J-1_FPS2_SOW.pdf

Attachment 1 SOW Center for Program Integrity

Centers for Medicare & Medicaid Services Procurement Sensitive

FPS2 SOW 06/04/2015 P a g e | 1

Table of Contents List of Tables

List of Figures

1. Purpose

2. Background

2.1 Current Environment

2.2 FPS2 Concept and Content

3. Scope

3.1 Performance Objectives

3.2 Project Timeframe

3.3 Assumptions and Constraints

3.3.1 Assumptions

3.3.2 Constraints

3.4 General IT Requirements

4. Description of Requirements

4.1 Task 1 - Project Management

4.1.1 Contractor Organization

4.1.2 Project Management Plan

4.1.3 Project Kick-off/Post–award Meeting

4.1.4 Coordination and Collaboration with CMS and other CMS Contractors

4.1.4.1 Zone Program Integrity Contractors/Program Safeguard Contractors (“ZPICs/PSC”)

4.1.4.2 Medicare Administrative Contractors (“MAC”)

4.1.4.3 Recovery Auditor Contractors (“RAC”)

4.1.4.4 Virtual Data Centers VDC(“VDC”)

4.1.4.5 Medicare Drug Integrity Contractors (“MEDIC”)

4.1.4.6 CMS Modeling Contractors

4.1.5 Joint Operating Agreements

FPS2 SOW 06/04/2015 P a g e | 2

4.1.6 Project Status Meetings and Reports

4.1.7 FPS2 Transition Planning and Management

4.1.8 Enterprise Change Control

4.2 Task 2 - FPS2 Requirements Analysis and Design

4.3 Task 3 – FPS2 Development, System Integration, and Testing

4.4 Task 4 –Change Management and FPS2 Optimization

4.5 Task 5 – FPS2 Operational and Application Support

4.5.1 Defect Tracking and Resolution

4.5.2 Business Activity Monitoring

4.5.3 Manage Batch Process Services

4.6 Task 6 – FPS2 Help Desk and Training

4.6.1 Help Desk

4.6.2 End User Training

4.6.3 End-User Communication

4.7 Task 7 – FPS2 Required Capabilities

4.7.1 FPS2 User Types, Roles, Permissions and Access

4.7.2 FPS2 Functional Requirements

4.7.2.1 Predictive Modeling System

4.7.2.2 User Interface Requirements

4.7.2.3 FPS2 System Landing Page Requirement

4.7.2.4 Query, Search and Export Requirements

4.7.2.5 Vulnerability Management Requirements

4.7.2.6 Model Management Requirements

4.7.2.7 Alert Summary Report (“ASR”) Management Requirements

4.7.2.8 Social Network Analysis Requirements

4.7.2.9 System Reports (Dashboard) Requirements

4.7.2.10 Database and Data Fields

4.7.2.11 System Outputs

4.7.2.12 Production Support

4.7.2.13 Data Sources

FPS2 SOW 06/04/2015 P a g e | 3

4.7.2.14 End-to-End Testing

4.7.3 FPS2 Non Functional Requirements

4.7.3.1 System Security

4.7.3.2 Federal of Information Act (“FOIA”)

4.7.3.3 Accessibility (Section 508)

4.7.3.4 Reliability (Backups, Redundancy, Downtime, and Failovers)

4.7.3.5 System Monitoring

4.7.3.6 FPS2 System Performance Service Level Agreements (“SLA”)

4.8 TASK 8 - Implementation of Models Developed by CMS and its Contractors

4.8.1 Implementation of Models

4.8.2 Monitoring of Models Implemented

4.9 Task 9 - Development and Implementation of Edits

4.9.1 Maintenance of Edits Module with the Medicare Fee-for Service (FFS) Claims Process ... 50

4.9.2 Implementation of an FPS2 Problem Reporting Tool

4.10 Task 10 - Enhancement to Edits Functionality (Optional)

4.11 Task 11 - Mirrored Test Environment ()

4.12 Task 12 - Transition FPS1 Models in FPS2

4.13 Task 13 - Legacy Data Management and Data Migration

4.14 Task 14 - Integration with CMS Unified Case Management (“UCM”) System (OPTIONAL)

4.15 Task 15 – Contract Transition

4.15.1 Transition Out

5. Deliverables and Schedule

6. Performance Standards, Quality Assurance, and Monitoring

7. Government Furnished Information and Property

7.1 Information

7.2 Data Use Agreements

7.3 Equipment

7.4 Access to Systems and Facilities

8. Other Compliance Requirements

8.1 Key Personnel

FPS2 SOW 06/04/2015 P a g e | 4

8.2 Hours of Operation/Location

8.3 Financial Reports

8.4 Earned Value Management

8.4.1 Performance Measurement Baseline

8.4.2 Integrated Baseline Review

8.4.3 Management Review

9. Security and Privacy and/or Legislative and Executive Mandates, Regulations, and Guidance

9.1 CMS Information Security (APR 2013) and Audits

9.2 Section 508 – Accessibility of Electronic and Information Technology

10. Reference Documents

11. Abbreviations and Acronyms

List of Tables

Table 1: FPS2 User and Roles

Table 2. FPS2 Services ............................................. Error! Bookmark not defined.………….31

Table 3. Measure Types ............................................................. Error! Bookmark not defined.45

Table 4. Table of Deliverables

Table 5. Performance Requirements Summary

Table 6. Reference Documents

List of Figures

Figure 1. FPS2 System Context Diagram .................................... Error! Bookmark not defined.7

Figure 2. Notional FPS2 Integrated Project WBS

FPS2 SOW 06/04/2015 P a g e | 5

1. Purpose

The purpose of this requirement is to acquire a second generation of the Fraud Prevention System (FPS2) and associated operational services to support the workload of Centers for Medicare & Medicaid Services (CMS) Program Integrity (PI) contractors across the Medicare and Medicaid programs. The Contractor, acting independently and not as an agent of the government, shall furnish all the necessary services, qualified personnel, material, equipment, supplies, and facilities except as otherwise specified herein, and otherwise do all things necessary for or incident to performance of requirements described in this work statement, also referred to as the Contractor’s Statement of Work (SOW).

2. Background

As required by the Small Business Jobs Act of 2010 (Public Law 111-240) mandates the use of predictive modeling and other analytic technologies to identify and prevent fraud, waste, and abuse in the Medicare FFS program. The Centers for Medicare & Medicaid Services (CMS) developed and implemented the Fraud Prevention System (FPS) to implement predictive analytics technologies to identify and prevent the payment of fraudulent claims in the Medicare Fee-for-Service (FFS) Program.

The vision of the Fraud Prevention Program (Version 1, known in this SOW as FPS1) was to establish predictive modeling tools into the claims processing system to stop payment on high risk claims. The outputs of the modeling included risk scores and proposed actions (e.g. denial, payment suspension, investigation, revocation, etc.) and appropriate data to support the actions. CMS extended the FPS to include edit capabilities. With edits, CMS/CPI is able to reject or deny claims that have been predetermined, by various policy experts, within and outside the agency, to not be a likely or a valid serviceable/billable claim.

CMS Center for Program Integrity (CPI) is measured on Return on Investment (ROI) of the FPS Program.

To improve CPI’s long-term ROI and align with CPI’s organizational goal, FPS (Version 2, known in this SOW as FPS2) is being undertaken to enable more efficient time-to-market for predictive models, better monitoring models and the ability to leverage more advanced modeling paradigms (such as Social Network Analysis).

By investing in FPS2 system, CMS expects a range of benefits, including cost savings in operational Information Technology (IT) infrastructures, improved cost recovery from administrative actions, improved prevention and detection of fraud, waste, and abuse in Medicare and Medicaid program spending.

More detailed information about CMS PI activities is available at www.cms.gov;

www.stopmedicarefraud.gov; the CMS Internet-Only Manual Publication 100-08, Medicare Program Integrity Manual (“PIM”); and CMS Internet-Only Manual Publication 100-15, Medicaid Integrity Program (“MIP”).

2.1 Current Environment

FPS2 SOW 06/04/2015 P a g e | 6

FPS1 provides a source of leads for CMS and Medicare PI contractors. The FPS1 applies predictive models and other algorithms to identify providers/suppliers exhibiting a pattern of behavior that is indicative of potential fraud, waste and abuse. The FPS1 system screens all Medicare FFS claims and builds profiles to help identify suspect behavior. FPS1 generates alerts based on billing behaviors, calculates a priority score, and assigns the alert to a PI contractor based on jurisdiction. FPS1 alerts may be assigned to a lead PI contractor and also allow for a participating PI contractor with shared workload responsibility. FPS1 priority scores are calculated and then prioritized list of alerts is updated in real time within the system. Alerts are stored in an Oracle database. PI contractors rule on FPS1 alerts based on the provider, not on individual alerts. The FPS1 system screens all national Medicare Part A, Part B, and Durable Medical Equipment (DME) claims during the adjudication process and consolidates alerts by provider. Medicare Parts C and D, and Medicaid information will be added as it becomes available in the Integrated Data Repository (IDR).

Figure 1 (below) is a system context diagram for the current FPS1.

Figure 1 – FPS1 System Context Diagram

2.2 FPS2 Concept and Content

The purpose of this contract is to implement FPS2 predictive modeling and other analytic technology systems that are capable of reporting alerts based on risk scoring applied to near real-time claims and increase CMS CPI Return on Investment (ROI). The system shall capture and detect patterns or anomalies through development of provider and beneficiary profiles, identifying potential fraud, waste and abuse by the methods listed below for Medicare Part A, Part B and DME claims:

• Provider billing patterns;

• Beneficiary utilization patterns;

FPS2 SOW 06/04/2015 P a g e | 7

• Use of social network analysis and neural network analysis;

• Regression analysis;

• And other approved methods by CMS.

The system for risk identification shall be grounded in sound analytic methodologies and rely on algorithms informed by analytic, medical, clinical, and administrative knowledge that enables identification of improper payments before final payment is authorized by CMS. The system shall include functionality capable of delivering analytic results and reports to CMS (or its Contractors) in a timely manner and in a format that provides flags back to CMS systems supporting the claims lifecycle before the claim is adjudicated. The Contractor shall design, develop, and implement a robust system that delivers the highest probability of successful outcomes in the stipulated schedule for performance.

The FPS2 shall have increased capabilities from the FPS1 as follows:

• Decrease model time to market and eliminate recoding of models to custom language;

• Expand toolset to include social network analysis visualization;

• Improve User Interface (UI) based on previous, or past usability studies;

• Improve model management and visibility and evaluation of prioritization rules;

• Business Intelligence Reporting Tools (Dashboard) connect to the live FPS2 system and allows drill-down capabilities to claims level;

• Create a mirrored testing environment to allow testing of how a new model will interact with existing models (e.g. how new models impact workload).

FPS2 shall be a standalone system not built on the foundations of the current FPS1.

Figure 2 (below) is a system context diagram for the FPS2 project. As depicted in the diagram, the users of FPS2 include ZPIC/Program Safeguard Contractors (PSC), CMS, Law Enforcement and other potential users that may be identified in the future. The CMS user category may include CPI staff in Baltimore, field or regional offices, and other CMS organizations. The Law Enforcement user category may include HHS Office of Inspector General (OIG), Department of Justice (DOJ), Federal Bureau of Investigation (FBI), and Assistant United States Attorney (AUSA).

FPS2 SOW 06/04/2015 P a g e | 8

Figure 2 - FPS2 System Context Diagram

3. Scope The Contractor shall be responsible for the entire FPS2 system life cycle from requirements, design, development, integration, acceptance testing, deployment, training, and production support to subsequent system enhancements. The Contractor shall develop the FPS2 system to meet the requirements and specifications of this SOW following applicable CMS IT standards, including CMS Technical Reference Architecture (TRA), CMS Information Security (IS) Acceptable Risk Safeguards (ARS), and the CMS Expedited Life Cycle (XLC) process identified in the SOW Reference Documents. The FPS2 system shall employ market-leading technologies. CMS expects the system will require customization, configuration, and potential integration of a Commercial Off-the-Shelf (COTS)-based products to perform access management, workflow processing, database management, document management, reporting, and allow for data exchange and integration with other CMS systems. While the implemented FPS2 system may consist of multiple COTS products, this shall be transparent to users; the look and feel of the UI will represent a common product interface and use single-sign-on (“SSO”) between products.

Historically, the Government has determined that significant modifications (of at least 30%) were made to COTS-based products. The Contractor shall support users during the initial transition to the new FPS2 system and deliver ongoing user support when the system is operational.

FPS2 SOW 06/04/2015 P a g e | 9

3.1 Performance Objectives

The Contractor shall meet the following critical success factors, in service, for the overall performance objectives for the FPS2 Project:

1. Business requirements for each user group are elicited, captured, agree upon, and transformed into an effective IT system capabilities as part of the FPS2.

2. Plan and execute a tailored development approach to complete design, development, testing and implementation of the predictive modeling FPS2, and iterate with continuous refinements of the modeling system and output reports. Design and develop the system to operate using software and IT infrastructure compatible with the CMS IT environment and Enterprise Architecture (EA) and in accordance with (IAW) the CMS system development framework and security.

3. The FPS2 system is operational within the Base Period of the contract. Operational is defined as:

a. User community able to log into the system, enter and retrieve data;

b. Ingestion and usability of all pertinent information into the FPS2 from the FPS1.

4. The FPS2 is optimized to support evolving user needs and changes are executed through release management coordinated with the CMS and other partners.

5. The FPS2 system is technically sound, operations, system performance and security meet all requirements, and the system is stable and available to users in the production environment for the management of CMS program integrity workload.

6. Assist in supporting users of the predictive analytic reports with any needed interpretation of finding and address user feedback. The type and level of user support shall include telephone and email support from 6:00 a.m to 9:00 p.m. Eastern Standard Time zone , 5 workdays per week.

7. Implement FPS2 system with case management capabilities that enables review and tracking of predictive model outputs and results by all CMS partners supporting enrollment, payment processing, investigations, audit, and enforcement.

8. Integrate edit module in the claims authorization processing and document the change order request to permit implementation of Edits.

9. Continually test and refine the predictive modeling and integrity of the results with CMS and the CMS modeling contractor to minimize false positives, refine the taxonomy of classifications, score the issues to support prioritization and continuously improve the model and/or edit based on user feedback.

10. Define agreed to metrics to measure implementation results and outcomes that can be computed and reported directly from the predictive modeling system.

FPS2 SOW 06/04/2015 P a g e | 10

11. Generate frequent (daily or more frequent) output reports in the format(s) accepted for use by

Medicare Administrative Contractors (MACs), Recovery Auditor Contractors (RACs) Recovery Audit CPI program staff, Zone Program Integrity Coordinators (ZPICs), or other entities responsible for payment, audit, or investigation. The reports shall identify high-risk claims (i.e., fraud, waste, or abuse), and indicate those claims where payment has been prevented until the claim is validated.

12. Coordinate delivery of reported analytic findings and results to users. The users of the predictive analytic findings, including the MACs, RACs ZPICs and PSCs will take action based on analytic reports.

13. Support users of the predictive analytic reports with any needed interpretation of finding and address user feedback. The type and level of user support shall include telephone and email support.

14. Implement a system/tool that enables review and tracking of predictive model outputs and results by all CMS partners supporting enrollment, payment processing, investigations, audit, and enforcement.

15. Models transitioning from FPS1 shall be recreated and implemented directly in FPS2 by the CMS Modeling Contractors.

16. New Models shall be developed and implemented directly in FPS2 by CMS Modeling Contractor(s).

17. Before a model is implemented in FPS2 production environment, CMS Model Owners will review the algorithms and/scripts and test in the mirrored system environment.

18. The contractors shall consult and work collaboratively with CMS Model Owners and Modeling Contractors to ensure effective models are implemented into the predictive modeling systems.

19. Business Intelligence Reporting Tools (Dashboard) connect to the live FPS2 system and allows drill-down capabilities to claims level.

20. FPS2 shall be 508 Compliant.

21. FPS2 shall be technically sound and provide acceptable system performance.

22. Maintain CMS Authority to Operate (ATO) and/or CMS interim ATO for hosting the predictive modeling system and/or authorization using CMS data sources and business intelligence at the Contractor’s facility.

FPS2 SOW 06/04/2015 P a g e | 11

3.2 Project Timeframe

The FPS2 system shall be delivered in logical and achievable project increments. The following roadmap outlines the expected short-, medium-, and long-term goals and objectives for incremental delivery of a successful FPS2 system.

Base Period:

FPS2 System Requirements and Design: This phase concentrates on discovery and design. PI business processes will be assessed and translated to business requirements. The Technical Requirements Document, Data Models and Mapping, Business Workflows, System Design Document, and Database Design Document will be completed. An implementation plan and schedule shall be prepared for release of the first increment of capability that addresses plans for training, customer relationship management, and transition to support.

FPS2 System Development, Integration and Testing: This phase concentrates on system development, validation readiness, documentation and training materials, and authorization for implementation of the initial increment of capability of the FPS2 system. The Contractor is responsible for development, integration, and testing, and will participate in verification in the CMS-furnished IT environments. The FPS shall be running in Production within the Base Performance Period.

Initial Legacy Data Migration Activities: Legacy data will be migrated to the new FPS2 system in incremental project efforts that may occur before the FPS2 system is available to users in the production environment. During the Base Period, CMS may require the Contractor to perform data management and support legacy data migration from FPS2. Additional legacy data migration activities may be performed in Option Periods one and two.

FPS2 System Implementation: This phase concentrates on implementation and delivery of training, customer relationship management, and transition to support for the new ZPICs/PCSs Contractors or legacy contractors and government users. This phase may begin in the Base Period and continue into Option Period One as determined by progress on system development and need to accommodate the transition in of new users.

Option Periods:

FPS2 System Enhancements: The Contractor shall enhance the FPS2 system to meet evolving CMS business requirements to support new features, new users, and legacy data migration during routine release cycles. Future releases may be required to support new Centers for Medicare & Medicaid Services or expanded PI authorities, enhance capabilities to support new stakeholders and users, or interface with other CMS systems.

Enhanced Predictive Modeling: Continue to refine and enhance the predictive modeling, report results, and support users.

FPS2 SOW 06/04/2015 P a g e | 12

3.3 Assumptions and Constraints

CMS recognizes the following assumptions and constraints for the performance of the FPS2 project:

3.3.1 Assumptions

1. The work required by this SOW shall be performed at the Contractor’s own facilities

2. The Contractor shall acquire all hardware and software and prepare the environments for:

• Development

• Test

• Validation

• Integration

• Production

• Training/demonstration

• Disaster recovery

3. Models transitioning from FPS1 and new models shall be developed by CMS model owners and the Model Contractor; however, implementation shall be completed directly in FPS2 by the FPS2 Contractor.

4. All Edits in FPS2 shall have the same functionality as they currently have in FPS1.

5. Before a model is implemented in FPS2 production environment, the CMS Model Owners and/or Model Contractor(s) need to review the algorithms and scripts to validate the build of the model logic used to implement is correct.

6. The Contractor shall consult and work collaboratively with CMS Model Owners and CMS Modeling Contractors to ensure effective models are implemented into the predictive modeling systems.

7. Business Intelligence Reporting Tools (Dashboard) connect to the live FPS2 system and allows drill-down capabilities to claims level.

8. FPS2 shall be 508 Compliant.

9. FPS2 shall provide technically sound, provide system performance as outlined in the requirements to include fast response time and application security, and is stable and available to the users.

10. FPS2 will support bi-directional integration with the CMS Unified Case Management (UCM) system at the time of its initial release to production.

FPS2 SOW 06/04/2015 P a g e | 13

11. Future system releases shall prioritize the business need for FPS2 integration with other CMS systems.

3.3.2 Constraints

1. FPS2 will only be accessible through CMSNet via approved, dedicated connections or Virtual Private Network (VPN).

2. The Contractor shall secure CMS data at the Contractor’s facility and ensure the system complies with Federal Information Security Management Act (FISMA). All CMS systems must undergo a Security Test & Evaluation (ST&E) prior to accreditation or reaccreditation including security controls testing. The ST&E assists in validating that appropriate management, operational, and technical security controls are implemented for the information system.

The information security risk assessment and minimum security requirements for this system shall be based on “Moderate” impact level data.

3. The expected level of background investigation for Contractor personnel shall be role-based according to the sensitivity and impact of positions performed under this contract.

4. The CMS Technical Review Board (TRB) must approve all software and hardware technologies and products selected by the Contractor before implementation.

5. The Contractor shall follow the CMS Governance process when responding to CMS Change

Requests (CR). The Contractor shall have a comprehensive understanding of the Marketplace business requirements.

6. The Contractor shall be capable of working under aggressive time constraints to successfully fulfill the requirements of this SOW.

7. The Contractor shall maintain a cooperative and professional approach during all interactions with CMS staff and other CMS-designated contractors.

8. All Contractor personnel shall participate in and complete CMS Information Security Awareness Training.

9. Contractor personnel who are required to obtain a CMS badge shall undergo a background investigation at the Contractor expense.

10. The Contractor shall not design, implement, or maintain any customized or proprietary utilities, tools, reporting systems, etc., without prior approval in writing from the Contracting Officer’s Representative (COR).

11. The Contractor shall receive prior approval, in writing, from the COR before introducing any new Commercial Off-The-Shelf (COTS) products or proprietary software utilities.

FPS2 SOW 06/04/2015 P a g e | 14

12. The activities and deliverables of this contract shall comply with the guidance in the CMS Technical Reference Architecture and associated Supplements, as well as CMS IT policies, procedures, and standards.

13. The Contractor activities and deliverables under this contract shall comply with CMS Data Administration and Database Administration Standards and Guidelines.

14. The Contractor activities and deliverables under this contract shall comply with CMS Information Security Acceptable Risk Safeguards (ARS).

15. The Contractor activities and deliverables under this contract shall comply with the CMS Expedited Life Cycle (XLC) Framework.

16. All products, including software, system tool(s) and all utilities developed to support the activities and deliverables of this contract, shall be the property of CMS. The Contractor shall deliver all products, including software and utilities, and deliverables of this contract IAW the prescribed schedule for deliverables or at the request of CMS upon termination of this contract.

17. The Contractor shall provide training to its personnel on any software and tools that are included in the CMS Technical Reference Architecture and required for the performance of this contract. The Contractor shall provide training to CMS staff on any Contractor provided unique software and tools upon CMS’ request.

18. The Contractor shall be responsible for purchasing any hardware and software needed to accomplish their tasks at the Contractor location(s).

19. The Contractor shall be required to establish network connectivity to CMS. Contractors who have existing connectivity to CMS through circuits provided on CMSNet (formerly the Medicare Data Center Network or MDCN), may use those circuits to establish connectivity for their employees engaged in work on CMS tasks. All employee workstations communicating with CMSNet shall conform to the CMS standard desktop configuration and abide by the CMS Desktop Features and Specifications.

20. All Contractor users shall comply with the Department of Health and Human Services (DHHS) Rules of Behavior (see applicable attachment). Contractor personnel who do not have connectivity to the CMSNet, or those who need to provide their personnel with remote access to CMS, shall provide their personnel with CMS VPN-based remote access over Internet broadband connections. Contractor workstation configurations shall comply with the requirements defined in the current version of “VPN Process Instructions for CMS Contractors”.

These requirements include a CMS standard desktop configuration, an Rivest, Shamir and Adleman (RSA) token supported by CMS, a currently patched operating system, current anti-virus software, and a current version of the VPN client used by CMS.

21. Where timeframes are stated, CMS may choose to give time consideration to unforeseen circumstances. Therefore, deliverable due dates are as stated unless otherwise agreed to by CMS and the Contractor. Changes in due dates shall be agreed to in writing by the CO, the COR

FPS2 SOW 06/04/2015 P a g e | 15 and the Contractor Throughout this document, unless specifically denoted as workday(s), all timeframes are in calendar weeks, calendar months, calendar days. In addition the due dates delivery will be 5:00 pm EST, close of business, unless otherwise agreed to by CMS and the Contractor.

22. The Contractor shall be responsible for the disposition of the data and information collected for this contract.

23. The Contractor shall use the current CMS standard desktop suite for all deliverables, plus additional tools as specified in the requirements for each mandatory task.

24. The Contractor shall sign a CMS Data Use Agreement (DUA) in order to protect confidential data.

25. The Contractor’s Program Management software shall compatible with Microsoft Office Project software.

26. The Contractor shall integrate its processes with Remedy (CMS currently uses Remedy as the agency’s tracking and trouble ticket system).

3.4 General IT Requirements

This section presents the general IT requirements for performance of the FPS2 project:

The Contractor shall be responsible for hosting the FPS2.

The Contractor’s activities and deliverables shall comply with the CMS TRA and associated TRA supplements. The Contractor is bound to adhere to only those parts of the CMS TRA that apply to the work under this contract. The Contractor shall also comply with applicable CMS IT policies, procedures, and standards. These policies, procedures and standards may be found on the following site:

http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information- Technology/InformationSecurity/Information-Security-Library.html.

The Contractor’s activities and deliverables shall comply with CMS XLC Process identified in the Reference Documents.

The Contractor’s activities and deliverables shall comply with CMS Data Administration and Database Administration Standards and Guidelines identified in the Reference Documents.

The Contractor’s activities and deliverables shall be IAW CMS ARS identified in the Reference Documents.

The Contractor shall comply with the applicable security requirements related to its operation as defined in the Business Partner System Security Manual (BPSSM) (also known as IOM Publication 100-

17) found at http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-technology/InformationSecurity/Info-Security-Library-Items/CMS1223332.html http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Information-Security-Library.html http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Information-Security-Library.html http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-technology/InformationSecurity/Info-Security-Library-Items/CMS1223332.html http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-technology/InformationSecurity/Info-Security-Library-Items/CMS1223332.html

FPS2 SOW 06/04/2015 P a g e | 16

The Contractor shall produce all Design, Development, Testing, and Implementation documentation identified in the Deliverables Section of this SOW.

4. Description of Requirements

The following subsections describe the requirements for the Contractor’s performance of this SOW. The requirements consist of fourteen (14) mandatory tasks and one (1) optional task, and a description of the FPS2 required capabilities that shall be met by the Contractor for this SOW.

• Task 1 – Project Management

• Task 2 – FPS2 Requirement Analysis and Design

• Task 3 – FPS2 Development, System Integration, and Testing

• Task 4 – FPS2 Change Management and Optimization

• Task 5 – FPS2 Operational and Application Support

• Task 6 – FPS2 Help Desk

• Task 7 – Required Capabilities

• Task 8 – Implementation of Models Developed by CMS and its Contractors

• Task 9 – Development and Implementation of FPS2 Edits

• Task 10 – Enhancement to FPS2 Edits Functionality (Optional)

• Task 11 – Mirror Test Environment

• Task 12 – Implement recreated FPS1 Models in FPS2

• Task 13 – Legacy Data Management and Data Migration

• Task 14 – Integration with CMS UCM System

• Task 15 – Contract Transition

4.1 Task 1 - Project Management

The Contractor shall provide project management support for the FPS2 project as delineated in the following subsections.

4.1.1 Contractor Organization

The Contractor shall establish and operate a formal organization responsible for executing the total effort required by this SOW. The Contractor is responsible for establishing and maintaining a clear line of authority among all Contractor organizational elements under this contract. The Contractor shall establish and document all roles, responsibilities, and reporting requirements for each organizational element.

4.1.2 Project Management Plan

FPS2 SOW 06/04/2015 P a g e | 17

The Contractor shall perform all Project Management (PM) duties, including technical and business management functions, in order to plan, implement, track, report, deliver, maintain, support and update the required FPS2 System. The Contractor shall manage all activities in alignment with project management standards defined by the latest publication of the Project Management Institute’s (PMI) The Guide to the Project Management Body of Knowledge (PMBOK®), except where directed otherwise by the CMS COR. Adherence to a common set of best practice standards for project management will foster effective and integrated planning and control mechanisms and tools, significantly reduce the risk of schedule and cost overruns, reduce the likelihood and impact of negative risks and issues on the project, and increase the ability to communicate and share program implementation information between the Contractor, CMS, and other contractors and stakeholders as appropriate.

The Contractor shall develop and maintain a comprehensive Project Management Plan (PMP) that describes the Contractor’s overall PM approach. The PMP shall include, at a minimum, the following elements:

• Assumptions and constraints for project management

• Requirements management and traceability plan

• Work Breakdown Structure (WBS), WBS dictionary, and scope management plan

• Change management plan

• Configuration management plan

• Schedule management plan and project schedule

• Risk management plan

• Cost management, cost reporting, and Earned Value Management (EVM)

• Quality management and continuous process improvement plan

• Human resource management plan, contact lists, organizational structure, organizational elements, and roles and responsibilities of project personnel

• Knowledge management approach and lessons learned

• Communications and stakeholder management plan

• Subcontract management plan

The Contractor shall manage its organization IAW the contract WBS. The WBS shall be the key reference document in defining the Contractor’s structure and organization for planning, controlling, and reporting requirements under this SOW. The Contractor’s WBS shall support the FPS2 project WBS (investment level). Figure 2 depicts a notional FPS2 integrated project WBS, CMS will update and validate this WBS during the project XLC Planning Phase.

FPS2 SOW 06/04/2015 P a g e | 18

Figure 2 - Notional FPS2 Integrated Project WBS

In addition to developing and maintaining artifacts defined in the PMP, the Contractor shall perform project management activities IAW the applicable IT standards and reporting requirements established by CMS’ EA and IT Governance programs and by the CMS COR. The EA and IT Governance programs have defined CMS’ IT investment life-cycle requirements process (i.e., Capability Maturity Model Integration® (CMMI), Capital Planning and Investment Control (CPIC), and XLC phases). Where applicable, the Contractor shall use templates provided by the COR or for project management artifacts and reports that are delivered to CMS.

The Contractor shall deliver and maintain updates of:

• All XLC Project Management artifacts identified in the deliverables section of this SOW are provided as a reference. These artifacts include the PMP, project schedule, risk register, issue list, action items, decision log, and lessons learned log.

• All EVM compliance reporting to satisfy the EVM requirements of this SOW as defined in Section

8.4 EVM. This includes the WBS, WBS dictionary, organizational breakdown structure, contractor performance report (CPR) formats 1, 2, 3, 4, and 5 and any other artifacts required for the

Task 10 is optional

FPS2 SOW 06/04/2015 P a g e | 19

Integrated Baseline Review (IBR), and requests for baseline changes.

• Ongoing reports on performance requirements, service level agreements, and delivery metrics to satisfy the performance standards, quality assurance and monitoring requirements of this

SOW.

• Reports to satisfy the management review requirements of this SOW.

• Monthly financial invoice containing a status of contract expenditures and funds, including an invoice/EVM reconciliation, monthly planned spend versus actual spend, and an earned value overview containing:

Earned value graphics;

Graphic and narrative summaries of any significant data pertaining to non-earned value metrics; and, A summary of the information from the EVM reporting (CPR Forms).

All project management artifacts shall be updated periodically as appropriate and as required by the

COR.

The Contractor shall maintain the PMP throughout the life of the contract, modifying and updating the plan as necessary. All Contractor proposed changes to the PMP are subject to review and approval by the CMS COR. Changes to the scope, cost or schedule baselines require approval by the COR and CO. All Contractor proposed changes shall be made in a timely manner so as to meet the contract schedule.

4.1.3 Project Kick-off/Post–award Meeting

The Contractor shall plan and participate in an initial post-award kickoff meeting between the COR, and other participants identified by CMS. The kickoff meeting will be held at a CMS office located at the CMS Baltimore, Maryland location within ten (10) business days after contract award. At a minimum, the Contractor’s Key Personnel shall attend in person. The Contractor shall introduce its team and present its initial PMP including WBS, draft Risk Prioritization Document, Methodology Document, and an outline for the FFS Architecture Design deliverable.

The Contractor shall take meeting minutes and provide a draft version to the COR no later than 2 workdays after the meeting.

4.1.4 Coordination and Collaboration with CMS and other CMS Contractors

The Contractor shall demonstrate independent judgment while maintaining core relationships with other stakeholders both contractors and government. The Contractor shall maintain communication and coordination of work with CMS and/or CMS-designated contractors (including MACs, RACs, ZPICs, PSCs, MEDICs, CMS Modeling Contractors and other entities as appropriate) to ensure the successful management of all performance required under this contract. The Contractor shall participate in all applicable workgroups that relate to the mission, program, or project, whether these groups currently exist or are formed in the future, as required and agreed to by the COR.

FPS2 SOW 06/04/2015 P a g e | 20

The Contractor shall be proactive in notifying CMS of any developing situation, risk, or issue that may impact service delivery or any other contractual issue. The Contractor shall promptly notify the COR of any indication that a potential problem may be developing. The Contractor shall coordinate and cooperate with CMS to address all risks and identify mitigation strategies. The Contractor shall monitor integration points and interdependencies with external projects or systems and assess impacts of external project interdependencies on the scope and schedule for work required under this contract.

4.1.4.1 Zone Program Integrity Contractors/Program Safeguard Contractors (“ZPICs/PSC”)

The primary goals of the ZPICs/PSCs are to provide a vehicle to promote the integrity of the Medicare and Medicaid programs by accomplishing the following objectives:

• Identify, stop and prevent Medicare and Medicaid fraud, waste and abuse and refer instances of potential fraud, waste and abuse to the appropriate law enforcement agencies.

• Decrease the submission of abusive and fraudulent Medicare and Medicaid claims.

• Recommend appropriate administrative action (e.g., payment suspension recommendations and

CMPs) to CMS as necessary IAW Medicare and Medicaid laws and regulations, etc., to ensure that appropriate and accurate payments for services are made, which are consistent with all Medicare and Medicaid rules and regulations.

• Coordinate potential fraud, waste and abuse with appropriate Medicare & Medicaid Entities

(MMEs).

The ZPICs/PSCs will be the primary source of investigation for alerts from the predictive modeling system FPS 2.0. Therefore, the Contractor shall ensure that the risk scoring module provides sufficient data to assist the ZPICs/PSCs in investigations, and that they are able to interpret and use the data they receive to investigate alerts appropriately. The Contractor may also leverage the ZPIC’s/PSC’s experience and data in fine-tuning the risk scoring module. The Contractor shall develop a method for receiving feedback from the ZPICs/PSCs on the outcomes of results provided.

4.1.4.2 Medicare Administrative Contractors (“MAC”)

The MACs serve as the providers’ primary point-of-contact for enrollment, training on Medicare coverage and billing requirements, and the receipt, processing, and payment of Medicare Fee for Service(FFS) claims within their respective jurisdictions. The MACs perform all core claims processing operations for both Part A and Part B. The FFS claims are processed by the following systems for the MACs:

• Multi-Carrier System (MCS) for all FFS Part B claims;

• Fiscal Intermediary Standard System (FISS) for all FFS Part A claims; and, FPS2 SOW 06/04/2015 P a g e | 21

• Viable Information Processing Systems (VIPS) for all FFS DME claims.

The Contractor shall closely coordinate with the MACs to ensure that they receive output in a format they can use, to ensure that they receive any ad-hoc reports that they require, and to ensure that they are able to interpret and use the data they receive to stop payments appropriately.

4.1.4.3 Recovery Auditor Contractors (“RAC”)

The RACs identify and correct Medicare Improper payments through the efficient detection and collection of overpayments made on claims of health care services provided to Medicare beneficiaries, and the identification of underpayments to providers so that the CMS can implement actions that will prevent future improper payments in all 50 states.

Each Recovery Auditor is responsible for identifying overpayments and underpayments in approximately ¼ of the country. The Recovery Audit Program jurisdictions match the DME MAC jurisdictions. There are 4 regions (A, B, C and D). The Recovery Audit Program jurisdictions match the DME MAC jurisdictions.

It may be necessary for the Contractor to leverage the experience and data of the RAC to assist in the implementation of Models and Edits. If Task 10 (optional) is executed, it will be imperative the Contractor works closely with the RAC to ensure coding is properly created and implemented.

4.1.4.4 Virtual Data Centers (“VDC”)

The VDCs are a source of Medicare claims data. The primary function of the VDC is to provide application hosting and information services to meet present and future legislative mandates while ensuring CMS’ ability to meet increasing computing and claims processing demands. Currently, all shared systems data processing is done at the VDCs.

The Contractor shall ensure that data can be exchanged with the VDCs both as input to models and as output to real time monitoring of claims processing.

4.1.4.5 Medicare Drug Integrity Contractors (MEDIC)

The MEDICs are tasked with finding Medicare Part D trends that may indicate fraud and abuse, investigate potential fraudulent activities, conducting fraud complaint investigations and referring cases to the appropriate law enforcement agency as needed.

The Contractor shall ensure that reports made available to MEDICs provide sufficient data for investigations, and that they are able to interpret and use the data to investigate fraud appropriately.

The Contractor may also wish to leverage the MEDICs experience and fraud investigations in fine-tuning the predictive analytic system.

FPS2 SOW 06/04/2015 P a g e | 22

4.1.4.6 CMS Modeling Contractors

The CMS Modeling Contractors developed the models currently in FPS1. For FPS2, the system will provide a collaborative environment for CMS and its contractors to develop, score and test models. The system shall track and record the development process, algorithms and scripts necessary to incorporate effective predictive models and for approval. The CMS and its Modeling Contractors will, in addition, perform rigorous User Acceptance Testing (UAT) and ensure the models pass all phases of testing before the models are implemented. This UAT is independent of the system testing to be performed by the FPS2 Contractor.

4.1.5 Joint Operating Agreements

When necessary, the Contractor shall execute a Joint Operating Agreement (JOA) with CMS-designated contractors. The JOA will define the mutually agreed roles, responsibilities, and cost-effective methods to work together in support of the CMS mission. The JOA shall clearly describe the work that needs to be accomplished and the roles and responsibilities of each signatory for the success of the task or project under this contract. It will include specifics about who shall do what, when, and for whom. The JOA shall also define the process the parties shall follow if either believes that the other is not following the agreement. The Contractor shall be responsible for identifying, negotiating, and addressing any changes to the appropriate roles and responsibilities of JOA parties. JOAs shall be updated at least annually.

4.1.6 Project Status Meetings and Reports

The Contractor shall coordinate and participate in all project status meeting with the contract team to discuss status, progress, risks, and issues (as defined by the COR) and delivering periodic status reports to CMS.

Cancellation or changes to the meeting format require prior approval by the CMS COR. These meetings shall be held on a weekly basis unless determined otherwise by the COR.

In addition to meeting and reports detailed in other SOW task, the Contractor shall:

• Conduct a post-award IBR within 180 days of award to establish the Performance Management Baseline (PMB) upon which the Contractor’s monthly EVM reports shall be delivered.

• Participate in weekly project meetings (by telephone or in person by mutual agreement) with the CMS COR/Business Functional Lead (BFL) and other CMS representatives and contractors as necessary to discuss current status of the project, key challenges and accomplishments, and upcoming activities.

• Arrange meetings (by phone or in person by mutual agreement) with CMS project stakeholders and contractors, and other CMS representatives as necessary to coordinate the proper workflow of activities to accomplish the SOW performance objectives.

• Develop agendas and electronic post-meeting summary notes for all regularly scheduled and ad hoc critical action meetings. Summary notes should specify critical action steps, outstanding

FPS2 SOW 06/04/2015 P a g e | 23 issues, follow-up activities, and decisions, and be distributed to attendees and any CMS-approved distribution list.

• Deliver status and other project reports as directed by the COR.

• Develop status briefings in PowerPoint and present topics related to the project activities for presentation to internal CMS stakeholders as needed and appropriate to support project integration and implementation.

• Participate as necessary as a member or ad hoc contributor on the change control boards (CCB) for other CMS systems, whether in production or development, that either interface with or otherwise affect the project activities of this contract.

4.1.7 FPS2 Transition Planning and Management

The Contractor shall manage all aspects of planning for transition to the new FPS2, communicating with CMS and its stakeholders, and supporting the rollout of the new FPS2 to users.

The Contractor shall develop, update, and maintain a Transition Management Plan that delineates the processes and approaches for:

• Effective communications and coordination with CMS and stakeholder users to communicate project status, and address questions or concerns

• An overall framework for managing and coordinating FPS2 user on-boarding and FPS2 new user training that will take place as part of the new FPS2 system rollout.

• Proposed or planned approaches to and schedules for legacy data migration and associated data management activities (Task 13).

Once CMS has approved the Transition Management Plan, the Contractor shall provide transition planning and management support in that may include the following activities:

• Identify stakeholder points of contact

• Support business process transition activities and coordinate implementation schedules for rollout of the FPS2 system

• Implement regular stakeholder communications procedures, including procedures to address stakeholder questions or concerns, handle the resolution of the questions/concerns and determine outcomes or the current status

• Establish regular communications for project status, questions, or concerns.

FPS2 SOW 06/04/2015 P a g e | 24

• Maintain statistics that support the Award Fee and approved SLAs.

• Manage on-boarding of new FPS2 users.

• Manage delivery of user training.

• Support legacy data migration activities (Task 12).

4.1.8 Enterprise Change Control

All changes and modifications to the FPS2 system shall go through a change management process to be defined by the Enterprise Change Control Board (CCB) and comprised of agency officials. The Contractor shall manage release of all agreed changes to the FPS2 system; the Contractor shall manage all changes related to infrastructure and tool upgrades.

The Contractor shall:

• Assist CPI, the business owner, in documenting and communicating system change proposals to the Enterprise CCB.

• Ensure that proposed changes comply with regulatory constraints.

• Participate in the Enterprise CCBs as a representative of CPI.

• Communicate approved changes to stakeholders.

4.2 Task 2 - FPS2 Requirements Analysis and Design

The Contractor shall assume control of the initial business requirements described in this SOW and translate them into functional requirements.