Exhibit_10_-_Requirements_Traceability_Matrix.xlsx
XLSX spreadsheet 72 KB Posted
- Attached to
- EDE-first State Based Exchange
- Solicitation number
- EV00000956
- Issued by
- Oklahoma
About this file
This is a Requirements Traceability Matrix (RTM) for a State-Based Exchange Technology Platform contract with the State of Oklahoma. The document outlines comprehensive functional, technical, implementation, and service center requirements that bidders must address in their proposals. The solution encompasses an EDE-first enrollment model supporting Oklahoma Enrollment Partners (OKEPs) and a consumer-facing portal, integrated eligibility and enrollment services, issuer and plan management capabilities, navigator and agent/broker support, document management, and customer support center functions. The platform must operate within a State-owned and governed cloud environment aligned with Oklahoma OMES enterprise architecture standards, support seamless data exchange across multiple external partners including CMS, issuers, and state agencies, and maintain full State ownership of all data, configurations, and developed intellectual property. The contract requires the solution to accommodate peak demand periods such as Open Enrollment and Special Enrollment Periods while ensuring scalability, interoperability, and long-term sustainability without vendor lock-in.
The RTM is organized into five primary requirement categories: Program Foundations (19 requirements establishing overarching principles and constraints), Technical (124 requirements covering solution architecture, development standards, integrations, performance, data management, security, privacy, and quality assurance), Functional (70 requirements detailing portal capabilities, application processing, eligibility determinations, shopping and enrollment, notices, issuer management, and assister/broker support), Service Center (35 requirements for consumer support, document management, and outbound communications), and Implementation (62 requirements addressing project management, implementation support, operations and maintenance, capacity and scalability, disaster recovery, training, and EDE channel management). Bidders must complete the RTM by selecting from standardized response options indicating whether they will fully meet, partially meet, meet through third-party integration, or not meet each requirement, with space provided for bidder notes and explanations. The document emphasizes compliance with federal regulations including 45 CFR Part 155, CMS standards, HIPAA, IRS Publication 1075, OMES security requirements, and state-specific rules, with particular focus on data security, accessibility standards (WCAG 2.2 and ADA compliance), audit trails, and program integrity controls.
View the file
Other files
Show all 29
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Requirement Categories
| Bidders shall complete this Requirements Traceability Matrix (RTM) in accordance with the Instructions for Requirements Traceability Matrix (RTM) Exhibit 10. Failure to follow these instructions may result in reduced evaluation scores. | ||
| Requirement Category | Requirement Sub-Category | Description |
| Program Foundations | Program Foundations | Requirements describe the overarching principles, constraints, and expectations that govern the design, implementation, and operation of the Exchange solution. This includes alignment to an EDE-first State-Based Exchange model supporting both OKEPs and a consumer-facing portal, operation within a State-owned and governed cloud environment, defined roles across the partner ecosystem (including OKEPs, issuers, and State agencies), compliance with applicable Federal and State requirements, and expectations for data ownership, flexibility, scalability, interoperability, and long-term sustainability. |
| SBE Functional | Anonymous Shopping | Requirements describe the functionality and features necessary to enable consumers to preview eligibility and plan options without establishing an Exchange account. Includes anonymous shopping capabilities available through supported enrollment channels, including the consumer-facing portal and OKEPs, to support pre-screening, plan comparison, and provider search capabilities. |
| SBE Functional | User Portal | Requirements describe the functionality and features required across supported enrollment and operational portals, including the consumer-facing portal, assister, agent/broker, and administrative users. Focus includes account creation, authentication, profile management, role-based access, secure communications, and shared account management capabilities across enrollment channels. |
| SBE Functional | Application and Eligibility | Requirements describe the functionality and features necessary to support the intake, processing, and determination of eligibility for enrollment in QHPs, SADPs, Medicaid, APTC, and other applicable programs. Includes integration with Federal and State data sources and account transfer capabilities. |
| SBE Functional | Shopping and Enrollment | Requirements describe the functionality and features necessary to support consumer shopping, plan comparison, decision support tools, and enrollment processes across supported enrollment channels, including the consumer-facing portal and OKEPs. |
| SBE Functional | Notice Management | Requirements describe the functionality and features necessary to generate and distribute notices and communications to consumers and other user groups in accordance with Federal and State requirements. Includes content management, delivery tracking, communication preferences, auditability, and support for electronic and outbound mail communications. (Physical mail excluded; handled outside the Exchange solution.) |
| SBE Functional | Issuer and Plan Management | Requirements describe the functionality and features necessary to support issuer participation, including plan submission, certification, management of QHPs/SADPs, and coordination with SERFF and related processes. |
| SBE Functional | Navigator/Assister Management | Requirements describe the functionality and features necessary to support certified Navigators and Assisters in assisting consumers with application, eligibility, and enrollment activities. |
| SBE Functional | Agent / Broker Management | Requirements describe the functionality and features necessary to support licensed agents and brokers in assisting consumers, including registration, certification, relationship management, and access to consumer data as permitted. |
| SBE Functional | Consumer-Facing Portal and Shared Services | Requirements describe the functionality and features necessary to support licensed agents and brokers in assisting consumers, including registration, certification, relationship management, and access to consumer data as permitted. |
| SBE Technical | Solution Architecture | Requirements describe the overall system architecture, including modular design, scalability, interoperability, and alignment with State-managed cloud environments and OMES enterprise architecture standards. |
| SBE Technical | Development | Requirements describe the standards, tools, and methodologies used to design, build, configure, and deploy the solution, including coding practices, version control, and release management processes. |
| SBE Technical | Integration | Requirements describe the system interfaces, APIs, shared services, and data exchange mechanisms necessary to support secure, real-time integration across the Exchange ecosystem, including CMS, OKEPs, the consumer-facing portal, issuers, OHCA, and other external partners. |
| SBE Technical | Availability and Performance | Requirements describe expectations for system uptime, performance, scalability, and responsiveness, including support for peak demand periods such as Open Enrollment and Special Enrollment Periods. |
| SBE Technical | Reporting and Analytics | Requirements describe the functionality and features necessary to support operational, performance, financial, and Federal reporting, including dashboards, ad hoc reporting, and real-time analytics. |
| SBE Technical | Data Management | Requirements describe the standards, architecture, and processes for managing data across the solution, including data governance, data quality, security, storage, and accessibility. |
| SBE Technical | Security and Privacy | Requirements describe the controls and safeguards necessary to protect sensitive data, including PII and FTI, and ensure compliance with applicable Federal and State security and privacy requirements. |
| SBE Technical | Quality Assurance | Requirements describe the processes, tools, and capabilities required to support testing, validation, defect management, and continuous quality improvement across the solution lifecycle. |
| Implementation | Project Management and Governance | Requirements describe expectations for planning, governance, coordination, and oversight of implementation and operations, including stakeholder engagement, risk management, and alignment with CMS and State requirements. |
| Implementation | Implementation Support | Requirements describe the activities, plans, and supporting capabilities required to successfully design, build, test, and deploy the solution, including migration, integration, and readiness activities. |
| Implementation | Operations and Maintenance Support | Requirements describe the ongoing operational support model, including monitoring, incident management, configuration management, and continuous improvement of the solution. |
| Implementation | Capacity, Scalability, and Extensibility | Requirements describe the ability of the solution to scale and adapt to changing demand, integrate with additional partners, and support future program expansion without significant redesign. |
| Implementation | Disaster Recovery and Business Continuity | Requirements describe the capabilities required to ensure system resilience, recovery, and continuity of operations in the event of disruptions, including testing and validation of recovery processes. |
| Implementation | Training | Requirements describe the development and delivery of training and knowledge transfer to ensure Exchange staff and stakeholders can effectively operate and support the solution. |
| Implementation | EDE/Enrollment Channel Management and Support | Requirements describe the processes, tools, governance, and operating model necessary to support and manage the Exchange’s enrollment channel ecosystem, including OKEPs, the consumer-facing portal, and other authorized enrollment participants. |
| Service Center | Consumer Support | Requirements describe the functionality and features necessary to support Customer Support Center operations, including case management, CRM capabilities, escalation handling (Tier 2 and Tier 3), document processing, and coordinated consumer support across OKEPs, the consumer-facing portal, and Exchange operations. |
| Service Center | Document Management | Requirements describe the functionality and features necessary to support document management across supported enrollment channels, including document upload, indexing, routing, processing, retention, and audit tracking. Physical inbound mail intake may be managed through approved operational channels outside the Exchange solution. |
| Service Center | Outbound Mail | Requirements describe the functionality and features necessary to support outbound communications management, including notice generation, printing, tracking, returned mail handling, digital document management, and communication delivery across supported enrollment channels. |
&1#&"Calibri"&10&K000000Confidential
Program Foundations
| ID # | Category | Sub-Category | Requirement | Bidder Response | Bidder Notes |
| OPR-001 | Program Foundations | Program Foundations | The solution shall support an EDE-first operating model in which consumer enrollment activities may be performed through both approved Oklahoma Enrollment Partners (OKEPs) and a consumer portal, with OKEPs serving as the primary enrollment channel. | ||
| OPR-002 | Program Foundations | Program Foundations | The solution shall support a consumer portal integrated with shared Exchange services, including eligibility, enrollment, account management, and consumer support capabilities, while also supporting distributed enrollment through OKEPs. | ||
| OPR-003 | Program Foundations | Program Foundations | The solution shall not require or include separate agent, broker, navigator, or call center-facing portals, and shall instead support all partner interactions through the EDE ecosystem and integrated operational tools. | ||
| OPR-004 | Program Foundations | Program Foundations | The solution shall enable the Exchange to maintain centralized oversight of eligibility, enrollment, program integrity, and partner operations across a distributed ecosystem. | ||
| OPR-005 | Program Foundations | Program Foundations | The solution shall support coordination across multiple external partners, including OKEPs, issuers, CMS, and State agencies, without requiring custom development for each integration. | ||
| OPR-006 | Program Foundations | Program Foundations | The solution shall ensure that the State retains full ownership of all data, system configurations, interfaces, and solution artifacts developed under the contract. | ||
| OPR-007 | Program Foundations | Program Foundations | The solution shall support full data portability, including the ability to export all data in non-proprietary formats without vendor dependency. | ||
| OPR-008 | Program Foundations | Program Foundations | The solution shall be deployed within a State-managed environment and operate in alignment with Oklahoma OMES enterprise architecture standards. | ||
| OPR-009 | Program Foundations | Program Foundations | The solution shall support a modular and decoupled architecture that enables component-level replacement, enhancement, or transition without requiring full system replacement. | ||
| OPR-010 | Program Foundations | Program Foundations | The solution shall support a distributed and multi-channel enrollment model in which consumer transactions may be initiated and managed through OKEPs and a consumer portal, while the Exchange coordinates eligibility, enrollment, and data exchange services. | ||
| OPR-011 | Program Foundations | Program Foundations | The solution shall support scalable operations to accommodate enrollment growth and peak demand periods, including Open Enrollment and Special Enrollment Periods. | ||
| OPR-012 | Program Foundations | Program Foundations | The solution shall comply with all applicable Federal and State requirements, including CMS, ARCH-AMP/MARS-E, HIPAA, IRS Pub 1075, and OMES security standards. | ||
| OPR-013 | Program Foundations | Program Foundations | The solution shall support ongoing operations, including monitoring, incident management, and continuous improvement, without requiring significant State operational overhead. | ||
| OPR-014 | Program Foundations | Program Foundations | The solution shall support escalation from Tier 1 consumer support functions, including support provided through OKEPs and/or contact center staff, to Tier 2 (Operational Support) and Tier 3 (Program Oversight), and shall ensure that functions reserved for the State are not performed by the Supplier without explicit State authorization. | ||
| OPR-015 | Program Foundations | Program Foundations | The solution shall utilize open standards, APIs, and reusable integration patterns to enable interoperability with current and future partners. | ||
| OPR-016 | Program Foundations | Program Foundations | The solution shall support a unified and modular Exchange architecture in which OKEPs, a consumer portal, and authorized ecosystem participants utilize shared eligibility, enrollment, workflow, account management, and integration services. | ||
| OPR-017 | Program Foundations | Program Foundations | The solution shall support future flexibility, including the ability to modify enrollment channel strategies to expand EDE operational approaches (such as EDE-only) should future Federal guidance permit. | ||
| OPR-018 | Program Foundations | Program Foundations | The solution shall support compliant State-Based Exchange consumer-facing capabilities, including consumer account management, eligibility workflows, enrollment support, notices, and document submission functionality. | ||
| OPR-019 | Program Foundations | Program Foundations | The solution shall maintain consistent eligibility, enrollment, notices, and consumer data across both partner-operated and consumer-facing enrollment channels. |
Technical
| ID # | Category | Sub-Category | Requirement | Bidder Response | Bidder Notes |
| TECH-001 | Technical | Solution Architecture | The vendor shall design and implement a solution that supports security, scalability, interoperability, and operational sustainability consistent with Federal and State requirements. | ||
| TECH-002 | Technical | Solution Architecture | The solution shall be deployed within a cloud environment that is owned and governed by the State of Oklahoma. The vendor shall be responsible for provisioning, configuration, and operation of the solution within the State-managed environment and shall not host the solution in a vendor-owned or third-party commercial cloud environment. | ||
| TECH-003 | Technical | Solution Architecture | The vendor shall develop solution architecture, integration patterns, data flows, and system lifecycle that complies with Oklahoma Office of Management and Enterprise Services enterprise reference and technical architecture standards. All architectural characteristics must be implemented within the State-owned and State-governed cloud environment. | ||
| TECH-004 | Technical | Solution Architecture | The vendor shall develop, maintain, and provide Solution Architecture Documentation that includes, at a minimum, the overall solution architecture; details of all software products and hardware (virtual or otherwise); diagrams illustrating system connections and integration interdependencies; and the programming languages used for development. | ||
| TECH-005 | Technical | Solution Architecture | The vendor shall design and implement a solution architecture that supports modular deployment of functionality that can be added or removed without codebase changes; enables integration across solution components without customization; supports execution of all annual and special open enrollment periods without requiring change orders; decouples transaction logic from business rules; and enables administration of business rules by designated Exchange users. | ||
| TECH-006 | Technical | Solution Architecture | The vendor shall design and implement a solution architecture that supports changes to infrastructure and components without compromising availability; enables testing and validation outside of production prior to deployment; automates migration and deployment across environments; provides isolation and separation of technical environments and tenant environments, where applicable; complies with Exchange security architecture requirements by ensuring servers and application processes are not located in the DMZ and utilize internal service APIs; and provides high availability through redundancy across U.S.-based geographically diverse data centers, session replication, transparent failover, and performance parity between primary and failover environments. | ||
| TECH-007 | Technical | Solution Architecture | The vendor shall design and implement a solution architecture that enables access to all functionality without degradation across all user types and devices, regardless of operating system; and supports concurrent user activity, including the ability to view and simultaneously create, read, update, and delete transactions on the same records, documents, templates, and forms. | ||
| TECH-008 | Technical | Solution Architecture | The solution must be deployed in a State-owned and State-governed cloud environment, with the vendor responsible for provisioning, configuration, and operations within the State-managed environment. All State data must reside within State-approved environments. | ||
| TECH-009 | Technical | Solution Architecture | The solution must integrate with approved OMES products and be deployed within the State-owned and State-governed cloud environment. The vendor shall manage and operate the solution within this environment. All solution components and data shall remain State-owned. | ||
| TECH-010 | Technical | Solution Architecture | The vendor must provide modular design to allow a phased deployment or transition by capability, reducing vendor lock-in and supporting future vendor changes without a full system replacement. | ||
| TECH-011 | Technical | Solution Architecture | The vendor shall ensure that all solution components operating within the State-managed cloud environment receive the latest supported updates, including, at a minimum, all Supplier-developed software; any software incorporated into the solution; operating systems; database management systems; middleware; firmware; and any software or applications used to support implementation, maintenance, and operations, including project management and testing tools. | ||
| TECH-012 | Technical | Solution Architecture | The vendor shall document functional and non-functional requirements, follow development standards for patterns, interoperability, portability, modularity, security, privacy, and data protection while ensuring standards are consistently applied across development teams. | ||
| TECH-013 | Technical | Solution Architecture | The vendor shall collaborate with the Exchange to assess enhancements against architectural standards and support periodic architecture, design, and code reviews. | ||
| TECH-014 | Technical | Solution Architecture | The vendor shall implement a solution that uses modular design to ensure maintainability, flexible vendor transition, and minimal disruption to the Exchange and partners. | ||
| TECH-015 |
| TECH-016 | Technical | Development | The Vendor shall maintain and follow a comprehensive development framework aligned with state and industry standards, including documented development procedures, secure coding practices, in-source documentation, and consistent application of standards to support maintainability, security, and auditability. |
| TECH-017 | Technical | Development | The Vendor shall develop modular, secure, and scalable code compatible with COTS and open-source frameworks, maintain source control and versioning, track remediation through nimble processes, conduct code reviews and unit testing, and produce code quality metrics including technical debt and overall code health with reporting to the State. |
| TECH-018 | Technical | Development | The Vendor shall implement automated, secure build, test, and deployment processes across environments using DevSecOps practices, define and execute approved release procedures, automate manual processes, maintain release schedules and documentation, and support continuous integration and regression testing to enable efficient and reliable delivery. |
| TECH-019 | Technical | Development | The Vendor shall ensure end-to-end security by applying industry standards, performing security scanning prior to production, using secure communication protocols, maintaining complete audit trails of system and code changes, and protecting all operational software and documentation. |
| TECH-020 | Technical | Development | The Vendor shall deliver all source code, executables, configurations, documentation, design artifacts, and related intellectual property to the State. The State retains exclusive ownership and rights to modify, maintain, reuse, and redistribute the software and IP without restriction. |
| TECH-021 | Technical | Development | The Vendor shall provide secure State access to all source code and deliverables under version control, ensure State ownership of all deliverables developed under the engagement, maintain reusable code repositories to support sustainability and transition, manage application releases, and participate in ongoing coordination activities including sprint and post-production reviews. |
| TECH-022 | Technical | Integration | The solution shall support the migration of applicable consumer and enrollment data from the FFE, including coordination with CMS. |
| TECH-023 | Technical | Integration | The solution shall provide the capability to support secure, bi-directional data exchange between OKEPs, the consumer-facing portal, and the Exchange to enable the transmission of consumer information supporting eligibility, enrollment, and administrative functions consistent with CMS standards. |
| TECH-024 | Technical | Integration | The solution shall provide the capability to connect with the Federal Data Services Hub (FDSH), while meeting requirements for the Marketplace Authority to Connect (ATC), to enable information verifications for eligibility assessments / determinations. |
| TECH-025 | Technical | Integration | The solution shall provide the capability to support the account transfer processes with Oklahoma's Medicaid system(s) to enable the "no wrong door" experience for consumers. |
TECH-026 Technical Integration The solution shall provide the capability to connect with Oklahoma's Medicaid system(s) to support online Medicaid checks and PDM.
TECH-027 Technical Integration The solution shall provide the capability to connect with the selected print vendor to enable notice delivery via postal mail.
TECH-028 Technical Integration The solution shall provide the capability to securely transfer Exchange plan information with the System of Electronic Rates and Forms Filling (SERFF).
TECH-029 Technical Integration The solution shall provide the capability to support ANSI X12 834 (enrollment) and 999 (implementation acknowledgment) data-exchange standards between carriers and the Exchange, consistent with HealthCare.gov. https://www.cms.gov/files/document/ffe-enrollment-manual-2023-5cr- 071323.pdf
TECH-030 Technical Integration The solution shall provide the capability to support the transfer of assister licensure, agent licensure, and broker licensure information to/from the Oklahoma Insurance Department (OID)
| TECH-031 | Technical | Integration | The solution shall provide the capability for the Exchange to assess/determine Medicaid eligibility through an rules engine or utilize an external tool such as the Magi in the Cloud (MitC). |
| TECH-032 | Technical | Integration | The solution shall provide the capability for the Exchange to send/receive carrier assessment fee information. |
| TECH-033 | Technical | Integration | The solution shall utilize open interfaces, previously developed application programming interfaces (APIs), and established web services to the fullest extent possible to facilitate integration, interfaces, and data exchange. |
| TECH-034 | Technical | Integration | The solution shall support CMS-aligned interoperability capabilities and APIs necessary to support distributed enrollment, consumer enrollment, eligibility, enrollment maintenance, notices, document management, and partner integration activities. This includes: |
| TECH-035 | Technical | Integration | a. Person Search - This service allows for a stakeholder to search for a consumer’s existing application within the FFE. A user may search for a person using a specific set of data |
| TECH-036 | Technical | Integration | b. Get DMI - This service provides a high-level overview of any Data Matching Issues (DMIs) tied to a consumer. Consumers have a certain timeframe in which to resolve DMIs, which is captured in a timer. |
| TECH-037 | Technical | Integration | c. Get SVI - This service provides a high-level overview of any Special Enrollment Period (SEP) Verification Issues (SVIs) tied to a consumer. An SVI is created when a consumer attests to being eligible for a SEP that requires verification. Consumers have a certain timeframe in which to resolve SVIs, which is captured in a timer. |
| TECH-038 | Technical | Integration | d. Store Permission - This service is used to store a set of required data when a consumer has authorized an authorized enrollment partner, agent/broker, or consumer-facing enrollment channel to submit API transactions on his or her behalf. |
| TECH-039 | Technical | Integration | e. Revoke Permission - This service is used when a consumer wants to revoke the authorization for an EDE entity or agent/broker to submit API transactions on his or her behalf |
| TECH-040 | Technical | Integration | f. Store ID Proofing - This service is used to store a set of required data when a consumer has successfully identity proofed through an authorized enrollment channel |
| TECH-041 | Technical | Integration | g. Document Upload - This service provides the capability to store documents and corresponding metadata. For EDE, consumers may upload documents through supported enrollment channels, including OKEPs and the consumer-facing portal to resolve either a DMI or an SVI. |
| TECH-042 | Technical | Integration | h. Notice Retrieval - This service allows authorized authorized enrollment channels to retrieve consumer notices directly from the {OK SYSTEM} document storage via a time-expiring URL. |
| TECH-043 | Technical | Integration | i. Metadata Search - This service provides the capability to search for metadata records tied to a consumer. This service will return metadata for notices tied to a consumer. |
| TECH-044 | Technical | Integration | j. Payment Redirect - This API allows stakeholders to redirect a consumer to their issuer’s payment website for their binder payment. |
| TECH-045 | Technical | Integration | k. Event-Based Processing - This API allows authorized enrollment channels to ingest certain events for consumers as they occur, and subsequently enables EDE entities to distribute corresponding communications to their consumers. |
| TECH-046 | Technical | Integration | The solution shall align with all Eligibility API’s which enable supported enrollment channels with the ability to retrieve and create enrollment data in real time, which shall include: |
| TECH-047 | Technical | Integration | a. Get Enrollment - This API allows supported enrollment channels to retrieve enrollment data for a consumer in real-time. |
| TECH-048 | Technical | Integration | b. Submit Enrollment - This API allows supported enrollment channels to submit an enrollment. |
| TECH-049 | Technical | Integration | c. Update Policy - This API allows supported enrollment channels to initiate certain actions that impact a consumer’s existing policy or Pended Plan Selection (PPS). Functionality available via the Update Policy API currently includes cancellation, termination, and Batch Auto-Renewal (BAR) opt-out functionality. |
| TECH-050 | Technical | Availability and Performance | The solution shall provide the capability to implement performance optimization mechanisms (e.g., query optimization, indexing, efficient schema design, infrastructure/configuration tuning, and continuous monitoring) to enable large-scale analytics without degradation, outages, or instability. |
| TECH-051 | Technical | Availability and Performance | The solution shall provide the capability to plan, execute, and report performance, load, and unit testing for the Exchange and all integrated systems. |
| TECH-052 | Technical | Availability and Performance | The solution shall provide the capability to define, measure, and manage service performance targets through Service Level Agreements (SLAs), Service Level Objectives (SLOs), and Service Level Indicators (SLIs) for all critical services. |
| TECH-053 | Technical | Availability and Performance | The solution, including supporting infrastructure, shall be designed to scale elastically to accommodate growth in enrollment volume, transaction load, and operational demand, including handling temporary demand spikes during Open Enrollment Periods, Special Enrollment Periods, and other external or policy-driven events. |
| TECH-054 | Technical | Availability and Performance | The Supplier shall ensure that the solution, including the technology platform and associated operational support services, is designed to meet capacity and scalability expectations without degradation of system performance, security, or availability. |
| TECH-055 | Technical | Availability and Performance | The solution shall provide the capability to deliver real-time dashboards and alerting that surface system health and operational risks, tailored to engineering, operations, and leadership audiences. |
| TECH-056 | Technical | Availability and Performance | The solution shall provide an automated method for ascertaining and reporting on the state, performance, and availability of each component of the solution and the underlying operating infrastructure on at least 30-minute intervals, 24 X 7 X 365. |
| TECH-057 | Technical | Availability and Performance | The solution shall automatically notify the Exchange when a service level objective has not been met. |
| TECH-058 | Technical | Reporting and Analytics | The solution shall provide the capability to provide reports for Oklahoma to support open enrollment, renewals, special enrollment, operational activities, and other Exchange-specific needs. |
| TECH-059 | Technical | Reporting and Analytics | The solution shall include reporting tools and dashboards to support both operational and programmatic reporting requirements. The State does not require a separate vendor-provided data warehouse, as the Oklahoma Insurance Department will maintain and manage all data within its existing State-owned data warehouse environment. |
| TECH-060 | Technical | Reporting and Analytics | The solution shall provide the capability to deliver accurate reports to support Centers for Medicare & Medicaid Services (CMS) requirements, including, at a minimum, CMS Bi-Annual Metrics, CMS Priority Open Enrollment Metrics, and CMS Expanded Priority Open Enrollment Metrics. |
| TECH-061 | Technical | Reporting and Analytics | The solution shall support the capability to deliver the User Fee Report. |
| TECH-062 | Technical | Reporting and Analytics | The solution shall provide the capability to deter and detect fraud, waste, and abuse to generate program integrity reports. |
| TECH-063 | Technical | Reporting and Analytics | The solution shall provide integrated reporting and analytics capabilities that deliver visibility into ongoing performance and operations, including, at a minimum, the ability to generate defined recurring reports, create ad hoc reports, monitor defined performance metrics and service levels, and present real-time performance information through integrated dashboards. |
| TECH-064 | Technical | Reporting and Analytics | The solution shall provide capabilities to generate performance reports for all operational components of the solution using pre-defined formats, data elements, and frequency. |
| TECH-065 | Technical | Reporting and Analytics | The solution shall provide capabilities to adhere to exact methods for measuring, calculating, and reporting all performance standards as prescribed by the Exchange. |
| TECH-066 | Technical | Reporting and Analytics | The solution shall provide capabilities shall generate and make available interactive visualizations of performance information, both real-time and retrospective, with the ability to drill down into and roll up information. |
| TECH-067 | Technical | Reporting and Analytics | The solution shall provide capabilities for data query features that support the ad hoc search and presentation of performance data in numerical formats. |
| TECH-068 | Technical | Reporting and Analytics | The solution shall provide capabilities for data query features that support the ad hoc search and presentation of performance data in visual formats. |
| TECH-069 | Technical | Data Management | The solution shall establish a strategic data management program, including associated standards and practices, that provides, at a minimum, clearly defined and documented data architecture and structuring across databases, data sources, and data elements; systematic data capture across all solution components, platforms, and tools; dynamic data access to support live consumer operations; comprehensive operational and service level reporting and analytics; support for quality assurance and continuous improvement; solution auditability and transparency; data security and integrity; and the flexibility to adapt to evolving business needs without requiring change requests that carry unique costs. |
| TECH-070 | Technical | Data Management | The solution shall provide the capability to enforce encryption of all data in transit and at rest, across services. |
| TECH-071 | Technical | Data Management | The solution shall provide the capability to enforce strict logical and access separation of FTI data at application, storage, and user levels. |
| TECH-072 | Technical | Data Management | The solution shall be built on a database that accommodates the potential growth by possessing through adequate storage sizing, archiving, and maintaining methods. |
| TECH-073 | Technical | Data Management | The solution shall accurately capture account, application, eligibility, verification, enrollment, and other data through a database designs that appropriately logs, stores, tracks, and audits a consumer's participation in multiple products. |
| TECH-074 | Technical | Data Management | The solution shall provide the capability to establish connectivity between the Exchange, OKEPs, and the consumer-facing portal to seamlessly and accurately transfer data. |
| TECH-075 | Technical | Data Management | The solution shall provide the capability to implement backups, replication, and multi-availability zone (multi-AZ) deployment strategies to support database resilience. |
| TECH-076 | Technical | Data Management | The solution shall ensure that the Exchange retains sole ownership of all data and it shall implement data models that allow full, unencrypted export of all related data on-demand in documented, non-proprietary formats. |
| TECH-077 | Technical | Data Management | The solution shall provide documented procedures and automation for: 1. Full data export 2. Schema evolution and versioning 3. Backup/restore and disaster recovery |
| TECH-078 | Technical | Data Management | The solution shall provide data management functions and features that include, at a minimum, the use of a relational database management platform; established database design and data management methodologies supporting data validation, data scrubbing and cleansing, and raw data transformation for transaction processing, analytics, and reporting; the ability to perform scheduled and unscheduled data load processes as directed by the Exchange; the capability to roll back recent data loads; and the ability to execute mass reprocessing of specified data or transactions as directed by the Exchange. |
| TECH-079 | Technical | Data Management | The solution shall provide capabilities to perform data load error resolution processes, including, at a minimum, the ability to identify and log data load errors; automatically notify designated contacts via email and direct contact methods (e.g., text, page, or telephone); and automatically generate data load error reports that include the job or job stream in which the error occurred, the error type (e.g., data error, processing error, or infrastructure performance disruption), and the date and time of the error. |
| TECH-080 | Technical | Data Management | The solution shall provide a data management architecture that enables simple changes without requiring customization or change requests that carry unique costs, including, at a minimum, the ability to deploy new or revised data elements, data sets, and data sources; reposition and rename field labels and data fields; remove or disable unused fields; update and maintain static content; modify user interface layouts; and add custom-defined fields. |
| TECH-081 | Technical | Data Management | The solution shall provide the capabilities to identify, record, process, track, and audit data matching issues (DMIs). |
| TECH-082 | Technical | Data Management | The solution shall capture, identify, store, track, and enable auditing for Federal Data Services Hub (FDSH) transactions and exceptions. |
| TECH-083 | Technical | Data Management | The solution shall retain and allowing mapping of account, application, eligibility, enrollment, enrollment professionals, and other data to successfully migrate consumers from the Federally Facilitated Marketplace. |
| TECH-084 | Technical | Data Management | The solution shall establish links and provide indicators for each unique individual and their associated account(s), application(s), eligibilities, enrollment(s), and other data. |
| TECH-085 | Technical | Data Management | The solution shall track and record all changes to account, household, eligibility, or enrollment information. |
| TECH-086 | Technical | Data Management | The solution shall perform address cleansing using the US Postal Service's CASS and NCOALink services. |
| TECH-087 | Technical | Data Management | The solution shall enable the export of data in prescribed formats (e.g., CSV) and to office automation tools (e.g., Microsoft Excel, PDF, etc.). |
| TECH-088 | Technical | Data Management | The solution shall enable capabilities to perform data backup in accordance with the State of Oklahoma and their information security and data management standards. |
| TECH-089 | Technical | Data Management | The solution shall retain data, documents, and any relationship amongst records and documents for a minimum of 10 years in accordance with state and federal records retention schedules, whichever is longer. |
| TECH-090 | Technical | Data Management | The solution shall remove and securely destroy data upon reaching the end of its retention period based on Exchange policies. |
| TECH-091 | Technical | Data Management | The solution shall provide consumers, at a minimum, with capabilities related to personally identifiable information (PII), including disclosures on the collection and use of PII by the Exchange; the ability to access and obtain their PII maintained by the Exchange; the ability to dispute the accuracy of their PII; and a process to request correction of their PII. |
| TECH-092 | Technical | Data Management | The solution shall maintain consistent consumer, eligibility, enrollment, notice, and document data across all supported enrollment channels. |
| TECH-093 | Technical | Quality Assurance | The solution shall provide the capability to automate compliance and audit reporting by creating comprehensive audit trails that trace information from source data files and documents through all processing stages to final recordation; generate and maintain audit artifacts including listings, transaction logs and reports, update logs and reports, event logs, and error logs; and record and log key details for all create, modify, and delete actions, including user or terminal ID, system job ID, and date and time. |
| TECH-094 | Technical | Quality Assurance | The solution shall provide capabilities to support audit monitoring and analysis, including the ability to display date and identification stamps on online inquiries; provide tools to view and analyze system logs and reports; support configurable logging levels, errors, alerts, and notifications; capture originating IP addresses for transactions; enable auditing of individual records and batch data; provide date and time stamping for document processing activities, including receipt, scanning and digitization, tagging and indexing, and upload; and support auditing at the object level (e.g., table, field, record). |
| TECH-095 | Technical | Quality Assurance | The solution shall enforce audit controls and governance, including the ability to configure auditable events based on organizational policies; perform time synchronization using NTP or SNTP and ensure synchronized timestamps across all logs and security records; restrict access to audit records to authorized users; protect audit records from unauthorized deletion; and prevent modification of stored audit records. |
| TECH-096 | Technical | Quality Assurance | The solution shall provide the capability for FTI scalable audit- logging that captures all user and system activities with timestamps and relevant context. |
| TECH-097 | Technical | Quality Assurance | The vendor shall develop, maintain, and execute a comprehensive testing strategy and Test Plan covering test types, environments, tools, defect management, metrics, and release readiness, and shall participate in Exchange and QA governance activities. |
| TECH-098 | Technical | Quality Assurance | The Vendor shall design and execute test cases across unit, integration, regression, and end-to-end testing, leverage automated testing frameworks to support continuous testing, maintain and update test assets including mock services, and promote shift-left practices including TDD and BDD to improve test coverage and quality. |
| TECH-099 | Technical | Quality Assurance | The Vendor shall perform formal root-cause analysis for defects, track and manage defects through resolution, and provide detailed and summary test reporting for each release including test results, defect metrics, severity, escaped defects, and overall system quality. |
| TECH-100 | Technical | Quality Assurance | The Vendor shall conduct performance testing including load, stress, and failover scenarios, perform pre-production validation checks, execute usability testing with representative users, and implement automated performance testing for critical workflows and integrations prior to production release. |
| TECH-101 | Technical | Quality Assurance | The vendor shall perform comprehensive and independent static code analysis on all components of the solution, including source code, scripts, configuration files, and libraries. This analysis shall identify security vulnerabilities, coding defects, and potential maintainability issues prior to delivery. The vendor must provide detailed results, remediation plans, and verification of fixes as part of acceptance. |
| TECH-102 | Technical | Security and Privacy | Security and Integrity, Security and Privacy Regulations and Standard Use of hardware and software that shall be kept current with the supplier's latest supported software releases both during implementation and all subsequent hosting and M&O years. This includes but is not limited to the operating systems, all third-party software, all Selected Offeror-provided software, and all tools and non-operating software (e.g., monitoring tools, project management tools, reporting tools). |
| TECH-103 | Technical | Security and Privacy | The hosting environment shall implement industry-standard security practices, including encryption in transit and at rest, identity and access management with multi-factor authentication, network segmentation, vulnerability management with defined remediation SLAs, security logging and monitoring, and incident response processes aligned to the Cloud Security Requirements. |
| TECH-104 | Technical | Security and Privacy | The solution shall establish controls at all appropriate points of processing to maintain information integrity. |
| TECH-105 | Technical | Security and Privacy | The solution shall establish controls governing access to data and user information, including the ability to manage data visibility through show, hide, and masking features; restrict access to protected data based on configurable user roles defined by the Exchange; designate all data, data sets, and information as sensitive or non-sensitive; and apply tagging to identify types of sensitive data, including, at a minimum, personally identifiable information (PII) and federal tax information (FTI). |
| TECH-106 | Technical | Security and Privacy | The solution shall provide safeguards for all data designated as sensitive, including, at a minimum, encryption of data in transit and at rest, implementation of masking as needed, and controls to prevent the persistence of sensitive data. |
| TECH-107 | Technical | Security and Privacy | The solution shall employ secure end-to-end transmission whenever transmitting information and data with other entities. |
| TECH-108 | Technical | Security and Privacy | The solution shall encrypt and support-file based encryption of files that are received and sent to other entities or systems. |
| TECH-109 | Technical | Security and Privacy | All primary and backup data shall be stored, processed, and maintained within the United States. |
| TECH-110 | Technical | Security and Privacy | The solution shall maintain currency of all system components throughout implementation and operations. |
| TECH-111 | Technical | Security and Privacy | The solution shall support access controls and geographic restrictions as required by security policy. |
| TECH-112 | Technical | Security and Privacy | The solution shall provide the capability to continuously conform to the Minimum Acceptable Risk Standards for Exchanges (MARS-E) standards as required by CMS. https://www.cms.gov/files/document/mars-e-v2-2-vol-1final-signed08032021- 1.pdf |
| TECH-113 | Technical | Security and Privacy | The solution shall comply with federal and state requirements, including Oklahoma Administrative Rules and CMS rules and regulations. CMS: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-B/part-155 |
| TECH-114 | Technical | Security and Privacy | The solution shall provide the capability to: 1. Safeguarding of personally identifiable information (PII) and FTI by encrypting user data, both in transit and at rest. 2. Minimization of the persistence of sensitive data. |
| TECH-115 | Technical | Security and Privacy | Operate and maintain the solution in accordance with State and federal laws, regulations, and guidelines related to security and confidentiality of protected information. |
| TECH-116 | Technical | Security and Privacy | The solution shall establish controls to support role based security for all marketplace roles where access and functions are defined based on Exchange requirements and needs. |
| TECH-117 | Technical | Security and Privacy | The solution shall enforce security policies and protocols that prohibit the sharing of user credentials, passwords, and other private login information with others for any reason. |
| TECH-118 | Technical | Security and Privacy | The solution shall provide secure methods for password transmittal that, at a minimum, prohibit sending passwords in the same email as an encrypted file. |
| TECH-119 | Technical | Security and Privacy | The solution shall employ effective security and privacy controls for information systems and organizations. |
| TECH-120 | Technical | Security and Privacy | The solution shall prevent access to the solution and the associated operating infrastructure from outside of the United States. |
| TECH-121 | Technical | Security and Privacy | The solution shall employ and adhere to the principle of “Fail Safe” in the solution's architecture and design to ensure that in a failed state the solution does not reveal or expose any sensitive information or leave any access controls open for attacks. |
| TECH-122 | Technical | Security and Privacy | The solution shall protect and harden the solution’s operating infrastructure so as to eliminate any unnecessary system services, accounts, and network services. |
| TECH-123 | Technical | Security and Privacy | The solution shall install up-to-date malware protections on an on-going basis to prevent successful network attacks and penetration attempts. |
| TECH-124 | Technical | Security and Privacy | The solution shall enforce consistent security, identity management, audit logging, and privacy protections across all supported enrollment channels, including OKEPs and the consumer-facing portal. |
&1#&"Calibri"&10&K000000Confidential
Functional
| ID # | Category | Sub-Category | Requirement | Bidder Response | Bidder Notes |
| FUNCT-001 | Functional | Anonymous Shopping | The solution shall provide anonymous shopping capabilities through the consumer-facing portal and/or integrated OKEPs so that users can preview eligibility and plans without establishing an account with the Exchange. | ||
| FUNC-002 | Functional | Anonymous Shopping | The solution shall provide the capability to enable the following functions, at minimum, through the anonymous shopping flow: obtain a pre-screening of eligibility with limited data collection for Medicaid, APTC, and QHP programs; find providers/facilities that are in-network/out-of-network through provider directory; preview and compare plans. | ||
| FUNC-003 | Functional | Anonymous Shopping | The solution shall provide the capability to offer an anonymous shopping experience for the current coverage year with a tailored flow for the previous and/or upcoming years based on open enrollment or special enrollment periods. |
| FUNC-004 | Functional | User Portal | The solution shall provide a unified Exchange ecosystem that manages integration and data flow between the consumer-facing portal, OKEPs, agents, issuers, and the Exchange so that consumers can securely and seamlessly view their profile, household, eligibility, enrollment, notices, and related data. |
| FUNC-005 | Functional | User Portal | The solution shall provide consumers with the capability to independently access and navigate the consumer-facing portal and/or OKEPs, allowing them to apply for financial assistance and coverage; shop, compare, and enroll in coverage; and optionally partner with brokers or agents. |
| FUNC-006 | Functional | User Portal | The solution shall provide the capability for consumers to securely access and navigate supported enrollment channels, including OKEPs and the consumer-facing portal, so that the consumer can act independently without partnering with an Agent/Broker; look for and partner with an Agent/Broker; and manage their partnership with an existing or previous Agent/Broker. |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .