Exhibit N – Requirements Traceability Matrix RFO No. HHS0015558v2

Exhibit N - Requirements Traceability Matrix (RTM)

Table of Contents

1. Requirements

1.1 Transition Phase Requirements

1.2 Operations Phase Requirements

1.2.1 Maintenance and Support Requirements

1.2.2 Functional Requirements

1.2.3 Training Requirements

1.2.4 Reporting Requirements

1.2.5 Security Requirements

1.2.6 Staffing Requirements

1.2.7 Accessibility Requirements

1.3 Turnover Phase Requirements

2. Key Performance Measures and Liquidated Damages

3. Deliverables

A. Written Deliverables

B. Deliverable Acceptance

C. Deliverable Due Dates

Table of Tables Table 1: Transition Requirements Table 2: Maintenance and Support Requirements Table 3: Functional Requirements Table 4: Training Requirements Table 5: Reporting Requirements Table 6: Security Requirements Table 7: Staffing Requirements Table 8: Accessibility Requirements Table 9: Turnover Requirements Table 10: Key Performance Measures and Liquidated Damages Table 11: Deliverables

1. Requirements The requirements for this RFO is detailed herein. The Contractor must meet or exceed the requirements for Services as specified in this section.

1.1 Transition Phase Requirements

The Transition Phase requirements include those activities that must be completed between the Contract Effective Date and Operations Start Date. The Contractor shall work with DSHS and the outgoing incumbent Contractor to transition the Services included in the Contract on a schedule approved by DSHS in writing. Transition is complete once; (1) DSHS determines that the Contractor has successfully completed all Transition activities, and (2) DSHS provides written notice to the Contractor to proceed with the commencement of the Operations phase.

The requirements listed in Table 1 (Transition Requirements) below describe the tasks and activities that must be performed by the Contractor during the Transition Phase.

Table 1: Transition Requirements

REQ ID Detailed Requirements

TRA-01 Transition activities occur between the Contract Effective Date and the Operations Start Date.

TRA-02 The Contractor must meet with DSHS-approved stakeholders no later than five (5) Business Days from the Contract Effective Date to define all activities through the first one hundred and eighty (180) Calendar Days.

The meeting may be held in person or remotely, as determined by DSHS.

TRA-03 The Contractor must schedule and facilitate a presentation within two (2) Business Days to familiarize DSHS with the Transition Plan (DEL-01) and the Contractor's approach to the requirements of this Contract. The presentation must include the following topics:

a. Project schedule (high level);

b. Objectives and definitions;

c. Artifacts;

d. Roles and responsibilities;

e. Keys to success;

f. Next steps;

g. Questions and answers (Q&A); and

h. Resources (including an updated organizational chart).

TRA-04 The Contractor must provide, for DSHS approval, a finalized Transition Plan within seven (7) Business Days of the Contract Effective Date. Revision to the Transition Plan requires DSHSs written approval.

TRA-05 The Contractor must coordinate with the incumbent Contractor to leverage the incumbent Contractor's Turnover tasks to create the Transition Plan.

TRA-06 The Contractor must provide all completed Transition milestones per the deadline in the DSHS-approved Transition Plan.

TRA-07 The Contractor must provide a Readiness Assessment Plan (DEL-03) that defines the assessment activities, fourteen (14) Calendar Days after Contract Effective Date for review and approval.

TRA-08 The Contractor must provide the Readiness Assessment Results Report fourteen (14) Calendar Days before Operations Start Date.

TRA-09 The Contractor must provide progress updates against DSHS approved Transition Plan for each task through the Weekly Written Status Reports and weekly progress meetings with stakeholders on a DSHS-approved schedule.

TRA-10 The Contractor must notify DSHS during transition weekly status meetings of any lack of responsiveness, cooperation or assistance on the part of the incumbent Contractor that impedes or hinders Contractor's efforts to comply with Transition.

TRA-11 The Contractor must ensure that all Providers are fully trained on both Mobile Application and Web-Based Application, fourteen (14) Business Days before Operations Start Date.

TRA-12 The Contractor must transition and store all Client's data - sixty (60) Calendar Days prior to Operation Start Date including:

a. Client Notes;

b. Client Symptoms and associated content;

c. Client Medication;

d. Client Medication Schedule; and

e. Client Treatment History.

TRA-13 The Contractor must transition and store all active Client's video recordings to the new Application dated [Contract Effective Date - 365 Calendar Days].

TRA-14 The Contractor must ensure that all agreed upon functionality will be available seven (7) Business Days before Operations Start Date.

TRA-15 The Transition Phase shall be complete when DSHS provides written approval of all deliverables and acknowledges successful completion.

1.2 Operations Phase Requirements

The Operations Services include all Contract requirements for ongoing functions. The Operations Phase commences on Operations Start Date and continues for the duration of the Contract until its expiration or earlier termination.

1.2.1 Maintenance and Support Requirements

The requirements specified in Table 2, Maintenance and Support Requirements apply to the maintenance and support of a Contractor‑provided, turnkey Application and do not include application development activities.

Table 2: Maintenance and Support Requirements

SUP-01 The Contractor must provide 24-hour online technical support that can be contacted via chat, or email for Application support.

SUP-02 The Contractor must provide telephone technical support during work hours 7:30 a.m. to 5:30 p.m. CST Monday through Friday.

SUP-03 The Contractor must host one (1) virtual monthly meeting to meet with DSHS to provide updates on upcoming features, receive feedback on current system, and review system optimization requests from DSHS.

SUP-04 The Contractor shall provide a way for DSHS to submit service requests (SRs) and optimization requests to the Contractor.

SUP-05 The Contractor must notify all Providers via email within two (2) Business Days of an issue being discovered by the Contractor and provide a timeline for resolution.

SUP-06 The Contractor must acknowledge and notify Providers via email within two (2) Calendar Days of an issue reported by a Provider and provide a timeline for resolution.

SUP-07 The Contractor shall ensure that all technical and Application support staff assigned to this Contract have completed HIPAA training appropriate to their roles and responsibilities. Upon request by DSHS, the Contractor shall provide documentation verifying completion of the required HIPAA training for each assigned staff member.

SUP-08 The Contractor must ensure that all resources assigned to this Contract are based in the contiguous United States (U.S.).

SUP-09 The Contractor must identify specific Key Personnel as defined in RFO Section 2.1.2.7 (Staffing Requirements) and Exhibit N, Requirements Traceability Matrix – Table 7 (Staffing Requirements), within two (2) Business Day after Contract Effective Date.

SUP-10 The Contractor must designate a primary and secondary contact responsible for the overall project to communicate with the DSHS throughout the duration of the Contract.

SUP-11 For the first ninety (90) Calendar Days of the Operations Start Date, the Contractor must schedule a weekly virtual meeting with all Providers to gather feedback on Application functionality.

SUP-12 The Contractor must submit Root Cause Analyses and Corrective Action Plans (CAP) for resolving operational deficiencies, discrepancies, and issues no later than five (5) Business Days of DSHS’s request, or as otherwise directed by DSHS.

SUP-13 The Contractor must provide support and maintenance for a Services-oriented architecture (SOA) or web Services architecture, as required by DSHS. The State requires SOA capabilities for all communication with constituent third party Applications.

SUP-14 The Contractor shall perform Services which include, but are not limited to, the following:

a. Trouble-shoot and resolve problems encountered by Users in VDOT;

b. Resolve integration issues with uploading electronic data into VDOT;

c. Resolve issues with the integration of VDOT records into the Electronic Health Record (EHR); and

d. Resolve issues for maximizing the speed of the Texas specific Extract, Transform and Load (ETL) code.

1.2.2 Functional Requirements

The requirements specified in Table 3, Functional Requirements define the functional capabilities of the Application.

Table 3: Functional Requirements

FNC-01 The Contractor must provide a turnkey Application for Video Directly Observed Therapy (VDOT) to be used for Tuberculosis (TB) medication adherence in Clients with TB.

FNC-02 The Contractor must provide an Application that supports both Synchronous and Asynchronous observation of Clients for medication adherence.

FNC-03 The Application must allow Clients to easily switch from Synchronous to Asynchronous observation without any disruption to dose tracking.

FNC-04 The Application, after logging in, must present the Client with the option to choose either Synchronous or Asynchronous observation.

FNC-05 The Contractor must provide an Application that includes both a Web-Based interface accessible via standard internet browsers and a Mobile component compatible with major Mobile operating systems (e.g., iOS and Android)

FNC-06 The Application must include functionality to define, assign, and manage distinct roles and permissions for Provider accounts, Administrator accounts and Client accounts, ensuring appropriate access controls and permissions based on User type.

FNC-07 The Application must enable Administrator roles with the following capabilities:

a. Review and approve or reject new User account registrations.

b. Provide global account management view of all User accounts, including details such as account status, activation date, and assigned roles.

c. View all available reports, including aggregated state-wide summaries and detailed breakdowns (e.g., by region).

FNC-08 The Application must be able to create roles, hierarchies and groups for Providers.

FNC-09 The Application must be able to assign Clients to Provider groups.

FNC-10 The Application must only send Client notifications to their assigned Provider group.

FNC-11 The Application must allow all active Client and Provider accounts to use the Application simultaneously.

FNC-12 The Application must support role-based access controls that allow Providers to access appropriate functionality via Web-Based and/or Mobile interfaces, as authorized by DSHS.

FNC-13 The Application must be scalable to support all active Provider accounts and must enable Providers to access, review, and interact with Asynchronous Client data.

FNC-14 The Application must be scalable to support all active Provider accounts to interact with Clients in a Synchronous environment.

FNC-15 The Application must inform Providers and Clients when they must update their system firmware to the latest version for security and performance purposes.

FNC-16 The Contractor must notify DSHS via email of any unanticipated downtime within one (1) Business Hour of downtime occurring.

FNC-17 The Contractor must notify DSHS via email of any anticipated downtimes to the Application a minimum of three (3) Business Days before scheduled downtime.

FNC-18 The Application must support multi-device login functionality for both Provider and Client accounts, ensuring that all User data and activity are associated with the account credentials rather than being restricted to a specific device.

FNC-19 The Application's Web-Based portal must be able to interface with the State's IAM multi-factor authentication system (Exhibit P, HHSC Identity and Access Management (IAM) Guide).

FNC-20 The Application must allow Clients to report symptoms and medication side-effects.

FNC-21 The Application must have the capability to collect, organize, and retain Client Records in a chronological order to ensure accurate tracking and historical reference of Client data.

FNC-22 The Application must enable Providers to document clinical notes, record and monitor Client-reported symptoms and side effects, and generate reports that can be shared with other Providers for care coordination and clinical decision-making.

FNC-23 The Application must provide Providers with the ability to run reports and have a data dashboard.

FNC-24 The Application must provide report generation and the ability to create regular, customizable data exports (.csv and/or .pdf) on all data.

FNC-25 The Application must automatically generate and display a date and time stamp for all Client data, including but not limited to clinical notes and video recordings.

FNC-26 The Application must enforce restrictions that prevent the editing or modification of original clinical notes once entered and video recordings once uploaded. Any updates or amendments to such records must be logged as separate, traceable entries to ensure integrity and accountability.

FNC-27 The Mobile Application must provide Clients with timely reminders regarding medication adherence, upcoming Visits, and the submission of report videos, ensuring that notifications are clear, actionable, and configurable by the Client or Provider.

FNC-28 The Application must support multiple dosing schedules (i.e., daily, split, or intermittent).

FNC-29 The Application must notify the associated Provider group, via email and within the Application, when a Client has entered new information about themselves into the Application.

FNC-30 The Application must allow Providers to enter medication, medication doses, medication form (pill, liquid, injection, capsule, etc.) and medication schedule/reminder for administration.

FNC-31 The Application must notify new Clients via text to download and set up their Client account.

FNC-32 The Application must provide instructions to both Clients and Providers in multiple languages, including but not to limited to, English and Spanish.

FNC-33 The Application must allow Providers to input Client care details, including but not limited to the following:

a. Illness type;

b. Medications prescribed;

c. Medication form (pill, liquid, capsule, injectable, etc.);

d. Dosage;

e. Drug regimen;

f. Contraindications; and

g. Schedule Dose Times.

FNC-34 The Web-Based Application must allow Providers to set up new Client accounts with the following information, including but not limited to:

a. Name;

b. Date of Birth (DOB);

c. Contact information (cell phone number);

d. Gender;

e. Primary language;

f. Condition being treated;

g. Region;

h. Monitoring Type (Synchronous vs Asynchronous);

i. Assigned Provider team;

j. Medication prescribed;

k. Medication dosage; and

l. Medication form (pill, liquid, etc.).

FNC-35 The Application must allow Providers to track all doses (taken, missed, refused, etc).

FNC-36 The Application should generate a count of remaining doses automatically after each Visit and populate a summary report at the end of treatment.

The report should highlight if a specific Client has missed consecutive doses and then recommend moving the Client to In-Person meetings.

FNC-37 The Application must allow Providers to activate and deactivate Client and Provider Accounts.

FNC-38 The Application must enable Providers to:

a. review Asynchronous video submissions;

b. accept or reject a dose based on the video review;

c. add observational notes that are linked to the corresponding Client Record and video submission; and

d. view instances of missed or refused doses.

FNC-39 The Application must autolink a recording to a Client's records.

FNC-40 The Application must allow Providers to review a Client’s Visit schedule, Visit history, and add notes to each Client’s Visit.

FNC-41 If a Client misses a Visit, the Application must notify the Provider team assigned via email and through the Application. The Application must allow Providers to add reason for missed Visit and reschedule Visit.

FNC-42 The Application must be available in multiple languages, including but not limited to, English and Spanish.

FNC-43 The Application must allow Providers to upload pdf documents in the Web-Based Application and allow Clients to view and print the documents through the Mobile-Application.

FNC-44 The Mobile-Application Interface must be simple enough to help Clients either record a video or attend a scheduled meeting for a Synchronous observation.

FNC-45 The Contractor must provide a data dictionary to DSHS at DSHS’s request.

FNC-46 The Application must allow Client to upload videos into the Application from a Mobile device.

FNC-47 The Contractor shall be responsible for hosting the Application in a secure, reliable, and scalable environment that is compliant with TX-RAMP Level 2 certification requirements.

FNC-48 The Application must generate automatic captions and provide real-time translation for video sessions to improve accessibility, ensure comprehension for Users with limited English proficiency, and support accurate monitoring of therapy adherence by care providers.

1.2.3 Training Requirements

The requirements specified in Table 4, Training Requirements define the Contractor’s training obligations.

Table 4: Training Requirements

TRN-01 The Contractor must provide Web-Based training for onboarding of Clients and Providers.

TRN-02 The Contractor-provided trainings for Clients must be available in multiple languages, including but not limited to, English and Spanish - at minimum.

TRN-03 The Contractor-provided trainings for Clients must be accessible to Users who have literacy limitations.

TRN-04 Training materials must comply with Accessibility requirements as defined in Table 8 - RFO, Section

2.1.2.8 (Accessibility Requirements).

TRN-05 The Contractor must meet with DSHS-approved stakeholders to review all Client-facing training materials prior to their release to Clients. The purpose of these reviews is to ensure that the content, format, and delivery are suitable for the intended Client audience before the materials are made available.

TRN-06 The Contractor-provided training must be available to both Providers and Clients at any time.

TRN-07 The Contractor must provide the Providers with both written and video formats of training for both the Web- Based Portal and the Mobile Application, including but not limited to entering Client, adding medications, running reports, etc.

TRN-08 The Contractor must ensure all trainings have Closed Captioning capabilities for all videos - in multiple languages including but not limited to English and Spanish.

TRN-09 The Contractor must ensure that all training materials are up to date and ensure that the Providers are informed, via email, within three (3) Business Days of any updates.

TRN-10 The training must be available in multiple languages, including but to limited to, English and Spanish.

TRN-11 After the Operations Start Date, the Contractor must host Provider trainings once a month to update Users of the Web-Applications functionality for the duration of the Contract Term.

TRN-12 The Contractor must provide a training environment for the Providers to use - to learn and test functionality.

1.2.4 Reporting Requirements

The requirements specified in Table 5, (Reporting Requirements) include reports, dashboards, and data analytics views used to present and analyze program and operational data.

Table 5: Reporting Requirements

RPT-01 The Application must create a report that shows:

a. Client Name;

b. Date of Birth (DOB);

c. Number of videos submitted;

d. Number of videos reviewed by personnel;

e. Number of Visits made; and

f. Number of Visits missed.

RPT-02 The Application must have a Population Analytics Dashboard that shows:

a. Region;

b. Client Status;

c. Medical Record Number (MRN);

d. Date;

e. Illness/Condition (TB suspect, TB case, latent TB infection, etc);

f. Total Number of Client Submissions; and

g. Client by Treatment Status (with filters).

RPT-03 The Application shall provide a dashboard that displays, by week, the number of Clients created, categorized by condition:

a. Week range filter;

b. Total number of Clients for selected week range; and

c. Clients created by illness/condition by week.

RPT-04 The Application shall provide a dashboard that displays, on a Monthly basis, the number of Clients created, categorized by condition:

a. Month range filter;

b. Total number of Clients for selected month range; and

c. Clients created by illness/condition by month.

RPT-05 The Application must have Report that breaks down Clients by status with conditions:

a. Client ID;

b. Client first name;

c. Client last name;

d. Entity name;

e. Phone;

f. Email;

g. Client status;

h. DOB;

i. Medical record number (MRN);

j. Total doses;

k. Treatment end date; and

l. Last login.

RPT-06 The Application must provide a Client specific reporting dashboard that displays:

a. Region;

b. Client status;

c. MRN;

d. Date;

e. Illness/condition;

f. Total number of Client’s video submissions;

g. Client by treatment status (with filters);

h. Total doses; and

i. Treatment end date.

RPT-07 The Application must have report that breaks down Client's video submissions by date and by different date ranges:

a. Client MRN;

b. Entity name;

c. Last name;

d. First name;

e. City;

f. Total number of Client’s video submissions reviewed;

g. Number of blocked videos;

h. Number of in-clinic videos;

i. Number of in-field videos;

j. Number of In Hospital videos;

k. Number of Live Stream Recorded Sessions; and

l. Number of missed appointments.

RPT-08 The Application must have a report that breaks down Client's video submissions by day:

a. Date of video submission;

b. Medical record number;

c. Entity name;

d. Last name;

e. First name;

f. Location;

g. Conditions reported;

h. Reviewer name;

i. Submissions reviewed;

j. Total number of videos;

k. Total number of videos blocked;

l. Number of in-clinic videos;

m. Number of in-field videos;

n. Number of in-hospital videos; and

o. Number of live stream recorded sessions.

RPT-09 When the Application displays a report by Client name, it must be role controlled to ensure that only Providers and Administrators can view the report.

RPT-10 The Application dashboard must always refresh, in real-time, with the latest datapoints.

RPT-11 The Application must provide a Client compliance report that shows:

a. Client name;

b. Client DOB;

c. Total number of Client doses prescribed;

d. Total number of doses missed;

e. Total number of doses counted;

f. Percentage (%) of doses counted;

g. Percentage (%) of doses missed;

h. Last Client system login; and

i. Comments.

RPT-12 The Contractor shall provide Weekly Written Status Reports. See (DEL-02) for additional details.

1.2.5 Security Requirements

The requirements specified in Table 6, Security Requirements define the security obligations applicable to the solution.

Table 6: Security Requirements

SEC-01 The Application must be HIPAA compliant and provide end-to-end encryption to ensure the security of Client data.

SEC-02 The Application must provide ability for a Provider to initiate a HIPAA- secure live chat with a Client.

SEC-03 The Contractor must notify the DSHS Regional and Local Health Operations by phone and email, within an hour, of any unauthorized attempt to obtain access or otherwise tamper with data.

SEC-04 The Application must clearly meet the National Institute of Standards and Technology (NIST) standard definition of SaaS as interpreted by Texas Department of Information Resource (DIR).

(NIST Definition of Cloud Computing SP 800-145)

Note: DSHS will be required to request and receive from DIR a Data Center Services (DCS) program exemption before a Contract can be awarded to a Contractor if the Application is not on DIR’s approved blanket SaaS products list.

SEC-05 The Contractor must retain all Client Recordings for the duration of the Contract Term.

SEC-06 The Contractor must comply with all requirements contained in Exhibit L, Information Security and Privacy Requirements.

Table 6: Security Requirements

SEC-07 The Contractor must provide a completed SOC2 Type II report or use the "Security Report and Attestation Guidance" template (Security Assessment Report and Attestation Guideline) annually on a date approved by DSHS.

SEC-08 The Contractor must be TX-RAMP Level 2 certified.

1.2.6 Staffing Requirements

The requirements specified in Table 7, Staffing Requirements define required staffing roles and qualifications.

Table 7: Staffing Requirements

STF-01 Account Manager - Represents the Contractor and oversees the day-to-day activities of the Contract. Serves as the primary or secondary POC for matters concerning the Contractor's performance and all operational matters under the Contract and must have the authority to make decisions that are binding to the Contractor.

The Account Manager must have a minimum of two (2) years of contract management experience managing contracts for related Services with similar budgets, preferably in the healthcare industry and for a project similar in size and scope to the Contract.

https://www.hhs.texas.gov/sites/default/files/documents/doing-business-with-hhs/contracting/security-assessment-report-attestation-guideline.pdf

Table 7: Staffing Requirements

STF-02 The Technical Lead is a senior technical resource responsible for providing deep technical expertise and strategic input throughout the lifecycle of the Application. This individual possesses comprehensive knowledge of the Application’s architecture, functionality, and integrations, enabling them to guide development efforts, ensure alignment with enterprise standards, and support informed decision-making.

The Technical Lead must have a minimum of five (5) years of managing Application’s architecture, functionality, and integrations.

1.2.7 Accessibility Requirements

The requirements specified in Table 8, Accessibility Requirements. The Accessibility Requirements encompass tasks, activities and responsibilities of the Contractor to ensure compliance with state and federal accessibility laws and regulations.

Table 8: Accessibility Requirements

AC-01 Accessibility Standards: The Contractor must provide Software conformant with Web Content Accessibility Guidelines (WCAG) 2.1 Accessibility Guidelines, Level A and Level AA success criteria.

The Contractor must provide contractual warrantees for accessibility (Accessibility Conformance Reports (completed VPAT)):

a. Refer to Exhibit O, VPAT WCAG Edition; and

b. Exhibit O-1, VPAT Revised Section 508 Edition.

https://www.w3.org/TR/WCAG21/

Table 8: Accessibility Requirements

AC-02 The Contractor must comply with HHS Uniform Electronic and Information Resources (EIR) Accessibility Clause included in Exhibit O-2, HHS Uniform Electronic and Information Resources (EIR) Accessibility Clause.

AC-03 The Contractor must comply with the Health and Human Services Accessibility Policy that requires compliance with Title 1, Texas Administrative Code (TAC), Chapter 206, Subchapter B and Chapter 213, Subchapter A and Subchapter B.

1.3 Turnover Phase Requirements

The primary objective for Turnover activities is to ensure no interruption of Services. Turnover shall begin 180 Calendar Days prior to Contract expiration. In the event the Contract is terminated in accordance with Exhibit B, Health and Human Services Uniform Terms and Conditions, Turnover activities shall begin ten (10) Business Days after the Contract is terminated. Turnover includes the administrative and Operations activities performed by the Contractor to turn over Operations to either DSHS or a DSHS-designated successor Service Provider. The Contractor shall provide Turnover Services that meets or exceeds the requirements specified in Table 9, Turnover Requirements.

Table 9: Turnover Requirements

TUR-01 The Contractor must provide weekly status reports during the Turnover Phase.

TUR-02 The Contractor shall take all steps necessary, at no additional cost to DSHS, to ensure that both Turnover Services and Operations Services are performed without interruption or diminished performance, including, if necessary, adding additional personnel, temporarily relocating personnel, and other increases in resources to ensure the Contractor’s complete and uninterrupted performance of all Contract obligations

TUR-03 The Contractor must provide a draft Turnover plan which defines the planned approach to turn over data from the Application to DSHS or a DSHS designated Contractor one hundred eighty (180) Business Days after Operations Start Date. See (DEL-05 Turnover Plan) for additional details.

TUR-04 The Contractor will submit a final approved Turnover plan ninety (90) Business Days before Contract Expiration Date.

TUR-05 During the Turnover Phase the Contractor must ensure continued operations with minimal disruption while concurrently implementing turnover tasks as defined in the turnover plan.

Table 9: Turnover Requirements

TUR-06 The Contractor must successfully complete all Turnover activities and performance measurements within one hundred and twenty (120) Calendar Days prior to Contract expiration date. Turnover activities must include:

a. Complete all requested enhancements as agreed with DSHS prior to Turnover;

b. Resolve all open SRs;

c. Coordinate activities with DSHS and any DSHS-designee;

d. Implement the DSHS approved Turnover plan; and

e. Work with DSHS to provide the current data dictionary and data to the successor Service Provider.

TUR-07 The Contractor must provide DSHS a complete inventory of all Contractor artifacts, tasks, data dictionary, data, workflow documentation, and DSHS specific materials that must be turned over to DSHS according to the final turnover plan.

TUR-08 The Contractor must document the completion and outcomes of each step of the Turnover plan on a Turnover Results Report. Turnover will not be considered complete and final payment will not be made until the turnover results report is received and approved by DSHS. See DEL-06 for additional details on Turnover Results Report.

TUR-09 The Contractor must ensure that all data provided during turnover is complete and uncorrupted.

TUR-10 After completion of the Turnover Phase, the Contractor must adhere to the data retention guidelines as outlined in Exhibit B, Health and Human Services Uniform Terms and Conditions and Affirmations for Price Requests under DIR Cooperative Contracts.

2. Key Performance Measures and Liquidated Damages The Contractor must achieve the following Key Performance Measures (“KPMs”). For purposes of these KPMs, all measurement periods shall be monthly unless otherwise specified. Additionally, when a Liquidated Damage refers to a percentage point or portion thereof, the "portion thereof" means that a total percentage point deviation is not required to assess the Liquidated Damage. For example, if the standard is 99% and the results achieved are 98.6%, the Liquidated Damage that may be assessed is based on 1.0% point. If the results are 97.9%, the Liquidated Damage that may be assessed is based on 2.0% points.

Table 10: Key Performance Measures and Liquidated Damages

KPM ID KPM Description Liquidated Damages

KPM-01 The Contractor must meet due dates as agreed for all deliverables. These include the following Deliverable IDs as described in Exhibit N, Requirements Traceability Matrix, Table 11 (Deliverables) – DEL-01, DEL-02, DEL- 03, DEL-04, DEL-06, and DEL-07.

$200 per additional Business Day, not to exceed $2,000 in a given month

KPM-02 The Contractor must submit an updated organizational chart, including designated Key Personnel, within ten (10) Business Days of the Contract Effective Date.

$200 per each Business Day, not to exceed $4,000 in each month

KPM-03 Fill any Key Personnel - as defined in Exhibit N, Requirements Traceability Matrix, Table 7 (Staffing Requirements) - replacement role vacancies within ten (10) Business Days, unless an alternate due date is approved by

DSHS.

$200 per each Business Day, not to exceed $4000 in each month

Table 10: Key Performance Measures and Liquidated Damages

KPM ID KPM Description Liquidated Damages

KPM-04 The Application must have a minimum of 99% uptime (planned downtime will not be counted against this KPM) per month.

Every percentage point below 99% per month shall be an additional $200

KPM-05 For each additional Business Hour past one (1) hour that the Contractor fails to notify DSHS of unanticipated downtime.

$50 per each additional Business Hour

KPM-06 For every additional day beyond two (2) Calendar Days that the Contractor fails to notify the Providers for issue and timeline of resolution.

$500 per Calendar Day

KPM-07 The Contractor must prepare and submit an acceptable Turnover Plan - as defined in DEL-05 of Exhibit N, Requirements Traceability Matrix, Table 11 (Deliverables) - on or before the one-hundredth and eightieth (180th) Calendar Day following the Contract Effective Date and update it annually on or before January 1st.

$2,000/Calendar Day

3. Deliverables For each Deliverable, DSHS may require a walk-through of the Deliverable in advance of delivery. DSHS will provide ten (10) Business Days advanced notice to Contractor when a Deliverable walk-through is required.

A. Written Deliverables

Deliverables must be published in a manner that enables visibility, collaboration, and ease of use for DSHS. The Contractor must:

1. Make all written deliverables available electronically.

2. Use the DSHS approved Application to publish the written deliverables online (e.g., Microsoft SharePoint or another DSHS approved collaboration tool).

3. Provide deliverables that show DSHS approved branding and are free of any copyrights.

4. Update written deliverables throughout the Contract Term as changes occur to VDOT and available resources.

B. Deliverable Acceptance

1. Contractor must provide the deliverables on or before the dates specified in Exhibit N, Requirements Traceability Matrix, (Section 1 (Requirements)).

2. Each Deliverable must be reviewed and approved by DSHS prior to its use. Approval will be granted if DSHS determines the Deliverable conforms to the accepted specifications identified in the Contract. DSHS acceptance of any Deliverable does not relieve the Contractor of the liability or responsibility for corrections for subsequent defects, errors, and/or omissions discovered or experienced in connection with the Deliverable.

3. If any Deliverable cannot be provided within the scheduled timeframe, the Contractor must contact DSHS’s point of contact, in writing, and provide a reason for the delay and the proposed revised schedule, which DSHS may accept or reject at its sole discretion. DSHS’s acceptance of a Deliverable after the applicable due date does not relieve the Contractor from its obligation to submit a complete Deliverable by the specified due date.

4. DSHS shall notify the Contractor in writing of Deliverable approval or rejection, along with the reason(s) for rejection and the steps the Contractor must complete so the Deliverable will be acceptable.

5. Upon receipt of the corrected and resubmitted Deliverable, DSHS shall review the corrected Deliverable to confirm that the identified deficiencies have been corrected and brought into compliance with specifications and that the corrections have not directly or indirectly caused other deficiencies. DSHS shall have the option to continue the evaluation process until the Deliverable is brought into compliance with the Contract specifications.

6. Any Deliverable that is not explicitly accepted by DSHS is rejected.

C. Deliverable Due Dates

All deliverables requested by DSHS must be provided on the dates specified in Exhibit N, Requirements Traceability Matrix, (Section 3 (Deliverables)). Failure to provide deliverables on the due dates may result in the assessment of liquidated damages as listed in Exhibit N, Requirements Traceability Matrix, (Section 2 (Key Performance Measures and Liquidated Damages)).

Table 11: Deliverables

Deliverable ID Deliverable Name Deliverable Due Date

Update Frequency

DEL-01 Transition Plan The Transition Plan outlines the activities necessary for a seamless transition of Services (when Contractor takes over Services from the incumbent Service Provider) to occur between the Contract Effective Date and the Operations Start Date. The plan will include:

a. A timeline for the transition to be reviewed and approved by DSHS staff;

b. How the Contractor will transition knowledge from the incumbent Service Provider to Contractor personnel to fully support the requirements of the Contract;

c. Establishment of the Contractor's project management office;

d. On-boarding of the project personnel;

e. On-boarding and/or transfer of technical resources; and

f. Completing the knowledge transfer from the incumbent Service Provider.

Seven (7) Business Days after the Contract Effective Date.

N/A

DEL-02 Weekly Written Status Reports

The Contractor must provide the Weekly Written Status Reports, in a format approved by the DSHS Program manager, which at a minimum will include the progress of deliverables and resolutions to any issues identified by the Contractor and DSHS staff.

The Weekly Written Status Reports will report progress against the Project Schedule and must include but is not limited to:

a. Progress against agreed upon milestones;

b. Contractor’s completed service requests (SRs);

1. Provides HHS IT the ability to view tickets and generate ad hoc reports.

c. Contractor’s SRs in progress;

d. Contractor’s work to be initiated during the next week;

e. Assessment of progress against, each SR and the percent completed with details of any slipping tasks; and

f. Issues requiring DSHS attention which include:

1. Problems that may delay completion of scheduled deliverables;

2. Failure or inadequacy of the Contractor in the performance of a Contracted Service;

Five (5) Business Days after Contract Effective Date.

Weekly during the Contract Term.

3. Failure or delay of Contractor or DSHS to perform a project task;

4. Open issues;

5. Age of open project issues;

6. Number of defects;

7. High priority risks with mitigation plan;

8. Quality measures (success criteria achieved compared to success criteria planned);

9. Implementation and technical performance criteria;

10. Failure, delay or inadequacy of the Contractor to DSHS in the performance of the respective obligations that may delay completion of scheduled deliverables;

11. Proposed corrective actions(s) for each issue reported; and

12. Other information requested by DSHS.

DEL-03 Readiness Assessment Plan

The Contractor must provide a Readiness Assessment Plan that:

a. Describes how the results of the readiness assessment will be collected and presented to DSHS to include recommended approaches to resolve any identified problems;

b. Ensures the Contractor’s ability to support incident management; and

c. Describes the readiness of business procedures, reporting, and secure data export.

Fourteen (14) Business Days after the Contract Effective Date.

N/A

DEL-04 Readiness Assessment Results Report

The Contractor must provide a Readiness Assessment Results Report which confirms:

a. All Users have been identified, on-boarded, trained, and registered (logins created); and

b. Receipt of DSHS written approval of Contractor’s transition and readiness for full operations.

Fourteen (14) Calendar Days prior to the Operations Start Date.

N/A

DEL-05 Turnover Plan The Turnover Plan shall be a comprehensive document detailing the proposed schedule, activities, and resource requirements associated with turnover tasks. The Turnover Plan must include:

a. A schedule for turnover activities, with timelines and milestones specified for key tasks;

b. A staffing plan to support turnover tasks, including knowledge transfer activities;

c. A description of the roles and responsibilities of Contractor personnel, including subcontractors, during the Turnover Phase;

d. The method for identifying all data, assets, and intellectual property to be turned over;

e. A risk register for the Turnover activities that identifies potential risks, prioritizes the risks based on probability and impact, and establishes appropriate risk mitigation strategies;

f. A communication plan to facilitate interaction between Contractor and the incoming Service Provider or DSHS during the Turnover activities; and

g. Any assumptions and dependencies.

The Turnover Plan must be approved, in writing, by

DSHS.

On or before one-hundred and eighty (180) Business Days after Operations Start Date.

a. Updated annually on or before January 1st;

b. Throughout Contract Term as any change occurs; or

c. As requested by

DSHS.

DEL-06 Turnover Results Report

The Contractor shall provide a detailed final Turnover Results Report that includes, but is not limited to, the following:

a. Summary of all turnover activities conducted;

b. Confirmation that all Contract requirements have been met and are fully turned over; and

c. Any additional information request regarding Turnover.

Ten (10) Calendar Days before end of the Contract Term.

N/A

DEL-07 System Security Plan (SSP)

The Contractor shall develop, execute, maintain and deliver for DSHS approval, a System Security Plan (SSP) to document the current level of security controls within the Contractor’s solution that protects the confidentiality, integrity and availability (CIA) of the solution and its information. Specific SSP security control requirements are located in Exhibit L, Information Security and Privacy Requirements and further guidance located on the Contractor Resources site. (https://www.hhs.texas.gov/business/contracting-hhs/vendor-resources#risk-assessment-report-and-system-security-plan)

Within twenty-one (21) Calendar Days of Contract Effective Date.

a. Annually throughout Contract Term as part of the Contractor’s risk assessment;

and

b. As requested by

DSHS.

https://www.hhs.texas.gov/business/contracting-hhs/vendor-resources#risk-assessment-report-and-system-security-plan https://www.hhs.texas.gov/business/contracting-hhs/vendor-resources#risk-assessment-report-and-system-security-plan https://www.hhs.texas.gov/business/contracting-hhs/vendor-resources#risk-assessment-report-and-system-security-plan

DEL-08 Root Cause Analysis (RCA)

A Root Cause Analysis must, at minimum, include:

a. Summary of the incident (date, time, impact, duration);

b. Identification of root cause(s) using a structured method; and

c. Contributing factors and sequence of events.

Five (5) Business Days of DSHS’s request, or as otherwise directed by

DSHS.

As requested by

DSHS.

DEL-09 Corrective Action Plan (CAP)

A Corrective Action Plan must, at minimum, include:

a. Corrective and preventive actions taken or proposed;

b. Timeline for resolution and implementation; and

c. Assigned responsible parties for follow-up actions.

Five (5) Business Days of DSHS’s request, or as otherwise directed by

DSHS.

As requested by

DSHS.

1.3 Turnover Phase Requirements