ESBD_524143_1780607280242_HHS0017000 Maven Registries Maintenance Operations RFO.pdf

RFO No. HHS0017000 Page 1 of 70 Version 2.30 Revision Date 04/28/2025

Stephanie Muth, Executive Commissioner

Request for Offers (RFO) for

Maven Registries Maintenance & Operations (M&O)

RFO No. HHS0017000

Date of Release: June 4, 2026

Responses Due: Refer to Section 3.1 Schedule of Events

NIGP Class/Item Codes

920-45 *Software Maintenance and Support Services and Updates and Data Hosting Services

920-46 *Software Updating and Upgrading Services

920-66 *System, Network, Database, DBA Administration Services

920-76 *Testing of Systems Infrastructure, Components of Software, IT Services

RFO No. HHS0017000 Page 2 of 70

Table of Contents Article I. Introduction, Definitions, and Authority

1.1 Introduction

1.2 Definitions

1.3 Authority

Article II. Scope of Work

2.1 Statement of Work

2.1.1 Overview of the Maven Platform

2.1.2 Overview of Maven Registries

2.1.3 Overview of Contract Project Phases

2.1.4 Contract Phases and Domains per Phase

2.1.5 Health Registries Domains and Associated Requirements

2.2 Contract Award, Term, and Historical Compensation

2.2.1 Contract Award and Execution

2.2.2 Contract Term

2.2.3 Historical Compensation

2.3 Data Use Agreement and Security Privacy Inquiry

2.4 No Guarantee of Volume, Usage, or Compensation

Article III. Administrative Information

3.1 Schedule of Events

3.2 Ambiguity, Conflict, or Discrepancy

3.3 Inquiries

3.3.1 Sole Point of Contact

3.3.2 Prohibited Communication

3.3.3 Exception to Sole Point of Contact

3.3.4 Solicitation Questions

3.4 Solicitation Response Composition

3.4.1 General Information

3.4.2 Page Limit and Supporting Documentation

3.4.3 Discrepancies

RFO No. HHS0017000 Page 3 of 70

Revision Date 04/28/2025

3.4.4 Exceptions

3.4.5 Assumptions

3.4.6 Binding Offer

3.5 Solicitation Response Submission and Delivery

3.5.1 Deadline

3.5.2 Submission Option

3.5.3 Submission Checklist

3.5.4 Labeling and Delivery for USB Drive Submission and Other Materials

3.5.5 Modifications and Withdrawals

Article IV. Solicitation Response Evaluation and Award Process

4.1 Conformance with State Law

4.2 Best Value Determination

4.2.1 Selection Methodology

4.2.2 Minimum Qualifications

4.2.3 Initial Compliance Screening

4.2.4 Written Solicitation Response Evaluation

4.2.5 Written Response Evaluation Criteria

4.2.6 Best and Final Offer (BAFO)

4.2.7 Final Written Response Score

4.2.8 Summary of Best Value Determination

4.3 Questions or Requests for Clarification

Article V. Narrative and Technical Proposals

5.1 Narrative Proposal

5.1.1 Executive Summary

5.1.2 Project Work Plan

5.1.3 Key Staffing Profile

5.2 Technical Proposal

5.2.1 Domain Approach

Article VI. Required Respondent Information

6.1 Company Information

6.1.1 Company Narrative

RFO No. HHS0017000 Page 4 of 70

Revision Date 04/28/2025

6.1.2 Company Profile

6.2 Franchise Tax

6.3 References

6.4 Major Subcontractor Information

6.5 Affirmations and Certifications

6.6 Other Reports

6.6.1 Dun and Bradstreet Reports

6.6.2 Financial Statements and Financial Solvency

6.6.3 Alternate Report

6.7 Corporate Guarantee

6.8 HUB Subcontracting Plan

6.9 Secretary of State Certification

Article VII. Cost Proposal

7.1 Cost Proposal

Article VIII. General Terms and Conditions

8.1 General Conditions

8.1.1 Changes, Modifications, and Cancellation

8.1.2 Offer Period

8.1.3 Costs Incurred

8.1.4 Contract Responsibility

8.1.5 Public Information Act - Respondent Requirements Regarding Disclosure

8.1.6 Respondent Waiver – Intellectual Property

8.1.7 Standards of Conduct for Vendors

8.1.8 Disclosure of Interested Parties

8.2 Insurance

8.2.1 Required Coverage

8.2.2 Alternative Insurability

8.3 Protest

Article IX. List of Exhibits

RFO No. HHS0017000 Page 5 of 70

Table of Tables

Table 1 - Platform Accessibility Requirement Table 2 - In-Scope Maven Registries Table 3 - Health Registries Service Domain Names and Acronyms Table 4 - Project Management Office (PMO) Requirements Table 5 - Performance Support (PFS) Requirements Table 6 - Testing (TST) Requirements Table 7 - Training (TRN) Requirements Table 8 - Supplemental Services (SPS) Requirements Table 9 - Deployment (DEP) Requirements Table 10 - Maintenance and Operations Services (MOS) Requirements Table 11 - Operations Support (OPS) Requirements Table 12 - Reporting (RPT) Requirements Table 13 - Disaster Recovery and Business Continuity (DRC) Requirements Table 14 - Application Security Management (ASM) Requirements Table 15 - Transition (TRA) Requirements Table 16 - Turnover (TUR) Requirements

RFO No. HHS0017000 Page 6 of 70

Revision Date 04/28/2025

ARTICLE I. INTRODUCTION, DEFINITIONS, AND AUTHORITY

1.1 INTRODUCTION

The issuing office believes that the requested items in this Request for Offers may be proprietary to one (1) vendor under Section 2155.067 of the Government Code; however, the issuing office strongly encourages offers from all qualified Respondents that may be able to provide the requested items.

The State of Texas, by and through the Texas Health and Human Services Commission (HHSC) oversees operations of the entire Health and Human Services (HHS) system in Texas. The HHS system is comprised of two (2) State agencies: HHSC and the Department of State Health Services (DSHS).

System Agency seeks a qualified vendor to provide Maven Registries Maintenance & Operations (M&O) in accordance with Article II (Solution Requirements) and other requirements of this Solicitation.

The Maven platform supports:

a. Blood Lead Registry (BLR) within DSHS Community Health Improvements (CHI) Division, and

b. HIV/STD Integrated System (THISIS) within DSHS Infectious Disease Prevention (IDP) Division, collectively referred to herein as “In-Scope Maven Registries”.

Information regarding HHSC and its programs is available online and can currently be accessed at https://www.hhs.texas.gov.

Information regarding DSHS and its programs is available online and can currently be accessed at https://www.dshs.texas.gov/.

The HHSC Procurement and Contracting Services (HHSC PCS) will administer the procurement process for this Solicitation, which includes Solicitation publication, handling of communications from vendors, as well as managing the receipt of Solicitation Responses for review and evaluation.

To be considered for award, a Respondent must execute Exhibit A, HHS Solicitation Affirmations and provide all other required information and documentation as set forth in this Solicitation.

https://www.hhs.texas.gov/ https://www.dshs.texas.gov/

RFO No. HHS0017000 Page 7 of 70

Revision Date 04/28/2025

1.2 DEFINITIONS

Refer to Exhibit B, Health and Human Services (HHS) Uniform Terms and Conditions (UTC) – Vendor, Exhibit C, HHS Additional Provisions, and Exhibit M, Health Registries Process Guide for additional definitions (e.g., Contract, Contractor, Deliverable, Effective Date, HUB, Services, Solicitation Response, Subcontractor, System Agency, Work, and Work Order).

As used in this Solicitation, unless a different definition is specified or the context clearly indicates otherwise, the following terms and conditions have the meanings assigned below:

“Addendum” means a written clarification or revision to this Solicitation issued by HHSC PCS and posted to the ESBD.

“Advancement Criteria” means the published criteria for Respondent to advance to the next phase of evaluation if multiple evaluation methods are utilized.

“Award Consideration (AC) Documents” means documents Respondent must submit as part of the Solicitation Response to be considered for negotiations or award.

“Business Day” has the same meaning as “business day” in Section 552.0031 of the Texas Government Code.

“Business Hours” is defined as the hours from 8:00 a.m. through 5:00 p.m. Central Time on Business Days.

“Calendar Day” means each day shown on the calendar beginning at 12:00 midnight and ending at 11:59 p.m., including Saturdays, Sundays, and national and State holidays listed in Section 662.003 of the Texas Government Code

“Contract Term” means the period of time beginning with the commencement date or Effective Date of a Contract and ending when the Contract expires in accordance with its terms, or when it has been terminated.

“ESBD” means the Electronic State Business Daily, the electronic marketplace where State of Texas bid opportunities over $25,000 are posted. The ESBD may currently be accessed at http://www.txsmartbuy.com/esbd.

“Final Written Response Score” refers to the final scoring of the written response as documented in the Solicitation.

“HHSC” means the Health and Human Services Commission.

“HHSC PCS” means Procurement and Contracting Services (PCS), a division of HHSC.

https://texas-sos.appianportalsgov.com/rules-and-meetings?$locale=en_US&interface=VIEW_TAC_SUMMARY&queryAsDate=04%2F14%2F2025&recordId=208793 https://texas-sos.appianportalsgov.com/rules-and-meetings?$locale=en_US&interface=VIEW_TAC_SUMMARY&queryAsDate=04%2F14%2F2025&recordId=208793 http://www.txsmartbuy.com/esbd

RFO No. HHS0017000 Page 8 of 70

Revision Date 04/28/2025

“HUB” means Historically Underutilized Business, as defined by Section 2161.001(2) of the Texas Government Code.

“HUB Subcontracting Plan” or “HSP” means written documentation regarding the use of subcontractors, which is required by Section 2161.252 of the Texas Government Code, for a purchase with an expected value of $100,000 or more when the state agency has determined subcontracting opportunities are probable. The HSP subsequently becomes a provision of the Contract and Contractor’s compliance with the HSP will be monitored during the Contract Term.

“Key Performance Measures” or “KPM” means a measurable value that demonstrates how effectively a company is achieving key business objectives.

“Maintenance and Operations” or “M&O” means System support that includes system maintenance and customer support for system administration, configuration, patching, troubleshooting and defect resolution.

“Registry Decommission” means withdraw of one (1) or more of the Maven software registries from the Maven platform.

“Respondent” means the individual or entity responding to this Solicitation.

“Solicitation Consideration (SC) Documents” means documents that must be submitted by Respondent with the Solicitation Response in order to be considered for evaluation and cannot be resubmitted or have errors remedied after the submission due date and time in the Schedule of Events has passed.

“State” means the State of Texas and its instrumentalities, including HHSC and DSHS and any other state agency, its officers, employees, or authorized agents.

“Transition” means the orderly and expeditious transfer of services from the outgoing service provider at the beginning of the Contract.

“Turnover” means the administrative and operations activities performed by the Contractor to turn over operations to either the System Agency or a designated successor service provider to ensure that the System Agency and its stakeholders do not experience any adverse impact from the transfer from the Contractor to either the System Agency or a designated service provider.

“VPTS” means Vendor Performance Tracking System maintained by the Texas Comptroller of Public Accounts. The VPTS may be currently accessed at https://comptroller.texas.gov/purchasing/programs/vendor-performance-tracking/.

https://statutes.capitol.texas.gov/Docs/GV/htm/GV.2161.htm#2161.001 https://statutes.capitol.texas.gov/Docs/GV/htm/GV.2161.htm#2161.001 https://statutes.capitol.texas.gov/Docs/GV/htm/GV.2161.htm#2161.252 https://comptroller.texas.gov/purchasing/programs/vendor-performance-tracking/

RFO No. HHS0017000 Page 9 of 70

Revision Date 04/28/2025

1.3 AUTHORITY

The System Agency is soliciting the Services under the authority of Section 2157.006(a)(2) of the Texas Government Code.

RFO No. HHS0017000 Page 10 of 70

Revision Date 04/28/2025

ARTICLE II. SCOPE OF WORK

2.1 STATEMENT OF WORK

2.1.1 Overview of the Maven Platform

The Maven platform is a commercial-off-the shelf (COTS), web-based business rules engine. It provides interactive, automated information gathering and decision support processes for each reportable communicable disease and occupational disease.

The Maven platform allows public health officials to enter, manage, process, track, and analyze data for disease exposure events. The Maven platform allows for secure communication and coordination between state and local health departments. In addition, the Maven platform enables the immediate exchange of information between clinics, labs, and local health departments. The Maven platform security environment displays only the data a user needs and is authorized to see. Through data analysis, the Maven platform can then extract surveillance data for the identification of a possible public health/environmental emergency. Additional Maven platform functions include:

a. Electronic data exchange and flow of work among groups working on public health;

b. Disease management;

c. Ability for lab reports to be imported electronically;

d. Data entry capability;

e. Reporting; and

f. Case management, contact-tracing, and outbreak management.

The In-Scope Maven Registries have commonality with each other. Each In-Scope Maven Registry has software licensing with unique application versions, specified licensed users, and functional workflow description.

2.1.1.1 Platform Accessibility

All technology bought, built, maintained, or used, including software, hardware, electronic content, and support documentation and services, used in support of this Project, must conform to the standards established in the revised Section 508 Amendment to the Rehabilitation Act of 1973, 29 U.S.C. §794d (1998) (https://www.fcc.gov/general/section-508-rehabilitation-act).

These standards contain scoping and technical requirements to help state agencies ensure information and communication technology is accessible and usable by individuals with https://www.fcc.gov/general/section-508-rehabilitation-act https://www.fcc.gov/general/section-508-rehabilitation-act https://www.fcc.gov/general/section-508-rehabilitation-act

RFO No. HHS0017000 Page 11 of 70

Revision Date 04/28/2025 disabilities. Any solution used in support of this Project must comply with all sections of the Americans with Disabilities Act (ADA), Web Content Accessibility Guidelines (WCAG), Version 2.1, Level AA (WCAG 2.1 AA) and the Revised Section 508 Standards for Information and Communication Technology (ICT) and Requirement ACC-01. See Table 1 – Platform Accessibility Requirement.

Table 1 - Platform Accessibility Requirement

Req ID Detailed Requirement

ACC-01

In the event the user interface will be modified, the Contractor must provide the EIR information in an Accessibility Conformance Report (ACR) to document conformance to the applicable Section 508 Standards found at VPAT 2.5Rev WCAG 2.1 in Exhibit O, VPAT 2.5Rev_WCAG_February 2025, and VPAT 2.5Rev 508 in Exhibit P, VPAT 2.5Rev 508_February 2025.

2.1.2 Overview of Maven Registries

The System Agency has leveraged the Maven platform over the past twelve (12) years to enable several Maven Registries. This Solicitation will only address the following two (2) In-Scope Maven Registries in Table 2 – In-scope Maven Registries.

Table 2 - In-Scope Maven Registries

Registry

ID

Registry Name

Registry Description

BLR Blood Lead Registry

The BLR supports and maintains a surveillance system of all blood lead test results for individuals in Texas. Each year, thousands of Texans are identified with blood lead levels above the reference level set by the Centers for Disease Control and Prevention (CDC).

Even low levels of lead, a neurotoxin, can cause adverse health effects in children and adults. The Blood Lead program works to prevent lead exposure through education and the promotion of safe homes and workplaces. The program also promotes early detection of lead exposure and provides follow-up for children with elevated blood lead levels. Through these activities, the program remains committed to preventing new cases of lead poisoning and safeguarding the health of families in Texas.

https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.itic.org%2FdotAsset%2Fc9497d16-4684-480c-bae2-99256283731c.docx&data=05%7C02%7CBrenda.Richter%40hhs.texas.gov%7Cfb5082f5db94480d14ea08de69bed283%7C9bf9773282b9499bb16aa93e8ebd536b%7C0%7C0%7C639064466127819653%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=ZKV15gFyRg8qhg6SPrtdLR2zGKLumjyLJi50sN7nOD4%3D&reserved=0 https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.itic.org%2FdotAsset%2Fc9497d16-4684-480c-bae2-99256283731c.docx&data=05%7C02%7CBrenda.Richter%40hhs.texas.gov%7Cfb5082f5db94480d14ea08de69bed283%7C9bf9773282b9499bb16aa93e8ebd536b%7C0%7C0%7C639064466127819653%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=ZKV15gFyRg8qhg6SPrtdLR2zGKLumjyLJi50sN7nOD4%3D&reserved=0

RFO No. HHS0017000 Page 12 of 70

Revision Date 04/28/2025

THISIS HIV/STD

Integrated System

THISIS comprises information on Human Immunodeficiency Virus (HIV) and Sexually Transmitted Diseases (STD). HIV and STD public health programs use information systems to track and attempt to control the spread of disease. Those systems store disease and case management data from the first positive test to follow up doctor’s visits and information on other people who may have been exposed. This data helps public health programs identify and notify those who may have been exposed, track the epidemics, plan resource allocation, and design interventions.

2.1.3 Overview of Contract Project Phases

The following sub-sections delineate the requirements that are applicable to the two (2) In-Scope Maven Registries. The requirements are associated with the following two (2) Contract Project Phases:

a. Phase I – Transition

b. Phase II - Registry Operations Phase (“Operations/ROP”)

c. Phase III – Turnover Phase (“Turnover/TUR”)

2.1.3.1 Contract Project Phases

a. Phase I – Transition Phase

Transition activities include, but are not limited to, logistical arrangements and security protocols for Contractor’s Personnel and the development of the finalized Transition Project Work Plan with an accompanying Project Management Plan.

The Contractor’s primary obligations for Phase I - Transition Phase include, but are not limited to, the following:

1. Provide Services for Transition Phase. Refer to Section 2.1.5.13 (Transition Phase);

2. Acquire access to System Agency facilities and resources required to perform the work;

3. Establish a project management presence as referenced in Section 2.1.5.1 (Project Management Office (PMO) Domain), Table 4 – Project Management Office (PMO) Requirements, including the development of project management Deliverables;

RFO No. HHS0017000 Page 13 of 70

Revision Date 04/28/2025

4. Onboard Contractor personnel;

5. Complete knowledge transfer activities with incumbent service provider (if required and as outlined in Section 2.1.5.13 (Transition Phase);

6. Coordinate with the System Agency for operational readiness; and

7. Complete all Transition activities and deliver a Readiness Assessment Results Report.

8. The Contractor will provide all plans, processes, and procedures for approval by the System Agency. All work product and Deliverables shall be accessible throughout the life of the Contract and following Contract termination, stored in an agreed upon repository that is fully accessible by the System Agency and the Contractor. The Contractor’s plans, processes, and procedures shall be consistent with the System Agency’s required plans, procedures, and reporting for the following areas:

i. Data storage, access, security policies, and procedures;

ii. Disaster recovery, including plans for business continuity and contingency capability;

iii. Quality measurement and reporting;

iv. Ongoing service delivery performance monitoring and improvement; and

v. Operational status reporting.

b. Phase II – Registry Operations Phase

The Registry Operations Phase will begin upon the Contract Effective Date and continue throughout the life of the Contract (refer to Section 2.2.2 (Contract Term).

Contractor shall perform all specific Services for day-to-day operations, maintenance, and availability of the In-Scope Maven Registries as stated in the requirements of the Scope of Work, including the following:

1. Providing Services for all domains (as identified and described in Section 2.1.4, Contract Phases and Domains per Phase), and associated requirements within the SOW;

2. Adhering to the System Agency coding, testing, and agile methodology standards (when applicable);

3. Producing standardized, scheduled reports, in addition to ad hoc reports;

4. Working with the System Agency to plan and execute ongoing initiatives to improve In-Scope Maven Registries as needed by the System Agency;

RFO No. HHS0017000 Page 14 of 70

Revision Date 04/28/2025

5. Supporting operations and coordinating with the System Agency on any modifications to existing applications;

6. Quality measurement and reporting; and

7. Ongoing service delivery performance monitoring and improvement, including KPM compliance.

c. Phase III – Turnover Phase

Turnover begins six (6) months prior to the end of the Contract Term, including any approved option periods. Turnover includes the administrative and operations activities performed by the Contractor to turn over operations to either the System Agency or a designated successor service provider to ensure that the System Agency and its stakeholders do not experience any adverse impact from the transfer from the Contractor to either the System Agency or a designated service provider.

1. Contractor shall be responsible for providing Services for the Turnover Phase;

2. Turnover includes the administrative and operational activities performed by the Contractor to transition operations to either the System Agency or a designated service provider; Turnover tasks must be planned and coordinated with the System Agency or a designated successor service provider to ensure the System Agency and In-scope Maven Registries clients do not experience any adverse impact from the Turnover;

3. Turnover activities must be completed according to the System Agency approved Turnover Plan;

4. The Contractor shall be responsible for completion of all non-Turnover Phase Deliverables as detailed in Exhibit L, Deliverables prior to the Turnover Phase;

and

5. Complete all Turnover activities and deliver a Final Turnover Results Report as detailed in Exhibit L, Deliverables.

2.1.3.2 Contract Invoicing

Information related to Contractor invoicing can be found in Exhibit M, Health Registries Process Guide.

RFO No. HHS0017000 Page 15 of 70

Revision Date 04/28/2025

2.1.4 Contract Phases and Domains per Phase

The Contract Phases above shall consist of domains per phase. The following Table 3 – Health Registries Service Domain Names and Acronyms delineate the Registries Service Domains and corresponding Acronyms.

Table 3 - Health Registries Service Domain Names and Acronyms

Table 3 – Health Registries Service Domain Name and Acronyms

Phase Contract Phase Domain Name Acronym

I Transition Phase Transition TRA

II Registry Operations Phase

a. Project Management Office

b. Performance Support

c. Testing

d. Training

e. Supplemental Services

f. Deployment

g. Maintenance and Operations Services

h. Operations Support

i. Reporting

j. Disaster Recovery and Business Continuity

k. Application Security Management

a. PMO

b. PFS

c. TST

d. TRN

e. SPS

f. DEP

g. MOS

h. OPS

i. RPT

j. DRC

k. ASM

II Turnover Phase Turnover TUR

2.1.5 Health Registries Domains and Associated Requirements

As indicated in Section 2.1.5 (Contract Phases and Domains per Phase), all requirements found within the subsections of 2.1.5 are considered in-scope for both Maven Registries and are necessary throughout the life of the Contract unless otherwise amended. The below subsections

2.1.5.1 through 2.1.5.13 will delineate the scope of those requirements.

2.1.5.1 Project Management Office (PMO) Domain

Contractor, in coordination with the System Agency’s approval will be responsible for using a clearly defined project management methodology to manage the Contract Project Phases, Deliverables, schedule, communication methods, and processes along with tracking In-Scope Maven Registries issues, risks, decisions, and actions. Project monitoring, control, and status reporting methods are part and parcel of the Contractor’s Contract obligations. See Table 4 – Project Management Office (PMO) Requirements that include, but is not limited to the following:

RFO No. HHS0017000 Page 16 of 70

Table 4 - Project Management Office (PMO) Requirements

Req ID Detailed Requirement

PMO-01 Contractor shall come on-site to the System Agency‘s designated Austin, TX location for testing, deployment, issue resolution and training for the In-Scope Maven Registries upon request by the System Agency. Location will be agreed upon by both parties at the time of request for Contractor to come on-site.

PMO-02 Contractor shall provide a full-time dedicated project manager to manage Contractor operations and obligations under the Contract.

PMO-03 Contractor shall provide one (1) software developer with a minimum of four (4) years’ experience with Maven.

PMO-04 Contractor shall provide the System Agency with support for all State audit information requests by assisting with research and analysis within State-mandated timeframes.

PMO-05 Contractor must begin work within five (5) Business Days after the Contract Effective Date or the effective date of any amendments initiated under Section

2.1.5.5 (Supplemental Services). Refer to Exhibit M, Health Registries Process Guide. See also Exhibit L, Deliverables, Change Management Plan, (DEL-04) and Exhibit N, Key Performance Measures and Liquidated Damages, (KPM-05).

PMO-06 Contractor shall train Contractor Personnel regarding the System Agency’s processes, methods and principles prior to assigning Contractor Personnel to perform work. Contractor is required to provide all training Services for its personnel to effectively develop and maintain the Registries. Training shall include, but not be limited to:

a. The current System Agency processes refer to Exhibit M, Health Registries Process Guide;

b. The System Agency’s required training, (e.g., IT Security; Protected Health Information (PHI) compliance; Health Insurance Portability and Accountability Act (HIPAA) compliance; and HHS Authorized User Agreement compliance.

RFO No. HHS0017000 Page 17 of 70

Revision Date 04/28/2025

PMO-07 Contractor shall provide a Deliverable Expectations Document (“DED”) for each of the Operations and Turnover phase. Contractor shall provide DED information as required in Exhibit P, Deliverables, Deliverable Expectations Document

(DED), (DEL-03).

All DEDs must be approved in writing by HHSC and must be updated to reflect changes to Deliverables.

PMO-08 Contractor shall adhere to and report compliance with all Key Performance Measures. Refer to Exhibit N, Key Performance Measures and Liquidated Damages.

PMO-09 Contractor shall follow the Software Development Life Cycle (SDLC) specified in Exhibit M, Health Registries Process Guide.

PMO-10 Contractor shall create and maintain a Change Management Plan (CMP) to track, review, and approve system modifications to the Maven platform prior to deployment. The Contractor shall provide the Change Management Plan as required in Exhibit L, Deliverables, Change Management Plan, (DEL-04) and Exhibit N, Key Performance Measures and Liquidated Damages, (KPM-04) and (KPM-05).

PMO-11 Contractor shall create and maintain a Risk Management Plan (RMP) that outlines the risk management approach, tasking, resources and monitoring, tracking and reporting methods to help identify and mitigate risks for the Maven platform. The Contractor shall provide the Risk Management Plan as required in Exhibit L, Deliverables, Risk Management Plan, (DEL-05).

PMO-12 Contractor shall define, manage, and ensure completion of all Contract project tasks, Deliverables, technical specifications, risks, and issues. Contractor shall manage the delivery of Services (when applicable), throughout the life of the Contract in coordination with the System Agency’s approval.

2.1.5.2 Performance Support Requirements

See Table 5 – Performance Support (PFS) Requirements that include, but is not limited to the

Table 5 - Performance Support (PFS) Requirements

RFO No. HHS0017000 Page 18 of 70

Revision Date 04/28/2025

Req ID Detailed Requirement

PFS-01 Upon request, Contractor shall conduct root cause analysis with the System Agency, for any recurring System performance issues and provide a detailed timeline for remediation plans.

PFS-02 Contractor shall provide break/fix support for the System. This service shall include but is not limited to:

a. Diagnosis and troubleshooting of System failures;

b. Restoration of service to normal operating conditions; and

c. Implementation of temporary workarounds and minimize downtime

(when necessary).

PFS-03 Contractor shall use a relational database management system within the Maven platform for data storage and shall follow industry standard practices for normalization and other data base performance management and capacity handling.

2.1.5.3 Testing Requirements

See Table 6 – Testing (TST) Requirements that include, but is not limited to the following:

Table 6 - Testing (TST) Requirements

Req ID Detailed Requirement

TST-01 Contractor shall adhere to the System Agency’s approved System Agency Test Management Plan. For a current example refer to Exhibit M, Health Registries Process Guide.

TST-02 Contractor shall provide electronic content and update the content as necessary in, the System Agency’s approved repository to reflect In-Scope Maven Registries requirements, test cases and acceptance criteria detail.

TST-03 Contractor shall adhere to the System Agency’s required software testing protocols, to ensure the delivery of high-quality Maven software including the resolution of defects according to defect severity as outlined in Exhibit M, Health Registries Guide. See also Exhibit L, Deliverables, Test Management

RFO No. HHS0017000 Page 19 of 70

Revision Date 04/28/2025

Plan, (DEL- 09) and Exhibit N, Key Performance Measures and Liquidated Damages, (KPM-07).

2.1.5.4 Training Requirements

See Table 7 – Training Requirements that include, but is not limited to the following:

Table 7 - Training (TRN) Requirements

TRN-01 Contractor shall allow System Agency IT administrators to update and edit on-line help/training documentation within the Maven platform.

TRN-02 The Maven platform shall have a help system that provides System Agency end-users with context sensitive help based on their location and active focus in the application, including but not limited to application specific help and external links to online documents (procedure manual, coding manual, etc.). Accessing the help system must use a separate process or window and must not cause the System Agency end-users to lose their place within the Maven platform.

TRN-03 Contractor shall provide the System Agency’s administrator, the Maven platform training that shall address, but not be limited to, system functionality, report generation, system administration, and other operations. System Agency trainees will be provided with electronic training materials to assist with training.

TRN-04 Contractor shall provide System Agency in-person end-user training using a train-the-trainer approach at an agreed upon location.

TRN-05 Contractor shall provide documentation for third-party vendor updates to the Maven platform.

TRN-06 Contractor shall maintain, and update training materials related to operating the Contractor’s System in electronic format, to reflect any upgrades and enhancements made to the System. Updated training materials shall be provided to the System Agency within ten (10) Business Days before the release of any update, change or enhancement.

RFO No. HHS0017000 Page 20 of 70

Revision Date 04/28/2025

TRN-07 Contractor shall complete the cybersecurity training program certified under Section 2054.5192 of the Texas Government Code as selected by the System Agency. The cybersecurity training program must be completed by Contractor annually during the Contract Term.

TRN-08 Contractor shall provide System Agency end-user training online or in person for major changes and new version releases, ten (10) Business Days prior to the associated release within the Maven platform.

TRN-09 Contractor shall maintain and update system documentation, including user manuals, technical specifications, and FAQs.

TRN-10 Contractor shall ensure training materials are available in multiple formats, including online modules, instructor-led sessions, and implementation guides.

2.1.5.5 Supplemental Services

To accommodate potential additional Services that may be required beyond the normal day-to-day maintenance, support and operations that are included in the quoted maintenance fees for each In-Scope Maven Registries, System Agency may require Contractor to perform Supplemental Services during the Contract Term.

System Agency will initiate the request for Supplemental Services using the Change Order Request (COR) process. Contractor shall prepare a Supplemental Services Plan to address the performance of the requested Services within the timeline required by System Agency. System Agency will provide such information as Contractor reasonably requests to facilitate Contractor’s preparation of a Supplemental Services Plan. System Agency will not pay any investigatory charges related to Contractor’s development of a Supplemental Services Plan.

Unless otherwise agreed by the Parties, Contractor shall respond in writing to System Agency’s Supplemental Services request on or before the fifteenth (15th) Calendar Day following the date of Contractor’s receipt of System Agency's request.

Notwithstanding any provision to the contrary, Contractor shall not be entitled to an increase in the Contract amount or an extension of the initial Contract Term with respect to any work performed that is not required by the Contract as amended, modified, and supplemented in a fully executed Contract amendment.

System Agency may accept or reject any Supplemental Services Plan.

RFO No. HHS0017000 Page 21 of 70

Revision Date 04/28/2025

2.1.5.6 Registry Decommissioning

Supplemental Services may include decommissioning any In-Scope Maven Registry (“Registry Decommission”) that will result in an additional cost, including data migration resulting from the Registry Decommission. For Supplemental Services associated with Registry Decommission, System Agency will engage the COR process to determine the level of effort required to complete Registry Decommission by the Registry Decommission Effective Date.

System Agency shall have the right to decommission any In-Scope Maven Registries at its sole discretion and at any time during the Contract Term. System Agency will provide to Contractor sixty (60) Calendar Days advance written notice of any Registry Decommission. The written notice shall state the following: the In-Scope Maven Registry to be decommissioned; the effective date of Registry Decommission (“Registry Decommission Effective Date”); and request the Supplemental Services that Contractor shall perform to complete the Registry Decommission pursuant to the COR process. The Supplemental Services that Contractor shall perform for any Registry Decommission shall be determined by System Agency at its sole discretion.

Table 8 - Supplemental Services (SPS) Requirements

Req ID Detailed Requirement

SPS-01 Contractor shall develop and establish a detailed High-Level Estimate (HLE) for newly identified projects that entail the fulfillment of complex requests, requiring design, solution, and proposals, including communications to set expectations and promote customer service acceptable to the System Agency. See Exhibit N, Key Performance Measures and Liquidated Damages, (KPM-06).

SPS-02 Contractor shall adhere to existing System Agency approved processes and procedures for triaging, escalating, and implementing project Change Order Requests. Refer to Exhibit M, Health Registries Process Guide.

SPS-03 Contractor shall identify, track, and maintain maintenance Change Order Requests in the System Agency approved ITSM tool and provide the System Agency with up-to-date information on any resulting impact to Maven.

SPS-04 Contractor shall provide a proposed organizational structure for each Contract Supplemental Services project, team roles, and assignment of Contractor Personnel to effectively meet the requirements for implementing Contract Supplemental Services projects.

RFO No. HHS0017000 Page 22 of 70

Revision Date 04/28/2025

SPS-05 Contractor shall assign Supplemental Services Contractor Personnel who will work onsite at the System Agency and provide updates to the System Agency IT Project Manager or their designee for the life of the Contract.

SPS-06 Contractor shall track Supplemental Services (Section 2.1.5.5 (Supplement Services)) Contractor Personnel time spent for all Contract supplement service projects by the In-Scope Maven Registry which can be represented by project ID or service request ID. This information will be required in the invoice reporting associated with supplemental Services.

SPS-07 In response to System Agency’s Supplemental Services request, Contractor shall provide a Supplemental Services Plan that will include, at a minimum, the following information, properly itemized and supported by sufficient substantiating data (e.g., documentation by Subcontractors performing the work), to permit evaluation by System Agency:

a. A project plan and fixed price or price estimate for the supplemental service;

b. A detailed breakdown of such price in the high-level estimate (HLE) as discussed in Exhibit M, Health Registries Process Guide;

c. The estimated level of effort (service hours);

d. A description of the Service Levels to be associated with the supplemental service;

e. A schedule for commencing and completing the supplemental service;

f. Any risks associated with the supplemental service and the integration of the supplemental service into the existing environment;

g. An analysis and estimate of the operational impacts related to the supplemental service;

h. Contractor must provide cost information (including detailed supporting metrics and detailed supporting costs deemed acceptable by System Agency) in sufficient detail to accurately modify the applicable fee formulas in Exhibit J, Cost Proposal. Once a total cost for the

RFO No. HHS0017000 Page 23 of 70

Revision Date 04/28/2025

Supplemental Services is agreed upon, System Agency will make the determination as to which fee formula(s) are to be modified.

SPS-08 Contractor shall not invoice and System Agency shall not pay for any charges related to the investigation of any proposed change to existing services or the development of Supplemental Services Plan(s). In addition, Contractor shall not invoice and System Agency shall not pay for Supplemental Services that:

a. Deviate from the System Agency-approved Supplemental Services Plan;

b. Commence prior to the date of the applicable Contract amendment; or

Exceed the fees specified in the applicable Contract amendment.

2.1.5.7 Deployment Requirements

See Table 9 – Deployment (DEP) Requirements that include, but is not limited to the

Table 9 - Deployment (DEP) Requirements

DEP-01 Contractor shall provide integration and release management approach to Transition releases and updates from Contractor’s DEV, TEST, STAGING, and PROD environments to the System Agency’s electronic environment, DEV, TEST, STAGING and PROD environment. See Exhibit M, Health Registries Process Guide.

DEP-02 Contractor shall provide to the System Agency any scripts, support documentation, and release notes at the time the Maven platform updates are delivered. See Exhibit M, Health Registries Process Guide.

DEP-03 Contractor shall record all Integration and Release Support defects in the System Agency’s approved defect tracking systems.

RFO No. HHS0017000 Page 24 of 70

Revision Date 04/28/2025

DEP-04 Contractor shall integrate Contractor’s release management process with the System Agency’s release management process and authorized third party vendors where the processes interact, and with other service management processes, including incident, change, configuration, release and program management that delineates at a minimum six (6) months downstream Maven releases. Refer to Exhibit M, Health Registries Process Guide.

DEP-05 Contractor shall facilitate, collaborate, and communicate any updates with respect to the Maven platform bug-fixes in a manner that adheres to the overall Release Management Process as delineated in Exhibit M, Health Registries Process Guide.

DEP-06 Contractor shall develop, enhance, and maintain automated build and deployment scripts for efficient Maven platform software deployment and configuration.

These automated build and deployment scripts shall be Texas Department of Information Resources Data Center Services (DCS) environment agnostic (refer to Exhibit G, Data Center Services RFO Language).

DEP-07 Contractor shall establish and maintain a Development (DEV) environment that mirrors the Austin Data Center (ADC) State Development environment. See Exhibit M, Health Registries Process Guide for details.

DEP-08 Contractor shall participate in and assist the System Agency with troubleshooting build and deployment issues as required in Exhibit M, Health Registries Process Guide.

2.1.5.8 Maintenance and Operations (MOS) Services

Maintenance and Operations Services (MOS) encompass annual core Services addressed by Contractor team off-site and on-site. MOS Services will include, but not be limited to, scheduled periodic maintenance releases as approved by the System Agency, maintenance of the core, patches to the core, version upgrades to the core and associated adjustments to the overlays.

The maintenance service levels (“Metal Plans”) are metal service levels for addressing In-Scope Maven Registries defects identified in production and approved by the System Agency for repair.

Currently the THISIS Registry is utilizing a Bronze Metal Plan. However, they will select their Metal Plan (Bronze, Bronze Modified, Silver, Gold, or Platinum) based on their maintenance requirements and the submitted pricing from the Respondent (refer to Exhibit M, Health Registries Process Guide for scope of each Metal Plan).

RFO No. HHS0017000 Page 25 of 70

Revision Date 04/28/2025

Pricing for each In-Scope Maven Registry and the associated Metal Plan shall be provided by Contractor in Exhibit J, Cost Proposal. Different service levels shall have different response times included and limited maintenance service hours per month.

The BLR is currently covered under the Bronze Modified Metal Plan and intend to keep the plan for the Contract Term which includes the following service hour allocations for Registry Maintenance and Operations Services (“Service Hour(s)”):

a. BRZ-01 Contractor shall provide ten (10) hours of Registries Maintenance and Operations Services for each Registry per month (“Monthly Service Hours”);

b. BRZ-02 System Agency shall also be provided a Monthly Service Hours overage allowance of 10% to be managed per Registry, per month, at no additional charge to System Agency, if required by System Agency, as determined by System Agency at its sole discretion;

c. BRZ-03 If Contractor determines System Agency is within the Monthly Service Hours overage for any Registry, for any month, Contractor shall immediately notify System Agency to ensure System Agency will not exceed the Monthly Service Hours overage by Registry;

d. BRZ-04 If directed by System Agency, Contractor shall re-allocate any unused Monthly Service Hours for any Registry in the current Contract year, to support overages in any Registry;

e. BRZ-04 At the end of each Contract year, Contractor and System Agency will examine the previous 12-month Contract period to determine the total Service Hours used for each Registry; and

f. BRZ-05 No fees or costs incurred by Contractor in excess of any allotted Monthly Service Hours or Monthly Service Hours overages may be charged to System Agency.

Contractor must submit a Supplemental Service proposal and cost estimate (i.e., HLE as per Exhibit M, Health Registries Process Guide to the System Agency if an In-Scope Maven Registries’ allotted hours, as identified in the associated In-Scope Maven Registries Metal Plan, will be exceeded for the maintenance level during any given month. These additional hours will be provided to the System Agency and will be implemented only upon written approval by the System Agency. See Table 10 - Maintenance and Operations Services (MOS) Requirements that include, but is not limited to the following:

Table 10 - Maintenance and Operations Services (MOS) Requirements

RFO No. HHS0017000 Page 26 of 70

Revision Date 04/28/2025

MOS-01 Contractor shall be responsible for providing Maintenance and Support (Operations) Services during the Term of the Contract .

MOS-02 Contractor shall provide support and response times in alignment with Exhibit M, Health Registries Process Guide Section 6.6 (Production Support – Response Times).

MOS-03 Contractor shall assist in troubleshooting Maven platform application issues (i.e., providing application logs for the System Agency to review).

MOS-04 Contractor shall adhere to the agreed upon Maven platform maintenance schedule.

MOS-05 Approximately every three years from Contract Execution date, at the request of the System Agency and at no additional cost to the System Agency, Contractor shall provide a core upgrade, including all Agency specific overlays, for the HIV/STD Integrated System. Contractor shall complete full Quality Assurance (QA) testing on the core upgrade and overlays prior to delivering the build to the System Agency.

MOS-06 Contractor shall respond to escalation procedures based on severity levels, which are defined and jointly agreed to with the System Agency, as defined in the Exhibit M, Health Registries Process Guide.

MOS-07 Contractor shall provide ongoing maintenance Services to ensure the System remains fully operational, including provision of software updates, patches, and firmware upgrades as necessary.

MOS-08 Contractor shall ensure the Maven platform provides application upgrades and security patches to protect against known and unknown vulnerabilities.

Contractor shall perform design requirements identified within this Contract in accordance with industry standard practice for software application systems holding confidential information and shall be designed to resist common attacks such as SQL injection and cross-site scripting.

RFO No. HHS0017000 Page 27 of 70

Revision Date 04/28/2025

MOS-09 Contractor shall provide a defined maintenance schedule and notify System Agency’s staff of any planned System outages, ensuring minimal disruption to operations. See Exhibit L, Deliverables, Annual Maintenance Schedule, (DEL-06).

MOS-10 Contractor shall conduct routine System health checks, performance monitoring, and preventive maintenance to minimize downtime and enhance system stability.

MOS-11 Contractor shall allow authorized downloads of data for verification purposes that comply with HIPAA requirements. When data leaves the Maven platform, the data shall comply with HIPAA standards.

MOS-12 Contractor shall provide the Maven platform production software maintenance defect and data fix services as required within System Agency approved timelines. Refer to Exhibit N, Key Performance Measures and Liquidated Damages, (KPM-11).

MOS-13 Contractor shall provide support for the System Agency ad hoc requests within the Maven platform including, but not limited to, the following:

a. Legislative Bill analysis support;

b. IV & V contractor assessments;

c. Open Records requests;

d. Internal and external audit requests; and

e. Other non-standard report or data requests.

MOS-14 Contractor shall implement System Agency requested performance improvements for the Maven platform as discussed and mutually agreed upon by both Contractor and the System Agency.

MOS-15 Contractor shall triage defects within the Maven platform reported to determine severity priority and assign the defect to the appropriate party for action in the System Agency approved issue tracking tool.

MOS-16 Contractor shall assist the System Agency IT application development team to analyze, determine root cause, and resolve maintenance issue requests within the Maven platform including, but not limited to, the following:

RFO No. HHS0017000 Page 28 of 70

Revision Date 04/28/2025

a. Provide guidance to determine remediation of defects;

b. Identify the Maven platform system or data errors and provide resolution;

and

c. Collaborate with the System Agency IT application development team for the Maven platform troubleshooting including root cause analysis and resolution.

2.1.5.9 Operations Support Requirements

See Table 11 – Operations Support (OPS) Requirements that include, but is not limited to the following:

Table 11 - Operations Support (OPS) Requirements

Req ID Detailed Requirement

OPS-01 Contractor shall provide live Maven platform IT help desk support during Business Days and Business Hours and ITSM support requests shall be captured within twelve (12) hours. See Exhibit L Deliverables, Help Desk Tickets, (DEL-16) and Exhibit N, Key Performance Measures and Liquidated Damages, (KPM-10).

OPS-02 Contractor shall ensure knowledge transfer and operational documentation is maintained to support continuity of service.

OPS-03 Contractor shall provide a help desk for the Maven platform that shall reply to messages or e-mails within four (4) Business Hours if live support is not available for immediate response.

OPS-04 Contractor shall maintain a cost-effective, high-availability environment that minimizes the frequency and impact of system failures, reduces downtime, and minimizes recovery time in the event of catastrophic failure.