY]

Requirement: Demonstrate direct or closely analogous experience accessing, querying, and analyzing large-scale federal healthcare claims data using authorized data systems, with compliance with applicable federal security and privacy requirements.

Describe your organization's experience with the following:

• Accessing and querying Medicare FFS or analogous federal healthcare claims data using authorized systems, including but not limited to the Integrated Data Repository Contractor (IDRC), Recovery Audit Contract Data Warehouse (RACDW), National Claims History (NCH) Standard Analytical Files (SAFs), Fiscal Intermediary Standard System (FISS), Medicare Carrier System (MCS), Provider Statistical and Reimbursement (PS&R) system, and/or the CERT Dashboard. Experience with Medicaid T-MSIS, VA CDW, or equivalent federal data systems is acceptable as supplemental evidence.

• Performing large-scale data analysis involving federal healthcare claims populations (e.g., datasets of 5 million or more records).

• Executing analyses under a CMS-approved Data Use Agreement (DUA), Memorandum of Understanding (MOU), or equivalent federal data governance agreement, with demonstrated compliance with applicable Privacy Act, HIPAA, and data governance requirements.

• Handling federal beneficiary Personally Identifiable Information (PII) and Protected Health Information (PHI), including Health Insurance Claim Numbers (HICNs) and Medicare Beneficiary Identifiers (MBIs), in compliance with NIST SP 800-53 Moderate baseline controls, NIST SP 800-171, OMB M-17-12, and Executive Order 13556 (CUI).

• Demonstrated experience with at least one of the three primary CMS data systems: (1) IDRC or legacy IDR (retired November 2023); (2) RACDW; and/or (3) NCH SAFs — or a comparable federal healthcare data warehouse.

Note: Respondents must clearly distinguish between experience with the legacy IDR (retired November 2023) and the current IDRC, identifying applicable time periods for each. Experience with analogous federal data systems is acceptable as supplemental evidence but must be clearly labeled as such.

THIS IS NOT A REQUEST FOR PROPOSAL (RFP) OR SOLICITATION | Page 4

Capability 2 — Improper Payment Analysis, Vulnerability Identification, and ROI Assessment [MANDATORY]

Requirement: Demonstrate direct or closely analogous experience performing improper payment analysis, error rate trending, vulnerability identification, and return on investment (ROI) assessment for a federal healthcare payment integrity program.

Describe your organization's experience with the following:

• Classifying federal healthcare claims errors using structured error taxonomies (e.g., CERT error taxonomy, PERM error categories, or equivalent), including insufficient documentation, no documentation, medically unnecessary, and incorrect coding categories.

• Applying stratified random sampling methodologies, weighted error rate estimation, and confidence interval calculations consistent with federal program integrity statistical standards.

• Performing multi-period error rate trending analysis across a minimum of two consecutive reporting periods to identify statistically significant changes in improper payment rates, error types, and drivers.

• Identifying high-value corrective action areas through systematic analysis of claims data, review data, and/or other federal healthcare data sources, including CERT data and MAC review data.

• Conducting error rate reduction feasibility assessments and cost-benefit/ROI analyses for program integrity activities, consistent with PIIA Section 3(a) and OMB Circular A-123 Appendix C requirements.

• Producing improper payment analysis products aligned with Payment Integrity Information Act of 2019 (PIIA), Improper Payments Elimination and Recovery Act (IPERA), and OMB Circular A-123 Appendix C reporting requirements.

• Supporting or producing deliverables for CMS program offices including the Office of Financial Management (OFM), Division of Program Evaluation and Research Methodology (DPERM), and/or the Program Analysis and Research Group (PARG).

Note: Direct Medicare FFS experience is preferred. However, experience with Medicaid PERM, CHIP, or other federal improper payment programs is acceptable as a partial substitute for up to one past performance example per respondent, provided the respondent clearly explains methodological transferability. General healthcare analytics or commercial insurance utilization review experience is not an acceptable substitute.

Capability 3 — Corrective Action Plan (CAP) Development, Assessment, and Medical Review [MANDATORY]

Requirement: Demonstrate direct or closely analogous experience developing, implementing, or evaluating Corrective Action Plans (CAPs) for a federal healthcare program, and applying coverage rules to claims through pre-payment and/or post-payment medical review.

Describe your organization's experience with the following:

THIS IS NOT A REQUEST FOR PROPOSAL (RFP) OR SOLICITATION | Page 5

• Developing structured CAPs that include root cause analysis, identification of responsible parties, implementation timelines, and measurable performance metrics aligned to error rate reduction targets.

• Assessing the alignment and effectiveness of prepayment and post-payment program integrity activities, including Targeted Probe and Educate (TPE), Prior Authorization (PA), Unified Program Integrity Contractor (UPIC) activities, and Recovery Auditor activities across Regions 1 through 5.

• Evaluating corrective action strategies using data from CMS or analogous federal program integrity systems (e.g., RACDW, Program Integrity Review System (PRIS), Medicare Review and Audit Contractor (MRAC) system, Unified Case Management (UCM) system, or equivalent).

• Supporting the Medicare Corrective Action Plan and Improper Payment Reduction Plan (MCPIRP), Medicaid PERM corrective action framework, or equivalent OMB-aligned federal improper payment reduction framework.

• Applying Medicare NCDs, LCDs, or analogous federal coverage rules to review claims for medical necessity, documentation compliance, and coding accuracy, using systems such as FISS, MCS, and/or Common Working File (CWF).

• Conducting pre-payment and/or post-payment medical reviews (e.g., Additional Documentation Requests (ADRs), prepayment probe reviews, CERT reviews, Recovery Auditor reviews, or equivalent) with documented outcomes including error rate reduction or improper payment identification.

• Implementing inter-rater reliability testing and reviewer calibration protocols to ensure consistency and accuracy across medical review teams.

• Identifying and documenting specific error types (e.g., insufficient documentation, no documentation, medically unnecessary, incorrect coding) consistent with the CERT error taxonomy or equivalent federal error classification framework.

• Producing measurable outcomes from medical review activities, including quantified error rate reductions, dollar amounts of improper payments identified or recovered, and audit support deliverables.

Note: Direct Medicare FFS experience is preferred. Experience with Medicaid, CHIP, VA, or TRICARE medical review and CAP development is acceptable as supplemental evidence for up to one (1) past performance example, provided the respondent clearly explains the relevance and transferability. Commercial insurance utilization review experience is not an acceptable substitute.

Capability 4 — Federal Healthcare Program Integrity Ecosystem Coordination

[MANDATORY]

Requirement: Demonstrate direct or closely analogous experience supporting or coordinating with entities within a federal healthcare program integrity ecosystem. Respondents must demonstrate active engagement with at least two of the five entity types listed below.

Describe your organization's direct experience with the following entity types:

THIS IS NOT A REQUEST FOR PROPOSAL (RFP) OR SOLICITATION | Page 6

• Medicare Administrative Contractors (MACs): Including Part A/B MACs and Durable Medical Equipment MACs (DMACs), in the context of claims processing, medical review, or corrective action coordination.

• Unified Program Integrity Contractors (UPICs): In the context of fraud, waste, and abuse investigations, data analysis support, or corrective action coordination.

• Recovery Auditors (RACs): Including Regions 1 through 5, in the context of post-payment review, overpayment identification, or RACDW data analysis.

• CERT Program: Including the CERT Review Contractor (CERT-RC) and CERT Supplemental Contractor (CERT-SC), in the context of claims review, error rate calculation, or corrective action support.

• CMS Program Integrity Systems or Analogous Federal Systems: Including the Program Integrity Review System (PRIS), Medicare Review and Audit Contractor (MRAC) system, Unified Case Management (UCM) system, or equivalent federal program integrity platforms.

Note: Experience with analogous federal program integrity ecosystems (e.g., Medicaid integrity contractors, OIG audit support, VA program integrity) is acceptable as supplemental evidence for one (1) of the two (2) required entity types, provided the respondent clearly explains the relevance.

For each entity type cited, provide specific contract numbers, agency names, periods of performance, and a description of work performed.

Capability 5 — Provider Education Materials and Compliance Products

[PREFERRED]

Requirement: Demonstrate experience developing provider-facing education products, compliance materials, and stakeholder briefing materials for Medicare FFS or similar federal healthcare programs.

Describe your organization's experience with the following:

• Developing Provider Compliance Tips (PCTs), educational toolkits, compliance tip sheets, or similar provider-facing products for CMS, HHS, or comparable federal health agencies, including products developed for or in coordination with the Center for Program Integrity (CPI) and Provider Compliance Group (PCG).

• Creating materials that accurately translate Medicare NCDs, LCDs, or analogous federal coverage rules into plain-language provider guidance.

• Developing materials compliant with Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. § 794d) and CMS plain language standards.

• Supporting electronic submission of medical documentation (esMD) Additional Documentation Request (ADR) workflows or similar provider-facing compliance processes.

Note: This is a PREFERRED capability area. Experience with analogous federal or state health agency education programs is acceptable.

THIS IS NOT A REQUEST FOR PROPOSAL (RFP) OR SOLICITATION | Page 7

Capability 6 — Stakeholder Engagement and Federal Program Office Support

[PREFERRED]

Requirement: Demonstrate experience managing stakeholder relationships and providing analytical support in a federal health agency environment, with coordination across multiple program offices or organizational units.

Describe your organization's experience with the following:

• Managing regular reporting cadences, ad-hoc analysis requests, and briefing support for CMS, HHS, or comparable federal agency program offices.

• Coordinating across multiple CMS or HHS program offices or organizational units simultaneously, including management of competing priorities and ad-hoc analytical requests.

• Supporting or participating in engagements with oversight bodies including the Office of Inspector General (OIG), Office of Management and Budget (OMB), and/or Congressional oversight staff in the context of improper payment reporting or program integrity activities.

• Demonstrating the MRAD or equivalent analytical dashboards and tools to senior CMS program office stakeholders, including DMR and DPMS.

Note: This is a PREFERRED capability area. Experience with analogous federal health agency or large federal program stakeholder engagement is acceptable.

SUMMARY OF CAPABILITY STRUCTURE

# Capability Title Type

1 Medicare FFS Claims Data Analysis and CMS Data Systems Access

MANDATORY

2 Improper Payment Analysis, Vulnerability Identification, and ROI Assessment

MANDATORY

3 CAP Development, Assessment, and Medical Review

MANDATORY

4 Federal Healthcare Program Integrity Ecosystem Coordination

MANDATORY

5 Provider Education Materials and Compliance Products

PREFERRED

6 Stakeholder Engagement and Federal Program Office Support

PREFERRED

THIS IS NOT A REQUEST FOR PROPOSAL (RFP) OR SOLICITATION | Page 8

STRUCTURED CAPABILITY RESPONSE MATRIX

In addition to the narrative capability descriptions, respondents must complete and submit the following Structured Capability Response Matrix as a separate attachment to their capability statement. The matrix does not count toward the 15-page limit.

For each of the six capability areas, provide the following information for each past performance example cited:

Field Required Information

Capability Number and Title e.g., Capability 1 — Medicare FFS Claims Data Analysis

Contract Number Federal contract or subcontract number

Agency / Client Name Federal agency and program office

Period of Performance Start date – End date

Total Contract Value Dollar value (prime or subcontract)

Prime or Subcontractor Role Identify role and percentage of effort

Description of Work Performed 2–3 sentences describing the specific work performed relevant to this capability

CMS/HHS Systems Used List specific data systems accessed (e.g., IDRC, RACDW, NCH, FISS, MCS)

Verifiable Point of Contact Name, title, phone number, and email address

RESPONDENT BUSINESS INFORMATION

Respondents shall also submit the following business information in their response:

1. Unique Entity Identifier (UEI) Number

2. Company Name

3. Company Address

4. Company Point of Contact, phone number, and email address

5. Type of company under NAICS 541611 – Administrative Management and General

Management Consulting Services; Size Standard $24.5M as validated via the System for Award Management (SAM). Additional information on NAICS codes can be found at www.sba.gov.

6. Corporate structure (e.g., corporation, LLC, sole proprietorship, partnership, limited liability partnership, professional corporation, etc.)

7. Current contracting vehicles (e.g., GSA Schedule, BPAs, IDIQs, etc.) that the company is a part of that are applicable and relevant to this SSN

8. Point of contact, phone number, and email addresses of at least two individuals who can verify the demonstrated capabilities identified in the responses.

THIS IS NOT A REQUEST FOR PROPOSAL (RFP) OR SOLICITATION | Page 9

Teaming Arrangements: All teaming arrangements shall also include the above-cited information and certifications for each entity on the proposed team. Specifically, the capability statement must address how much effort would be performed by any proposed team member.

Note that any resulting small business set-aside would require that at least 50% of the cost of contract performance for personnel be expended for employees of the concern and other similarly situated subcontractors (see FAR 52.219-14, Limitations on Subcontracting).

SUBMISSION REQUIREMENTS

All capability statements shall be submitted via email to the point of contact listed below. The title of the email shall read: "SB Response to CASA SSN 261097"

Responses must be submitted no later than 12:00 PM, local time, Baltimore, MD on May 8, 2026.

Responses shall be limited to 15 single-sided pages (to allow adequate demonstration of all 6 capability areas). The Structured Capability Response Matrix is a required separate attachment and does not count toward the page limit. Pages should be:

• Single-spaced

• 12-point font minimum (Times New Roman or Arial)

• Minimum one-inch margins on all sides

• Cover page and business information section do not count toward the page limit

Responses should be sent electronically to:

Eisha Banks, Contract Specialist

Email: Eisha.Banks@cms.hhs.gov

With a courtesy copy to:

Jennifer Kuhn, Contracting Officer

Email: Jennifer.Kuhn@cms.hhs.gov

DISCLAIMER AND IMPORTANT NOTES

This notice does not obligate the Government to award a contract or otherwise pay for the information provided in response. The Government reserves the right to use information provided by respondents for any purpose deemed necessary and legally appropriate. Any organization responding to this notice should ensure that its response is complete and sufficiently detailed to allow the Government to determine the organization's qualifications to perform the work.

Respondents are advised that the Government is under no obligation to acknowledge receipt of the information received or provide feedback to respondents with respect to any information submitted. Responses to this notice will not be considered adequate responses to a solicitation.

THIS IS NOT A REQUEST FOR PROPOSAL (RFP) OR SOLICITATION | Page 10

CONFIDENTIALITY

No proprietary, classified, confidential, or sensitive information should be included in your response. The Government reserves the right to use any non-proprietary technical information in any resultant solicitation(s).

PROTECTION OF PRIVILEGED OR CONFIDENTIAL COMMERCIAL OR FINANCIAL

INFORMATION

The Freedom of Information Act (FOIA), 5 U.S.C. § 552, provides individuals with a right to access certain records in the possession of the Federal government, subject to certain exemptions. Exemption 4 of the FOIA permits information to be withheld that is in the nature of "trade secrets and commercial or financial information obtained from a person and privileged or confidential."

CMS may invoke Executive Order 12600 in accordance with FOIA Regulation 45 C.F.R. § 5.42.

Information provided by entities to CMS in response to this notice may be subject to FOIA disclosure requirements unless protected under Exemption 4 of the Freedom of Information Act.

Should entities wish to protect any trade secret or confidential information under Exemption 4, they should mark their submission accordingly citing applicable redactions and non-disclosure rationale. Pre-disclosure redactions and non-disclosure rationale shall be sent via email to the requesting Contracting Officer with a copy to the CMS FOIA Office at 12600@cms.hhs.gov.

If an entity's submission is not marked and CMS receives a FOIA request related to this notice, the CMS Contracting Officer will notify the entity. The entity will have 10 working days to object to the release of any part of their information submitted to CMS citing relevant case law. Final determination on the applicability of Exemption 4 of the FOIA are made on a case-by-case basis by CMS.

The statutory language of the FOIA is codified at 5 U.S.C. § 552(b). Additional information and resources, including the 9 FOIA Exemptions and HHS FOIA Regulation, and examples, can be found on the HHS FOIA Website.