ESBD_376748_1726527017945_454-25-0101-31688-EM.pdf

Texas Department of Insurance

Request for Offers Network Adequacy Software

RFO No. 454-25-0101-31688-EM NIGP Class/Item Codes: 920-00, 208-11, 208-60

September 16, 2024

Anticipated Schedule of Events

September 16, 2024 Issuance of Solicitation

September 27, 2024, 3:00 p.m., Central time Deadline for Submission of Questions

October 8, 2024 Release of Official Responses to Questions (or as soon thereafter as practical)

Not Applicable Deadline to Submit HSP for Courtesy Review

Not Applicable Deadline for HSP HUB Outreach Notification

October 17, 2024, 3:00 p.m., Central time Deadlines for Submission of Proposals Late Proposals will not be considered

November 1, 2024 Presentations by Top-Ranked Respondents (if presentations requested)

November 22, 2024 Anticipated Award Date (or as soon thereafter as practical)

NOTE: Any Addendum that adds new language or replaces any language within this solicitation controls over the original version. It is the responsibility of all prospective Respondents to routinely check the Electronic State Business Daily (ESBD) during the posting period for this solicitation for any Addenda that may be posted. TDI will not make any other announcements regarding Addenda after the publication of this solicitation.

RFO No. 454-25-0101-31688-EM

Table of Contents I. Summary

II. Specifications

A. Introduction

B. Background

C. Qualifications

D. Definitions and Acronyms

E. Roles and Responsibilities

F. Scope of Work

G. TDI’s Technical Environment

H. Hosting

I. Security

J. Other Contract Requirements

K. Performance and Service Specifications

L. Schedule of Deliverables and Milestones

III. General Proposal Information

A. Contract Resulting from this Solicitation

B. Contract Term

C. Copyrighted Proposals

D. Unacceptable Terms in Respondent’s Proposal

E. Authority to Bind

F. Protest Procedures

G. Texas Public Information Act and Exchange or Creation of Information

H. Respondent Documents

I. Respondent Exceptions and Assumptions

J. Service Additions or Deletions, Change Control

K. Acceptance Criteria

L. Payments and Invoice Instructions

IV. Proposal Submission Requirements

A. Time for Submission and TDI’s Email Address

B. Respondent Identification

C. No Alterations or Withdrawals of Proposal after Deadline

D. Tie Proposals

E. Pre-contract Costs

F. TDI’s Tax Exemption

G. Attachments

H. Evaluation Process

I. Proposal Content and Format

V. Mandatory Price Sheet

A. Schedule of Fees

VI. Terms and Conditions

A. Clauses Required by the Texas Procurement and Contract Management Guide

B. Additional Texas Procurement and Contract Management Guide Provisions

C. Additional Provisions Required by TDI

VII. Execution of Proposal

VIII. Conflict of Interest/Disclosure Statement

IX. Certification Regarding Public Nature of the Proposal

X. Appendix A: Sample Contract

XI. Appendix B: Tips for a Successful Submission

XII. Appendix C – DCS Private and Public Cloud Information

Attachment 1 – Solution Questionnaire

I. Summary

1. Type of Solicitation Request for Offers (RFO)

2. Issuing Office

Texas Department of Insurance Purchasing and Contract Administration

PO BOX 12030

Austin, TX 78711-2030

3. Responses to Solicitation Emailed Competitive Proposals

4. HSP Courtesy Review Not Applicable

5. Deadline for Proposals Emailed to Contracts@tdi.texas.gov no later than:

October 17, 2024, 3:00 p.m., Central time

6. Initial Contract Term Contract Execution – August 31, 2026

7. TDI Optional Terms Three (3) one-year renewal options or one (1) three-year term

8. TDI Contact Person for this Solicitation

Elisabeth Monahan, CTCD, CTCM contracts@tdi.texas.gov

9. Proposals Submitted by Email Submit to Contracts@tdi.texas.gov TDI will use the date and time stamp on TDI’s Microsoft Outlook mailbox to confirm receipt by the deadline.

10. Proposals Submitted by Mail Not Accepted

11. Proposals Submitted by Fax Not Accepted

12. Pre-Proposal Conference Not Applicable

13. Pre-Proposal Inspection Not Applicable

14. Letters of Intent to Submit a Proposal

Not Applicable mailto:Contracts@tdi.texas.gov

15. Solicitation Addenda Notices of changes to items directly impacting the original solicitation or Proposal process will be posted on the Electronic State Business Daily (ESBD) located at www.txsmartbuy.com/esbd. TDI will post any amendment to this solicitation on the ESBD as a solicitation Addendum. It is the responsibility of an interested party to periodically check the ESBD for updates to the solicitation prior to submitting a Proposal. Each Respondent is solely responsible for verifying TDI’s receipt of its questions, if applicable, and Proposal by the deadlines specified in this solicitation.

16. Questions and Answers Questions regarding this solicitation must be in writing and must be submitted to the TDI Contact Person specified in Item 9 no later than September 27, 2024, 3:00 p.m., Central time. Telephone inquiries will not be accepted. Questions must be submitted by email to the email address specified in Item 9. TDI intends to post on the ESBD answers to those questions received by the deadline on October 8, 2024, or as soon thereafter as practical.

17. Respondent Presentations TDI may request that Top-Scoring Respondents present an overview of the Services described in their Proposals.

The presentations will be online and in-person attendance is not requested. Presentation dates and times to be arranged. The number of Top-Scoring Respondents will be determined by TDI in its sole discretion.

18. Contact with TDI Staff Upon issuance of this solicitation, employees and representatives of TDI, other than the TDI Contact Person identified in Item 9, will not discuss the contents of this solicitation with any Respondent, Potential Respondent, or its representatives. Failure of a Respondent or any of its representatives to observe this restriction may result in disqualification of any related Proposal. This restriction does not preclude discussions between affected parties for the purpose of conducting business unrelated to this procurement.

http://www.txsmartbuy.com/esbd

19. Evaluation of Proposals under Best Value Standard

Criteria Points Cost 25 Respondent’s Qualifications and

Experience

Compliance with TDI Specifications 40 Past Performance and References 0 or -10 Proposal Content and Format 0 or -5 Total 100

The factors listed in Sections 2155.074, 2155.075, 2156.007, 2157.003, and 2157.125 of the Texas Government Code shall be considered in making an award, when applicable.

The overall score for Proposals that fail to adhere to the format and content listed in Section IV Part I (Proposal Content and Format) may be deducted 5 points, the Proposal may be disqualified, or TDI may waive minor technicalities in accordance with Section III Part A (Contract Resulting from this Solicitation).

20. Basis for Automatic Disqualification Proposals submitted in response to the solicitation will be rejected as non-responsive and will be disqualified if they do not meet the following mandatory requirements. A disqualified Proposal will receive no further consideration.

1) Respondent must not be debarred from participation in state contracts.

2) Proposal must be submitted by the deadline stated in Item 5 above (Deadline for Proposals) of this Section.

3) The Title Page must be signed and submitted.

See Section IV Part I.

4) Each addendum to the solicitation must be included in its entirety, including the signed signature page. See Section IV Part I Item 10.

5) The Execution of Proposal must be signed and submitted. See Section VII

6) The Conflict of Interest form must be completed, signed, and submitted. See Section

VIII.

7) The Certification Regarding Public Nature of the Proposal must be completed, signed, and submitted. See Section IX.

II. Specifications

A. Introduction The Texas Department of Insurance (TDI), an agency of the State of Texas, issues this Request for Offers (solicitation) to solicit pricing from qualified vendors for network adequacy software services as described in this solicitation (“Services”). TDI’s objective is to obtain the Services that represent the best value for TDI and the State of Texas according to the terms and conditions of this solicitation. The Services and requirements described in this solicitation are mandatory unless specifically described as optional.

TDI anticipates making a Contract Award to one Successful Respondent (“Contractor”) for the Services required by the solicitation. TDI reserves the right not to award a Contract for the performance of all or part of the requirements of this solicitation. This solicitation is not exclusive and TDI reserves the right to issue additional solicitations regarding the Services described in this solicitation or similar services at any time.

All Respondents are encouraged to offer their best pricing at all times.

All costs associated with the Services, as defined by this solicitation, must be included in the Respondent’s Proposal. Proposals that do not meet all the requirements or contain all the required documentation specified in this solicitation will be rejected as non-responsive and will be disqualified.

B. Background

1. TDI Overview TDI regulates the state’s insurance industry, oversees the administration of the Texas workers’ compensation system, performs the duties of the State Fire Marshal’s Office, and provides administrative support to the Office of Injured Employee Counsel – a separate agency.

TDI’s vision is to be a dynamic leader in responsible state, national, and global regulation; consumer protection; and market viability.

2. Project Overview TDI reviews health plan networks to ensure they meet network adequacy standards required by Texas law, including Insurance Code Chapter 1301. Network adequacy review involves determining that the network has enough contracted and credentialed health care practitioners and facilities to provide all medically necessary covered services to enrollees. The health care practitioners and facilities must be available and accessible to all enrollees in the plan’s service area.

Companies that offer network-based health coverage in Texas submit network adequacy filings to TDI on an annual basis, and any time there is a material change to the network, including a service area expansion or reduction, or a network gap that requires a waiver request and access plan.

Specific network adequacy requirements are established by statute and rule and are subject to change.

TDI seeks a vendor to implement an application software that will allow TDI to upload provider lists that include the provider’s address and specialty type for analysis against applicable network adequacy time and distance standards. The solution must include flexibility to adapt to changes in the standards.

C. Qualifications Respondents must have the knowledge and expertise to provide the services described in this solicitation.

Respondents submitting a Proposal in response to this solicitation must describe in its Executive Summary how the Respondent meets the qualifications described below.

1) Respondent has a minimum of five years’ experience providing services comparable to the services described in this solicitation.

2) Respondent has experience with at least five individual engagements for services comparable to the services described in this solicitation.

D. Definitions and Acronyms As used in this solicitation, the following capitalized terms will have the meaning specified below.

Term Definition Agency The Texas Department of Insurance.

Agency Primary Contact The person designated by TDI to be the point of contact between TDI and Contractor for the purposes of monitoring Contractor performance and providing day-to-day interaction and instruction. Also referred to as “Contract Administrator.”

Contract The written agreement, if any, executed by the authorized representatives of the parties (the Agency and the Contractor) that formalizes the terms, provisions, covenants, and obligations, including but not limited to those contained in this solicitation, of the respective parties to the arrangement for provision of Services.

Contractor The individual or entity qualified to provide the goods and/or services sought by TDI pursuant to this solicitation and who is ultimately selected to carry out the requirements stipulated in this solicitation and any resulting Contract. Has the same meaning as “Vendor” and “Successful Respondent.”

Contract Administrator The person designated by TDI to be the point of contact between TDI and Contractor for the purposes of monitoring Contractor performance and providing day-to-day interaction and instruction. Also referred to as “Agency Primary Contact.”

Contract Award TDI’s notice of award to the Successful Respondent of TDI’s intent to execute a contract.

Contract Execution The date the Contract is fully executed by all Parties.

Contract Term The complete period of service including any extensions and renewals that are executed by Contract Amendment.

Data Breach A security incident in which sensitive, protected, or confidential data is copied, transmitted, viewed, stolen, or used by an individual or entity unauthorized to do so, whether or not the breach occurred in transit or at rest.

Days Calendar days unless otherwise specified.

Deliverable Unit or increment of work required by the Contract, including such items as goods, services, reports, or documents.

DWC The Division of Workers’ Compensation, a division within TDI.

Term Definition Electronic State Business Daily (ESBD)

The public-facing website in which applicable government entities post certain competitive procurement solicitations.

http://www.txsmartbuy.com/esbd.

Employee, Contractor Employee

Any individuals who, on behalf of the Contractor, will or may participate in any Contract resulting from this solicitation. The term includes all officers, personnel, replacement personnel, agents, contractors, subcontractors, subcontractor employees, and other representatives of the Contractor, regardless of how employed or contracted by Contractor.

Financial Interest Receiving, or the right to receive, money or other valuable property or benefits under the actual or proposed Contract; holding a position in a business such as a principal, officer, director, trustee, partner, employee, or the like, or holding a position of management; holding any of the outstanding debt of a person directly involved in the proposed or resulting Contract; or owning stock or other interest in the business.

Fiscal Year (FY) The State of Texas and TDI’s fiscal year that begins September 1 and ends August 31.

Key Deliverable A key deliverable may have a payment associated with it and will likely have an associated liquidated damage.

Mandatory Required, compulsory, or obligatory.

Offer, Proposal, or Response The documents, including any exhibits or attachments, submitted by a prospective vendor in response to a solicitation. “Offer” has the same meaning as “Proposal” or “Response,” when such terms are applicable in the solicitation document so titled as Request for Proposal (RFP), Request for Offers (RFO), or an Invitation for Bid (IFB), respectively.

Party Entity who enters into a binding agreement with one or more other contracting parties and thus accepts the benefits and obligations specified therein.

Relative When referring to an individual, the term includes a current or former TDI employee’s spouse, father, mother, brother, sister, son or stepson, daughter or stepdaughter, mother-in-law, father-in-law, sister-in-law, brother-in-law, son-in-law, or daughter-in-law.

Respondent An individual or business entity submitting a Proposal in response to a solicitation, with an intent to contract with TDI.

Services All of the requirements, duties, schedules, locations, and other items listed in the solicitation. The term includes any other services associated with Contractor’s performance under any Contract resulting from this solicitation.

Security Incident An event that results in unauthorized, access, loss, disclosure, modification, or destruction of information resources, whether accidental or deliberate. An instance in which a user or other person circumvents or defeats the controls of a system to obtain unauthorized access to system resources or to information contained in the system.

State Holidays The State Agency Holiday schedule is defined on the Texas State Auditor’s website at www.hr.sao.texas.gov/Holidays/.

http://www.txsmartbuy.com/esbd http://www.hr.sao.texas.gov/Holidays/

Term Definition Successful Respondent The individual or entity qualified to provide the goods and/or services sought by TDI pursuant to this solicitation and who is ultimately selected to carry out the requirements stipulated in this solicitation and any resulting Contract. Has the same meaning as “Vendor” and “Contractor.”

TDI The Texas Department of Insurance, the state agency responsible for the issuance of this solicitation.

Vendor The individual or entity qualified to provide the goods and/or services sought by TDI pursuant to this solicitation and who is ultimately selected to carry out the requirements stipulated in this solicitation and any resulting Contract. Has the same meaning as “Successful Respondent” or “Contractor.”

Vendor Primary Contact The person designated by the Contractor to be the point of contact between Contractor and Agency for purposes of scheduling, billing, contract management, and day-to-day management of Services under this solicitation.

E. Roles and Responsibilities

1. Agency Responsibilities Agency agrees to meet the following requirements during the Contract Term:

a) Designate an Agency representative to be the Agency Primary Contact for the purposes of monitoring Contractor performance and providing day-to-day interaction and instruction.

The Agency Primary Contact will also be the designated Contract Administrator.

b) Provide technical staff to assist with coordination between Contractor and TDI.

c) Have final approval on all schedules and deliverables.

2. Contractor Responsibilities Contractor must meet all the following requirements during the Contract Term:

a) Designate a representative to be the Vendor Primary Contact for the purposes of scheduling, billing, contract management, and day-to-day management of Services under this solicitation.

b) Provide the necessary staff to fulfill deliverables and requirements in accordance with the agreed upon schedule or services.

c) Collaborate with TDI to ensure successful implementation and completion of the Services.

d) Be honest, open, courteous, respectful, and fair in all contact with TDI.

e) Identify and communicate any risks to the Service to the Agency Primary Contact.

F. Scope of Work

1. Network Adequacy Data Analytics Contractor must implement a software or application solution capable of generating data analytics that include the items listed below. Contractor’s software or application solution must ensure the analytical results are available to TDI within three (3) business days of TDI uploading the provider list.

• Identifying information o Company name o NAIC number o Network name o Network ID o System for Electronic Rate and Form Filing (SERFF) tracking number

• Summary information o A list of all counties in the service area o A listing of the approved service area for annual network filings o A listing of the proposed service area for any service area expansion or reduction filing o A list of all specialties provided (up to 75)

• Network adequacy compliance information for each network adequacy standard that applies for a specific physician or provider specialty type in a given county within the service area. See Table A below for the network adequacy standards that currently apply.

o For non-facility-based physicians and providers, the number of in-network physicians or providers within the county.

o For facility-based physicians and providers, the number of in-network physicians and providers with privileges within the in-network facility.

• Number of potential members per county

• Number of potential members with access o For non-facility-based physicians and providers, the percentage of enrollees with sufficient access and choice, relative to where enrollees are expected to reside within the service area, based on a representative data set of prospective enrollee locations provided by the Contractor.

TDI requires health plans to submit their provider lists using the Microsoft Excel template created by TDI.

In its Business Proposal (see Section IV Part I Item 5), Respondent must describe any preferences for file formats (i.e. raw data versus reports) and any file format constraints for provider lists uploaded by TDI.

2. Network Adequacy Standards for Compliance Analysis The proposed solution must be capable of measuring whether a network includes enough providers in each medical specialty to provide sufficient access and choice, consistent with the types of network adequacy standards in the chart below.

The solution must allow distance standards to be measured based on either driving distance or radius distance. Access and choice standards are defined by Texas laws and rules, which may change over time. For example, the current rule requires 100% of enrollees to have access to at least two physicians or providers within the applicable time and distance standards, without leaving the service area. Enrollee access must be measured based on a representative data set of prospective enrollee locations provided by the Contractor. The solution must include flexibility to allow TDI to add to or modify these standards.

In its Business Proposal (see Section IV Part I Item 5), Respondent must disclose the source of the representative data set and describe how it approximates the locations of prospective enrollees.

Table A - Network Adequacy Time and Distance Standards

Specialty Types

Maximum Time and Distance Standards (Time is measured in minutes and distance is measured in miles)

Large Metro County Metro County Micro County Rural County

Counties with Extreme Access Considerations

(CEAC)

Time Distance Time Distance Time Distance Time Distance Time Distance

Acute Inpatient Hospitals (must have Emergency services available 24/7)

20 10 45 30 80 60 75 60 110 100

Allergy and Immunology 30 15 45 30 80 60 90 75 125 110

Cardiac Catheterization Services

30 15 60 40 160 120 145 120 155 140

Cardiac Surgery Program 30 15 60 40 160 120 145 120 155 140

Cardiology 20 10 30 20 50 35 75 60 95 85

Cardiothoracic Surgery 30 15 60 40 100 75 110 90 145 130

Chiropractor 30 15 45 30 80 60 90 75 125 110

Critical Care Services - Intensive Care Units (ICU)

20 10 45 30 160 120 145 120 155 140

Dermatology 20 10 45 30 60 45 75 60 110 100

Diagnostic Radiology (Free-standing; hospital outpatient;

ambulatory health facilities with Diagnostic Radiology)

20 10 45 30 80 60 75 60 110 100

Durable Medical Equipment NA 75 NA 75 NA 75 NA 75 NA 75

Emergency Medicine 20 10 45 30 80 60 75 60 110 100

Endocrinology 30 15 60 40 100 75 110 90 145 130

Specialty Types

Maximum Time and Distance Standards (Time is measured in minutes and distance is measured in miles)

Large Metro County Metro County Micro County Rural County

Counties with Extreme Access Considerations

(CEAC)

Time Distance Time Distance Time Distance Time Distance Time Distance

ENT/

Otolaryngology 30 15 45 30 80 60 90 75 125 110

Gastroenterology 20 10 45 30 60 45 75 60 110 100

General Surgery 20 10 30 20 50 35 75 60 95 85

Gynecology, OB/GYN 10 5 15 10 30 20 40 30 70 60

Home Health NA 75 NA 75 NA 75 NA 75 NA 75

Infectious Diseases 30 15 60 40 100 75 110 90 145 130

Inpatient or Residential Behavioral Health Facility Services

30 15 70 45 100 75 90 75 155 140

Mammography 20 10 45 30 80 60 75 60 110 100

Nephrology 30 15 45 30 80 60 90 75 125 110

Neurology 20 10 45 30 60 45 75 60 110 100

Neurosurgery 30 15 60 40 100 75 110 90 145 130

Occupational Therapy 20 10 45 30 80 60 75 60 110 100

Oncology - Medical, Surgical 20 10 45 30 60 45 75 60 110 100

Oncology - Radiation 30 15 60 40 100 75 110 90 145 130

Ophthalmology 20 10 30 20 50 35 75 60 95 85

Optometrist NA 75 NA 75 NA 75 NA 75 NA 75

Orthopedic Surgery 20 10 30 20 50 35 75 60 95 85

Specialty Types

Maximum Time and Distance Standards (Time is measured in minutes and distance is measured in miles)

Large Metro County Metro County Micro County Rural County

Counties with Extreme Access Considerations

(CEAC)

Time Distance Time Distance Time Distance Time Distance Time Distance

Outpatient Clinical Behavioral Health (Licensed, accredited, or certified professionals)

10 5 15 10 30 20 40 30 70 60

Outpatient Infusion/ Chemotherapy

20 10 45 30 80 60 75 60 110 100

Pharmacy NA 75 NA 75 NA 75 NA 75 NA 75

Physical Medicine and Rehabilitation

30 15 45 30 80 60 90 75 125 110

Physical Therapy 20 10 45 30 80 60 75 60 110 100

Plastic Surgery 30 15 60 40 100 75 110 90 145 130

Podiatry 20 10 45 30 60 45 75 60 110 100

Primary Care – Adult

10 5 15 10 30 20 40 30 70 60

Primary Care – Pediatric

10 5 15 10 30 20 40 30 70 60

Psychiatry 20 10 45 30 60 45 75 60 110 100

Pulmonology 20 10 45 30 60 45 75 60 110 100

Rheumatology 30 15 60 40 100 75 110 90 145 130

Skilled Nursing Facilities 20 10 45 30 80 60 75 60 95 85

Speech Therapy 20 10 45 30 80 60 75 60 110 100

Surgical Services (Outpatient or

ASC)

20 10 45 30 80 60 75 60 110 100

Specialty Types

Maximum Time and Distance Standards (Time is measured in minutes and distance is measured in miles)

Large Metro County Metro County Micro County Rural County

Counties with Extreme Access Considerations

(CEAC)

Time Distance Time Distance Time Distance Time Distance Time Distance

Therapeutic Optometrist NA 75 NA 75 NA 75 NA 75 NA 75

Urgent Care 20 10 45 30 80 60 75 60 110 100

Urology 20 10 45 30 60 45 75 60 110 100

Vascular Surgery 30 15 60 40 100 75 110 90 145 130

Facility Types for Evaluating Facility-based Providers

Acute Inpatient Hospitals (must have Emergency services available 24/7)

Critical Care Services - Intensive Care Units (ICU)

Surgical Services (Outpatient or ASC)

Free-Standing Emergency Room

Facility-based Provider Types

Anesthesiology Neonatology Hospitalists

Emergency Medicine Oncology - Radiation Pathology

General Surgery Radiology Intensivists Oncology - Medical, Surgical

In its Business Proposal (see Section IV Part I Item 5), Respondent must describe the software or application solution that will help TDI to conduct network adequacy reviews. The description must include the types of standards the solution is capable of measuring, the ability for users to customize and adjust the standards to be measured, and any limits on the standards or ability of users to customize the standards to be measured. Respondent must also describe any internal data that is used (such as data on prospective enrollee locations), including the source of the data, and how frequently the data is updated.

3. Data Analytics Reporting Dashboard Contractor’s solution must include a dashboard or report portal with analytical results of each provider list uploaded by TDI for analysis. It must aggregate the network adequacy compliance analysis for all networks submitted for analysis. The dashboard or report portal must be updated within three (3) business days of TDI uploading a provider list and meet the following requirements:

Ability to confirm when data is uploaded successfully.

Data sets that are configurable and allow TDI to run reports on demand and configure reports as needed.

Reports that compare network specialties across multiple companies and multiple service areas and use historical company data (based on previous analysis completed using the software or solution) to provide information by health plan, physician or provider type, and network.

Reports that are available to TDI in standard file format such as MS Office formats, PDF, or another non-proprietary file format, to allow TDI to export the data.

In its Business Proposal (see Section IV Part I Item 5), Respondent must describe the software or application solution data analytics reporting process.

4. System Availability Contractor must ensure the system is available during TDI’s peak business hours, 8:00am to 5:00pm, Central time, Monday through Friday. The overall uptime and availability of the system must be 99.98%. Any exceptions to this availability must be mutually agreed upon in writing between TDI and Contractor.

Contractor must ensure that any routine maintenance is scheduled in advance and is scheduled for non-peak business hours; peak business hours are (8am – 5pm, Central time, Monday – Friday).

5. Training and Training Materials Contractor must provide interactive on-line training for key agency staff within five (5) business days of testing acceptance. Training must include train-the-trainer sessions and materials.

Contractor must have qualified staff dedicated to training. Training session topics must include, but are not limited to the following:

a) General user training on system functionality

b) How to create and manage reports, and dashboards within the product

c) Administrator functions

d) Machine learning features of the software

Training materials must include, but are not limited to, training manuals for users and train-the trainer, training videos, instructional guides, Frequently Asked Questions (FAQs), best practice standards, and any other relevant resources beneficial for training purposes.

In its Business Proposal (see Section IV Part I Item 5), Respondent must describe the training offered with its insurance form review software.

6. Additional Requirements If any services, functions, or responsibilities not specifically described in this solicitation are an inherent, necessary, or customary part of the services, or are required for proper performance or provision of the services in accordance with this solicitation and any resulting contract, such services, functions, or responsibilities will be deemed to be included within the scope of the services to be delivered to TDI, as if such services, functions, or responsibilities were specifically described in this solicitation and any resulting contract. Any changes will follow the Change Control process described in Section II Part J Item 5 (Change Control).

7. Data Retention In addition to the requirements listed in Section II Part J Item 2 (Records Retention), Contractor must retain reported data for a minimum of five (5) years. Data must be maintained in a format such that the data can be used for reports analyzing historical data.

8. Testing Within 30 calendar days of Contract Execution, Contractor must provide a detailed test plan that describes the scope, approach, strategy, resources, risks, assumptions, and schedule of intended test activities. Test activities will include test cases, test design, parallel testing, security testing, exit criteria, and quality assurance. The test plan is subject to TDI review and approval.

TDI requires a minimum of 14 business days to complete user acceptance tests and identify any deficiencies. TDI will provide a list of deficiencies within seven (7) business days of the completed test. TDI will not consider a deliverable complete until user acceptance tests are completed to TDI’s satisfaction. TDI will provide acceptance of each deliverable in writing.

In its Business Proposal (see Section IV Part I Item 5), Respondent must describe the proposed testing process.

9. Maintenance and Support Contractor must ensure the functionality and operational effectiveness of the system and TDI data during the Contract Term. The Contractor will provide the following types of program maintenance and support for the system and any enhancements, modifications, or customizations that are required and completed by Contractor for the Services provided under this solicitation:

a) Maintenance Contractor must provide the program maintenance listed below.

1) Corrective Maintenance – to correct processing, performance, or implementation faults of the program.

2) Adaptive Maintenance – to adapt to changes in environment such as new hardware of the next release of an operating system to protect the system and adapt to external threats, such as viruses. Adaptive maintenance does not lead to changes in the program functionality.

3) Preventive Maintenance – to maintain the system in satisfactory operating condition by providing for systematic inspection, detection, and correction of initial failures either before they occur or before they develop into major defects.

4) Performance Tuning – to perfect the program for its performance, processing efficiency, maintainability, or accommodation of new or changed user requirements.

5) Emergency Maintenance – to correct system emergencies affecting processing and performance of the program. All scheduled and planned outages must be scheduled with a minimum of 72 hours of advance notice to TDI and must occur only during non-peak hours unless otherwise agreed upon by TDI and Contractor.

b) Technical Support Contractor must provide technical assistance to TDI or system users with technical issues including connectivity problems and password changes, if applicable. Technical support must be available during TDI business hours, 8am to 5pm, Central time, Monday – Friday.

10. Scalability and Flexibility Contractor’s solution must incorporate scalability and flexibility to accommodate changes due to technological improvements or enhancements, legislative mandates, and program changes that are within the scope of this solicitation. Contractor agrees to support modifications that TDI requests when the requested changes are necessary to maintain the accuracy, functionality, security, and integrity of the system. Any such revisions will be coordinated with Contractor and follow the change management process.

11. Electronic and Information Resources Accessibility Standards Texas government statute and rules require that electronic and information resources (EIR) used, developed, procured, or maintained by Texas agencies and institutions of higher education are accessible to people with disabilities. See Texas Government Code Chapter 2054 Subchapter M.

12. Licenses and Enhancements Contractor’s solution must include the type of license TDI will receive, i.e., perpetual, site, concurrent, SaaS, or other type included with the solution, as well as, including any enhancements, modifications, or customizations completed by Contractor for the Services provided under this solicitation. The licenses and enhancements must be for perpetual use by TDI at no cost to TDI for the life of the system.

At the end of the Contract Term, TDI must have the option to execute a new Contract for maintenance and support for the product and any enhancements, modifications, or customizations completed by Contractor for the Services provided under this solicitation.

G. TDI’s Technical Environment

1. Enterprise Client Computing Environment TDI’s client computing environment is comprised of Intel-based laptops running 64-bit Windows Operating System. Microsoft Edge, Mozilla Firefox, and Google Chrome are supported browsers.

Microsoft Office 365, including SharePoint and the Office client suite, is standard for office automation needs such as email, word processing, spreadsheets, presentations, collaboration, file sharing, and small databases. A network faxing solution is also standard for e-fax capability. All workstations are managed through a directory service.

Agency-owned mobile devices are used by staff requiring the additional mobility. These mobile devices are managed through an enterprise Mobile Device Management (MDM) solution.

Supported devices are iOS11 and up.

Xerox Multi-Function Devices (MFDs) are located throughout all agency sites for services including print, copy, fax, and scan. Staff that are not based in any agency sites use stand-alone multi-function or portable printers.

2. Server Environment TDI is a customer of the State Shared Technology Services (STS) Data Center Services (DCS) program overseen by the Texas Department of Information Resources (DIR). The agency utilizes a broad server environment, hosted by multiple STS contractors, which provides data center services including: hosting of agency systems both in an on-premise and cloud environment, data center security, operating system security patching, backup and monitoring of systems, and disaster recovery.

The TDI Server Environment consists of a combination of Windows and Linux systems and consist of file sharing, application, database, and utility servers.

TDI provides web content to both public and internal employees via Microsoft Internet Information Security (IIS).

The current database standard is Oracle. Any database versions used with the third-party product(s) must fully support the current certified supported version. Microsoft SQL is used to support any third-party applications that will not run under Oracle.

3. Telecommunications Infrastructure All TDI offices are connected through an Ethernet topology and connect to the Texas State Data Center through a TDI-managed WAN network.

Agency phones and contact centers are connected through an internally managed VOIP system.

TDI has one main office building site located in the Austin area and multiple field office locations across the state. All field offices are directly connected through the agency WAN with circuits varying by number of staff and business functions performed in the office. All sites have both wired and wireless (Wi-Fi) connectivity.

H. Hosting

Data Center Services (DCS) Infrastructure Requirements The Texas Legislature, by action of House Bill 1516, 79th Legislature (Regular Session), established the foundation of a shared technology infrastructure and directed DIR to coordinate a statewide program to consolidate infrastructure services. Section 2054.391 requires State agencies included in the DCS program to use such services, unless otherwise approved by DIR through a DCS Exemption. DIR currently has executed multi-vendor contracts to provide data center managed services for DIR Customers (state agencies).

All hosted solutions offered in response to this RFO (including custom developed application, COTS, and Portal or Website managed content) must host the application or solution in the DCS program, using either public or private cloud compute and DCS managed services provided.

Respondents should comprehensively list their infrastructure or compute requirements, to be hosted in either a DCS public or private cloud, for financial review by TDI. TDI will facilitate the process to request an estimate of the cost to host the solution within the DCS program.

If the Respondent intends to propose Software as a Service (SaaS), then the Respondent must demonstrate that the solution clearly meets the National Institute of Standards and Technology (NIST) standard definition of SaaS (NIST Definition of Cloud Computing Special Publication 800- 145). The solution must be TX-RAMP certified (or equivalent substitution). TDI will be required to request and receive from DIR a DCS program exemption before a contract can be awarded to a Respondent if the solution is purchased outside of the DCS program.

Respondent must also complete and submit the Solution Questionnaire in Attachment 1.

More details about the DCS Vendor Contracts, Master Services Agreements (MSAs), and Statements of Work (SOWs) may be found on DIR’s website at: www.dir.texas.gov.

Respondents should provide one technical solution: either SaaS or DCS hosted and managed. If your proposal is for a hosted solution, it will need to be hosted in the State’s DCS program, which offers both public and private cloud hosting options. This program provides all server management functions including system administration, operating system management and patching, base security services, dedicated local area network connectivity, storage services, backup services, and disaster recovery services. Respondents should indicate whether it is proposing fully managed, or semi managed DCS infrastructure hosting and compute solutions required.

Respondents are not required to estimate the cost to host within the DCS program; however, Respondents are required to provide complete technical specifications in order for TDI to estimate.

Collectively, the DCS contracts provide participating state agencies mainframe and server operations, both public and private cloud services, disaster recovery, and bulk print and mail services.

DCS Public and Private Cloud Compute and Software Acquisition As a participating entity in the DCS program, TDI is required to acquire all in-scope infrastructure compute, services, and software through the DCS program. Respondents must include complete compute and software infrastructure requirements in their response in order for TDI to estimate DCS costs.

The Successful Respondent is required to participate in the procurement process, including, participating in the requirements gathering session, and validating any DCS created solution proposals. Proper long-range planning is required in order to ensure compute is provisioned to meet project schedules.

DCS Process Management The Successful Respondent may be asked to participate in the defined DCS processes for incident management, problem management, change management, release management, configuration management, and request management. In the management plans described in this RFO Section H, the Respondent must describe its interactions with the DCS program.

DCS Public Cloud Industry leading public cloud services available from DIR Shared Technology Services are hardened public cloud virtual data center solutions with a focus on aligning the DCS Operating Model with Industry Best Practices, technical and security assurances, and onboarding of public cloud services through Amazon Web Services (AWS), Azure, and Google.

Leveraging Cloud Native tooling, the DCS Cloud Service model is poised to align to the value of Cloud Service Providers by evolving capabilities with investment in Service Evolution of the Public Cloud. Our expanded Public Cloud model delivers Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and SaaS services with products and tooling built for and within the Public Cloud to leverage the full benefits of Public Cloud services with the security assurances of DCS. For more information on the DCS Public Cloud see Appendix C – Additional DCS Hosting Information.

DCS Private Cloud The Data Center Services program maintains two consolidated data centers geographically separated in order to provide disaster recovery. The Texas Private Cloud (TPC) provides technology infrastructure compute and storage based on standard reference models and managed services options. For details see Appendix C – Additional DCS Hosting Information.

Functions Retained by TDI – Not Provided by Data Center Services For clarity, the following services are not provided by DCS Service Providers. In developing your response, the Respondent should clearly understand that the requestor (agency) performs these functions as needed.

• End-user computing, including desktop, mobile, and LAN-attached multi-function devices.

• Network support, including WAN/LAN support outside of the State data centers, voice/phone support.

• Help desk (Level I – all services).

• Expert troubleshooting and support for all non-DCS services.

• Technology planning, strategies, and visioning.

• Project management.

• Disaster recovery planning and testing for all retained services.

• Business continuity planning for agency processes.

• Packaged imaging systems (scanners, servers, optical disks, etc.).

• Coordination of data center print services, including coordinating form changes with business units, volume trending.

• Data security, security design and policy development, systems access requests

(directory/file, ID creation and removal, determination of access rights).

• Logical database administration.

• Application development, support, maintenance, and monitoring.

• Electronic payment processing services.

• Data import and export to the environment (FTP services).

• Reporting services.

For additional details, see Appendix C – Additional DCS Hosting Information.

I. Security

1. General Security Requirements Personally Identifiable Information (PII) refers to information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual. Examples of PII include but are not limited to:

• name, such as full name, maiden name, mother’s maiden name, or alias;

• date of birth;

• personal identification numbers, such as a driver’s license number;

• address information, such as a street address or email address; and

• all future additions to PII as stipulated by the laws, statutes, rules, and rulings that govern

Texas data.

a) Security Incidents TDI defines a “Security Incident” as an event that results in unauthorized, access, loss, disclosure, modification, or destruction of information resources, whether accidental or deliberate. An instance in which a user or other person circumvents or defeats the controls of a system to obtain unauthorized access to system resources or to information contained in the system. A Security Incident may or may not turn into a Data Breach. Contractor and any subcontractors who have a reasonable belief that a Security Incident has occurred must notify TDI immediately (within one hour) upon discovery or detection. Within 24 hours of a Security Incident, Contractor will provide a Security Incident report that includes, at a minimum:

• The facts surrounding the incident;

• What mitigating actions have already been taken;

• Whether the incident is an ongoing security threat and whether additional actions or resources are needed to stop it;

• Types of information involved;

• Classification of information involved;

• The number of individuals whose information is affected;

• Whether the information was encrypted;

• Whether information systems were affected, and

• Other relevant information under the circumstances.

b) TDI Actions as a Result of Contractor’s Failure to Safeguard TDI Data TDI, in its sole discretion, reserves the right to conduct an independent investigation of all Security Incidents; Contractor will be responsible for the costs of any such investigation. In the event TDI has a reasonable belief that Contractor has not safeguarded the PII, TDI may enact the actions listed below.

1) Disconnect or suspend, in whole or in part, services provided under the Contract until Contractor has remediated all issues to the satisfaction of TDI.

2) Require Contractor, at its own cost, to provide notice that satisfies the requirements of the Texas Business and Commerce Code Section 521.053.

3) If TDI elects to send a separate notice, Contractor will reimburse TDI the costs associated with the notice. TDI reserves the right to collect such costs from Contractor if Contractor fails to reimburse TDI within 30 calendar days of TDI’s written request.

4) At TDI’s request, require Contractor to purchase, at its own cost, an identity theft protection service for all individuals whose information was disclosed without authorization. The protection service must cover each individual for a two-year period from the effective date of the identity theft protection service for each individual, must include automatic fraud alerts to the individual, and must include monitoring services. Contractor will be responsible for all costs.

c) Protected Information Contractor must have measures in place to protect employees’ PII/SPI/PHI and must comply with HIPAA and the Health Information Technology for Economic and Clinical Health (HITECH) Act as it relates to HIPAA regulations. TDI reserves the right to review policies, procedures, and plans that detail those protective measures.

2. Password Guidelines and Requirements Contractor must provide a unique ID and password for each individual to access the system and must implement password policies that adhere to the standards listed below. Respondent’s Business Proposal must include a description of how Respondent will meet the requirements listed in this item.

a) Password policies and standards must be the same for all users.

b) Contractor must maintain a comprehensive password policy to include the methods of password storage and transmission, password composition, documentation of authorized users, applicable mandates, regulations, and all guidelines that Contractor uses for password management. The password policy document must include all Contractor’s password guidelines and methods, if applicable.

c) At a minimum, passwords must meet or exceed NIST 800-63B rev. 3 requirements.

d) Password security efforts and standards must allow for continuous, ongoing security measures and improvements to respond to any current and future security threats throughout the Contract Term. Any proposed changes to existing standards must be approved by TDI.

e) Contractor must maintain and update the password policies and standards on an annual basis.

f) The solution must support single sign on (SSO) and support the most common, widely used protocols that enable SSO relationship such as SAML, OpenID Connect, OAuth 2, and WS- Federation.

3. Security Standards Contractor must adhere to the security requirements and standards below to the extent possible.

Contractor must maintain current knowledge of the listed standards and apply updates to the solution to remain current with the security standards.

• Texas Administrative Code Title 1 Chapters 202, 203, and 206;

• National Institute of Standards and Technology (NIST);

• Payment Card Industry Data Security Standards (PCI DSS);

• International Organization for Standardization (ISO) 27001; and

• Criminal Justice Information System (CJIS).

Contractor must comply with the Texas Business and Commerce Code Chapter 521 to the extent applicable.

4. Data Security Contractor will ensure TDI data is protected against unauthorized access, disclosure, modification, or destruction, whether accidental or deliberate, and ensure the availability, integrity, and confidentiality of information. At a minimum, to prevent unauthorized access, Contractor must:

• restrict physical and electronic access to all data provided by TDI;

• verify individual access…