ESBD_354867_1714149931529_HHS0014117 RFO Texas Health Care Information Collection.pdf

Version 2.10 Revision Date 09/12/2023 RFO No. HHS0014117 Page 1 of 75

Cecile E. Young, Executive Commissioner

Request for Offer (RFO) for

Texas Health Care Information Collection Health Care Data Collection System

RFO No. HHS0014117

Date of Release: April 26, 2024

Deadline for Submission of Solicitation Responses:

May 28, 2024 by 10:30 a.m. Central Time

NIGP Class/Item Codes 920-02 *Access Services, Data

920-05 *Application, Infrastructure, Hosting, Data Hosting and Cloud Computing Services, Vendor Hosted and Internally Hosted

920-14 *Applications Software, Mainframes and Servers

920-21 *Data Entry Services

(*) Automated Information Systems (AIS)

Revision Date 09/12/2023 RFO No. HHS0014117 Page 2 of 75

Table of Contents Article I. Introduction, Definitions, and Authority

1.1 Introduction

1.2 Definitions

1.3 Authority

Article II. Scope of Work

2.1 Contract Phases

2.2 Staffing Requirements

2.2.1 Staffing Key Performance Measures

2.2.2 Project Management Requirements

2.3 Deliverable Requirements

2.4 Transition Phase

2.4.1 Transition Requirements

2.4.2 Transition Key Performance Measures

2.5 Operations Phase

2.5.1 Communications Requirements

2.5.2 Quarterly Certification Requirements

2.5.3 Solution Report Requirements

2.5.4 Testing Requirements

2.5.5 Training Requirements

2.5.6 Technical Support Requirements

2.5.7 Software Maintenance and Support Requirements

2.5.8 Security and Access Requirements

2.5.9 Solution Requirements

2.5.10 Solution Key Performance Measures

2.5.11 Solution User Interface Requirements

2.6 Turnover Phase

2.7 Voluntary Product Accessibility Template (VPAT)

2.8 Supplemental Services

2.9 Reduced Services

2.10 Contract Award, Term, and Historical Compensation

2.11 Data Use Agreement and Security Privacy Inquiry

Revision Date 09/12/2023 RFO No. HHS0014117 Page 3 of 75

2.12 No Guarantee of Volume, Usage, or Compensation

Article III. Administrative Information

3.1 Schedule of Events

3.2 Ambiguity, Conflict, or Discrepancy

3.3 Inquiries

3.3.1 Sole Point of Contact

3.3.2 Prohibited Communication

3.3.3 Exception to Sole Point of Contact

3.3.4 Solicitation Questions

3.4 Pre-proposal Conference/HSP Training

3.4.1 Attendance

3.4.2 Conference Logistical Information

3.4.3 Questions at Pre-Proposal Conference/HSP Training

3.5 Solicitation Response Composition

3.5.1 General Information

3.5.2 Page Limit and Supporting Documentation

3.5.3 Discrepancies

3.5.4 Exceptions

3.5.5 Assumptions

3.5.6 Binding Offer

3.6 Solicitation Response Submission and Delivery

3.6.1 Deadline

3.6.2 Submission Option

3.6.3 Submission Checklist

3.6.4 Labeling and Delivery for USB Submission and Other Materials

3.6.5 Modifications and Withdrawals

Article IV. Solicitation Response Evaluation and Award Process

4.1 Conformance with State Law

4.2 Best Value Determination

4.2.1 Selection Methodology

4.2.2 Minimum Qualifications

Revision Date 09/12/2023 RFO No. HHS0014117 Page 4 of 75

4.2.3 Initial Compliance Screening

4.2.4 Written Solicitation Response Evaluation

4.2.5 Written Response Evaluation Criteria

4.2.6 Best and Final Offer

4.2.7 Final Written Response Score

4.2.8 Summary of Best Value Determination

4.2.9 Final Consideration for Award Data Center Services Hosting Costs

4.3 Questions or Requests for Clarification

Article V. Narrative/Technical Proposal

5.1 Narrative Proposal

5.1.1 Executive Summary

5.1.2 Project Work Plan

5.1.3 Key Personnel Profiles

5.2 Technical Proposal

5.2.1 Technology Architecture

5.2.2 Solution Availability and Capacity

5.2.3 Software and Hardware Components

5.2.4 Solution Integration

5.2.5 Solution Administration, Support, and Maintenance

5.2.6 Solution Security and Disaster Recovery

5.2.7 Performance Monitoring and Management

Article VI. Required Respondent Information

6.1 Company Information

6.1.1 Company Narrative

6.1.2 Company Profile

6.2 Franchise Tax – Right to Transact Business in Texas

6.3 References

6.4 Major Subcontractor Information

6.5 Affirmations and Certifications

6.6 Other Reports

6.6.1 Dun and Bradstreet Reports

Revision Date 09/12/2023 RFO No. HHS0014117 Page 5 of 75

6.6.2 Financial Statements and Financial Solvency

6.6.3 Alternate Report

6.7 Corporate Guarantee

6.8 HUB Subcontracting Plan

6.9 Secretary of State Certification

Article VII. Cost Proposal

7.1 Cost Proposal

7.1.1 Transition

7.1.2 Operations and Maintenance

Article VIII. General Terms and Conditions

8.1 General Conditions

8.1.1 Changes, Modifications, and Cancellation

8.1.2 Offer Period

8.1.3 Costs Incurred

8.1.4 Contract Responsibility

8.1.5 Public Information Act - Respondent Requirements Regarding Disclosure

8.1.6 Respondent Waiver – Intellectual Property

8.1.7 Standards of Conduct for Vendors

8.1.8 Disclosure of Interested Parties

8.2 Insurance

8.2.1 Required Coverage

8.2.2 Alternative Insurability

8.3 Protest

Article IX. List of Exhibits

Revision Date 09/12/2023 RFO No. HHS0014117 Page 6 of 75

Table of Tables Table 1, Key Personnel Descriptions and Qualifications Table 2, Staffing Requirements Table 3, Staffing Key Performance Measures Table 4, Project Management Requirements Table 5, Deliverables Requirements Table 6, Transition Requirements Table 7, Transition Key Performance Measures Table 8, Communication Requirements Table 9, Quarterly Certification Requirements Table 10, Solution Report Requirements Table 11, Testing Requirements Table 12, Training Requirements Table 13, Technical Support Requirements Table 14, Software Maintenance and Support Requirements Table 15, Security and Access Requirements Table 16, Solution Requirements Table 17, Solution Key Performance Measures Table 18, Solution User Interface Requirements Table 19, Turnover Requirements

Revision Date 09/12/2023 RFO No. HHS0014117 Page 7 of 75

ARTICLE I. INTRODUCTION, DEFINITIONS, AND AUTHORITY

1.1 INTRODUCTION

The State of Texas, by and through the Health and Human Services Commission (HHSC), for and on behalf of the Texas Department of State Health Services (DSHS), issues this Request for Offer (RFO) to solicit a vendor that will provide a Solution which will allow for inpatient, outpatient, and emergency department claims data collection, validation, corrections, and certifications;

develop new or modified processes or reports; and provide helpdesk services to support the Texas Health Care Information Council legislation in accordance with the Scope of Work (“SOW”) and other requirements contained in this Solicitation.

The 74th Texas Legislature created the Texas Health Care Information Council in 1995. The program name was subsequently changed to Texas Health Care Information Collection (THCIC) by DSHS. THCIC collects data and reports on health care activity in hospitals and facilities operating in Texas. The goal of THCIC is to provide information enabling Texas consumers and health plan purchasers to make informed health care decisions to positively impact the cost and quality of care in Texas. The THCIC legislation is codified in Texas Health and Safety Code, Chapter 108 and Title 25 Texas Administrative Code Chapter 421.

HHSC PCS will administer the procurement process for this Solicitation, which includes RFO publication, handling of communications from Respondents, as well as managing the receipt of Solicitation Responses for review and evaluation.

To be considered for award, a Respondent must execute Exhibit A, HHS Solicitation Affirmations v.2.4 and provide all other required information and documentation as set forth in this Solicitation.

Information regarding HHSC or DSHS and its programs is available online and can currently be accessed at https://www.hhs.texas.gov/ and https://www.dshs.texas.gov/.

1.2 DEFINITIONS

Refer to Exhibit B, Health and Human Services (HHS) Uniform Terms and Conditions (UTC) – Vendor, v.3.4, Exhibit D, HHS Data Use Agreement, v.8.5, Exhibit H, 5010 Outpatient THCIC 837 Technical Specifications, and Exhibit I, 5010 Inpatient THCIC 837 Technical Specifications, for additional definitions.

As used in this Solicitation, unless a different definition is specified or the context clearly indicates otherwise, the following terms and conditions have the meanings assigned below:

“Addendum” means a written clarification or revision to this Solicitation issued by HHSC PCS and posted to the ESBD.

https://statutes.capitol.texas.gov/Docs/HS/htm/HS.108.htm https://statutes.capitol.texas.gov/Docs/HS/htm/HS.108.htm https://texreg.sos.state.tx.us/public/readtac$ext.ViewTAC?tac_view=4&ti=25&pt=1&ch=421 https://www.hhs.texas.gov/ https://www.dshs.texas.gov/

Revision Date 09/12/2023 RFO No. HHS0014117 Page 8 of 75

“Award Consideration (AC) Documents” means documents Respondent must submit as part of the Solicitation Response to be considered for negotiations or award.

“Business Day(s)” means any day (24-hour period) in which normal business operations of HHSC are conducted (e.g., excludes weekends and the national holidays specified in Section 662.003 of the Texas Government Code).

“Calendar Day(s)” means each day shown on the calendar beginning at 12:00 Midnight and ending at 11:59 p.m. the following day, including Saturdays, Sundays, and national and State holidays listed in Texas Government Code § 662.003.

“Contract Term” means the period of time beginning with the commencement date or Effective Date of a Contract resulting from this Solicitation and ending when the Contract expires in accordance with its terms, or when it has been terminated.

“Cloud Computing” Consistent with Sections 2054.0593(a) and 2157.007 of the Texas Government Code, has the meaning assigned by Special Publication 800-145 issued by the United States Department of Commerce National Institute of Standards and Technology, as the definition existed on January 1, 2015. (https://csrc.nist.gov/publications/detail/sp/800-145/final) enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This cloud model is composed of five essential characteristics, three service models, and four deployment models.

“Contract Manager” means the single Point of Contact (POC) for DSHS for matters concerning the Contractor's performance under the Contract. This person shall have the authority to make decisions that are binding to the Contractor, shall be responsible for timely completion of the project, and shall be responsible for meeting all contractual obligations.

“Contractor’s Solution” or “Solution” means the software, computer hardware, and network and telecommunications equipment and software used by Contractor to perform the Services.

“DSHS” has the same meaning as the definition in Exhibit B, Health and Human Services (HHS) Uniform Terms and Conditions (UTC) – Vendor, v.3.4.

“Downtime” means the total time the Solution is out of service or offline.

“Effective Date” has the same meaning as the definition in Exhibit B, Health and Human Services (HHS) Uniform Terms and Conditions (UTC) – Vendor, v.3.4.

“Encounter Record” means a patient level electronic record that contains information on all inpatient services rendered for a patient episode of care by a provider in a hospital.

“ESBD” means the Electronic State Business Daily, the electronic marketplace where State of Texas bid opportunities over $25,000 are posted. The ESBD may currently be accessed at http://www.txsmartbuy.com/esbd.

http://www.txsmartbuy.com/esbd

Revision Date 09/12/2023 RFO No. HHS0014117 Page 9 of 75

“Event Record” means a patient level electronic record that contains information on all outpatient services rendered for a patient episode of care by a provider in an outpatient Facility hospital or ambulatory surgical center.

“Extraordinary Event” means a circumstance in which an event or discrete set of events has occurred or is planned with respect to the operations of HHSC that results or will result in a reduction in the nature or volume of the Services that DSHS will require from Contractor.

“Facility” means a health care Facility required to report data to the System Agency via the Contractor’s Solution in accordance with Health and Safety Code, Section 108.002(10) and Title 25 Texas Administrative Code, Sections 421.2, 421.62, and 421.72.

“Final Written Response Score” refers to the final scoring of the written response as documented in the Solicitation.

“Health Care Professional” or “HCP” means a physician or other health care practitioner contracted to or employed by a Facility.

“HHSC” means the Health and Human Services Commission.

“HHSC PCS” means Procurement and Contracting Services (PCS), a division of HHSC.

“HUB” means Historically Underutilized Business, as defined by Chapter 2161 of the Texas Government Code.

“HUB Subcontracting Plan” or “HSP” means written documentation regarding the use of subcontractors, which is required to be submitted with all responses to state agency contracts with an expected value of $100,000 or more where the state agency has determined subcontracting opportunities are probable. The HSP subsequently becomes a provision of the awarded Contract and shall be monitored for compliance by the state agency during the term of the Contract.

“Key Personnel” means any vendor staff who are essential to the performance of the Services requested under this Solicitation.

“Operations” means the Contract phase following Transition during which the Contractor provides a complete collection of software, Services, and equipment integrated and functioning together as a system.

“Outsourced Services” means services performed by an entity that utilizes its proprietary or licensed Software as a Service (SaaS) and infrastructure to provide business or data management processes to customers.

“Qualified Substitute” means an individual meeting the requirements of the Key Personnel position they are temporarily filling.

“Respondent” means the individual or entity responding to this Solicitation.

“Services” has the same meaning as the definition in Exhibit B, Health and Human Services (HHS) Uniform Terms and Conditions (UTC) – Vendor, v.3.4.

Revision Date 09/12/2023 RFO No. HHS0014117 Page 10 of 75

“Software as a Service” or “SaaS” for the purpose of this Solicitation, means the service model described by the National Institute of Standards and Technology (NIST) in Special Publication No. 800-145 (https://csrc.nist.gov/publications/detail/sp/800-145/final) to be the capability provided to the consumer to use the provider’s applications running on a cloud infrastructure. The applications are accessible from various client devices through a thin client interface such as a web browser (e.g., web-based e-mail). The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited User-specific application configuration settings.

“Solicitation” means this RFO including all exhibits, attachments, forms, and Addenda, if any.

“Solicitation Consideration (SC) Documents” means documents that must be submitted by Respondent with the Solicitation Response in order to be considered for evaluation and cannot be resubmitted or have errors remedied after the submission due date and time in the Schedule of Events has passed.

“State” means the State of Texas and its instrumentalities, including HHSC or DSHS, and any other state agency, its officers, employees, or authorized agents.

“Submitting Organization” means the entity that submits data on behalf of one or more Facilities to the System Agency through the Contractor’s Solution.

“Third-Party Agents” means the entity that submits data on behalf of one or more Facilities to the System Agency through the Contractor’s Solution.

“Texas Health Care Information Collection” or “THCIC” means the program within DSHS responsible for implementing Texas Health and Safety Code, Chapter 108.

“Transition” means the Contract phase that occurs prior to the Operations phase, during which activities are performed by the Contractor to prepare systems and resources for Operations.

“Turnover” means the Contract phase that occurs after Operations and that is required to turnover system functionality, processes and necessary data required by the Contract to DSHS or a successor service provider. Turnover begins 180 Calendar Days prior to the end of the Contract Term.

“TX-RAMP” means the Texas Risk and Authorization Management Program established by the Texas Department of Information Resources (DIR) that provides a standardized approach for security assessment, authorization, and continuous monitoring of Cloud Computing services that process the data of a state agency.

“Unanticipated Change” refers to a material change in the technologies or processes available to provide all or any portion of the Services which is outside the normal evolution of technology experienced by the Services, that was not generally available as of the Contract Effective Date and that would materially reduce the Contractor's cost of providing the Services.

Revision Date 09/12/2023 RFO No. HHS0014117 Page 11 of 75

“User” means anyone with an account within the Contractor’s Solution (e.g., provider Users, submitter Users, agency Users, facility Users).

“VPTS” means Vendor Performance Tracking System, as defined under Section 2262.055 of the Texas Government Code and Title 34 of the Texas Administrative Code Part 1, Chapter 20, Subchapter B, Division 2, Rule §20.115 and Subchapter F, Division 2, Rule §20.509.

1.3 AUTHORITY

HHSC, on behalf of DSHS, is soliciting the services stated in this Solicitation under the authority of Texas Government Code § 2157.068(e-4), § 2157.006(a)(2); and Texas Administrative Code, Title 1, Part 15, Chapter 391, Subchapter B, Rule §391.213.

ARTICLE II. SCOPE OF WORK

2.1 CONTRACT PHASES

The Contractor shall provide Services, as described in this Scope of Work (SOW), in three (3) phases:

A. Transition, Section 2.4;

B. Operations, Section 2.5; and

C. Turnover, Section 2.6.

2.2 STAFFING REQUIREMENTS

The Contractor shall provide all staff resources necessary to perform the Services described in this SOW, unless specifically stated as the responsibility of DSHS or another entity. This section does not identify all required staff, it only identifies the Contractor’s required Key Personnel.

The requirements listed in Table 1, Key Personnel Descriptions and Qualifications below includes a list of Key Personnel and their required minimum qualifications.

Table 1, Key Personnel Descriptions and Qualifications

Role Description Qualifications

Project Manager

Represents the Contractor and oversees the day-to-day activities of

The Project Manager must meet the following qualifications:

https://statutes.capitol.texas.gov/Docs/GV/htm/GV.2262.htm#2262.055 https://texreg.sos.state.tx.us/public/readtac$ext.TacPage?sl=R&app=9&p_dir=&p_rloc=&p_tloc=&p_ploc=&pg=1&p_tac=&ti=34&pt=1&ch=20&rl=115 https://texreg.sos.state.tx.us/public/readtac$ext.TacPage?sl=R&app=9&p_dir=&p_rloc=&p_tloc=&p_ploc=&pg=1&p_tac=&ti=34&pt=1&ch=20&rl=509

Revision Date 09/12/2023 RFO No. HHS0014117 Page 12 of 75

Table 1, Key Personnel Descriptions and Qualifications

Role Description Qualifications the project. This individual shall serve as DSHS primary POC for all operational matters.

A. A minimum of seven (7) years' project management experience managing projects of size and scope similar to the Contract, preferably in the healthcare industry. Relevant experience must have occurred within the three (3) years immediately preceding the issuance date of this Solicitation.

B. Project management experience must include each phase of the Solution development life cycle.

Contract Manager

Serves as the single POC for DSHS for matters concerning the Contractor's performance under the Contract. This person shall have the authority to make decisions that are binding to the Contractor, shall be responsible for timely completion of the project, and shall be responsible for meeting all contractual obligations.

The Contract Manager must have a minimum of five (5) years' contract management experience managing contracts for related Services with similar budgets, preferably in the healthcare industry and for a project similar in size and scope to the Contract.

During the Contract Term, Contractor must provide staffing services that include, but are not limited to the requirements listed in in Table 2, Staffing Requirements, which include providing qualified, knowledgeable, trained, professional staff to install, configure, manage, and maintain the Contractor's Solution. Refer to Exhibit C, Additional Provisions for additional staffing information.

Table 2, Staffing Requirements

Req ID Requirements

STF-1 Provide Key Personnel no later than two (2) Calendar Days following the Contract Effective Date. These Key Personnel must be available during all configuration activities. Key Personnel must not hold more than one (1) key role unless otherwise approved by DSHS.

STF-2 Provide DSHS with written notification ten (10) Business Days prior to making any changes in Key Personnel and obtain DSHS written approval before making such changes.

Revision Date 09/12/2023 RFO No. HHS0014117 Page 13 of 75

Table 2, Staffing Requirements

Req ID Requirements

STF-3 Key Personnel positions may not be vacant for more than five (5) Business Days without a Qualified Substitute. A Qualified Substitute must be in place no more than five (5) Business Days after the separation date of the vacating resource or as negotiated and approved by DSHS.

STF-4 Key Personnel replacements must meet the minimum qualifications for the position and must be in place no later than 30 Calendar Days from the separation date of the vacating resource.

STF-5 Commit an adequate level of technical and human resources sufficient to complete the project within the required time frame and to meet the project quality requirements outlined in this SOW. The level of technical and human resources which the Contractor agrees to commit to the project at the time of proposal must be maintained during the Contract Term at a level to complete the SOW.

2.2.1 Staffing Key Performance Measures

The requirements listed in Table 3, Staffing Key Performance Measures below describe the level of required Contractor performance for staffing under the Contract and associated liquidated damages.

Table 3, Staffing Key Performance Measures

Req ID Key Performance Measures Liquidated Damages

STF-6 Provide a DSHS approved Qualified Substitute for any vacancy in Key Personnel positions no later than five (5) Business Days of staff separation date unless an extension is approved by DSHS.

$1,000 per Business Day per occurrence following the deadline for filling a vacancy for a Key Personnel position.

STF-7 Fill a vacant Key Personnel position with a permanent replacement no later than 30 Calendar Days from the vacancy date (a position is considered vacant even with the substitute replacement serving in that role).

$500 per Business Day after 30 Calendar Days a Key Personnel position is vacant without a permanent replacement.

2.2.2 Project Management Requirements

The Contractor shall perform, manage, and control all tasks and activities according to an industry-recognized Project Management Institute (PMI®) System Development Life Cycle (SDLC) methodology.

https://www.pmi.org/pmbok-guide-standards/foundational/pmbok

Revision Date 09/12/2023 RFO No. HHS0014117 Page 14 of 75

The requirements listed in Table 4, Project Management Requirements describe the tasks and activities that must be performed by the Contractor during the Contract Term.

Table 4, Project Management Requirements

Req ID Requirements

PM-1 Update all documentation (e.g., User and training documentation) as necessary during the Contract Term.

PM-2 Report, within 24 hours of discovery, any potential Contract compliance deficiencies and operational issues to DSHS that impact service delivery to facilities, providers, submitting organizations, or DSHS.

PM-3 Report, within 24 hours of discovery, any operational deficiencies, discrepancies, and issues and provide plans for addressing discovered items.

PM-4 Respond to all complaints and inquiries submitted by DSHS by the due date and time requested.

PM-5 Comply with all sections of the Americans with Disabilities Act (ADA), Web Content Accessibility Guidelines (WCAG) 2.0 (or most current version), and Section 508 of the Rehabilitation Act.

PM-6 Request meetings and provide agendas with no less than one (1) Business Day notice.

PM-7 Provide meeting minutes within two (2) Business Days of meeting adjournment.

PM-8 Submit 100% of invoices accurately and remedy any found errors within 24 hours of said error being found.

PM-9 Submit 100% of invoices to DSHS for approval monthly by the tenth (10th) Business Day of each month.

Contractor must submit its invoices for payment to DSHS via email to it_invoicing@hhs.texas.gov within the time frames established under this Contract.

Contractor must maintain and submit with each invoice documentation supporting the provision of Services and substantiating the costs incurred and the invoice submitted for payment. At a minimum, the invoice must include:

A. Contractor’s legal name;

B. State of Texas Vendor number or federal Tax Identification number;

C. Contractor’s address;

D. Contractor’s telephone number;

E. Invoice number;

Revision Date 09/12/2023 RFO No. HHS0014117 Page 15 of 75

Table 4, Project Management Requirements

Req ID Requirements

F. Purchase Order Number;

G. State agency Contract number;

H. State agency and division name;

I. Description of Services provided;

J. Date(s) of Service;

K. If a Subcontractor(s) is required to provide Services, an attached explanation of benefits for the Subcontractor(s) Services rendered;

L. The name and telephone number of a person designated by the Contractor to answer questions regarding the invoice; and M. Documentation supporting the Services, and substantiating costs incurred for the invoice provided to DSHS.

2.3 DELIVERABLE REQUIREMENTS

The requirements listed in Table 5 Deliverables Requirements below describe the Deliverables that must be provided by the Contractor during the Contract Term. Deliverables include the plans and documentation necessary to prepare for, implement, manage, and maintain the requirements of the Contract.

Table 5, Deliverables Requirements

Req ID Requirements Due Date Frequency

DEL-1

The Contractor must develop, execute, maintain, and submit a Project Management Plan (PMP) to provide a comprehensive baseline of the goals of the project, how the Contractor shall achieve those goals, the personnel and entities that need to be involved, how the Contractor shall report and measure reaching the project’s goals, and how the Contractor shall communicate to DSHS regarding the project. The PMP must include the following:

Due 14 Calendar Days after Contract Effective Date and within five

(5) Business Days of any update made.

One-Time As required by

DSHS

Revision Date 09/12/2023 RFO No. HHS0014117 Page 16 of 75

A. Communication Plan;

B. Change Management Plan;

C. Staffing Management Plan;

D. Risk Management Plan; and E. Issue Management Plan.

The PMP is a living document that evolves as the project progresses and the Contractor must update the PMP with the latest relevant information.

The PMP may be broken into separate documents, but all documents will be considered sections of the PMP.

DEL-2

Develop, execute, maintain, and submit a Communication Plan as part of the PMP. The Communication Plan must provide a description of the types of communication that will occur on the project and how the communication will be managed. The Communication Plan must include the following and ensure the approach addresses communication with DSHS:

A. Types and means of communication details;

B. Communication channels;

C. Communication flow within the

Contractor’s organizational structure;

D. Escalation processes;

E. Guidelines for meetings;

F. Dissemination of knowledge; and G. Means of ensuring communication effectiveness.

(See DEL-1) (See DEL-1)

DEL-3

maintain, and submit a Change Management Plan, as part of the PMP, that includes written, trackable, and diagrammatic representation, describes the processes and procedures to be used to initiate, evaluate, review, and resolve any change requests that occur

Revision Date 09/12/2023 RFO No. HHS0014117 Page 17 of 75 both before and after the Contractor’s Solution is implemented.

DEL-4

maintain, and submit a Staffing Management Plan as part of the PMP approved by HHSC.

The staffing management plan must describe how the Contractor shall meet all requirements outlined in Table 2, Staffing Requirements.

DEL-5

maintain, and submit a Risk Management Plan, as part of the PMP, which must include, at a minimum, the following:

A. Proactive identification and analysis of risks before they become issues, including methods, tools, and techniques;

B. Development of risk avoidance, transfer, mitigation, or management strategies;

C. Approach to monitoring, communicating, reporting of risk status, including procedures for documenting, resolving, and reporting issues and risks identified by the Contractor or DSHS;

D. Approach to root cause analysis;

and

E. Description of how risks will be quantified and qualified.

DEL-6

The Contractor must develop, execute, maintain, and submit an Issue Management Plan, as part of the PMP, which must include at a minimum, the following:

A. Approach to issue management;

B. Issue management process steps including:

Revision Date 09/12/2023 RFO No. HHS0014117 Page 18 of 75

1. Approach to prioritizing, tracking, escalating, communicating, and reporting issues;

2. Approach to documenting, reporting, and resolving issues identified by the Contractor or

DSHS;

C. Approach to impact analysis;

D. Tools, and techniques for active and ongoing identification and monitoring of issues;

E. Roles and responsibilities; and F. Describe how issues will be quantified and qualified.

DEL-7

and submit a detailed Project Work Schedule (PWS) that is aligned with the SOW. The PWS must identify detailed tasks, realistic person hours for each task, the sequence of tasks and activities including duration necessary to meet Deliverable and PWS milestone dates.

Due 14 Calendar Days after Contract Effective Date.

(See DEL-1)

DEL-8

and submit a Project Service Level Agreement and Management Plan that defines a reporting mechanism to ensure Deliverables are managed within established due dates.

Due 14 Calendar Days after Contract Effective Date.

DEL-9

and submit a Transition Plan which will convey all the components of the Contractor’s technical approach to implementing the Contractor’s Solution functionality in a phased program, ensuring that the Contractor’s Solution is built with scalable architecture.

A. This transition plan shall provide the overarching methodology to incorporate project planning, knowledge transfer, User acceptance and quality assurance

Due 14 Calendar Days after Contract Effective Date.

Revision Date 09/12/2023 RFO No. HHS0014117 Page 19 of 75 methodology for the life and success of the project.

B. Contractor’s transition plan shall include:

1. Detailed schedule including all related activities, key milestones and Deliverables.

2. Outline of procedures to be followed during each migration and installation.

3. Identification of key issues and risks that need to be addressed during the migration and installation.

The Contractor’s transition plan shall also include all tasks and Deliverables (and leverage necessary resources) needed to transition the Contractor’s Solution to a steady state environment. This shall include but is not limited to:

A. Documentation and knowledge transfer.

B. Configuration Item transfer.

C. Proposed transition schedule and key transition milestones.

DEL-10

maintain, and submit for DSHS approval, a Security Plan (SP) to document the current level of security controls within the Contractor’s Solution that protects the confidentiality, integrity, and availability (CIA) of the Contractor’s Solution and its information.

The SP must address the following topics:

A. Adherence to HHSC requirements outlined in the “Security and Privacy Controls Requirements” document, included in Exhibit E, Texas Health and Human

Due 21 Calendar Days after Contract Effective Date.

One-time

Annually and as Requested by

Revision Date 09/12/2023 RFO No. HHS0014117 Page 20 of 75

Services Information Security and Privacy Requirements.

B. Acceptable Risk Safeguards (ARS) to assess CIA and NIST SP 800-53 Rev 4 at a "moderate" control level;

C. Physical security;

D. Network segmentation, access controls, and forensics;

E. Application security and data sensitivity classification, including Protected Health Information (PHI) and Personally Identifiable Information (PII);

F. Intrusion detection and prevention;

and

G. Encryption of data at rest and in transit.

The SP is a living document, and the Contractor shall update the SP when new vulnerabilities are identified and mitigated, and when additional functionality and/or components are implemented. Contractor will submit an updated copy of the SP to DSHS for approval within five (5) Business Days of any revision. Further guidance is located on the Vendor Resources site.

(https://www.hhs.texas.gov/doing-business-hhs/contracting-hhs/vendor-resources#risk-assessment-report-and-system-security-plan)

DEL-11 The Contractor will deliver a Security Assessment Report in accordance with the Security Assessment Report and Attestation Guideline (https://www.hhs.texas.gov/sites/def ault/files/documents/doing-business-with-hhs/contracting/security-assessment-report-attestation-guideline.pdf) no later than 40

Due 40 Calendar Days after Contract Effective Date.

One-time

Annually and as Requested by

DSHS

https://www.hhs.texas.gov/doing-business-hhs/contracting-hhs/vendor-resources#risk-assessment-report-and-system-security-plan https://www.hhs.texas.gov/doing-business-hhs/contracting-hhs/vendor-resources#risk-assessment-report-and-system-security-plan https://www.hhs.texas.gov/doing-business-hhs/contracting-hhs/vendor-resources#risk-assessment-report-and-system-security-plan https://www.hhs.texas.gov/doing-business-hhs/contracting-hhs/vendor-resources#risk-assessment-report-and-system-security-plan https://www.hhs.texas.gov/sites/default/files/documents/doing-business-with-hhs/contracting/security-assessment-report-attestation-guideline.pdf https://www.hhs.texas.gov/sites/default/files/documents/doing-business-with-hhs/contracting/security-assessment-report-attestation-guideline.pdf https://www.hhs.texas.gov/sites/default/files/documents/doing-business-with-hhs/contracting/security-assessment-report-attestation-guideline.pdf https://www.hhs.texas.gov/sites/default/files/documents/doing-business-with-hhs/contracting/security-assessment-report-attestation-guideline.pdf https://www.hhs.texas.gov/sites/default/files/documents/doing-business-with-hhs/contracting/security-assessment-report-attestation-guideline.pdf

Revision Date 09/12/2023 RFO No. HHS0014117 Page 21 of 75

Calendar Days after the Security Plan submission to DSHS.

Refer to the security control baseline identified in Table 1 of Exhibit E, Security and Privacy Controls Requirements.

DEL-12

The Contractor shall develop, execute, and submit a Release Management Plan outlining procedures for release and deployment of Contractor Solution components, of future software upgrades and enhancements.

Contractor shall be responsible for collaboratively working with the System Agency to plan, schedule, deploy, and test releases deployed into Contractor’s environment.

Due 45 Calendar Days after Contract Effective Date.

DEL-13

and submit a Test Plan. The Test Plan must document and describe the overall test strategy, the test criteria, and the testing activities. Execution of the plan shall determine the Solution’s readiness for release to the production environment. The Test Plan must include, but not be limited to, Contractor’s proposed:

A. Testing Support;

B. User Acceptance Testing;

C. Load and Stress Testing;

D. Operational Readiness

Assessment; and E. Operational Readiness Results

Report

Due 45 Calendar Days after Contract Effective Date.

DEL-14

and submit a Training Plan that, at a minimum, addresses the following:

A. Solution administrator guide, which includes but is not limited to:

1. Solution functional diagram;

Due 60 Calendar Days after Contract Effective Date.

Revision Date 09/12/2023 RFO No. HHS0014117 Page 22 of 75

2. Solution setup and orientation;

3. Solution configuration;

4. Solution maintenance;

5. User account administration;

and

6. Solution interfacing

B. Support documentation, which includes but is not limited to:

1. Methods for contacting

Contractor support; and

2. Service Level Agreements or equivalent.

C. User guides written in both English and Spanish.

DEL-15 Provide and maintain annually, a Disaster Recovery Plan.

The Disaster Recovery Plan must address, at a minimum, the following:

A. Retention and storage of backup files and software;

B. Hardware backup for critical solution components;

C. Facility backup;

D. Backup for any telecommunications links and networks;

E. Backup procedures and support to accommodate the loss of any online communications;

F. A detailed file backup plan, procedures, and schedules, including rotation to an off-site storage facility;

G. The off-site storage facility must provide security of the data stored there, including protections against unauthorized access or disclosure

Due 60 Calendar Days after Contract Effective Date

Annually and as Requested by

Revision Date 09/12/2023 RFO No. HHS0014117 Page 23 of 75 of the information, fire, sabotage, and environmental considerations;

H. An enumeration of the prioritized order of restoration for Contractor's Solution; and

I. Provide a short-term uninterruptible power supply to facilitate an orderly shutdown of the Solution in the event of a primary power source loss.

2.4 TRANSITION PHASE

The Transition Phase requirements include those activities that must be completed between the Contract Effective Date and Operations start date. The Contractor shall work with DSHS and the outgoing services provider to transition the services included in the Contract on a schedule approved by DSHS in writing. Transition requires intense focus on knowledge transfer (i.e., sharing or dissemination of knowledge) of all functions identified within this SOW, to ensure that all DSHS designated personnel acquire sufficient understanding of the Services under the Contractor’s Solution's functionality to achieve a successful and seamless transition into Operations. Transition is complete once; (1) DSHS determines that the Contractor has successfully completed all Transition activities, and (2) DSHS provides written notice to the Contractor to proceed with the commencement of the Operations phase.

2.4.1 Transition Requirements

The requirements listed in Table 6 Transition Requirements below describe the tasks and activities that must be performed by the Contractor during the Transition Phase.

Note: All transition requirements listed in Table 6, Transition Requirements are due 90 Calendar Days after the Contract Effective Date.

THIS SPACE INTENTIONALLY LEFT BLANK

Revision Date 09/12/2023 RFO No. HHS0014117 Page 24 of 75

Table 6, Transition Requirements

Req ID Requirements

TRN-1 Conduct collaborative Transition design sessions to address all gaps between the Contractor’s Solution and the business requirements identified during requirements validation.

TRN-2 Recommend ways to resolve each functional or operational gap, as defined in requirements validation, that will produce the desired business outcomes.

TRN-3 Provide training on the Solution for User Acceptance Testing (UAT) testers. The Contractor shall provide updated User and Solution documentation to UAT testers to support the UAT effort.

Training must be provided in accordance with the approved Training Plan.

TRN-4 The Contractor shall perform a Load and Stress Test (LAST) prior to release into the production environment to ensure the Contractor’s Solution can meet the volume needs of DSHS.

TRN-5 Provide operational readiness test results demonstrating that the Solution meets all performance measures as defined in the SOW.

TRN-6 Develop Operational Readiness Results Report (ORR) that demonstrate the actual Solution’s characteristics and the procedures to ensure that all service requirements are met, and User documentation accurately reflects the deployed functionality of the Contractor’s Solution.

TRN-7 Conduct a walkthrough with DSHS to validate the operational readiness of the Contractor and the Solution.

TRN-8 Obtain formal written approval from DSHS on the Operational Readiness Results Report prior to the Contractor proceeding to implement the Solution.

2.4.2 Transition Key Performance Measures

The requirements listed in Table 7, Transition Key Performance Measures below describe the level of performance required by the Contractor for Transition and associated liquidated damages.

Table 7, Transition Key Performance Measures

Req ID Key Performance Measures Liquidated Damages

TRN-9 The Contractor must complete all activities identified during Transition that are needed to satisfy operational readiness, no later than the operational readiness review date in the DSHS-

$25,000 per Business Day for failure to meet the completion of all key transition milestones by the operational readiness review date.

Revision Date 09/12/2023 RFO No. HHS0014117 Page 25 of 75 approved Project Work Schedule or alternate date approved by DSHS. (See Table 6, Transition Requirements.)

2.5 OPERATIONS PHASE

Operations services include all Contract requirements for ongoing functions.

2.5.1 Communications Requirements

The communications tasks and activities are designed to promote clear, comprehensive, and effective communication between Contractor, Providers, and DSHS.

The requirements for communications listed in Table 8, Communication Requirements below describe the tasks and activities that must be performed by the Contractor during the Contract Term.

Table 8, Communication Requirements

Req ID Requirements

COM-1 Notify the appropriate User, as defined by DSHS, of planned Solution events (e.g., major Solution changes and Solution planned outages) via DSHS approved communication methods at least 15 Calendar Days in advance of implementing the change.

COM-2 Coordinate with DSHS to produce and maintain accurate and comprehensive educational materials, including but not limited to, training, job aids, computer-based training, User guides, and publications according to DSHS approved content, format, and schedules. Update training materials concurrent with Solution changes.

If emergency changes must be implemented (i.e., for security reasons), training materials should be produced within two weeks of the implemented change.

2.5.2 Quarterly Certification Requirements

Solution certification requirements encompass the tasks and activities performed by the Contractor to perform claims data certification.

The requirements listed in Table 9, Quarterly Certification Requirements below, describe the functionality, features, and capabilities that must be part of the Contractor's services during the Contract Term.

Revision Date 09/12/2023 RFO No. HHS0014117 Page 26 of 75

Table 9, Quarterly Certification Requirements

Req ID Requirements

CRT-1 Provide the capability within the Contractor’s Solution to allow Facility Users to generate their quarterly certification data before the scheduled correction due date.

See Exhibit G, Report Requirements.

CRT-2 Prohibit Facility Users from generating their quarterly certification data before the scheduled correction due date unless the data is 100% error free.

CRT-3 Generate quarterly Certification Data Reports for facilities which have not generated their own certification data by the scheduled due date. See Exhibit G, Report Requirements, page 4 (see subsection 2.2).

CRT-4 Maintain the capability to certify claims data using one of the following certification options:

A. Certify with No Comments;

B. Certify with Comments – Comments Required; or C. Elect Not to Certify - Comments Required.

Comments must be limited to five hundred (500) characters of text.

CRT-5 Generate and make available for Facility download, THCIC quarterly certification data according to the schedule defined in Chapter 421, Title 25, Part 1 of the Texas Administrative Code, Subchapter D, RULE §421.66. (Currently defined as: within 30 Calendar Days after the correction period for each quarter). The current schedule can be viewed at: https://www.dshs.texas.gov/texas-health-care-information-collection/Facility-reporting-requirements/data-reporting-schedule.

CRT-6 Generate a data file containing certification data for each Facility. Make the file available within the Contractor’s Solution for download. The file will be generated in non-proprietary Windows readable ASCII text format.

CRT-7 Do not include the following data in the quarterly generated data file:

A. Those claims for which a matching final claim is not included in the claims submitted for the reporting quarter and their frequency type code indicates that they must void, replace, or modify a claim.

B. Those interim claims that cannot be consolidated into an encounter because the final discharge claim is not included in the claims submitted for the reporting quarter.

C. Those claims determined to be a duplicate.

D. Any claims having a discharge/statement through date earlier than the beginning of the previous reporting quarter.

https://www.dshs.texas.gov/texas-health-care-information-collection/facility-reporting-requirements/data-reporting-schedule https://www.dshs.texas.gov/texas-health-care-information-collection/facility-reporting-requirements/data-reporting-schedule

Revision Date 09/12/2023 RFO No. HHS0014117 Page 27 of 75

Table 9, Quarterly Certification Requirements

Req ID Requirements

CRT-8 Make certification data available in the Contractor’s Solution within 24 hours of request from a Facility User.

CRT-9 Notify the Facility (primary, alternate and certifier of record) contacts when certification data is available for review and certification in the Contractor’s Solution.

CRT-10 Prohibit editing of certified claims data.

CRT-11 Provide the capability to de-certify data to allow for late claims corrections during the DSHS defined certification period.

CRT-12 Notify the Facility Primary, Alternate and Certifier of Record contacts when quarterly data for a given reporting quarter has been certified in the Contractor’s Solution.

CRT-13 Provide the capability within the Contractor’s Solution to modify scheduled due dates at the request of DSHS.

CRT-14 Notify DSHS when the THCIC quarterly data files are available for download.

CRT-15 Provide a solution which will allow secure downloading of the THCIC quarterly data files via the Contractor’s Solution User interface. (See Exhibit V, Quarterly Data File Format)

2.5.3 Solution Report Requirements

Solution reporting requirements encompass the tasks and activities performed by the Contractor to perform claims data reporting.

The requirements listed in Table 10, Solution Report Requirements below, describe the functionality, features, and capabilities that must be part of the Contractor's Services during the Contract Term.

Table 10, Solution Report Requirements

Req ID Requirements

RPT-1 Contractor’s Solution must provide all reports in Exhibit G, Report Requirements.

2.5.4 Testing Requirements

The requirements below describe the procedures to be used to perform and complete all testing of the Contractor’s Solution to attain all required Solution functionality and DSHS approval prior to initial deployment and any subsequent changes.

Revision Date 09/12/2023 RFO No. HHS0014117 Page 28 of 75

Testing requirements listed in Table 11, Testing Requirements below, describe the functionality, features, and capabilities that must be part of the Contractor's Services during the Contract Term.

Table 11, Testing Requirements

Req ID Requirements

TST-1 Provide a testing environment available to DSHS authorized Users for UAT and other purposes, as defined by DSHS.

TST-2 Provide access to DSHS authorized Users for testing and other purposes, as defined by DSHS. The System Agency, with the assistance of the Contractor, shall assess the performance of the complete Contractor’s Solution.

The Contractor shall provide the System Agency personnel access to the Contractor’s Solution, via web accessibility or other agreed upon method. The System Agency, with the assistance of the Contractor, shall assess the performance of the complete Contractor’s Solution.

TST-3 Provide data files to DSHS containing representative samples of current and up to date claims records for use in testing. Claims data must be representative of all Facility and claim types and in the amended THCIC 837 format. The following testing criteria apply:

A. System Agency will employ testing processes that conform to industry standard criteria applicable to systems comparable in functionality and complexity to Contractor’s Solution to determine whether the Contractor’s Solution meets or exceeds DIR, HHSC, and the System Agency minimum operational, and security requirements.

B. Online web User interface and Database processing time should be less than 2 seconds and batch processing should be less than one minute in processing time without interruptions. The testing shall include testing the Contractor Solution's components (including infrastructure configuration and network configuration) to evaluate one or more properties of interest, including whether the components:

1. Meet the requirements that guided its design and development.

2. Respond correctly to all kinds of inputs.

3. Batch file system shall process 120,000 claims, 241 Facilities concurrently and response time must be less than one (1) minute and without interruptions.

4. Online web system shall process 241 Facilities concurrently and response time must be less than two ( 2) seconds and without interruptions.

5. Database system shall process 120,000 claims, 241 Facilities concurrently and response time must be less than two (2) seconds and without interruptions.

Revision Date 09/12/2023…