ESBD_File_352473_HHS0014445 Diabetes Prevention Program Sftw (SaaS).pdf

TEXAS HEALTH AND HUMAN SERVICES COMMISSION

Cecile E. Young, Executive Commissioner

Invitation for Bids for

Diabetes Prevention Program Software as a Service (SaaS) and Maintenance

IFB No. HHS0014445

NIGP Class/Item No(s): 208-60 Medical Software, All Types, Microcomputer*

Procurement Schedule - All Times are Central Time Reference Section 2 for further information

Solicitation Date Posted to ESBD February 28, 2024

Questions or Clarifications Submission Deadline March 5, 2024, 5:00 PM

Responses to Questions or Clarifications - Addendum posted on the ESBD March 7 2024

Response Deadline March 14, 2024, 10:30 AM

Anticipated Contract Start Date Upon award

Table of Contents 1 Introduction and Purpose of Solicitation

1.1 No Guarantee of Volume, Usage or Compensation

1.2 Solicitation Components

2 Procurement Schedule 3 Withdrawal of Response 4 HHSC Overview 5 Definitions 6 General Solicitation Information

6.1 Sole Point of Contact and Communications

6.2 Exception to the Sole Point of Contact

6.3 Offer Period

6.4 Costs Incurred

6.5 Changes, Modifications and Cancellation

6.6 Ambiguity, Conflict, Discrepancy

6.7 Solicitation Questions or Clarifications

6.8 Notification of Addenda or Cancellation

7 Scope of Work (SOW)

7.1 Scope of Services to be Performed

8 HUB Subcontracting Plan (HSP) Requirements

8.1 HUB Subcontracting Plan (HSP)

9 Pricing Information

9.1 Pricing Structure

9.2 Price Adjustments

10 Changes to The Contract 11 Contract Term

11.1 Term of Contract or Purchase Order

11.2 Initial Contract Term:

11.3 Extension Option

12 Contract Administration/Transactional Purchase Order Administration

12.1 Contract Manager/Program Lead

12.2 Performance Reporting

12.3 Contractor Response to Notification of Non-Material Deficiency

12.4 Corrective Action Plan (The Plan)

12.5 Performance Issues

12.6 Confidential or Proprietary Information

12.7 Bidder Waiver – Intellectual Property

13 Invoicing and Payment

13.1 Bill-to Address

13.2 Invoice Information

13.3 Payment

13.4 Invoice Submission

13.5 Disputed Invoice(s)

14 Insurance Requirements

14.1 Specific Insurance Requirements

14.2 Workers’ Compensation and Employers’ Liability

14.3 Commercial Automobile Liability

14.4 Commercial General Liability

14.5 Umbrella/Excess Liability

15 Screening of Responses

15.1 Administrative Screening

15.2 Irregularities

16 Evaluation

16.1 Evaluation of Responses

16.2 Conformance with State Law for Evaluation

16.3 Specific Evaluation Criteria

17 Award 18 Disclosure of Interested Parties 19 Protest Procedures Appendix A – Submission Instructions and Response Checklist

1 Introduction and Purpose of Solicitation The Texas Health and Human Services Commission (HHSC) is an agency within the Texas Health and Human Services (HHS) system. The Procurement and Contracting Services (PCS) division of HHSC administers solicitations for HHS.

HHSC PCS is seeking competitive bids to establish Contract(s) for a Diabetes Prevention Program Software as a Service (SaaS) application on an annual basis.

Prior to award of the Contract, Respondent must obtain TX-RAMP Level Two certification or TX- RAMP Provisional Certification.

Both HHS Agencies, HHSC and DSHS, will be entitled to use any contract awarded as a result of this Solicitation.

To be considered for award, Bidders must submit a comprehensive Response which includes all required information and documentation as outlined in this Solicitation to ensure the Bidder meets all requirements, possesses the required experience and qualifications and has the capacity to provide the goods and related services described in this Solicitation. See Appendix A, Submission Instructions and Response Checklist.

1.1 No Guarantee of Volume, Usage or Compensation

HHS Agency does not guarantee any volume, usage, or compensation to be paid to any Contractor under any Contract resulting from this Solicitation. Additionally, all HHS Agency contracts are subject to appropriations, the availability of funds, and termination.

The estimated historical quantities included in the Price Sheet are provided only as a guideline for preparing the pricing response and should not be construed as representing anticipated or actual quantities that will be required.

1.2 Solicitation Components

This Solicitation includes the following items:

• Exhibit A – HHS Solicitation Affirmations

• Exhibit B – PCS 111-Contract Affirmations, with Data Use Agreement and HHS Uniform Terms and Conditions (UTCs)

• Exhibit B-1 – Attachment 1 - Security and Privacy Inquiry (SPI)

• Exhibit C – Bid Execution Page

• Exhibit D – Pricing Sheet

• Exhibit E – Bidder Reference Form

• Exhibit F – HHS Online Bid Room Information

2 Procurement Schedule The Procurement Schedule dates on the cover page of this Solicitation are tentative. HHSC reserves the right to modify these dates at any time by issuing an addendum. Any events listed in the Procurement Schedule after the Response Deadline will occur at the discretion of HHSC.

Responses must be received by HHSC prior to the Response Deadline as indicated in the Procurement Schedule or as changed via an Addendum. Every Bidder is solely responsible for ensuring its Response is received before the Response Deadline. HHSC is not responsible for lost, misdirected or late Responses.

By submitting a Response, the Bidder represents and warrants that any individual submitting the Response and any related documents on behalf of the Bidder is authorized to do so and to bind the Bidder under any resulting contract.

3 Withdrawal of Response Responses may be withdrawn from consideration or amended at any time prior to the Response Deadline by submitting a written request by e-mail to the point of contact listed in Section 6.1 (Sole Point of Contact and Communications).

The e-mail subject line for withdrawal should contain the Solicitation (IFB) number as indicated on the cover page of this Solicitation. The Bidder is solely responsible for ensuring the email is received by HHSC before the Response Deadline. HHSC is not responsible for lost or misdirected e-mails.

4 HHSC Overview The Health and Human Services Commission (HHSC) was created in 1991 to oversee and coordinate the planning and delivery of health and human services in Texas. It is established pursuant to Chapter 531, Texas Government Code and is responsible for oversight of Texas Health and Human Services agencies (HHS Agency).

PCS administers the procurement processes, which include Solicitation announcement and publication, Bidder communications, receipt of Responses, screening of timely received responses, and facilitating the evaluation of qualified Responses. PCS, in coordination with each HHS program, manages the execution of the award, through issuance of Purchase Order(s) or other Contract document, resulting from this Solicitation.

5 Definitions Unless the context clearly indicates otherwise, throughout this Solicitation, the definition given to a term below applies whenever the term appears in this Solicitation, in any Response (Bid) submitted in response to this Solicitation, and in any Contract awarded as a result of this Solicitation. All other terms have their ordinary and common meaning.

a) Addendum – A written clarification or revision to this Solicitation issued by HHSC.

http://www.statutes.legis.state.tx.us/Docs/GV/htm/GV.531.htm

b) Bidder – Entity or individual that submits a response to this Solicitation. This term also includes anyone acting on behalf of the entity or individual that submits a response, such as an agent, employee, or representative. See also Respondent below.

c) Contract – A legally enforceable agreement between two or more parties. As a result of this Solicitation, HHSC may issue a Contract document or Purchase Order (see definition).

d) Contractor - Each Bidder, business entity or individual, if any, awarded a Contract (Purchase Order) to provide the services or goods as a result of this Solicitation.

e) Contract Term – The period of time during which the Purchase Order or Contract is in effect from the start date through the end date and may include renewal or extension periods.

f) Debarment – An exclusion from contracting or subcontracting with state agencies on the basis of cause pursuant to Title 34, Part 1, Chapter 20, Subchapter G of the Texas Administrative Code, and the Federal System for Award Management (SAM).

g) Deliverables – The services or goods specified in this Solicitation and any resulting Contract, that the Contractor shall perform or deliver to the HHS Agency for acceptance.

h) Electronic State Business Daily (ESBD) - The electronic online directory, administered by the Comptroller of Public Accounts, Statewide Procurement Division (SPD), for publishing procurement opportunities which exceed $25,000 in total estimated value and for providing public notice of contract awards. The ESBD may be accessed through the CPA web site at: http://www.txsmartbuy.com/esbd.

Note: The Texas Comptroller of Public Accounts (CPA) recommends utilizing Google Chrome when navigating CPA websites.

i) Exhibit – A document, included as an attachment to this Solicitation, which provides terms and conditions, additional requirements and information related to this Solicitation.

j) HHS Agency - The Texas Health and Human Services Commission (HHSC) and the Texas Department of State Health Services (DSHS), separately or combined.

k) Purchase Order – A legally enforceable agreement between two or more parties. A Purchase Order is issued by HHSC indicating types, quantities, and agreed pricing for services and goods the Contractor will provide. Also considered a Contract.

l) Response – All information and materials submitted in response to this Solicitation. May also be referred to as Bid or Bid Response.

m) Respondent – a term interchangeable with Bidder.

n) Scope of Work – The description of requirements, services, specifications for goods which may be required, and deliverables as provided in this Solicitation and any resulting Contract which the Contractor is required to provide.

o) Solicitation - This document, including all exhibits, attachments, appendices, or Addenda (if applicable). May also be referred to as Invitation for Bid or IFB.

http://www.txsmartbuy.com/sp http://www.txsmartbuy.com/sp http://www.txsmartbuy.com/esbd

p) Subcontractor - Any entity or individual that enters into a contract with the Contractor to perform part or all of the obligations of the Contractor under the Contract.

q) Unit Rate – The set rate per the unit of measure (UOM), used for payment of the services, included on the Price Sheet under the Contract or Purchase Order. (e.g., Hourly, Daily, Weekly, Monthly, etc.).

r) Vendor – A business entity or individual that supplies services or goods and may be a potential Bidder to this Solicitation.

s) TX-RAMP - means the Texas Risk and Authorization Management Plan established by the Texas Department of Information Resources (DIR) that provides a standardized approach for security assessment, authorization, and continuous monitoring of cloud computing services that process the data of a state agency. To become TX-RAMP certified, entities must submit prescribed documentation to DIR. Information regarding TX-RAMP is currently located at: https://dir.texas.gov/texas-risk-and-authorization-management-program-tx-ramp.

t) Texas Identification Number (TIN) – The 11-digit identification number set up through the Texas Comptroller of Public Accounts which is required for any entity or individual to receive payment under a Contract with the State of Texas. Also known as Texas Payee ID Number required in Exhibit A, HHS Solicitation Affirmations. Further information regarding this number may be accessed on the CPA website at https://fmx.cpa.texas.gov/fm/pubs/payment/gen_prov/index.php?s=payee_numreq&p=p ayee_numreq.

6 General Solicitation Information

6.1 Sole Point of Contact and Communications

The HHSC PCS Sole Point of Contact for inquiries concerning this Solicitation is:

Phyllis Benitez, CTCD, CTCM

Procurement and Contracting Services Building

1100 W 49th St. MC: 2020

Austin, TX 78756

512-406-2586 phyllis.benitez@hhs.texas.gov

Bidders shall NOT use the e-mail address above for submission of a Response to this Solicitation.

See Appendix A for submission requirements.

Bidders shall direct all communications, including questions or clarifications relating to this Solicitation, in writing by e-mail to the HHSC PCS Sole Point of Contact named in Section 6.1 (Sole Point of Contact and Communications); communications by phone will not be accepted. See Appendix A for submission requirements. All other communications between a Bidder and HHS https://dir.texas.gov/texas-risk-and-authorization-management-program-tx-ramp https://dir.texas.gov/texas-risk-and-authorization-management-program-tx-ramp https://fmx.cpa.texas.gov/fm/pubs/payment/gen_prov/index.php?s=payee_numreq&p=payee_numreq https://fmx.cpa.texas.gov/fm/pubs/payment/gen_prov/index.php?s=payee_numreq&p=payee_numreq https://fmx.cpa.texas.gov/fm/pubs/payment/gen_prov/index.php?s=payee_numreq&p=payee_numreq mailto:phyllis.benitez@hhs.texas.gov agency staff concerning this Solicitation are prohibited. In no instance is a Bidder to discuss cost information regarding this Solicitation and contained in a Response with the HHSC PCS Sole Point of Contact or any other HHS staff. Failure to comply with these requirements may result in disqualification of the Response.

The Sole Point of Contact will authorize a secondary Sole Point of Contact in the event of their absence and, in such an event, will include the contact information for the secondary Sole Point of Contact in their automatic reply out-of-office e-mail message. Bidders seeking to contact the Sole Point of Contact should do so via e-mail in order to receive updated contact information. See also Section 6.2 (Exception to Sole Point of Contact) below.

This restriction (as to only communicating in writing with the HHSC Sole Point of Contact identified above) does not preclude discussions between Bidder and agency personnel for the purposes of conducting business unrelated to this Solicitation.

6.2 Exception to the Sole Point of Contact

The only exceptions to the Sole Point of Contact are the HUB Coordinator, or, if expressly directed by the Sole Point of Contact, another designated System Agency representative, e.g., during contract negotiations, if allowed due to the circumstances of this procurement; generally, negotiations are not allowed when soliciting with the Invitation for Bid method and there should be no expectation by Bidders that negotiations will be allowed for this procurement.

6.3 Offer Period

By submitting a Response to this Solicitation, Bidder agrees that its Response will remain a firm and binding offer for at least the period of time, 240 days, as stated in the HHS Solicitation Affirmations (Exhibit A).

Bidder may extend the time for which its Response will be honored and include the extended period in the Response.

6.4 Costs Incurred

Bidder understands that issuance of this Solicitation or retention of responses in no way constitutes a commitment by HHSC to award a Contract. HHSC accepts no obligations for cost incurred in preparing and submitting a response, including, but not limited to, preparing for or participating in a vendor conference or site visit.

Responses shall be submitted at the sole expense of the Bidder. All responses shall be prepared simply and economically, providing a straightforward, concise delineation of the Bidder’s capabilities to satisfy the requirements of this Solicitation.

6.5 Changes, Modifications and Cancellation

HHSC reserves the right to change, amend, or modify this Solicitation prior to the Response Deadline indicated in the Procurement Schedule (cover page of this Solicitation). Changes, amendments and modifications will be processed through one or more Addendum. The notification for any Addendum will be processed in accordance with Section 6.8.

HHSC reserves the right to cancel this Solicitation at any time. The notice of cancellation will be in accordance with Section 6.8.

6.6 Ambiguity, Conflict, Discrepancy

Bidders must notify the Sole Point of Contact, Section 6.1, of any ambiguity, conflict, discrepancy, exclusionary specification, omission or other error in the Solicitation in the manner and by the deadline for submitting questions.

If Bidder fails to properly and timely notify the Sole Point of Contact, Section 6.1, of any ambiguity, conflict, discrepancy, exclusionary specification, omission or other error in the Solicitation, the Bidder, whether awarded a contract or not:

a) shall have waived any claim of error or ambiguity in the Solicitation and any resulting contract,

b) shall not contest the interpretation by HHSC of such provision(s), and

c) shall not be entitled to additional compensation, relief, or time by reason of ambiguity, conflict, discrepancy, exclusionary specification, omission, or other error or its later correction.

6.7 Solicitation Questions or Clarifications

HHSC will allow written questions and requests for clarification regarding this Solicitation if submitted by e-mail to the Sole Point of Contact, Section 6.1, by the deadline established in the Procurement Schedule (cover page of this solicitation) or deadlines established in subsequent Addenda. Responses to questions or other written requests for clarification will not be provided individually to requestors but will be consolidated in one or more Addenda.

HHSC reserves the right to amend the answers to questions or clarifications prior to the Response Deadline (cover page of this solicitation) through a new Addendum. The notification will be processed in accordance with Section 6.8 (Notification of Addenda or Cancellation).

6.7.1 Submission of Questions or Clarifications

All questions and requests for clarification must be submitted in writing by e-mail and include the following information:

a) IFB Number and Title of Solicitation (cover page of this Solicitation) must be included in the e-mail subject line and in the e-mail body

b) Section or Paragraph number from this Solicitation

c) Page Number of this Solicitation

d) Exhibit name, Section or Paragraph, page number from the Exhibit

e) Language, Topic, Section Heading being questioned

f) Requestor Contact Information must be included in the body of the e-mail submitted with questions

Questions or requests for clarification received after the deadline set in the Procurement Schedule (cover page of this Solicitation) may be reviewed by HHSC but will not be answered.

6.8 Notification of Addenda or Cancellation

6.8.1 Addenda Notification

Addenda for changes, modifications and answers to questions or requests for clarification as well as subsequent Addenda with amended answers to questions or requests for clarifications, will be posted to the ESBD. It is the responsibility of each Bidder to monitor the ESBD for any Addenda affecting this Solicitation. Failure to check the ESBD will in no way release any Bidder or awarded Contractor from the requirements of posted Addenda. No HHS Agency will be responsible or liable in any regard for the failure of any Bidder or awarded Contractor to stay informed of all postings to the ESBD. If the Bidder fails to monitor the ESBD for any changes or modifications to this Solicitation, such failure will not relieve the Bidder or Contractor of its obligation to fulfill the requirements as posted.

6.8.2 Cancellation Notification

HHSC reserves the right to cancel this Solicitation at any time. Notice of the cancellation will be posted on the ESBD. Bidders are responsible for monitoring the ESBD frequently for notices regarding this Solicitation.

7 Scope of Work (SOW)

7.1 Scope of Services to be Performed

1. Scope of Service Specific Definitions

a. “Deliverables” refers to those implementation deliverables included in the Project Scope in Section 2, Project Scope.

b. “Delivery Team” refers to the Contractor for fulfillment of project scope.

c. “Project” refers to the project that is the cumulation of Deliverables to be provided under this Scope of Work.

d. “Users” refer to the public of state of Texas, who have diagnosed with diabetes or at the risk of having diabetes and need access to diabetes prevention programs.

e. “Customer” refers to the Texas Department of State Health Services (DSHS)

2. Project Scope

a. Inclusions

PCS 137 - IT

Version 1.10 Page 11 of 41 Revised 09/13/2023 a.1. General Program Requirements and Specifications for Software as a Service (SaaS) a.1.1. Feature or Function Requirements:

i. Diabetes Prevention Program services shall be available via an online platform and may have an application for mobile phones (not platform specific).

ii. Must be available in English and other languages to navigate system and for the content.

iii. Online platform shall have engaging curriculum including interactive video lessons; however, data does not need to be retained.

iv. Must allow a single master license holder with multiple sublicensees and allow unlimited participants. May be a tiered pricing structure. Potential sublicensees include, but are not limited to, any clinic, hospital, community organization, health department, which offers diabetes prevention lifestyle change programs. The agency estimates being able to serve up to one hundred (100) organizations as sublicensees and each of those organizations is anticipated to serve a maximum of one-hundred (100) clients at one time.

v. Must have an exercise and meal tracking feature.

vi. Must provide participants with access to a healthy lifestyle coach (software does not have to provide the coach).

vii. Must provide procurement, implementation, training, and initial support of the Software as a Service (SaaS) and ongoing maintenance support.

viii. Software must be a Centers for Disease Control and Prevention (CDC) recognized diabetes prevention program

(DPP).

ix. Customizations required by program shall be delivered by the Delivery Team.

x. Solution must be customizable to the HHS approved look-and-feel and branding.

xi. Email sent from the system must not contain any PII or PHI data.

xii. System must have data encryption (both in-transit and rest) in place.

https://dprp.cdc.gov/Registry

Version 1.10 Page 12 of 41 Revised 09/13/2023 a.1.2. Reporting Requirements:

i. Shall have the ability for DSHS and the sublicensees to create reports (both in- system and exportable) from the users’ activities and information excluding video lessons.

ii. Must provide reporting dashboards for the sublicensees.

iii. Must include demographics (e.g., race, ethnicity, gender, age, insurance status, County, city, region).

iv. Must provide biometric data (e.g., height, weight, blood glucose, A1c).

v. Must provide program specific reports which includes buckets (drill down).

vi. Must provide productivity reports for program management.

vii. Must be customizable (reports created by program)/Ad-hoc reports.

a.1.3. User Access Level Requirements:

i. Shall send and access secure communications among sub-licensees and participants.

ii. Shall have the ability to allow for 24/7 access from any smart phone, tablet, and computer with cross-browser compatibility and highly mobile.

iii. Shall have the ability to design and manage user roles, access, and permissions for users.

iv. Shall have accessibility for Users.

v. The Contractor shall provide VPAT (Voluntary Product Accessibility Template) documentation applicable with Section 508 standards.

a.1.4. Interfaces Requirements:

i. The system shall be accessed using customized URL (Domain Name System- DNS).

ii. May integrate with Fitbit 1.

a.1.5. Security Requirements:

i. Security – SaaS should be Health Insurance Portability and Accountability Act( HIPAA) , PHI (Protected Health Information) and PII (Personally identifiable information) complaint.

ii. Shall have the ability to keep security related information from being viewed by staff and/or users not having a need to access the data.

iii. SaaS solution must meet National Institute of https://www.section508.gov/sell/vpat/ https://www.access-board.gov/ict/ https://www.hhs.gov/hipaa/index.html

Version 1.10 Page 13 of 41 Revised 09/13/2023

Standards Technology (NIST) requirements (SP 800- 145).

iv. Must inform DSHS of unplanned downtimes within twenty-four (24) hours.

v. Must inform DSHS of planned downtime or operational changes within forty-eight (48) hours.

vi. Must provide for the return or migration of data in a standard format from the SaaS platform as needed.

vii. Must follow HHS Policy for Records Management

viii. Must provide a system architecture.

ix. Must provide for disaster recovery.

x. Must provide for performance monitoring and management in the form of reports.

xi. Product shall be able to integrate with HHS Enterprise IAM (Identity and Access Management) solution for the user provisioning, authentication and authorization using Security Assertion Markup Location (SAML) or OpenID Connect (OIDC), or Open Authorization (OAUTH), or Header Based Authentication method. IT systems must use role-based access controls instead of individual access controls to manage access to the applications. IT systems must integrate with the HHS IAM system for user onboarding, role provisioning, role deprovisioning, and user termination. Participants (Public of Texas) will not need an access to IAM Online accounts. Common Example of this integration can be webservice (REST / SCIM / SOAP), database stored procedure or any other mechanism when IAM system can manage users in application repository.

xii. The Contractor must provide a penetration testing report (or summary), self-attest, or use a third-party report (example SOC report) to meet the criteria.

a.1.6. Training and Support:

i. Delivery Team must complete Implementation, training, and initial support of the Software as a Service (SaaS) and ongoing maintenance support.

b. Exclusions b.1. Installation of the software in the data center.

b. 2. Anything not listed above is excluded from scope of the Project.

c. Assumptions https://csrc.nist.gov/publications/detail/sp/800-145/final https://csrc.nist.gov/publications/detail/sp/800-145/final https://www.hhs.gov/web/governance/digital-strategy/it-policy-archive/hhs-ocio-policy-for-records-management.html

Version 1.10 Page 14 of 41 Revised 09/13/2023

Project Duration:

The duration for Contractor to complete processing through Procurement and Contracting Services (PCS), and privacy and security team is not included in this rough order of magnitude (ROM).

The state staff duration is based on the HHS Information Technology (IT) team time required to understand the product, and how to integrate the services with the agency system.

Software purchased will not need to interact with other systems.

Implementation shall be approximately eight (8) through ten (10) weeks.

3. Responsibilities

a. Delivery Team Responsibilities a.1. Shall provide a detailed Project plan.

a.2. Shall work closely with agency to ensure all the requirements for program and end-user are met.

a.3. Shall engage with Customer throughout the Project, keeping Customer informed of timelines and progress toward completion throughout the Project.

a.4. Shall complete all items listed under delivery team responsibilities and the tasks listed under inclusions of Project Scope a.5. Shall share training resources as appropriate for each deliverable, which may be in the form of live online training, online materials, and/or free online webinars.

a.6. Shall offer guidance and support required to ensure customer can fulfill responsibilities listed under Project scope and Delivery team for each deliverable.

a.7. For projects that involve a new license setup, shall provide initial configuration of license.

a.8. Delivery team shall continue to onboard sublicensees after Project is complete or train Customer to be able to manage the program when the Project is complete. Please see Project scope inclusions and a list of Delivery Team and Customer responsibilities.

a.9. Shall prepare deployment documentation.

a.10. Shall deploy product.

a.11. Shall prepare help text.

a.12. Shall prepare technical specifications.

a.13. Shall prepare prototype (if applicable).

a.14. Shall prepare release notes.

Version 1.10 Page 15 of 41 Revised 09/13/2023 a.15. Shall provide training and knowledge transfer.

a.16. Shall provide user training, user manual and knowledge transfer to the Program staff.

b. Customer Responsibilities b.1. Shall engage actively throughout the Project, following a cadence decided in agreement with the Delivery Team during kickoff call; changes or cancellations of any meetings require twenty-four (24) hour notice to avoid forfeiture of allotted time.

b.2. Shall ensure Project stays on time by approving deliverables timely and answering questions timely.

b.3. Shall ensure program team members do not add deliverables beyond the original agreed upon scope. Any change in scope must be approved by ESC (Executive Steering Committee) and PCR (Project Change Request) will be completed timely.

b.4. Shall manage User Acceptance Testing (UAT) process and any special testing requirements, ensuring that each stage of the Project is complete, and the scope of work has been met. This may include:

b.4.1. Uploading sample data to the Contractor’s platform to test system functionality and license settings.

b.4.2. Validating that scoped features and settings were implemented correctly and meet the requirements of the Project.

b.4.3. Engaging other stakeholders within Customer’s organization as needed to test technical or functional aspects of the Contractor’s platform.

b.5. As needed, provides resources to fill all required roles for successful implementation, which may include Project sponsorship, signatory, stakeholder management, Project coordination, customer experience lead, technical lead, operational support.

b.6. Completes all steps listed under customer responsibilities or each applicable deliverable included in Project scope.

b.7. Maintains all features included in the license after the implementation period, including any updates to deliverables created during the Project, as well as the creation of any new deliverables, including surveys and dashboards.

b.8. For projects that involve a new license setup, provides required information for setup of brand administrator accounts; brand administrator admin users/Customer may create additional user accounts and manage access to the license, in accordance with any limitations

Version 1.10 Page 16 of 41 Revised 09/13/2023 specified in the license terms.

4. Governance

a. Delivery Team will coordinate with Customer to schedule a Project kickoff call, at which time the Project begins. Timing of kickoff call will be mutually agreed between Delivery Team and Customer based on Delivery Team availability and Customer’s milestones. It is estimated that the Project will begin after this agreement has been fully executed.

b. The Project is complete based on completion of delivery and Customer's acceptance, per the terms of the Acceptance Criteria listed in “5. Acceptance Criteria” below.

c. Unless otherwise agreed by both parties in writing, all interactions and meetings will be conducted in English, and will be conducted remotely, via phone, email, or videoconference.

d. Conduct meetings/work sessions with HHS key stakeholders and subject matter experts to confirm the business requirements.

e. Develop product using HHS approved processes.

f. Deliverables must be provided on the dates specified. Any changes to the delivery date must have prior approval (in writing) by the Customer contract manager or designate.

g. Provide product demos on a mutually agreed up on cadence.

h. Provide weekly written progress report on a mutually agreed up on day of the week.

i. The progress report shall identify any problem encountered or outstanding item hindering the Project progress.

j. The Project plans for the Project and transition provided by the Delivery team needs to be approved by the Customer.

k. Monitor and track progress toward completion of the Scope of Work.

5. Acceptance Criteria

a. Once a Project phase is completed and the Delivery Team provides notification of the Deliverables for review and approval, the Customer will either (1) confirm the requirements have reasonably been met and sign off on the approval for the next implementation phase to begin (2) reply to the Delivery Team, in writing, detailing the specific requirements that must still be met. Upon mutual agreement, both parties may agree to extend the time period for UAT, though additional time may impact Project timelines and budget and be subject to a Change Order (as defined below).

b. Ensures that all Deliverables are reviewed and signed off according to the following

Version 1.10 Page 17 of 41 Revised 09/13/2023 process:

b.1. Delivery Team will submit final drafts for review and sign-off at least five

(5) business days prior to the Deliverable completion date.

b.2. Customer will sign off or report any issues within five (5) business days of draft submission.

b.3. The Delivery Team will correct reported issues within a mutually agreed time frame.

b.4. Customer will provide written feedback and raise issues related to the reworked portion of the Deliverable within a mutually agreed time frame, and the Delivery Team will make changes necessary to resolve the issues.

b.5. Customer will provide final review and signoff on the reworked Deliverables within two (2) business days.

b.6. Deliverables will be considered accepted if the Customer does not provide written notification of Deliverable rejection within the timelines specified above.

c. Application response time should be less or equal to a sub second

d. Application availability should be 99.5%

e. If application is down for more than twelve (12) hours, credits or reduction for invoiced services shall be applied by the Contractor.

6. Change Orders

a. If Customer or Delivery Team wishes to change the scope of the Project, they will submit details of the requested change to the other in writing. Delivery Team will, within a reasonable time after such request is received, provide a written estimate to Customer of changes to Project cost, timeline, and/or scope.

b. Promptly after receipt of the written estimate, Customer and Delivery Team will negotiate and agree in writing on the terms of such change (a “Change Order”).

Each Change Order complying with this Section will be considered an amendment to this Service Order.

7. Texas Risk and Authorization Management Program

The Contractor shall comply with the program requirements of TX-RAMP as they currently exist and as amended throughout the Contract Term. Commencing on the Effective Date, the Contractor shall have achieved TX-RAMP Level 2 Certification, and the Contractor must maintain such certification for the duration of the Contract Term.

At the sole discretion of HHSC, the Contractor’s attainment of TX-RAMP Provisional Certification may satisfy the TX-RAMP Certification Level 2 requirement for the length of

Version 1.10 Page 18 of 41 Revised 09/13/2023 active TX-RAMP Provisional Certification. If HHSC permits TX-RAMP Provisional Certification, the Contractor is solely responsible for obtaining and maintaining TX- RAMP Level 2 Certification prior to the expiration of TX-RAMP Provisional Certification.

Contractor acknowledges that HHSC shall not provide Agency-sponsored Interim Provisional Certification or otherwise assist Contractor in Contractor’s compliance with TX-RAMP requirements.

In addition, Contractor shall

a. Upon HHSC’s request, provide Contractor’s submission(s) to DIR that supports DIR’s approval of certification status and respond to HHSC and DIR TX-RAMP staff inquiries promptly;

b. Provide written notification to HHSC of any lapse in TX-RAMP certification including, but not limited to, DIR revocation of TX-RAMP certification within two (2) business days of Contractor’s discovery of non-compliance with TX-RAMP requirements;

c. Complete all TX-RAMP monitoring reports required by DIR and submit copies of reports to HHSC on or before the second (2nd) business day following the DIR submission deadline;

d. Routinely assess and monitor for compliance with required security controls and demonstrate that the security posture of the cloud computing services offered is acceptable to maintain TX-RAMP certification;

e. If the Contractor has TX-RAMP Provisional Certification, provide a progress update to HHSC on Contractor’s application for TX-RAMP Level 2 Certification no later than the third (3rd) business day of each calendar month, unless HHSC requires more frequent reporting, until the expiration of the TX-RAMP Provisional Certification; and

f. If the Contractor has TX-RAMP Level 2 Certification, commencing six months prior to the expiration date of the TX-RAMP Level 2 Certification, provide a progress update to HHSC on Contractor’s application for renewal or extension of its TX-RAMP Level 2 Certification no later than the third (3rd) business day of each calendar month, unless HHSC requires more frequent reporting.

The Contractor’s failure to comply with any TX-RAMP requirements including, but not limited to, continuous maintenance of the minimum certification required by the Contract shall constitute a material breach of contract, and HHSC reserves the right to hold Contractor accountable by taking any remedial or corrective actions available under the Contract, at law, or in equity.

7.1.1 Service Location(s)

The required services will be performed virtually or at the Contractor’s location with no on-site component. HHSC, at its sole discretion, during the contract term and with a 30 days’

Version 1.10 Page 19 of 41 Revised 09/13/2023 advance written notice, reserves the right to change, consolidate, delete or add service locations.

Contractor and Contractor’s personnel assigned to provide the services shall be physically located within the United States of America, consisting of the fifty (50) states and the District of Columbia.

7.1.2 Performance Schedule

Contractor shall perform contracted services, including any minor adjustment call-back services, Monday through Friday between the hours of 8:00 a.m. and 5:00 p.m. (Central Time).

Contractor shall not interfere with normal flow of business at the service location.

Contractor shall respond to all service calls within four (4) hours of HHS Agency request unless the Response Deadline is extended by the HHS Agency Contract Manager.

7.1.3 Outside Regular Hours

Any services performed outside of regular work hours must be approved by the HHS Agency Contract Manager and will be paid at the hourly rate stated in Exhibit D – Pricing Sheet.

HHS Agency reserves the right to declare any necessary work to be an emergency. Services performed by the Contractor outside of the regular service hours, without prior approval, will be at Contractor’s own risk and not considered or approved for payment at other than the established regular hours service rate.

7.1.4 State Holidays

The state holidays observed are maintained by the State Auditor’s Office and may be accessed at: http://www.hr.sao.texas.gov/Holidays. HHS Agency does not specifically require services to be performed on these holidays.

To fulfill the required services, as applicable, the Contractor may perform the services on a holiday observed by HHS at NO additional expense to the HHS Agency.

Performance of services on a state holiday requested by HHS Agency will be performed and invoiced at the Contract rate for Outside Regular Hours.

7.1.5 Minimum Experience and Qualifications

These minimum requirements apply to the Contractor and Contractor’s personnel and any Subcontractor and Subcontractor’s personnel.

Documentation of experience and qualifications must be submitted with Response, if requested in Exhibit D – Pricing Sheet.

a) The Bidder shall have relevant experience required for the performance of the services as outlined in this Solicitation. The minimum experience required is two (2) years.

http://www.hr.sao.texas.gov/Holidays

Version 1.10 Page 20 of 41 Revised 09/13/2023

b) Required Licensure and Accreditation: The Bidder must provide proof of Centers for Disease Control and Prevention (CDC) recognition as a diabetes prevention program

(DPP).

c) TX-RAMP Documentation - In its Solicitation Response, Respondent must provide one of the following:

i. If Respondent has attained TX-RAMP Level 2 Certification, provide DIR-issued TX- RAMP Identification Number(s);

ii. If Respondent has attained TX-RAMP Provisional Certification, provide (1) DIR-issued TX-RAMP Identification Number(s) and (2) Respondent’s submission(s) to DIR to support DIR’s approval of certification status;

iii. If Respondent has not attained either TX-RAMP Level 2 Certification or TX-RAMP Provisional Certification, provide (1) evidence that the TX-RAMP Acknowledgment and Inventory Questionnaire has been filed with DIR and (2) a copy of Respondent’s application and any supporting documentation filed with DIR seeking TX-RAMP Provisional Certification.

If Respondent has not attained TX-RAMP Level 2 Certification at time of submission of its Solicitation Response, Respondent shall provide, in its Solicitation Response, Respondent’s proposed plan and approach to attaining TX-RAMP Level 2 Certification which includes the following:

i. Respondent must clearly identify and describe each Service affected by the TX- RAMP Provisional Certification; and

ii. Respondent must explain its strategy and anticipated timeline to achieve TX- RAMP Level 2 Certification, including identification of key milestones, significant deadlines, monitoring mechanisms to track progress, and contingency measures to address any challenges or delays.

d) The Bidder must provide a minimum of three (3) verifiable references for current or previous contracts of the same size and for similar or same services within the last two

(2) years. See Exhibit E – Bidder Reference Form.

7.1.6 Contractor Responsibilities

HHSC will look solely to the Contractor(s) for the performance of all contractual obligations resulting from an award based on this Solicitation. No Contractor will be relieved of its obligations for any nonperformance by its Subcontractor(s).

a) The Contractor shall furnish all labor, tools, transportation, equipment, materials, and supplies, as necessary to perform the services and/or provide the goods, if applicable, as required.

The Contractor shall comply with all federal, state and local laws, statutes, ordinances, rules and regulations, and the orders and decrees of any court or administrative bodies or tribunals

Version 1.10 Page 21 of 41 Revised 09/13/2023 in any matter affecting the performance of the Contract including, if applicable, workers’ compensation laws, minimum and maximum salary and wage statutes and regulations, and licensing laws and regulations.

Training for Contractor Employees:

All Contractor employees, and Subcontractor’s employees, if applicable, assigned to perform the services must be trained and experienced in the type of work to be performed. The Contractor shall provide adequate training to all personnel assigned to perform the services on the roles, responsibilities and technical aspects of the work.

The Contractor shall only provide and allow trained and qualified personnel to perform the required services under the Contract.

The Contractor is required to provide current copies of the completed training(s) and of the license or accreditation certificate related to the training upon request by the HHS Agency Contract Manager. This requirement applies to Subcontractor(s) and Subcontractor’s personnel who may be used in the performance of services.

7.1.7 Independent Contractor

It is understood and agreed by the HHS Agency and the Contractor that the Contractor is retained as an independent Contractor and in no event shall any employee hired by the Contractor be considered an employee of the State.

a) The Contractor shall not allow any visitors, spouses, children or other relatives of the Contractor’s or Subcontractor’s employees to be on state property in connection with the Contract during working hours.

b) The Contractor shall be responsible for all employment taxes and other payroll withholding for its employees.

c) The Contractor shall be responsible and liable for the safety and health of its personnel while they are performing work for an HHS agency and while on the HHS Agency premises.

d) The Contractor shall be responsible for verifying that all of its employees assigned to perform services under the Contract are in compliance with all requirements of the Immigration Reform and Control Act of 1986, Public Law 99-603, which became effective November 6, 1986, and any subsequent amendments.

e) The Contractor and the assigned Contractor employees or the Contractor’s Subcontractor and Subcontractor employees assigned to perform the services must have all applicable permits, licenses, accreditations and insurance coverage.

7.1.8 Contractor Equipment

The Contractor shall be responsible for the security, maintenance, loss or damage to its equipment or its Subcontractor’s equipment while on HHS Agency premises.

Version 1.10 Page 22 of 41 Revised 09/13/2023

HHS Agency will NOT be held responsible for damage to or loss of the Contractor’s or Subcontractor’s equipment while on HHS Agency premises, while in route to the HHS Agency or in route back to Contractor’s location.

7.1.9 Telephone Service

The Contractor shall have an active telephone service answered during normal business hours.

Normal business hours are between 8:00 a.m. and 5:00 p.m. Monday through Friday, unless otherwise stated in the Solicitation.

7.1.10 24-Hour Contact The Contractor must provide, in Exhibit C – Bid Execution Page, the HHS Agency Contract Manager with 24-hour contact information for a minimum of two (2) Contractor personnel so the HHS Agency may communicate urgent performance issues that require immediate correction or any other issues that may occur. The Contractor’s 24-hour contact must always be available. Any urgent performance issues requiring immediate correction will be followed up in writing by the HHS Agency Contract Manager.

7.1.11 Contractor and Contractor Personnel Conduct

All personnel employed by the Contractor to fulfill the requirements and terms and conditions of the Contract remain under the Contractor’s sole direction and control.

The following applies to the Contractor, Contractor employees, and, if applicable, the Contractor’s Subcontractor and Subcontractor’s employees.

7.1.11.1 Performance Compliance

While performing the services, all Contractor and Subcontractor personnel must comply with all applicable state rules, regulations, and HHS Agency’s requests regarding personal and professional conduct applicable to the services being provided as well as the service locations.

All personnel must always conduct themselves in a businesslike and professional manner.

If the HHS Agency determines in good faith that an employee of the Contractor or Subcontractor is not conducting himself or herself in accordance with the conduct standards under this Contract, the HHS Agency may provide written notice to the Contractor. Upon receipt of such notice, Contractor must promptly investigate the matter and take appropriate action that may include:

a) Removing the employee from the project;

b) Providing the HHS Agency with written notice of such removal; and

c) Providing the HHS Agency with the information for the replacement employee, who must be qualified and trained, within the timeline designated by the HHS Agency.

7.1.11.2 Contractor Supervisor(s) and Performance Monitoring

Version 1.10 Page 23 of 41 Revised 09/13/2023

The Contractor shall provide competent supervisor(s), if the service location is at an HHS Agency facility. A Supervisor may be considered a roving Supervisor to monitor more than one location with approval from the HHS Agency Contract Manager.

All supervisors must be able to communicate in English verbally and in writing. The supervisor shall be knowledgeable of the Statement of Work (SOW) and requirements of the Contract.

The Contractor and the supervisors shall continuously monitor and maintain awareness, by personal inspection, of the quality and completeness of the work being performed. The Contractor and supervisor may be requested and required to inspect the HHS Agency facility with the HHS Agency Contract Manager or designee.

7.1.11.3 Personnel Removal and Replacement

a) Removal

The HHS Agency may request removal of any Contractor or Subcontractor employee assigned to the Contract for cause, including but not limited to:

1. poor or unacceptable work performance,

2. theft,

3. abusive language or behavior, or

4. improper attire, in accordance with the terms and conditions of the Contract.

Occurrences of this type may be cause for termination of the Contract.

b) Replacement

Replacement of Contractor or Subcontractor personnel will be subject to HHS Agency review and approval. At the request of the HHS Agency, the Contractor must replace, any Contractor or Subcontractor personnel who are not adequately performing the required services or who are unable to work effectively with the HHS Agency Contract Manager or other HHS staff. The Contractor will provide replacement personnel who have the required qualifications and training as outlined in this Solicitation and resulting Contract. The Contractor and HHS Agency Contract Manager will work together in the event of any such required replacement to prevent disruption in the services or performance schedule and will mutually agree upon the timeline for the replacement.

7.1.11.4 Intoxicants and Illegal Drugs Prohibited

The use or possession of any kind of intoxicants or illegal drugs while employees are on duty at HHS Agency premises, including the building and grounds, is prohibited. At the sole discretion of the HHS Agency, non-compliance with this requirement may result in termination of the Contract.

7.1.11.5 Smoking Prohibited

Version 1.10 Page 24 of 41 Revised 09/13/2023

All HHS Agency facilities are nonsmoking buildings. Contractor’s and Subcontractor’s employees are prohibited from smoking in all non-designated areas.

8 HUB Subcontracting Plan (HSP)…