Exhibit J, Enrollment Broker Statement of Work.pdf

RFP No. HHS0016867 Exhibit J

Exhibit J, Enrollment Broker Statement of Work (SOW)

RFP No. HHS0016867 i

Table of Contents

ARTICLE 1 INTRODUCTION 1

Project Overview 1

Definitions 2

ARTICLE 2 SCOPE OF WORK 10

Description of Services 10

Contract General Requirements 10

2.2.1 Hosting 10

2.2.2 Texas Risk and Authorization Management Plan 12

2.2.3 Accessibility Requirements and US Section 508 VPAT Completion 13

2.2.4 Disaster Recovery (DR) Test 13

2.2.5 Enrollment Broker Compliance (COM) 13

2.2.6 Facilities (FAC) 14

2.2.7 Key Personnel and Staffing (PER) 15

2.2.8 Security Requirements (SEC) 19

2.2.9 Supplemental Services 23

2.2.10 Service Acceptance Criteria 24

Contract Financial Requirements 24

2.3.1 Financial Requirements Overview 24

2.3.2 Accounting and Financial Reporting Requirements and Standards 25

2.3.3 Allowable and Unallowable Costs 28

2.3.4 Access to Accounting and Financial Records 34

2.3.5 Financial Payment Structure and Provisions 34

2.3.6 General Payment Terms 38

2.3.7 Payment for Changes to Scope 40

2.3.8 Transition Costs 44

2.3.9 Retrospective Cost Settlement 48

2.3.10 Audits of Enrollment Broker's Billings and Costs 51

2.3.11 Invoicing Requirements 54

2.3.12 Contract Financial Deliverables Requirements (RFD) 55

Project Phases 58

2.4.1 Transition Phase 58

2.4.2 Operations Phase 58

2.4.3 Turnover Phase 59

Transition Phase Requirements 60

2.5.1 Initial Project Management Services (PRM) 60

2.5.2 Human Resources Mobilization and Training (HRM) 62

2.5.3 Asset Management (ASM) 63

2.5.4 Operations Readiness (RDR) 64

2.5.5 System Readiness (SYR) 69

ii

Operations Phase Requirements 73

2.6.1 Business Operations (REQ) 73

2.6.2 Deliverables and Work Products (DWP) 77

2.6.3 Data and Documentation (REC) 78

2.6.4 Fund Management (FND) 80

2.6.5 Fraud, Waste, and Abuse (FWA) 84

2.6.6 Materials Development and Maintenance (MDM) 84

2.6.7 Complaint and Dispute Resolution (CMP) 86

2.6.8 Enrollment Services (ENR) 87

2.6.9 Outreach, Informing, and Education Services (OTR) 96

2.6.10 Mail and Document Processing (MAI) 111

2.6.11 Call Center Operations (CCO) 116

2.6.12 Training (TRN) 125

2.6.13 Reports (RPT) 126

Design Development and Implementation (DDI) Application Support (DDI) 127

System Maintenance and Operations (OPS) 128

2.8.1 Data, Data Conversion and Data Quality (DDC) 135

2.8.2 Business Continuity Plan (BCP) 139

2.8.3 User Access (UAR) 140

2.8.4 Testing (ATS) 141

Enrollment Broker Financial Services 145

2.9.1 Fund Management Requirements for Financial Services 146

2.9.2 Cost Sharing Collections 146

2.9.3 Co-Pay Refund Payments 147

2.9.4 Unclaimed Property 148

2.9.5 Enrollment Broker Financial Deliverables (EFD) 149

Future Enhancement Projects Requirements 151

2.10.1 Implementation of Mobile Application for Increased Client Engagement (MBL) 152

2.10.2 Implementation of MDCP Interest List Processing (INT) 152

2.10.3 Implementation of Automated File Transfers for Interest List Activities (AFT) 153

2.10.4 Implementation of Quality Assurance for Interest List Activities (QUA) 153

2.10.5 Implementation of Medicaid and CHIP Quality Rating System (MAC QRS) Website (MAC) 153

2.10.6 Implementation of an Online Payment Portal for MBI and MBIC (OPP) 154

2.10.7 Other Enhancements 154

Turnover and Contract Closeout Phase Requirements (TCC) 154 iii

TABLE OF TABLES

Table 1 - Compliance Requirements Table 2 - Facilities Requirements Table 3 - Key Personnel List Table 4 - Personnel and Staffing Requirements Table 5 - Security Requirements Table 6 - EB Responsibilities and Financial Deliverables Table 7 - Project Management Table 8 - Human Resource Mobilization and Training Table 9 - Asset Management Table 10 - Readiness Review Requirements Table 11 - System Readiness Table 12 – Requirement Activities Table 13 - Deliverables and Work Product Requirements Table 14 - Records, Data, and Documentation Requirements Table 15 - Fund Management Table 16 - Fraud, Waste, and Abuse Requirements Table 17 - Materials Development and Maintenance Table 18 - Compliant and Dispute Handling Table 19 - Enrollment Services Requirements Table 20 - Outreach, Informing, and Education Services Table 21 - THSteps O&I Table 22 - Mail and Document Processing Table 23 - Call Center Operations Table 24 - Call Center Operations Inquiry Management Table 25 - STAR+PLUS HCBS Interest List Table 26 - Training Requirements Table 27 - Reports Requirements Table 28 - Design, Development and Implementation Table 29 - System Maintenance and Operations Requirements Table 30 - Data Conversion and Data Quality Requirements Table 31 - Business Continuity Plan Requirements Table 32 - System - User Access Requirements Table 33 - Additional Testing Services Table 34 - Enrollment Broker Financial Deliverables Table 35 - Turnover and Contract Closeout Phase - Turnover Requirements

ARTICLE 1 INTRODUCTION

PROJECT OVERVIEW

Title XIX of the Social Security Act authorizes HHSC, the single state Medicaid agency for Texas, to contract with an entity to provide enrollment and outreach/informing Services for Medicaid clients in Managed Care. Currently, Texas Medicaid has 97 percent of Medicaid clients enrolled through continued expansion and advancement of Managed Care.

The State of Texas, by and through the Texas Health and Human Services Commission (HHSC), seeks a single qualified Contractor to perform Enrollment Broker (EB) services including the following tasks and functions, in accordance with the specifications contained in this Statement of Work (SOW):

1. Provide and implement an enrollment process that offers multiple access channels to support client inquiries (i.e. Service portal, mobile application, websites) as well as facilitate updates to enrollment processes as needed;

2. Provide and operate a solution that creates an enrollment packet, manages inbound and outbound correspondence and documents processing functions (electronic imaging, auto-linking and auto-routing);

3. Provide call center operations that utilize the HHSC telephony infrastructure to respond to inquiries from clients and providers, and assist clients with benefit and services information, including enrollment procedures and rules;

4. Encourage Medicaid recipients to fully use THSteps services by conducting various means of outreach to inform recipients about these services as specified by HHSC;

5. Provide effective outreach to individuals eligible for Medicaid, Children’s Medicaid Dental Services Program, CHIP, CHIP Perinatal, and CHIP Dental managed care, informing individuals regarding options for managed care enrollment, and providing assistance to individuals with completion of enrollment;

6. Provide effective interest list management through outreach and informing for the STAR+PLUS HCBS interest list; and

7. Provide cost effective services, including a solution that collects enrollment fees and premiums and facilitates related accounting activities with transparency in its reporting of billing, cost, and other data to HHSC.

The Managed Care Programs relevant to the project for EB and outreach/informing services are:

1. STAR;

2. STAR+PLUS;

3. STAR Health;

4. STAR Kids;

5. Children’s Medicaid Dental Services Program;

6. CHIP;

7. CHIP Perinatal; and

8. CHIP Dental.

RFP NO. HHS0016867 Exhibit J

The Contractor shall support both the existing and future state of operations for processing outreach and enrollment during the Transition periods for the Managed Care Organizations (MCOs).

DEFINITIONS

Defined terms have the meaning described herein, Section 2.3, Contract Financial Requirements of this SOW, and in Exhibit B, HHS Uniform Terms and Conditions (UTC) unless the context clearly indicates otherwise. Defined terms are capitalized, are proper nouns, or serve to define an acronym.

“Abuse” means:

1. A practice a provider engages in that is inconsistent with sound fiscal, business, or medical practices and that results in:

a. an unnecessary cost to Medicaid; or

b. reimbursement for services that are not medically necessary or that fail to meet professionally recognized standards for health care; or

2. A practice a recipient engages in that results in an unnecessary cost to Medicaid.

“Administrative Services Contractor” means the HHSC-contracted entity, referred to as the Texas Medicaid and Healthcare Partnership (TMHP), performing provider enrollment and claims and encounter processing for HHSC programs and operates the Texas Medicaid Enterprise Systems (MES).

“Affiliate” means any individual or entity that meets any of the following criteria:

1. Owns or holds more than a five percent interest in the Contractor (either directly, or through one (1) or more intermediaries);

2. Contractor owns or holds more than a five percent interest (either directly, or through one (1) or more intermediaries);

3. Parent entity or Subsidiary entity of the Contractor, regardless of the organizational structure of the entity;

4. Entity that has a common parent with the Contractor (either directly, or through one (1) or more intermediaries);

5. Entity that directly, or indirectly through one (1) or more intermediaries, controls, or is controlled by, or is under common control with, the Contractor; or

6. Entity that would be considered to be an affiliate by any Securities and Exchange

Commission (SEC) or Internal Revenue Service (IRS) regulation, Federal Acquisition Regulations (FAR), or by another applicable regulatory body.

“Agile” means a group of software development methodologies based on iterative development, where requirements and solutions evolve through collaboration between self-organizing cross-functional teams.

“Americans with Disabilities Act” or “ADA” 42 U.S. Code § 12101 et seq., legislation passed in 1990 that prohibits discrimination against people with disabilities.

“Bonus” includes all forms of compensation outside of a base salary, excluding standard company-wide employee benefits. Bonuses may be immediate or deferred and may be paid directly to the employee or may represent things which are provided to the employee or paid for on the employee's behalf. A non-exhaustive list of bonus payment examples would include any annual or other performance bonus payments, any car allowance, the value of company-provided vehicle, any stock or stock options, even if deferred, and the value of any benefits (entertainment, travel, memberships, housing, spousal travel or benefits, and other amenities or perquisites) that are in excess of those available on a company-wide basis to all employees.

“Business Component” means a primary function the Contractor will be responsible for maintaining under the Contract. The primary functions are:

1. Enrollment Services for Medicaid and CHIP managed care programs and

2. Texas Health Steps Outreach and Informing Services.

“Business Day” means any day of the week other than Saturday, Sunday, or a state or federal holiday.

“Calendar Day” means every consecutive day (measured from midnight to midnight) of the year, including holidays and weekends.

“Child(ren) of Migrant Farmworker” means a Medicaid recipient age 17 or younger whose parent or parents temporarily move to work in agriculture. Generally, this includes a parent or parents:

1. Whose principal employment is in agriculture on a seasonal basis;

2. Who has been so employed within the last twenty-four months;

3. Who performs any activity directly related to the production or processing of crops, dairy products, poultry, or livestock for initial commercial sale or as a principal means of personal subsistence; and

4. Who establishes for the purposes of such employment a temporary abode.

“Children’s Health Insurance Program” or “CHIP” means the program administered by the Health and Human Services Commission that provides health insurance coverage for eligible children pursuant to Title XXI of the Social Security Act (42 U.S.C. 1397aa-1397ii) and Chapter 62 of the Health and Safety Code.

“Children with Special Health Care Needs” means individuals who range in age from birth to 21 and have a health condition that has a biological, psychological, and/or cognitive basis that has lasted or is virtually certain to last for at least a year.

“Corrective Action Plan” or “CAP” means the written plan to correct or resolve a deficiency, incident, or non-performance of requirements and to prevent reoccurrence of such deficiency, incident, or non-performance.

“Cost Proposal” means the pricing elements in Exhibit L, Cost Proposal for delivering all Contract requirements for Deliverables and Services to HHSC, by the Contractor in response to the Solicitation, which becomes incorporated as an attachment to the Contract. The pricing elements include HHSC-specified types of fixed and variable costs, as more fully described in Exhibit L, Cost Proposal. The pricing elements proposed in the initial Solicitation Response become the governing principles in determining compensation to the Contractor.

“COTS” means “commercial-off-the-shelf” software that is ready-made and available for purchase or licensing on the commercial market.

“Deliverable Expectation Document” or “DED” means the document reviewed and approved by HHSC to ensure agreed upon expectations are clearly defined before the Deliverable is formally submitted to HHSC.

“Design, Development, and Implementation” or “DDI” refers to activities associated with enhancement or modifications of an application or system.

“Dental Maintenance Organization” or “DMO” means an organization that delivers and manages dental Managed Care Services under a risk-based arrangement with HHSC.

“Early and Periodic Screening, Diagnostic and Treatment” or “EPSDT” means the Medicaid Early and Periodic Screening, Diagnostic, and Treatment Program that is a federally mandated health care program administered by HHSC. EPSDT is Medicaid's comprehensive screening, diagnostic, and treatment service for individuals from birth through 20 years of age. In Texas EPSDT is known as Texas Health Steps (THSteps), which includes the preventive care components, or Early and Periodic Screening (EPS) (medical and dental checkups), of the total EPSDT service. In addition, medically necessary health care Services listed in Section 1905(a) of the Social Security Act are provided to children and adolescents enrolled in THSteps even if the Service is not available under HHSC’s Medicaid plan to the rest of the Medicaid population.

“Enrollment Broker” or “EB” means the Contractor selected to complete the work described in this Solicitation.

“Enrollment Broker Self-Service Portal” or “EBSSP” means an application that provides clients’ information and allows them to complete enrollment activities and talk to call center representatives via a web chat solution

“Carla Frew, et al. v. Stephanie Muth, et al. (Frew)” is a class action lawsuit filed in 1993 against the predecessor agencies of HHSC and DSHS. Filed on behalf of children ages birth through 20 who are eligible for Medicaid, the suit alleged that the Texas Medicaid program did not meet federal requirements for Early and Periodic Screening, Diagnosis, and Treatment (EPSDT) services. HHSC and DSHS agreed to a consent decree in 1996, and 11 Corrective Action Orders (CAOs) in 2007 (together referred to as the “orders”). These orders require certain actions and dictate many aspects of how the Texas Health Steps program is to be implemented. Some of the CAOs and portions of the consent decree have been dismissed. The agencies’ compliance with the remaining orders is still monitored by a federal district court.

“Fraud” means an intentional deception or misrepresentation a person makes with the knowledge that the deception or misrepresentation could result in an unauthorized benefit to that person or another person. The term does not include unintentional technical, clerical, or administrative errors.

“Healthy Texas Women” or “HTW” means the Texas program that provides eligible women with free family planning exams, related health screenings, and birth control through the Medicaid Program.

“HIPAA” means Health Insurance Portability and Accountability Act.

“Home and Community Based Services” or “HCBS” means the Texas program approved for the Managed Care delivery system, designed to allow individuals who qualify for nursing facility care to receive long term Services and supports (LTSS) to be able to live in the community.

“Indirect Costs” means any cost the Contractor does not directly identify with a single final cost objective but identified with two or more final cost objectives or with at least one intermediate cost objective. All cost components that constitute the Predetermined Indirect Cost Rates are considered to be Indirect Costs. To facilitate equitable distribution of Indirect Costs to the activities benefited, it may be necessary to establish a number of pools of Indirect Costs. Indirect Cost pools should be distributed to activities benefited on bases that will produce an equitable result in consideration of relative benefits derived. For the purposes of this Contract, the Indirect Costs will include Overhead Costs and General & Administrative (G&A) Costs. The Indirect Rates are Predetermined Fixed Rates and are subject to the Retrospective Cost Settlement Audit.

“Information Technology (IT) Incident” means an unplanned interruption of service or degradation in the quality of service, or a configuration failure that has not yet impacted service but has the potential to cause a service interruption.

“Interactive Voice Response” or “IVR” means a technology that allows a computer to interact with humans through the use of voice and dual tone multi-frequency input via keypad.

“Iteration” refers to a time-bound period in which an Agile team commits to delivering a specified goal.

“Key Performance Measures” or “KPM” means measures that rise to a level of a criticality that a failure to meet stated performance results in harm to HHSC and Liquidated Damages apply.

“Key Personnel” are dedicated Contractor staff to fulfill key roles as listed in Section 2.2.7, Key Personnel and Staffing of this SOW.

“Liquidated Damages” means a predetermined sum specified in a contract that one party agrees to pay the other in the event of a breach, serving as compensation for losses that are difficult to quantify.

“Maintenance and Operations” or “M&O” refers to the activities related to maintaining and operating the systems and includes items such as defects and data fixes.

“Managed Care” means a system in which the overall care of a patient is overseen by a single provider or organization.

“Managed Care Organization” or “MCO” means an organization that delivers and manages managed care health services under a risk-based arrangement with HHSC.

“Managed Care Programs” means managed care programs administered by HHSC including STAR, STAR+PLUS, STAR Health, STAR Kids, Children’s Medicaid Dental Services Program, and CHIP.

“Materials” include but are not limited to enrollment forms, notices, letters, pamphlets, presentations, videos, audiotapes, and other mailers and media as defined by HHSC.

“Medicaid” means the Texas Medical Assistance Program administered by HHSC. It is the Federal Medical Assistance Program as described in Title XIX of the Social Security Act, a joint federal-state entitlement program that pays for medical care on behalf of certain groups of low-income persons.

“Medicaid Buy-In” or “MBI” means the program for disabled working individuals that meet the eligibility criteria. The cost share requirements must be met before Medicaid coverage is effective.

“Medicaid Buy-In for Children” or “MBIC” means the program for children with disabilities whose families need health insurance but don't meet the eligibility criteria to get traditional Medicaid.

“NIST” means the National Institute of Standards and Technology. The National Institute of Standards and Technology is a physical sciences laboratory and a non-regulatory agency of the United States Department of Commerce.

“Nonemergency Medical Transportation Services” or “NEMT” means a service which arranges non-emergency transportation to and from covered health care services, based on medical necessity, for categorically eligible Medicaid clients enrolled in Medicaid, and clients enrolled in Children with Special Health Care Needs (CSHCN) Services program, or the Transportation for Indigent Cancer Patients program who have no other means of transportation.

“Office of Inspector General” is the department within HHSC responsible for the prevention, detection, audit, inspection, review, and investigation of fraud, waste, and abuse in the provision and delivery of all health and human services in the state, including services through any state-administered Health or Human Services Program that is wholly or partly federally funded or by the Department of Family and Protective Services, and the enforcement of state law relating to the provision of those Services.

“Offshoring” means locations outside the continental United States.

“Operations” means the Contract activities that begin immediately after Transition activities are completed and approved by HHSC and continue throughout any Contract extensions and Turnover activities.

“Operational Start Date” means the date following completion of Transition activities on which the Contractor assumes responsibility of Operations.

“Peripherals” is defined as all of the items that HHSC approves that are associated with a workstation. This includes desktops, laptops, monitors, keyboard and mouse, docking stations, tablets, laptop 2-in-1, and any other items designated as Peripherals by HHSC.

“Planned Outage” refers to planned release windows for interrupting the production uptime of a system to implement code changes in a production environment. Release contents can include maintenance and modification/enhancement changes. An annual release calendar will be proposed by the Contractor.

“Procurement Library” means the repository of information relevant to the Solicitation provided through the ESBD.

“Provider Enrollment Management System” or “PEMS” means the HHSC system of record supporting Texas Medicaid provider enrollment and credentialing of medical, dental, pharmacy and other HHSC programs.

“SaaS” means software as a service and is the capability provided to the consumer (business User) to use applications running on a cloud infrastructure. The applications are accessible from various client devices through a thin client interface such as a web browser (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited User-specific application Configuration settings. Reference:

National Institute of Standards and Technology (NIST) standard definition of SaaS provided in NIST Special Publication No. SP 800-145

“Security Incident” is the violation of an explicit or implied security policy. Examples of Security Incidents include but are not limited to:

1. Attempts from authorized sources to access systems or data.

2. Unplanned disruption to a service or denial of a service.

3. Unauthorized processing or storage of data.

4. Unauthorized changes to system hardware, firmware or software.

“STAR Health” is the Texas Medicaid Managed Care program that provides a medical care delivery system for the Department of Family and Protective Services (DFPS)-involved children and youth in Medicaid. STAR Health is designed to prioritize continuity of care, which is often a challenge when serving this population. STAR Health membership includes: children in foster care; children enrolled in the Adoption Assistance or Permanency Care Assistance program who are transitioning from STAR Health to STAR or STAR Kids; youth aged 21 years and younger with voluntary extended foster care placement agreements; and youth aged 20 and younger who are Former Foster Care Children.

“STAR Kids” is the Texas Medicaid Managed Care program that provides acute and long- term Services and supports (LTSS) benefits to children and young adults with disabilities age 20 or younger.

“STAR+PLUS” is the Texas Medicaid Managed Care program that provides both acute care Services and LTSS by integrating primary care, behavioral health care, pharmacy Services, and LTSS for individuals who are age 65 or older or adults who have a disability.

“State of Texas Access Reform” or “STAR” is the Texas Medicaid’s Managed Care program that provides primary, acute care, behavioral health care, and pharmacy Services for low-income families, children, pregnant women, as well as some former foster care youth.

“Subsidiary” means an entity which Contractor controls, whether in whole or part, and also means a relationship in which Contractor is controlled, whether in whole or part, by another entity. Any costs incurred by a Subsidiary for the Contract will be recorded into Contractor’s accounting records for the agreement without Subsidiary profit. Subsidiary costs will be recorded in the Direct Cost category.

“Texas Administrative Code” or “TAC” is a compilation of agency rules in Texas that are applicable to the Contract.

“Texas Health Steps” or “THSteps” means federally mandated Medicaid EPSDT Services.

“THSteps” is a program administered by HHSC with support from Department of State Health Services (DSHS) regional provider relations staff. THSteps benefits and Services are offered to all Medicaid recipients from birth through 20 years of age. (See also “Early and Periodic Screening, Diagnostic and Treatment” or “EPSDT”) THSteps benefits include Case Management for children and pregnant women for clients from birth through age 20.

“Texas Health Steps Outreach and Informing” or “THSteps O&I” means the outreach and informing activity functions designed to encourage utilization of THSteps Services among eligible populations.

“Texas Integrated Eligibility Redesign System” or “TIERS” is the system that supports the eligibility determination process for programs administered by HHSC.

“Texas Medicaid Enterprise System” or “MES” is the information system used by Administrative Services contractor to enroll providers, processes healthcare claims, and provide data to HHSC authorized business partners for the overall management of healthcare delivery Services provided to clients in the State of Texas.

“Texas State Plan” means the officially recognized document describing the nature and scope of the State of Texas Medicaid program. The plan is developed by the state and approved by the Centers for Medicare and Medicaid Services on behalf of the U.S. Department of Health and Human Services.

“Trading Partner” means a person or entity that sends, receives, and exchanges information in an ongoing relationship with HHSC. Trading Partners referenced in the Interface Control Document (ICD) and are listed in a separate document located in the Procurement Library.

“Transition” is the period of time between the Contract Effective Date and the beginning of Operations.

“Turnover” includes the administrative and operational activities performed by the Contractor to turn over Operations to either HHSC or an HHSC-designated successor service provider to ensure stakeholders do not experience any adverse impact during the Transition of services to either HHSC or an HHSC-designated successor service provider.

“Unplanned Outage” means a system outage which was not on the Planned Outage calendar and must be addressed as an IT Incident (severity 1 or severity 2 maintenance item).

“Vendor DC” refers to the data center managed or contracted by the Contractor. As indicated in this document, if an exception is not met to Data Center Services (DCS) requirement, then the DIR-managed DCS is required to be used.

“Waste” means practices that a reasonably prudent person would deem careless or that would allow inefficient use of resources, items, or services.

“Web-Self Service” means the Texas.gov portal for enrollment fee payment located at https://txapps.texas.gov/tolapp/viewandpay/?configid=HHSC_CHIP&licenseid=01&XXtask=1

ARTICLE 2 SCOPE OF WORK

DESCRIPTION OF SERVICES

Contractor shall provide all Services and meet all requirements, Deliverables, performance standards, and Key Performance Measures (KPM’s) as described in this Scope of Work (SOW).

Contractor shall implement EB Services and provide ongoing support for the EB Services that meet or exceed HHSC requirements.

CONTRACT GENERAL REQUIREMENTS

2.2.1 HOSTING

Chapter 2054 of the Texas Government Code requires the Department of Information Resources (DIR) to maintain a statewide data center which consists of consolidated data Services managed by contracted vendors which is also referred to as Data Center Services (DCS). Contractor may use a solution that is either fully contained within DCS, on-premises, or cloud-based Software as a Service (SaaS). If an on-premises or cloud-based Saas solution is used, HHSC must obtain an exemption from DIR and the infrastructure shall be hosted and managed by the Contractor, https://txapps.texas.gov/tolapp/viewandpay/?configid=HHSC_CHIP&licenseid=01&XXtask=1 and for any portion of the solution that is SaaS, the solution must meet the National Institute of Standards and Technology (NIST) standard definition of SaaS provided in NIST Special Publication No. SP 800-145.

a. DCS hosted – no exemption required:

Contractor may provide a solution which is hosted in the DCS, using either public or private cloud compute, and using the DCS managed Services. The Contractor shall also comply with all DCS requirements. Contractor must meet the minimum requirements of the Scope of Work, provisions, terms, and conditions set forth in the Contract and comply with the IS-Controls found in Exhibit Q, HHS Information Security and Privacy Requirements.

b. On-premises infrastructure solution – exemption required:

Contractor may provide a solution through its own locally dedicated infrastructure where all components are physically installed on Contractor’s own servers. Contractor will be responsible for all system configuration, security, installation, and patching services. Any such on-premises infrastructure solution must meet the minimum requirements of this Scope of Work, provisions, terms, and conditions set forth in the Contract, and comply with the HHS MODERATE (NIST SP 800-53R4 MODERATE equivalent) security baseline and the HIPAA overlay found in Exhibit Q, HHS Information Security and Privacy Requirements. Additionally, the Contractor must:

1. Comply with State security requirements in Texas Administrative Code (TAC) Chapter 202;

2. Comply with State accessibility requirements in TAC Chapters 206 and 213;

3. Comply with the requirements in Texas Health and Safety Code Chapter 105.003, Collection of Data (if applicable);

4. Comply with the DCS standards for technical currency of hardware and software

(n/n-1);

5. Comply with the DCS standards for hardware refresh (5-year refresh);

6. Provide service level agreements applicable to the system;

7. Provide Disaster Recovery services;

8. Provide backup services, in accordance with the data retention and recovery requirements of the data; and

9. Provide installation, configuration, and maintenance of all components of the system;

including the operating system and other software components to ensure upgrades and security patching activities are performed in a timely manner.

c. SaaS solution– exemption required:

Contractor may provide a Contractor-managed cloud based packaged solution which meets the minimum requirements of the Scope of Work, provisions, terms, and conditions set forth in the Contract and must comply with the IS-Controls found in Exhibit Q, HHS Information Security and Privacy Requirements. Any portion of the proposed solution that is SaaS, must clearly meet NIST standard definition of SaaS, as interpreted by DIR (NIST Definition of Cloud Computing SP 800-145).

A DCS exemption is required for any hosting solution outside of DCS. If the exemption is not approved, the Contractor would be required to host all components of the solution in DCS.

https://csrc.nist.gov/pubs/sp/800/145/final https://csrc.nist.gov/pubs/sp/800/145/final https://csrc.nist.gov/pubs/sp/800/145/final https://csrc.nist.gov/pubs/sp/800/145/final

2.2.2 TEXAS RISK AND AUTHORIZATION MANAGEMENT PLAN

Contractor shall comply with the program requirements of TX-RAMP as they currently exist and as amended throughout the Contract Term. Contractor shall have achieved TX-RAMP Level 2 Certification on the Contract Effective Date, and the Contractor shall maintain such certification for the duration of the Contract Term. Contractor acknowledges that HHSC or DIR will not provide agency-sponsored interim TX-RAMP Provisional Certification or otherwise assist Contractor in Contractor’s compliance with TX-RAMP requirements.

In addition, Contractor shall:

1. Upon HHSC request, provide Contractor’s submission(s) to DIR that supports DIR’s approval of certification status and promptly respond to HHSC and DIR TX-RAMP staff inquiries;

2. Provide written notification to HHSC of any lapse in TX-RAMP certification including, but not limited to, DIR revocation of TX-RAMP certification within two

(2) Business Days of Contractor’s discovery of non-compliance with TX-RAMP requirements;

3. Complete all TX-RAMP monitoring reports required by DIR and submit copies of reports to HHSC on or before the second (2nd) Business Day following the DIR submission deadline;

4. Routinely assess and monitor for compliance with required security controls and demonstrate that the security posture of the cloud computing services offered is acceptable to maintain TX-RAMP certification; and

5. If on the Contract Effective Date, Contractor's TX_RAMP Level 2 Certification is less than six (6) months from its expiration date, Contractor must provide a progress update to HHSC on Contractor’s application for renewal or extension of its TX-RAMP Level 2 Certification no later than the third (3rd) Business Day of each calendar month, unless HHSC requires more frequent reporting.

Contractor’s failure to comply with any TX-RAMP requirements including, but not limited to, continuous maintenance of the minimum certification required by the Contract may constitute a material breach of contract, and HHSC reserves the right to hold Contractor accountable by taking any remedial or corrective actions available under the Contract, at law, or in equity. If Contractor is unable to achieve TX-RAMP Level 2 Certification or re-certification, as applicable, for any reason before the 60th Calendar Day prior to the expiration date of the TX-RAMP Level 2 Certification, as applicable, the Contractor shall provide, at no cost to HHSC, Turnover services in accordance with Turnover service requirements outlined in Section 2.11, Turnover and Contract Closeout Phase Requirements.

TX-RAMP compliance is outlined in Texas Government Code, Section 2054.0593(a) for proposed cloud computing Services. Contractor is required to adhere to requirements specified in Texas Administrative Code Sections 202.27 and 202.77.

To become certified, Contractor must submit documentation to DIR meeting the minimum requirements for TX-RAMP Level 2 certification.

2.2.3 ACCESSIBILITY REQUIREMENTS AND US SECTION 508 VPAT

COMPLETION

The Contractor shall comply with all Section 508 accessibility guidelines and standards issued by the United States Access Board, currently accessed at: https://www.access-board.gov/ict/.

2.2.4 DISASTER RECOVERY (DR) TEST

At least once per State Fiscal Year, for no additional compensation, Contractor shall conduct a Disaster Recovery (DR) test to assess the effectiveness of the Contractor’s DR plan. Contractor shall develop the DR testing procedures in coordination with HHSC. Contractor shall provide HHSC at least thirty (30) Calendar Days advance written notice of each DR test. HHSC may monitor Contractor’s DR testing activities. During the DR exercises, Contractor shall simulate daily operations that occur in a production setting and, at a minimum, test the recovered environments, accessibility, data integrity, and functionality. Contractor shall provide HHSC with a written summary report detailing the results of each DR test. A lessons learned meeting will be conducted by Contractor, no later than thirty (30) Calendar Days following the completion of the DR test, upon HHSC request. Upon HHSC written request, Contractor shall make Contractor personnel available to discuss with HHSC the results of the DR test. If a DR test is unsuccessful, Contractor shall:

1. Develop a remediation plan on or before the thirtieth (30th) Calendar Day following the unsuccessful DR test;

2. Implement such remediation plan on or before the ninetieth (90th) Calendar Day following the unsuccessful DR test unless an alternate timeframe is mutually agreed upon by HHSC and Contractor;

3. Upon HHSC written request, Contractor shall conduct, for no additional compensation, an additional DR test during each State Fiscal Year to validate the successful implementation of Contractor’s remediation activities.

2.2.5 ENROLLMENT BROKER COMPLIANCE (COM)

The table below provides direct Contract requirements related to compliance with state and federal law and regulations. The list is not dispositive and compliance with state and federal law remains exclusively the responsibility of Contractor.

https://www.access-board.gov/ict/

Table 1 - Compliance Requirements

EBCOM - 0001 Comply with state and federal accessibility standards, guidelines, policy, and procedures for all Work Products, including ADA Title II, including conformance with all success criteria in WCAG 2.1 Level A and AA, Section 508 Compliance in accordance with and including, but not limited to1 TAC 206, Subchapter B; 1 TAC 213, Subchapter B; Texas Health and Human Services Electronic and Information Resources (EIR) Accessibility Standards; and 29 U.S.C. § 794, and 1 TAC 353.

EBCOM - 0002 Comply with 42 C.F.R. § 457.535 that exempts Native American families from any cost-sharing provisions under CHIP.

EBCOM - 0003 Submit decisions on incidents involving potential HIPAA violations as authorized by the HIPAA Compliance Officer for HHSC review and approval.

EBCOM - 0004 As directed by HHSC, comply with requirements imposed on HHSC as a result of court orders, consent decrees, corrective action orders, CAPs, and/or agreed settlements (i.e., orders or agreements impacting Services under the Contract).

EBCOM - 0005 Design, develop, and implement root cause analysis and CAPs as requested by HHSC.

2.2.6 FACILITIES (FAC)

The following table provides the requirements for facility and asset management for Contractor to assume in preparation of the Operations Phase. The incumbent contractor lease is located at 3501 Ed Bluestein Boulevard, Austin, TX 78721. In the event the Contractor cannot assume the lease located at 3501 Ed Bluestein Boulevard, Austin, TX 78721, the Contractor will propose locations in central Texas or the surrounding area that could provide greater efficiency and cost effectiveness to HHSC. Utilization of any alternative location is subject to approval by HHSC in its sole discretion.

The table below provides requirements associated with facilities.

Table 2 - Facilities Requirements

REQ ID REQUIREMENT DESCRIPTION

EBFAC - 0001 Enter into a lease agreement either by assuming the lease at the current location from the incumbent contractor or by entering into a new lease agreement at an alternative location upon approval from HHSC.

EBFAC - 0002 Ensure lease agreements for facilities contain provisions for assignment and/or subletting to HHSC or an entity designated by HHSC.

acastro582 Highlight

REQ ID REQUIREMENT DESCRIPTION

EBFAC - 0003 Operate and maintain facilities to be located in central Texas or surrounding areas, or unless otherwise directed by HHSC, to properly support the scale and magnitude of Services provided under the Contract in an economical fashion as practicable.

EBFAC - 0004 Maintain fully accessible facilities in accordance with the Americans with Disabilities Act (ADA).

EBFAC - 0005 Maintain access to all facilities and operations for all HHSC-authorized staff, as requested, during the hours of 8:00 a.m. to 6:00 p.m. Central Standard Time (CST), Monday through Friday and other hours as specified by HHSC in advance (e.g., providing after-hours availability during Texas legislative sessions).

EBFAC - 0006 Submit a Facilities Site Seating and Head Count Report on the 15th Business Day of each month. The headcount component of this report should include all staff by program/title and gross count of temporary and permanent employees. The report must also include full-time or part-time status of employees and their work from home status (full-time work-from-home, hybrid, or full time in office). (See Exhibit M, Deliverables

EBDEL-0001)

EBFAC - 0007 Utilize HHSC provided equipment in support of the Contract. A list of assets will be provided by the incumbent contractor upon HHSC request.

Contractor shall utilize any existing assets supporting the Contract at Contract Execution until the end of the assets’ recommended life cycle.

Contractor must coordinate with HHSC to refresh or replace assets to specified configurations on the HHSC managed refresh cycle.

2.2.7 KEY PERSONNEL AND STAFFING (PER)

Contractor must provide sufficient and qualified Key Personnel and staff for the performance of Services delivered under the Contract. The table below provides a list of Key Personnel with minimum qualifications. Key Personnel are those who have a leadership role and have interactive day-to-day involvement in, and management of, activities associated with fulfilling the requirements of the SOW and managing the Contract.

Table 3 - Key Personnel List

Role Description Minimum Qualifications

Principal or an Executive

Serves as the primary Point of Contact (POC) with HHSC executive management and oversees the successful fulfillment of the project.

At least six (6) years of experience managing personnel and/or EB activities. Previous Medicaid or similar health care system experience required.

Transition Project Manager

Serves as the primary POC to HHSC for EB Transition Activities.

At least two (2) years as a Project Manager for a health care or Managed Care system.

Must have and maintain certification for project management from an accredited entity).

Call Center Operations Project Manager

Serves as the primary POC with HHSC for call center operations and status reporting.

At least four (4) years of experience managing call center operations and/or EB activities.

Previous Medicaid or similar health care system experience required.

Systems Manager Serves as the primary POC to HHSC on all system integration, modification, and maintenance activities; accountable for scheduling and reporting all maintenance and modification activities, coordinating use of modification task personnel resources, facilitating implementation of system modifications, maintaining all system interfaces, and maintaining the ability for all appropriate users to access the

EB.

At least five (5) years of experience in healthcare and/or Managed Care development, design, and programming in a large systems environment, including at least three (3) years in a management capacity.

1. Five (5) years of experience in a similar role on a project of similar size.

2. Public sector experience.

3. Knowledge of HHSC programs, Medicaid programs, and the related federal and Texas laws and regulations.

Must have and maintain certification for project management from an accredited entity.

Role Description Minimum Qualifications

HIPAA

Compliance Manager

Serves as the primary POC with HHSC for the development, implementation, and maintenance of the policies and procedures required by the Contract for compliance with Data Use Agreements (DUA), Health Insurance Portability and Accountability Act (HIPAA), and all applicable state and federal laws, rules, regulations, and guidelines.

Knowledge of HIPAA requirements and pertinent privacy experience.

Reporting/Data Specialists

Responsible for assisting HHSC and HHSC-approved Trading Partners with data analysis, ad hoc report generation and production, scheduling EB file download requests, monitoring and analyzing production reports, and dashboard reporting.

At least two (2) years’ experience in a combination of ad hoc, database, report-writer software and middleware and web-based reporting. Previous knowledge of healthcare data.

Turnover Project Manager

Serves as the primary POC to HHSC for EB Turnover Activities, oversees all Turnover Activities, and must not serve in any other Key Personnel position during turnover.

At least two (2) years as a Project Manager.

Must have and maintain certification for project management from an accredited entity).

Information Security Manager

Primary POC with State staff for Information Security and potential electronic or system information compromise.

Knowledge of National Institute of Standards and Technology (NIST) security requirements, Federal Risk and Authorization Management Program (FedRAMP) requirements, Texas Risk and Authorization Management Program (TX- RAMP), HIPAA security requirements, and pertinent management experience.

The following table provides the requirements associated with Key Personnel and staffing.

Table 4 - Personnel and Staffing Requirements

REQ ID REQUIREMENT

EBPER - 0001 Provide qualified, knowledgeable, and professional staff to fulfill the performance of Services and Deliverables of the Contract.

EBPER - 0002 As needed and requested by HHSC, Key Personnel based outside of Texas must travel to Texas for any required in person meetings or events. HHSC will provide at least 14 Business Days’ notice of required travel unless the request is due to an emergency that does not allow for a 14 Business Day notice. Any travel for out of state Key Personnel will result in no reimbursement from HHSC.

EBPER - 0003 Ensure Key Personnel are 100% exclusively allocated to the Contract. Any redirection of Key Personnel to perform functions other than the responsibilities of the positions identified for the Contract, either temporarily or permanently, will require prior HHSC approval.

EBPER - 0004 Contractor must hire Key Personnel, Contractor Staff, or Subcontractor employee to perform task and functions of the Contract. HHSC reserves the right to approve the hiring or removal of any Key Personnel, Contractor staff, or Subcontractor employee.

EBPER - 0005 All Contractor staff providing Services under the Contract, including employees, contractors, and temporary agency workers, must successfully pass a background check process executed by a third-party provider of such services. The process must include criminal history, social security number, and med-scan (Medicaid Fraud) for all employees. If job requirements dictate, driving records, credit history checks, and other verification should be performed prior to employment.

Contractor must provide notification to HHSC for any other personnel who by virtue of their access to information or facilities may present a risk to the safety or security of clients and other persons or to the integrity, confidentiality or security of HHSC information. The Contractor warrants to HHSC that its or its subcontractors’ continued employment of such personnel is contingent upon the Contractor’s compliance with these and other appropriate security measures that may be required by HHSC.

EBPER - 0006 Contractor must provide HHSC with written notification within ten (10) Business Days prior to making any planned changes in Key Personnel and obtain HHSC’s written approval before making any permanent or temporary changes in Key Personnel.

EBPER - 0007 Key Personnel positions must not remain vacant more than ninety (90) Calendar Days without prior written approval from HHSC. Key Personnel positions must not remain vacant for longer than ninety (90) Calendar Days without prior written approval by HHSC.

REQ ID REQUIREMENT

EBPER - 0008 Submit a Personnel Report for HHSC review, which includes the status of Contractor staff, including roll-ons, roll-offs, and ongoing, in order to approve or disable EB HHSC network login accounts. (See Exhibit M, Deliverables EBDEL - 0002)

EBPER - 0009 Replace any employee working under the Contract who is determined by HHSC to be non-performing at any phase of the Contract. Contractor must immediately remove the individual from providing Services under the Contract upon HHSC’s request for removal.

EBPER - 0010 Contractor must disclose, throughout the Contract Term, any personal involvement of staff designated as Key Personnel in litigation or fraud cases involving any state agency and the scope of the Contract, including being deposed, investigated, or providing material responses to civil investigative demands or discovery. HHSC, in its sole discretion, may reject any such Key Personnel and require a replacement at Contractor’s expense.

2.2.8 SECURITY REQUIREMENTS (SEC)

The Contractor, at a minimum, shall comply with the security requirements set forth in Exhibit Q, HHS Information Security and Privacy Requirements.

Table 5 - Security Requirements

EBSEC - 0001 Implement the security and privacy controls identified in Exhibit Q, HHS Information Security and Privacy Requirements to ensure all controls are addressed appropriately to maintain the HHS enterprise risk posture protecting the confidentiality, integrity, and availability of HHSC data.

EBSEC - 0002 Complete a Security Assessment Report as proof of compliance with HHS information security requirements as found in Exhibit Q, HHS Information Security and Privacy Requirements. For HHS to accept the Security Assessment Report, the external entity must do the following:

1. Submit the Security Assessment Report using the HHS template.

2. Attest that the external entity is compliant with all HHS information security controls required per the external entity’s contractual agreement with HHS.

For the template and additional information, see the HHS Vendor Resources page at https://www.hhs.texas.gov/business/contracting-hhs/vendor-resources.

(See Exhibit M, Deliverables EBDEL-0003)…