RFQ No. HHS0017023

Recovery Audit Contractor Services

Exhibit F, Scope of Work (SOW)

Scope of Work Exhibit F

1.1 Description of Services

The Contractor will perform recovery audit review services and conduct Recovery Audit Contractor (RAC) activities in accordance with the requirements of this SOW and HHSC OIG’s directives and guidelines. Unless otherwise noted, requirements included in this document apply to both Medicaid fee-for-service (FFS) and Managed Care Organizations (MCO).

The Contractor shall:

A. Review Medicaid claim and encounter data (collectively “Medicaid claims data”) provided or approved by HHSC OIG or its designee to identify potential Medicaid Improper Payments and recover Overpayments across the spectrum of provider types and services delivered under the Texas Medicaid State Plan or a waiver of the Medicaid State Plan, ensuring there is no duplication or overlap in reviews.

B. Coordinate recovery efforts across a variety of stakeholders (including but not limited to claims administrators, MCOs, HHSC, HHSC OIG).

C. Conduct first-level appeal reviews and facilitate second-level appeals as requested by providers.

D. Provide a secure, online, role-based portal accessible by HHSC OIG, appeal reviewers, providers, and other stakeholders where RAC-related information and documentation can be easily accessed and transmitted.

E. Conduct education and outreach to Texas Medicaid providers and MCOs.

F. Refer suspected fraud or abuse to HHSC OIG.

1.1.1 Federal and State Requirements

A. Contractor must maintain a thorough and complete understanding of Medicaid requirements and all Texas Medicaid services.

B. Contractor must follow all applicable federal and state laws, rules, policies, processes, manuals, contracts, and payment schedules and comply with any required changes, as directed by HHSC OIG.

1.1.2 General Requirements

A. Contractor must be proficient in:

1. Interpreting federal and Texas Medicaid rules, regulations, policies, and contracts for all Medicaid programs, including those administered through managed care delivery models;

2. Performing program integrity risk assessments;

3. Developing logic and algorithms to analyze large data sets and produce meaningful outcomes;

4. Utilizing efficient methods to detect and refer suspected fraud, waste, abuse, and Improper Payments;

5. Securely handling, analyzing, storing, and transmitting large volumes of confidential data including but not limited to Medicaid client data, HHS-business partner contracts with MCOs or providers. All information and materials obtained are confidential as defined in Exhibit D, Data Use Agreement (DUA), Version 8.5; and

6. Conducting government project administration, including effective management and implementation of internal controls, risk management processes, audit trail management and tracking, and information security requirements.

B. Contractor must coordinate with HHSC OIG to implement a governance process for the Texas RAC program that includes establishing and holding periodic project and status update meetings as well as other routine or ad hoc meetings as requested by HHSC OIG.

C. Contractor must work closely and collaboratively with HHSC OIG or its designee(s) to effectively operate the Texas RAC program.

D. Contractor must consult with HHSC OIG, as appropriate, to effectively and efficiently carry out the daily administrative, technical, and programmatic requirements of the Texas RAC program.

E. Contractor must furnish all personnel, material, labor, computers, software, equipment, technology, supplies, travel costs, and other direct or indirect expenses necessary to perform required Services. HHSC OIG will not pay for incidental or administrative expenses related to RAC services.

F. Contractor must maintain a secure, electronic, role-based portal for the exchange of medical records, appeal information, and other relevant documents submitted by Medicaid providers, MCOs, and State staff or their designees. Refer to Section 1.3, Technical Requirements, of this SOW.

G. Contractor must provide HHSC OIG with read only access to all provider access points, including, but not limited to, Contractor electronic portal(s) accessed by providers submitting RAC documents.

H. Contractor must honor HHSC OIG’s explicit right of access to Contractor working papers including copies of documentation collected from the provider and all chain of custody and authenticating affidavits related to the working papers and all underlying records and documents.

I. Contractor must collect evidence (including expert opinions) in accordance with Texas law, including the Texas Rules of Evidence (https://www.txcourts.gov/rules-forms/rules-standards/).

J. Contractor must not remove original records from State offices, Contractor offices, provider locations, or MCO locations.

K. Contractor must develop, conduct and/or make available program education outreach and user support, including the ability to clearly, and in plain language, explain policies and procedures, provide instructional materials, train end users and respond effectively to questions or issues raised by HHSC OIG or stakeholders. Refer to Section 1.1.7, Provider Education and Outreach Program, of this SOW.

L. Contractor must participate in formal hearings/appeals in the format or medium in which those meetings are conducted, provide expert testimony related to RAC activities as needed, and be available to review testimony and evidence with HHSC or HHSC OIG legal counsel at least two (2) Business Days in advance of any scheduled testimony.

M. Contractor must establish and follow a quality assurance process for reviewing formal materials submitted to HHSC OIG including but not limited to presentations, program enhancement proposals.

N. Throughout the Contract Term, Contractor must disclose any new, newly discovered, existing, or potential conflict of interest with respect to any resulting Contract.

Additionally, any such relationship that might be perceived, or represented as a conflict, must be disclosed. Examples of potential conflicts include an existing or potential business or personal relationship between Contractor, its principal, or any affiliate or Subcontractor, with HHSC OIG, MCOs or dental maintenance organizations, or any other entity or person involved in any way in any project that is the subject of the Contract. HHSC OIG will determine to what extent, if any, a potential conflict of interest can be mitigated and managed during the Contract Term. Failure to disclose any such relationship may be cause for Contract termination. If, following a review of this information, it is determined by HHSC OIG that a conflict of interest exists, HHSC OIG reserves the right to mitigate the conflict or terminate the Contract at its sole discretion.

1.1.3 Identification of Potential Improper Payments

A. Contractor must thoroughly evaluate and interpret federal and State Medicaid laws, rules, policies, processes, manuals, contracts, payment schedules, and medical coding and billing https://www.txcourts.gov/rules-forms/rules-standards/ https://www.txcourts.gov/rules-forms/rules-standards/ practices, including requirements specific to Texas Medicaid, all associated waiver programs, and Texas’ MCOs (hereafter referred to as “Medicaid requirements”).

B. Contractor must develop Review Scenarios based on potential Medicaid violations observed in Medicaid claims data or other Medicaid information and data. Review Scenarios must encompass the range of provider types, managed care plan models, and services delivered across Texas Medicaid and associated waiver programs.

C. Contractor must obtain approval from HHSC OIG before pursuing the identification of Improper Payments.

D. Review Scenarios submitted to HHSC OIG for review and approval must, at a minimum, contain the following elements:

1. The title and description of the Review Scenario written in plain language, and including relevant definitions, as well as the process, criteria, and logic used to identify potential Improper Payments;

2. Specific federal and/or State Medicaid law, policy, contracts, or other requirements that support potential violations the Review Scenario aims to identify, including their respective effective dates;

3. An indicator of whether the Review Scenario is an Automated Scenario or a Complex Scenario;

4. Estimated recoveries associated with the Review Scenario, including a description of the logic used to calculate the estimated figure;

5. Examples of potential Improper Payments based on Medicaid claims data or other data (including but not limited to procedure codes and exclusions);

6. A summary outlining the provider types the Review Scenario applies to; and

7. An analysis of the associated Review Scenario data and other relevant information to determine whether services were provided and/or paid in accordance with the cited Medicaid law, policy, contract, and/or other requirements effective on the date that the service was rendered or the claim was adjudicated, as applicable, for each approved Review Scenario. An analysis may include review of medical charts, documentation, and records used to determine if services were medically necessary, appropriate, or authorized.

E. Contractor must submit and present Review Scenarios to HHSC OIG and other assigned stakeholders, as directed by HHSC OIG, for review and approval.

F. Contractor must coordinate with HHSC OIG or its designee(s) to identify and exclude from review and/or recovery any Medicaid claims data details that have been reviewed and/or recovered by another entity, that are currently under review by another entity, or that are expected to be reviewed by another entity to prevent duplication of review and recovery efforts.

G. Contractor must restrict reviews to the service dates, program types, provider types, Medicaid claims data types, and other relevant parameters determined and approved by HHSC OIG for a given scenario. Contractor must not review Medicaid claims data older than five (5) years from the date the Medicaid claims data was submitted to HHS or its designee (for the purposes of this contract, “submitted” means the date of service of the Medicaid claims data) unless a written exception is granted by HHSC OIG.

H. Contractor must identify Medicaid claims data with Improper Payments resulting from approved Review Scenarios and provide identified Medicaid claims data details to HHSC OIG and/or its designee(s) to enable HHSC OIG to evaluate and resolve the Improper Payments.

I. Contractor must adhere to limitations established by HHSC OIG regarding the number and frequency of medical records to be requested and/or reviewed for a given Review Scenario, provider type, provider, or other defined parameter, unless a written exception is granted by HHSC OIG.

J. Contractor must perform reviews of individual Medicaid claims data or must cease reviews upon direction by HHSC OIG, regardless of otherwise established deadlines or requirements, and Contractor must use current data sets to initiate each review unless a written exception is granted by HHSC OIG.

K. Contractor must recommend process or system changes to HHSC OIG and/or its designee(s), to prevent future Improper Payments based on observed Improper Payment trends.

L. Contractor must provide necessary support services to recover Overpayments from either MCOs or providers as directed by HHSC OIG.

1.1.4 Coordinate Recovery of Overpayments

A. Contractor must submit a file containing identified Overpayments to HHSC OIG and/or its designee(s) on a frequency and in a manner and format determined by HHSC OIG and/or its designee(s). HHSC OIG and/or its designee will then provide Contractor with a response file that includes all Medicaid claims data that have been successfully scheduled for recovery and those that resulted in an error.

B. Contractor must resolve any errors included on the return offset file and submit the results to HHSC OIG and/or its designee, once resolved. The process of resolution involves coordinating with HHSC OIG and/or its designee to research and address the conditions that resulted in the error.

C. HHSC OIG or its designee will send the Contractor a file summarizing successful recovery information from the previous month, referred to as the “collection file”, on a periodic basis as determined by HHSC OIG and/or its designee(s).

D. Contractor must reconcile the collection file with the resolved offset file. The process of reconciliation involves:

1. Comparing the Contractor’s record of identified Overpayments with the collection file prepared by HHSC and/or its designee, using matching data elements (including but not limited to Claim Numbers);

2. Coordinating with HHSC OIG and/or its designee to research Medicaid claims data that are not represented in both data sets; and

3. Ensuring that Medicaid claims data match between the final iteration of the Contractor’s record of identified Overpayments (the resolved offset file) and the collection file for a given period (usually a month), and that any unmatched Medicaid claims data are appropriately documented, addressed, and shared with HHSC OIG in a timely manner.

1.1.5 Appeals

Providers who are subject to an Improper Payment finding as the result of a RAC review are entitled to two levels of due process:

1. First level appeals are reviewed by the Contractor to determine whether the original finding is valid based on the original review parameters plus any additional information supplied by the provider within allowed parameters.

2. Second level appeals are independent reviews performed by HHSC or its designee that considers the original finding, the first-level appeal decision and associated information, and any other information supplied by the provider within allowed parameters. Second-level appeal determinations are final.

1.1.5.1 Appeal Submission Methods

A. Contractor must update or develop, maintain, and use the online portal, as described in Section 1.3, Technical Requirements, for securely receiving, processing, and tracking appeal requests, documents, and time frames. For appeal purposes, the Contractor’s online portal must allow providers to:

1. Register to submit appeal requests electronically;

2. Receive notifications and status updates regarding appeal requests;

3. Upload supportive appeal request documents (categorized by type and identified as such); and

4. Confirm the total number of pages uploaded.

B. Contractor must create and maintain all official records for first and second level appeals in the Contractor’s online portal application and ensure that HHSC OIG and designated appeal reviewers can access appeal records on demand. Note that these “official records” are property of HHSC OIG and must be retained as per Texas Government Code Chapter 441 and transferred to HHSC OIG upon termination of the Contract as part of Turnover activities. Contractor must accept documents via mail (U.S. Postal Service or other shipping service such as UPS or FedEx), facsimile, or other secure transmission method(s) approved by HHSC OIG for providers who do not register to access the Contractor’s online portal. HHSC OIG may define document categories and issue specific guidelines for each.

C. Contractor must provide HHSC OIG with copies of all documentation on file for any first-level appeal or appeal received within ten (10) Calendar Days of the date requested by

HHSC OIG.

D. Contractor must facilitate and maintain secure communication and information exchange regarding appeals between providers, HHSC and/or its designee(s), and HHSC OIG and/or its designee(s).

1.1.5.2 First-Level Appeals

A. Contractor must conduct and adjudicate first-level appeals within 45 Calendar Days of receiving a first-level appeal request or the date that all first-level appeal request deficiencies are resolved, if applicable.

B. Contractor must thoroughly and objectively conduct first-level appeals and review associated documentation to determine whether to uphold or overturn the initial finding in accordance with applicable Medicaid requirements, including federal and State laws and regulations, Texas Medicaid policies, and managed care contract terms when applicable.

C. Contractor must conduct the first-level appeal utilizing a reviewer(s) who was not associated with the initial review and who possesses the subject matter expertise necessary to assess the particular scenario on appeal.

D. If a provider chooses to dispute the initial Overpayment finding by filing a first-level appeal request, Contractor must complete the first-level appeal review and notify the provider or their designated agent of the first-level appeal decision within 45 Calendar Days. The notification must include detailed first-level appeal outcomes including, when applicable, specific law/policy/contract references and, if the Overpayment finding is upheld, information regarding the requirements and process the provider must follow to submit a second-level appeal request.

1.1.5.3 Second-Level Appeals

A. If a provider elects to appeal the first-level appeal decision, Contractor must notify the assigned second-level appeal reviewer, as designated by HHSC and communicated by HHSC OIG, that the record for a pending appeal is complete and ready for review within five (5) Business Days of receiving the second-level appeal request.

B. Contractor must provide second-level appeal reviewers with access to all materials submitted along with or regarding the appeal request, as well as the original documents and correspondence related to the Overpayment, first-level appeal request, and associated decision.

C. Once a second-level appeal has been completed, Contractor will receive the decision from the second-level appeal reviewers and shall notify the provider of the second-level appeal decision within seven (7) Calendar Days of receipt. Copies of letters should be placed in the provider’s account within the Contractor’s online portal.

1.1.6 Communication Requirements

1.1.6.1 Contractor Communication with HHSC OIG

A. Contractor must respond to requests from HHSC OIG within 48 hours, excluding weekends and Holidays.

B. Contractor must notify HHSC OIG when providers or other external stakeholders raise concerns or inquiries that Contractor is not reasonably or satisfactorily able to respond to, that remain unresolved after the associated resolution timeframe, or that indicate a pattern or trend that may require additional exploration or intervention.

C. Contractor must obtain HHSC OIG approval regarding the content, format, and transmission method for provider and other published or external communications.

D. Contractor must immediately escalate all inquiries or outreach related to the Texas RAC program received from members of the media; legislative members, bodies, or related agents; other federal, State, or local agencies; or other similar sources to HHSC OIG for direction prior to responding.

E. Contractor must deliver trend analysis and performance reports to HHSC OIG and/or its designee(s) in the agreed upon manner and timeframes.

F. Contractor must request advance HHSC OIG approval for extensions or adjustments to timelines.

G. Contractor must provide HHSC OIG with electronic copies of provider correspondence (including but not limited to, letters and notices) monthly in an agreed-upon manner and format.

H. Contractor must proactively discuss contractual requirements, performance, amendments, billing and invoicing, or other related matters with HHSC OIG, as needed.

I. Contractor must exercise sound professional judgment for identifying Medicaid claims data activities, recoveries, processes, or projects under the auspices of the Texas RAC program that are abnormal, noteworthy, or that could result in significant adverse impact (including but not limited to, provider abrasion) and promptly escalate those matters to HHSC OIG in writing, clearly highlighting the basis for the escalation.

J. Contractor must seek guidance and/or decisions from HHSC OIG on RAC program matters in writing, providing at a minimum, a summary of the request or topic the guidance and/or decision relates to and suggested solutions, as applicable. Contractor must maintain record of the guidance and/or decision made.

1.1.6.2 Contractor Communication with Providers

Contractor must obtain advance HHSC OIG approval regarding the content, format, and transmission method for provider communications related to the Texas RAC program. All published content (including but not limited to, frequently asked questions and other program details added to the Texas RAC public-facing website), educational materials, letters, and correspondence templates must be approved by HHSC OIG prior to being used or distributed and when any changes are made. Additionally, all items referenced above should at a minimum include the following:

1. HHSC OIG logo

2. Contact information for the Contractor

3. Contact information for the HHSC OIG

1.1.6.3 Customer Support

A. Contractor must establish and operate a toll-free hotline and mailing address for provider and/or MCO inquiries and customer support, to be included on all provider correspondence. Additional customer service support contact methods, such as email or chat options, may also be considered.

B. The hotline and other customer service contact methods must be accessible and staffed during normal business hours, generally 8:00 a.m. to 5:00 p.m., in time zones applicable to Texas provider locations (Central Time and Mountain Time). The State-approved Holiday schedule is updated annually and can be found on the Texas State Auditor’s Office website (https://hr.sao.texas.gov/Holidays/).

C. Contractor must respond to provider inquiries within 48 hours of receipt, excluding weekends and Holidays, and Contractor must resolve issues included within an inquiry within seven (7) Calendar Days, unless HHSC OIG grants an extension based on the complexity, volume, or other factors involved.

D. Contractor must ensure that the hotline meets the following minimum performance requirements, conduct ongoing call quality assurance to ensure these standards are met, and provide performance metric information to HHSC OIG monthly or in an agreed-upon manner and format

1. An average hold time of two minutes or less.

2. A call abandonment rate of seven percent or less.

E. The hotline must be staffed with personnel who are knowledgeable about the Texas RAC program and processes, and who are able to satisfactorily address RAC-related inquiries, including but not limited to; the review process and status, medical record requests and receipt verification, appeal processes, and requests for copies of provider or MCO correspondence.

F. Artificial Intelligence Systems (including but not limited to assistants, chatbots,) must not be used without prior disclosure to and consultation with HHSC OIG and HHSC to ensure that AI controls that meet HHSC and HHSC OIG requirements are in place.

1.1.6.4 Notices

A. Contractor must notify providers in writing of potential Improper Payments within 60

Calendar Days of observation. Notification should be completed by mailing the written notice to the provider, and/or uploading the written notice to the Contractor’s online portal.

If the provider has selected a preferred method of contact within the Contractor’s online portal, the Contractor must notify the provider via the provider’s preferred method.

B. Notices to providers must, at a minimum, include a description of the Review Scenario, the reason for the potential Improper Payment, and information regarding the provider’s appeal rights.

C. For mailed correspondence, Contractor must apply a standard, distinct, colored border on envelopes to easily distinguish RAC mail and inform the provider community about using the markings to recognize important RAC correspondence. Contractor must obtain HHSC OIG approval for correspondence format and layout. Contractor will be allowed to have a 90-Calendar Day grace period following the Effective Date of the executed Contract to develop and implement this requirement.

D. For mailed correspondence, Contractor must utilize the address of record on the provider file supplied by HHSC OIG or its designee, unless the provider has designated a RAC-specific contact preference in the Contractor’s online portal. If the Contractor’s online portal includes an updated contact preference or information, the information in the portal takes precedence.

E. For Complex Scenarios, once the Contractor has identified a potential Improper Payment in Medicaid claims data, the Contractor must contact the provider in writing to request the medical documentation or other evidence necessary to determine the appropriateness of the Medicaid reimbursement reflected in the Medicaid claims data and must grant providers the response timeframe allowed by HHSC OIG.

F. Contractor must accept medical records and documentation via:

1. The Contractor’s online portal,

2. United States Postal Service or other similar mail/package carriers, and

3. CD/DVD or facsimile, upon provider’s request.

G. For Complex Scenarios, the Contractor must send providers reminder letters and make follow-up phone calls for medical documentation requests in a frequency and timeframe determined by HHSC OIG.

H. When correspondence is received by mail or any transmission method other than the

Contractor’s online portal, Contractor must enter and upload the information into the Contractor’s online portal (or associated database) for tracking, retention, and reporting.

I. Contractor must establish due dates for provider requirements and obtain HHSC OIG approval regarding the established timeframe (Calendar Days or Business Days). If the original due date falls on a weekend or Holiday, the Contractor must update the due date to the following Business Day and recalculate subsequent timeframes accordingly.

1.1.7 Provider Education and Outreach Program

A. Contractor must develop and implement an education and outreach program for providers and stakeholders regarding RAC policies, protocols, and Improper Payment identification and Overpayment recoveries as agreed upon with HHSC OIG. Contractor-observed trends should be considered when developing education and outreach materials and proposing education opportunities to HHSC OIG.

1. Examples of education and outreach efforts include sending educational correspondence to providers, attending provider association and stakeholder meetings, creating virtual training presentations or videos (including but not limited to, live webinars and on-demand trainings), providing technical assistance,

2. Examples of education and outreach content include information on how Improper Payments are detected, Review Scenario specifics, Improper Payment prevention best practices, ways to reduce Technical Denials..

B. Education and outreach materials must be approved by HHSC OIG prior to use, presentation, or distribution.

C. Contractor must, at a minimum, develop and deliver four (4) trainings per year. The trainings must be stored and made available in the online portal.

1.1.8 Reporting Requirements

A. Contractor must respond to requests from HHSC OIG staff for information and reports related to the Contract within 48 hours, excluding weekends and Holidays, unless HHSC OIG agrees to an extension based on the complexity, volume, or other factors involved.

B. Contractor must develop and deliver reports in a manner and schedule agreed upon by HHSC OIG that enable HHSC OIG to assess Contractor, program performance, and conduct RAC trend analysis. Examples of reports include:

1. Statistics regarding Automated and Complex Scenarios.

2. Statistics that identify FFS and MCO scenarios and outcomes.

3. Statistics that identify MCO trends by organization.

4. Review Scenario reports, such as the number and dollar value of claim details included in the review, number of claim details that resulted in findings associated with the scenario, and the recoveries identified and collected (by provider, provider type, and in total).

5. Reports identifying providers that may benefit from education.

6. The number of letters sent to providers.

7. The number of medical records requested and received (by scenario, provider, provider type, and total).

8. The number and types of Technical Denials for each Complex Scenario.

9. First and second level appeal trends (requested, completed, outcomes).

10. Customer service inquiries, including number of inquiries and response timeliness.

11. Call volume, answer rates, and hold times for the hotline.

12. Technical performance, including system availability, downtime, and performance.

13. Other reports as requested by HHSC OIG to assess Contract and program performance.

C. Contractor must refer suspected cases of fraud, or abuse to HHSC OIG within 24 business hours of discovery, or in a time frame otherwise approved by HHSC OIG.

1.2 Required Qualifications

1.2.1 Organizational Requirements

Contractor must meet and maintain the eligibility requirements for Medicaid RACs described in 42 CFR § 455.508, which includes the technical capability to perform RAC services as described in 42 U.S.C. § 1396a(a)(42)(B), 42 CFR Part 455 Subpart F, Texas Government Code Section 544.0504, 1 TAC § 354.1451, and the requirements detailed in this Solicitation.

1.2.2 Key Personnel and Staffing

To prevent any real or perceived key personnel conflict of interest, Contractor must ensure that key personnel and reviewers (or those consulted during a review) do not participate in RAC activities, such as reviews or appeals, involving medical facilities, business entities, or individuals with which they are employed, contracted, or affiliated, either indirectly or directly, or with which they have been employed, contracted, or affiliated in the preceding 12 months.

1.2.3 Key Personnel Required Credentials

A. Project Director: At least five (5) years of relevant experience in managing a complex system or project, ideally performing RAC or similar government or public health review activities, is preferred.

B. Federal regulations at 42 CFR 455.508(b) require Medicaid RACs to hire a minimum of one Medical Director who is in good standing with the relevant State licensing authorities and has relevant work and educational experience. HHSC has an approved State Plan Amendment allowing Contractor to use a panel of physicians to evaluate RAC Review Scenarios in lieu of a Medical Director; however, this allowance is subject to change. HHSC OIG prefers that Contractor provide both a Medical Director and a panel of medical professionals who participate in Review Scenarios and first-level appeals involving services relevant to their area of medical expertise, as described below.

1. Medical Director: A physician with relevant Medicaid experience licensed to practice medicine in the State of Texas. The Medical Director must be a Doctor of Medicine or Doctor of Osteopathy actively licensed and in good standing with relevant licensing authorities (preferably in the state of Texas) and must possess associated medical credentials from an accredited medical school.

2. Panel of Physicians: A panel of physicians and other medical professionals with a variety of specialties (Medical specialists may include, but not be limited to, pharmacists, radiologists, therapists and registered nurses) to review and assess the range of providers and services within Texas Medicaid. All individuals on the review panel must possess appropriate medical credentials for their specialty and must be actively licensed and in good standing with the relevant licensing authority (preferably Texas) for their area of medical specialization. If Contractor elects to provide a panel of physicians in lieu of or in addition to a Medical Director, the Medical Director is exempt from being licensed in Texas.

3. Certified Coder(s): Individuals certified and experienced in medical coding requirements, including processes and practices and who maintain active and ongoing continuing education to remain abreast of changes to medical coding guidelines.

Certified coders are responsible for rendering coding determinations associated with Review Scenarios and the identification of Improper Payments. Certified coder(s) must possess a certificate for medical coding issued by an accredited coding organization, such as The Practice Management Institute, The American Health Information Management Association, or the American Academy of Professional Coders.

4. Review Manager: Must have relevant experience in Medicaid policies, regulations, managed care encounters and FFS claims reimbursement, as well as experience with compliance reviews, managed care contracts or audit techniques and procedures.

Certification as a Fraud Examiner, Fraud Investigator, or similar credentials are preferred.

5. Medical Review/Utilization Manager: Must possess recent and relevant supervisory experience in medical utilization review.

6. Technical Point of Contact: Individual with relevant IT experience who is responsible for maintaining and overseeing Contractor’s technological infrastructure, including the online portal and telecommunication services. This position will coordinate with HHSCOIG or its designee(s) regarding Contractor’s technology, telecommunication, and information security services.

7. Data Analytics Point of Contact: Individual with relevant data analysis or data science expertise who will coordinate with HHSC OIG or its designee(s) regarding the Contractor’s data analytics services, including the logic and techniques associated with developing and maintaining RAC scenarios, comparing data sets, and reporting.

1.2.4 Key Personnel and Staffing Maintenance

A. Contractor must hire and maintain key personnel and staff required to effectively conduct RAC activities. HHSC OIG reserves the right to add or modify positions as necessary for appropriate performance of the RAC program. HHSC OIG further reserves the right to require Contractor to remove or replace personnel performing services for the Texas RAC program if their qualifications or performance are not satisfactory to HHSC OIG.

B. Contractor must provide HHSC OIG with a list of all key personnel and staff that support RAC activities within ten (10) Calendar Days of Contract execution. At a minimum, the list must include staff names, roles, titles, email addresses, and qualifications. Contractor must also provide HHSC OIG with an updated list within ten (10) Calendar Days of any changes to key personnel and staff that support RAC activities. At a minimum, the list must include a description of the change and the effective date of the change.

C. Contractor must maintain and, upon request, provide HHSC OIG with documentation regarding the credentials, employment history, or affiliations of individuals involved with review or first-level appeal determinations, as well as other clinical, professional, or administrative staff.

1.3 Technical Requirements

1.3.1 Online Portal

A. Contractor must provide and maintain a secure online, role-based portal application accessible by HHSC OIG, providers, MCOs, and other stakeholders to allow for the following, at a minimum:

1. Providers to designate and update their points of contact for RAC activities;

2. Providers to designate their preferred contact methods;

3. Secure electronic exchange of information, including provider correspondence and appeal information;

4. Secure upload and storage of medical records, contract documents, and other documents related to RAC reviews; and

5. Track timeframes and display status updates related to RAC review and appeal activities (including but not limited to, outstanding, received, review underway, review complete).

B. The portal must:

1. Be accessible via standard web browsers, such as Microsoft Edge, Google Chrome, and Mozilla Firefox;

2. Allow providers and other stakeholders to register for a portal account with a secure login and authentication process;

3. Include role-based security provisioning that conditions the levels of access available to different categories of users including but not limited to view-only access to portal functionality and account information, the ability to download and/or edit certain information. HHSC OIG must approve roles for State users;

4. Include functionality for providers to designate one or more points of contact and associated demographics (including but not limited to, name, title, phone number, email address, mailing address, fax number) for receiving RAC correspondence and coordinating first and second-level appeals;

5. Allow the upload of large documents or sets of documents (including but not limited to, medical records) and for document uploads to be named/labeled and categorized by predetermined labels;

6. Include a mechanism to alert provider contacts when correspondence is added to their account or when a workflow status or activity changes;

7. Include capabilities to support appeal policies and procedures as defined by HHSC;

8. Include functionality for HHSC, stakeholders and or its designee(s) to access reports based on desired metrics as well as automatic reporting;

9. Include a method to communicate systemic information to all users (including but not limited to, banner messages or similar functionality);

10. Be accessible 24 hours a day, 7 days a week, except for standard downtime for enhancements and maintenance;

11. Publish notifications regarding scheduled maintenance on the portal’s login page at least 48 hours in advance of the planned downtime;

12. Serve as the official source of record for first and second-level appeals; and

13. Meet the compliance standards of TX-RAMP Level Two (2). Refer to Section 2.5, Texas Risk and Authorization Management Plan, of the RFQ.

C. Contractor must also provide and maintain a publicly accessible website specific to the Texas RAC program that includes information for providers regarding relevant functions performed under this Contract, including clear descriptions of Review Scenarios, process overview information, and educational materials. Additionally, Contractor must provide the website’s link for inclusion on HHSC OIG and other State websites, as appropriate.

The Contractor must implement standard search engine optimization (SEO) best practices to ensure the site can be properly accessed, indexed and associated with relevant keywords.

(e.g., if “Texas RAC” is searched via standard web browsers, it will bring up a link to the website).

D. The Contractor must report unscheduled outages to HHSC OIG no later than 24 hours after Contractor becomes aware of an outage.

1.3.2 Data Sharing and Security

A. Contractor must ensure that all data transmission, exchange, and storage processes meet the technical specifications and information security standards applicable to the content of information being exchanged, which includes confidential data such as Personally Identifiable Information (PII) and Personal Health Information (PHI).

B. Contractor must ensure all data exchange and storage processes are secure and compliant with the Health Insurance Portability and Accountability Act (HIPAA) and all provisions of Exhibit D, Data Use Agreement (DUA), Version 8.5.

C. Contractor must not offshore HHS confidential data; must ensure that all HHS confidential data is stored, maintained and transmitted only within the contiguous United States; and must not allow individuals or systems outside of the United States to access HHS confidential data.

D. As Review Scenarios are developed, Contractor must consult with HHSC OIG and/or its designee(s) to determine and document a complete list of the required data fields, with descriptions and associated parameters, that will be used for the detection and validation of Improper Payments.

E. Contractor must coordinate with HHSC OIG and its designee(s) to implement a data/file exchange solution that aligns with the existing infrastructure (including but not limited to, file layouts, file types, secure data exchange methods) of the Medicaid Enterprise System (MES) or other systems from which data is collected and exchanged, with minimal impact to existing systems.

F. Contractor must document the agreed-upon data flow and information exchange in a diagram that details the data exchange processes, transmission methods or systems, and file layouts associated with RAC activities. Maintain and update these documents as necessary throughout the Contract Term and submit updated iterations to HHSC OIG as changes occur.

G. Contractor must respond to additional data exchange documentation requests from HHSC OIG in the manner, format, and timeframe requested. For example, HHSC OIG may request Contractor’s assistance in updating the RAC data exchange processes in HHSC’s Joint Interface Plan (JIP). Upon request, Contractor must demonstrate, explain, or provide to HHSC OIG the Contractor’s process(es) for comparing data sets and identifying inconsistencies in data provided by HHSC OIG or other entities.

H. Contractor must receive and send all data in a format and timeline designated by HHSC

OIG.

I. Contractor must implement and maintain industry-standard database audit logging across all systems, applications, and platforms that store, process, or transmit Texas HHS Confidential Information. Audit logging controls shall, at a minimum:

1. Record all access and modification events, including user identity, date and time of access, source IP address, device details, and event outcome (success or failure);

2. Ensure audit logs are protected against unauthorized access, alteration, and deletion, consistent with NIST SP 800-53 controls AU-9 (Protection of Audit Information) and AU-11 (Audit Record Retention);

3. Retain audit logs in accordance with HHS agency record retention requirements to support regulatory reviews, investigations, and compliance audits;

4. Provide the capability to export logs in formats compatible with Security Information and Event Management (SIEM) solutions to enable centralized monitoring, incident detection, and response;

5. Include alerting mechanisms for suspicious or anomalous activity and supporting capabilities to facilitate audit and compliance inquiries;

J. The Contractor must:

1. Encrypt data at rest and in transit using FIPS 140-2 validated cryptographic algorithms;

2. Enforce role-based access controls and multi-factor authentication for all privileged and administrative accounts;

3. Notify HHSC OIG promptly of any actual or suspected security or privacy incident in accordance with applicable legal, regulatory, and contractual notification timelines;

4. Maintain appropriate security and compliance records and make such records available to HHSC OIG upon request for audit or oversight purposes.

1.4 Agency Requirements

HHSC OIG, or its designee(s), will:

A. Arrange a kick-off meeting with Contractor upon Contract execution;

B. Assist Contractor with development and facilitation of the RAC governance process;

C. Review and approve Contractor’s publications, correspondence templates, and other communications as necessary;

D. Coordinate with Contractor to define specific business processes and associated timelines;

E. Provide direction and technical assistance to the Contractor to support the fulfillment of the duties outlined in this SOW;

F. Review and approve Review Scenarios submitted by the Contractor. HHSC OIG will establish a Scenario Review process to obtain input from other HHSC stakeholders or designee(s), as appropriate;

G. Provide Contractor with data sets applicable to a given review;

H. Identify FFS claims, managed care encounters, or populations that should be excluded from a given review;

I. Coordinate the recovery or recoupment of Improper Payments and provide collection details to Contractor;

J. Provide Contractor with reports and files necessary to support reviews, comparisons, and recoveries as appropriate to assist the Contractor with achieving the objectives of the Contract;

K. Coordinate the development and communication processes for completing second-level appeals and the provision of decisions to Contractor;

L. Respond to Contractor requests and inquiries required for the performance or progress of RAC activities within 48 hours, excluding weekends and Holidays, including requests for timeframe extensions;

M. Respond to other Contractor requests and inquiries within five (5) Business Days;

N. Review and respond to Contractor Deliverables within 15 Calendar Days of receipt;

O. Attend, participate in, and schedule meetings to facilitate Contractor’s execution of activities required under the Contract, as needed;

P. Provide meeting space for joint meetings and work sessions, if needed; and

Q. Monitor Contractor’s performance and provide feedback.

1.5 Deliverables

A. Contractor must attend the kick-off meeting in the format or medium arranged by HHSC OIG upon Contract execution. HHSC OIG will provide Contractor with details on this meeting when it is arranged.

B. In consultation with HHSC OIG, Contractor must develop and document an outline of the governance and oversight process for the Texas RAC program. The required outline will encompass the framework of meetings and Deliverables that the Contractor will use to obtain HHSC OIG decisions regarding RAC activities and to provide HHSC OIG program staff, executive leadership, and other relevant stakeholders with updates on the status and progress of RAC activities. The required outline must, at a minimum, include the following elements and be delivered to HHSC OIG for approval within 60 Calendar Days of the Effective Date of the Contract:

1. The title and purpose of each governance activity;

2. The forum or delivery method of each governance activity. Delivery method examples are in-person meetings, virtual meetings, and emailed reports;

3. The key participants or recipients (by role) who should attend or receive each governance activity;

4. The frequency and proposed schedule for each governance activity;

5. The change management process associated with adjustments to governance activities; and

6. The process for ad hoc or other meetings within the governance lifecycle, as needed.

C. Contractor must deliver the online portal described in Section 1.3, Technical

Requirements, of this SOW. The portal must be fully functional, live, and access permissions granted and activated for HHSC OIG, appeal reviewers, and providers to begin using within 60 Calendar Days of the Effective Date of the Contract, unless an alternative, interim option is approved or a written extension is granted by HHSC OIG.

D. Contractor must deliver the key personnel and staffing list described in Section 1.2.4, Key Personnel and Staffing Maintenance, of this SOW to HHSC OIG within ten (10) Calendar Days of the Effective Date of the Contract and within ten (10) Calendar Days of any changes.

E. Contractor must deliver procedures for processing first-level appeals and facilitating second-level appeals to HHSC OIG for approval within 60 Calendar Days of the Contract Effective Date. The procedures should incorporate a description of:

1. How the Contractor will work with HHSC OIG to establish and document detailed procedures for processing first and facilitating second-level appeals for both Automated and Complex scenarios;

2. Contractor’s internal processes for processing first-level appeals that align with Section 1.1.5.2, First-Level Appeals;

3. Contractor’s internal processes for facilitating second-level appeals aligning with Section 1.1.5.3, Second-Level Appeals, including details of the coordination process between Contractor and HHSC OIG’s designated appeal reviewers; and

4. Contractor’s first- and second-level appeals processes related to provider communication, including requests, deficiency resolution, status updates, and decisions; tracking workflow, status, and timeframes; document collection and obtaining attestations related to document completion and accuracy; the exchange of information and documents between parties involved in the appeals; and reporting on request rates and outcomes for appeals.

F. Contractor must develop and deliver distinct colored border envelopes, as described in

Section 1.1.6.4, Notices, of this SOW, that easily distinguish RAC mail and inform the provider community about using the markings to recognize important RAC correspondence within 90 Calendar Days of Contract Execution.

G. Contractor must deliver Improper Payment Review Scenarios as described in Section

1.1.3, Identification of Potential Improper Payments, of this SOW, annually to HHSC OIG for approval. Contractor must present a minimum of five (5) new Review Scenarios to HHSC OIG and/or its designee(s) for consideration and approval within each 12-month period in which the Contract is active.

H. Contractor must deliver data security and exchange diagrams to HHSC OIG for approval within 45 Calendar Days of the Effective Date of the Contract and within 30 Calendar Days of when approved changes are implemented throughout the life of the Contract. In consultation with HHSC OIG and/or its designee(s), Contractor must develop and provide HHSC OIG with:

1. A description of Contractor’s secure data exchange and storage processes and how they comply with Contract requirements;

2. A diagram that documents in detail the agreed-upon data flow and information exchange process with respect to the identification of Improper Payments and collecting recoveries. This process should generally include:

a. How, when, and what files, data elements, and formats will be provided to Contractor, and by whom, for the purpose of scenario development and improper payment detection;

b. How Contractor will work with HHSC OIG or its designee(s) to exclude claims already under review or recovery by another entity;

c. How and where Contractor will store the data;

d. How, when, and with what techniques, tools, and information Contractor will validate Improper Payments;

e. How, when, and what files, data elements, and formats will be provided to

HHSC OIG or its designee(s) for the collection of Overpayments or the resolution of Underpayments;

f. The process for crediting…