ESBD_364348_1719000944064_HHS0014057v2_Patient Assistance Program Navigation Software.pdf

Version 2.10 (09/12/2023) RFO No. HHS0014057v2 Page 1 of 67

Cecile E. Young, Executive Commissioner

Request for Offer (RFO) for

Patient Assistance Program Navigation Software

RFO No.: HHS0014057v2

Date of Release: June 21, 2024

Solicitation Response Submission Deadline: July 22, 2024, by 10:30 a.m. Central Time

NIGP Class/Item Codes

Class/ Item

Code

AIS

Description

208-32* Yes Customer Relationship Management Software (CRM), Microcomputer

208-37* Yes Database Software, Microcomputer

917-55 No Information Distribution Services

920-03* Yes Application Service Provider (ASP), Web Based Hosted

920-05* Yes

Application, Infrastructure, Hosting, Data Hosting and Cloud Computing Services, Vendor Hosted and Internally Hosted

920-07* Yes

Applications Software for Microcomputer Systems: Business, Mathematical and

Statistical, Medical, Scientific, etc.

920-44* Yes Risk Management for Software Development

920-45* Yes Software Maintenance and Support Services and Updates and Data Hosting Services

948-43 No Health Information Services

949-77 No Self-insured Program, Prescription Drug

*The State of Texas has marked certain codes for information technology and related commodities and services as Automated Information System (AIS).

Version 2.10 (09/12/2023) RFO No. HHS0014057v2 Page 2 of 67

Table of Contents Article I. Executive Summary, Definitions, and Authority

1.1 Executive Summary

1.2 Definitions

1.3 Authority

Article II. Scope of Work

2.1 Program Background

2.2 Scope Overview

2.2.1 Contract Phases

2.2.2 User Base

2.2.3 Contractor Personnel

2.2.4 Deliverable Approval

2.2.5 Key Performance Measures and Associated Remedies

2.3 Solution Requirements

2.3.1 Functional Requirements

2.3.2 Texas Risk and Authorization Management Plan

2.3.3 SaaS Requirements

2.3.4 DIR Data Center Services Infrastructure

2.3.5 Status Reports

2.4 Phase I – Transition

2.4.1 Configuration Services

2.4.2 Training Services

2.4.3 Security and Compliance

2.4.4 Scalability and Availability

2.4.5 User Acceptance Testing Services

2.4.6 Go-live Services

2.5 Phase II – Operations

2.5.1 User and Volume Reports

2.5.2 Software Maintenance and Support

2.5.3 Help Desk Services

2.5.4 Response and Resolution Service

Version 2.10 (09/12/2023) RFO No. HHS0014057v2 Page 3 of 67

2.5.5 Disaster Recovery Test

2.6 Phase III – Turnover

2.7 Payments and Invoices

2.8 Enterprise License

2.9 Contract Award, Term, and Historical Compensation

2.9.1 Contract Award and Execution

2.9.2 Contract Term

2.9.3 Historical Compensation

2.10 Data Use Agreement and Security Privacy Inquiry

2.11 No Guarantee of Volume, Usage, or Compensation

Article III. Administrative Information

3.1 Schedule of Events

3.2 Ambiguity, Conflict, or Discrepancy

3.3 Inquiries

3.3.1 Sole Point of Contact

3.3.2 Prohibited Communication

3.3.3 Exception to Sole Point of Contact

3.3.4 Solicitation Questions

3.4 Pre-proposal Conference

3.4.1 Attendance

3.4.2 Conference Logistical Information

3.4.3 Questions at Pre-proposal Conference

3.5 Solicitation Response Composition

3.5.1 General Information

3.5.2 Page Limit and Supporting Documentation

3.5.3 Discrepancies

3.5.4 Exceptions

3.5.5 Assumptions

3.5.6 Binding Offer

3.6 Solicitation Response Submission and Delivery

3.6.1 Solicitation Response Submission Deadline

Version 2.10 (09/12/2023) RFO No. HHS0014057v2 Page 4 of 67

3.6.2 Submission Options

3.6.3 Submission Checklist

3.6.4 Labeling and Delivery for USB Submission and Other Materials

3.6.5 Modifications and Withdrawals

Article IV. Solicitation Response Evaluation and Award Process

4.1 Conformance with State Law

4.2 Best Value Determination

4.2.1 Selection Methodology

4.2.2 Minimum Qualifications

4.2.3 Initial Compliance Screening

4.2.4 Written Solicitation Response Evaluation

4.2.5 Written Response Evaluation Criteria

4.2.6 TX-RAMP Certification Assessment

4.2.7 Best and Final Offer

4.2.8 Final Written Response Score

4.2.9 Summary of Best Value Determination

4.3 Questions or Requests for Clarification

Article V. Narrative and Technical Proposal

5.1 Narrative Proposal

5.1.1 Executive Summary

5.1.2 Project Work Plan

5.1.3 Key Staffing Profile

5.2 Technical Proposal

5.2.1 Technology Architecture

5.2.2 System Availability and Capacity

5.2.3 Software and Hardware Components

5.2.4 System Integration

5.2.5 System Administration, Support, and Maintenance

5.2.6 System Security and Disaster Recovery

5.2.7 Performance Monitoring and Management

Article VI. Required Respondent Information

Version 2.10 (09/12/2023) RFO No. HHS0014057v2 Page 5 of 67

6.1 Company Information

6.1.1 Company Narrative

6.1.2 Company Profile

6.2 Franchise Tax – Right to Transact Business in Texas

6.3 References

6.4 Major Subcontractor Information

6.5 Affirmations and Certifications

6.6 Other Reports

6.6.1 Dun and Bradstreet Reports

6.6.2 Financial Statements and Financial Solvency

6.6.3 Alternate Report

6.7 Corporate Guarantee

6.8 HUB Subcontracting Plan

6.9 TX-RAMP Documentation

Article VII. Cost Proposal

7.1 Cost Proposal

Article VIII. General Terms and Conditions

8.1 General Conditions

8.1.1 Changes, Modifications, and Cancellation

8.1.2 Offer Period

8.1.3 Costs Incurred

8.1.4 Contract Responsibility

8.1.5 Public Information Act - Respondent Requirements Regarding Disclosure

8.1.6 Respondent Waiver – Intellectual Property

8.1.7 Standards of Conduct for Vendors

8.1.8 Disclosure of Interested Parties

8.2 Insurance

8.2.1 Required Coverage

8.2.2 Alternative Insurability

8.3 Protest

Article IX. List of Exhibits

Version 2.10 (09/12/2023) RFO No. HHS0014057v2 Page 6 of 67

Table of Tables

Table 1 – SaaS Service Requirements

Table 2 – Configuration Requirements

Table 3 – Training Requirements

Table 4 – Security and Compliance Requirements

Table 5 – Scalability and Availability Requirements

Table 6 – Contractor System Availability Service Credit Calculation

Table 7 – UAT Requirements

Table 8 – Go-live Requirements

Table 9 – User Report and Volume Report Requirements

Table 10 – Software Maintenance and Support Requirements

Table 11 – Help Desk Requirements

Table 12 – Response and Resolution Requirement Priority Levels

Table 13 – Turnover Requirements

Remainder of this page was left blank intentionally.

Version 2.10 (09/12/2023) RFO No. HHS0014057v2 Page 7 of 67

ARTICLE I. EXECUTIVE SUMMARY, DEFINITIONS, AND AUTHORITY

1.1 EXECUTIVE SUMMARY

The Texas Health and Human Services Commission (HHSC) is seeking a qualified Contractor to provide a Web-based System, Software as a Service (SaaS) Solution that contains an existing central repository or library of available drug-manufacturer and third-party prescription assistance programs available to Clients. The Solution will be used by trained Navigators at approved health-care Organization Sites or locations around the State to improve Client access to needed medications and prescription therapies, which may otherwise be cost prohibitive, by connecting uninsured or underinsured Texans with the information they need. Key Business objectives include:

a. Assisting Texas Clients in gaining access to cost prohibitive prescriptions via existing manufacturer Patient Assistance Programs (PAPs);

b. Reducing manual workload for individuals, advocates, care Navigators and other partners in the community who assist Clients in finding and applying for prescription assistance resources; and

c. Identifying financial assistance sources by navigating multiple potential Sites and programs for multiple medications while reviewing eligible criteria.

HHSC Procurement and Contracting Services (PCS) will administer the procurement process for this Solicitation, which includes RFO publication, handling of communications from vendors, as well as managing the receipt of Solicitation Responses for review and evaluation.

To be considered for award, a Respondent must execute Exhibit A, HHS Solicitation

Affirmations, v. 2.4 and provide all other required information and documentation as set forth in this Solicitation.

Prior to award of the Contract, Respondent must obtain TX-RAMP Level 2 certification or TX-

RAMP Provisional Certification.

Information regarding HHSC and its programs is available online and can currently be accessed at https://hhs.texas.gov/.

1.2 DEFINITIONS

Refer to Exhibit B, Health and Human Services (HHS) Uniform Terms and Conditions –

Vendor, v. 3.4, for additional definitions.

As used in this Solicitation, unless a different definition is specified or the context clearly indicates otherwise, the following terms and conditions have the meanings assigned below:

https://hhs.texas.gov/

Version 2.10 (09/12/2023) RFO No. HHS0014057v2 Page 8 of 67

“340B Pricing” means the pricing associated with the 340B drug pricing program. The 340B drug pricing program is a federal program that requires drug manufacturers to provide outpatient drugs to eligible health care Organizations and covered entities at significantly reduced prices.

“Addendum” means a written clarification or revision to this Solicitation issued by HHSC PCS and posted to the ESBD.

“Award Consideration (AC) Documents” means documents Respondent must submit as part of the Solicitation Response to be considered for negotiations or award.

“Business Day” means any day in which normal operations are conducted (excludes State holidays and weekends).

“Calendar Day” means each day shown on the calendar beginning at 12:00 midnight, including

Saturdays, Sundays, and holidays.

“Client” means the individual who has been prescribed a medication and is seeking assistance in completing one (1) or more applications for PAPs directly to prescription drug manufacturers or third-party prescription assistance programs.

“Contract Term” means the period of time beginning with the commencement date or Effective

Date of a Contract and ending when the Contract expires in accordance with its terms, or when it has been terminated.

“Effective Date” has the same meaning as the definition in Exhibit B, Health and Human

Services (HHS) Uniform Terms and Conditions – Vendor, v. 3.4.

“ESBD” means the Electronic State Business Daily, the electronic marketplace where State of

Texas bid opportunities over $25,000 are posted. The ESBD may currently be accessed at http://www.txsmartbuy.com/esbd.

“Final Written Response Score” refers to the final scoring of the written response as documented in the Solicitation.

“Go-live” refers to the date the Solution will be operational for use.

“HHSC” has the same meaning as the definition in Exhibit B, Health and Human Services

(HHS) Uniform Terms and Conditions – Vendor, v. 3.4.

“HHSC PCS” means Procurement and Contracting Services, a division of HHSC.

“HUB” has the same meaning as the definition in Exhibit B, Health and Human Services (HHS)

Uniform Terms and Conditions – Vendor, v. 3.4.

“HUB Subcontracting Plan” or “HSP” means written documentation regarding the use of subcontractors, which is required to be submitted with all responses to State agency contracts with an expected value of $100,000 or more where the State agency has determined subcontracting opportunities are probable. The HSP subsequently becomes a provision of the awarded Contract and shall be monitored for compliance by the State agency during the term of the Contract.

http://www.txsmartbuy.com/esbd

Version 2.10 (09/12/2023) RFO No. HHS0014057v2 Page 9 of 67

“IAM Online” means the HHSC identity and access management (IAM) platform which uses

SailPoint Identity IQ (Identity Governance and Administration) and Okta (Single Sign-on/Access

Management) to meet both the integration objectives and business requirements of the application.

“Medication” refers to a prescription drug or medication in which a Client is prescribed by a licensed physician to treat a condition.

“NIST” means National Institute of Standards and Technology. For more information, see Exhibit

M, DCS RFO Language.

“Operations” or “Operations Phase” means the phase that which the Solution is functional for use.

“Patient Assistance Program” or “PAP” means programs sponsored by pharmaceutical manufacturers and other third parties that provide medications to eligible Clients at low cost or no cost. This can include both uninsured and underinsured Clients.

“Respondent” means the individual or entity responding to this Solicitation.

“Single Sign-on” or “SSO” means an authentication process that allows Users to access multiple applications and websites with one (1) set of login credentials.

“Site” means the physical location designated by the enrolled Organization, where one (1) or more enrolled Navigators can meet in-person with Clients to complete one (1) or more applications for eligible PAPs.

“Software-as-a-Service” or “SaaS” means the service model described by NIST in Special

Publication No. 800-145 (https://csrc.nist.gov/pubs/sp/800/145/final) to be the capability provided to the consumer to use the provider’s applications running on a cloud infrastructure. The applications are accessible from various Client devices through a thin Client interface such as a web browser (e.g., web-based e-mail). The consumer does not manage or control the underlying cloud infrastructure including network, servicers, operating systems, storage, or even individual application capabilities, with the possible exception of limited User-specific application configuration settings. For more information, see Exhibit M, DCS RFO Language.

“Solicitation” means this RFO including all exhibits, attachments, forms, and Addenda, if any.

“Solicitation Consideration (SC) Documents” means documents that must be submitted by

Respondent with the Solicitation Response in order to be considered for evaluation and cannot be resubmitted or have errors remedied after the submission due date and time in the Schedule of

Events has passed.

“State” means the State of Texas and its instrumentalities, including HHSC, and any other state agency, its officers, employees, or authorized agents.

“Texas Cares Program” means the HHSC program that oversees enrollment, training, and certification of Organizations, Sites, and Navigators who will assist Texans in gaining financial assistance to prescription medications or therapies through existing drug manufacturer or third-party prescription assistance programs.

https://csrc.nist.gov/pubs/sp/800/145/final

Version 2.10 (09/12/2023) RFO No. HHS0014057v2 Page 10 of 67

“Turnover” or “Turnover Phase” means the phase which the Contractor will turnover, to HHSC, the day-to-day management of client activities, including all requisite project management activities, for the Solution.

“TX-RAMP” means the Texas Risk and Authorization Management Program established by the

Department of Information Resources (DIR) that provides a standardized approach for security assessment, authorization, and continuous monitoring of cloud computing services that process the data of a state agency. To become TX-RAMP certified, entities must submit prescribed documentation to DIR. Information regarding TX-RAMP is currently located at:

https://dir.texas.gov/texas-risk-and-authorization-management-program-tx-ramp.

“User” means an individual, who has a defined role with Texas Cares Program and Texas Cares

Program approved access to the SaaS described in this solicitation.

“VPTS” means Vendor Performance Tracking System, as defined under Section 2262.055 of the

Texas Government Code and Title 34 of the Texas Administrative Code Part 1, Chapter 20, Subchapter B, Division 2, Rule §20.115 and Subchapter F, Division 2, Rule §20.509.

“Web-Based System” is a software environment that is accessible via a web browser.

1.3 AUTHORITY

HHSC is soliciting the Services stated in this Solicitation under the authority of Texas Government

Code § 2157.068(e-1); and 1 TAC pt. 10 Ch. 212, Subchapter C, § 212.20. Additional authority is granted under Chapter 65 of the Texas Health and Safety Code; and Title 26, Texas Administrative

Code, Part 1, requiring HHSC to establish a prescription assistance program for Texans.

ARTICLE II. SCOPE OF WORK

2.1 PROGRAM BACKGROUND

The Texas Cares Program was established by House Bill (H.B.) 18, 87th Regular Session, 2021, to assist uninsured Texans in gaining access to prescription benefits. The Texas Cares Program strives to improve accessibility to prescription drugs for individuals who are unable to access comparable medications through insurance or other health care programs.

In review of the current prescription landscape, it was found that approximately 98% of the top

200 most prescribed medications are available through existing drug assistance options.

Additionally, research found that many prescription medications which are considered cost prohibitive are available through manufacturer PAPs. There is a significant need to maximize access to prescriptions through existing free and low-cost resources by increasing awareness and strategic navigation.

The Texas Cares Program seeks to increase prescription drug access for Texans through a comprehensive community-based model and SaaS Solution. With this strategy, Navigators will https://dir.texas.gov/texas-risk-and-authorization-management-program-tx-ramph https://dir.texas.gov/texas-risk-and-authorization-management-program-tx-ramph https://statutes.capitol.texas.gov/Docs/GV/htm/GV.2262.htm#2262.055 https://texreg.sos.state.tx.us/public/readtac$ext.TacPage?sl=R&app=9&p_dir=&p_rloc=&p_tloc=&p_ploc=&pg=1&p_tac=&ti=34&pt=1&ch=20&rl=115 https://texreg.sos.state.tx.us/public/readtac$ext.TacPage?sl=R&app=9&p_dir=&p_rloc=&p_tloc=&p_ploc=&pg=1&p_tac=&ti=34&pt=1&ch=20&rl=509

Version 2.10 (09/12/2023) RFO No. HHS0014057v2 Page 11 of 67 assist individuals with finding and applying for existing drug manufacturer and third-party PAPs.

The Texas Cares Program is dedicated to assisting Texans while meeting them where they are, embodying the program mission – Bringing Care Closer to Texans.

Many pharmaceutical manufacturers offer PAPs which provide medications to eligible Clients at no-cost or low-cost. There are currently over 350 known PAPs available, with varying eligibility and applications. Although there are numerous PAPs available, many providers, Clients and advocates note that program requirements can be difficult to navigate and time consuming.

Additionally, since the application forms and eligibility criteria for PAPs can change as a result of manufacturer updates, ensuring that the most up-to-date information for these programs is used can be difficult for providers, Clients and advocates.

A comprehensive community-based model SaaS Solution can facilitate the process of identifying these PAPs, and act as a single “port” of entry for Navigators to assist Clients with applications for assistance. This single “port” of entry will find and autofill applications for all PAPs that a

Client is eligible for, reducing workload and saving time.

2.2 SCOPE OVERVIEW

HHSC seeks a qualified Contractor to provide a comprehensive community-based model SaaS

Solution that meets or exceeds the requirements as specified in this Solicitation. The Contractor shall provide all software, hardware, and personnel resources necessary to implement and maintain the Solution, unless specifically stated as the responsibility of HHSC.

The Contractor must provide a Solution that can be used by HHSC to assist Clients in gaining medications and prescription therapies, which may otherwise be cost prohibitive. The Solution must include reporting and analytics, security, cataloging, processing, producing, and retaining data to meet HHSC policies. The Solution must have processing capabilities, enhanced reviewing features, comprehensive reporting, agility in handling large quantities of data, and advanced production capabilities.

The Solution must be capable of being adapted and modified to meet HHSC’s business needs through configuration. In addition, the Solution must be scalable and flexible to accommodate changes in technology, security, legislative mandates, and any other changes within the scope of this Solicitation.

The Solution must:

a. Contain an existing central repository or library of available drug-manufacturer and third-party prescription assistance programs (PAPs) available to Clients;

b. Streamline the application process, reduce errors, update the applications as needed, and aid in the search of available PAPs;

c. Act as a central point of entry to search for PAPs that a Client may qualify for, determine eligibility, and directly submit specific application forms to the program providers;

Version 2.10 (09/12/2023) RFO No. HHS0014057v2 Page 12 of 67

d. Use the most current versions of application forms for manufacturer PAPs and other third-party prescription assistance;

e. Routinely be updated by the Contractor when assistance program forms and requirements have been updated, in accordance with industry standards, to reflect current information;

f. Require that updates be communicated to all Users in advance of web or information updates;

g. Provide the ability for Navigators to locate copay assistance programs;

h. Provide the ability for Navigators to locate appropriate programs specific to the Client’s individual needs; and

i. Have capacity for 340B Pricing to be incorporated into the system and be available as part of a suite of offerings.

2.2.1 Contract Phases

The Contractor’s performance is comprised of three (3) phases:

a. Phase I – Transition;

b. Phase II – Operations; and

c. Phase III – Turnover.

2.2.2 User Base

The Texas Cares Program will grow the user base iteratively. Within the first year of the Contract term, less than fifty (50) Users will be required. Over time, the Solution must have capacity to be scaled to host 1,500 plus Users. User types include:

a. HHSC Users - Texas Cares Program staff administrators that oversee enrollment, training, and certification of Organizations, Sites, and Navigators to facilitate access by Texans to drug manufacturer or third-party PAPs for assistance;

b. Organization Users - An entity (predominantly external entities) that will enroll with the

Texas Cares Program and register one (1) or more geolocated Sites where Navigators can assist Clients;

c. Navigator - An individual (predominantly external entities but may also be HHSC

Program staff) who has completed the program-required background check process and completed required training in the HHSC Texas Cares Program to assist Clients with the application process to receive assistance from drug manufacturers or third-party PAPs. The term “Advocate” can be used synonymously with Navigator; and

d. Site Manager - An individual (predominantly external entities) who has, completed the program-required background check process and required training with HHSC Texas Cares

Program, and will be the key point of contact for the Site(s) where Navigators can meet

Version 2.10 (09/12/2023) RFO No. HHS0014057v2 Page 13 of 67

Clients in person. Site Managers will provide oversight of enrolled Navigators who are associated to their Site. A Site Manager can also be a Navigator.

Please note, a single User may fall into more than one (1) type listed above. If the user falls into more than one category, they count as only one user.

2.2.3 Contractor Personnel

The Contractor shall provide key personnel to provide support for the Solution to HHSC throughout the life of the Contract.

The Contractor’s key personnel must include an account manager who will serve as the

Contractor’s primary point of contact to HHSC for coordinating and directing Contractor resources as required, addressing concerns or issues raised by HHSC, and for generally managing the business relationship, during the Contract Term. The account manager will be responsible for ensuring a successful project fully compliant with all appropriate security laws, policies, procedures, and regulations throughout the Contract term.

HHSC reserves the right to alter the designation of any Contractor personnel as key personnel.

HHSC, at its discretion, may request that the Contractor remove key personnel providing Services under the Contract, if HHSC believes that such an individual is not providing the Services as described within the Contract and the Contractor, after notice, has been unable to resolve performance issues relative to such individual.

2.2.4 Deliverable Approval

The Contractor must provide all Deliverables listed in the following tables on or before the dates specified in the Contract:

a. Table 2 – Configuration Requirements;

b. Table 3 – Training Requirements;

c. Table 4 – Security and Compliance Requirements;

d. Table 5 – Scalability and Availability Requirements;

e. Table 7 – UAT Requirements;

f. Table 8 – Go-live Requirements;

g. Table 9 – User Report and Volume Report Requirements; and

h. Table 13 – Turnover Requirements.

The Contractor must submit each written Deliverable to HHSC for review and approval prior to use. HHSC approval is contingent upon HHSC’s determination the Deliverable conforms to the agreed upon specifications identified in the Contract. HHSC’s approval of the Contractor’s work products or processes will not relieve the Contractor of liability of errors and omissions in the work products or processes.

Version 2.10 (09/12/2023) RFO No. HHS0014057v2 Page 14 of 67

HHSC shall notify the Contractor of Deliverable approval or rejection, in writing. If the

Deliverable is rejected, HHSC’s written notification will include the reason(s) for rejection and the steps the Contractor must complete so the Deliverable will be acceptable.

Upon receipt of the corrected and resubmitted Deliverable, HHSC shall review the corrected

Deliverable to confirm that the identified deficiencies have been corrected and brought into compliance with specifications and that the corrections have not directly or indirectly caused other deficiencies. HHSC shall have the option to continue the evaluation process until the written

Deliverable is brought into compliance with the Contract specifications.

If the Contractor is unable to provide any Deliverable within the scheduled timeframe, the

Contractor’s account manager must contact HHSC in writing, and provide a reason for the delay and the proposed revised schedule, which HHSC may accept or reject at its sole discretion.

The Contractor’s failure to comply with applicable deadlines for Deliverables, or other HHSC requests for information may result in adverse action against the Contractor (see, Exhibit N, Key

Performance Measures and Liquidated Damages).

Any Deliverable that is not explicitly accepted in writing by HHSC is rejected.

2.2.5 Key Performance Measures and Associated Remedies

HHSC will monitor the performance of the Contractor and all requirements of the Contract are subject to performance evaluation by HHSC. HHSC has identified Key Performance Measures

(KPMs) in Exhibit N, Key Performance Measures and Liquidated Damages.

For the contractual obligations subject to a KPM, the KPM will be used to gauge the Contractor’s commitment to successful performance, its willingness to stand behind its Goods and Services provided during the Contact Term, as well as its confidence in its ability to perform.

The Contractor will achieve the KPMs specified in Exhibit N, Key Performance Measures and

Liquidated Damages and may have liability for liquidated damages based on KPM failure as further described in each KPM. Liquidated damages will not be assessed if HHSC determines that the Contractor is not responsible for the failure described in the respective KPM.

For purposes of the KPMs, all measurement periods shall be monthly unless otherwise specified.

In addition, the term “day” refers to a Calendar Day, unless otherwise specified in the text. Partial days beyond the due date shall be rounded up to a whole day for the purposes of the KPM measurement. Also, an hour is not prorated i.e., a fraction of an hour means an hour.

When a liquidated damages measure refers to a percentage point, or portion thereof, the "portion thereof" means that a full percentage point deviation is not required to assess the liquidated damages. For example, if the standard is 99% and the results achieved are 98.6%, the liquidated damages that may be assessed is based on one (1) percentage point. If the results achieved are

97.9%, the liquidated damage that may be assessed is based on two (2) percentage points. HHSC is not required to provide the Contractor with notice and opportunity to resolve issues to System

Agency’s assessment of liquidated damages in accordance with Texas law.

Version 2.10 (09/12/2023) RFO No. HHS0014057v2 Page 15 of 67

In the event the Contractor fails to perform or complete the obligations in a timely manner, HHSC may, in addition to the remedies set forth elsewhere in the Contract, impose the remedies which include the following:

a. Compliance by the Contractor, at no cost to HHSC, with the performance improvement activities and timelines specified in a written corrective action plan(s) approved by HHSC;

b. Additional or ad hoc reporting by the Contractor, at no cost to HHSC, to address performance issues;

c. To the extent that HHSC has not received full performance of any Contractor obligations, HHSC may exercise its statutory right to withhold authorization for payments for invoices for any Services not actually received in conformance with Contract requirements. See

Section 2155.322 of the Texas Government Code (requiring State agencies to inspect and certify receipt of goods or Services for compliance with Contract requirements); and

d. Assessment of liquidated damages as listed in Exhibit N, Key Performance Measures and Liquidated Damages.

2.3 SOLUTION REQUIREMENTS

The Solution must be:

a. Compatible with standard Internet browsers, including but not limited to, Google Chrome, Microsoft Edge, Mozilla Firefox, and Apple Safari;

b. Capable of being viewed on a desktop, tablet or mobile device;

c. Capable of providing and supporting access for up to 1,500 synchronous Users, logins, or access points to obtain the information concurrently;

d. Allow for easy access that is compatible with SSO through HHSC’s IAM Online platform, see Exhibit O, HHSC Identity and Access Management (IAM) Guide;

e. Include role-based security provisioning that conditions the levels of access available to different categories of Users;

f. Scalable to increase or decrease the number of Users, number of licenses, storage capacity, and number of HHSC-assigned instances;

g. Compliant with privacy and information security standards for transmission and storage of data and information applicable to confidential data sets with Health Insurance Portability and Accountability Act (HIPAA) and Personal Identifiable Information (PII) data compliance constraints; and

h. Capable of being adapted and modified to meet the specific needs through configuration.

2.3.1 Functional Requirements

The Solution must meet or exceed the following functional requirements:

Version 2.10 (09/12/2023) RFO No. HHS0014057v2 Page 16 of 67

a. Enable multi-site user and data management with the ability to implement tiered user access and granular rights management. Allow organizations to oversee and manage sites or locations along with the Users assigned to those specific sites or locations.

b. Allow Organizations that partner with HHSC for the use of the system the ability to access reports pertaining to their various sites or locations. Allow HHSC staff to access reports and data across all organizations, sites, and locations. Enable data exportation from the

Solution. Provide the ability to generate custom ad-hoc reports and configure desired data reporting structures for HHSC. Offer Client utilization reports at both Navigator and

Organization levels.

c. Provide User utilization data, detailing the frequency of Client application initiation versus completion or submission. Include audit trails covering user activity, encompassing login details, application modifications, and duration spent working on Client records.

d. Deliver electronic renewal reminders for maintenance medication to relevant users at the

Site, location, or Organization levels. Possess document management functionalities for

Client support documents. Offer text and email notifications to Clients regarding their application status.

e. Enable users to manage a list of Clients served, along with application status and follow-up capabilities.

f. Provide capability to upload or import Client demographics from other electronic healthcare systems using Excel standard file formats.

g. Include quality review questionnaire that can be managed and distributed following PAP utilization including the capability to send text or email reminders to complete the questionnaire.

h. The solution must be available in English; and the software-generated communications, questionnaires, and automated notifications should be available in both English and

Spanish.

i. Enable any software-generated communications and automated notifications to be customized to reference HHSC Program (Texas Cares Program) and branding. Enable customization of all software-generated communications and automated notifications to reflect the HHSC Program (Texas Cares Program) and its branding.

2.3.2 Texas Risk and Authorization Management Plan

The Contractor shall comply with the program requirements of TX-RAMP as they currently exist and as amended throughout the Contract Term. Commencing on the Effective Date, the Contractor shall have achieved TX-RAMP Level 2 Certification, and the Contractor must maintain such certification for the duration of the Contract Term. At the sole discretion of HHSC, the

Contractor’s attainment of TX-RAMP Provisional Certification may satisfy the TX-RAMP

Certification Level 2 requirement for the length of active TX-RAMP Provisional Certification. If

Version 2.10 (09/12/2023) RFO No. HHS0014057v2 Page 17 of 67

HHSC permits TX-RAMP Provisional Certification, the Contractor is solely responsible for obtaining and maintaining TX-RAMP Level 2 Certification prior to the expiration of TX-RAMP

Provisional Certification. The Contractor acknowledges that HHSC shall not provide Agency-sponsored Interim Provisional Certification or otherwise assist the Contractor in Contractor’s compliance with TX-RAMP requirements.

In addition, the Contractor shall:

a. Upon HHSC’s request, provide the Contractor’s submission(s) to DIR that supports DIR’s approval of certification status and respond to HHSC and DIR TX-RAMP staff inquiries promptly;

b. Provide written notification to HHSC of any lapse in TX-RAMP certification including, but not limited to, DIR revocation of TX-RAMP certification within two (2) business days of the Contractor’s discovery of non-compliance with TX-RAMP requirements;

c. Complete all TX-RAMP monitoring reports required by DIR and submit copies of reports to HHSC on or before the second (2nd) business day following the DIR submission deadline;

d. Routinely assess and monitor for compliance with required security controls and demonstrate that the security posture of the cloud computing services offered is acceptable to maintain TX-RAMP certification;

e. If the Contractor has TX-RAMP Provisional Certification, provide a progress update to

HHSC on the Contractor’s application for TX-RAMP Level 2 Certification no later than the third (3rd) business day of each calendar month, unless HHSC requires more frequent reporting, until the expiration of the TX-RAMP Provisional Certification; and

f. If the Contractor has TX-RAMP Level 2 Certification, commencing six months prior to the expiration date of the TX-RAMP Level 2 Certification, provide a progress update to

HHSC on the Contractor’s application for renewal or extension of its TX-RAMP Level 2

Certification no later than the third (3rd) business day of each calendar month, unless HHSC requires more frequent reporting.

The Contractor’s failure to comply with any TX-RAMP requirements including, but not limited to, continuous maintenance of the minimum certification required by the Contract shall constitute a material breach of contract, and HHSC reserves the right to hold the Contractor accountable by taking any remedial or corrective actions available under the Contract, at law, or in equity.

If the Contractor is unable to achieve TX-RAMP Level 2 Certification or re-certification, as applicable, for any reason before the 120th calendar day prior to the expiration date of the TX-

RAMP Provisional Certification or TX-RAMP Level 2 Certification, as applicable, the Contractor shall provide, at no cost to HHSC, turnover services in accordance with Section 2.6 (Phase III –

Turnover).

Version 2.10 (09/12/2023) RFO No. HHS0014057v2 Page 18 of 67

2.3.3 SaaS Requirements

The Contractor shall provide a Solution that meets the NIST standard definition of SaaS provided in NIST Special Publication No. SP 800-145 and that meets or exceeds the requirements specified in Table 1, SaaS Service Requirements.

Table 1 – SaaS Service Requirements

Requirement

ID

Requirement

Name Requirement

SAA-01 Off-site

Hosted Data

The Contractor must make all HHSC data hosted off-site available to HHSC.

SAA-02 Planned

Downtime The Contractor must provide five (5) Calendar Days advance notice of planned downtime with HHSC.

See Exhibit N, Key Performance Measure and Liquidated

Damages, KPM-02.

SAA-03 Unplanned

Downtime

Contractor must provide HHSC at least thirty (30) minutes advance written notice of any known, unplanned downtime.

See Exhibit N, Key Performance Measures and Liquidated

Damages, KPM-03.

SAA-04 Data Back

Ups

The Contractor must back up all HHSC data, at a minimum, every two (2) weeks with daily incremental backups.

SAA-05 Remote Back

Ups

The Contractor must provide remote back-ups of HHSC data when requested by HHSC.

SAA-06 Operational

Changes

The Contractor must provide HHSC with five (5) Calendar Days advanced notice of any operational changes that may affect access to HHSC data before the Contractor implements any changes to the Solution.

SAA-07 System

Architecture

The Contractor must provide a detailed Architecture Diagram if using a Private Cloud (vs. a Public Cloud Service Provider).

SAA-08 System

Architecture

The Contractor must provide information related to NIST compliance if using a Private Cloud (vs. a Public Cloud Service

Provider).

2.3.4 DIR Data Center Services Infrastructure

To the extent applicable to the Solution, the Contractor must comply with Exhibit M, DCS RFO

Language.

Version 2.10 (09/12/2023) RFO No. HHS0014057v2 Page 19 of 67

2.3.5 Status Reports

The Contractor must provide, at no additional cost, weekly Status Reports via email to the Texas

Cares Program team during Phase I –Transition until Go-live or Phase II – Operations, at which point incident reports are required as applicable. The status reports are due every Friday by 4:00 p.m. Central Time, with the exception that if a holiday falls on a Friday, report is due on preceding

Thursday.

Status Reports must include the following information at a minimum:

a. A detailed description of work completed by the Contractor during the reporting period;

b. An overview of pending work that aligns with the project work status;

c. The identification of work activities and tasks not tracking to the project timeline;

d. A list of past due work activities and tasks with the Contractor’s escalation plan to meet schedule deadlines;

e. The identified risks, issues, and action items with associated strategies;

f. The disposition of escalated or critical issues, risks; and

g. The tracking and documentation of decisions made during the reporting period.

2.4 PHASE I – TRANSITION

2.4.1 Configuration Services

The Contractor shall provide Configuration Services that meet or exceed the requirements specified in Table 2, Configuration Requirements.

Table 2 – Configuration Requirements

Requirement

ID

Requirement

Name Requirement

CF-01 Project Work

Plan

The Contractor must provide a detailed Project Work Plan that addresses all of the Contractor activities with a schedule to complete all the requirements and provide all deliverables, in electronic format, to include, but not limited to, the following:

a. Project Start and finish dates;

b. Weekly informational sessions;

c. Task identification;

d. Tasks and subtasks;

e. Dependencies;

f. Milestones;

g. Percentages of completed tasks;

Version 2.10 (09/12/2023) RFO No. HHS0014057v2 Page 20 of 67

Table 2 – Configuration Requirements

Requirement

ID

Requirement

Name Requirement

h. Durations; and

i. Assigned resources.

The Project Work Plan must address all of the Contractor activities with a schedule to complete all the requirements.

After approval by HHSC of the proposed Project Work Plan, any subsequent changes to the Project Work Plan must be approved in writing by HHSC.

Deliverable Due Date: Ten (10) Calendar Days following the

Contract Effective Date.

See Exhibit N, Key Performance Measures and Liquidated

Damages, KPM-15.

CF-02 Kickoff

Meeting and

Materials

The Contractor must schedule a Kickoff meeting with HHSC to familiarize project team members with the project and develop baseline expectations between HHSC and the Contractor, within five (5) Calendar Days following the Contract Effective Date.

The Contractor must provide presentation materials two (2)

Calendar Days prior to meeting with HHSC and revise materials to comply with Contract requirements in accordance with HHSC written notice.

Kickoff Meeting can be both in person and virtual.

Deliverable Due Date: Kickoff Meeting scheduled within five

(5) Calendar Days following the Contract Effective Date;

presentation material provided at least two (2) Calendar Days prior to the Kickoff Meeting.

See Exhibit N, Key Performance Measures and Liquidated

Damages, KPM-15.

CF-03 Contractor

Personnel

The Contractor must ensure all personnel performing Services have requisite training and are available within five (5) Calendar

Days following the Contract Effective Date.

CF-04 State-specific

Configurations

The Contractor must provide a Solution that meets the requirements of Section 2.3 (Solution Requirements).

CF-05 Project

Management

Plan (PMP)

The Contractor must provide a PMP that outlines the project tasks, how to accomplish the tasks, who is involved, how will issues be

Version 2.10 (09/12/2023) RFO No. HHS0014057v2 Page 21 of 67

Requirement

ID

Requirement

Name Requirement escalated, how information is communicated, measured, and reported.

The PMP must include the following project plans:

a. Communication Plan;

b. Staffing Management Plan;

c. Implementation Plan;

d. Escalation Plan;

e. Performance and Quality Management Plan;

f. UAT Plan and;

g. Risk and Issue Management Plan.

The PMP must follow the Project Management Body of Content

(PMBOK) standards and guidelines for the structure and content of the document. The PMP is a living document and may change as the project progresses. The Contractor must update the PMP as required to describe the current state of the project.

Deliverable Due Date: Ten (10) Calendar Days following the

Contract Effective Date.

See Exhibit N, Key Performance Measures and Liquidated

Damages, KPM-15.

CF-06 Change

Management

Plan

The Contractor must provide a Change Management Plan that describes its change management controls and procedures which it will carry out in coordination with HHSC. The Contractor’s

Change Management Plan must include, but is not limited to:

a. Description of the change, including the need/benefit, date identified, and who initiated the change request;

b. List of data, functions, or processes affected by the change;

c. Potential risks associated with the change (both implementing and not implementing the change);

d. Start and completion dates (dates must be approved by

HHSC);

e. Plans for staff allocations, installation, and testing;

f. Roll-back plan that provides details on how to restore the

Solution before the change; and

Version 2.10 (09/12/2023) RFO No. HHS0014057v2 Page 22 of 67

Requirement

ID

Requirement

Name Requirement

g. Estimated hours of work to implement change.

Deliverable Due Date: Ten (10) Calendar Days following the

Contract Effective Date.

See Exhibit N, Key Performance Measures and Liquidated

Damages, KPM-15.

CF-07 Readiness

Assessment

Plan

The Contractor must provide a Readiness Assessment Plan that confirms:

a. How the results of the readiness assessment will be collected and presented to HHSC and include recommended approaches to resolve any identified problems;

b. All Users have been identified, on-boarded, trained, and registered (logins created);

c. HHSC’s written approval on the Contractor’s development and approach on readiness criteria;

d. All support components are present, the support desk is operational, and online support materials are approved and in place on Solution help links;

e. HHSC’s written approval of development and approach for test plan and test cases; and

f. HHSC’s written approval of development and approach for success criteria that will be used to measure complete deployment of the Solution.

Deliverable Due Date: Thirty (30) Calendar Days following the

Contract Effective Date.

See Exhibit N, Key Performance Measures and Liquidated

Damages, KPM-15.

CF-08 Information

Gathering

Sessions

The Contractor must conduct information gathering sessions with

HHSC base Users throughout Phase I - Transition, in accordance with the approved Project Work Plan, to determine the configuration and how to develop the interfaces for the Solution.

CF-09 Readiness

Assessment

Results Report

The Contractor must provide a Readiness Assessment Results

Report that describes how the results were collected and include recommended approaches to resolve any identified problems or

Version 2.10 (09/12/2023) RFO No. HHS0014057v2 Page 23 of 67

Requirement

ID

Requirement

Name Requirement issues with the Solution. The Readiness Assessment Results

Report must evaluate:

a. The Contractor’s ability to support Users’ ability to log in and use the Solution;

b. The developed business procedures and processes;

reporting; and

c. and the security of the data export.

The Readiness Assessment Report must include a formal statement that acknowledges the planned completion of Phase I –

Transition and provides HHSC with the information need to approve deployment to Phase II – Operations.

Deliverable Due Date: Thirty (30) Calendar Days following the

Contract Effective Date.

See Exhibit N, Key Performance Measures and Liquidated

Damages, KPM-15.

CF-10 Add and

Remove Users

Process

The Contractor must develop and document the process to add and remove HHSC-approved Users to the Solution.

Instructions for this process must be included in deliverable associated with TRA-02 (Training Materials Deadline).

CF-11 Solution

Administrators

The Contractor must provide access for HHSC to serve as

Solution administrators. See Section 2.2.2 (User Base).

CF-12 Data

Dictionary

The Contractor must provide an electronic searchable Data

Dictionary for the Solution, using industry best practices to be approved by HHSC.

At a minimum, the Data Dictionary must contain for each of the following:

a. Field name in human readable format;

b. Field description;

c. Database field name;

d. Database table;

e. Field type and length;

f. Valid values and their corresponding descriptions; and

g. Instructions on how to create queries.

Version 2.10 (09/12/2023) RFO No. HHS0014057v2 Page 24 of 67

Requirement

ID

Requirement

Name Requirement

Deliverable Due Date: Thirty (30) Calendar Days following the

Contract Effective Date.

See Exhibit N, Key Performance Measures and Liquidated

Damages, KPM-15.

CF-13 Configuration

Requirement

Completion

The Contractor must complete all Configuration Requirements and activities, and document processes included in the Project

Work Plan.

Deliverable Due Date: Fifty (50) Calendar Days following the

Contract Effective Date.

CF-14 Configuration

Requirement

Written

Approval

The Contractor must obtain written approval from HHSC that all configuration requirements identified in this Table 2, Configuration Requirements have been completed.

Deliverable Due Date: On or before fifty (50) Calendar Days following the Contract Effective Date.

See, Exhibit N, Key Performance Measures and Liquidated

Damages, KPM-08.

2.4.2 Training Services

The Contractor shall provide Training Services that meet or exceed the requirements specified in

Table 3, Training Requirements.

Table 3 – Training Requirements

Requirement

ID

Requirement

Name Requirement

TRA-01 Training

Environment and Software

The Contractor must provide a virtual training environment for the Solution.

Deliverable Due Date: Sixty (60) Calendar Days following the

Contract Effective Date.

TRA-02 Training

Materials

Deadline

The Contractor must develop all training materials in both paper and electronic format with instructor-led training for the

Solution.

The Contractor must provide all training materials, in both paper and electronic format, to HHSC staff for approval in writing by HHSC staff.

Deliverable Due Date: Five (5) Calendar Days before scheduled training.

Version 2.10 (09/12/2023) RFO No. HHS0014057v2 Page 25 of 67

Table 3 – Training Requirements

Requirement

ID

Requirement

Name Requirement

See Exhibit N, Key Performance Measures and Liquidated

Damages, KPM-15.

TRA-03 Troubleshooting

Guide

The Contractor must provide a Troubleshooting Guide for

Users to address common application issues such as password logins, search problems, error messages.

Deliverable Due Date: Within sixty (60) Calendar Days following the Contract Effective Date.

See Exhibit N, Key Performance Measures and Liquidated

Damages, KPM-15.

TRA-04 Training Levels The Contractor will provide two (2) levels of training: Solution administrators and Users.

Deliverable Due Date: Within sixty (60) Calendar Days following the Contract Effective Date.

TRA-05 Ongoing

Training

Materials

The Contractor must provide training materials, delivered through online tutorials or videos, that will be used throughout

Phase II – Operations.

Deliverable Due Date: Within sixty (60) Calendar Days following the Contract Effective Date.

See Exhibit N, Key Performance Measures and Liquidated

Damages, KPM-15.

TRA-06 Training State-specific

Configuration

The Contractor must provide training to HHSC for configuration and maintenance of all State-specific configurations as required in Section 2.3 (Solution

Requirements).

Deliverable Due Date: Within sixty (60) Calendar Days following the Contract Effective Date.

See Exhibit N, Key Performance Measures and Liquidated

Damages, KPM-15.

TRA-07 Training

Requirements

Written

Approval

The Contractor must obtain written approval from HHSC that confirms all Training Requirements have been completed.

Deliverable Due Date: Within…