Draft SOO - Part D Transaction Facilitator.pdf

Part D Transaction Facilitator — Statement of Objectives (SOO)

CMS — For Official Use Only | Page 1

Statement of Objectives (SOO) — Part D Transaction Facilitator

Statement of Objectives (SOO)

Part D Transaction Facilitator

1. Background

The Centers for Medicare & Medicaid Services (CMS) administers the Medicare Part D prescription drug benefit program. A critical component of Part D administration is the coordination of benefits (COB) between Medicare Part D plans and other payers, including non- Part D plans providing prescription drug coverage. CMS requires a Part D transaction facilitation contractor to support the accurate tracking of True Out-of-Pocket (TrOOP) costs, facilitate eligibility queries, and ensure secure and compliant exchange of protected health information (PHI) in accordance with Health Insurance Portability and Accountability Act (HIPAA) and applicable federal regulations.

CMS seeks a contractor to provide transaction facilitation services that support the Medicare Part D COB program. The contractor shall bring innovative, efficient, and compliant solutions to meet the objectives described herein.

2. Scope

This Statement of Objectives (SOO) describes the high-level outcomes and objectives CMS seeks to achieve through this acquisition. Offerors are required to submit, as part of their technical proposal, a Performance Work Statement (PWS) and a Quality Assurance Surveillance Plan (QASP) that describe how they will meet these objectives and how performance will be measured and monitored.

The appendices referenced herein (Appendices A through I) define technical specifications, data formats, matching criteria, and transaction standards that shall remain unchanged and must be incorporated into the offeror's proposed PWS.

CMS — For Official Use Only | Page 2

Referenced Appendices (unchanged and incorporated by reference):

• Appendix A – HHS Contractor Non-Disclosure Agreement

• Appendix B – Baseline Deliverables

• Appendix C – Medicare Part D Eligibility Index

• Appendix D – Medicare Part D Eligibility Verification Transactions (E1), Financial

Information Reporting Transactions (FIR), Supplemental Payment Information Transactions (Nx), and Hospice Nx.

• Appendix E – Transaction Payer Sheets

• Appendix F – FIR Mass Retrigger Dates

• Appendix G – Real-time Nx Process

• Appendix H – E1 Matching Logic

• Appendix I – BIN/PCN Routing Supplemental Transaction

3. Contract Type

This is a Firm-Fixed-Price (FFP) contract with a Time-and-Materials (T&M) Order-level materials (OLMs) Contract Line Item Number (CLIN) for each period.

4. Offeror Submission Requirements

In response to this SOO, offerors shall submit the following as part of their technical proposal:

1. Performance Work Statement (PWS): A detailed PWS describing the offeror's approach to achieving each objective stated in Section 5 of this SOO. The PWS shall describe the specific tasks, methods, processes, staffing, tools, and technologies the offeror will employ.

The PWS must incorporate all technical requirements contained in Appendices A through I.

2. Quality Assurance Surveillance Plan (QASP): A QASP that identifies measurable performance standards, Acceptable Quality Levels (AQLs), surveillance methods, and remedies for each performance objective in the PWS. The QASP shall align to the performance objectives and framework described in Section 6 of this SOO.

CMS — For Official Use Only | Page 3

5. Performance Objectives

Objective 1: Part D Transaction Facilitation

CMS seeks accurate, timely, and compliant processing of Part D Coordination of Benefits (COB) related transactions between Medicare Part D plans and other payers. The tasks listed below require require a 24/7 real-time, on-line switching network and connectivity with pharmacies, other pharmacy switches, Part D plan sponsors, and other payers, providers, and other entities as designated by CMS

The Contractor shall:

• Maintain the Medicare Part D Eligibility Index (Appendix C) provided by CMS;

• Use the Medicare Part D Eligibility Index (Appendix C) to accept and respond to pharmacy-initiated or from CMS approved entities eligibility queries;

• Build a database of primary Part D and supplemental payer BIN/PCNs;

• Accept from pharmacies, payers and other switches Part D related transactions and route these transactions to the appropriate entity;

• Identify and accept supplemental claims transactions from pharmacies, payers and switches, and create and route transactions reporting supplemental claims data to the Part D plans;

• Create and route automated TrOOP balance transfer transactions to Part D plans and accept responses to these transactions.

• Create and route coordination of benefits, other coverage enrollment information and other data as defined by CMS.

• Utilize existing commercial IT system(s) to support this objective.

CMS — For Official Use Only | Page 4

Objective 2: HIPAA-Compliant Business Associate Agreement (BAA) Execution

CMS seeks full compliance with the HIPAA Privacy Rule (45 CFR Parts 160 and 164) in the exchange of Protected Health Information (PHI) between the Part D Transaction Facilitator and Medicare Part D plan sponsors. The contractor shall achieve outcomes including, but not limited to:

• Execution of a signed BAA with each Medicare Part D prescription drug plan sponsor prior to the exchange of TrOOP information.

• Maintenance of BAA execution rates such that no more than 10% of plan sponsors require amendment to the standard language agreement; the Contracting Officer's Representative (COR)/Project Officer (PO) shall be notified if this threshold is exceeded.

• Timely notification to CMS of any plan sponsor that has not executed a BAA by December 31 of each year.

• Execution of BAAs with newly identified Part D sponsors prior to the beginning of each new Part D contract year, based on a list provided by CMS no later than October 1.

• Publication of the CMS-provided standard language BAA on the contractor's website for plan sponsor access.

CMS — For Official Use Only | Page 5

Objective 3: Pharmacy Eligibility Query (E1) Support

CMS seeks reliable, accurate, and secure responses to pharmacy eligibility queries to support beneficiary access to Part D benefits at the point of sale. The contractor shall achieve outcomes including, but not limited to:

• Provision of timely and accurate responses to E1 eligibility queries using the current National Council for Prescription Drug Programs (NCPDP) standard E1 transaction, per specifications in Appendix D and Appendix E.

• Use of all official (non-audited off) records in the "Part D Contract Data" field of the Medicare Eligibility Index to determine historical, current, and future coverage, including contract information, coverage dates, and 4Rx data.

• Application of minimum matching criteria as defined in Appendix H.Compliance with CMS security and privacy standards for all E1 query responses.

• Maintenance and ongoing support of the E1 environment, including requirements analysis, design, development, quality assurance (QA), and project management.

• Implementation and management of pharmacy exclusion tables as directed by CMS.

• Publication of E1 specifications, RxBIN/PCN information, and matching criteria as defined in

Appendices E, H, and I on the contractor’s website.

CMS — For Official Use Only | Page 6

Objective 4: Disaster Recovery (DR) and System Architecture Compliance

CMS seeks a resilient, modern, and compliant system architecture that meets federal continuity of operations and security requirements. The contractor shall achieve outcomes including, but not limited to:

• Design and re-architecture of the current DR environment to comply with applicable CMS and federal guidelines.

• Maintenance of system availability, integrity, and confidentiality at a Moderate risk level in accordance with FIPS 199 and NIST SP 800-60.

• Alignment with the CMS Technical Reference Architecture (TRA), which will be provided upon request.

CMS — For Official Use Only | Page 7

Objective 5: Information Security and Privacy Compliance

CMS seeks full compliance with all applicable federal information security and privacy requirements. The contractor shall achieve outcomes including, but not limited to:

• Protection of government information and systems in accordance with the HHS Information Security and Privacy Policy (IS2P) and CMS Information Systems Security and Privacy Policy (IS2P2).

• Safeguarding of Personally Identifiable Information (PII) at a Moderate confidentiality impact level per OMB Circular A-130.

• Handling of Controlled Unclassified Information (CUI) in accordance with Executive Order 13556 and NIST SP 800-171 Rev 3.

• Immediate notification (within one (1) hour) to CMS of any new or unanticipated threats, hazards, or safeguard failures.

• Destruction of information and data in accordance with NIST SP 800-88 Rev 1 when no longer needed.

• Compliance with the Privacy Act and applicable FAR clauses.

CMS — For Official Use Only | Page 8

Objective 6: Program and Technical Management

CMS seeks transparent, accurate, and timely project management and reporting to support CMS oversight. The contractor shall achieve outcomes including, but not limited to:

• Development and maintenance of a Project Management Plan (PMP) when requested by the COR.

• Provision and maintenance of a baseline integrated project schedule using the current CMS version of Microsoft Project, or an alternative format acceptable to the COR.

• Active participation in joint management reviews with CMS (Bi-weekly or as needed), attended by persons with authority to make cost and schedule decisions.

• Active participation in MA & Part D system workgroups and meetings as directed by CMS, including preparation of materials, agendas, meeting minutes, and presentations upon request.

• Participation in status conference calls as directed by the COR.

• Preparation and submission of Monthly Status Reports as requested by the COR, including the CMS Financial Status Report Spreadsheet.

• Preparation and submission of meeting minutes documenting meeting date(s), participants, purpose, decisions reached, and action items (including responsible party and due date).

• Preparation and submission of meeting agendas for meetings where the contractor is the primary presenter, including meeting date, purpose, intended audience, and specific agenda items.

• Submission of all proposed key personnel substitutions or additions in writing to CMS at least thirty (30) days prior to the proposed substitution, including a detailed explanation and complete resume; all substitutions must have qualifications equal to or greater than the person being replaced.

CMS — For Official Use Only | Page 9

Objective 7: Transition-In Support (Optional)

CMS seeks a seamless transition of duties, responsibilities, activities, and functions from the incumbent contractor. The contractor shall achieve outcomes including, but not limited to:

• Collaboration with the previous contractor to ensure an orderly and seamless transition over approximately 3 months (or as otherwise specified by CMS).

• Transfer of all tools, data, documentation, and institutional knowledge necessary to maintain continuity of operations.

CMS — For Official Use Only | Page 10

Objective 8: Section 508 Compliance

CMS seeks full compliance with Section 508 of the Rehabilitation Act for all Information and Communication Technology (ICT) developed or delivered under this contract, in accordance with E205 Electronic Content requirements.

CMS — For Official Use Only | Page 11

6. QASP Framework

Offerors shall propose a QASP that addresses, at a minimum, the performance objectives, standards, AQLs, surveillance methods, and remedies described in this section. The Government will use the offeror's proposed QASP as the basis for performance monitoring throughout the contract. CMS reserves the right to modify the QASP by mutual agreement during the period of performance.

The QASP shall include, at a minimum, the following elements for each performance standard:

• Performance Objective — The outcome or result to be achieved.

• Performance Standard — The measurable threshold defining acceptable performance.

• Acceptable Quality Level (AQL) — The minimum level of performance the Government will accept before initiating remedies.

• Surveillance Method — How CMS will monitor and verify contractor performance.

• Remedy — The action CMS will take if performance falls below the AQL.

The table below provides the minimum QASP framework that offerors must address. Offerors are encouraged to propose additional performance standards that demonstrate their commitment to quality and innovation.

CMS — For Official Use Only | Page 12

# Performance Objective

Performance Standard

AQL Surveillance Method

Remedy

1 E1 Daily Reporting

Report E1 data submission by percent and volume

100% compliance with daily delivery.

Periodic sampling of designated mailbox via third party audit..Annual CMS review of report transmission.

Corrective Action Plan

(CAP)

required within 2 business days;

potential price reduction for sustained non-compliance.

FIR

Performance Reporting

Adjustments and reversals processed within industry-standard timeframes for online processing

100% compliance with monthly delivery

Quarterly CMS review and analysis of report.

Data used to assess Part D Sponsor

FIR

compliance.

CAP required within 5 business days;

potential price reduction for sustained non-compliance.

Missing 4Rx Reporting

Identify and report incomplete Part D contract enrollment records.

100% compliance with daily delivery.

Quarterly CMS review and analysis of report.

Data used to reconcile enrollment records.

CAP required within 2 business days;

potential price reduction for sustained non-compliance.

4 BAA

Execution — Coverage

Signed BAA executed by contractor with all Part D plan sponsors prior

100% of active Part D sponsors have

Annual review of

BAA

execution records;

CMS

CAP required within 10 business days;

potential price

CMS — For Official Use Only | Page 13 to exchange of

PHI.

executed BAAs.

verification against CMS plan sponsor list reduction for sustained non-compliance.

5 BAA

Execution — Amendment Rate

No more than 10% of plan sponsors amend the standard language

BAA.

≤ 10% amendment rate

Contractor-provided BAA status report; CMS review

CAP

required witin 10 business days;

potential price reduction for sustained non-compliance

6 BAA

Execution — New Sponsors

BAAs executed with new Part D sponsors prior to beginning of new contract year

100% of new sponsors identified by CMS (by Oct.

1) have executed BAAs before plan year start

CMS review of BAA execution records against CMS-provided new sponsor list

CAP required within 5 business days;

potential price reduction for sustained non-compliance.

Vulnerability Assessments and CMS Assets Reporting

Report system vulnerabilities

8 Information Security — Incident Notification

CMS notified within 1 hour of any new or unanticipated threat, hazard, or safeguard failure

100% compliance with 1-hour notification requirement

COR review of incident logs and notification records

Immediate escalation to

CMS ISSO;

CAP required

CMS — For Official Use Only | Page 14

9 Disaster Recovery — Compliance

DR

environment designed and maintained in compliance with CMS and federal guidelines;

system availability at Moderate risk level per FIPS

100% compliance with applicable DR and security standards

Annual DR test results;

CMS security review

CAP required within 10 business days;

potential contract action for sustained non-compliance

10 Monthly Status Reports

Monthly Status Reports (including, but not limited to:

CMS Financial Status Report Spreadsheet) submitted as requested by the COR

100% of required reports submitted on time and complete

COR review of report submissions

Written notice; CAP required if pattern of non-compliance

11 Key Personnel Substitution

All proposed substitutions submitted in writing at least 30 days prior to proposed change, with required documentation

100% compliance with 30-day advance notice requirement

COR review of personnel change requests

Written notice; CAP required

12 Section 508 Compliance

All ICT deliverables comply with Section 508 of the Rehabilitation Act (E205 Electronic Content)

100% of ICT deliverables are 508-compliant at time of delivery

COR review of 508 compliance testing results for each deliverable

Rework required at no additional cost to the Government;

CAP required

CMS — For Official Use Only | Page 15

13 Transition-In (if applicable)

Orderly and seamless transition completed within approximately 3 months or as specified by CMS

Transition completed on schedule with no disruption to ongoing operations

COR review of transition plan milestones and status reports

CAP required within 5 business days of missed milestone

CMS — For Official Use Only | Page 16

6.1 Surveillance Methods

The Government will use the following surveillance methods, as appropriate, to monitor contractor performance:

• 100% Inspection — Used for critical deliverables (e.g., security incident notifications, BAA execution, key personnel changes).

• Periodic Sampling — Used for transaction processing monitoring; sample size and frequency to be determined by the COR.

• Customer Feedback — CMS may solicit feedback from Part D plan sponsors, pharmacies, and other stakeholders regarding contractor responsiveness and accuracy.

• Validated Contractor Self-Assessment — Contractor-submitted reports (e.g., Monthly Status Reports, BAA status reports) reviewed and validated by the COR.

• Automated System Logs — System-generated logs reviewed by the COR, ISSO, and CMS Vulnerability Assessment Team for vulnerability identification and remediation..

CMS — For Official Use Only | Page 17

6.2 Remedies

The following remedies may be applied when contractor performance falls below the AQL:

3. Written Notice — COR issues a written notice identifying the performance deficiency and required corrective action.

4. Corrective Action Plan (CAP) — Contractor submits a CAP within the timeframe specified in the QASP, identifying root cause, corrective actions, and milestones for resolution.

5. Price Reduction — For sustained non-compliance on FFP CLINs, the Government may pursue a price reduction in accordance with FAR 52.246-4 or applicable contract clauses.

6. Withholding of Payment — For T&M OLM CLINs, the Government may withhold payment for hours not meeting performance standards.

7. Contract Action — For sustained or critical non-compliance, the Government reserves the right to pursue contract termination or other remedies available under the FAR.

CMS — For Official Use Only | Page 18

7. Government-Furnished Information (GFI) and Resources

CMS will provide the following to support contractor performance:

• Standard language BAA for distribution to Part D plan sponsors via the contractor's website.

• List of new Part D sponsors for the following plan year, no later than October 1 of each year.

• Pharmacy exclusion criteria for E1 responses.

• Access to the Medicare Part D Eligibility Index and related data systems.

• Technical specifications contained in Appendices A through I.

• CMS Technical Reference Architecture (TRA) document, provided upon request.

CMS — For Official Use Only | Page 19

8. Place and Period of Performance

• Place of Performance: Contractor facility and/or CMS-designated locations.

• Period of Performance: To be specified in the solicitation (Base Period + 4 Option

Periods).

CMS — For Official Use Only | Page 20

9. Key Constraints and Considerations

• All technical specifications, transaction formats, and matching criteria are defined in Appendices A–I and are non-negotiable; offerors must incorporate them into their proposed PWS.

• The contractor's website shall serve as the primary publication point for transaction facilitator specifications, BAA standard language, E1 matching criteria, and RxBIN/PCN information.

• The contractor shall not negotiate BAA amendments with more than 10% of Part D plan sponsors without notifying the PO.

• The overall information system risk level is Moderate across Confidentiality, Integrity, and Availability.

• This contract involves PII at a Moderate confidentiality impact level.

• The T&M OLM CLIN for each period is intended to cover any Order-level materials (OLMs) necessary to an offerors technical solution and shall not be used as a substitute for FFP task performance.

CMS — For Official Use Only | Page 21

10. Applicable Regulations and Standards

• HIPAA Privacy Rule (45 CFR Parts 160 and 164)

• FIPS 199

• FIPS 200

• NIST IR 7511 Rev. 5

• NIST SP 800-18 Rev. 2

• NIST SP 800-30 Rev. 1

• NIST SP 800-34 Rev. 1

• NIST SP 800-37 Rev. 2

• NIST SP 800-53 Rev. 5

• NIST SP 800-53A Rev. 5

• NIST SP 800-60, Volume II

• NIST SP 800-63-4

• NIST SP 800-137A

• NIST SP 800-171 Rev 3

• NIST SP 800-88 Rev 1

• OMB 04-04

• OMB Circular A-130

• Executive Order 13556 (CUI)

• 18 U.S.C. Chapter 31, Section 641

• FAR Subpart 2.1

• FAR 52.246-4 (Inspection of Services — Fixed Price)

• Section 508 of the Rehabilitation Act (E205 Electronic Content)

• NCPDP E1 Transaction Standards

• HHS Information Security and Privacy Policy (IS2P)

• CMS Information Systems Security and Privacy Policy (IS2P2)

• Privacy Act (US Code 2018 Title 5)

• FISMA of 2014 (44 U.S.C., Chapter 35, Subchapter II Information Security)

• US-CERT Specified Standards

• HHS IT System Inventory Management Process

• USGCB

• ARS

• TRA

• CMS PISP

• BPSSM

• CMS IS Testing Approach

CMS — For Official Use Only | Page 22

Note to Offerors: In response to this SOO, offerors shall submit a proposed Performance Work Statement (PWS) and Quality Assurance Surveillance Plan (QASP) as part of their technical proposal. The PWS shall describe, in detail, how the offeror intends to achieve each objective in Section 5. The QASP shall propose measurable performance standards, AQLs, surveillance methods, and remedies for each objective, consistent with the framework in Section

6. Appendices A–I are incorporated by reference and define binding technical requirements that must be reflected in the offeror's PWS.