ESBD_File_318813_HHS0012857 - HeRDMOSS.pdf

PCS 550 HHS RFO RFO No. HHS0012857 Page 1 of 89 Version 2.0 (12/13/2022)

Cecile E. Young, Executive Commissioner

Request for Offers (RFO) for

Health Registries Development, Maintenance, Operations, and Support Services (HeRDMOSS)

RFO No. HHS0012857

Date of Release: March 10, 2023

Responses Due: April 10, 2023, by 10:30 a.m. Central Time

NIGP Class/Item Codes

920-14 *Applications Software, Mainframes & Servers

920-15 *Assessment and Profiling Services of Software

920-45 *Software Maintenance and Support Services

920-46 *Software Updating and Upgrading Services

920-66 *System, Network, Database, DBA Administration Services

972-55 Training, Non-State Employees

(*) Automated Information Systems (AIS)

PCS 550 HHS RFO RFO No. HHS0012857 Page 2 of 89

Contents Article I. Executive Summary, Definitions, and Authority

1.1 Executive Summary

1.2 Definitions

1.3 Authority

1.4 Proprietary Software

Article II. Scope of Work (SOW)

2.1 Description of Services

2.1.1 Overview of Health and Human Services Commission

2.1.2 Overview of Department of State Health Services

2.1.3 Overview of The Maven Platform

2.1.4 Overview of Maven Registries

2.1.5 Interpretive Conditions

2.2 Overview of Contract Project Phases

2.2.1 Contract Project Phases

2.2.2 Contract Phases, Domains, and Subdomains per Phase

2.2.3 Health Registries Domains and Associated Requirements

2.3 Contract Award, Term, and Historical Compensation

2.3.1 Contract Award and Execution

2.3.2 Contract Term

2.3.3 Contract Budget

2.3.4 Historical Compensation

2.4 Data Use Agreement and Security Privacy Inquiry

2.5 No Guarantee of Volume, Usage, or Compensation

Article III. Administrative Information

3.1 Schedule of Events

3.2 Ambiguity, Conflict, or Discrepancy

3.3 Inquiries

3.3.1 Sole Point of Contact

3.3.2 Prohibited Communication

3.3.3 Exception to Sole Point of Contact

3.3.4 Solicitation Questions

PCS 550 HHS RFO RFO No. HHS0012857 Page 3 of 89

3.4 Solicitation Response Composition

3.4.1 General Information

3.4.2 Page Limit and Supporting Documentation

3.4.3 Discrepancies

3.4.4 Exceptions

3.4.5 Assumptions

3.4.6 Binding Offer

3.5 Solicitation Response Submission and Delivery

3.5.1 Deadline

3.5.2 Submission Option

3.5.3 Submission Checklist

3.5.4 Labeling and Delivery for USB Submission and Other Materials

3.5.5 Modifications and Withdrawals

Article IV. Solicitation Response Evaluation and Award Process

4.1 Conformance with State Law

4.2 Best Value Determination

4.2.1 Selection Methodology

4.2.2 Minimum Qualifications

4.2.3 Initial Compliance Screening

4.2.4 Written Solicitation Response Evaluation

4.2.5 Written Response Evaluation Criteria

4.2.6 Best and Final Offer (BAFO)

4.2.7 Final Written Response Score

4.3 Questions or Requests for Clarification

Article V. Narrative/Technical Proposal

5.1 Narrative Proposal

5.1.1 Executive Summary

5.1.2 Project Management Plan

5.1.3 Project Organizational Chart and Key Staffing Profile

5.2 Technical Proposal

5.2.1 Domain Approach

PCS 550 HHS RFO RFO No. HHS0012857 Page 4 of 89

5.2.2 Subdomain Approach

5.2.3 Technology Architecture

5.2.4 System Availability and Capacity

5.2.5 Software and Hardware Components

5.2.6 System Integration

5.2.7 System Administration, Support, and Maintenance

5.2.8 System Security and Disaster Recovery

5.2.9 Performance Monitoring and Management

Article VI. Required Respondent Information

6.1 Company Information

6.1.1 Company Narrative

6.1.2 Company Profile

6.2 Authorization to Conduct Business in Texas

6.3 References

6.4 Major Subcontractor Information

6.5 Affirmations and Certifications

6.6 Other Reports

6.6.1 Dun and Bradstreet Reports

6.6.2 Financial Statements and Financial Solvency

6.6.3 Alternate Report

6.7 Corporate Guarantee

6.8 HUB Subcontracting Plan

Article VII. Cost Proposal

7.1 Cost Proposal

7.1.1 Cost Proposal Guidance

7.1.2 Supplemental Services

Article VIII. General Terms and Conditions

8.1 General Conditions

8.1.1 Changes, Modifications, and Cancellation

8.1.2 Offer Period

8.1.3 Costs Incurred

PCS 550 HHS RFO RFO No. HHS0012857 Page 5 of 89

8.1.4 Contract Responsibility

8.1.5 Public Information Act - Respondent Requirements Regarding Disclosure

8.1.6 Respondent Waiver – Intellectual Property

8.1.7 Standards of Conduct for Vendors

8.1.8 Disclosure of Interested Parties

8.2 Insurance

8.2.1 Required Coverage

8.2.2 Alternative Insurability

8.3 Bonds

8.4 Protest

Article IX. List of Exhibits

PCS 550 HHS RFO RFO No. HHS0012857 Page 6 of 89

TABLE OF TABLES

Table 1 - In-Scope Maven Registries Table 2 - Health Registries Service Domain Acronyms and Definitions Table 3 - Common Across All (CAA) Project Management Services (PMS) Requirements16 Table 4 - Common Across All (CAA) Contractor Personnel Assignment (CPA) Requirements Table 5 - Common Across All (CAA) Design, Development, and Implementation (DDI) Requirements Table 6 - Common Across All (CAA) Technical Management Services (TMS) Requirements Table 7 - Common Across All (CAA) Maintenance and Operation Services (MOS) Requirements Table 8 - Common Across All (CAA) Security and Compliance Services (SCS) Requirements Table 9 - Transition (TRA) Phase Requirements Table 10 - BLR Domain Requirements Table 11 - BDR Domain Requirements Table 12 - EMSTR Domain Requirements Table 13 - Turnover (TUR) Phase Domain Requirements Table 14 – HeRDMOSS Contract Term

PCS 550 HHS RFO RFO No. HHS0012857 Page 7 of 89

ARTICLE I. EXECUTIVE SUMMARY, DEFINITIONS, AND AUTHORITY

1.1 EXECUTIVE SUMMARY

The State of Texas, by and through the Texas Health and Human Services Commission (HHSC), for and on behalf of the Department of State Health Services (DSHS), issues this Request for Offers (RFO) to solicit a qualified Respondent to provide the Maven platform and associated operations, maintenance, and support services. The Maven platform is proprietary software owned by Conduent Public Health Solutions Inc. The qualified Respondent shall provide the Maven platform and software development, technical support, and maintenance services for the Texas Emergency Management Services and Trauma Health Registry (EMSTR), Birth Defect Registry (BDR), and Blood Lead Registry (BLR) (collectively referred to herein as “In-Scope Maven Registries”), in accordance with this Solicitation.

HHSC oversees operations of entire Health and Human Services System in Texas. The HHS System comprises two state agencies: HHSC and the Department of State Health Services (DSHS). Information regarding HHSC and its programs is available online and can currently be accessed at https://www.hhs.texas.gov.

Information regarding Department of State Health Services (DSHS) and its programs is available online and can currently be accessed at: http://www.dshs.texas.gov/.

HHSC PCS will administer the procurement process for this Solicitation and will manage Respondent communications as well as the receipt of Solicitation Responses for review and evaluation.

To be considered for award, a Respondent must execute Exhibit A, HHS Solicitation Affirmations Version 2.3 and provide all other required information and documentation as set forth in this Solicitation.

1.2 DEFINITIONS

As used in this Solicitation, unless a different definition is specified or the context clearly indicates otherwise, the following terms and conditions have the meanings assigned below.

Refer to Exhibit B, Health and Human Services (HHS) Uniform Terms and Conditions (UTC) – Vendor Version 3.3 and Exhibit M, Health Registries Process Guide v.4.0 for additional definitions.

“Addendum” means a written clarification or revision to this Solicitation posted to the

ESBD.

“Advancement Criteria” means the published criteria for Respondent to advance to the next phase of evaluation if multiple evaluation methods are utilized.

https://www.hhs.texas.gov/ http://www.dshs.texas.gov/

PCS 550 HHS RFO RFO No. HHS0012857 Page 8 of 89

“Award Consideration (AC) Documents” means documents Respondent must submit as part of the Solicitation Response to be considered for negotiations or award.

“Business Day” means any day (24-hour period) in which normal business operations of the System Agency are conducted (e.g., excludes weekends and the national holidays specified in Section 662.003(a) of the Texas Government Code).

“Business Hours” is defined as the hours from 8:00 a.m. through 5:00 p.m. Central Time on Business Days.

“Calendar Day” is each day shown on the calendar beginning at 12:00 Midnight, including Saturdays, Sundays, and holidays.

“Competitive Range” has the same meaning as the definition under Title 1 of the Texas Administrative Code Part 15, Chapter 391, Subchapter A, Rule §391.107(3).

“Contract Term” means the period of time beginning with the commencement date or Contract Effective Date and ending when the Contract expires in accordance with its terms, or when it has been terminated.

“Contractor” means the Respondent awarded a Contract pursuant to this Solicitation. See also the definition of Contractor in Exhibit B, Health and Human Services (HHS) Uniform Terms and Conditions (UTC) – Vendor, Version 3.3.

“Contractor Personnel” means Contractor project personnel who have the knowledge, experience, and capability to manage and deliver Contract resource planning, management, and oversight Services and Deliverables for the In-Scope Maven Registries.

“Effective Date” has the same meaning as the definition in Exhibit B, Health and Human Services (HHS) Uniform Terms and Conditions (UTC) – Vendor, Version 3.3.

“ESBD” means the Electronic State Business Daily, an online directory where State of Texas solicitations over $25,000 are posted. The ESBD may currently be accessed at http://www.txsmartbuy.com/esbd.

“Final Written Response Score” refers to the final scoring of the written response as documented in the Solicitation.

“Frew Lawsuit” or “Frew” – Frew, et al. v. Young, et al. (commonly referred to as Frew) was filed in 1993 and was brought on behalf of children under age 21 enrolled in Medicaid and eligible for Early and Periodic Screening, Diagnostic, and Treatment (EPSDT) benefits. The class action lawsuit alleged that the Texas EPSDT program did not meet the requirements of the Federal Medicaid act. In Texas, EPSDT is called Texas Health Steps.

The lawsuit was settled by a consent decree in 1996. The decree requires numerous State obligations and is monitored by the court. In 2007, the parties agreed to eleven corrective action orders to bring the State into compliance with the consent decree and to increase access to EPSDT benefits.

“Health and Human Services Commission” or “HHSC” has the same meaning as the definition in Exhibit B, Health and Human Services (HHS) Uniform Terms and Conditions (UTC) – Vendor, Version 3.3.

“HHSC PCS” means Procurement and Contracting Services (PCS), a division of HHSC.

https://statutes.capitol.texas.gov/Docs/GV/htm/GV.662.htm#:%7E:text=Sec.-,662.003.,-DATES%20AND%20DESCRIPTIONS https://texreg.sos.state.tx.us/public/readtac$ext.TacPage?sl=R&app=9&p_dir=&p_rloc=&p_tloc=&p_ploc=&pg=1&p_tac=&ti=1&pt=15&ch=391&rl=107 http://www.txsmartbuy.com/esbd

PCS 550 HHS RFO RFO No. HHS0012857 Page 9 of 89

“Key Performance Measures” or “KPM” means measurable value that demonstrates how effectively a company is achieving key business objectives.

“Registry Decommission” means withdraw of one (1) or more of the Maven software registries from the Maven platform.

“Respondent” means the individual or entity responding to this Solicitation.

“Solicitation” means this RFO including all Exhibits, Addenda, or Addendums.

“Solicitation Consideration (SC) Documents” means documents that must be submitted by Respondent with the Solicitation Response in order to be considered for evaluation and cannot be resubmitted or have errors remedied after the submission due date and time in the Schedule of Events has passed.

“State” means the State of Texas and its instrumentalities, including HHSC or DSHS, and any other state agency, its officers, employees, or authorized agents.

“System Agency” has the same meaning as the definition in Exhibit B, Health and Human Services (HHS) Uniform Terms and Conditions (UTC) – Vendor, Version 3.3.

“Transition” refers to the period of time between the Contract Effective Date and the beginning of operations during which activities are performed by the Contractor to prepare systems and resources for operations, including merging and transferring data, logistical arrangements and security protocols for the Contractor’s personnel and the development of the finalized Transition Project Work Plan with an accompanying Project Management Plan.

“VPTS” means Vendor Performance Tracking System as defined under Section 2262.055 of the Texas Government Code and Title 34 of the Texas Administrative Code Part 1, Chapter 20, Subchapter B, Division 2, Rule §20.115 and Subchapter F, Division 2, Rule §20.509.

1.3 AUTHORITY

HHSC issues this Solicitation under the authority of Texas Government Code §§ 2157.068(e-1); 2157.006(a)(2); and 2155.067.

1.4 PROPRIETARY SOFTWARE

The System Agency believes that the requested items in this Request for Offers may be proprietary to one (1) vendor under Section 2155.067 of the Texas Government Code;

however, the issuing office strongly encourages offers from qualified respondents that may be able to provide the requested items.

https://statutes.capitol.texas.gov/Docs/GV/htm/GV.2262.htm#2262.055 https://texreg.sos.state.tx.us/public/readtac$ext.TacPage?sl=R&app=9&p_dir=&p_rloc=&p_tloc=&p_ploc=&pg=1&p_tac=&ti=34&pt=1&ch=20&rl=115 https://texreg.sos.state.tx.us/public/readtac$ext.TacPage?sl=R&app=9&p_dir=&p_rloc=&p_tloc=&p_ploc=&pg=1&p_tac=&ti=34&pt=1&ch=20&rl=509 https://statutes.capitol.texas.gov/Docs/GV/htm/GV.2157.htm#:%7E:text=e%2D1)%20%20Except%20as%20provided%20by%20Subsection%20(e%2D4)%2C%20a%20state%20agency%20contracting%20to%20purchase%20a%20commodity%20item%20shall%20use%20the%20list%20maintained%20as%20required%20by%20Subsection%20(e)%20as%20follows%3A https://statutes.capitol.texas.gov/Docs/GV/htm/GV.2157.htm#:%7E:text=(2)%20%20a%20purchasing%20method%20designated%20by%20the%20comptroller%20to%20obtain%20the%20best%20value%20for%20the%20state%2C%20including%20a%20request%20for%20offers%20method.

https://statutes.capitol.texas.gov/Docs/GV/htm/GV.2155.htm#:%7E:text=Sec.%202155.067.%20%20PROPRIETARY%20PURCHASES.

https://statutes.capitol.texas.gov/Docs/GV/htm/GV.2155.htm#:%7E:text=September%201%2C%202019.-,Sec.%202155.067.,-PROPRIETARY%20PURCHASES.%20%20(a

PCS 550 HHS RFO RFO No. HHS0012857 Page 10 of 89

ARTICLE II. SCOPE OF WORK

2.1 DESCRIPTION OF SERVICES

2.1.1 Overview of Health and Human Services Commission

The System Agency manages programs that help families with food, health care, safety, and disaster services including the Women, Infants, and Children (WIC) program, Children’s Medicaid, and Supplemental Nutritional Assistance programs (SNAP). The System Agency offers resources and administers an eco-system associated with the following programs:

a. Health care, such as Texas Medicaid and the Children’s Health Insurance Program

(CHIP);

b. SNAP Food Benefits, which assists with food purchases;

c. Temporary Assistance for Needy Families (TANF) Cash Help, providing cash payments to aid families with food, clothing, housing, and other essentials;

d. Community programs like Community Attendant Services (CAS) and Health

Coordination and Consumer Services;

e. Texas Women’s Health Program provides low-income women family-planning services, health screenings, and birth control;

f. 2-1-1 Texas program, connects individuals with various community services and programs;

g. Licensing and credentialing of long-term care facilities, such as nursing homes and assisted living facilities;

h. Licensing childcare providers; and

i. Managing the day-to-day operations of state supported living centers and state hospitals.

2.1.2 Overview of Department of State Health Services

The System Agency has been created to sharpen the focus on public health in Texas. At a high level the System Agency exists to promote and protect the health of people, and the communities where they live, learn, work, worship, and play. The System Agency offers resources and administers an eco-system associated with the following programs:

a. Birth, death, marriage, and divorce record;

b. Consumer protection;

c. Data and surveillance associated with health-related issues;

d. Emergency Preparedness and Response;

e. Health and wellness;

f. Infectious disease control;

PCS 550 HHS RFO RFO No. HHS0012857 Page 11 of 89

g. Laboratory management; and

h. Local public health support.

2.1.3 Overview of The Maven Platform

The Maven platform is a commercial-off-the shelf (COTS), web-based business rules engine. It provides interactive, automated information gathering and decision support processes for each reportable communicable disease and occupational disease.

The Maven platform allows public health officials to enter, manage, process, track and analyze data for disease exposure events. The Maven platform allows for secure communication and coordination between State and local health departments. In addition, the Maven platform enables the immediate exchange of information between clinics, labs, and local health departments. The Maven platform security environment displays only the data a user needs and is authorized to see. Through data analysis, the Maven platform can then extract surveillance data for the identification of a possible public health/environmental emergency. Additional Maven platform functions include:

a. Electronic data exchange and flow of work among groups working on public health;

b. Disease management;

c. Ability for lab reports to be imported electronically;

d. Data entry capability;

e. Reporting; and

f. Case management, contact-tracing, and outbreak management.

2.1.4 Overview of Maven Registries

The System Agency has leveraged the Maven platform over the past 10 years to enable and instantiate the following five (5) Maven Registries:

a. EMS and Trauma Registries (EMSTR);

b. Birth Defect Registry (BDR);

c. Blood Lead Registry (BLR);

d. Texas Healthcare Safety Network Registry (TxHSN); and

e. TB-HIV-STD Integrated System Registry (THISIS).

PCS 550 HHS RFO RFO No. HHS0012857 Page 12 of 89

This RFO will only address the following three (3) In-Scope Maven Registries in Table 1 - In-Scope Maven Registries.

Table 1 - In-Scope Maven Registries

Registry

ID

Registry Name Registry Description

EMSTR Emergency Management Services and

Trauma

The EMSTR are made up of five (5) subdivisions:

a. EMS;

b. Traumatic Brain Injury;

c. Spinal Cord Injury;

d. Submersion; and

e. other acute Traumatic Injury.

The EMSTR is a statewide passive surveillance system that collects reportable event data from EMS providers, hospitals, Justices of the Peace, Medical Examiners, and rehabilitation facilities. Texas is home to one of the largest EMS registries in the United States with more than 4 million EMS data entries received annually.

BDR Birth Defect Registry

The BDR collects, manages, analyzes, and disseminates population-based data on the occurrence of birth defects in Texas. This data is then used to identify and describe the patterns of birth defects in Texas for epidemiological studies on birth defects, and to conduct cluster investigations and family outreach initiatives. Through multiple sources of information, the program monitors all births in Texas (approximately 380,000 each year based on five-year average) and identifies cases of birth defects.

BLR Blood Lead Registry

The BLR supports and maintains a surveillance system of all blood lead test results for individuals in Texas. Each year, thousands of Texans are identified with blood lead levels above the reference level set by the Centers for Disease Control and Prevention (CDC). Even low levels of lead, a neurotoxin, can cause adverse health effects in children and adults. The Blood Lead program works to prevent lead exposure through education and the promotion of safe homes and workplaces. The program also promotes early detection of lead exposure and provides follow up for children with elevated blood lead levels. Through these activities, the program remains committed to preventing new cases of lead poisoning and safeguarding the health of families in Texas.

PCS 550 HHS RFO RFO No. HHS0012857 Page 13 of 89

2.1.5 Interpretive Conditions

Whenever the terms "shall", "will", "must", "needs to", "responsible for" or “is required” are used in conjunction with a specification or performance requirement, the specification or requirement is mandatory. The Respondent’s failure to address or accept any requirement in their Solicitation Response may be cause for the System Agency’s rejection of the Solicitation Response.

2.2 OVERVIEW OF CONTRACT PROJECT PHASES

The following sub-sections of Section 2.2 (Overview of Contract Project Phases), delineate the requirements that are applicable to the three (3) In-Scope Maven Registries.

The requirements are associated with the following three (3) Contract Project Phases:

a. Phase I – Transition Phase (“Transition/TRA”)

b. Phase II – Registry Operations Phase (“Operations/ROP”)

c. Phase III – Turnover Phase (“Turnover/TUR”)

2.2.1 Contract Project Phases

a. Phase I – Transition Phase Transition activities include, but are not limited to, logistical arrangements and security protocols for Contractor’s Personnel and the development of the finalized Transition Project Work Plan with an accompanying Project Management Plan.

The Contractor’s primary obligations for Phase I - Transition Phase include, but are not limited to, the following:

1. Provide Services for Transition Phase. Refer to Section 2.2.3.8 (Transition

Phase);

2. Acquire access to System Agency facilities and resources required to perform the work;

3. Establish a project management presence as referenced in Table 3 - Common

Across All (CAA) Project Management Services (PMS) Requirements, including the development of project management deliverables;

4. Onboard Contractor Personnel;

5. Complete knowledge transfer activities with incumbent service provider (if required and as outlined in Section 2.2.3.8 (Transition Phase);

6. Coordinate with the System Agency for operational readiness; and

7. Complete all Transition activities and deliver a Readiness Assessment Results

Report.

8. The Contractor will provide all plans, processes, and procedures for approval by the System Agency. All work product and Deliverables shall be accessible throughout the life of the Contract and following Contract termination, stored in an agreed upon repository that is fully accessible by the System Agency and the

PCS 550 HHS RFO RFO No. HHS0012857 Page 14 of 89

Contractor. The Contractor’s plans, processes, and procedures shall be consistent with the System Agency’s required plans, procedures, and reporting for the following areas:

i. Data storage, access, security policies, and procedures;

ii. Disaster recovery, including plans for business continuity and contingency capability;

iii. Quality measurement and reporting;

iv. Ongoing service delivery performance monitoring and improvement; and

v. Operational status reporting.

b. Phase II – Registry Operations Phase The Registry Operations Phase will begin immediately after Transition activities are completed and approved by the System Agency and continue throughout the life of the Contract (refer to Section 2.3.2 (Contract Term)). The Operation Phase start date is the date of the first day of operations following the successful completion of the Transition Phase.

Contractor shall perform all specific Services for day-to-day operations and availability of the In-Scope Maven Registries as stated in the requirements of the Contract, including the following:

1. Providing Services for all domains (as identified and described in Section 2.2.2, Contract Phases, Domains, and Subdomains per Phase), and associated requirements within the SOW;

2. Adhering to the System Agency coding, testing, and agile methodology standards;

3. Producing standardized, scheduled reports, in addition to ad hoc reports;

4. Working with the System Agency to plan and execute ongoing initiatives to improve In-Scope Maven Registries as needed by the System Agency;

5. Supporting operations and coordinating with the System Agency on any modifications to existing applications;

6. Quality measurement and reporting;

7. Ongoing service delivery performance monitoring and improvement, including

KPM compliance; and

8. Required reporting (reporting as detailed in Exhibit M, Health Registries

Process Guide V4.0, by Contractor under the Contract.

c. Phase III – Turnover Phase Turnover begins six (6) months prior to the end of the Contract Term, including any approved option periods. Turnover includes the administrative and operations activities performed by the Contractor to turnover operations to either the System Agency or a designated successor service provider to ensure that the System Agency and its

PCS 550 HHS RFO RFO No. HHS0012857 Page 15 of 89 stakeholders do not experience any adverse impact from the transfer from the Contractor to either the System Agency or a designated successor service provider.

1. Contractor shall be responsible for providing Services for the Turnover Phase;

2. Turnover includes the administrative and operational activities performed by the

Contractor to Transition operations to either the System Agency or a designated service provider;

3. Turnover tasks must be planned and coordinated with the System Agency or a designated successor service provider to ensure the System Agency and In-scope Maven Registries clients do not experience any adverse impact from the Turnover;

4. Turnover activities must be completed according to the System Agency approved Turnover Plan;

5. The Contractor will be responsible for completion of all non-Turnover Phase Deliverables as detailed in Exhibit M, Health Registries Process Guide V.4.0 prior to the Turnover Phase; and

6. Complete all Turnover activities and deliver a Turnover Results Report as detailed in Exhibit M, Health Registries Process Guide V.4.0.

2.2.2 Contract Phases, Domains, and Subdomains per Phase

The Contract Phases above will consist of domains and subdomains per phase. Services and Deliverables that are common across all domains are identified below in Table 2, which identification longitudinally addresses requirements across the Contract Project Phases.

The following Table 2 - Health Registries Service Domain Acronyms and Definitions delineates the Registries Service Domains and corresponding descriptions.

Table 2 - Health Registries Service Domain Acronyms and Definitions

Phase Service Domain Acronym Subcategory Acronym

I Transition Phase TRA None

II Registry Operations Phase ROP a. Blood Lead Registry (BLR)

b. Birth Defect Registry (BDR)

c. Emergency Management System

(EMS) and Trauma (TR) Registry

(EMSTR)

III Turnover Phase TUR None

I, II,

and

III

Common Across All

Service Domains

CAA a. Project Management Services (PMS)

b. Contractor Personnel Assignment

(CPA)

c. Design, Development, and

Implementation (DDI)

PCS 550 HHS RFO RFO No. HHS0012857 Page 16 of 89

Table 2 - Health Registries Service Domain Acronyms and Definitions

Phase Service Domain Acronym Subcategory Acronym

d. Technical Management Services

(TMS)

e. Maintenance and Operations Services

(MOS)

f. Security and Compliance Services

(SCS)

2.2.3 Health Registries Domains and Associated Requirements

As indicated in Section 2.2.2 (Contract Phases, Domains, and Subdomains per Phase), the System Agency has allocated requirements that have commonality across In-Scope Maven Registries, requirements that are unique to each In-Scope Maven Registry, and requirements necessary throughout the life of the Contract. The following sections will delineate the scope of those requirements.

2.2.3.1 Common Across All (CAA) Phases and Domain Requirements The In-Scope Maven Registries have commonality with each other. Each In-Scope Maven Registry has software licensing with unique application versions, specified licensed users, and functional workflow description.

Refer to the Exhibit M, Health Registries Process Guide V.4.0, for further detail to incorporate into the Solicitation Response.

2.2.3.2 Project Management Services (PMS) Subdomain

Contractor, in coordination with the System Agency’s approval, is required to provide a clearly defined project management methodology to manage the Contract Project Phases, Deliverables, schedule, communication methods, and processes along with tracking In- Scope Maven Registries issues, risks, decisions, and actions. Project monitoring, control, and status reporting methods are part and parcel of the Contractor’s Contract obligations.

During the Transition Phase and Turnover Phase, the Contractor will be required to complete delivery of all the Project Management Plans (PMP) as defined in Exhibit M, Health Registries Process Guide V.4.0.

See Table 3 - Common Across All (CAA) Project Management Services (PMS) Requirements.

Table 3 - Common Across All (CAA) Project Management Services (PMS) Requirements

Req ID Requirement CAA-PMS-01 Contractor shall provide a full-time dedicated project manager to manage Contractor operations and obligations under the Contract.

CAA-PMS-02 Contractor shall comply with the requirements of all System Agency approved deliverables referenced in this RFO.

PCS 550 HHS RFO RFO No. HHS0012857 Page 17 of 89

Table 3 - Common Across All (CAA) Project Management Services (PMS) Requirements

Req ID Requirement CAA-PMS-03 Contractor shall define, manage, and ensure completion of all Contract

Project tasks, Deliverables, technical specifications, risks, and issues.

Contractor shall manage the delivery of Services throughout the life of the Contract in coordination with the System Agency’s approval. This includes, but is not limited to, the following:

a. Provide day-to-day management of Contract Projects including overall Contractor performance, Contract compliance and Project status updates based on State approved frequency and schedule;

b. Manage current work plans and coordinate availability of scheduled resources to the Project;

c. Manage all Contractor resources and ensure appropriate resources are available throughout the life of the Contract;

d. Establish and maintain communication as per the approved Communication Plan;

e. Maintain status reporting, budget/cost reporting, and issue reporting, tracking, escalation, and resolution procedures;

f. Manage and internally review the Contractor’s invoices and Deliverables for conformance with Contract requirements; and

g. Provide timely submission of Contract Deliverables and Services.

Refer to Exhibit M, Health Registries Process Guide V.4.0 for further details.

CAA-PMS-04 Contractor shall use the System Agency approved tools for Project Management throughout the life of the Contract.

CAA-PMS-05 Contractor shall log all risks and mitigation strategies associated with the delivery of the Services in the System Agency approved electronic/application tools including the following:

a. Risks and mitigation strategies associated with the delivery of

Services;

b. Service delivery issues and issue resolution strategies in the State approved issue tracking system;

c. Risk and mitigation strategies associated with the delivery of

Services in the State-approved risk management system; and

d. The Contractor repository shall sync with the System Agency owned repository within a timetable agreed upon by the Parties following Contract kick-off meeting and pursuant to a System Agency approved repository sync schedule.

PCS 550 HHS RFO RFO No. HHS0012857 Page 18 of 89

Table 3 - Common Across All (CAA) Project Management Services (PMS) Requirements

Req ID Requirement CAA-PMS-06 Contractor shall provide real-time updates to the System Agency’s approved risk and issue tracking systems including the following:

a. Risk and mitigation plans; and

b. Pending issues and corrective action plans to resolve the issues.

CAA-PMS-07 Contractor shall adhere to and report compliance with all Key Performance Measures. Refer to Exhibit G, Key Performance Measures (KPMs) and Liquidated Damages.

CAA-PMS-08 Contractor shall recommend to the System Agency, continuous process improvement and efficiencies for the System Agency’s approved processes identified in Exhibit M, Health Registries Process Guide V.4.0.

CAA-PMS-09 Contractor shall provide electronic content and update the content as necessary in, the System Agency’s approved repository to reflect In- Scope Maven Registries requirements, test cases and acceptance criteria detail.

CAA-PMS-010 Contractor shall improve In-Scope Maven Registries development and management through the continuous improvement of processes, productivity, increased code maintainability, and reusability.

CAA-PMS-011 Contractor shall mitigate risk associated with the operation of In-Scope Maven Registries to the System Agency, the System Agency ‘s clients, the System Agency ‘s end-users, and State taxpayers.

CAA-PMS-012 Contractor shall train Contractor Personnel regarding the System Agency’s processes, methods and principles prior to assigning Contractor Personnel to perform work. Contractor is required to provide all training services for its personnel to effectively develop and maintain the Registries. Training must include, but not be limited to:

a. The current System Agency processes refer to Exhibit M, Health

Registries Process Guide V.4.0;

b. The System Agency’s required training, (e.g., IT Security;

Protected Health Information (PHI) compliance; Health Insurance Portability and Accountability Act (HIPAA) compliance; and HHS Authorized User Agreement compliance.

2.2.3.3 Contractor Personnel Assignment (CPA) Subdomain

Contractor shall provide the System Agency with Contractor project personnel (Contractor Personnel) who have the knowledge, experience, and capability to manage and deliver

PCS 550 HHS RFO RFO No. HHS0012857 Page 19 of 89

Contractor resource planning, management, and oversight Services and Deliverables for the In-Scope Maven Registries, as identified below in Table 4 - Common Across All (CAA) Contractor Personnel Assignment (CPA) Requirements.

Table 4 - Common Across All (CAA) Contractor Personnel Assignment (CPA) Requirements

Req ID Requirement CAA-CPA-01 Contractor shall supply a written personnel background check attestation which shall act to confirm that Contractor, or its designee, conducted a background check for Contractor Personnel prior to any Contractor Personnel securing access to sensitive or confidential client data contained in any System Agency system accessed throughout the life of the Contract.

CAA-CPA-02 Contractor shall provide 24 x 7 x 365 support and response times will be aligned with the requirements detailed for incident support and escalation matrix for severity support as documented in Exhibit M, Health Registries Process Guide V.4.0 and Exhibit G, Key Performance Measures (KPMs) and Liquidated Damages.

CAA-CPA-03 Contractor shall come on-site to the System Agency ‘s designated Austin, TX location for testing, deployment, issue resolution and training for the In-Scope Maven Registries upon request by the System Agency.

CAA-CPA-04 Contractor shall assist in troubleshooting Maven platform application issues (i.e., providing application logs for the System Agency to review).

CAA-CPA-05 Contractor shall ensure that the PII/PHI (Personal Identifying Information/Protected Health Information), or other sensitive or confidential information is securely managed in accordance with the System Agency’s security requirements within Exhibit D, Data Use Agreement (DUA) Version 8.5.

CAA-CPA-06 Contractor shall consult with the System Agency regarding unacceptable Contractor Personnel, remove and replace any personnel deemed unacceptable by the System Agency, at its sole discretion, within fourteen (14) Calendar Days of notification. Replacement personnel must have equal to, or greater qualifications relative to personnel being replaced - as determined by the System Agency at its sole discretion. Replacement personnel are subject to System Agency approval prior to any assignment.

CAA-CPA-07 Contractor shall comply with System Agency’s request to replace Contractor Personnel completely or temporarily in order to focus on critical activities as needed (i.e., temporary absence of Contractor Personnel).

PCS 550 HHS RFO RFO No. HHS0012857 Page 20 of 89

Table 4 - Common Across All (CAA) Contractor Personnel Assignment (CPA) Requirements

Req ID Requirement CAA-CPA-08 Contractor shall notify the System Agency prior to or within five (5)

Business Days after termination or resignation of any Contractor Personnel throughout the life of the Contract.

CAA-CPA-09 Contractor shall provide an updated organization chart when Contractor Personnel changes within sixty (60) Calendar Days of the change.

CAA-CPA-010 Contractor shall provide résumés and references for the System Agency’s review and approval within fourteen (14) Calendar Days of notification of resignation for replacement of any Contractor Personnel during Design, Development, and Implementation (DDI) and Technical Management Services (TMS) projects.

CAA-CPA-011 Contractor shall respond to escalation procedures based on severity levels, which are defined and jointly agreed to with the System Agency, as defined in the Exhibit M, Health Registries Process Guide V.4.0.

CAA-CPA-012 Contractor shall provide a proposed organizational structure for each Contract project, team roles, and assignment of Contractor Personnel to effectively meet the requirements for implementing Contract projects.

CAA-CPA-013 Contractor shall provide the System Agency with support for all State audit information requests by assisting with research and analysis within State-mandated timeframes.

CAA-CPA-014 Contractor shall create, update, maintain, and provide to the System Agency within ten (10) Calendar Days of request by the System Agency, plans and reports, including but not limited to, the following (see Exhibit M, Health Registries Process Guide V.4.0):

a. Transition Phase Deliverables:

1. Transition Project Work Plan;

2. Transition Weekly Status Report;

3. Readiness Assessment Plan; and

4. Readiness Assessment Results Report.

b. Project Management Deliverables:

1. Project Management Plan;

2. Risk Management Plan;

3. Change Management Plan;

4. Performance and Quality Management Plan;

5. Software Specification and Guidelines;

PCS 550 HHS RFO RFO No. HHS0012857 Page 21 of 89

Table 4 - Common Across All (CAA) Contractor Personnel Assignment (CPA) Requirements

Req ID Requirement

6. Support and Maintenance Plan;

7. Test Management Plan; and

8. Project Work Plan.

c. Design, Development, and Implementation/Software and Maintenance Services Deliverables:

1. Monthly Status Report;

2. Microsoft Project Plan;

3. System Documentation Updated for the Release; and

4. DDI/TMS Test Plan.

d. Turnover Deliverables:

1. Turnover Plan; and

2. Turnover Results Report.

e. Maintenance Service Levels For the foregoing Deliverable information, refer to Exhibit M, Health Registries Process Guide V.4.0.

CAA-CPA-015 Contractor and the System Agency shall commence discovery sessions on detailed Maven requirements and design for Contract Projects ten

(10) Business Days following the Contract kickoff meeting (after Contract execution). Refer to Exhibit M, Health Registries Process Guide V.4.0.

CAA-CPA-016 Contractor shall assign Supplemental Services Contractor Personnel who will work onsite at the System Agency and provide updates to the System Agency IT Project Manager or their designee for the life of the Contract.

CAA-CPA-017 Contractor shall track Supplemental Services (refer to Section 7.1.2, Supplement Services for service details) Contractor Personnel time spent for all Contract supplement service projects by the In-Scope Maven Registry and by Deliverables, for each domain/subdomain (as applicable), which can be represented by Project ID or Deliverable ID, or Service Request ID. This information will be required in the invoice reporting associated Supplemental Services.

CAA-CPA-018 Contractor shall provide one (1) software developer with a minimum of four years’ experience with Maven.

PCS 550 HHS RFO RFO No. HHS0012857 Page 22 of 89

CAA-CPA-019 Contractor shall have a maximum fixed amount of 160 hours per month, per In-Scope Maven Registries, for Supplemental Service (Refer to Exhibit J, Cost Proposal) Contractor Personnel hours throughout the life of the Contract.

2.2.3.4 Design, Development, and Implementation (DDI) Subdomain The DDI subdomain requirements identified below in Table 5 - Common Across All (CAA) Design, Development, and Implementation (DDI) Requirements shall be requested by the System Agency at its sole discretion. Contractor shall provide these DDI services as requested by the System Agency. The DDI services entail making modifications and recommending modifications to Maven in support of the detailed requirements outlined in Section 2.2.3.9 (In-Scope Maven Registries Operational Phase (ROP) Domain Requirements).

Table 5 - Common Across All (CAA) Design, Development, and Implementation

(DDI) Requirements Req ID Requirements

CAA-DDI-01 Contractor shall engage with authorized System Agency staff and other System Agency end-users through observation and design sessions to better understand workflows and opportunities to improve the System Agency’s end-user experience. Refer to Exhibit M, Health Registries Process Guide V.4.0.

CAA-DDI-02 Contractor shall provide integration and release management approach to Transition releases and updates from the Contractor’s DEV, TEST, STAGING, and PROD environments to the System Agency’s electronic environment, DEV, TEST, STAGING and PROD environment. Refer to Exhibit M, Health Registries Process Guide V.4.0.

CAA-DDI-03 Contractor shall provide to the System Agency any scripts, support documentation, and release notes at the time the Maven platform updates are delivered. Refer to Exhibit M, Health Registries Process Guide V.4.0.

CAA-DDI-04 Contractor shall integrate Contractor’s release management process with the System Agency’s release management process and authorized third party vendors where the processes interact, and with other service management processes, including incident, change, configuration, release and program management that delineates at a minimum six (6) months downstream Maven releases. Refer to Exhibit M, Health Registries Process Guide V.4.0.

CAA-DDI-05 Contractor shall facilitate, collaborate, and communicate any updates with respect to the Maven platform bug-fixes in a manner that adheres to the overall Release Management Process as delineated in Exhibit M, Health Registries Process Guide V.4.0.

PCS 550 HHS RFO RFO No. HHS0012857 Page 23 of 89

Table 5 - Common Across All (CAA) Design, Development, and Implementation (DDI) Requirements

Req ID Requirements

CAA-DDI-06 Contractor shall record all Integration and Release Support defects in the System Agency’s approved defect tracking systems.

CAA-DDI-07 Contractor shall adhere to the System Agency’s approved System Agency Test Management Plan. For a current example refer to Exhibit M, Health Registries Process Guide V.4.0.

CAA-DDI-08 Contractor shall adhere to the System Agency’s required software testing protocols, to ensure the delivery of high-quality Maven software. The testing protocols must include the following software test components (refer to Exhibit M, Health Registries Process Guide V.4.0):

a. Manual and automated unit testing to validate application code changes;

b. Manual and automated application integration testing to validate code changes made by multiple Contractor developer teams to ensure no issues with Maven update integration testing or release;

c. Collaborate with the System Agency to conduct manual and automated Systems Integration Testing to validate integration between Maven and other supporting systems;

d. Automated integrated load and stress testing to validate the performance of Maven;

e. Automated build validation testing to confirm the integrity of Maven after each build;

f. Manual and automated Maven regression testing to validate pre-existing functionality is not adversely impacted by code changes within a Development Cycle;

g. Reporting on the outcomes of all types of Maven testing activities;

h. Provide analysis and code fix, if needed, to resolve any Maven testing issues; and

i. Assist in deploying fully tested software supporting Maven.

CAA-DDI-09 Contractor shall develop, enhance, and maintain automated build and deployment scripts for efficient Maven platform software deployment and configuration. These automated build and deployment scripts must be Texas Department of Information Resources Data Center Services (DCS) environment agnostic (refer to Exhibit N, SERVICE MANAGEMENT MANUAL Enterprise Policies DCS RFO Language).

PCS 550 HHS RFO RFO No. HHS0012857 Page 24 of 89

Table 5 - Common Across All (CAA) Design, Development, and Implementation (DDI) Requirements

Req ID Requirements

CAA-DDI-010 Contractor shall establish and maintain a Development (DEV) environment that mirrors the Austin Data Center (ADC) State Development environment. Refer to Exhibit M, Health Registries Process Guide V.4.0 for details.

CAA-DDI-011 Contractor shall participate in and assist the System Agency with troubleshooting build and deployment issues as required in Exhibit M, Health Registries Process Guide V.4.0.

CAA-DDI-012 Contractor shall adhere to all agreed upon Contract Project schedules;

Contractor will provide Build, Test, and Deploy Services as requested by the System Agency within System Agency approved timelines. Refer to Exhibit M, Health Registries Process Guide V.4.0, and Exhibit G, Key Performance Measures (KPMs) and Liquidated Damages.

CAA-DDI-013 Contractor shall identify, track, and maintain maintenance Change Requests in the System Agency approved ITSM tool and provide the System Agency with up-to-date information on any resulting impact to Maven.

CAA-DDI-014 Contractor shall adhere to existing System Agency approved processes and procedures for triaging, escalating, and implementing project change requests. Refer to Exhibit M, Health Registries Process Guide V.4.0.

CAA-DDI-015 Contractor shall develop and establish a detailed High-Level Estimate (HLE) for newly identified projects that entail the fulfillment of complex requests, requiring design, solution, and proposals, including communications to set expectations and promote customer service acceptable to the System Agency. At a minimum the following will be adhered to:

a. The System Agency and Contractor will, following agreement on the

HLE, provide a timeline for the detailed estimate, that includes a delivery by date/time, review date/time, and acceptance date/time to be provided to the System Agency for the System Agency’s review and approval.

b. The detailed estimate will be a non-binding estimate until agreement on timeline, resources and budget are agreed to by the Parties.

c. If the HLE will result in an increase in the Contract not-to-exceed amount, then the agreement must be placed in a Contract amendment executed by both Parties.

Refer to Exhibit G, Key Performance Measures (KPMs) and Liquidated Damages.

PCS 550 HHS RFO RFO No. HHS0012857 Page 25 of 89

2.2.3.5 Technical Management Services (TMS) Subdomain

Technology Management Services (TMS) subdomain requirements are the management functions and approaches undertaken by Contractor to monitor, administer, document, and report on the integrity of the hardware and software aspects of the In-Scope Maven Registries.

Contractor will provide TMS services for the three (3) In-Scope Maven Registries as outlined in Section 2.2.3.9 (In-Scope Maven Registries Operational Phase (ROP) Domain Requirements) that include the following requirements identified in Table 6 - Common Across All (CAA) Technical Management Services (TMS) Requirements.

Table 6 - Common Across All (CAA) Technical Management Services (TMS) Requirements

Req ID Category Requirements

CAA-TMS-01 Application Data Management

Contractor shall ensure the capability within the Maven platform to import and filter data from a variety of sources (e.g., hospitals, prenatal diagnosis facilities, fetal death certificates, statewide hospital discharge databases, providers, hospitals, and laboratories). The System Agency’s end-users must be able to modify import data and data schema format specifications as needed to keep up with format changes.

CAA-TMS-02 Application Data Management

Contractor shall identify and propose Maven platform changes designed to meet and improve Maven platform performance.

CAA-TMS-03 Application Data Management

Contractor shall be able to archive historical data separately from active data sets due to storage constraints. This data shall be kept in accordance with HHSC data retention policy and human readable interpretation standards.

CAA-TMS-04 Application Data Management

Contractor shall provide processes that validate and filter the data that is imported to the Maven platform from all sources. The import process must distinguish between System Agency approved and System Agency non-approved data. The process must provide workflow processes for Contractor tracking and approval of data by the System Agency.

CAA-TMS-05 Application Data Management

Contractor shall facilitate data analysis capability for current and legacy Maven platform data that accommodates both basic and advanced System

PCS 550 HHS RFO RFO No. HHS0012857 Page 26 of 89

Table 6 - Common Across All (CAA) Technical Management Services (TMS) Requirements

Req ID Category Requirements

Agency end-users (i.e., identify Maven platform data patterns and trends).

CAA-TMS-06 Application Data Management

Contractor shall allow export of data from the Maven platform into multiple data exchange formats readable by commonly used analytical tools (e.g., Excel, SAS, SPSS - statistical software). These formats must include delimited text, and fixed-width text. Contractor will provide a tool for mapping queries and reports to a given export format (e.g., wizard) that are usable to a System Agency end-user without programming experience.

CAA-TMS-07 Application Data Management

Contractor shall allow inclusion of all historical data migrated from all Maven platform legacy systems.

Historical data must be accessible in the new…