ESBD_376748_1729547800849_Addendum No.2.pdf

Texas Department of Insurance

Request for Offers Network Adequacy Software

RFO No. 454-25-0101-31688-EM Addendum No. 2

Issue Date: October 21, 2024

A. Purpose of Addendum Addendum Item 1: To publish answers to submitted questions.

B. Addenda Items Questions and Responses

Questions are organized by inquiring party. Respondents are urged to read all questions and responses.

All typographical errors, errors in spelling, or incorrect or inaccurate references are in the original questions. Texas Department of Insurance (TDI) determined not to alter them.

Similar or similarly-asked questions are answered only at the first instance of the question. Each subsequent instance refers back to the question number containing the applicable response.

Where a simple “yes,” or “no,” response is given, TDI determined that no further qualification was needed.

RFO No. 454-25-0101-31688-EM

Addendum No. 2

No. Question Response 1 Can TDI provide additional details on the expected frequency and volume of provider list uploads? This will help in designing the system to handle peak loads effectively.

Reference: Section II.F.1- Network Adequacy Data Analytics (Page 10).

TDI receives 10-20 provider lists throughout the year, but estimates a volume increase every April of approximately 130-140 provider list uploads.

2 Are there any specific formats or data standards required for the output reports, aside from the standard Microsoft Office formats? Reference: Section II.F.3- Data Analytics Reporting Dashboard (Page 15)

No, see Section II, Part F, Item 3d).

3 Can you clarify if there are any specific exceptions or special conditions in the network adequacy standards that the software needs to account for, such as specific provider types or geographic areas?

Reference: Section II.F.2- Network Adequacy Standards for Compliance Analysis (Page 11).

See Section II, Part F, Item 2.

4 Will TDI provide the necessary updates to network adequacy standards as they change, or will the contractor need to monitor and implement these changes independently? Reference: Section II.F.2- Network Adequacy Standards for Compliance Analysis (Page 11).

Yes, see Section II, Part F, Item 2. The solution must include flexibility to allow TDI to add to or modify these standards.

5 Are there any existing systems or databases that the proposed solution must integrate with? If so, please provide details on the required interfaces and data exchange formats. Reference: Section II.G- TDI’s Technical Environment (Page 18).

No, the data just needs to be exportable.

See Section II, Part F, Item 3.d).

6 Are there any specific APIs or data sources that the system needs to interface with for real-time data validation or integration?

Reference: Section II.G.2- Server Environment (Page 19).

No, there are no specific APIs or data sources that the system needs to interface with for real-time date validation or integration.

Addendum No. 2

No. Question Response 7 Can you provide more details on the specific data security standards and protocols required, particularly around the handling of personally identifiable information (PII) and health information? Reference: Section II.I.1- General Security Requirements (Page 22).

See Section II, Part I, Item C and Section II, Part I, Item 3.

8 Are there any additional security certifications or audits, beyond those listed (e.g., NIST, HIPAA), that the contractor must adhere to during the contract term?

Reference: Section II.I.3- Security Standards (Page 23).

No, all security requirements are included in the RFO.

9 For the SaaS solution, is there a preference for a specific cloud provider, or is the choice of provider at the discretion of the contractor, provided that it meets the TX- RAMP certification? Reference: Section II.H- Hosting (Page 19).

No, Respondent must propose their solution in accordance with Section II, Part H.

10 If proposing a DCS-hosted solution, what are the specific performance expectations or SLAs for the hosted environment beyond what is provided in the RFP? Reference:

Section II.H- Hosting (Page 19).

See Section II Part K for performance and service specifications and Section II, Part F, Item 4.

11 Can you provide more details on the required depth and duration of the train-the-trainer sessions? Are there specific user roles or groups that need focused training sessions? Reference: Section II.F.5- Training and Training Materials (Page 16).

The training must include administrator training (if applicable), general user training, including but not limited to running reports, creating dashboards, automated business rule-based workflows, and creating queries.

The administrator training must also include how to manage the application and its customizations on the back end.

Specifics will be provided once the vendor is selected, as this is based on the type of license procured.

Addendum No. 2

No. Question Response 12 Will ongoing training and support for new system features be required during the contract term, and if so, how frequently should this be conducted? Reference:

Section II.F.5- Training and Training Materials (Page 16).

Yes, it will be required.

For minor system feature changes, Contractor must notify the Contract Administrator within 3 business days by email.

For major system feature changes that will greatly impact normal daily workflow, the Contractor must notify the Contract Administrator in 7 business days and offer at least two training sessions by videoconference that TDI will record. The training sessions will be on a mutually agreed upon date and time, for each role depending on the licenses type procured.

13 Are there specific performance metrics or KPIs that TDI will use to evaluate the success of the software solution? If so, please provide a detailed list. Reference: Section II.K.1- Performance Standards (Page 29).

See Section II Part K for performance and service specifications.

14 Can you provide more details on the required format and content of the weekly and monthly status reports? Reference:

Section II.J.1- Communication Protocols (Page 26)

See Section II, Part J, Item 1 for details on the required format and content of the weekly and monthly status reports.

15 Could you clarify the expected process and communication protocol for planned and emergency maintenance windows?

Reference: Section II.F.4- System Availability (Page 16).

See Section II, Part F, Item 9.

16 Are there any critical business operations or time periods where the system must be available without exception? Reference:

Section II.F.4- System Availability (Page 16).

See Section II, Part F, Item 4. Contractor must ensure that any routine maintenance is scheduled in advance and is scheduled for non-peak business hours; peak business hours are (8am – 5pm, Central time, Monday

– Friday).

Addendum No. 2

No. Question Response 17 What is the expected timeline for the

Change Control process in the event of legislative changes that impact the software’s functionality or compliance requirements? Reference: Section II.J.5- Change Control (Page 27).

The timeline will depend on the complexity of the legislative change. TDI is not able to provide an expected timeline.

18 Are there specific scenarios where changes to the contract terms would require legislative approval or additional authorization from TDI? Reference: Section II.J.6- Legislative Changes (Page 28).

TDI is not able to provide specific scenarios.

19 Can you provide additional details on the testing and acceptance criteria for deliverables? Are there specific performance benchmarks that must be met during testing? Reference: Section II.F.8- Testing (Page 17).

See Section II, Part F, Item 8. Within 30 calendar days of Contract Execution, Contractor must provide a detailed test plan that describes the scope, approach, strategy, resources, risks, assumptions, and schedule of intended test activities. Test activities will include test cases, test design, parallel testing, security testing, exit criteria, and quality assurance. The test plan is subject to TDI review and approval.

20 What is the process for handling deficiencies identified during user acceptance testing? Is there a predefined timeline for corrective actions? Reference: Section II.F.8- Testing (Page 17).

TDI will not consider a deliverable complete until user acceptance tests are completed to TDI’s satisfaction The timeline for corrective actions is generally within a week or a timeframe that is mutually agreed upon.

21 Approximately how many issuers and networks does TDI expect to evaluate using the system?

See response to question 1. TDI estimates 70 companies.

Addendum No. 2

No. Question Response 22 Will the state provide a standard statewide census file that is to be used to determine the "potential members" per county and with access?

No, see Section II Part F, Item 2. In its Business Proposal (see Section IV Part I Item 5), Respondent must disclose the source of the representative data set and describe how it approximates the locations of prospective enrollees.

The vendor should obtain a representative data set such as the Qualified Health Plan Population Sample File provided by the Centers for Medicare and Medicaid Services.

23 How many active requests do you expect to have open at any one time? With a threeday turn around is there a chance that multiple requests come in at once?

Yes, TDI estimates 130 active requests could be sent at once, on the same day.

24 How large is the population dataset that this analysis will be processed against?

The vendor should obtain a representative data set such as the Qualified Health Plan Population Sample File provided by the Centers for Medicare and Medicaid Services.

for Medicare and Medicaid Services.

See Scope of Work Section II Part F Item 2.

Only data for Texas residents would be needed, which would be an extract from the nationwide population sample.

See response to Question 22.

25 How large are the provider datasets provided with each analysis? A rough maximum and a rough average would be helpful.

TDI estimates 2-18 Megabyte’s.

26 Do you have a spark-based environment we could use to run the calculations? If not, can we deploy a spark-based local cluster in your cloud/on-prem servers?

See Section II, Part H, Hosting.

27 What existing mapping or spatial analytics software is currently in use at TDI?

None at this time.

https://www.qhpcertification.cms.gov/s/Network%20Adequacy https://www.qhpcertification.cms.gov/s/Network%20Adequacy

Addendum No. 2

No. Question Response 28 What specific types of Services will be required under the Scope of Proposal?

Example, Time and Materials (hourly consulting)? Managed Cloud Services?

Deliverables-based Services under a Firm Fixed Price Model?

All services requested in RFO 454-25-0101-

31688-EM.

29 TDI is eligible to leverage the terms and conditions contained in the Master Purchase Agreement (State of TX DIR Contract No.

DIR-CPO-4699) between Respondent and The State of Texas, acting by and through the Department of Information Resources (“DIR”) effective July 18, 2022 (hereinafter referred to as the “Agreement”).

Respondent can agree to non-conflicting terms and conditions under the RFO. Will TDI agree to purchase through the Texas State DIR MPA DIR-CPO-4699?

Yes.

30 It is stated in the RFO that in the Respondent’s proposal, the Respondent can provide their exceptions to the identified section and their proposed alternative language. Respondent’s ability to agree to the following sections under the RFO, including but not limited to, Security, Acceptance Testing, Performance and Service Specifications, System Service Levels and liquidated damages, will be contingent on the type of Service proposed and the type of Security required thereunder. Will TDI accept exceptions to these sections?

Respondent must follow the process outlined in Section III, Part I. Respondent Exceptions and Assumptions. TDI will review all exceptions submitted.

31 Will you take exception to Section 29.

“Property Rights”?

See response to question 30.

32 Are you willing to extend the deadline of the RFO to October 24, 2024?

See Addendum No. 1. The deadline for the submission of proposals is October 29, 2024, 3:00 p.m., Central time.

Addendum No. 2

No. Question Response 33 Language: The standards for encryption

"must be the latest industry-accepted encryption" and "FIPS 140-3 validated modules" are required. Clarification Question: Will TDI specify any additional encryption protocols or technologies beyond FIPS 140-3, and what happens if standards change during the contract term?

See Section II, Part I, Item 5, Contractor will use the latest industry accepted encryption standards for data encryption at rest and in transit.

34 Language: The document prohibits subcontracting work without prior TDI approval. Clarification Question: Is there a posted procedure how to get a subcontractor approved, or are there any pre-approved subcontractors or types of services that would not require additional approval from TDI?

See Section II Part K and Section VI, Part B, Item 36.

Contractor may not subcontract any or all of the work and/or obligations due under the Contract without prior written approval of

TDI.

Respondent’s Business Proposal must include a description of how Respondent proposes to measure and report to TDI the performance associated with each listed task in Section II, Part K.

35 Language: TDI and the Contractor may execute a Contract Amendment and/or TDI Purchasing and Contract Administration Program may provide a revised Purchase Order (PO) or PO Change Notice (POCN) to Contractor along with a letter indicating the effective date of the change, the amount of the change in cost (if any) Clarification Question: Will there be an agreed upon time frame to allow for internal modification of services?

Changes impacting deadlines and service obligations will be reflected in a mutually agreed upon amendment, unless required by law.

36 Language: The document sets a high service availability requirement of 99.98% uptime, with no clear definition of penalties for failing to meet this threshold. Clarification Question: Is there an established list of SLA’s other than the stated 99.98%?

No, see Section II, Part K.

Addendum No. 2

No. Question Response 37 Language: Only those Proposals that are responsive to the solicitation will be evaluated using the criteria and the points set forth in Section I. Clarification Question:

Will those respondents not chosen for further evaluation be notified?

No, see the Texas Public Information Act (Chapter 552 of the Texas Government Code). TDI will post the final award to the Electronic State Business Daily (ESBD).

38 Language: The document allows TDI to adjust the contract based on new legislation.

Clarification Question: How will contract pricing be adjusted if legislative changes increase the contractor’s scope of work or deliverables?

All changes will be mutually agreed upon.

39 Language: Contractors must report security incidents within one hour but there are no details about what qualifies as a "reasonable belief" of a security breach. Clarification Question: Can TDI provide more detailed definitions of what constitutes a security incident that would require reporting within one hour?

See Section II, Part I, Item 1a).

40 Language: The section refers to both "administrative" and "substantive" changes but does not clearly define the scope of each. Clarification Question: Can you clarify the distinction between "administrative" and "substantive" changes, and what process TDI will follow for approving each type?

See Section II, Part J, Item 5.

41 Language: The criteria for automatic disqualification include "non-responsive" proposals, but "non-responsive" is not fully defined. Clarification Question: Can TDI provide a more specific definition of "non-responsive" to avoid potential misunderstandings?

See Section I, Item 20 and Appendix B.

Addendum No. 2

No. Question Response 42 Clarification Question: Is the respondent allowed to include a co-bid partner to the RFP submittal?

No, see Section II Part A. TDI anticipates making a Contract Award to one Successful Respondent (“Contractor”) for the Services required by the solicitation.

Additionally, see Section VI, Part B, Item 36.

Contractor may not subcontract any or all of the work and/or obligations due under the Contract without prior written approval of

TDI.

C. Acknowledgement of Receipt of Addendum No.2

Signature of Authorized Representative Date Signed

Printed Name and Title of Authorized Representative

Respondent Company Name

Qualified Health PlanPopulation Sample File