Exhibit_16_-_Program_Integrity_Security_Privacy_Compliance.docx

Exhibit 16 – Program Integrity, Security, Privacy, and Compliance

Purpose This Exhibit defines the required content and format for the Bidder’s Fraud, Waste, and Abuse (FWA), and Program Integrity Approach, including integrated security and compliance capabilities.

The response will be used to evaluate Bidder’s ability to deliver a unified framework for program integrity, security, privacy, and regulatory compliance across the full Exchange lifecycle.

general instructions

· Page Limit: 20 Pages maximum

· Font: Minimum 11-point (Arial, or Calibri)

· Margins: Minimum 1 inch

· Line spacing: Single or 1.15

· Tables and diagrams are encouraged and count toward page limits

· Content must be specific and implementation-focused, not conceptual

· All content within each Exhibit, including bidder instructions, narrative responses, tables, and supporting detail, shall count toward the applicable page limitations unless otherwise specified.

Response Organization Requirement Responses must be organized using the structure provided in this Exhibit. Each subsection must be clearly labeled. Failure to clearly label responses may result in reduced evaluation scores.

Response expectations Responses must:

· Demonstrate a fully integrated approach, not separate FWA and security silos

· Show how capabilities are operationalized, not just designed

· Provide clear examples, diagrams, or workflows where applicable

· Align with Requirements Matrix obligations

The Bidder shall describe:

Fraud, Waste, and Abuse Detection and Prevention Bidder Instructions: FWA Detection and Prevention Describe the Bidder’s approach to identifying, preventing, and mitigating fraud, waste, and abuse across the Exchange.

At a minimum, include:

· Detection methodologies (rules-based, analytics-based, risk scoring, anomaly detection)

· Prevention controls embedded within eligibility and enrollment workflows

· Real-time vs. post-processing detection capabilities

· Identification of high-risk actors or behaviors (e.g., brokers, agencies, enrollment patterns)

· Use of predictive analytics or machine learning (if applicable)

Bidder Response: Fraud, Waste, And Abuse (FWA) Detection and Prevention In this section, the Bidder shall provide its written response to the instructions stated above. The response will be evaluated in accordance with this Exhibit.

Monitoring, Reporting, and Program Integrity Operations Bidder Instructions: Monitoring, Reporting, and Program Integrity Operations Describe how FWA and program integrity activities are operationalized.

Include:

· Program integrity dashboards and reporting capabilities

· Ability to perform drill-down analysis and investigative review

· Monitoring of trends, outliers, and concentration risks

· Case management or investigation support capabilities

· Reporting to State and Federal oversight entities

Bidder Response: Monitoring, Reporting, and Program Integrity Operations In this section, the Bidder shall provide its written response to the instructions stated above. The response will be evaluated in accordance with this Exhibit.

Security and Compliance Approach Bidder Instructions: Security and Compliance Approach Provide a clear and concise summary of the Bidder’s security and compliance framework. Bidder will also demonstrate comprehensive identify and access management (IAM) approach that directly mitigates fraud waste and abuse. Access must be managed based on the principle of least privilege.

At a minimum, address:

· Alignment with CMS security frameworks

· IRS Publication 1075 compliance approach (FTI protection)

· HIPAA privacy and security compliance

· Alignment with State of Oklahoma cybersecurity requirements

· Ability to produce required artifacts (e.g., SSP, POA&M, audit evidence)

· Identity and access management approach

· Security controls supporting both partner-operated and State-operated consumer enrollment channels

· Access Control Model: describe your proposed access control methodology, specifically comparing role-based (RBAC) and attribute-based (ABAC) controls (recommend a hybrid approach using RBAC for broad baseline permissions and layering ABAC for fine grained, dynamic controls.

· Encryption (data in transit and at rest)

· Logging, monitoring, and audit controls

Bidder Response: Security and Compliance Approach In this section, the Bidder shall provide its written response to the instructions stated above. The response will be evaluated in accordance with this Exhibit.

Privacy and Data Protection Bidder Instructions: Privacy and Data Protection Describe how the solution protects sensitive data, including PII and FTI.

Include:

· Data protection strategies

· Access controls and data segmentation

· Data minimization and masking (if applicable)

· Handling of sensitive data across integrations

Bidder Response: Privacy and Data Protection In this section, the Bidder shall provide its written response to the instructions stated above. The response will be evaluated in accordance with this Exhibit.

Real-Time Monitoring and Incident Response Bidder Instructions: Real-Time Monitoring and Incident Response Describe the Bidder’s ability to detect and respond to threats and anomalies.

Include:

· Real-time monitoring capabilities

· Alerting and escalation processes

· Incident detection and response workflows

· Integration of security and program integrity monitoring

Bidder Response: Real-Time Monitoring and Incident Response In this section, the Bidder shall provide its written response to the instructions stated above. The response will be evaluated in accordance with this Exhibit.

Regulatory Alignment and Audit Readiness Bidder Instructions: Regulatory Alignment and Audit Readiness Describe how the solution supports compliance and oversight.

Include:

· Alignment with CMS, IRS, and applicable Federal requirements

· Independent audit readiness approach

· Support for regulatory reporting and transparency

· Evidence Generation and documentation practices

Bidder Response: Regulatory Alignment and Audit Readiness In this section, the Bidder shall provide its written response to the instructions stated above. The response will be evaluated in accordance with this Exhibit.

2 | Page image1.png