ESBD_533036_1782847046387_304-27-0833WS Employee Assisistance Program.pdf

RFP # 304-27-0833WS EAP and Related Svcs Page 1 of 42 (Rev. 2/2024)

TEXAS COMPTROLLER OF PUBLIC ACCOUNTS

Request for Proposals (RFP)

For

Employee Assistance Program and Related Services RFP No. 304-27-0833WS

Issuance Date: June 30, 2026

Anticipated Schedule of Events

June 30, 2026 Issuance of RFP

July 9, 2026 Deadline for Submission of Questions (2:00p.m., CT)

July 14, 2026 Release of Official Responses to Questions (or as soon thereafter as practical)

July 28, 2026 Deadline for Submission of Proposals (2:00p.m., CT) Late Proposals will not be considered

September 1, 2026 Services Commencement Date (or as soon thereafter as practical)

RFP # 304-27-0833WS EAP and Related Svcs Page 2 of 42

Table of Contents

I. Summary II. Specifications

A. Introduction B. Background C. Definitions and Acronyms D. Scope of Services E. Contract Resulting from this Solicitation; Order of Priority F. Warranty of Performance G. Security Incident Notification H. Insurance and Bonds I. Criminal Background Investigation J. Contract Term; Survival of Terms K. Acceptance Criteria L. Payments M. Discounts N. PO Addition and Deletion O. VetHUB Subcontracting Plan Information P. Respondent Documents Q. Respondent Exceptions R. Respondent’s Past Performance; Vendor Performance Tracking System

III. Proposal Submission Requirements A. Delivery of Proposal B. Proposal Content and Format

IV. Mandatory Price Sheet V. Standard Terms and Conditions VI. Execution of Proposal VII. Conflict of Interest/Disclosure Statement VIII. Nondisclosure Agreement IX. Confidential Treatment of Information Acknowledgment X. Certification Regarding Public Nature of the Proposal XI. Respondent Exceptions

RFP # 304-27-0833WS EAP and Related Svcs Page 3 of 42

I. Summary

1. Type of Solicitation: Request for Proposals (RFP)

2. Issuing Office: Texas Comptroller of Public Accounts Procurement Section Room 300, Attn: RFP No. 304-27-0833WS 111 E. 17th Street Austin, Texas 78774

3. Additional Requirements/Qualifications: N/A

4. Responses to RFP: Sealed Competitive Proposals

5. Deadline for Proposals: In Issuing Office No Later Than:

July 28, 2026; 2:00 p.m., Central Time (CT)

6. Initial Contract Term: September 1, 2026 to August 31, 2027

7. CPA Optional Contract Terms: September 1, 2027 through August 31, 2028 September 1, 2028 through August 31, 2029 and September 1, 2029 through August 31, 2030

8. CPA Contact Person for this RFP: Wendy Foley-Smith, CTCD, CTCM Email with delivery receipt requested to: bidcpa@cpa.texas.gov Copy to: Wendy.foley@cpa.texas.gov

9. Proposals Submitted by Email: Required; see Section III, Part A

10. Proposals Submitted by Fax: Not accepted

11. Pre-Proposal Conference: N/A

12. Pre-Proposal Inspection: N/A

13. Letters of Intent to Submit a Proposal: N/A

14. RFP Addenda: Notices of changes to items directly impacting the original RFP or solicitation process will be posted on the Electronic State Business Daily (ESBD) located at: http://www.txsmartbuy.com/esbd. CPA will post any amendment to this solicitation on the ESBD as an RFP Addendum. It is the responsibility of an interested party to check the ESBD for updates to this RFP before submitting a Proposal. Each Respondent is solely responsible for verifying CPA’s receipt of its questions, if applicable, and its Proposal by the deadlines specified in this RFP.

15. Questions and Answers: Questions regarding this RFP must be in writing and must be submitted to the CPA Contact Person specified in Part 8, no later than July 9, 2026;

2:00 p.m. CT. Telephone inquiries will not be accepted. Questions may be submitted by email to the email address specified in Section I, Part 8.

CPA intends to post answers to the questions received on the ESBD on July 14, 2026, or as soon thereafter as practical.

16. Respondent Presentations: N/A

17. Evaluation of Proposals under Best Value Standard (Section 2156.125 of the Texas Government Code):

Criteria Weight

Respondent’s Qualifications, Experience and Past Performance 20% Compliance with CPA Specifications 40% Costs 40% Total: 100%

As applicable, the factors listed in Sections 2155.074, 2155.075, 2156.007, and 2157.003 of the Texas Government Code shall also be considered in making an award. Best and Final Offers may be sought from Respondents whose Proposals are ranked most highly by the evaluation committee. However, CPA encourages Respondents to offer their best pricing at all times. CPA reserves the right in its sole judgment and discretion, and at any time upon failure of negotiations, to reissue or withdraw this RFP rather than continue with negotiations.

mailto:bidcpa@cpa.texas.gov mailto:Wendy.foley@cpa.texas.gov http://www.txsmartbuy.com/esbd

RFP # 304-27-0833WS EAP and Related Svcs Page 4 of 42

18. Email Submission Only. Due to changed building access restrictions, Respondents will not be permitted to hand deliver Proposals to the Issuing Office. Respondents are required to submit Proposals electronically via email with delivery receipt requested in accordance with Section III, Part A.

19. Contact with CPA Staff: Upon issuance of this RFP, employees and representatives of CPA, other than the CPA Contact Person identified in Section I, Part 8, will not discuss the contents of this RFP with any Respondent or its representatives.

Failure of a Respondent or any of its representatives to observe this restriction may result in disqualification of any related Proposal. This restriction does not preclude discussions between the parties to conduct business unrelated to this procurement or to obtain assistance completing State of Texas VetHUB Subcontracting Plan forms required by this RFP.

RFP # 304-27-0833WS EAP and Related Svcs Page 5 of 42

II. Specifications

A. Introduction

The Texas Comptroller of Public Accounts (CPA), an agency of the State of Texas, issues this Request for Proposals (RFP) to solicit responses from qualified individuals and entities to provide an Employee Assistance Program and Related Services as described in this RFP (Services). CPA’s objective is to obtain the Services that represent the best value for CPA and the State of Texas according to the terms and conditions of this RFP.

CPA anticipates making a Contract award to one (1) Successful Respondent for the Services. CPA reserves the right not to award a Contract for the performance of all or part of the Services. This RFP is not exclusive, and CPA reserves the right to issue additional solicitations regarding the Services or similar services at any time. All Respondents are encouraged to offer their best pricing at all times.

All costs associated with the Services must be included on Section IV (Mandatory Price Sheet) and submitted in the Respondent’s Proposal. Proposals that do not meet all of the requirements or contain all of the required documentation specified in this RFP may be rejected as non-responsive.

B. Background

CPA’s existing Employee Assistance Program (EAP) provides assessment, guidance, counseling and referral services to help Participants identify and resolve personal issues, including issues that may impact the employee’s job performance or work behavior. CPA’s existing EAP and Related Services contract will expire on August 31, 2026. CPA has identified a continuing need for an EAP and Related Services and seeks to meet this need through a contract resulting from this RFP.

• The EAP is extended to all of CPA’s approximately 3,000 employees. CPA’s workforce includes those working at CPA’s headquarters and field offices within Texas, remote teleworkers distributed throughout the U.S., and staff with offices at the following field locations:

o Chicago, IL – 24 employees o Los Angeles, CA – 23 employees o New York, NY – 14 employees o Tulsa, OK – 14 employees o Detailed CPA location information is available at https://comptroller.texas.gov/about/contact/locations.php.

• The table below represents CPA’s EAP utilization data for the most recent two (2) years:

Description FY2024 FY2025 Number of employees on which the report is based 2,850 2,850

Total number of live engagements (# of issues)

Counseling 98 144 Work-Life 2 8

Legal 19 19 Financial 4 1

Total number of digital engagements (including behavioral health, work-life, financial, health and well-being, health care, and legal resources) 378 312

Well-Being Coaching (# of requests/# of sessions) 1 request/1 session 2 requests/6 sessions Webinar training hours (total hours) 1 hour 1 hour

On-site critical incident support (# sessions/# hours per session) 1 session/5 hours 6 sessions/2-4 hours for 19 hours total

On-site training/orientation/educational seminars (total hours) 0 0 On-site health fair event (total hours) 0 0

• CPA’s health plan administrator is the Employees Retirement System of Texas (ERS) and ERS participants are offered several self-funded plan options.

C. Definitions and Acronyms

• Award Date. The Award Date is the earlier of the date an authorized representative of CPA (1) issues a Purchase Order (PO) or (2) signs a formal, written agreement.

• Business Day. Monday through Friday, 8:00AM (CT) through 5:00PM (CT), except days on which the CPA’s offices are closed in accordance with the State of Texas Holiday Schedule posted on the agency website.

https://comptroller.texas.gov/about/contact/locations.php

RFP # 304-27-0833WS EAP and Related Svcs Page 6 of 42

• Contract. The agreement described in Section II, Part E (Contract Resulting from this Solicitation; Order of Priority), if any.

• Days. The word “days” shall mean calendar days unless otherwise specified.

• Participant. A CPA employee and its family members who participate in the EAP with such family members defined as any individual CPA employee's parent, spouse, child, brother, or sister (whether related by kinship, adoption, or foster care) residing as a member of the same household in the CPA employee's principal place of residence and any CPA employee's minor child (whether related by kinship, adoption or foster care) who does not reside in the CPA employee's principal place of residence.

• Proposal. A submitted response to this RFP.

• Respondent. Any person or entity that submits a Proposal.

• Successful Respondent. The Respondent awarded a Contract, if any.

• TDD. Telecommunications Device for the Deaf.

D. Scope of Services

D.1. General

a. Successful Respondent shall provide the Services as described in this RFP and in accordance with the terms set forth in this RFP.

b. Successful Respondent’s performance under the Contract shall include requirements set forth in RFP Section II (Specifications) and any services reasonably related to satisfying such requirements.

c. Successful Respondent shall provide all EAP Services delivered to Participants at no cost to Participants.

1) Successful Respondent shall not request payment from a Participant’s insurance carrier for any EAP Services.

2) Participants will be responsible for payment for any services not included under the Contract and provided by referral resources.

D.2. EAP Services

a. Counseling Services.

1) Successful Respondent shall provide Counseling Services which must include, without limitation, assessment, short-term confidential counseling in areas such as alcohol and/or substance abuse and addiction, relationship matters, psychological, emotional, and/or physical health and wellness, legal matters, and financial concerns.

2) Successful Respondent shall make available a minimum of six (6) Counseling Sessions (including assessment and/or referral when indicated) per incident/issue per Participant per Contract year.

3) A “Counseling Session” is a scheduled face-to-face conference between a Participant and a counselor for the purpose of discussing and identifying areas of concern and issue-solving.

a) At Participant’s election, a counselor may provide a Counseling Session by telephone or video conference.

b) Successful Respondent shall not utilize telephone, video or virtual conferences as the usual or the routine method of providing counseling. Appointments for Counseling Sessions must be scheduled to ensure confidentiality.

4) Successful Respondent must provide trained individuals who:

a) are counselors by trade;

b) possess a minimum of a master’s degree, in psychology, counseling, social work or other appropriate behavioral science, awarded by an accredited institution of higher education; and

c) possess a current license, certification, and/or other credentials required by federal and state laws, rules, and regulations applicable to the state or jurisdiction in which the counselor practices, and, as applicable, be a member in good standing of any professional organization if required by the licensing board or the laws of the state in which the counselor practices.

d) To the extent permitted by applicable laws, rules, and regulations, exception to the requirement of a master’s degree may be made for licensed or certified, as applicable, counselors in fields requiring

RFP # 304-27-0833WS EAP and Related Svcs Page 7 of 42 specialized knowledge, training, and expertise obtained through a reputable professional training program that issues licenses or certifications to qualified individuals who meet nationally recognized standards of theoretical study and practical experience as set by the counseling profession.

5) Counselors shall make available to the Participant a minimum of 45 minutes per Counseling Session.

6) Counselors shall immediately provide Counseling Sessions to Participants in extreme crisis (harmful to self or others) on an emergency basis.

7) Except for extreme crisis Counseling Sessions described immediately above, a Counseling Session appointment shall be available to the Participant within 48 hours of the Participant's first contact with Successful Respondent.

8) Successful Respondent shall provide CPA a designated contact person who is dedicated to managing all Procedural Referrals. “Procedural Referrals” are defined as all cases where a CPA employee is required to obtain counseling based on negative job performance or work behavior.

b. Referrals.

1) If a counselor deems a referral to another resource (Referral Resource) is appropriate and in the best interest of the Participant, the counselor shall assist the Participant in locating the Referral Resource that is most appropriate for, and in the best interest of, the Participant.

2) Counselors shall provide Referral Resources covered by a Participant’s insurance or health coverage, if available, at the Participant’s election.

3) Counselors shall consider a Participant’s financial means when making Referrals.

4) Counselors shall assist a Participant in accessing the Referral Resources. Counselors shall follow up with each Participant to determine the services received and the appropriateness and usefulness of the service.

5) Successful Respondent shall not charge a Participant or a Participant’s insurance provider for any of Successful Respondent’s efforts related to identifying and providing the Participant with a Referral to a Referral Resource.

6) It is the intent of CPA that the Participant’s best interest always be considered. Accordingly, Successful Respondent shall ensure that all Referrals are made in a manner such that Successful Respondent or Successful Respondent’s affiliate companies do not benefit disproportionately from Referrals.

7) In its Proposal, Respondent must propose and describe in detail a Referral system which would avoid the appearance of a conflict of interest, and which would minimize the possibility of self-serving Referrals.

c. Helpline.

1) Successful Respondent shall provide a toll-free “Helpline” that is staffed with qualified counselors who are trained in assisting Participants seeking Counseling Services or other EAP Services.

2) The Helpline must be available to Participants twenty-four (24) hours a day, all days throughout the Contract Term.

3) The Helpline must be accessible to all Participants, including Participants requiring Services through TDD technology.

4) Successful Respondent’s Helpline numbers shall be included in all informational campaign materials required under RFP Section II, Part D.3.

d. Compliance with Laws and Best Practices Standards

1) Successful Respondent shall ensure its compliance with all applicable federal and state laws and professional best practices applicable to delivery of EAP and Related Services.

2) Successful Respondent shall ensure compliance with all applicable provisions of the Americans with Disabilities Act of 1990, (42 U.S.C. §12101 et seq.), as amended, for all EAP Services delivered under the Contract.

3) Successful Respondent shall provide free language access/interpretation services to limited English proficient Participants.

RFP # 304-27-0833WS EAP and Related Svcs Page 8 of 42

4) Successful Respondent shall provide effective auxiliary aids and/or sign language interpreter services to hearing impaired or deaf Participants, as needed, and shall deliver such services through licensed or certified interpreters when required by applicable law.

e. Service Locations.

1) Successful Respondent shall provide EAP Services at off-site, non-CPA locations to ensure maximum confidentiality of Participants. The off-site locations must be accessible to all Participants and must meet all requirements of Section II, Part D.2.d (Compliance with Laws and Best Practices Standards).

2) Successful Respondent shall provide EAP Services available and accessible to all CPA employees and their family members and household members that qualify as Participants.

a) EAP Services must be available to Participant within reasonable distance of the CPA employee Participant’s principal place of residence.

b) Where a Participant is the minor child not residing with the CPA employee, EAP Services must be available to the CPA employee and the child within reasonable distance of the child’s principal place of residence.

3) Successful Respondent’s EAP Services shall include Participants may receive EAP Services through optional remote access (i.e., virtually/digitally) via secure telehealth, web portal, 24/7 toll-free hotline, and mobile applications/platforms.

f. Contact Person. Successful Respondent shall designate a contact person and provide a toll-free number and a TDD toll-free number to which Participants may address questions or complaints. Successful Respondent must provide this contact person’s name and location and make this information readily available to CPA and Participants.

D.3. Education and Information Services.

a. General. CPA encourages creativity on the part of Successful Respondent in providing Education and Information Services to CPA employees and Participants, which must include, at a minimum, the Education and Information Services described in this Part D.3.

b. Informational Campaign. Within thirty (30) days of Award Date, Successful Respondent shall deliver an informational campaign that will familiarize all CPA employees with the EAP and educate them on how to access the available EAP Services. The campaign must include, but is not limited to, the following:

1) providing a 45 to 60-minute EAP Services and benefits overview via virtual platform (e.g., Teams®, Zoom®, etc.) to CPA’s general employee population, with a recording of the overview available to CPA for use in delivery of the overview to CPA’s employees located in remote offices or who missed the original meeting;

2) providing bilingual (English and Spanish) posters, brochures, and pamphlets to all CPA locations via mail;

3) providing bilingual (English and Spanish) informational pamphlets for periodic electronic mailings by CPA;

4) providing bilingual (English and Spanish) hard-copy brochures for an estimated 500 new-employee orientations per year; and

5) providing an online video to be used by the CPA to publicize the EAP Services and benefits.

c. Executive/Managerial Overview. Within thirty (30) calendar days of Award Date, Successful Respondent must provide CPA executives, managers, and CPA designated personnel with a condensed overview of the EAP, either on-site at a CPA designated location in Austin, TX, or virtually. The overview must provide a clear understanding of the EAP, its benefits to Participants and CPA, its impact on working conditions, and instructions on how to access the EAP Services as a Participant. Successful Respondent shall provide CPA with a recorded version of such overview for CPA’s use in delivery of the overview to CPA’s executives, managers, and designated employees on demand. Successful Respondent shall be available to periodically meet with CPA executives, managers, and designated personnel on-site at a CPA designated location in Austin, TX, or through a virtual platform (e.g., Microsoft Teams®, Zoom®, etc.) to discuss EAP matters.

d. Critical Incident Stress Debriefing (CISD). CISD is defined as a worksite intervention provided to employees to relieve stress and trauma induced by any crisis affecting employees. Successful Respondent shall provide CISD within 24-72 hours of receipt of CPA’s request, unless otherwise agreed by CPA in writing.

RFP # 304-27-0833WS EAP and Related Svcs Page 9 of 42

e. Wellness Training. In addition to any regularly scheduled wellness offerings, Successful Respondent shall provide a minimum of twenty (20) hours of Wellness Training during each Contract Term (i.e., Initial Term and each exercised Renewal Term) on an as-needed, requested basis. Wellness Training for the agency shall be available for, but not exclusively limited to, on-site requests.

f. Counselor Identification Information. Successful Respondent must provide identification information for counselors. Identification information must reflect the counselor’s name, counseling location, and telephone number, plus any other pertinent information to assure access to EAP Services for Participants.

D.4. Reports.

a. Successful Respondent will provide CPA with statistical and evaluative data at the times and in the format prescribed by CPA at no additional cost to CPA.

1) At a minimum, Successful Respondent shall provide quarterly and annual reports. Quarterly reports must include cumulative year-to-date totals.

2) Reports must include, without limitation, the following data: Number of Participants (unduplicated count), age, sex, race, geographic regions to be established by CPA’s office, geographic location by regional boundaries, whether the consultation was with a CPA employee or with a CPA employee’s family/household member, type of referrals, type of issues, type of outside referrals, number of EAP visits, number of complaints/grievances concerning outside referral services, number of complaints/grievances concerning the services of the EAP, number of referrals made to Successful Respondent affiliate companies.

b. For purposes of demonstrating Successful Respondent’s internal quality assurance process, within 30 days after completion of EAP Services provided to a Participant, Successful Respondent shall seek from each Participant a follow-up “quality of care” report that must include data compiled by Successful Respondent to determine if the Participant received EAP Services that addressed their concerns/issues in an effective way. Upon receipt of CPA’s written request and reasonable advance notice, Successful Respondent shall provide a summary of the results of quality of care reports.

c. Upon CPA request, Successful Respondent shall provide a list of Successful Respondent’s affiliate companies.

D.5. Service Delivery Plan.

In its Proposal, Respondent must describe in detail:

a. The service delivery method (who will provide and how), and

b. How EAP Services will be provided to Participants in accordance with requirements of Section II, Part D.2.e.

with the detailed description specifically addressing:

• In-person Services delivered at non-CPA, off-site locations accessible to any Participants and that meet requirements of Section II, Part D.2.e.2) (Compliance with Laws and Best Practices Standards);

• Services delivered to Participants:

o Within reasonable distance of the CPA employee (including field office and remote/teleworking)

Participant’s principal place of residence; and o Where a Participant is the minor child not residing with the CPA employee Participant, within reasonable distance of the child’s principal place of residence.

• EAP Services that are available through remote access.

Respondent must also describe the following in detail in its Proposal:

• Method/plan for data collection for required reports;

• Plan for self-evaluation and quality control, including any follow-up procedures;

• Plan for a formal operational grievance procedure for Participants;

• Plan to transition counseling services of active Participants at the time of Contract award; and

• Referral system as described in Section II, Part D.2.b.

D.6. CPA Data Safeguard Standards.

a. Defined Terms. The term “CPA Data” refers to CPA’s information as well as other entity information in the possession of CPA that is processed, stored, or transmitted by a computer. CPA Data includes all data that is generated by Successful Respondent in performance of a contract with CPA. The term “CPA Information System” refers to those devices, software, networks and related infrastructure that CPA owns, operates or has obtained for

RFP # 304-27-0833WS EAP and Related Svcs Page 10 of 42 use to conduct CPA business. Devices include, but are not limited to, CPA-owned or managed storage, processing, and communications devices, as well as personally owned devices.

b. Access to CPA Data. Successful Respondent represents and warrants that it will implement, maintain, and use appropriate administrative, technical, and physical safeguards to preserve the confidentiality, integrity, and availability of CPA Data. Successful Respondent will not collect, access, use, disclose, or retain CPA Data other than as necessary to perform the services specified in a contract resulting from this solicitation or as otherwise authorized in writing by CPA. Successful Respondent will restrict access to CPA Data to only those personnel who must have the information on a “need to know” basis. Successful Respondent will not use CPA Data, or any information derived from CPA Data, for its own benefit or the benefit of any other person or entity. Successful Respondent will not share CPA Data with its parent company or other affiliate without CPA’s express written consent. If communications with Contractor necessitate the access or use of confidential CPA Data, upon CPA’s written consent, Successful Respondent shall require each individual who will require access to or may be exposed to confidential CPA Data to sign the Confidential Treatment of Information Acknowledgment (CTIA) form (Section IX).

c. Reserved.

d. Reserved.

e. Reserved.

f. Location of CPA Data. Successful Respondent shall ensure that CPA Data (i.e., primary and backup) remains, at all times, within the continental United States. Successful Respondent shall receive, process, transmit, and store all CPA Data within the continental United States. Successful Respondent’s point of access to CPA Data shall be within the continental United States.

g. Encryption Standards.

1) Successful Respondent shall encrypt CPA Data in transit and at rest. Data in transit means data is moving via email, in applications, or through browsers and other web connections. Data at rest (including data backups) means data is stored in databases, the cloud, removable media, or mobile devices.

2) Successful Respondent shall utilize encryption standards that are FIPS 140-2 compliant or, upon the written approval of CPA’s Chief Information Security Officer, shall meet the intent of the standards as described in

FIPS 140-2.

3) The minimum cryptographic algorithm used by Successful Respondent must be Advanced Encryption Standard (AES) 128 or higher (256 AES is preferred).

4) Successful Respondent shall encrypt CPA Data transmitted over a public or private network. CPA approved data encryption transmission protocols include the following: (1) SFTP (FTP over SSH), (2) FTPS (FTP over TLS), (3) HTTPS (HTTP over TLS), and (4) virtual private network.

h. Reserved.

i. Reserved.

j. Reserved.

k. Supply Chain Risk Management. Successful Respondent shall provide CPA’s Contract Manager a description of how it manages supply chain risks. Specifically, Successful Respondent shall describe its established agreements and procedures with entities involved in the supply chain for the notification of supply chain risks, compromises, and the result of assessments or audits. During the Contract Term, Successful Respondent shall provide CPA’s Contract Manager prompt, written notice of supply chain risks that impact the delivery of the products and services of the Contract. Examples of supply chain risks include supplier financial failure, production control/product quality, market supply and demand, labor disputes/shortages, cybersecurity threats, natural disasters. Successful Respondent shall notify CPA of a supply chain compromise and potential compromise in accordance with the Security Incident Notification Section.

l. Reserved.

m. Media Sanitization. Successful Respondent shall sanitize information system media, both digital and non-digital, in accordance with NIST Special Publication 800-88 (Guidelines for Media Sanitization) when CPA Data in the custody of Successful Respondent is no longer required to be retained by contract with CPA. Successful Respondent must maintain a record documenting each sanitization procedure that, at a minimum, includes the following information: (i) date sanitization completed, (ii) description of the item(s), serial number(s), inventory control number(s), if applicable, and (iii) sanitization method used. No later than sixty (60) calendar days from contract expiration or termination or as otherwise specified in the Contract, Successful Respondent must either

RFP # 304-27-0833WS EAP and Related Svcs Page 11 of 42

(i) complete the sanitization and submit via email to the CPA Contract Manager all sanitization documentation or

(ii) submit a written statement via email to the CPA Contract Manager explaining the reason that destruction of CPA Data by Successful Respondent is technically impossible or impractical. Successful Respondent’s obligations set forth in this clause survive the termination or expiration of the contract as long as Successful Respondent retains CPA Data.

n. Third-Party Service Providers. It is Successful Respondent’s sole responsibility to ensure that its access and the access Successful Respondent grants to its service providers to CPA Data or CPA Information Systems does not result in unauthorized access to CPA Data or CPA Information Systems.

o. Reserved.

p. Reserved.

q. Reserved.

r. Prohibited Technology. Successful Respondent shall not use covered applications or prohibited technologies in its technology solutions or services provided to CPA. In addition, Successful Respondent represents and warrants that its system, software, components, and services do not use the covered applications or prohibited technologies listed on the Department of Information Resources (DIR) Covered Applications and Prohibited Technologies website.

s. Use of Artificial Intelligence. Successful Respondent shall comply with all federal and state laws and regulations for artificial intelligence. Successful Respondent shall implement and maintain the following.

1) Transparency. Disclose the artificial intelligence (AI) that Successful Respondent embeds in its technology products and services and provide detailed information on the purpose of the AI, the specific AI model(s) in use, if the AI uses CPA Data to train AI model(s), the configuration settings and options to disable or opt out of using the AI.

2) Artificial Intelligence Inventory. Successful Respondent shall implement and maintain an inventory of the AI used in Successful Respondent’s solution, software, system components, and services provided to CPA. CPA is required to report an inventory of artificial intelligence in biennial statutorily required reports and Successful Respondent shall support CPA’s compliance by providing the inventory information upon CPA’s written request.

3) Monitoring. Successful Respondent shall monitor AI for query attacks, malicious inputs, and perturbations for model manipulation, theft, data poisoning, and data drift. Successful Respondent shall establish model integrity validation checks and data poisoning detection capabilities. Successful Respondent shall implement processes for detecting personally identifying information (PII) in the model and removing PII from the model, as appropriate to ensure the AI cannot provide PII to Successful Respondent’s other customers or outside the boundaries of the CPA Information System.

4) Disclosure Notice. Successful Respondent shall disclose to the public prior to system use, the use of AI in systems that interact with the public and receive, process, transmit, or store CPA Data.

5) Data Ownership. Successful Respondent shall acknowledge that CPA owns CPA Data. If Successful Respondent uses generative AI to provide services to customers of a CPA Information System, Successful Respondent shall ensure that the AI cannot provide CPA Data to Successful Respondent’s other customers or outside the boundaries of the CPA Information System systems.

t. Reserved.

u. Reserved.

v. Reserved.

w. Reserved.

D.7. Accessibility Compliance. Successful Respondent shall provide Licensed Software that complies with the applicable, statutorily required accessibility standards for the State of Texas. In the event that the Licensed Software does not meet or exceed the applicable statutorily required accessibility standards for the State of Texas, Successful Respondent shall provide technical support and Licensed Software documentation necessary to enable CPA to comply with the State of Texas reporting requirements outlined in 1 Texas Administrative Code Chapters 206 and 213. Such assistance includes, but is not limited to, Successful Respondent providing a Voluntary Product Accessibility Template (VPAT) or a similar report in substantially the same format as a VPAT. Successful Respondent shall respond to all written inquiries from CPA regarding the Licensed Software’s compliance with requisite accessibility standards within five

(5) business days of receiving such request.

https://dir.texas.gov/information-security/covered-applications-and-prohibited-technologies https://dir.texas.gov/information-security/covered-applications-and-prohibited-technologies

RFP # 304-27-0833WS EAP and Related Svcs Page 12 of 42

D.8. Liquidated Damages. In submitting a Proposal, Respondent agrees that the measure of damages in the event of a default or breach by Successful Respondent may be difficult or impossible to calculate. In the event Successful Respondent fails to perform Services or complete the obligations under the Contract in a timely manner, CPA may require Successful Respondent to pay, as liquidated damages and not as a penalty, an amount equivalent to two percent (2%) of the total cost for Services or obligations not completed as required by the Contract per calendar day of delay.

CPA may impose, but is not obligated to impose, these liquidated damages in lieu of any monetary damages available to CPA under the Contract or applicable law.

D.9. Optional Features, Products or Services. If Respondent believes there are additional features, products or services that would benefit CPA under this RFP, Respondent may describe such features, products or services and include pricing for such features, products or services in Price Schedule 2, Section IV (Mandatory Price Sheet). Optional features, products or services are not scored as part of the evaluation process.

E. Contract Resulting from this Solicitation; Order of Priority

Respondent’s Proposal is a legal offer to contract based upon the terms, conditions, and specifications set forth in this RFP.

“Contract” means (1) a valid PO issued by CPA or (2) a formal, written agreement between CPA and Successful Respondent, if any. The Contract is effective as of the Award Date and will be between CPA and the Successful Respondent. Successful Respondent shall be solely responsible to CPA for all performance by Successful Respondent’s employees, representatives, agents, subcontractors, suppliers, third-party service providers, and similar entities (“Persons” for purposes of this sentence) and for ensuring that all such Persons comply with applicable provisions of this RFP and the Contract. The entire Contract between CPA and Successful Respondent shall consist of the following documents, which shall control in the following order of priority, except as otherwise provided in the formal, signed agreement between the parties or CPA’s PO: (1) the PO and PO Change Notices (POCN), if any; (2) the formal, signed agreement, if any; (3) this RFP; and (4) Successful Respondent’s Proposal (collectively, these documents constitute the “Contract”).

F. Warranty of Performance

Successful Respondent represents and warrants that its performance under the Contract shall be conducted conscientiously in a professional and workmanlike manner to the full extent of Successful Respondent’s talents and capabilities with due diligence and in full compliance with the highest professional standards of practice in the industry applicable to the Services.

G. Security Incident Notification

Successful Respondent shall have policies and procedures for the effective management of Security Incidents, which shall be made available to CPA upon written request. Within twenty-four (24) hours of Successful Respondent’s discovery or reasonable belief that there has been an event which results in the accidental or deliberate unauthorized access, loss, disclosure, modification, disruption, or destruction of confidential CPA information (Security Incident), Successful Respondent shall provide notice to CPA by calling (800) 531-5441 EXT 34357. Until the investigation is complete, Successful Respondent shall submit, on a daily basis or as otherwise agreed by CPA, a written report via encrypted email to security.alerts@cpa.texas.gov that includes, at a minimum, the following:

• Date and time incident occurred,

• Date and time incident detected,

• Date and time incident contained,

• Address where incident occurred,

• Name of person(s) that discovered incident,

• Description of how Successful Respondent discovered incident,

• Type of CPA information involved,

• Description of the nature of the incident,

• Description of the steps Successful Respondent has taken or will take to investigate incident,

• Description of the steps Successful Respondent has taken or will take to mitigate any negative impacts of incident,

• Information technology involved (e.g., laptop, server, mainframe),

• Description of steps taken to preserve computer evidence and maintain chain of custody, and

• Description of corrective action Successful Respondent has taken or will take to prevent future incidents.

Successful Respondent shall coordinate all media or other breach notifications with CPA in advance of such notification(s), unless expressly prohibited by law. Subject to review and approval of CPA, Successful Respondent shall provide notice at its own cost that satisfies the requirements of applicable law to individuals whose information was compromised or likely compromised as a result of the Security Incident. If CPA, in its sole discretion, elects to send its own separate notice, then all costs associated with preparing and providing the notice shall be reimbursed to CPA by Successful Respondent. If Successful Respondent does not reimburse such costs within thirty (30) days of CPA’s written request, then CPA shall have the right to collect such costs. CPA reserves the right to conduct an independent investigation of any Security Incident, mailto:security.alerts@cpa.texas.gov

RFP # 304-27-0833WS EAP and Related Svcs Page 13 of 42 and should CPA choose to do so, Successful Respondent shall cooperate fully with CPA and assume responsibility at its own expense for making personnel, resources, and systems access available to CPA and CPA’s authorized representative(s).

H. Insurance and Bonds

Successful Respondent represents and warrants that it shall obtain and maintain the following coverages throughout the Contract Term and that all coverages shall be with companies licensed in Texas with an “A” rating from A.M. Best Co.

authorized to provide the required coverages:

• Blanket Employee Dishonesty Bond or Employee Dishonesty Coverage under a liability insurance policy with a minimum $25,000 for each individual who will provide Services. A rider or endorsement shall name the Texas Comptroller of Public Accounts as loss payee or additional named insured under the respective bond or policy.

• Standard Workers Compensation Insurance covering all individuals who will provide Services.

• Commercial General Liability Insurance: $1,000,000 minimum each occurrence limit; $2,000,000 minimum aggregate limit.

• Professional Liability Insurance: $1,000,000 minimum each occurrence limit; $2,000,000 minimum aggregate limit.

All of the above policies and bonds shall contain endorsements prohibiting cancellation except upon thirty (30) calendar days’ prior written notice to CPA. Successful Respondent shall furnish proof to CPA of such coverage in the form of a Certificate of Insurance from Successful Respondent’s insurance carrier(s) indicating the required coverages. The certificate shall be addressed to CPA as the certificate holder. Successful Respondent shall submit proof of required insurance coverage within five (5) days after the Effective Date, and annually thereafter, via email, referencing the PO number, to the following address: contract.administration@cpa.texas.gov.

I. Criminal Background Investigation

1. Criminal Background Investigation by Successful Respondent. Prior to an Assigned Personnel commencing Services under the Contract, Successful Respondent shall conduct a criminal background investigation and provide written notice via email to CPA’s Criminal Investigation Division of any Assigned Personnel that have any felony criminal conviction(s). If any information for the Assigned Personnel changes during the Contract Term, Successful Respondent shall provide written notice via email to CPA’s Criminal Investigation Division no later than three (3) business days after Successful Respondent’s discovery of such changed information that relates to felony criminal conviction(s). Written notice to CPA’s Criminal Investigation Division shall be submitted to cid.analysts@cpa.texas.gov.

Successful Respondent’s exercise of due diligence in conducting the criminal background investigation shall include, at a minimum, the following: (1) compliance with Successful Respondent’s published policies and procedures for background and criminal conviction checks and (2) a comprehensive search of the public information portion of Texas Department of Public Safety criminal conviction database located at:

https://publicsite.dps.texas.gov/ConvictionNameSearch/. If Successful Respondent asserts that a search of the Texas Department of Public Safety criminal conviction database is not appropriate for a particular Assigned Personnel, Successful Respondent must provide written notice via email to CPA’s Criminal Investigation Division that explains the proposed alternate approach for conducting the criminal background investigation.

For purposes of this clause, “Assigned Personnel” includes, without limitation, all individuals provided by Successful Respondent under the contract resulting from this RFP who will or may (1) be assigned as lead or key personnel; (2) provide Services on-site at CPA’s premises; or (3) access CPA information resources, i.e., the procedures, equipment, and software that are employed, designed, built, operated, and maintained to collect, record, process, store, retrieve, display, and transmit information, and associated personnel including consultants and contractors. At CPA’s written request, Successful Respondent shall replace Assigned Personnel that has any felony criminal conviction(s).

Within five (5) business days of receipt of a written request by CPA’s Criminal Investigation Division during the Contract Term, Successful Respondent shall provide written notice to CPA’s Criminal Investigation Division of any Assigned Personnel that have any felony criminal conviction(s).

2. Criminal Background Investigation by CPA. At CPA’s discretion, CPA may conduct a criminal background investigation on Successful Respondent’s Assigned Personnel. Should any Assigned Personnel not be acceptable to CPA due to a finding of felony criminal conviction(s) as a result of the criminal background investigation, Successful Respondent shall replace such Assigned Personnel upon CPA’s written request or CPA may terminate the Contract.

3. Remedies. If CPA becomes aware that Successful Respondent provided false information, Successful Respondent fails to promptly notify CPA of changed information that related to felony criminal convictions, or Successful Respondents fails to replace Assigned Personnel as required by this Section, Successful Respondent shall be in breach mailto:contract.administration@cpa.texas.gov mailto:cid.analysts@cpa.texas.gov https://publicsite.dps.texas.gov/ConvictionNameSearch/

RFP # 304-27-0833WS EAP and Related Svcs Page 14 of 42 of contract and CPA shall have the option to terminate the Contract without further obligation to Successful Respondent as well as pursue all other remedies and rights available to CPA under contract, at law, or in equity.

J. Contract Term; Survival of Terms

The Initial Term of the Contract shall be from September 1, 2026 to August 31, 2027. CPA may, in its sole discretion, exercise the option to extend the Contract for up to three (3) additional, one (1) year periods. The optional additional periods are September 1, 2027, through August 31, 2028; September 1, 2028, through August 31, 2029; and September 1, 2029, through August 31, 2030. “Contract Term” means the Initial Term and any optional additional periods exercised. To exercise an option to extend the term, CPA will notify the Successful Respondent; such notice may be by PO issuance.

Termination of the Contract for any reason shall not release Successful Respondent from liability or obligation set forth in the Contract that is expressly stated to survive any such termination or by its nature would be intended to be applicable following any such termination, e.g., indemnification, confidentiality, dispute resolution, records retention, CPA data security terms, and right to audit.

K. Acceptance Criteria

Prior to payment, CPA will evaluate the provided products and/or Services using the following criteria and any additional acceptance criteria agreed to by the parties prior to the Award Date and included in the Contract:

1. The products and/or services must meet all specifications and standards of performance in the Contract; and

2. The products and/or services must comply with all published specifications.

L. Payments

Payment(s) to Successful Respondent will be based upon the schedule described in Section IV (Mandatory Price Sheet) and the Contract. CPA may, in its sole discretion, process payments on a monthly basis. CPA makes no express or implied warranty whatsoever that any minimum compensation or minimum quantity will be guaranteed under the Contract.

Payment shall be made in accordance with the Texas Prompt Payment Act, Chapter 2251 of the Texas Government Code (Chapter 2251) and Chapter 2251 shall govern remedies for late payment. Payments will be made to Successful Respondent as provided in Section V, Provision for Direct Deposit or Warrant.

M. Discounts

If Successful Respondent provides a discount on the final Contract costs at any time during the Contract Term, Successful Respondent will notify CPA in writing ten (10) calendar days before the effective date of the discount. CPA will generate a POCN and send it to Successful Respondent. If an early payment discount is available to CPA, then Respondent’s Proposal must describe the early payment discount offered and the discount percentage that would apply to CPA’s early payment within ten (10), fifteen (15), twenty (20) or twenty-five (25) calendar days after receipt of a correct invoice.

Successful Respondent shall also specify any applicable, early payment discount option(s) on each submitted invoice.

N. PO Addition and Deletion

CPA reserves the right, in its sole discretion, to add or delete products or Services during the Contract Term. All additions or deletions will be processed through CPA’s Procurement Section. The rate at the time of the addition or deletion shall be the same as the rate quoted in the Contract for the same model product or Service. The effective date of any addition or deletion will be no later than five (5) business days after receipt of CPA’s written notification of the addition or deletion.

For this purpose, written notification includes registered mail, regular mail, or email with confirmation receipt.

For any additions, CPA’s Procurement Section will provide a POCN to Successful Respondent. The total number of additions allowed to CPA is determined by the number CPA chooses to purchase. For any deletions, CPA’s Procurement Section will provide a POCN to Successful Respondent with the effective date of the deletion, the amount of the reduction or refund (if any), and the equipment serial number or other specific equipment information to identify equipment, if applicable.

O. VetHUB Subcontracting Plan Information

In accordance with Section 2161.252 of the Texas Government Code and 34 Texas Administrative Code §20.285, each state agency that considers entering into a contract with an expected value of $100,000 or more over the life of the contract (including any renewals) shall, before the agency solicits bids, proposals, offers, or other applicable expressions of interest, determine whether subcontracting opportunities are probable under the contract.