ESBD_379399_1732061513073_HHS0014749 CIMS RFO.pdf

Version 2.10 RFO No. HHS0014749 Page 1 of 58

Cecile E. Young, Executive Commissioner

Request for Offers (RFO) for

Critical Incident Management System (CIMS)

RFO HHS0014749

Date of Release: November 19, 2024

Deadline for Submission of Solicitation Responses: See Section 3.1 for Schedule of Events

NIGP Class/Item Codes

920-07 *Application Service Provider (ASP), Web Based Hosted 920-31 *Installation of Computers, Peripherals, and Related Equipment (Including Software) 920-35 *Modification of Existing Equipment (Including Cost of Parts) 920-44 *Risk Management for Software Development 920-45 *Software Maintenance and Support Services 920-46 *Software Updating and Upgrading Services 920-66 *System, Network, Database, DBA Administration Services 920-75 *Technical Writing and Documentation, IT Services 920-91 *Training, Computer Based, Software Supported

(*) Automated Information Systems (AIS)

Version 2.10 RFO No. HHS0014749 Page 2 of 58

Table of Contents Article I. Introduction, Definitions, and Authority

1.1 Introduction

1.2 Definitions and Acronyms

1.3 Authority

Article II. Scope of Work

2.1 Description of Services

2.1.1 Contractor Personnel Services

2.1.2 CIMS Requirements

2.1.3 Texas Risk and Authorization Management Plan

2.1.4 Contract Phases Overview

2.1.5 Service Level Requirements and Associated Remedies

2.1.6 Supplemental Services

2.1.7 Reduced Services

2.1.8 Accessibility Requirements

2.2 Contract Award, Term, and Historical Compensation

2.2.1 Contract Award and Execution

2.2.2 Contract Term

2.2.3 Historical Compensation

2.3 Data Use Agreement and Security Privacy Inquiry

2.4 Invoice Requirements

2.5 No Guarantee of Volume, Usage, or Compensation

Article III. Administrative Information

3.1 Schedule of Events

3.2 Ambiguity, Conflict, or Discrepancy

3.3 Inquiries

3.3.1 Sole Point of Contact

3.3.2 Prohibited Communication

3.3.3 Exception to Sole Point of Contact

3.3.4 Solicitation Questions

3.4 Pre-proposal Conference

Version 2.10 RFO No. HHS0014749 Page 3 of 58

3.4.1 Attendance

3.4.2 Conference Logistical Information

3.4.3 Questions at Pre-Proposal Conference

3.5 Solicitation Response Composition

3.5.1 General Information

3.5.2 Page Limit and Supporting Documentation

3.5.3 Discrepancies

3.5.4 Exceptions

3.5.5 Assumptions

3.5.6 Binding Offer

3.6 Solicitation Response Submission and Delivery

3.6.1 Deadline

3.6.2 Submission Option

3.6.3 Submission Checklist

3.6.4 Labeling and Delivery for USB Drive Submission and Other Materials

3.6.5 Modifications and Withdrawals

3.6.6 Procurement Library

Article IV. Solicitation Response Evaluation and Award Process

4.1 Conformance with State Law

4.2 Best Value Determination

4.2.1 Selection Methodology

4.2.2 Minimum Qualifications

4.2.3 Initial Compliance Screening

4.2.4 Written Solicitation Response Evaluation

4.2.5 Written Response Evaluation Criteria

4.2.6 Best and Final Offer (BAFO)

4.2.7 Final Written Response Score

4.2.8 Summary of Best Value Determination

4.3 Questions or Requests for Clarification

Article V. Narrative/Technical Proposal

5.1 Narrative Proposal

Version 2.10 RFO No. HHS0014749 Page 4 of 58

5.1.1 Executive Summary

5.1.2 Project Work Plan

5.1.3 Staffing Profile

5.2 Technical Proposal

5.2.1 Technology Architecture

5.2.2 System Availability and Capacity

5.2.3 Software Components

5.2.4 System Integration

5.2.5 System Administration, Support, and Maintenance

5.2.6 System Security and Disaster Recovery

5.2.7 Performance Monitoring and Management

5.2.8 Appendices

5.2.9 Accessibility

Article VI. Required Respondent Information

6.1 Company Information

6.1.1 Company Narrative

6.1.2 Company Profile

6.2 Authorization to Conduct Business in Texas

6.3 References

6.4 Major Subcontractor Information

6.5 Affirmations and Certifications

6.6 Other Reports

6.6.1 Dun and Bradstreet Reports

6.6.2 Financial Statements and Financial Solvency

6.6.3 Alternate Report

6.7 Corporate Guarantee

6.8 HUB Subcontracting Plan

Article VII. Cost Proposal

7.1 Cost Proposal

Article VIII. General Terms and Conditions

8.1 General Conditions

Version 2.10 RFO No. HHS0014749 Page 5 of 58

8.1.1 Changes, Modifications, and Cancellation

8.1.2 Offer Period

8.1.3 Costs Incurred

8.1.4 Contract Responsibility

8.1.5 Public Information Act - Respondent Requirements Regarding Disclosure

8.1.6 Respondent Waiver – Intellectual Property

8.1.7 Standards of Conduct for Vendors

8.1.8 Disclosure of Interested Parties

8.2 Insurance

8.2.1 Required Coverage

8.2.2 Alternative Insurability

8.3 Protest

Article IX. List of Exhibits, Forms, and Attachments

The Remainder of This Page Intentionally Left Blank

Version 2.10 RFO No. HHS0014749 Page 6 of 58

ARTICLE I. INTRODUCTION, DEFINITIONS, AND AUTHORITY

1.1 INTRODUCTION

HHSC is seeking a qualified Contractor to provide a modern, adaptable, single source, cloud-based, Contractor hosted Software as a Service (SaaS) or DCS hosted COTS (Commercial-Off-the-Shelf), Critical Incident Management System (CIMS) to be used by Medicaid waiver Providers established under Sections 1915(c) (https://www.ssa.gov/OP_Home/ssact/title19/1915.htm) and 1115 of Social Security Act. The CIMS is used to report all Critical Incidents as defined in federal law and regulation. The CIMS provides a mechanism to allow HHSC to develop efficiencies in oversight and to comply with CMS guidance as outlined in Modifications to Quality Measures and Reporting in Section 1915(c) Home and Community-Based Waivers published by the Centers for Medicare and Medicaid Services (CMS) on March 12, 2014 (see Exhibit M, Modifications to Quality Measures and Reporting in §1915(c) – HCB Waivers).

Key requirements of the SOW include:

a. Comply with federal reporting requirements;

b. Improve data analytics capabilities;

c. Provide one location for all reported Critical Incident data which allows for efficient and effective cross Program analysis; and

d. Automate data feeds to reduce entry and potential for errors with a manual data entry process. The ability to analyze data across all Programs reporting Critical Incident data will provide insight on potential underreporting or data entry errors due to inadequate training of Providers.

HHSC PCS will administer the procurement process for this Solicitation, which includes RFO publication, handling of communications from vendors, and managing the receipt of Solicitation Responses for review and evaluation.

To be considered for award, a Respondent must execute Exhibit A, HHS Solicitation Affirmations, Version 2.4 and provide all other required information and documentation as set forth in this Solicitation.

Prior to award of the Contract, Respondent must obtain The Texas Risk and Authorization Management Program (TX-RAMP) level 2 certification. TX-RAMP provisional status does not satisfy the TX-RAMP level 2 certification requirement. For this Solicitation, HHSC shall not provide “agency-sponsored” TX-RAMP provisional status certification to any Respondent.

Information regarding HHSC and its Programs is available online and can currently be accessed at HHSC website address: https://www.hhs.texas.gov.

https://www.ssa.gov/OP_Home/ssact/title19/1915.htm https://www.hhs.texas.gov/

Version 2.10 RFO No. HHS0014749 Page 7 of 58

1.2 DEFINITIONS AND ACRONYMS

Refer to Exhibit B, Health and Human Services (HHS) Uniform Terms and Conditions (UTC) – Vendor, Version 3.4 and Exhibit D, HHS Data Use Agreement (DUA), Version. 8.5, for additional definitions (e.g., Contract, Contractor, Deliverable, Effective Date, Historically Underutilized Business (HUB) Services, Solicitation Response, Subcontractor, System Agency, and Work).

As used in this Solicitation, unless a different definition is specified or the context clearly indicates otherwise, the following terms and conditions have the meanings assigned below:

“Acceptance Criteria” means the criteria that must be met by Contractor for a Deliverable to be considered completed under the terms of the Contract and for Contractor to receive payment.

“Addendum” means a written clarification or revision to this Solicitation issued by HHSC PCS and posted to the ESBD.

“ANE” means abuse, neglect, and exploitation.

“Applicable Laws” means all State and federal laws and regulations applicable to the Services and Contractor’s performance under the Contract, including without limitation the laws and regulations identified in Exhibit D, HHS Data Use Agreement (DUA), Version 8.5) and cited in the Contract.

“Available” or “Availability” means Users are able to access the CIMS, including the training site;

Users are able to log in to the CIMS and perform business functions; and all automated processes are running as scheduled.

“Award Consideration (AC) Documents” means documents Respondent must submit as part of the Solicitation Response to be considered for negotiations or award.

“BAFO” means Best and Final Offer.

“Business Day” means Monday through Friday, 7:30 am – 5:30 pm CT, excluding any days designated as “All agencies closed” on the State Holiday Schedules posted on the Texas State Auditor’s Office website located at www.sao.texas.gov.

“Calendar Day” means every consecutive day (measured from midnight to midnight) of the year, including holidays and weekends.

“CFR” means Code of Federal Regulations.

“CIMS” means the Contractor’s Critical Incident Management System.

http://www.sao.texas.gov/

Version 2.10 RFO No. HHS0014749 Page 8 of 58

“CLASS” means Community Living Assistance and Support Services.

“CMS” means Centers for Medicare & Medicaid Services.

“Competitive Range” has the same meaning as the definition under Title 1 of the Texas Administrative Code Part 15, Chapter 391, Subchapter A, Rule §391.107(3).

“Configure” or “Configuration” refers to an option included in the source code which permits HHSC to choose from a pre-defined range of selections that typically relate to the functionality and look-and-feel of an application.

“Contractor Personnel” means individuals who, on behalf of Contractor, will or may participate in the Contract including all officers, employees, replacement personnel, agents, vendors, Subcontractors, and other representatives of Contractor regardless of how employed or contracted by Contractor.

“Contract Term” means the period beginning with the commencement date or Effective Date of a Contract and ending when the Contract expires in accordance with its terms, or when it has been terminated.

“COR” means change order request, which is a formal, written proposal to modify a Project's scope, specifications, or requirements.

“COTS” means ‘commercial-off-the-shelf’ software that is ready-made and available for purchase or licensing on the commercial market.

“Critical Incident” means any of the following events:

a. Verbal, physical, sexual, psychological, or emotional abuse;

b. Neglect;

c. Exploitation including financial exploitation;

d. Medication errors committed by Program Provider agency staff or occurring under the supervision of Program Provider agency staff;

e. Serious injuries, regardless of the cause or setting in which it occurred;

f. Deaths (unexpected, unexplained, or unusual);

g. Restraints (physical, mechanical, or chemical);

h. Law enforcement intervention;

i. Emergency room visits;

j. Hospital admissions;

k. Elopement or lost or missing person;

l. Seclusions; and

m. Other incidents or events per guidance from CMS, the State legislature, or

HHSC direction.

https://texreg.sos.state.tx.us/public/readtac$ext.TacPage?sl=R&app=9&p_dir=&p_rloc=&p_tloc=&p_ploc=&pg=1&p_tac=&ti=1&pt=15&ch=391&rl=107

Version 2.10 RFO No. HHS0014749 Page 9 of 58

“DBMD” means Deaf Blind with Multiple Disabilities.

“DBMS” means database management software. This is used for storing, manipulating, and managing data, such as format, names of fields, and record and file structures in a database.

“DCS” means Data Center Services. This service allows the State and local governmental entities to outsource management of technology infrastructure Services. DCS provides secure connectivity to select public and private clouds designed around government security and disaster recovery requirements, and flexible service tiers to meet differing needs and budgets.

“DED” means Deliverables Expectation Document. The purpose of the DED is to ensure that agreed-upon expectations are clearly defined before the Deliverable is developed.

“Department of Information Resources” or “DIR” means the administrative agency established under Chapter 2054, Texas Government Code, or its designee.

“Downtime” means a time when the CIMS is not Available.

“ESBD” means the Electronic State Business Daily, the electronic marketplace where State of Texas bid opportunities over $25,000 are posted. The ESBD may currently be accessed at http://www.txsmartbuy.com/esbd.

“Final Written Response Score” refers to the final scoring of the written response as documented in the Solicitation.

"Go-live” refers to when the CIMS will be live and ready for Program use in the production environment for the first time.

“HCBS” means Home and Community Based Services Programs.

“HHSC” means the Health and Human Services Commission.

“HHSC PCS” means Procurement and Contracting Services (PCS), a division of HHSC.

“HIPAA” means Health Insurance Portability and Accountability Act.

“HUB” means Historically Underutilized Business, as defined by Chapter 2161 of the Texas Government Code.

“HUB Subcontracting Plan” or “HSP” means written documentation regarding the use of subcontractors, which is required to be submitted with all responses to State agency contracts with an expected value of $100,000 or more where the State agency has determined subcontracting https://statutes.capitol.texas.gov/Docs/GV/htm/GV.2054.htm http://www.txsmartbuy.com/esbd https://statutes.capitol.texas.gov/Docs/GV/htm/GV.2161.htm

Version 2.10 RFO No. HHS0014749 Page 10 of 58 opportunities are probable. The HSP subsequently becomes a provision of the awarded Contract and shall be monitored for compliance by the State agency during the term of the Contract.

“Key Personnel” means the resources identified by the Contractor to fill primary leadership roles on the Project team or who have critical day-to-day involvement in delivery of the service domains associated with this Contract.

“MCO” means Managed Care Organization.

“MDCP” means Medically Dependent Children Program.

“NIST” means the National Institute of Standards and Technology. The National Institute of Standards and Technology is a physical sciences laboratory and a non-regulatory agency of the United States Department of Commerce. Its mission is to promote innovation and industrial competitiveness.

“Operations Phase” means contract business operations that begins directly after the end of the Transition Phase and continues through contract extensions up through the Turnover Phase.

“Operations Phase Activities” means those activities, including planning, project management, communication, and coordination activities, which are required for the Contractor to complete during the Operation Phase.

“Program” means a set of Medicaid Services delivered by HHSC or its contractors per guidance from CMS, the State legislature, or HHSC direction. Depending on the context, the term includes, but is not limited to, one or more of the following Programs:

a. Deaf Blind with Multiple Disabilities (DBMD);

b. Home and Community-based Services (HCS);

c. Texas Home Living (TxHmL);

d. Community Living Assistance and Support Services (CLASS);

e. Youth Empowerment Services (YES);

f. Medically Dependent Children Program (MDCP);

g. STAR+PLUS Home and Community Based Services (HCBS);

h. Community First Choice (CFC) (the inclusion of CFC as a Program is limited to this Contract); and

i. Adult Mental Health-Home and Community-Based Services (AMH-HCBS).

“Provider(s)” means the HCBS waiver Providers contracted with MCOs, and waiver Providers directly contracted with HHSC.

“Respondent” means the individual or entity responding to this Solicitation.

Version 2.10 RFO No. HHS0014749 Page 11 of 58

“Response Time” means the number of business hours between a technical support request via opened ticket and the Contractor’s initial contact with HHSC.

“Resolution Time” means the time taken by the Contractor to resolve an issue, case, or ticket once it has been opened.

“SaaS” means software as a service and is the capability provided to the consumer (business User) to use applications running on a cloud infrastructure. The applications are accessible from various client devices through a thin client interface such as a web browser (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited User-specific application Configuration settings. Reference: National Institute of Standards and Technology (NIST) standard definition of SaaS provided in NIST Special Publication No. SP 800-145

“SLR” means service level requirements, which are used to evaluate Contractor’s delivery of the required Services.

“Solicitation” means the document issued by the System Agency (including any published addenda, exhibits, and Attachments) under which the goods or Services provided under the Contract were initially requested, which is incorporated by reference for all purposes in its entirety.

“Solicitation Consideration (SC) Documents” means documents that must be submitted by Respondent with the Solicitation Response in order to be considered for evaluation and cannot be resubmitted or have errors remedied after the submission due date and time in the Schedule of Events has passed.

“State” means the State of Texas and its instrumentalities, including HHSC, and any other State agency, its officers, employees, or authorized agents.

“Supplemental Services” means Services aligned with the original purpose of the Contract and reasonably related to the scope of the Contract. These requested Services include the addition of emerging technology such as enhancements and upgrades for products or Services as part of Supplemental Services.

“Transition Phase” means Contract business operations that begin directly after the Contract Effective Date and continues through Go-live.

“Transition Phase Activities” means those activities, including all project management activities required, that take place between the Contract Effective Date and Go-live.

https://csrc.nist.gov/pubs/sp/800/145/final

Version 2.10 RFO No. HHS0014749 Page 12 of 58

“Turnover Phase” means Contract business operations that begin after the end of the Operations Phase which are required for the Contractor to transfer Contract service delivery to HHSC or an HHSC designated successor service provider.

“Turnover Phase Activities” means those activities, including planning, project management, communication, and coordination activities, which are required for the Contractor to transfer Contract service delivery to HHSC or an HHSC designated successor service provider during the Turnover Phase.

“TX-RAMP” means the Texas Risk and Authorization Management Program established by Texas Department of Information Resources (DIR) that provides a standardized approach for security assessment, authorization, and continuous monitoring of cloud computing Services that process the data of a State agency. To become TX-RAMP certified, entities must submit prescribed documentation to DIR. Information regarding TX-RAMP is currently located at:

https://dir.texas.gov/texas-risk-and-authorization-management-program-tx-ramp.

“Users” means HHSC authorized Users, which may include HHSC staff, Providers, MCO staff, and others. Users are given specific access to utilize the CIMS for their specific tasks.

“VPTS” means Vendor Performance Tracking System, as defined under Section 2262.055 of the Texas Government Code and Title 34 of the Texas Administrative Code Part 1, Chapter 20, Subchapter B, Division 2, Rule §20.115 and Subchapter F, Division 2, Rule §20.509.

1.3 AUTHORITY

HHSC is soliciting the Services stated in this Solicitation under the authority of Section 2157.068(e-4) of the Texas Government Code.

https://dir.texas.gov/texas-risk-and-authorization-management-program-tx-ramp https://statutes.capitol.texas.gov/Docs/GV/htm/GV.2262.htm#2262.055 https://texreg.sos.state.tx.us/public/readtac$ext.TacPage?sl=R&app=9&p_dir=&p_rloc=&p_tloc=&p_ploc=&pg=1&p_tac=&ti=34&pt=1&ch=20&rl=115 https://texreg.sos.state.tx.us/public/readtac$ext.TacPage?sl=R&app=9&p_dir=&p_rloc=&p_tloc=&p_ploc=&pg=1&p_tac=&ti=34&pt=1&ch=20&rl=509 https://statutes.capitol.texas.gov/Docs/GV/htm/GV.2157.htm#2157.068

Version 2.10 RFO No. HHS0014749 Page 13 of 58

ARTICLE II. SCOPE OF WORK

2.1 DESCRIPTION OF SERVICES

Contractor shall provide all Services and meet all requirements as described in this Scope of Work (SOW), including the requirements listed in Exhibit N, Requirements Traceability Matrix.

Contractor shall implement the CIMS and provide ongoing support for the CIMS that meets or exceeds HHSC specifications. Contract shall provide a COTS or SaaS solution to meet applicable hosting requirements. If a SaaS hosting infrastructure is proposed, CIMS shall be hosted and managed by the Contractor, and CIMS Solution shall meet the NIST standard definition of SaaS provided in NIST Special Publication No. SP 800-145. If a COTS is proposed, the Contractor shall also comply with the requirements in Exhibit P, DIR DCS Requirements.

Contractor shall provide Power BI reporting tool at no additional cost to HHSC including licensing cost. Contractor shall also deliver Power BI on top of the SSRS ad hoc reporting which can be used for reporting on trends and analytics by MCOs and Providers. Contractor is not required to perform Services on HHSC premises.

Contractor shall take a collaborative, innovative, cooperative, flexible, and customer-oriented approach to the CIMS and shall work with HHSC as necessary to achieve successful outcomes in completing its requirements under this SOW. The CIMS shall include an external portal where all Providers report Critical Incident information, and each Provider shall have access to query their specific data. The CIMS shall provide a mechanism allowing HHSC to develop efficiencies in oversight and to comply with CMS guidance as outlined in Exhibit M, Modifications to Quality Measures and Reporting in §1915(c) – HCBS Waivers.

Contractor shall provide a CIMS Solution that meets the National Institute of Standards and Technology (NIST) standard definition of SaaS provided in NIST Special Publication No. SP 800-

145. If applicable, the Contractor shall also comply with the requirements in Exhibit P, DIR DCS Requirements. HHSC will provide the Contractor with reasonable and timely access to data, information, and staff of HHSC. Contractor shall ensure that all Work Products and artifacts will be accessible to HHSC throughout the Contract Term.

The CIMS shall be compliant with all applicable State and federal laws, regulations, or administrative rules relating to the specific Programs that Contractor will support on behalf of HHSC and those set forth in Exhibit D, HHS Data Use Agreement (DUA), Version 8.5.

CIMS Go-live is no later than November 29, 2025.

Contractor’s primary objectives under this SOW include, but are not limited to, the following:

Version 2.10 RFO No. HHS0014749 Page 14 of 58

a. Provide a CIMS to HHSC for receiving Provider-reported Critical Incident data, including ANE, for Programs.

b. Provide a CIMS with capability to integrate with other Health and Human Services (HHS) systems for related Critical Incident status reporting that will automate data feeds to strategically analyze patterns and trends and inconsistencies.

2.1.1 CONTRACTOR PERSONNEL SERVICES

2.1.1.1 General

a. Contractor shall provide all personnel resources necessary to perform Services described in this Solicitation, unless specifically stated as the responsibility of HHSC.

b. Contractor shall ensure that all Contractor Personnel assigned to this Project and all Subcontractors (if applicable) complete the required security and cybersecurity training and ensure the compliance with all Applicable Laws and regulations governing the handling of HHSC Confidential Information and protected data as identified in Exhibit D, HHS Data Use Agreement (DUA), Version 8.5.

c. Contractor shall ensure that Contractor Personnel conduct themselves professionally and courteously in the performance of their duties and responsibilities under this Contract.

d. HHSC reserves the right to remove Contractor Personnel and the Contractor shall provide substitute staff at no additional cost.

2.1.1.2 Key Personnel

a. Contractor shall provide Key Personnel who possess the required experience, qualifications and certification as specified below in this section. Key Personnel shall include a project manager who will communicate and coordinate with the HHSC project manager throughout the Contract Term to ensure delivery of all service requirements associated with project and security management as detailed in Exhibit N, Requirements Traceability Matrix, Tab 6. CIMS Contractor Deliverables.

b. Contractor project manager

1. Contractor’s project manager shall possess the following skills, certifications, and experience:

i. Active Project Management Professional (PMP) certification from the Project Management Institute;

ii. Experience implementing proposed CIMS with a minimum of one (1) client;

and

iii. Experience with CIMS application functional and technical design and architecture.

2. It is preferred that the Contractor’s project manager possess the following:

Version 2.10 RFO No. HHS0014749 Page 15 of 58

i. IT Infrastructure Library (ITIL) Practitioner certification (or higher); and

ii. Certified Information Systems Security Professional (CISSP) certification or documented training in the field of security and risk management, software development security; and

iii. Security Assessment and Training, or Security Operations training.

c. In the event the Contractor proposes additional, replacement, or substitute Key Personnel during the Contract Term, Contractor shall provide HHSC with the resumes of at minimum three (3) qualified individuals. The resume information for the proposed Key Personnel shall be provided to HHSC at least fifteen (15) Calendar Days prior to the proposed start date of any additional (i.e., individual filling a new position) or replacement (i.e., individual replacing a removed individual) Key Personnel. In addition to meeting the minimum standards set forth in the Contract, replacement and substitute Key Personnel shall have a level of qualification and experience similar or superior to the applicable disembarking individual. A minimum of three (3) references shall be included with each provided resume.

An “Excused Removal” occurs when an individual designated as a Key Personnel voluntarily leaves the employment of the Contractor or Contractor’s Subcontractor or is unable to perform Services due to an extended absence resulting from illness or other emergencies, or there are other circumstances that the Parties agree precluded the Contractor from complying with this Section 2.1.1.2 (Key Personnel).

d. HHSC will have the right to conduct an interview of all Contractor’s proposed Key Personnel. Furthermore, HHSC will have the right to contact references of proposed Key Personnel. HHSC will provide Contractor with written notice of rejection of proposed Key Personnel within five (5) Business Days of receipt of the resume, if applicable. HHSC shall have the right to reject assignment of any of the Contractor’s proposed Key Personnel.

Within five (5) Calendar Days of HHSC’s written notification of rejection, Contractor shall provide HHSC with additional resumes of proposed qualified individuals for review. This process shall be repeated until HHSC provides written notice to the Contractor of the individual selected. The approved individual shall commence Services within thirty (30) Calendar Days of the Contractor’s receipt of the HHSC selection notice.

e. HHSC, at its discretion, can require Contractor to remove any Key Personnel. HHSC reserves the right to alter the designation of any Contractor Personnel as Key Personnel.

Version 2.10 RFO No. HHS0014749 Page 16 of 58

2.1.2 CIMS REQUIREMENTS

2.1.2.1 Functional Requirements

Contractor shall provide a CIMS that meets HHSC’s functional requirements set forth in Exhibit N, Requirements Traceability Matrix, Tab 3, CIMS RTM – Functional, including Configurable business rules, ability to add new Providers, and ability to centralize tracking. The CIMS shall be able to expand to support additional State and/or federal mandates and comply with all data security regulations set forth in Exhibit N, Requirements Traceability Matrix, Tab 3, CIMS RTM - Functional.

2.1.2.2 Technical Requirements

The CIMS shall enable data encryption that complies with all State and federal regulations and allows for Configuration of access by User role. The CIMS shall meet all requirements set forth in Exhibit N, Requirements Traceability Matrix, Tab 4, CIMS RTM - Technical.

2.1.2.3 Information Security and Privacy Requirements

Contractor, at a minimum, shall comply with the security requirements set forth in Exhibit O, HHS Information Security and Privacy Controls Requirements, Exhibit D, HHS Data Use Agreement (DUA), Version 8.5, and Exhibit N, Requirements Traceability Matrix, Tab 5

(SEC).

2.1.2.4 CIMS Deliverables

Contractor shall provide a Deliverable or a set of Deliverables and associated Deliverables Expectation Document (DED) for each CIMS requirement identified as a Deliverable in the Contract. All Deliverables will be provided to HHSC in an agreed upon timely manner, or as assigned by HHSC defined in Exhibit N, Requirements Traceability Matrix, Tab 6, CIMS Contractor Deliverables. Furthermore, the Deliverables will be provided electronically.

2.1.3 TEXAS RISK AND AUTHORIZATION MANAGEMENT PLAN

Commencing on the Contract Effective Date and during the Contract Term, Contractor shall provide Services that comply with TX-RAMP level 2 certification. Contractor acknowledges that TX-RAMP provisional status does not satisfy the TX-RAMP level 2 certification requirement.

2.1.4 CONTRACT PHASES OVERVIEW

Contract performance is comprised of three (3) phases: Phase I – Transition, Phase II – Operations, and Phase III –– Turnover.

2.1.4.1 Phase I - Transition Phase Services

Contractor shall complete Transition Phase Activities with successful achievement of all performance measures as detailed in Exhibit N, Requirements Traceability Matrix, Tab 7, CIMS SLR, applicable to the Transition Phase on or before the hundred eightieth (180) Calendar Day following the Contract Effective Date, unless HHSC provides written notice approving a postponement to the start of Transition Phase. The Transition Phase shall be complete when HHSC

Version 2.10 RFO No. HHS0014749 Page 17 of 58 notifies Contractor of HHSC’s approval of all Transition Phase DEDs, Deliverables, and HHSC’s acknowledgement of Contractor’s successful completion of software acceptance testing.

2.1.4.1.1 Transition Phase Requirements and Deliverables

Contractor shall provide all Transition Phase requirements and Deliverables (see Exhibit N, Requirements Traceability Matrix, Tab 5, CIMS Service Requirements and Tab 6, CIMS Contractor Deliverables. Transition requirements and Deliverables are identified with a TRA domain acronym.

Contractor shall provide all plans, processes, and procedures for approval by HHSC prior to commencement of Phase II – Operations. HHSC shall provide Contractor reasonable access to HHSC staff for the purposes of gathering and finalizing business requirements for system Configuration.

2.1.4.1.2 CIMS Implementation

Contractor’s requirements to support CIMS implementation are listed in Exhibit N, Requirements Traceability Matrix, Tab 4, CIMS RTM Technical. CIMS Implementation requirements are identified with a CSI domain acronym.

2.1.4.1.3 Software Acceptance Testing

HHSC will conduct a formal software acceptance testing of the CIMS to ensure it complies with all Contract requirements including User needs and business processes.

Contractor’s requirements to support HHSC software acceptance testing are listed in Exhibit N, Requirements Traceability Matrix, Tab 5, CIMS Service Requirements. Software Acceptance Testing requirements are identified with a SAT domain acronym.

If the CIMS fails to meet any of the software acceptance tests at the end of the assessment period, HHSC will notify Contractor’s designated point of contact of such failure in writing. Contractor shall correct failures to the CIMS within ten (10) Business Days from the date of notification to meet the software acceptance test.

Thereafter, HHSC shall re-conduct the software acceptance test. This process shall be repeated, at HHSC’s discretion, until HHSC accepts the CIMS.

In addition to any other rights and remedies available under the Contract, HHSC shall have the right and the option to terminate the Contract for cause in the event that the CIMS fails to meet the software acceptance test criteria after three (3) attempts.

Software acceptance testing may involve the formal execution of application test cases performed by the designated testers and a formal demonstration of the to-be-delivered functionality. HHSC will identify a group of CIMS Users who will perform the software acceptance testing. Software acceptance testing will be conducted using Contractor-provided test data that does not contain Protected Health Information (PHI) or Personally Identifiable Information (PII).

Version 2.10 RFO No. HHS0014749 Page 18 of 58

2.1.4.2 Phase II - Operations Phase Services

The Operations Phase commences the next Business Day after the conclusion of the Transition Phase and continues through the Turnover Phase of the Contract. Contractor shall complete Operation Phase Activities with successful achievement of all performance measures as detailed in Exhibit N, Requirements Traceability Matrix, Tab 7, CIMS SLRs.

2.1.4.2.1 Educational Outreach and Technical Assistance

Contractor shall develop and conduct standardized training for the CIMS, educational outreach, and technical assistance for Users, as described in Exhibit N, Requirements Traceability Matrix, Tab 5, CIMS Service Requirements. Educational Outreach and Technical Assistance requirements are identified with a EOT domain acronym. Contractor is expressly prohibited from using any educational or outreach materials developed by Contractor hereunder for any purpose other than expressly described in this SOW.

A major focus of the Contractor’s training shall be the linking of the learning experience to the realities experienced during a User’s daily operations.

Providers who are unable to participate in the instructor-led classes because of space limitation will be able to participate in the monthly classes offered after the start date for the Operations Phase and will have online access to Contractor videos.

2.1.4.2.2 Software Maintenance and Technical Support

Contractor shall provide software maintenance and technical support for the CIMS that meets or exceeds the requirements set forth in Exhibit N, Requirements Traceability Matrix, Tab 5, CIMS Service Requirements. Software Maintenance and Technical Support requirements are identified with a SMT domain acronym.

HHSC shall provide the list of authorized technical support staff to Contractor for software maintenance and technical support. In HHSC’s sole discretion, HHSC may update the authorized technical contacts and any such change in HHSC’s designated contacts shall be immediately accepted by Contractor. Contractor’s Key Personnel will work with the HHSC project manager to define HHSC points of contact and communication channels to ensure appropriate notifications and coordination with HHSC staff for maintenance and technical support. Assigned contact information will be maintained as a component of the Communications and Project Management Plan.

Any technical support request related to HHSC Programs and policies and not related to use of the CIMS would be first handled by the designated HHSC staff and escalated to Contractor staff only as needed, with HHSC staff acting as the point of contact for both the end User and Contractor Personnel.

Version 2.10 RFO No. HHS0014749 Page 19 of 58

2.1.4.2.3 Technical Support Associated with User Accounts

Contractor shall provide technical support associated with User accounts that meets or exceeds the requirements set forth in Exhibit N, Requirements Traceability Matrix, Tab 4, CIMS RTM Technical. Technical Support Associated with User Accounts requirements are identified with a TSU domain acronym.

2.1.4.2.4 Enhancements

Contractor shall provide Services for enhancements that meet or exceed the requirements set forth in Exhibit N, Requirements Traceability Matrix, Tab 5, CIMS Service Requirements. CIMS Enhancement requirements are identified with a ENH domain acronym.

2.1.4.2.5 Disaster Recovery Testing

At least once per State Fiscal Year, for no additional compensation, Contractor shall conduct a disaster recovery test to assess the effectiveness of Contractor’s disaster recovery plan. Contractor shall develop the disaster recovery testing procedures in coordination with HHSC. Contractor shall provide HHSC at least thirty (30) Calendar Days advance written notice of each disaster recovery test. HHSC, at its discretion, may monitor Contractor’s disaster recovery testing activities. During the disaster recovery exercises, Contractor shall simulate daily operations that occur in a production setting and, at a minimum, test the recovered environments, accessibility, data integrity, and functionality. Contractor will provide HHSC, with a written summary report detailing the results of each disaster recovery test. Contractor will conduct a lessons-learned meeting no later than thirty (30) Calendar Days following the completion of the disaster recovery test. Upon HHSC written request, Contractor shall make Contractor Personnel available to discuss with HHSC the results of the disaster recovery test. If a disaster recovery test is unsuccessful, Contractor will (i) develop a remediation plan on or before the thirtieth (30th) Calendar Day following the unsuccessful disaster recovery test and (ii) implement such remediation plan on or before the ninetieth (90th) Calendar Day following the unsuccessful disaster recovery test unless an alternate timeframe is mutually agreed by HHSC and Contractor. Upon HHSC written request, Contractor shall conduct, for no additional compensation, an additional disaster recovery test during the State Fiscal Year to validate the successful implementation of Contractor’s remediation activities.

2.1.4.2.6 HHSC Business Continuity Preparedness Exercises

No more than once per State Fiscal Year, Contractor shall participate, for no additional compensation, in a business continuity preparedness exercise designed to assess the effectiveness of HHSC’s business continuity procedures related to coordination and communication with private sector Service Providers. HHSC will provide at least thirty (30) Calendar Days advance written notice to the Contractor of the HHSC-scheduled exercise. Contractor shall provide qualified personnel as reasonably necessary to actively participate in scheduled business continuity preparedness activities which may include phone conference workshops, in-person tabletop exercises, and operations-based exercises. Upon HHSC written request, Contractor shall identify lessons learned and actions to improve coordination and communication responsibilities.

Version 2.10 RFO No. HHS0014749 Page 20 of 58

2.1.4.3 Phase III - Turnover Services

The Turnover Phase, which includes Contract closeout, shall begin six (6) months prior to the end of the Contract Term or at HHSC’s written request for Turnover Services. Contractor shall perform Turnover Phase Services concurrently with regular Operations Services.

Contractor shall take all steps to ensure that both Turnover Phase Activities and Operations Phase Activities are performed without interruption or diminished performance, including, if necessary, adding additional Contractor Personnel, temporarily relocating Contractor Personnel, and other increases in Contractor’s resources to ensure the Contractor’s complete and uninterrupted performance of all Contract obligations at no additional cost to HHSC.

The Contract includes separate and distinct charges for Turnover Phase Activities and Operations Phase Activities, therefore, to the extent that HHSC has not received full performance of any Contractor obligations, in addition to any other rights and remedies available hereunder, HHSC may exercise its statutory right to withhold authorization for payments for invoices for any Services not actually received in conformance with Contract requirements. See Texas Government Code Title 10, Subtitle D, Chapter 2155, Section 2155.322 (requiring State agencies to inspect and certify receipt of goods or services for compliance with contract requirements)..

Contractor shall perform the Turnover Phase Activities as part of the Services in a manner to successfully accomplish the following:

a. Complete a smooth, seamless, and uninterrupted turnover of responsibilities from Contractor to HHSC or an HHSC designated successor service provider;

b. Complete knowledge and data turnover from Contractor to HHSC or an HHSC designated successor service provider; and

c. Mitigate risk of HHSC failing to comply with CMS guidelines, and MCO and Providers failing to comply with HHSC requirements.

2.1.4.3.1 Turnover Phase Requirements

Contractor shall also provide the following Turnover Activities as part of the Services:

a. Complete all requested enhancements as agreed with HHSC prior to the termination of the Contract;

b. Resolve all open support requests;

c. Coordinate activities with HHSC and any HHSC-designee;

d. Implement the HHSC-approved Turnover Plan; and

e. Work with HHSC to provide the current data dictionary and data to HHSC or an HHSC designated successor service provider.

The Turnover Phase requirements shall meet or exceed the requirements set forth in Exhibit N, Requirements Traceability Matrix, Tab 5, CIMS Service Requirements. Turnover Phase requirements are identified with a TUR domain acronym.

https://statutes.capitol.texas.gov/docs/gv/htm/gv.2155.htm https://statutes.capitol.texas.gov/docs/gv/htm/gv.2155.htm

Version 2.10 RFO No. HHS0014749 Page 21 of 58

2.1.4.3.2 Turnover Phase Deliverables

As part of the Turnover Phase, Contractor shall provide Deliverables that meet or exceed the requirements set forth on Exhibit N, Requirements Traceability Matrix, Tab 6, CIMS Contractor Deliverables. Turnover deliverables are identified with a TUR domain acronym.

2.1.5 SERVICE LEVEL REQUIREMENTS AND ASSOCIATED REMEDIES

Contractor and the CIMS shall meet all SLRs set forth in Exhibit N, Requirements Traceability Matrix, Tab 7, CIMS SLRs. Definitions for incident severity and priority and UAT defect resolution are provided in Exhibit N, Requirements Traceability Matrix, Tab 8, CIMS SLR Definitions.

Each SLR set forth in Exhibit N, Requirements Traceability Matrix, Tab 7, CIMS SLRs identifies service level requirements that will be used to evaluate Contractor’s delivery of the required Services. HHSC will manage Contractor’s Services by monitoring and measuring performance on SLRs. SLRs identified in Exhibit N, Requirements Traceability Matrix, Tab 7, CIMS SLRs specify the following:

a. Number

b. Requirement ID

c. Service Level Requirement (SLR) name

d. Service Level Requirement (SLR) description/objective

e. Measurement formula

f. Service Level Requirement (SLR) reporting period

g. Non-compliance

h. Liquidated Damages Assessment

These SLRs and associated liquidated damages are reasonable estimates of projected financial loss and damages resulting from Contractor’s non-performance, including financial loss due to delays.

Contractor agrees that (1) the liquidated damages and any amounts assessed in connection therewith are neither a penalty nor a forfeiture and (2) the amount of liquidated damages is a reasonable forecast of just compensation.

HHSC is not required to provide the Contractor with notice and opportunity to resolve issues prior to assessment of liquidated damages. Liquidated damages will not be assessed if HHSC determines that Contractor is not responsible for the delay or failure of the applicable SLR.

2.1.6 SUPPLEMENTAL SERVICES

a. To accommodate future business objectives, which may be a result of implementation of federal and State mandates and other State initiatives that include additional departments, Programs or Services within HHSC, that are aligned with the original purpose of the Contract and reasonably related to the SOW of the Solicitation, HHSC

Version 2.10 RFO No. HHS0014749 Page 22 of 58 may require Contractor to perform Supplemental Services during the Contract Term.

No such additions are known or detailed at this time but may arise during the Contract Term.

b. At the sole discretion of HHSC, HHSC will initiate the request for Supplemental

Services using the Change Order Request (COR) process, which will provide information needed by the Contractor to prepare a Supplemental Services plan to address the performance and the delivery of the requested Services within the required timeline.

c. Unless otherwise agreed by the Parties, Contractor shall respond to HHSC’s request for Supplemental Services with a Supplemental Services plan on or before the thirtieth (30th) Business Day following the date of receipt of HHSC's request. In the case of a pressing need or an emergency, Contractor shall respond within three (3) Business Days to HHSC’s Supplemental Services request. In response to HHSC’s Supplemental Services request, Contractor shall provide a Supplemental Services plan that will include, at a minimum, the following information, properly itemized and supported by sufficient substantiating data (e.g., documentation by Subcontractors performing the work), to permit evaluation by HHSC. Contractor shall provide a Supplemental Services Plan that will include, at a minimum, the following information:

1. A Project plan and fixed price or price estimate for the additional service;

2. A supplemental Services cost proposal that includes a detailed breakdown of such price or estimate;

3. The estimated level of effort (service hours);

4. A schedule for commencing and completing the Supplemental Service;

5. A description and justification of the new hardware or software to be provided by Contractor in connection with the additional service;

6. A description of the software, hardware, and other resources necessary to provide the additional service;

7. Any risks associated with the Supplemental Services and/or the integration of the additional service into the existing environment;

8. In the case of any developed materials to be created through the provision of the

Supplemental Services, any ownership rights therein that differs and/or conflicts from the provisions already included in the Contract; and

9. An analysis and estimate of the operational impacts related to the Supplemental Services.

d. Contractor shall provide, in the Supplemental Services cost proposal, cost information, including detailed supporting metrics and detailed supporting costs deemed acceptable by HHSC, in sufficient detail to accurately modify the applicable fixed fee and variable fee formulas. Once a total cost for the Supplemental Services is agreed upon, HHSC will make the determination as to which fixed fee and/or variable fee formula(s) are to be modified.

e. Notwithstanding any provision to the contrary:

Version 2.10 RFO No. HHS0014749 Page 23 of 58

1. Contractor will act reasonably and in good faith in formulating the Supplemental

Services cost proposal;

2. Contractor will identify potential means of reducing the cost to HHSC, including utilizing Subcontractors as and to the extent appropriate;

3. The Supplemental Services pricing proposal may not exceed the pricing and labor rates set forth in the Contract for comparable Services;

4. The Supplemental Services pricing proposal will account for the existing and future volume of business between HHSC and Contractor;

5. Contractor shall not be entitled to an increase in the Contract amount or a renewal or extension of the Contract Term with respect to any work performed that is not required by the Contract as amended, modified, and supplemented in a fully executed amendment to the Contract; and

6. The Contract shall adhere to applicable SLRs as defined by HHSC for requested and approved Supplemental Services.

f. HHSC may accept or reject any Supplemental Services plan. Upon HHSC’s acceptance of Contractor’s Supplemental Services Plan, the Contract will be amended to include the addition of such Supplemental Services. Contractor shall not invoice and HHSC shall not pay for any charges related to the investigation of any proposed change to existing Services or the development of Supplemental Services Plan(s). In addition, Contractor shall not invoice and HHSC shall not pay for Supplemental Services that:

1. Deviate from the HHSC-approved Supplemental Services Plan;

2. Commence prior to the date of the applicable Contract Amendment; and

3. Exceed the fees specified in the applicable Contract Amendment.

2.1.7 REDUCED SERVICES

a. In the event of the occurrence of an Extraordinary Event or Unanticipated Change, HHSC may, at its option, request modifications to the Scope of Work to address each such occurrence.

b. For the purpose of this clause, the term “Extraordinary Event” means a circumstance in which an event or discrete set of events has occurred or is planned with respect to the operations of HHSC that results or will result in a reduction in the nature or volume of the Services that HHSC will require from Contractor.

c. For the purpose of this clause, the term “Unanticipated Change” refers to a material change in the technologies or processes available to provide all or any portion of the Services which is outside the normal evolution of technology experienced by the Services, which was not generally available…