ESBD_File_350871_HHS0014057_Patient Assistance Program Navigation Software.pdf

Version 2.10 (09/12/2023) RFO No. HHS0014057 Page 1 of 67

Cecile E. Young, Executive Commissioner

Request for Offer (RFO) for

Patient Assistance Program Navigation Software

RFO No.: HHS0014057

Date of Release: February 15, 2024

Solicitation Response Submission Deadline: March 15, 2024, by 10:30 a.m. Central Time

NIGP Class/Item Codes

Class/ Item Code AIS Description

208-32* Yes Customer Relationship Management Software (CRM), Microcomputer

208-37* Yes Database Software, Microcomputer

917-55 No Information Distribution Services

920-03* Yes Application Service Provider (ASP), Web Based Hosted

920-05* Yes Application, Infrastructure, Hosting, Data Hosting and Cloud Computing Services, Vendor Hosted and Internally Hosted

920-07* Yes Applications Software for Microcomputer Systems: Business, Mathematical and Statistical, Medical, Scientific, etc.

920-44* Yes Risk Management for Software Development

920-45* Yes Software Maintenance and Support Services and Updates and Data Hosting Services

948-43 No Health Information Services

949-77 No Self-insured Program, Prescription Drug

*The State of Texas has marked certain codes for information technology and related commodities and services as Automated Information System (AIS).

Version 2.10 (09/12/2023) RFO No. HHS0014057 Page 2 of 67

Contents Article I. Executive Summary, Definitions, and Authority

1.1 Executive Summary

1.2 Definitions

1.3 Authority

Article II. Scope of Work

2.1 Program Background

2.2 Scope Overview

2.2.1 Contract Phases

2.2.2 User Base

2.2.3 Contractor Personnel

2.2.4 Deliverable Approval

2.2.5 Key Performance Measures and Associated Remedies

2.3 Solution Requirements

2.3.1 Functional Requirements

2.3.2 Texas Risk and Authorization Management Plan

2.3.3 SaaS Requirements

2.3.4 DIR Data Center Services Infrastructure

2.3.5 Status Reports

2.4 Phase I – Transition

2.4.1 Configuration Services

2.4.2 Training Services

2.4.3 Security and Compliance

2.4.4 Scalability and Availability

2.4.5 User Acceptance Testing Services

2.4.6 Go-live Services

2.5 Phase II – Operations

2.5.1 User and Volume Reports

2.5.2 Software Maintenance and Support

2.5.3 Help Desk Services

2.5.4 Response and Resolution Service

Version 2.10 (09/12/2023) RFO No. HHS0014057 Page 3 of 67

2.5.5 Disaster Recovery Test

2.6 Phase III – Turnover

2.7 Payments and Invoices

2.8 Enterprise License

2.9 Contract Award, Term, and Historical Compensation

2.9.1 Contract Award and Execution

2.9.2 Contract Term

2.9.3 Historical Compensation

2.10 Data Use Agreement and Security Privacy Inquiry

2.11 No Guarantee of Volume, Usage, or Compensation

Article III. Administrative Information

3.1 Schedule of Events

3.2 Ambiguity, Conflict, or Discrepancy

3.3 Inquiries

3.3.1 Sole Point of Contact

3.3.2 Prohibited Communication

3.3.3 Exception to Sole Point of Contact

3.3.4 Solicitation Questions

3.4 Pre-proposal Conference

3.4.1 Attendance

3.4.2 Conference Logistical Information

3.4.3 Questions at Pre-proposal Conference

3.5 Solicitation Response Composition

3.5.1 General Information

3.5.2 Page Limit and Supporting Documentation

3.5.3 Discrepancies

3.5.4 Exceptions

3.5.5 Assumptions

3.5.6 Binding Offer

3.6 Solicitation Response Submission and Delivery

3.6.1 Solicitation Response Submission Deadline

Version 2.10 (09/12/2023) RFO No. HHS0014057 Page 4 of 67

3.6.2 Submission Options

3.6.3 Submission Checklist

3.6.4 Labeling and Delivery for USB Submission and Other Materials

3.6.5 Modifications and Withdrawals

Article IV. Solicitation Response Evaluation and Award Process

4.1 Conformance with State Law

4.2 Best Value Determination

4.2.1 Selection Methodology

4.2.2 Minimum Qualifications

4.2.3 Initial Compliance Screening

4.2.4 Written Solicitation Response Evaluation

4.2.5 Written Response Evaluation Criteria

4.2.6 TX-RAMP Certification Assessment

4.2.7 Best and Final Offer

4.2.8 Final Written Response Score

4.2.9 Summary of Best Value Determination

4.3 Questions or Requests for Clarification

Article V. Narrative and Technical Proposal

5.1 Narrative Proposal

5.1.1 Executive Summary

5.1.2 Project Work Plan

5.1.3 Key Staffing Profile

5.2 Technical Proposal

5.2.1 Technology Architecture

5.2.2 System Availability and Capacity

5.2.3 Software and Hardware Components

5.2.4 System Integration

5.2.5 System Administration, Support, and Maintenance

5.2.6 System Security and Disaster Recovery

5.2.7 Performance Monitoring and Management

Article VI. Required Respondent Information

Version 2.10 (09/12/2023) RFO No. HHS0014057 Page 5 of 67

6.1 Company Information

6.1.1 Company Narrative

6.1.2 Company Profile

6.2 Franchise Tax – Right to Transact Business in Texas

6.3 References

6.4 Major Subcontractor Information

6.5 Affirmations and Certifications

6.6 Other Reports

6.6.1 Dun and Bradstreet Reports

6.6.2 Financial Statements and Financial Solvency

6.6.3 Alternate Report

6.7 Corporate Guarantee

6.8 HUB Subcontracting Plan

6.9 TX-RAMP Documentation

Article VII. Cost Proposal

7.1 Cost Proposal

Article VIII. General Terms and Conditions

8.1 General Conditions

8.1.1 Changes, Modifications, and Cancellation

8.1.2 Offer Period

8.1.3 Costs Incurred

8.1.4 Contract Responsibility

8.1.5 Public Information Act - Respondent Requirements Regarding Disclosure

8.1.6 Respondent Waiver – Intellectual Property

8.1.7 Standards of Conduct for Vendors

8.1.8 Disclosure of Interested Parties

8.2 Insurance

8.2.1 Required Coverage

8.2.2 Alternative Insurability

8.3 Protest

Article IX. List of Exhibits

Version 2.10 (09/12/2023) RFO No. HHS0014057 Page 6 of 67

Table of Tables Table 1 – SaaS Service Requirements Table 2 – Configuration Requirements Table 3 – Training Requirements Table 4 – Security and Compliance Requirements Table 5 – Scalability and Availability Requirements Table 6 – Contractor System Availability Service Credit Calculation Table 7 – UAT Requirements Table 8 – Go-live Requirements Table 9 – User Report and Volume Report Requirements Table 10 – Software Maintenance and Support Requirements Table 11 – Help Desk Requirements Table 12 – Response and Resolution Requirement Priority Levels Table 13 – Turnover Requirements

Remainder of this page was left blank intentionally.

Version 2.10 (09/12/2023) RFO No. HHS0014057 Page 7 of 67

ARTICLE I. EXECUTIVE SUMMARY, DEFINITIONS, AND AUTHORITY

1.1 EXECUTIVE SUMMARY

The Texas Health and Human Services Commission (HHSC) is seeking a qualified Contractor to provide a Web-based System, Software as a Service (SaaS) Solution that contains a central repository or library of available drug-manufacturer and third-party prescription assistance programs available to Clients. The Solution will be used by trained Navigators at approved health-care Organization Sites or locations around the State to improve Client access to needed medications and prescription therapies, which may otherwise be cost prohibitive, by connecting uninsured or underinsured Texans with the information they need. Key Business objectives include:

a. Assisting Texas Clients in gaining access to cost prohibitive prescriptions via existing manufacturer Patient Assistance Programs (PAPs);

b. Reducing manual workload for individuals, advocates, care Navigators and other partners in the community who assist Clients in finding and applying for prescription assistance resources; and

c. Identifying financial assistance sources by navigating multiple potential Sites and programs for multiple medications while reviewing eligible criteria.

HHSC Procurement and Contracting Services (PCS) will administer the procurement process for this Solicitation, which includes RFO publication, handling of communications from vendors, as well as managing the receipt of Solicitation Responses for review and evaluation.

To be considered for award, a Respondent must execute Exhibit A, HHS Solicitation Affirmations, v. 2.4 and provide all other required information and documentation as set forth in this Solicitation.

Prior to award of the Contract, Respondent must obtain TX-RAMP Level 2 certification or TX- RAMP Provisional Certification.

Information regarding HHSC and its programs is available online and can currently be accessed at https://hhs.texas.gov/.

1.2 DEFINITIONS

Refer to Exhibit B, Health and Human Services (HHS) Uniform Terms and Conditions – Vendor, v. 3.4, for additional definitions.

As used in this Solicitation, unless a different definition is specified or the context clearly indicates otherwise, the following terms and conditions have the meanings assigned below:

https://hhs.texas.gov/

Version 2.10 (09/12/2023) RFO No. HHS0014057 Page 8 of 67

“340B Pricing” means the pricing associated with the 340B drug pricing program. The 340B drug pricing program is a federal program that requires drug manufacturers to provide outpatient drugs to eligible health care Organizations and covered entities at significantly reduced prices.

“Addendum” means a written clarification or revision to this Solicitation issued by HHSC PCS and posted to the ESBD.

“Award Consideration (AC) Documents” means documents Respondent must submit as part of the Solicitation Response to be considered for negotiations or award.

“Business Day” means any day in which normal operations are conducted (excludes State holidays and weekends).

“Calendar Day” means each day shown on the calendar beginning at 12:00 midnight, including Saturdays, Sundays, and holidays.

“Client” means the individual who has been prescribed a medication and is seeking assistance in completing one (1) or more applications for PAPs directly to prescription drug manufacturers or third-party prescription assistance programs.

“Contract Term” means the period of time beginning with the commencement date or Effective Date of a Contract and ending when the Contract expires in accordance with its terms, or when it has been terminated.

“Effective Date” has the same meaning as the definition in Exhibit B, Health and Human Services (HHS) Uniform Terms and Conditions – Vendor, v. 3.4.

“ESBD” means the Electronic State Business Daily, the electronic marketplace where State of Texas bid opportunities over $25,000 are posted. The ESBD may currently be accessed at http://www.txsmartbuy.com/esbd.

“Final Written Response Score” refers to the final scoring of the written response as documented in the Solicitation.

“Go-live” refers to the date the Solution will be operational for use.

“HHSC” means the Health and Human Services Commission.

“HHSC PCS” means Procurement and Contracting Services, a division of HHSC.

“HUB” means Historically Underutilized Business, as defined by Chapter 2161 of the Texas Government Code.

“HUB Subcontracting Plan” or “HSP” means written documentation regarding the use of subcontractors, which is required to be submitted with all responses to State agency contracts with an expected value of $100,000 or more where the State agency has determined subcontracting opportunities are probable. The HSP subsequently becomes a provision of the awarded Contract and shall be monitored for compliance by the State agency during the term of the Contract.

http://www.txsmartbuy.com/esbd

Version 2.10 (09/12/2023) RFO No. HHS0014057 Page 9 of 67

“IAM Online” means the HHSC identity and access management (IAM) platform which uses SailPoint Identity IQ (Identity Governance and Administration) and Okta (Single Sign-on/Access Management) to meet both the integration objectives and business requirements of the application.

“Medication” refers to a prescription drug or medication in which a Client is prescribed by a licensed physician to treat a condition.

“NIST” means National Institute of Standards and Technology. For more information, see Exhibit M, DCS RFO Language.

“Operations” or “Operations Phase” means the phase the at which the Solution is functional for use.

“Patient Assistance Program” or “PAP” means programs sponsored by pharmaceutical manufacturers and other 3rd parties that provide medications to eligible Clients at low cost or no cost. This can include both uninsured and underinsured Clients.

“Respondent” means the individual or entity responding to this Solicitation.

“Single Sign-on” or “SSO” means an authentication process that allows Users to access multiple applications and websites with one (1) set of login credentials.

“Site” means the physical location designated by the enrolled Organization, where one (1) or more enrolled Navigator can meet in-person with Clients to complete one (1) or more applications for eligible PAPs.

“Software-as-a-Service” or “SaaS” means the service model described by NIST in Special Publication No. 800-145 (https://csrc.nist.gov/pubs/sp/800/145/final) to be the capability provided to the consumer to use the provider’s applications running on a cloud infrastructure. The applications are accessible from various Client devices through a thin Client interface such as a web browser (e.g., web-based e-mail). The consumer does not manage or control the underlying cloud infrastructure including network, servicers, operating systems, storage, or even individual application capabilities, with the possible exception of limited User-specific application configuration settings. For more information, see Exhibit M, DCS RFO Language.

“Solicitation” means this RFO including all exhibits, attachments, forms, and Addenda, if any.

“Solicitation Consideration (SC) Documents” means documents that must be submitted by Respondent with the Solicitation Response in order to be considered for evaluation and cannot be resubmitted or have errors remedied after the submission due date and time in the Schedule of Events has passed.

“State” means the State of Texas and its instrumentalities, including HHSC, and any other state agency, its officers, employees, or authorized agents.

“Texas Cares Program” means the HHSC program that oversees enrollment, training, and certification of Organizations, Sites, and Navigators who will assist Texans in gaining financial assistance to prescription medications or therapies through existing drug manufacturer or third-party prescription assistance programs.

https://csrc.nist.gov/pubs/sp/800/145/final

Version 2.10 (09/12/2023) RFO No. HHS0014057 Page 10 of 67

“Turnover” or “Turnover Phase” means the phase which the Contractor will turnover, to HHSC, the day-to-day management of client activities, including all requisite project management activities, for the Solution.

“TX-RAMP” means the Texas Risk and Authorization Management Program established by the Department of Information Resources (DIR) that provides a standardized approach for security assessment, authorization, and continuous monitoring of cloud computing services that process the data of a state agency. To become TX-RAMP certified, entities must submit prescribed documentation to DIR. Information regarding TX-RAMP is currently located at:

https://dir.texas.gov/texas-risk-and-authorization-management-program-tx-ramp.

“User” means an individual, who has a defined role with Texas Cares Program and Texas Cares Program approved access to the SaaS described in this solicitation.

“VPTS” means Vendor Performance Tracking System, as defined under Section 2262.055 of the Texas Government Code and Title 34 of the Texas Administrative Code Part 1, Chapter 20, Subchapter B, Division 2, Rule §20.115 and Subchapter F, Division 2, Rule §20.509.

“Web-Based System” is a software environment that is accessible via a web browser.

1.3 AUTHORITY

HHSC is soliciting the Services stated in this Solicitation under the authority of Texas Government Code § 2157.068(e-1); and 1 TAC pt. 10 Ch. 212, Subchapter C, § 212.20. Additional authority is granted under Chapter 65 of the Texas Health and Safety Code; and Title 26, Texas Administrative Code, Part 1, requiring HHSC to establish a prescription assistance program for Texans.

ARTICLE II. SCOPE OF WORK

2.1 PROGRAM BACKGROUND

The Texas Cares Program was established by House Bill (H.B.) 18, 87th Regular Session, 2021, to assist uninsured Texans in gaining access to prescription benefits. The Texas Cares Program strives to improve accessibility to prescription drugs for individuals who are unable to access comparable medications through insurance or other health care programs.

In review of the current prescription landscape, it was found that approximately 98% of the top 200 most prescribed medications are available through existing drug assistance options.

Additionally, research found that many prescription medications which are considered cost prohibitive are available through manufacturer PAPs. There is a significant need to maximize access to prescriptions through existing free and low-cost resources by increasing awareness and strategic navigation.

The Texas Cares Program seeks to increase prescription drug access for Texans through a comprehensive community-based model and SaaS Solution. With this strategy, Navigators will https://dir.texas.gov/texas-risk-and-authorization-management-program-tx-ramph https://dir.texas.gov/texas-risk-and-authorization-management-program-tx-ramph https://statutes.capitol.texas.gov/Docs/GV/htm/GV.2262.htm#2262.055 https://texreg.sos.state.tx.us/public/readtac$ext.TacPage?sl=R&app=9&p_dir=&p_rloc=&p_tloc=&p_ploc=&pg=1&p_tac=&ti=34&pt=1&ch=20&rl=115 https://texreg.sos.state.tx.us/public/readtac$ext.TacPage?sl=R&app=9&p_dir=&p_rloc=&p_tloc=&p_ploc=&pg=1&p_tac=&ti=34&pt=1&ch=20&rl=509

Version 2.10 (09/12/2023) RFO No. HHS0014057 Page 11 of 67 assist individuals with finding and applying for existing drug manufacturer and third-party PAPs.

The Texas Cares Program is dedicated to assisting Texans while meeting them where they are, embodying the program mission – Bringing Care Closer to Texans.

Many pharmaceutical manufacturers offer PAPs which provide medications to eligible Clients at no-cost or low-cost. There are currently over 350 known PAPs available, with varying eligibility and applications. Although there are numerous PAPs available, many providers, Clients and advocates note that program requirements can be difficult to navigate and time consuming.

Additionally, since the application forms and eligibility criteria for PAPs can change secondary to manufacturer updates, ensuring that the most up to date information for these programs is used can be difficult for providers, Clients and advocates.

A comprehensive community-based model SaaS Solution can facilitate the process of identifying these PAPs, and act as a single “port” of entry for Navigators to assist Clients with applications for assistance. This single “port” of entry will find and autofill applications for all PAPs that a Client is eligible for, reducing workload and saving time.

2.2 SCOPE OVERVIEW

HHSC seeks a qualified Contractor to provide a comprehensive community-based model SaaS Solution that meets or exceeds the requirements as specified in this Solicitation. The Contractor shall provide all software, hardware, and personnel resources necessary to implement and maintain the Solution, unless specifically stated as the responsibility of HHSC.

The Contractor must provide a Solution that can be used by HHSC to assist Clients in gaining medications and prescription therapies, which may otherwise be cost prohibitive. The Solution must include reporting and analytics, security, cataloging, processing, producing, and retaining data to meet HHSC policies. The Solution must have processing capabilities, enhanced reviewing features, comprehensive reporting, agility in handling large quantities of data, and advanced production capabilities.

The Solution must be capable of being adapted and modified to meet HHSC’s business needs through configuration. In addition, the Solution must be scalable and flexible to accommodate changes in technology, security, legislative mandates, and any other changes within the scope of this Solicitation.

The Solution must:

a. Find all forms of available PAPs for Clients, including but not limited to manufacturer PAPs and other third-party prescription assistance;

b. Streamline the application process, reduce errors, update the applications as needed, and aid in the search of available PAPs;

c. Act as a central point of entry to search for programs that a Client may qualify for, determine eligibility, and directly submit specific application forms to the program providers;

Version 2.10 (09/12/2023) RFO No. HHS0014057 Page 12 of 67

d. Use the most current versions of application forms for manufacturer PAPs and other third-party prescription assistance;

e. Routinely be updated by the Contractor when assistance program forms and requirements have been updated, in accordance with industry standards, to reflect current information;

f. Require that updates be communicated to all Users in advance of web or information updates;

g. Provide the ability for Navigators to locate copay assistance programs;

h. Provide the ability for Navigators to locate appropriate programs specific to the Client’s individual needs; and

i. Have capacity for 340B Pricing to be incorporated into the system and be available as part of a suite of offerings.

2.2.1 Contract Phases

The Contractor’s performance is comprised of three (3) phases:

a. Phase I – Transition;

b. Phase II – Operations; and

c. Phase III – Turnover.

2.2.2 User Base

The Texas Cares Program will grow the user base iteratively. Within the first year of the Contract term, less than fifty (50) Users will be required. Over time, the Solution must have capacity to be scaled to host 1,500 plus Users. User types include:

a. HHSC Users - Texas Cares Program staff administrators that oversee enrollment, training, and certification of Organizations, Sites, and Navigators to facilitate access by Texans to drug manufacturer or third-party PAPs for assistance;

b. Organization Users - An entity (predominantly external entities) that will enroll with the Texas Cares Program and register one (1) or more geolocated Sites where Navigators can assist Clients;

c. Navigator - An individual (predominantly external entities but may also be HHSC Program staff) who has completed the program required background check process, and completed required training in the HHSC Texas Cares Program to assist Clients with the application process to receive assistance from drug manufacturers or third-party PAPs; and

d. Site Manager - An individual (predominantly external entities) who has , completed the program required background check process, and completed required training with HHSC Texas Cares Program and will be the key point of contact for the Site(s) where Navigators can meet Clients in person. Site Managers will provide oversight of enrolled Navigators who are associated to their Site. A Site Manager can also be a Navigator.

Version 2.10 (09/12/2023) RFO No. HHS0014057 Page 13 of 67

Please note, a single User may fall into more than one (1) role listed below. If the user falls into more than one category, they count as only one user.

2.2.3 Contractor Personnel

The Contractor shall provide key personnel to provide support for the Solution to HHSC throughout the life of the Contract.

The Contractor’s key personnel must include an account manager who will serve as the Contractor’s primary point of contact to HHSC for coordinating and directing Contractor resources as required, addressing concerns or issues raised by HHSC, and for generally managing the business relationship, during the Contract Term. The account manager will be responsible for ensuring a successful project fully compliant with all appropriate security laws, policies, procedures, and regulations throughout the Contract term.

HHSC reserves the right to alter the designation of any Contractor personnel as key personnel.

HHSC, at its discretion, may request that the Contractor remove key personnel providing Services under the Contract, if HHSC believes that such an individual is not providing the Services as described within the Contract and the Contractor, after notice, has been unable to resolve performance issues relative to such individual.

2.2.4 Deliverable Approval

The Contractor must provide all Deliverables listed in the following tables on or before the dates specified in the Contract:

a. Table 2 – Configuration Requirements;

b. Table 3 – Training Requirements;

c. Table 7 – UAT Requirements;

d. Table 8 – Go-live Requirements;

e. Table 9 – User Report and Volume Report Requirements; and

f. Table 13 – Turnover Requirements.

The Contractor must submit each written Deliverable to HHSC for review and approval prior to use. HHSC approval is contingent upon HHSC’s determination the Deliverable conforms to the agreed upon specifications identified in the Contract. HHSC’s approval of the Contractor’s work products or processes will not relieve the Contractor of liability of errors and omissions in the work products or processes.

HHSC shall notify the Contractor of Deliverable approval or rejection, in writing. If the Deliverable is rejected, HHSC’s written notification will include the reason(s) for rejection and the steps the Contractor must complete so the Deliverable will be acceptable.

Upon receipt of the corrected and resubmitted Deliverable, HHSC shall review the corrected Deliverable to confirm that the identified deficiencies have been corrected and brought into

Version 2.10 (09/12/2023) RFO No. HHS0014057 Page 14 of 67 compliance with specifications and that the corrections have not directly or indirectly caused other deficiencies. HHSC shall have the option to continue the evaluation process until the written Deliverable is brought into compliance with the Contract specifications.

If the Contractor is unable to provide any Deliverable within the scheduled timeframe, the Contractor’s account manager must contact HHSC in writing, and provide a reason for the delay and the proposed revised schedule, which HHSC may accept or reject at its sole discretion.

The Contractor’s failure to comply with applicable deadlines for Deliverables, or other HHSC requests for information may result in adverse action against the Contractor (see, Exhibit N, Key Performance Measures and Liquidated Damages).

Any Deliverable that is not explicitly accepted in writing by HHSC is rejected.

2.2.5 Key Performance Measures and Associated Remedies

HHSC will monitor the performance of the Contractor and all requirements of the Contract are subject to performance evaluation by HHSC. HHSC has identified Key Performance Measures (KPMs) in Exhibit N, Key Performance Measures and Liquidated Damages.

For the contractual obligations subject to a KPM, the KPM will be used to gauge the Contractor’s commitment to successful performance, its willingness to stand behind its Goods and Services provided during the Contact Term, as well as its confidence in its ability to perform.

The Contractor will achieve the KPMs specified in Exhibit N, Key Performance Measures and Liquidated Damages and may have liability for liquidated damages based on KPM failure as further described in each KPM. Liquidated damages will not be assessed if HHSC determines that the Contractor is not responsible for the failure described in the respective KPM.

For purposes of the KPMs, all measurement periods shall be monthly unless otherwise specified.

In addition, the term “day” refers to a Calendar Day, unless otherwise specified in the text. Partial days beyond the due date shall be rounded up to a whole day for the purposes of the KPM measurement. Also, an hour is not prorated i.e., a fraction of an hour means an hour.

When a liquidated damages measure refers to a percentage point, or portion thereof, the "portion thereof" means that a full percentage point deviation is not required to assess the liquidated damages. For example, if the standard is 99% and the results achieved are 98.6%, the liquidated damages that may be assessed is based on one (1) percentage point. If the results achieved are 97.9%, the liquidated damage that may be assessed is based on two (2) percentage points. HHSC is not required to provide the Contractor with notice and opportunity to resolve issues to System Agency’s assessment of liquidated damages in accordance with Texas law.

In the event the Contractor fails to perform or complete the obligations in a timely manner, HHSC may, in addition to the remedies set forth elsewhere in the Contract, impose the remedies which include the following:

a. Compliance by the Contractor, at no cost to HHSC, with the performance improvement activities and timelines specified in a written corrective action plan(s) approved by HHSC;

Version 2.10 (09/12/2023) RFO No. HHS0014057 Page 15 of 67

b. Additional or ad hoc reporting by the Contractor, at no cost to HHSC, to address performance issues;

c. To the extent that HHSC has not received full performance of any Contractor obligations, HHSC may exercise its statutory right to withhold authorization for payments for invoices for any Services not actually received in conformance with Contract requirements. See Section 2155.322 of the Texas Government Code (requiring State agencies to inspect and certify receipt of goods or Services for compliance with Contract requirements); and

d. Assessment of liquidated damages as listed in Exhibit N, Key Performance Measures and Liquidated Damages.

2.3 SOLUTION REQUIREMENTS

The Solution must be:

a. Compatible with standard Internet browsers, including but not limited to, Google Chrome, Microsoft Edge, Mozilla Firefox, and Apple Safari;

b. Capable of being viewed on a desktop, tablet or mobile device;

c. Capable of providing and supporting access for up to 1,500 synchronous Users, logins, or access points to obtain the information concurrently;

d. Allow for easy access that is compatible with SSO through HHSC’s IAM Online platform, see Exhibit O, HHSC Identity and Access Management (IAM) Guide;

e. Include role-based security provisioning that conditions the levels of access available to different categories of Users;

f. Scalable to increase or decrease the number of Users, number of licenses, storage capacity, and number of HHSC-assigned instances;

g. Compliant with privacy and information security standards for transmission and storage of data and information applicable to confidential data sets with Health Insurance Portability and Accountability Act (HIPAA) and Personal Identifiable Information (PII) data compliance constraints; and

h. Capable of being adapted and modified to meet the specific needs through configuration.

2.3.1 Functional Requirements

The Solution must meet or exceed the following functional requirements:

a. Enable multi-site user and data management with the ability to implement tiered user access and granular rights management. Allow organizations to oversee and manage sites or locations along with the Users assigned to those specific sites or locations.

b. Allow Organizations that partner with HHSC for the use of the system the ability to access reports pertaining to their various sites or locations. Allow HHSC staff to access reports

Version 2.10 (09/12/2023) RFO No. HHS0014057 Page 16 of 67 and data across all organizations, sites, and locations. Enable data exportation from the Solution. Provide the ability to generate custom ad-hoc reports and configure desired data reporting structures for HHSC. Offer Client utilization reports at both Navigator and Organization levels.

c. Provide User utilization data, detailing the frequency of Client application initiation versus completion or submission. Include audit trails covering user activity, encompassing login details, application modifications, and duration spent working on Client records.

d. Deliver electronic renewal reminders for maintenance medication to relevant users at the Site, location, or Organization levels. Possess document management functionalities for Client support documents. Offer text and email notifications to Clients regarding their application status.

e. Enable users to manage a list of Clients served, along with application status and follow-up capabilities;

f. Provide capability to upload or import Client demographics from other electronic healthcare systems using Excel standard file formats;

g. Include quality review questionnaire that can be managed and distributed following PAP utilization including the capability to send text or email reminders to complete the questionnaire.

h. Be available in both English and Spanish; and ensure questionnaire availability in both English and Spanish.

i. Enable any software-generated communications and automated notifications to be customized to reference HHSC Program (Texas Cares Program) and branding. Enable customization of all software-generated communications and automated notifications to reflect the HHSC Program (Texas Cares Program) and its branding.

2.3.2 Texas Risk and Authorization Management Plan

The Contractor shall comply with the program requirements of TX-RAMP as they currently exist and as amended throughout the Contract Term. Commencing on the Effective Date, the Contractor shall have achieved TX-RAMP Level 2 Certification, and the Contractor must maintain such certification for the duration of the Contract Term. At the sole discretion of HHSC, the Contractor’s attainment of TX-RAMP Provisional Certification may satisfy the TX-RAMP Certification Level 2 requirement for the length of active TX-RAMP Provisional Certification. If HHSC permits TX-RAMP Provisional Certification, the Contractor is solely responsible for obtaining and maintaining TX-RAMP Level 2 Certification prior to the expiration of TX-RAMP Provisional Certification. The Contractor acknowledges that HHSC shall not provide Agency-sponsored Interim Provisional Certification or otherwise assist the Contractor in Contractor’s compliance with TX-RAMP requirements.

In addition, the Contractor shall:

Version 2.10 (09/12/2023) RFO No. HHS0014057 Page 17 of 67

a. Upon HHSC’s request, provide the Contractor’s submission(s) to DIR that supports DIR’s approval of certification status and respond to HHSC and DIR TX-RAMP staff inquiries promptly;

b. Provide written notification to HHSC of any lapse in TX-RAMP certification including, but not limited to, DIR revocation of TX-RAMP certification within two (2) business days of the Contractor’s discovery of non-compliance with TX-RAMP requirements;

c. Complete all TX-RAMP monitoring reports required by DIR and submit copies of reports to HHSC on or before the second (2nd) business day following the DIR submission deadline;

d. Routinely assess and monitor for compliance with required security controls and demonstrate that the security posture of the cloud computing services offered is acceptable to maintain TX-RAMP certification;

e. If the Contractor has TX-RAMP Provisional Certification, provide a progress update to HHSC on the Contractor’s application for TX-RAMP Level 2 Certification no later than the third (3rd) business day of each calendar month, unless HHSC requires more frequent reporting, until the expiration of the TX-RAMP Provisional Certification; and

f. If the Contractor has TX-RAMP Level 2 Certification, commencing six months prior to the expiration date of the TX-RAMP Level 2 Certification, provide a progress update to HHSC on the Contractor’s application for renewal or extension of its TX-RAMP Level 2 Certification no later than the third (3rd) business day of each calendar month, unless HHSC requires more frequent reporting.

The Contractor’s failure to comply with any TX-RAMP requirements including, but not limited to, continuous maintenance of the minimum certification required by the Contract shall constitute a material breach of contract, and HHSC reserves the right to hold the Contractor accountable by taking any remedial or corrective actions available under the Contract, at law, or in equity.

If the Contractor is unable to achieve TX-RAMP Level 2 Certification or re-certification, as applicable, for any reason before the 120th calendar day prior to the expiration date of the TX- RAMP Provisional Certification or TX-RAMP Level 2 Certification, as applicable, the Contractor shall provide, at no cost to HHSC, turnover services in accordance with Section 2.6 (Phase III – Turnover).

2.3.3 SaaS Requirements

The Contractor shall provide a Solution that meets the NIST standard definition of SaaS provided in NIST Special Publication No. SP 800-145 and that meets or exceeds the requirements specified in Table 1, SaaS Service Requirements.

Version 2.10 (09/12/2023) RFO No. HHS0014057 Page 18 of 67

Table 1 – SaaS Service Requirements

Requirement

ID

Requirement Name Requirement

SAA-01 Off-site Hosted Data

The Contractor must make all HHSC data hosted off-site available to HHSC.

SAA-02 Planned Downtime

The Contractor must provide five (5) Calendar Days advance notice of planned downtime with HHSC.

See Exhibit N, Key Performance Measure and Liquidated Damages, KPM-02.

SAA-03 Unplanned Downtime

Contractor must provide HHSC at least thirty (30) minutes advance written notice of any known, unplanned downtime.

See Exhibit N, Key Performance Measures and Liquidated Damages, KPM-03.

SAA-04 Data Back Ups

The Contractor must back up all HHSC data, at a minimum, every two (2) weeks with daily incremental backups.

SAA-05 Remote Back Ups

The Contractor must provide remote back-ups of HHSC data when requested by HHSC.

SAA-06 Operational Changes

The Contractor must provide HHSC with five (5) Calendar Days advanced notice of any operational changes that may affect access to HHSC data before the Contractor implements any changes to the Solution.

2.3.4 DIR Data Center Services Infrastructure

To the extent applicable to the Solution, the Contractor must comply with Exhibit M, DCS RFO Language.

2.3.5 Status Reports

The Contractor must provide, at no additional cost, weekly Status Reports via email to the Texas Cares Program team during Phase I –Transition until Go-live or Phase II – Operations, at which point incident reports are required as applicable. The status reports are due every Friday by 4:00 p.m. Central Time, with the exception that if a holiday falls on a Friday, report is due on preceding Thursday.

Status Reports must include the following information at a minimum:

a. A detailed description of work completed by the Contractor during the reporting period;

b. An overview of pending work that aligns with the project work status;

c. The identification of work activities and tasks not tracking to the project timeline;

Version 2.10 (09/12/2023) RFO No. HHS0014057 Page 19 of 67

d. A list of past due work activities and tasks with the Contractor’s escalation plan to meet schedule deadlines;

e. The identified risks, issues, and action items with associated strategies;

f. The disposition of escalated or critical issues, risks; and

g. The tracking and documentation of decisions made during the reporting period.

2.4 PHASE I – TRANSITION

2.4.1 Configuration Services

The Contractor shall provide Configuration Services that meet or exceed the requirements specified in Table 2, Configuration Requirements.

Table 2 – Configuration Requirements

Requirement

ID

Requirement Name Requirement

CF-01 Project Work Plan

The Contractor must provide a detailed Project Work Plan that addresses all of the Contractor activities with a schedule to complete all the requirements and provide all deliverables, in electronic format, to include, but not limited to, the following:

a. Project Start and finish dates;

b. Weekly informational sessions;

c. Task identification;

d. Tasks and subtasks;

e. Dependencies;

f. Milestones;

g. Percentages of completed tasks;

h. Durations; and

i. Assigned resources.

The Project Work Plan must address all of the Contractor activities with a schedule to complete all the requirements.

After approval by HHSC of the proposed Project Work Plan, any subsequent changes to the Project Work Plan must be approved in writing by HHSC.

Deliverable Due Date: Ten (10) Calendar Days following the Contract Effective Date.

See Exhibit N, Key Performance Measures and Liquidated Damages, KPM-15.

Version 2.10 (09/12/2023) RFO No. HHS0014057 Page 20 of 67

Table 2 – Configuration Requirements

Requirement

ID

Requirement Name Requirement

CF-02 Kickoff Meeting and

Materials

The Contractor must schedule a Kickoff meeting with HHSC to familiarize project team members with the project and develop baseline expectations between HHSC and the Contractor, within five (5) Calendar Days following the Contract Effective Date.

The Contractor must provide presentation materials two (2) Calendar Days prior to meeting with HHSC and revise materials to comply with Contract requirements in accordance with HHSC written notice.

Deliverable Due Date: Kickoff Meeting scheduled within five

(5) Calendar Days following the Contract Effective Date;

presentation material provided at least two (2) Calendar Days prior to the Kickoff Meeting.

See Exhibit N, Key Performance Measures and Liquidated Damages, KPM-15.

CF-03 Contractor Personnel

The Contractor must ensure all personnel performing Services have requisite training and are available within five (5) Calendar Days following the Contract Effective Date.

CF-04 State-specific Configurations

The Contractor must provide a Solution that meets the requirements of Section 2.3 (Solution Requirements).

CF-05 Project Management Plan (PMP)

The Contractor must provide a PMP that outlines the project tasks, how to accomplish the tasks, who is involved, how will issues be escalated, how information is communicated, measured, and reported.

The PMP must include the following project plans:

a. Communication Plan;

b. Staffing Management Plan;

c. Implementation Plan;

d. Escalation Plan;

e. Performance and Quality Management Plan;

f. UAT Plan and;

g. Risk and Issue Management Plan.

The PMP must follow the Project Management Body of Content (PMBOK) standards and guidelines for the structure and content of the document. The PMP is a living document and may change

Version 2.10 (09/12/2023) RFO No. HHS0014057 Page 21 of 67

Requirement

ID

Requirement Name Requirement as the project progresses. The Contractor must update the PMP as required to describe the current state of the project.

Deliverable Due Date: Ten (10) Calendar Days following the Contract Effective Date.

See Exhibit N, Key Performance Measures and Liquidated Damages, KPM-15.

CF-06 Change Management

Plan

The Contractor must provide a Change Management Plan that describes its change management controls and procedures which it will carry out in coordination with HHSC. The Contractor’s Change Management Plan must include, but is not limited to:

a. Description of the change, including the need/benefit, date identified, and who initiated the change request;

b. List of data, functions, or processes affected by the change;

c. Potential risks associated with the change (both implementing and not implementing the change);

d. Start and completion dates (dates must be approved by

HHSC);

e. Plans for staff allocations, installation, and testing;

f. Roll-back plan that provides details on how to restore the

Solution before the change; and

g. Estimated hours of work to implement change.

Deliverable Due Date: Ten (10) Calendar Days following the Contract Effective Date.

See Exhibit N, Key Performance Measures and Liquidated Damages, KPM-15.

CF-07 Readiness Assessment

Plan

The Contractor must provide a Readiness Assessment Plan that confirms:

a. How the results of the readiness assessment will be collected and presented to HHSC and include recommended approaches to resolve any identified problems;

b. All Users have been identified, on-boarded, trained, and registered (logins created);

Version 2.10 (09/12/2023) RFO No. HHS0014057 Page 22 of 67

Requirement

ID

Requirement Name Requirement

c. HHSC’s written approval on the Contractor’s development and approach on readiness criteria;

d. All support components are present, the support desk is operational, and online support materials are approved and in place on Solution help links;

e. HHSC’s written approval of development and approach for test plan and test cases; and

f. HHSC’s written approval of development and approach for success criteria that will be used to measure complete deployment of the Solution.

Deliverable Due Date: Thirty (30) Calendar Days following the Contract Effective Date.

See Exhibit N, Key Performance Measures and Liquidated Damages, KPM-15.

CF-08 Information Gathering Sessions

The Contractor must conduct information gathering sessions with HHSC base Users throughout Phase I - Transition, in accordance with the approved Project Work Plan, to determine the configuration and how to develop the interfaces for the Solution.

CF-09 Readiness Assessment

Results Report

The Contractor must provide a Readiness Assessment Results Report that describes how the results were collected and include recommended approaches to resolve any identified problems or issues with the Solution. The Readiness Assessment Results Report must evaluate:

a. The Contractor’s ability to support Users’ ability to log in and use the Solution;

b. The developed business procedures and processes;

reporting; and

c. and the security of the data export.

The Readiness Assessment Report must include a formal statement that acknowledges the planned completion of Phase I – Transition and provides HHSC with the information need to approve deployment to Phase II – Operations.

Deliverable Due Date: Thirty (30) Calendar Days following the Contract Effective Date.

Version 2.10 (09/12/2023) RFO No. HHS0014057 Page 23 of 67

Requirement

ID

Requirement Name Requirement

See Exhibit N, Key Performance Measures and Liquidated Damages, KPM-15.

CF-10 Add and Remove Users

Process

The Contractor must develop and document the process to add and remove HHSC-approved Users to the Solution.

Instructions for this process must be included in deliverable associated with TRA-02 (Training Materials Deadline).

CF-11 Solution Administrators

The Contractor must provide access for HHSC to serve as Solution administrators. See Section 2.2.2 (User Base).

CF-12 Data Dictionary

The Contractor must provide an electronic searchable Data Dictionary for the Solution, using industry best practices to be approved by HHSC.

At a minimum, the Data Dictionary must contain for each of the following:

a. Field name in human readable format;

b. Field description;

c. Database field name;

d. Database table;

e. Field type and length;

f. Valid values and their corresponding descriptions; and

g. Instructions on how to create queries.

Deliverable Due Date: Thirty (30) Calendar Days following the Contract Effective Date.

See Exhibit N, Key Performance Measures and Liquidated Damages, KPM-15.

CF-13 Configuration Requirement Completion

The Contractor must complete all Configuration Requirements and activities, and document processes included in the Project Work Plan.

Deliverable Due Date: Fifty (50) Calendar Days following the Contract Effective Date.

CF-14 Configuration Requirement

The Contractor must obtain written approval from HHSC that all configuration requirements identified in this Table 2, Configuration Requirements have been completed.

Version 2.10 (09/12/2023) RFO No. HHS0014057 Page 24 of 67

Requirement

ID

Requirement Name Requirement

Written Approval

Deliverable Due Date: On or before fifty (50) Calendar Days following the Contract Effective Date.

See, Exhibit N, Key Performance Measures and Liquidated Damages, KPM-08.

2.4.2 Training Services

The Contractor shall provide Training Services that meet or exceed the requirements specified in Table 3, Training Requirements.

Table 3 – Training Requirements

Requirement

ID

Requirement Name Requirement

TRA-01 Training Environment and Software

The Contractor must provide a virtual training environment for the Solution.

Deliverable Due Date: Sixty (60) Calendar Days following the Contract Effective Date.

TRA-02 Training Materials Deadline

The Contractor must develop all training materials in both paper and electronic format with instructor-led training for the Solution.

The Contractor must provide all training materials, in both paper and electronic format, to HHSC staff for approval in writing by HHSC staff.

Deliverable Due Date: Five (5) Calendar Days before scheduled training.

See Exhibit N, Key Performance Measures and Liquidated Damages, KPM-15.

TRA-03 Troubleshooting Guide

The Contractor must provide a Troubleshooting Guide for Users to address common application issues such as password logins, search problems, error messages.

Deliverable Due Date: Within sixty (60) Calendar Days following the Contract Effective Date.

See Exhibit N, Key Performance Measures and Liquidated Damages, KPM-15.

TRA-04 Training Levels The Contractor will provide two (2) levels of training: Solution administrators and Users.

Deliverable Due Date: Within sixty (60) Calendar Days following the Contract Effective Date.

Version 2.10 (09/12/2023) RFO No. HHS0014057 Page 25 of 67

Table 3 – Training Requirements

Requirement

ID

Requirement Name Requirement

TRA-05 Ongoing Training Materials

The Contractor must provide training materials, delivered through online tutorials or videos, that will be used throughout Phase II – Operations.

Deliverable Due Date: Within sixty (60) Calendar Days following the Contract Effective Date.

See Exhibit N, Key Performance Measures and Liquidated Damages, KPM-15.

TRA-06 Training State-specific

Configuration

The Contractor must provide training to HHSC for configuration and maintenance of all State-specific configurations as required in Section 2.3 (Solution Requirements).

Deliverable Due Date: Within sixty (60) Calendar Days following the Contract Effective Date.

See Exhibit N, Key Performance Measures and Liquidated Damages, KPM-15.

TRA-07 Training Requirements

Written Approval

The Contractor must obtain written approval from HHSC that confirms all Training Requirements have been completed.

Deliverable Due Date: Within sixty (60) Calendar Days following the Contract Effective Date.

See, Exhibit N, Key Performance Measures and Liquidated Damages, KPM-09.

2.4.3 Security and Compliance

The Contractor shall provide a Solution and Services that meet or exceed the requirements specified in Table 4, Security and Compliance Requirements.

Table 4 – Security and Compliance Requirements

Requirement

ID

Requirement Name Requirement

COM-01 Records Management

The Solution must comply with all federal, State, and HHSC records management policies and retention schedules for all data and documentation, except where a different retention period is specified by…