Exhibit F, Scope of Work (SOW).pdf

HHS0016585 Exhibit F

RFO No. HHS0016585

Exhibit F, Scope of Work (SOW)

Contents Section 1 – Overview

1.1 Description of Services

1.1.1 Overview of LabWare Laboratory Information Management System (LIMS) Section 2 – Contractor Requirements

2.1 Contractor Requirements

2.1.1 General

2.1.2 Phase I - Operations

2.1.3 Phase II – Turnover

2.2 Project Management Office (PMO)

2.2.1 Project Documentation

2.3 Training Requirements

2.4 Licensing Requirements

2.5 Operation Support Requirements

2.6 Performance Support Requirements

2.7 Security Requirements

2.8 System Maintenance Service Requirements

2.9 Disaster Recovery and Business Continuity Requirements

2.10 Reporting Requirements

2.11 Configuration Management Requirements

2.12 Supplemental Services Requirements

2.12.1 Supplemental Services

2.13 Development Services

2.14 Service Requests

2.15 Severity Levels, Response and Resolution Times

2.16 TLO Integration

2.16.1 TLO Interface Features and Functionalities

2.16.2 Testing Requirements

2.16.3 Deployment Requirements

2.16.4 Data Analytics Requirements

2.17 Accessibility Requirements

2.18 Turnover Requirements

Section 3 – Deliverables

3.1 Deliverables

3.1.1 Written Deliverables

3.1.2 Deliverables Acceptance

3.1.3 Deliverable Due Dates

Section 4 – Key Performance Measures

4.1 Key Performance Measures and Liquidated Damages

Section 1 – Overview

1.1 Description of Services

DSHS provides vital statistics, compiles and disseminates health data, administers chronic and infectious disease prevention, laboratory testing efforts, leading public health response to disasters, disease threats and outbreaks, and provides licenses and regulatory services.

DSHS PHLD serves the state of Texas by performing a variety of analyses on 450,000 samples per year in support of public health, including Texas Health Steps (THSteps) Medicaid Program, Microbiological Services, Emergency Preparedness, and Consumer Product Testing. More than 8,000 entities submit these samples. This testing is supported by LabWare LIMS, applications for tracking and testing samples and reporting results.

DSHS requires an enhanced LIMS capability to modernize laboratory ordering, reporting and supply management. The current Labware system must integrate with the Texas Laboratory Online (TLO) application. This integration is necessary to ensure secure, HIPAA compliant (PHI) and to support automated reporting, order processing and inventory management.

DSHS has identified the need to establish a LabWare LIMS Maintenance and Operations (M&O) Contract, to provide the following:

a. Maintenance and Operations support for LabWare LIMS v.8 and Clinical Health Template (CHT) v. 5.1;

b. Licensing for LabWare LIMS v.8;

c. Supplemental Services (Administrative Support)

d. Provide integration services from LabWare Inc to connect LabWare LIMS to the TLO application;

e. Configuration for LabWare LIMS Data Entry templates for electronic orders; and

f. Development Services.

1.1.1 Overview of LabWare Laboratory Information Management System (LIMS)

Labware LIMS v.8 with Clinical Health Template v.5.1 is currently used in testing samples of virology, serology, advanced molecular, biothreat and chemical threat groups.

The TLO System is designed to pull and push data between the different LIMS applications. This will require the LIMS vendors to develop interfaces with the TLO application.

Section 2 – Contractor Requirements

2.1 Contractor Requirements

2.1.1 General

The Contractor shall provide Services, as described in this SOW, in two (2) phases, Operations and Turnover.

2.1.2 Phase I - Operations

Operations must commence on Go-Live, February 28, 2027, as detailed in Section 2.16.3 (Deployment Requirements), DEP-09. The System Agency will provide written notice to the Contractor to proceed with the commencement of Operations. Operations include all requirements for the operational support of the Solution as detailed in Section 2.5 (Operation Support Requirements). Operations require the Contractor to develop and maintain the Deliverables as required by Section 3.1 (Deliverables) of this SOW.

2.1.3 Phase II – Turnover

Turnover activities will begin twelve (12) months prior to the end of the Contract Term or as requested by the System Agency. Turnover includes the administrative and operational activities performed by the Contractor to move the System and associated data to either the System Agency or System Agency designee. The Contractor must perform all Turnover activities without impacting the Users’ experience and to ensure the System Agency does not experience a reduction of Services during Turnover. Additional information related to Turnover Services is detailed in Section 2.18 (Turnover Requirements) of this SOW. Turnover requires the Contractor to develop and maintain the Deliverables as required by Section 3.1 (Deliverables) of this SOW.

2.2 Project Management Office (PMO)

Contractor shall provide the Services set forth in Table 1 - PMO Requirements.

Table 1 – PMO Requirements

REQ. No. Requirement Description PMO-01 The Contractor must establish a Project Management Office (PMO) to manage project tasks, Deliverables, risks, and issues for all System projects during the Contract Term.

PMO-02 The Contractor must attend the post-award meeting (in person or virtual), coordinated by the System Agency, to be held within two (2) Business Days of the Contract Effective Date. Contractor must ensure that Contractor's point of contact (POC) attends the meeting. The POC will be responsible for:

a. Completion of all Deliverables on or before the due dates;

b. Providing management of the LabWare resources on the project and interfaces with the System Agency project manager; and

c. Provide an overall status of activities (written or verbal) performed by LabWare resources and assist System Agency project manager in proactively mitigating risks based on LabWare implementation experience.

PMO-03 The Contractor must define, manage, and ensure completion of all Contract project tasks, technical specifications, risks, issues, and manage the delivery of Services and Deliverables in accordance with the requirements of the Contract. This includes, but is not limited to the following:

a. Provide day-to-day management of Contract projects including overall System performance, Contract compliance and project status updates based on System Agency approved frequency and schedule;

b. Manage current work plans and coordinate availability of scheduled resources to the project;

c. Manage all the Contractor resources and ensure appropriate resources are available throughout the Contract;

d. Establish and maintain communication as per the approved communication plan;

e. Maintain status reporting, budget/cost reporting, issue reporting, tracking, escalation, and resolution procedures;

f. Manage and internally review the Contractor’s invoices and Deliverables for conformance with Contract requirements; and

g. Provide timely submission of Contract Deliverables and Services.

PMO-04 The Contractor must use System Agency-approved tools (e.g., Microsoft Project, Microsoft TEAMS, SharePoint, etc.) for project management throughout the Contract Term.

PMO-05 Contractor must provide to System Agency an agenda for all meetings forty-eight (48) hours prior to the meeting and include at a minimum the following information:

a. Objective of meeting;

b. Key attendees;

c. Action items and owners, if applicable;

d. Planned items for discussion, including, any expected approvals needed in the meeting and blockers or issues that are to be addressed; and

e. Contractor design approaches for stakeholder discussion and feedback.

PMO-06 Contractor personnel must be trained in the System Agency’s security practices and compliance guidelines prior to receiving access to the System and assigned to perform Services. The

Contractor shall provide all training services for its personnel to effectively develop and maintain the System. System training must include, but not be limited to:

a. The System Agency’s required training (e.g., IT Security; Protected Health Information (“PHI”) compliance, and Cybersecurity);

b. Health Insurance Portability and Accountability Act (“HIPAA”) compliance; and

c. HHS Authorized User Agreement compliance.

PMO-07 The Contractor must come on-site to the System Agency’s designated Austin, TX location, as required by System Agency for testing, deployment, issue resolution and training for the System.

PMO-08 The Contractor must provide written recommendations to the System Agency regarding continuous process improvements and efficiencies of the System.

PMO-09 The Contractor, with notification and approval from the System Agency, must improve the System development and management through the continuous improvement of processes, productivity, increased code maintainability, and reusability.

PMO-10 The Contractor must use System Agency approved project management framework, including all established processes and tools.

Any changes to the framework require prior written approval from the System Agency.

2.2.1 Project Documentation

Contractor shall provide the Services set forth in Table 2 – Project Documentation.

Table 2 – Project Documentation

PMD-01 The Contractor must comply with the Key Performance Measures outlined in Section 4.1 (Key Performance Measures and Liquidated Damages) by developing, maintaining, and submitting project documents for System Agency approvals within the required timeframes outlined in Section 3.1 (Deliverables).

PMD-02 Contractor must provide a Project Management Plan (“PMP”) that outlines the project tasks, how to accomplish the tasks, who is involved, how issues will be escalated, how information is communicated, measured, and reported. The PMP must follow the

Project Management Body of Knowledge (“PMBOK”) standards and guidelines for the structure and content of the document. Contractor must update the PMP as required by System Agency to describe the current state of the project.

After Contract Effective Date and throughout the Contract Term, the Contractor must develop, maintain, and submit the PMP and associated documents in a form and within the timeframes as required in Section

3.1 (Deliverables) (DEL-01).

PMD-03 The Contractor must provide a Change Management Plan (CMP) that describes its change management controls and procedures which it will conduct in coordination with the System Agency. As part of the Change Management Plan, the Contractor will collaborate with the System Agency in the development of the COR and impact analysis forms. At the discretion of the System Agency, additional information and forms may be added to the Change Management Plan. The Contractor must provide the Change Management Plan as required in Section 3.1 (Deliverables) (DEL-02).

PMD-04 The Contractor must assist IT PHA to develop, execute, maintain and deliver for System Agency approval, a System Security Plan (“SSP”) to document the current level of security controls within the System that protects the Confidentiality, Integrity and Availability (“CIA”) of the System and its information. Specific SSP security control requirements are located on the Contractor Resources site:

Information Security Controls.

The initial SSP must be submitted for System Agency approval no more than 14 Business Days after the Contract Effective Date. The SSP is a living document and must be updated no less than annually as part of Contractor’s risk assessment as required in Section 3.1 (Deliverables)

(DEL-18).

PMD-05 Annually on September 1st, or at the request of the System Agency, the Contractor must deliver a Security Assessment Report (“SAR”) in accordance with the Security Assessment Report and Attestation Guideline as required in Section 3.1 (Deliverables) (DEL-14).

(https://www.hhs.texas.gov/sites/default/files/documents/doing-business-with-hhs/contracting/security- assessment-report-attestation-guideline.pdf).

PMD-06 Contractor must submit a clear, concise and comprehensive Requirements Document to the System Agency. The Requirements Document must receive System Agency review and approval before any design or implementation work may begin as required by Section

3.1 (Deliverables) (DEL-15)

PMD-07 Contractor must develop, maintain, and submit a Requirements Traceability Matrix (“RTM”) to show bi-directional traceability with applicable business requirements and for compliance throughout all project phases (e.g., requirements, design, testing, and certification).

https://www.hhs.texas.gov/sites/default/files/documents/information-security-controls.pdf https://www.hhs.texas.gov/sites/default/files/documents/doing-business-with-hhs/contracting/security-assessment-report-attestation-guideline.pdf https://www.hhs.texas.gov/sites/default/files/documents/doing-business-with-hhs/contracting/security-assessment-report-attestation-guideline.pdf https://www.hhs.texas.gov/sites/default/files/documents/doing-business-with-hhs/contracting/security-assessment-report-attestation-guideline.pdf https://www.hhs.texas.gov/sites/default/files/documents/doing-business-with-hhs/contracting/security-assessment-report-attestation-guideline.pdf

This must include how the requirement operates (e.g., configuration, custom development, base functionality) within the System to address the business need as required in Section 3.1 (Deliverables)

(DEL-16).

No later than 30 Business Days before the UAT start date, the completed RTM must be submitted for System Agency approval.

The RTM must be maintained during the Contract Term and all revisions to the RTM must be reviewed and approved by the System Agency.

PMD-08 Contractor must develop, maintain and submit a Technical Design Document (TDD) to show overall System architecture, detail System and interface design as required in Section 3.1 (Deliverables) (DEL- 19).

PMD-09 Contractor must provide a comprehensive Support and Maintenance plan that outlines the Contractor’s strategies, processes and procedures for supporting and maintaining the Labware LIMS System and its integration with TLO system as required in Section

3.1 (Deliverables) (DEL-20).

PMD-10 Contractor must provide an online User manual which reflects all current System functionality. The Contractor must provide the User manual as requested by the System Agency.

PMD-11 Contractor must maintain project documentation in compliance with the System Agency approved records retention guidelines.

PMD-12 At the discretion of the System Agency, Contractor must provide a Corrective Action Plan (“CAP”) for a Service failure. Upon the System Agency imposing a CAP, the Contractor must provide the following to include, but not limited to:

a. Description of service failure;

b. Root Cause Analysis (RCA);

c. Process plan to correct;

d. Deadline date for correction; and

e. Preventative steps to avoid future service failure.

The CAP must be provided to the System Agency within ten (10) Business Days of the System Agency’s requesting Contractor for a

CAP.

If more than three (3) failures related to the same Service occur, the

Contractor must, at its sole cost and expense, provide additional resources necessary to identify and resolve the failure. Additional resources must be provided within ten (10) Business Days of the date of the second failure. The System Agency reserves the right to impose LDs as described in Section 4.1 (Key Performance Measures and Liquidated Damages) (KPM-04).

PMD-13 Annually or as changes occur to the System, the Contractor must maintain and update project related communications and publications. The Contractor must coordinate and obtain approval of all proposed changes to project related communications and publications, 90 Calendar Days prior to implementation.

PMD-14 On an annual basis, the Contractor must audit all documentation related to the System to verify that the documentation is complete, accurate, and represents the current features, functionalities, and business rules of the System.

2.3 Training Requirements

Contractor shall provide the Services set forth in Table 3 – Training Requirements.

Table 3 – Training Requirements

TRS-01 The Contractor must provide System training (virtual or remote) to System Agency staff. Upon written request by the System Agency, the Contractor may be requested to provide training with a train-the-trainer approach.

TRS-02 Contractor must provide initial and ongoing training for the System Agency personnel on System usage, troubleshooting, and best practices.

TRS-03 Contractor must maintain and update System documentation, including User manuals, technical specifications, and FAQs.

TRS-04 Contractor must ensure training materials are available in multiple formats, including online modules, instructor-led sessions, and implementation guides.

TRS-05 The Contractor must provide System Agency staff training online for major changes and new version releases ten (10) Business Days prior to the associated release.

TRS-06 The Contractor must develop all training materials in electronic format and provide the materials within the System or to a System Agency designated location. The Contractor will provide required training materials after Contract award.

TRS-07 The Contractor must provide a troubleshooting guide for Users to address common application issues such as password logins, search problems, error messages, etc. The troubleshooting guide must be updated as the System changes or at the request of designated System Agency staff.

TRS-08 Throughout the Contract Term, the Contractor must maintain, and update training materials related to operating the Contractor’s System in electronic format, to reflect any upgrades, changes (i.e., federal mandates, legislative changes etc.), and enhancements made to the System. Updated training materials must be provided to designated System Agency staff within ten (10) Business Days before the release of any update, change, or enhancement.

TRS-09 The Contractor must provide System automation to allow Users the ability to register for online training, track User attendance, monitor completion of User training, and submit a certificate of completion to the User.

TRS-10 The System must provide designated System Agency staff the ability to generate an ad hoc attendance report for all online training sessions and show Users that completed the training.

TRS-11 The Contractor must complete the cybersecurity training program certified under Section 2063.104of the Texas Government Code as selected by the System Agency. The cybersecurity training program must be completed by the Contractor annually during the Contract Term as required in Section 3.1 (Deliverables) (DEL-17).

2.4 Licensing Requirements

Contractor shall provide the Services set forth in Table 4 – Licensing Requirements.

Table 4 – Licensing Requirements

LCR-01 Contractor must ensure that all software, hardware, and service licenses required for the System are maintained in compliance with applicable laws, regulations, and contractual agreements. Contractor must manage license renewals, updates, and modifications to prevent service disruptions.

LCR-02 Contractor must provide documentation of all active licenses, including expiration dates, terms of use, and renewal requirements. License audits must be conducted annually or upon System Agency request to verify compliance.

LCR-03 Contractor must ensure that any third-party software integrated into the System remains licensed and supported, preventing any unauthorized or unlicensed use that may result in compliance violations.

LCR-04 Contractor must provide one (1) site license and preserve existing concurrent User licenses including two (2) batches of sixty (60) Users each.

2.5 Operation Support Requirements

Contractor shall provide the Services set forth in Table 5 – Operation Support Requirements.

Table 5 – Operation Support Requirements

OSR-01 Contractor must provide a dedicated helpdesk or support center available between the hours of 7:00 a.m. to 7:00 p.m., Central Time (“CT”), Monday through Friday, with an escalation path for critical System failures.

OSR-02 Contractor must ensure knowledge transfer and operational documentation is maintained to support continuity of service.

OSR-03 The Contractor is responsible for security, maintenance and support, of the System throughout the Contract Term. Support includes whatever is necessary to ensure the System is continually operable, fully functional, and compliant with the requirements of the SOW.

OSR-04 The Contractor must maintain the System as defined by the requirements of the Contract. Changes to the System will occur only at the direction of the System Agency and changes will be applied as consistent with the Change Management process as required in Section

3.1 (Deliverables) (DEL- 02).

OSR-05 The Contractor must build new reports and modify existing reports to meet the changing business and information needs of the System Agency. Changes must be made using the Change Management process as required in Section 3.1 (Deliverables) (DEL-02). The Contractor must respond within ten (10) Business Days to the System Agency with the acknowledgment of the change and a date when the change will be completed. Failure to implement the change within ten (10) Business Days of the Contractor’s completed date may result in LDs as indicated in Section 4.1 (Key Performance Measures and Liquidated Damages) (KPM-01).

OSR-06 On a weekly basis, the Contractor must provide a Weekly Status Report as required in Section 3.1 (Deliverables) (DEL-03)

OSR-07 The Contractor must provide a Deliverable Expectations Document (“DED”) for Operations. Contractor must provide DED information as required in Section 3.1 (Deliverables) (DEL-07). Contractor must notify the System Agency when the DED is added to the collaboration tool. All DEDs must be approved in writing by the System Agency and must be updated to reflect changes to Deliverables.

DED must be made available electronically, using the Contractor provided system for publishing (e.g., Microsoft SharePoint or other collaboration tool), and use the process as outlined in Section 3.1

(Deliverables) (DEL-02).

OSR-08 The Contractor must provide the completed reports with the results of the service organization control (SOC) Type II audit annually on date identified by the System Agency. Within ten (10) Business Days of the receipt of the audit report, the Contractor must provide a mitigation plan for all areas of non-compliance. Issues found to be non-compliant must be corrected no later than 21 Business Days of the report submission to designated System Agency staff. Contractor must notify the System Agency five (5) Business Days in advance if the Contractor anticipates not meeting the deadlines for the mitigation plan and provides an alternate date with justification. At the System Agency’s sole discretion, the System Agency may extend the deadline for the mitigation plan.

OSR-09 At no cost to the System Agency, the Contractor shall implement enhancements to the TLO interface that are required by State legislation and other changes in applicable law. The enhancements must be approved by the System Agency before implementing the enhancement in the production environment.

2.6 Performance Support Requirements

Contractor shall provide the Services set forth in Table 6 – Performance Support Requirements.

Table 6 – Performance Support Requirements

PSR-01 Upon request, Contractor must conduct root cause analysis with the

System Agency, for any recurring System performance issues and provide remediation plans.

PSR-02 The Contractor must provide break/fix support for the System. This service must include but is not limited to:

a. Diagnosis and troubleshooting of System failures;

b. Restoration of service to normal operating conditions; and

c. Implementation of temporary workarounds and minimize downtime (when necessary).

2.7 Security Requirements

Contractor shall provide the Services set forth in Table 7 – Security Requirements.

Table 7 – Security Requirements

SEC-01 The System must adhere to the security controls and requirements as described in Exhibit D-1, Attachment 2 to the DUA, Security and Privacy Inquiry, (SPI) for the duration of the Contract Term. If more than one (1) applicable standard and/or Applicable Law requires the same information security and privacy control, then the System must implement the most restrictive requirements for the specified control.

SEC-02 The System must ensure that the Personal Identifying Information (“PII”) or Protected Health Information (“PHI”), or other sensitive or confidential information is securely managed in accordance with the System Agency’s security requirements within Exhibit D, HHS Data Use Agreement (DUA).

SEC-03 The System must adhere to transmission security at Transport Layer Security (“TLS”) 1.2, Secure Handshake Algorithm (“SHA”)-2 protocols or more current version with a minimum of a 2048-bit key.

SEC-04 The System must be compliant with Health Insurance Portability and Accountability Act (“HIPAA”) requirements and Federal Information Security Management Act (“FISMA”) and the Contractor must provide updated system equipment and software to ensure continuous compliance.

SEC-05 The System must adhere to HHS security controls when modifying or enhancing the System. The required security controls are available on HHS website : Information Security Controls.

SEC-06 The System must meet and maintain compliance with all standards established by the System Agency requiring protection of sensitive data and information available on HHS website page: Summary of the HIPAA Security Rule | HHS.gov.

SEC-07 All System Agency Data in the System must remain, and be stored, processed, accessed, viewed, transmitted, and received, always and exclusively within the contiguous United States.

SEC-08 The System must provide automated timed log-off based on User non-activity within the System. The System timed logoffs must provide a 30-minute warning of timeout and provide the User the ability to override the log-off.

SEC-09 Contractor must perform regular application layer vulnerabilities scans to ensure System integrity.

SEC-10 Contractor must provide a security incident response plan and notify the System Agency of any application layer vulnerabilities within the agreed timeframe in accordance with the HHS Data Use Agreement.

2.8 System Maintenance Service Requirements

Contractor shall provide the Services set forth in Table 8 – System Maintenance Service Requirements.

Table 8 – System Maintenance Service Requirements https://www.hhs.texas.gov/sites/default/files/documents/information-security-controls.pdf https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html

SMS-01 Contractor must provide ongoing maintenance services to ensure the System remains fully operational, including provision of software updates, patches, and firmware upgrades as necessary.

SMS-02 Contractor must conduct routine System health checks, performance monitoring, and preventive maintenance to minimize downtime and enhance system stability.

SMS-03 Contractor must provide ongoing maintenance and technical support for the TLO integration throughout the Contract Term.

SMS-04 The Contractor must allow designated System Agency staff the ability to obtain assistance for software maintenance and technical support issues. The list of designated System Agency staff will be provided in writing to the Contractor by the System Agency.

SMS-05 The Contractor must use the latest software version for the operating software, database software, and application utility tools. In the event of a software version update, the system must be upgraded, at no additional cost, to the newest software version within six (6) months of the version release date to comply with the Key Performance Measure as outlined in Section 4.1 (Key Performance Measures and Liquidated Damages) (KPM-03).

2.9 Disaster Recovery and Business Continuity Requirements

Contractor, for no additional compensation, shall conduct on an annual basis a Disaster Recovery test to assess the effectiveness of the Contractor’s Disaster Recovery Plan. On or before the ninetieth (90th) calendar day following each Disaster Recovery test, Contractor will provide System Agency, with a written summary report detailing the results of the Disaster Recovery test.

Upon System Agency, written request, Contractor shall make Contractor personnel available to discuss with System Agency the results of the Disaster Recovery test. Contractor shall use commercially reasonable efforts to resolve issues identified during the Disaster Recovery test and, for each unsuccessful test, Contractor shall conduct an additional Disaster Recovery test in a timely manner to validate the successful implementation of Contractor’s remediation activities.

Contractor shall provide the Services set forth in Table 9 – Disaster Recovery and Business Continuity Requirements.

Table 9 – Disaster Recovery and Business Continuity Requirements

REQ. ID Requirement Description DRB-01 The Contractor must participate in all disaster recovery testing, planning, and documentation tasks throughout the Contract Term.

DRB-02 The Contractor must provide to the System Agency a comprehensive

Disaster Recovery and Business Continuity Plan that describes how

System functions will continue in the event of a disaster or unplanned System disruption as required in Section 3.1 (Deliverables) (DEL- 09). The Disaster Recovery and Business Continuity Plan must address all areas such as arrangements for backup hardware or processing sites; off-site data storage; and detailed recovery procedures for all anticipated types of disasters.

The Disaster Recovery and Business Continuity Plan must be updated when the Contractor System changes or at a minimum, on September 1st of each year.

2.10 Reporting Requirements

Contractor shall provide the Services set forth in Table 10 – Reporting Requirements.

Table 10 – Reporting Requirements

REP-01 The System must provide the System Agency with the ability to generate standard reports as needed by the System Agency.

REP-02 The System must allow Users to generate and export ad-hoc or on demand reports using specific criteria.

REP-03 The System must provide the ability for Users to save standard report queries and report parameters for future use.

REP-04 The System must provide the Users ability to generate reports using a configurable date range.

REP-05 The Contractor must provide a monthly Ticket Report that includes but is not limited to:

a. Number of user support tickets logged, resolved, and pending.

b. Average response & resolution times.

REP-06 On a weekly basis the Contractor must provide a Weekly Status

Report disruption as required in Section 3.1 (Deliverables) (DEL- 03).

REP-07 The system must support export of reports to CSV, Excel, and PDF.

REP-08 The Contractor must provide the Security Assessment Report (“SAR”), as required by Section 4.2.1 of the Information Security Assessment

Supplemental Guidance for External Entities, available at:

Information Security Assessment Supplemental Guidance for External Entities.

2.11 Configuration Management Requirements

Contractor shall provide the Services set forth in Table 11 – Configuration Management

Table 11 – Configuration Management Requirements

CMR-01 Contractor must implement a Change Management Plan (CMP) to track, review, and approve system modifications prior to deployment.

CMR-02 Contractor must provide version control and rollback procedures for system configuration changes and document in the CMP.

2.12 Supplemental Services Requirements

Contractor shall provide the Services set forth in Table 12 – Supplemental Services

Table 12 – Supplemental Services Requirements

SSR-01 The Contractor must provide two thousand and eighty (2080) hours annually for administrative and operational support services (LabWare Customer Care Program). These hours are in addition to the Contractor’s standard Maintenance and Operations (M&O) support obligations. These hours will be used at the direction of the System Agency.

SSR-02 Administrative and operational support defined in the supplemental services requirements will include (but is not limited to) system configuration, patching/updating, data analysis, complex reporting, process improvement, and any other services within the scope of the Contract.

SSR-03 Unused hours at the end of each year within the Contract Term will rollover for use in the following year.

SSR-04 The Contractor at the request of the System Agency must provide additional support hours (as defined in SSR-01) beyond the annual allocation at an agreed hourly rate defined in Exhibit O, Cost Proposal.

2.12.1 Supplemental Services

https://www.hhs.texas.gov/sites/default/files/documents/doing-business-with-hhs/contracting/risk-assessment-monitoring-procedures.pdf https://www.hhs.texas.gov/sites/default/files/documents/doing-business-with-hhs/contracting/risk-assessment-monitoring-procedures.pdf

To accommodate future business objectives, which may be a result from implementation of federal and State mandates and other State initiatives, funding opportunities and emergencies that are aligned with the original purpose of the Contract and directly related to the scope of the Solicitation, the System Agency may require the Contractor to perform supplemental services during the Contract Term, which may be either singular occurrences or recurring activities, both more fully explained in sections below. At the System Agency’s sole discretion, the System Agency will initiate a request for supplemental services using a Change Order Request (COR). The Contractor will perform the supplemental services in accordance with the Change Management Plan (DEL-02).

The System Agency will provide such information as the Contractor reasonably requests to prepare a supplemental services plan.

Unless otherwise agreed by the Parties, Contractor will respond to the System Agency’s Supplemental Services Request (SSR) on or before the 30th Business Day following the date of receipt of the System Agency’s request. In the case of an escalated deadline or an emergency matter as determined by the System Agency, Contractor will respond on or before the tenth (10th) Business Day to the System Agency’s SSR.

In response to the System Agency’s SSR, Contractor shall provide a supplemental services plan that will include, at a minimum, the following information, properly itemized and supported by sufficient substantiating data (e.g., documentation by Subcontractors performing the work), to permit evaluation by the System Agency:

a. A detailed description of the technical scope approach;

b. A fixed price or high-level estimate (HLE) for the additional service;

c. A supplemental services cost proposal, which includes a detailed breakdown of such price or estimate;

d. The estimated level of effort (service hours);

e. A description of the service levels to be associated with the additional service;

f. A schedule for commencing and completing the additional service;

g. A description and justification of the new hardware or software to be provided by the Contractor in connection with the additional service;

h. Any risks associated with the additional service and/or the integration of the additional service into the existing environment;

i. In the case of any developed materials to be created through the provision of the additional service, any ownership rights therein that differs from the provisions already included in the Contract; and

j. An analysis and estimate of the operational impacts related to the additional service.

The Contractor will provide a supplemental services plan for each SSR. The HLE and supplemental services plan will be reviewed by the System Agency and feedback provided to the Contractor by the tenth (10th) Business Day of receipt. Both parties will meet to discuss the HLE and scope. The System Agency must provide written approval of a supplemental services plan before the Contractor begins such work.

The Contractor shall not be entitled to an increase in the Contract amount or an extension of the Contract Term with respect to any Work performed that is not required by the Contract as amended, modified, and supplemented in a fully executed Contract Amendment.

2.13 Development Services

Contractor shall provide the Services set forth in Table 13 – Development Services.

Table 13 – Development Services

DEV-01 The Contractor will provide development services as required by the

Agency in response to objectives identified in special projects required by federal and State mandates, other State initiatives, funding opportunities and emergencies.

Any development required will be identified in a Supplemental Services Request (SSR), reference Section 2.12.1 Supplemental Services of the

SOW

2.14 Service Requests

Contractor shall provide the Services set forth in Table 14 – Service Requests.

Table 14 – Service Requests

SVR-01 The Contractor must maintain a SharePoint site for the System Agency to create, track, and manage Service Requests (SRs) SVR-02 The Contractor must create SRs when issues are reported by Users for the Solution. The SRs must be remediated through system fixes, patches, or maintenance activities.

SVR-03 The Contractor must identify SRs related to User errors and provide analysis to the designated System Agency staff.

SVR-04 The Contractor must perform a Root Cause Analysis(RCA) for the SRs and update results on the SharePoint site

SVR-05 The Contractor must provide SR resolution information to System Agency for User errors not requiring a fix.

SVR-06 The Contractor must provide accurate information and remediation steps to the System Agency to resolve all reported issues, (e.g tickets, defects, outages). The Contractor must provide clear and concise notification when the SR is resolved including the documentation of the steps taken to resolve the reported issue.

SVR-07 The Contractor must develop and maintain SR reports that provide daily, weekly, and monthly metrics, that includes, but is not limited to:

a. Total number of SRs;

b. Number of resolved SRs;

c. Number of unresolved SRs;

d. Number of escalated SRs;

e. SR tracking number; and

f. SR status.

Reference Section 3.1 (Deliverables) (DEL-08).

2.15 Severity Levels, Response and Resolution Times

Table 15 – Severity Levels, Response and Resolution Times

Severity Levels, Response and Resolution Times Security Level

Severity Name

Description Maximum Response Time

Maximum Resolution Time

1 Critical Defects and issues that are “Critical” include:

a. Critical impact where the System is compromised and all Users cannot access the System, perform required functionality, the data quality is compromised, and required tasks cannot be performed in the System.

b. Total outage or an outage of a critical

One (1) clock hour from when the defect is initially identified.

Four (4) clock hours from when the defect is initially identified.

component that renders the System unusable or unable to perform pending critical tasks.

c. Security issues or incidents that affect the production environment.

d. An issue that significantly impairs the User’s normal business operations; that causes complete disruption to Users that prevents Users from being able to download/upload/export System information or perform analytical reviews.

e. Time sensitive information and/or reports or deliverables cannot be produced as required from the System and no workaround exists.

2 High Defects and issues that are “High” include:

a. Major impact to most Users that creates delays in business operations, major functionality is unavailable, major impacts to data quality exists, Users must perform rework, and

Two (2) clock hours from when the defect is initially identified.

Eight (8) clock hours from when the defect is majority of required tasks cannot be performed.

b. Partial System outage that impacts the normal business operations or user experience and no workaround exists.

c. Incident, issue, or defect that prevent Users from meeting a pending deadline.

d. Incident, issue, or defect that impacts business operations and core functionality does not operate as intended and no workaround exists.

e. Reporting issue that prevents Users from generating, downloading, or printing reports from the System.

f. Performance degradation occurs that majorly reduces processing, capacity, and/or functionality that impacts Users.

g. Time sensitive information and/or reports or Deliverable cannot be produced as required from the System, but a workaround exists.

3 Medium Defects and issues that are “Medium” include:

a. Significant impact to some internal and external Users that creates delays in business operations, some functionality is unavailable, significant impacts to data quality, existing Users are not required to perform rework, and some required tasks can still be performed at a reduced capacity.

b. Some performance degradation occurs that significantly reduces some processing, capacity, and/or functionality that impacts some Users.

c. Incident, issue, or defect that delays work to be performed on a deadline where the deadline is occurring within the next 30 Business Days.

d. Incident, issue, or defect that impacts business operations and core functionality does not operate as intended and a workaround exists.

e. An outage of a

12 clock hours from when the defect is initially identified.

Two (2) Calendar Days from when the defect is functionality or System feature that does not impact the normal business operations or user experience and a work around exists.

f. Time sensitive information and/or reports or Deliverables can be produced as required from the System without a workaround.

4 Low Defects and issues that are “Low” include:

a. Minor impact to internal and external users that does not create a delay, stop business practices, all functionality is available, does not impact data quality, and no rework is required, and tasks can be performed as intended.

b. Performance issue impacts non-essential environments and is not connected to time sensitive testing (i.e., UAT).

c. Minor System inconvenience that minimally impacts Users' normal business operations and functionality (e.g., selection button/drop-down does not work, dead hyperlink, design element not functioning, 36 clock hours from when the defect is initially identified.

30 Calendar Days from when the defect is etc.)

d. Minor incident, issue, or defect that requires additional research to remediate, testing, or a cooperative effort between Contractor/System Agency to resolve.

2.16 TLO Integration

2.16.1 TLO Interface Features and Functionalities

Contractor shall provide the Services set forth in Table 16 – TLO Interface Features and Functionalities.

Table 16 – TLO Interface Features and Functionalities

TFF-01 Contractor must create an interface between the existing enhanced

LabWare LIMS (LabWare 8) and the Texas Laboratory Online (TLO) to enable automated, bi-directional, data exchange. Refer to Exhibit Q, Architecture Diagram for more details.

TFF-02 The Contractor is responsible for configuring, implementing, managing and maintaining the integration of TLO with LIMS.

The TLO – Labware integration must support, including, but not limited to, the following capabilities:

a. Allow Users to enter a TLO order number during data entry within LabWare.

b. Provide interface(s) that electronically retrieves TLO order details including new patient data and demographic data during LabWare data entry process for any order with a TLO number.

c. Provide interface(s) that allow TLO to receive updates to existing orders and discrete reportable results,

d. Provide interface(s) to synchronize order information, patient details, physicians and submitters data, facilities information, and contact data periodically,

e. Provide interface(s) that allow access to reports.

Additional items may be added during the JAD sessions.

TFF-03 The System must allow the Laboratory Services Section (LSS) staff to electronically receive, register, and track laboratory samples from TLO in compliance with Texas state regulations.

TFF-04 The TLO interface must comply with standards for order and test results messaging to ensure interoperability and standardized data exchange.

TFF-05 The interface must enable secure, automated exchange of laboratory test orders, results and updates between TLO and LIMS.

TFF-06 At the request of the System Agency, the Contractor must analyze the TLO interface processes to identify opportunities for automation. The Contractor must collaborate with the System Agency to design, develop and implement automation solutions that reduce errors, improve workflow efficiency and eliminate manual data manipulation within the TLO interface. All proposed automation enhancements must be reviewed and approved by the System Agency.

TFF-07 Integration must support growth in data volume and maintain flexible architecture for future advancements in technology. Any modifications enhancing scalability to the System must not involve complex reconfigurations or data migration.

2.16.2 Testing Requirements

Contractor shall provide the Services set forth in Table 17 – Testing Requirements.

Table 17 – Testing Requirements

TEST-01 At least twenty-one (21) Business Days before the start of testing, Contractor must provide a Test Plan, with the content as required by System Agency. The required information for the Test Plan is outlined in Section 3.1 (Deliverables) (DEL-04).

The Test Plan must be approved by the System Agency before testing begins.

TEST-02 In accordance with the System Agency-approved Test Plan, the Contractor must perform testing in a secured testing environment.

Testing must include the following, at a minimum:

a. System integration testing;

b. UAT;

c. Load and Stress Testing (“LaST”); and

d. Regression testing.

TEST-03 The Contractor must perform data preparation required for efficient testing. The data preparation must support the following Quality

Assurance activities:

a. System Integration testing;

b. LaST;

c. Build Validation testing; and

d. Regression testing.

TEST-04 The Contractor must perform LaST on the System prior to all deployment releases into the production environment.

TEST-05 In accordance with the System Agency-approved Test Plan, the

Contractor must complete and pass all testing activities prior to deploying updates, enhancements, and fixes to the production environment.

TEST-06 Upon completing testing activities, the Contractor must obtain System Agency's written approval before deploying updates, enhancements, fixes and code into the production environment.

TEST-07 The Contractor must provide the designated System Agency staff with online access to the test database tables and files to allow the designated System Agency staff to independently prepare test data, run System tests, and review System test results.

TEST-08 The Contractor must actively participate and assist the System Agency with troubleshooting build and deployment issues.

TEST-09 The Contractor must check code into the System Agency-approved source code repository using the System Agency-approved tools. Code must be checked in without disrupting other development efforts.

TEST-10 The Contractor must participate in the System Agency’s evaluation of the System and provide support during UAT. The Contractor must allow System Agency staff to perform UAT prior to the required start date referenced in Section 2.16.3 (Deployment Requirements) (DEP- 09).

TEST-11 The Contractor must provide a fully configured testing environment available to designated System Agency staff and approved external users for UAT testing, training, and other purposes as defined by the System Agency.

TEST-12 During the testing of the System, the Contractor must fully demonstrate compliance with all Contract requirements scheduled for UAT.

TEST-13 The Contractor must actively help System Agency staff, in a manner as defined by the System Agency, to troubleshoot all issues and answer questions as needed during UAT for the System. The System Agency will provide the Contractor ten (10) Business Days advance notice of the need for the Contractor to be physically onsite during UAT.

TEST-14 The Contractor must not promote partial code, changes, upgrades, and enhancements into the testing environment until all development is completed and ready for UAT.

TEST-15 The Contractor must perform peer reviews of code while code is under development and prior to testing to show compliance with the System Agency-approved coding standards and guidelines. The Contractor must provide a code review report to the System Agency 21 Business Days before UAT begins. The required information is outlined in Section 3.1 (Deliverables) (DEL-04).

TEST-16 The Contractor must allow the System Agency to perform UAT testing prior to any code release to production (e.g., post Go-Live, post Go- Live defect fixes, enhancement release, etc.).

TEST-17

The Contractor must develop execute and submit written test cases and supporting test data to the designated System Agency staff prior to the commencement of program-led testing activities. Test cases shall include at a minimum:

a) Test scenarios;

b) Detailed test steps;

c) Expected results; and

d) Pass/fail criteria.

User Acceptance testing (UAT) scripts and test cases shall be developed and executed by the System Agency staff. The Contractor must support program-led testing activities, including defect resolution and clarification of test scenarios, as requested.

TEST-18 The Contractor must obtain designated System Agency staff approval of the written test cases within three (3) submission attempts. Each test case that System Agency rejects will result in resetting the written test case submission period. The System Agency reserves the right to request a Corrective Action Plan (CAP) as required in Requirement ID PMD-12; after three (3) failed attempts for the same test case and pursue liquidated damages as described in Section 4.1 (Key Performance Measures and Liquidated Damages) (KPM-05).

TEST-19 For each UI and before the System is released for UAT, the Contractor must provide the designated System Agency staff with a live System demonstration…