Exhibit D - Technical - NonFunctional Response Workbook.docx

Overall Instructions to Vendor: Please utilize this workbook to provide your responses to CareOregon questions. Where applicable please include timelines, organizational charts, etc. as requested. Submissions not using this template will not be considered.

Technical Requirements

Instructions to Vendor for Technical Requirements: Please describe your solution technology, platform, and architecture in the following areas:

Service Level Objectives

· Please provide your standard service level objectives including but not limited to:

· Days and hours of operation for in-scope solutions

· Availability (M-F, 8:00am-5:00pm, Pacific Time)

Vendor Response:

Architecture

· Please provide a diagram and explanation of the overall architecture:

· What application solutions are included?

· What analytics tools are included?

· What data encryption tools are included?

· What other utilities or tools are included?

· Which of these will need to be hosted at CareOregon?

· Describe proposed implementation models and hosting services. Please specify if your solution multi or single tenant architecture

· Please provide a description of the technical requirements for running the solution: Operating System, desktop software if any, storage requirements, memory requirements, and CPU requirements.

· Are availability and performance SLAs available? Please provide list including: well published scheduled maintenance window, current number of users supported and anticipated threshold, current volume supported and anticipated threshold, and current number of system processes supported and anticipated threshold?

· What is your standard uptime & availability SLA?

· Provide a technology roadmap that clearly lays out product enhancement strategy and timeframe

Integration

· Does the solution include integration software (e.g., integration brokers, IPAAS, ETL tools)? If so:

· What integration software is included?

· Which of these would be internally hosted by CareOregon?

· Are all interfaces operationalized through integration software via a publish-and-subscribe model or are there also point-to-point interfaces? If the latter, please clarify where this is used?

· Does your application come with APIs that are callable by custom code interfaces CareOregon may develop? Please provide a list of client accessible APIs and a description of API functionality. Confirm if you have Rest APIs, FHIR based APIs and Webhooks for deep linking

· Are there any limitations on your APIs? What is the scalability of your APIs

· Do you support HL7 based integration?

· Are there any document management capabilities inherent in your proposed solution? If not, provide a list of document management solutions with whom you currently integrate and a description of the functional integration that has been achieved with each solution.

· What type of external data feeds will your solution require at implementation?

Database, Files and Import/Export

· What type of bulk data import and export/extraction capabilities exist?

· Do you have a cloud connector to SnowFlake?

· Do you have a cloud connector for Logic Apps?

· What limitations exist around uploading data into development, test, and training environments?

· Is there any limit on CareOregon’s ability to refresh the data in these environments?

· Describe your database and file management technology for the product, including the product and versions.

· Describe your data architecture, data model, data standards, audit standards, etc.

· Describe your data store and data warehouse processes with data stored at CareOregon.

· What method do you utilize to load data (e.g. SFTP)?

· How frequently can CareOregon pull data from the system (e.g. on-demand)?

· Describe in detail the level of data pull capabilities

· What formats are available (e.g. XML, etc.)?

· Do you have file size limits? Describe.

· How do you load existing data into the solution during Implementation?

· Describe your data migration process from CareOregon’s legacy applications.

· How do you support data loads (Implementation and during normal business operations)?

· How are data load communicated and data load failures communicated? (e.g. Specific row and error should be identified)

· What corrective action can the solution take when a file load fails?

Information Security

· Describe how this solution will help us keep compliant with health care regulations, such as HIPAA.

· Describe your Information Security program, including organizational structure, leadership, and framework.

· How does your product provide high availability and resiliency to address service outages, compromises, data corruption, or other impairments?

· Describe all places where CareOregon data may be stored by your staff, such as on workstations or paper, and physical locations such as in offices and/or data centers. Describe your physical security model. Do you allow customer data to be downloaded or moved outside of your applications and data centers?

· How will you ensure that CareOregon data is not stored or processed outside of the United States?

· How does the proposed solution protect CareOregon data from unauthorized access, both at rest and in transit?

· Describe how you keep CareOregon data separate from other customer data.

· How do you screen your employees and contractors to ensure the safety of customer data?

· Is the data stored in this solution accessible by the service provider’s support staff? Please describe.

· How does the proposed solution implement single sign-on with third-party identity systems, such as Active Directory, Azure Active Directory, and/or other OAuth identity services?

· Describe how the system records and reports on user access and activity. Do you periodically review your own staff access logs?

· Are your system security measures validated regularly by a third party? Please describe and include any industry certifications you have achieved.

· What provisions do you have to allow us to retrieve data if/when our agreement ends? How do you ensure data is destroyed and/or permanently removed from your systems?

· CareOregon Data at all times must be located in the continental United States. Confirm that all applications and data base servers are located in the continental United States.

· Is client data encrypted at rest?

· Provide details on return of client’s data upon contract termination.

· Provide a copy of your most recent data security audit.

Availability

· What monitoring and reporting is available of system failures and outages?

· What is the service level objective for availability?

· How many hours of scheduled downtime per month?

· What is the recovery time objective (RTO) for the application Solution?

· What is the recovery point objective (RPO) for the application Solution?

· How frequently is the recovery capability tested?

· Has there been a successful disaster recovery test in the past year, where the actual recovery met the RTO and RPO specified above?

· How is performance and response time measured for your product?

· Describe your load balancing strategy at both the web and application tiers.

· What are your typical on-line response times for users (e.g., screen flips etc.) for an implementation of similar size and scope?

· What is the typical response time for application start-up for users? Log in times? Application screen-to-screen navigation? What are factors specific to your application/solution that would affect application response times across the tiers of your application in online and batch mode? Can the application support online users and batch processing concurrently? How is performance affected?

· How does the system scale in terms of users, and concurrent users? Are there lead times or timeframes required to increase or decrease capacity? Are there multi-level security paramaters available to distinguid visibility to populations based on various parameters? (LOB,Team,Role, etc.)

· How will internal and external users be managed and how is access controlled for those users. Can your system handle HCP users that may need special access?

· Describe available capacity and the ability for CareOregon to increase system capacity (i.e., memory, CPU, space). Are there lead times or timeframes required to increase or decrease capacity?

· What monitoring solutions does your system integrate with?

· Describe process for error handling (Application System, and Database Errors).

Software Update

· How frequently are software application updates applied?

· What type of notification occurs surrounding the composition of upcoming software updates?

· How long before they are applied in the production environment are the updates made available in the test environment?

· Are any automated testing tools included in the base price Proposal?

· Briefly describe your patch management process activities including how emergency patches are handled

· May patches or upgrades be skipped or postponed at the discretion of CareOregon?

· May updates or enhancements to the application or functionality be toggled on or off by configuration switches?

· For software security bugs, vulnerabilities, etc. please describe how CareOregon would be notified

· Does the software impose a limit on what OS upgrades, patch levels or service packs can be installed (i.e., support Microsoft OS SP2 but not Microsoft OS SP3)?

· Will included third party components, applications or operating system patches or updates require they be tested, approved, and delivered through you?

· How do you help ensure CareOregon remains on current environments?

· Describe your update / upgrade process. Can upgrades be cumulative. If an upgrade has been skipped, how would the next upgrade be managed?

· Describe the Maintenance and Enhancement Update Process.

· What is your process and expected lead time to CareOregon to perform UAT to include regression, integration, and performance tests prior to acceptance and deployment into CareOregon production environment?

· Is your beta environment a place where POC’s can occur? Can admin be built within? Is this a place where fixes and enhancements can be accepted?

· For software security bugs, vulnerabilities, etc. please describe how CareOregon would be notified

· Do you have dependencies on 3rd party software versions and releases?

· What tasks is CareOregon responsible for to operate and maintain the deployed environments (production and non-production) (business and IT) with required skill sets and level of involvement?

· What downtime can CareOregon expect for application upgrades or maintenance? If there is an established maintenance schedule, please describe.

Reporting (Technical Specifications)

· Describe what reporting and analytic software you use

· Describe current abilities to integrate with industry standard analytics tools?

· Is reporting performed directly in the transactional system or do you utilize a DataMart or other solution?

· Describe the reporting administration process? (e.g. Who grants access to reports to a new user)

Contract Requirements

· Vendor shall be required to comply with the CareOregon Data Security Requirements and Terms and Conditions for Clouds Services found at: https://www.careoregon.org/contact-us/vendor-resources. These exhibits will be attached to any resulting contract.

· If PHI included, vendor shall be required to sign and comply with the Business Associate Agreements found at: https://www.careoregon.org/contact-us/vendor-resources.

Miscellaneous

· What is your best practice approach to User and license management

· What is your best practice approach to Brand portal implementation

· Describe any organizational changes (mergers, acquisitions, divestitures) that have recently occurred or are planned in the future.

Non-functional Requirements

Instructions to Vendor for Non-functional Requirements: Please address each section when prompted. Additional instructions have been provided within most categories.

Consulting Model

CareOregon desires for the Vendor to present a Proposal whereby a single Vendor will act as the prime contractor for systems implementation/integration efforts. The prime contractor is defined as: 1) The entity that will coordinate and manage all external-to-CareOregon resources for this initiative; 2) The entity that will have responsibility for the successful (on-time, on budget) implementation of the Solution.

Please clarify the Vendor that will be the prime contractor for the proposed implementation effort.

Project Management Instructions to Vendor: Vendors shall present their approach and ability to control product quality and timeliness and the management and distribution of the same.

· What is the program management model and project management methodology? How will Vendor interact with internal CareOregon teams?

· Please provide an example of the status report that would be provided to the CareOregon project manager and project team to track the progress of the implementation effort.

Implementation Methodology Instructions to Vendor: Vendors are asked to provide details about their proposed implementation methodology, including addressing the following questions:

· What is your process for resolving differences between system capabilities and CareOregon’s business requirements?

· What approach will be used to control the number of customizations? What reporting will be provided to enable CareOregon to monitor the extent of any customizations that are implemented?

· What is your methodology and plan for training and adoption of the solution? What training and solution deliverables would be provided?

· Please elaborate on how the plan will address data conversion. What are the key deliverables in this regard? What is expected from CareOregon in this area?

· Please elaborate on how the plan will address system integration. What are the key deliverables in this area? What is expected from CareOregon in this area?

· Please describe testing methodology. What metrics will be reported to explain testing results?

· Does testing include the development of automated test scripts? If so, what tool is required to support this testing? Is the cost for this tool included in the Vendor base price Proposal?

· Please explain the approach to security testing. What measures will be taken to identify and remediate potential security vulnerabilities?

· Please explain the approach to disaster recovery implementation and testing. What role will the Vendor take and what deliverables will be provided?

· Do you provide a project approach playbook for all phases of the project (design planning, workflow configuration, testing, implementation, go-live, post go-live)?

Implementation Approach

· Please provide your recommendation on overall project phasing and the rationale for the recommended approach

· What are the major phases?

· What is the rationale for the recommended approach?

· What measures are provided within the plan to integrate with current systems while the full solution is being rolled out?

· Please clarify the total level of effort embodied in the proposed project plan. This should include:

· The types and quantities of resources that CareOregon will need to provide and the expected timeframes for their involvement.

· Please clarify any significant assumptions that were made in developing the project plan.

· Please outline roles and responsibilities for both vendor and CareOregon for the proposed implementation effort.

· Please describe your approach and phasing (if any) for data migration from CareOregon’s current solutions

Implementation Plan Instructions to Vendor: Please provide a high-level project plan that includes the following information:

· Timeline

· Task level detail that aligns with the Vendor’s implementation methodology.

· All deliverables and when CareOregon will receive them.

Training

· Discuss your training plan for the implemented end-to-end solution for this product, including the qualifications of the trainers, available training materials, availability to include all of CareOregon project team and ongoing training capabilities.

· Describe your training methodology.

· Can the vendor arrange to have training occur at our facility? If yes, what are your minimum requirements (e.g. number of students, equipment, room, etc.)?

· Please discuss all documentation that is available to support your product. Is documentation available in various formats (i.e. CD, hard copy, on line)? Would CareOregon be allowed open license to duplicate manuals and other training materials for internal use only?

· What on-going technical training is provided after a release (e.g. Release notes, WebEx Training, etc.)?

· What on-going end-user training is provided after a release (e.g. Release notes, WebEx Training, system updates and related training, new functionality, etc.)?

· Do you offer virtual training? If yes, describe your training offerings for a general user of the system? For a power user? For an administrator of the system?

· Do you offer training guides? FAQs? Recordings of training sessions?

Implementation Risks

· What are the most significant risks the Vendor foresees?

· What measures does the Vendor propose to take to mitigate those risks?

· How will the Vendor mitigate cost risk?

· Will the Vendor offer any contractual or other cost protections?

Ongoing Support Plan and Approach Instructions to Vendor: Please describe your approach for ongoing maintenance and operational support post-implementation, including “Maintenance Services” and “Enhancement Services”:

· Service Management and Quality Assurance: Please describe your proposed CareOregon account management structure

· Continuous Improvement: Please describe an approach to defining CareOregon’s future projects and requirements for Care Coordination (e.g., system strategy, availability, capacity, performance, etc.) Please align your approach to the background information provided and what you know to be CareOregon’s roadmap/strategy

· Performance Management: Please describe proposed monitoring and reporting of service component performance. This includes supporting activities associated with restoring normal application operation and minimizing the adverse impact on business operations of CareOregon so that the best possible levels of service quality and availability are maintained respecting defined quality metrics (e.g., SLAs and KPIs)

· Change and Release Management: Please describe proposed Care Coordination change and release management procedures and standards

· Root Cause Analysis (RCA): Please describe proposed RCA policies, procedures and standards and explain how recurring problems or failures are tracked and reported, and how business impact to CareOregon is measured.

· Incident and Problem Management: Please describe proposed incident and problem management policies, procedures, and standards. Describe workflow, escalation, communication, and reporting processes that help to achieve the SLAs

· System Monitoring: Please describe proposed monitoring policies, procedures and standards that meet Care Coordination best practices, including monitoring of buffers, system logs, update errors, database corruption, jobs, transaction and trace logs, network event logs, and middleware, etc.

· Technical and End-User Support: Please describe your ability to assist CareOregon with detailed application functional or technical component knowledge at business process or package or platform expert level. Explain how you would identify and work with any limitations of the skills and competencies of CareOregon in the supported applications and will provide knowledge and skills required for the supported applications at functional and technical levels.

Key Personnel Instructions to Vendor: Please explain the proposed staffing for this effort. Provide a project organization chart

· CareOregon defines key personnel as those for whom resumes will be shared, CareOregon must approve, and who will serve in a leadership role. Provide resumes of key personnel that would be used for the project. What would be their role and level of commitment for CareOregon? Please indicate the production installations already in place that the key people the key personnel on the prospective Vendor’s project team have been involved in that are equivalent scope as the proposed effort for CareOregon?

· What is knowledge and experience of Vendor’s implementation team overall? What percentage of team has successfully installed systems equivalent in size and scope to CareOregon?

· What training and certification programs are in place for Vendor’s staff?

· Does any part of the implementation need to be in-person?

· Provide a matrix of responsibilities (RACI) including milestones, prerequisite milestones, and milestone durations.

· What is the number of hours per week we should anticipate dedicating to the project?

· What is the number of hours per week we should anticipate your team will be working or meeting with us directly?