f - 01_2031JW24R00002_Dental Insurance Solicitation_09.06.24.pdf

2031JW24R00002

SOLICITATION, OFFER AND AWARD

4. TYPE OF SOLICITATION2. CONTRACT NUMBER 3. SOLICITATION NUMBER

7. ISSUED BY CODE 8. ADDRESS OFFER TO (If other than Item 7)

System (DPAS) - Code of Federal Regulations - at 15 CFR 700.

6. REQUISITION/PURCHASE NUMBER

NOTE: In sealed bid solicitations "offer" and "offeror" mean "bid" and "bidder".

NEGOTIATED (RFP) REQUEST FOR

SEALED BID (IFB) INVITATION FOR BID

5. DATE ISSUED

1. This Contract is a Rated Order under the Defense Priorities and Allocations RATING PAGE OF PAGES

1 71

C. E-MAIL ADDRESS

EXT.NUMBERAREA CODE

B. TELEPHONE (NO COLLECT CALLS)A. NAME

10. FOR

INFORMATION

CALL:

CAUTION: LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation.

(Date)(Hour) local timeuntildepository located in copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if hand carried, in the

SOLICITATION

9. Sealed offers in original and

PART IV - REPRESENTATIONS AND INSTRUCTIONS

OTHER STATEMENTS OF OFFERORS

EVALUATION FACTORS FOR AWARD

INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS

REPRESENTATIONS, CERTIFICATIONS AND

LIST OF ATTACHMENTS

CONTRACT CLAUSES

PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS

I

J

K

L

M SPECIAL CONTRACT REQUIREMENTS

CONTRACT ADMINISTRATION DATA

DELIVERIES OR PERFORMANCE

INSPECTION AND ACCEPTANCE

PACKAGING AND MARKING

DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

SUPPLIES OR SERVICES AND PRICES/COSTS

SOLICITATION/CONTRACT FORM

PART II - CONTRACT CLAUSESPART I - THE SCHEDULE

H

G

F

E

D

C

B

A

SEC. DESCRIPTION PAGE(S) (X) DESCRIPTION SEC. (X)

11. TABLE OF CONTENTS

18. OFFER DATE17. SIGNATURE

SUCH ADDRESS IN SCHEDULE.

IS DIFFERENT FROM ABOVE - ENTER

15C. CHECK IF REMITTANCE ADDRESS

EXTENSIONNUMBERAREA CODE

15B. TELEPHONE NUMBER

(Type or print)AND

ADDRESS

OF

OFFEROR

CODE FACILITY

16. NAME AND TITLE OF PERSON AUTHORIZED TO SIGN OFFER15A. NAME

DATEAMENDMENT NO.DATEAMENDMENT NO.

and related documents numbered and dated):

amendments to the SOLICITATION for offerors

(The offeror acknowledges receipt of

14. ACKNOWLEDGEMENT OF AMENDMENTS

CALENDAR DAYS (%)30 CALENDAR DAYS (%)20 CALENDAR DAYS (%)10 CALENDAR DAYS (%)

(See Section I, Clause No. 52.232.8)

13. DISCOUNT FOR PROMPT PAYMENT

designated point(s), within the time specified in the schedule.

by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

OFFER (Must be fully completed by offeror)

IMPORTANT - Award will be made on this Form, or on Standard Form 26, or by other authorized official written notice.

28. AWARD DATE

(Signature of Contracting Officer)

27. UNITED STATES OF AMERICA

25. PAYMENT WILL BE MADE BY

26. NAME OF CONTRACTING OFFICER (Type or print)

CODE 24. ADMINISTERED BY (If other than Item 7)

ITEM

(4 copies unless otherwise specified)

23. SUBMIT INVOICES TO ADDRESS SHOWN IN

41 U.S.C. 3304 (a) ( 10 U.S.C. 3204 (a) (

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION UNDER THE

21. ACCOUNTING AND APPROPRIATION20. AMOUNT19. ACCEPTED AS TO ITEMS NUMBERED

AWARD (To be completed by government)

CODE

09/06/2024 X

OCC

Comptroller of the Currency Acquisitions Management

400 7TH STREET SW

Washington DC 20219

1000 ET 10/07/2024

MATTHEW J QUINN

MATTHEW.QUINN@OCC.TREAS.G

OV

X

X

X

X

X

X

X

X

X

X

X

X

X

PAGE(S)

JOEY BARDEN

AUTHORIZED FOR LOCAL REPRODUCTION

Previous edition is unusable

STANDARD FORM 33 (REV. 12/2022)

Prescribed by GSA - FAR (48 CFR) 53.214(c)

1 - 2

4 - 25 28 - 29 30 - 33 34 - 37

38 - 46

48 - 57

58 - 66

67 - 71

12. In compliance with the above, the undersigned agrees, if this offer is accepted within _____160_________ calendar days (60 calendar days unless a different period is inserted

PROPOSAL

UNITED STATES CODE AT:

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

NAME OF OFFEROR OR CONTRACTOR

2 71

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

2031JW24R00002

(A) (B) (C) (D) (E) (F)

Period of Performance: 04/01/2025 to 03/31/2026

OPTIONAL FORM 336 (4-86)

Sponsored by GSA

FAR (48 CFR) 53.110

NSN 7540-01-152-8067

Dental Insurance Solicitation

PART I – THE SCHEDULE

SECTION B – SUPPLIES OR SERVICES AND PRICES / COSTS

B.1 See Attachment (1) Price Proposal Spreadsheet for the Contract Line-Item Number (CLIN) structure.

SECTION C – DESCRIPTIONS / SPECIFICATIONS / STATEMENT OF WORK

1.0 GENERAL

The Contractor shall provide the services specified herein for a 12-month base period and nine one-year option periods (if exercised) at the rates specified in each CLIN.

The Contractor shall underwrite and administer the Office of the Comptroller of the

Currency’s (OCC) Dental Insurance Program for OCC employees, retirees, and their eligible family members as well as employees of the Office of Financial Research (OFR) and their dependents.

1.1 PRICING SCHEDULE FOR DENTAL INSURANCE PROGRAM

The Contractor shall underwrite and administer insurance for two different dental plans, Preferred Provider Organization (PPO) and Dental Health Maintenance Organization (DHMO).

The OCC pays 100 percent of the premium for its active employees (OCC and OFR), disabled retirees (OCC only), and buyouts/survivors (OCC only). Retirees pay 100% of the premium based on the coverage tier they elect, which can be retiree only, retiree plus one, or retiree and their eligible family members.

The number of eligible employees enrolled in the DHMO and PPO plans is estimated and used for the purpose of establishing a funding amount for each performance period. The OCC employee population may fluctuate within each performance period resulting in an increase or decrease throughout the year (i.e., there may be a variation in quantity). The number of eligible employees enrolled in the DHMO and PPO plans is also subject to change. The OCC will remit premium payment based on actual enrollment for that month at the performance period’s fixed unit rate. Retirees will be invoiced monthly directly by the contractor.

As noted in the SOW section to follow, the OCC is considering two plan designs, Attachment (2) is the Current Plan Design and Attachment (3) is the Enhanced Plan Design, which consists of the current plan design with two changes – increases in the calendar year maximum and orthodontic lifetime maximum. The Government will identify the chosen plan design at the time the contract is awarded.

1.2 CLIN DESCRIPTION AND ARRANGEMENT

The contract type will be Fixed-Price with prospective price redetermination. The base and option year 1 CLIN rates are fixed; however, the total price for each CLIN could increase or decrease depending on changes in the number of eligible OCC and OFR employees, and OCC retirees. Insurance rates for option CLINs 2001 through 9001 will be negotiated prior to exercise but may not exceed the capped amount to be established. Additionally, there will be a transition period (date of award through June 30, 2025) to enroll employees into the dental plan, which will not be separately priced (i.e., at no additional cost to the Government) and will be included in the base year. See Attachment (1), Price Proposal Spreadsheet, for the CLIN structure.

At any time during the contract’s period of performance, the OCC may negotiate with the

Contractor for changes to the insurance plans that would provide more benefits to beneficiaries of the plans (lower co-pays, more services covered, lower deductibles, etc.), provided the cost to the OCC for such increases in benefits do not exceed 20% of the fixed and/or capped price rates for the associated year(s) of coverage.

1.3 INTRODUCTION

The OCC is a non-appropriated federal financial regulatory agency of the Department of the

Treasury. The OCC supervises national banks, federal savings associations, and federal branches and agencies of foreign banks that serve consumers, businesses, and communities across the United States and conducts approximately 70% of banking activity in the country.

These banks range from community banks serving local neighborhood needs to the nation’s largest most internationally active banks.

The OCC Headquarters is in Washington D.C., with four district offices in New York, Chicago, Dallas, and Denver. The OCC employs about 3,600 employees nationwide in offices throughout the contiguous United States with most employees located in Washington, D.C. This population count changes throughout the year. The OCC is unique from most other federal government agencies because it has independent authority to offer its employees compensation and benefit programs that are not offered by other agencies. The OCC-sponsored benefit programs include, but are not limited to, dental insurance, AD&D, flexible spending accounts, short and long-term disability and 401(k) programs.

The OCC, for purposes of its governmental plans, is specifically exempted from Title I of the

Employee Retirement Income Security Act.

1.4 SCOPE OF WORK

1.4.1 BACKGROUND

The OCC needs a contractor (i.e., a qualified insurance company – not insurance brokers/agencies) to provide for underwriting and administration of these benefits.

The Contractor shall provide a dental insurance program for the agency’s employees, retirees, and their eligible family members, as well as employees of the OFR and their dependents. OFR was established because of the Dodd-Frank Wall Street Reform and Consumer Protection Act

(“Dodd-Frank”), as a small office (maximum headcount of 250 employees) within the

Department of the Treasury, but was given the same independent authority as the OCC. Since the OFR determined that they would not be able to obtain reasonable dental rates due to their small size, they determined that they would be best served if they joined with another governmental agency and became a part of their existing contract. In 2011 (when they were established) they chose to be a participant on the OCC’s dental insurance contract.

1.4.2 GENERAL

It is the intent of the OCC to provide a dental benefits program that will help to promote and maintain healthy living for its program participants. In support of the OCC’s efforts to educate employees on healthy living and their benefit options, the successful Contractor shall perform the following:

▪ Attend an onsite or virtual health benefits fair that is generally held on multiple days from

November through December of every year. When providing on-site fairs, the Contractor must supply handouts and giveaways (ancillary dental items such as toothbrushes, floss, etc.) and be prepared to answer employee questions concerning the OCC Dental

Insurance program. Travel reimbursement is not authorized and will not be paid by the

Government.

▪ Support an OCC wellness fair at OCC’s headquarters location (Washington, DC) by arranging for the attendance of a professional in the health field (at no additional cost to the OCC) who must provide free demonstrations of their services or products. In the year that the OCC hosts a wellness fair, the OCC will notify the Contractor within 90 days of the event date. Travel reimbursement is not authorized and will not be paid by the

Government.

▪ Host a bi-annual online seminar to educate employees on the dental benefits, claims process, and full-time student verification process.

Dental Insurance Plan Options. Employees are offered a choice between a dental Nationwide

PPO option or a DHMO option. Regardless of the option selected or the number of persons covered, the OCC pays 100% of the premium. However, retirees pay 100% of the premium based on the coverage tier they elect, which can be retiree only, retiree plus one, or retiree and their eligible family members.

Dental Insurance Program Guide. The Contractor shall provide a detailed dental insurance program guide that outlines all program benefits to include, but is not limited to, plan design, program requirements, limitations, and exclusions. The program guide will be identified as the official statement of benefits.

The Contractor shall provide services in accordance with this SOW regardless of the actual number of services or fluctuation in services. Any information in this SOW regarding estimated or historical services is intended to aid the Contractor in understanding the requirements associated with the services.

1.4.3 ELIGIBILITY

All full-time and part-time employees who are hired on an appointment that is expected to last more than one year are offered the opportunity to enroll in the program. OCC and OFR employees can elect coverage for their eligible dependents as follows:

• A lawful spouse or domestic partner (same or opposite sex);

• Children (defined as a natural, step, foster, legally adopted, or child of the domestic partner) up to age 22 or up to age 25 if the child is a full-time student; and

• A child that has been deemed “disabled” under the certification guidelines of the Federal

Employees Health Benefits program. Eligibility must be established before the child obtains age 22.

1.4.4 ENROLLMENTS AND EFFECTIVE DATES

Below is a chart that identifies all the enrollment opportunities.

Life Event Description Time Limit Effective Date

New Hire

Initial enrollment opportunity to select the dental option of choice and to enroll dependents without the submission of proof of relationship documentation*

60 days from date of hire

First of the month following receipt of enrollment form

Change in

Employment

Status from

Non- Benefit

Eligible to

Benefit Eligible

Initial enrollment opportunity to select the dental option of choice and to enroll dependents without the submission of proof of relationship documentation*

60 days from date of change in employment status

First of the month following receipt of enrollment form

Gaining a New

Dependent

Marriage, establishment of domestic partner relationship, birth, adoption, placement of foster child, stepchild or child of a domestic partner and it requires the submission of documentation to verify the event

60 days from date of the event

First of the month following receipt of enrollment form

Open Season

Annual period identified by the

OCC which allows

Generally, a 4-week period between

January 1 of the year following for the addition of dependents to be added without proof of relationship documentation* -

OR – the opportunity to change options

November and

December the open season period

Moving at least

30 miles outside of the DHMO servicing area

Opportunity to change from the DHMO to

PPO

60 days from the date of change in address

First of the month following receipt of enrollment form

*Except for domestic partnerships and the enrollment of a disabled dependent or a dependent child aged 22 or older who is a full-time student.

Additionally, there are a few other events that may occur which will allow an employee to change their enrollment in the program. They are as follows:

Event Description Time Limit Effective Date

Retirement

Employee elects to receive an immediate annuity from one of the federal retirement systems and they can elect the PPO option

60 days from date of retirement

First of the month following receipt of enrollment election

Approval of

Disability

Retirement

Office of Personnel

Management (OPM) approves an employee’s claim to receive disability retirement benefits

Immediately upon receipt of

OPM approval notification

Day following the employee’s date of separation

Buyout

Employee terminates from the OCC under a “severance” type of agreement and continues coverage for six months

60 days from the date of separation

Day following the employee’s date of separation

1.4.5 TERMINATION OF ENROLLMENT

When an employee’s employment ends, their coverage terminates on the date of their separation.

A separated employee is not extended the option to continue coverage beyond their date of separation unless one of the following occurs:

1. Employee retires from the OCC on an immediate annuity;

2. Employee is approved for disability retirement by OPM;

3. Employee is offered a “buyout” by the OCC; or

4. Employee dies and any dependents enrolled on their plan will be extended 24 months of coverage, at which time the policy will terminate.

Coverage for a dependent will terminate when:

1. The employee’s coverage is terminated;

2. The dependent child attains age 22 or if certified as a full-time student on their 25th birthday;

3. A dependent child under age 25 gets married;

4. The dependent dies;

5. The employee divorces their spouse or terminates their relationship with their domestic partner;

6. A stepchild or a child of the domestic partner is no longer in a “parent-child relationship” with the employee; or

7. The employee chooses to drop the dependent from coverage during open season or outside of open season. In this scenario, the employee can re-enroll the dependent during any open season only.

1.4.6 SURVIVOR BENEFITS

Upon the death of an employee or disabled retiree, the surviving dependents that are enrolled on the employee’s plan will be extended 24-months of coverage, at which time the policy will terminate.

1.4.7 STUDENT VERIFICATION

The OCC requires that once a dependent child attains age 22, verification of enrollment in an accredited college or university is required. The responsibility for requesting, reviewing, and updating the dependent child’s continued eligibility is that of the Contractor. The Contractor shall send employees email notifications of the requirement to supply the student verification documentation of full-time student status 30, 60, and 90 days prior to the dependent child’s

22nd birthday. The notification is to address, at a minimum, the following:

1. Identify the minimum number of hours per semester that qualifies as a “full-time” student for both undergraduate and graduate enrollment.

2. Identify any specific information that must be contained in the documentation.

3. Identify where to submit the documentation and due date for submission.

The Contractor shall provide an online method for employees to safely and securely submit documentation, including Personally Identifiable Information (PII), to the

Contractor directly. Once documentation is received, the Contractor is to update the dependent child’s eligibility with some type of full-time student indicator. The

Contractor shall notify the employee of its decision for continuation of coverage. The

Contractor shall collaborate with the OCC on all notices to employees. The Contractor shall provide notices and reports as described below and, in the chart, labeled required program deliverables. The Contractor shall manage this process for new hires, open season, and annual recertification.

Student Verification Task Requirement Summary

Action Requirement

Contractor shall administer the fulltime student verification requirement of this contract.

Offeror’s student verification report that identities the following:

• Name and date of birth of dependent child

• Employee’s name

• Date of coverage termination

• Date of reinstatement of coverage due to receipt of student verification documentation

• Date email notifications sent to employee

(30, 60, 90-day notices)

• Send written notification to the employee at least 30, 60, and 90 days prior to the dependent child’s upcoming coverage termination.

• Administer the coverage eligibility of a dependent child attaining age 22 or extend coverage beyond age 22 up to age

25 if full-time student requirement is met.

1.4.8 FUNDING AND PAYMENT SCHEDULE

The program is fully insured, and the OCC pays 100% of the premium for both the PPO and

DHMO options for active employees, disabled retirees, survivors, buyout employees and OFR active employees (this also includes employee who are in a leave without pay status or on military leave) and dependents. The monthly premium is “composite rated.” However, the

OCC does not share in the cost of the premium for the non-disabled retirees and their premium rate consist of a 3-tier rate (Single, 2-Person, and Family) for which participants pay 100% of the premium. Attachment (4) includes further details on premium rate history.

The Contractor shall invoice the OCC monthly for payment for services for OCC and OFR active employees, OCC disabled retirees, survivors, and buyout employees. Non-disabled retirees shall be directly billed by the Contractor and the Contractor shall give them flexible payment options.

The OCC has a unique funding arrangement for its dental program which is a fully insured participating arrangement with a Premium Stabilization Reserve (PSR) account that is held by the Contractor. If claim costs are less than the premium paid for the year, then the extra money

(after administrative expenses and profit are deducted) is held in the PSR and used for future rate reductions or a premium holiday. The contractor shall comply with this funding arrangement. Attachment (5), PSR Funding Agreement, provides further details regarding the specifics of the agreement.

Funds will be obligated at time of award for the base period (or at the time each option period is exercised if the Government chooses to exercise an option). Funds will be added to the contract by modification for eligible employees who are hired after July 1 of that period of performance, if needed. The Contractor agrees this incremental funding may be added by OCC via unilateral modification. The Contractor shall notify the Contracting

Officer (CO) when 75% of the funds on any CLIN have been invoiced to the OCC. The

Contractor shall provide an estimate of additional funds required for the remainder of the period of performance. The Contractor shall invoice the OCC monthly for payment for services for OCC and OFR active employees, OCC disabled retirees, survivors, and buyout employees in accordance with the PPO and DHMO plans outlined in Attachments (2) and

(3). Non-disabled retirees shall be directly billed by the Contractor, and the Contractor shall give them flexible payment options.

1.4.9 PLAN DESIGN

The Contractor must provide dental insurance benefits with a plan design that covers a

Preferred Provider Organization (PPO) plan option and a Dental Health Maintenance

Organization (DHMO) plan option.

1.4.10 WEBSITE AND ENROLLMENT ADMINISTRATION TOOLS

Benefits Administration Tool. At a minimum, the Contractor shall provide a safe and secure electronic system to maintain enrollment data. The Contractor shall provide the OCC’s Human

Capital (HC) staff access to the system for the purpose of processing new hire enrollments, qualifying life events, and open season changes. The Contractor shall provide training (and training materials) to the OCC’s HC staff on the use of their system. The Contractor shall troubleshoot any issues with processing enrollments.

The Contractor shall provide information about their capability to provide a self-service electronic enrollment tool to facilitate new hire elections, qualifying life events, and open season changes.

The Contractor shall provide an electronic method for non-disabled retirees to elect the dental

PPO option, and provide payment options for the non-disabled retirees to pay directly to the

Contractor.

Website. The Contractor shall provide a customized and accessible website for the OCC dental insurance program. At a minimum, this website shall have the capability for enrollees to search for PPO in-network and out-of-network dentists, DHMO dentists, options to print ID cards, plan information, Frequently Asked Questions, program guide, and voluntary retiree information. The Contractor shall also provide an electronic method for employees to upload documents related to the verification of full-time student status to the Contractor directly.

Member Portal. The Contractor shall provide the capability for employees to register and access their member record. At a minimum, the portal shall include demographic information, options to view/print explanation of benefits (EOB), view/print ID cards, list dependents, and show a summary of dental plan option benefits. See section 1.11 below for specific security requirements.

Data File Exchanges. The Contractor shall have the capability to exchange data files with the

OCC via a Secure File Transfer Protocol site established by the Contractor. The Contractor shall have the capability to generate an alternate ID number to use in lieu of employees’ Social

Security Number (SSN). The Contractor shall not use full or partial SSNs as the employees’ alternate ID. The Contractor shall collaborate with the OCC IT Data Warehouse to establish data files necessary to administer the program. The Contracting Officer’s Representative

(COR) will provide contract information for the Data Warehouse points of contact to the

Contractor.

Future OCC Benefits Enrollment Platform. At any point during the period of performance, the OCC reserves the right to implement its own benefits enrollment platform to manage dental enrollment data for its dental insurance program. If the OCC implements its own benefits enrollment platform at any future date, the Contractor shall collaborate with the OCC to transition enrollment data and participate on the project team to ensure there is a smooth transition.

1.5 KEY PERSONNEL REQUIREMENTS

The Contractor shall provide a single point of contact that will serve as a liaison to the OCC to address day-to-day matters, per 1052.215-8003 Key Personnel, referred to as the “account manager”. This person must ensure that all issues are addressed and responded to in a timely manner, including tracking issues electronically (i.e., incident log), until the issues are resolved.

If an issue cannot be resolved by the next business day, then the person must provide the OCC with a reasonable date that the issue will be resolved. This individual shall have a minimum of three years of account management experience in the insurance industry.

Offeror’s day-to-day point of contact shall be responsive to the OCC in a timely manner.

Offeror’s day-to-day point of contact's electronic incident log which is to be sent to the OCC on a quarterly basis.

Respond to any issues brought to their attention by the next business day (if not with a resolution, should at least provide an acknowledgement of the issue and next steps);

• Ensure that eligibility and retiree billing issues are resolved in a satisfactory manner; and

• Ensure that the OCC is notified of any system outages at the earliest possible time but no later than on the day that the outage occurs.

1.6 CLAIMS EXPERIENCE

The Contractor shall process all claims accurately and in accordance with the time limit listed below. The Contractor shall provide OCC employees with written notification of its claims appeal process. The Contractor shall also ensure that employees have access to a safe and secure online system where they can view the status of a claim and print copies of the EOB statements for previously filed and adjudicated claims. The Contractor must have an option to opt out of paper mailings for claims and EOBs. The Contractor shall provide a method for the employee to obtain a pre-treatment estimate.

Contractor is to adjudicate claims timely and accurately with no more than a 1% error rate:

• Ensure that claim determinations are made within 14 calendar days of receipt, but no more than 30 calendar days; and

• EOB statements are mailed to the claimant's address on file within 5 business days of claims adjudication.

Offeror’s Claims Turnaround Report (CTR) that identifies the following:

• Date of receipt of claim,

• Date the claim was adjudicated, and

• Date the EOB was mailed.

The CTR is to be sent to the OCC monthly.

1.7 PERIOD OF PERFORMANCE

The OCC is awarding a contract with a 12-month base period and nine one-year options.

There shall be a three-month transition period (date of award April 1, 2025, through June

30, 2025) included in the base period. There will be a line-item, that is not separately priced, for the transition period from the date of award to June 30, 2025, to facilitate the enrollment of OCC and OFR employees. Insurance coverage services shall commence on

July 1, 2025. See clause OCC 1052.242-8002 for period of performance dates and details.

1.8 PLACE OF PERFORMANCE

The Contractor shall perform all its duties relating to this contract at the Offeror’s work location.

1.9 DELIVERABLES

The Contractor shall produce the following items:

Program Deliverables Description Due Date

Dental Program Guide Official statement of benefits outlining all program details

Annually by the first month of the active period of performance

Claims Expense Summary

Lists the total claim dollars paid and broken out by primary member and dependents.

Quarterly within the first 30 days of the quarter

Enrollment Summary Identifies active primary members and their dependents.

Monthly within 30 days of the initial report

Member Termination

Report

Identifies members that were terminated within the reporting

Period.

Monthly within 30 days of the initial report

New Member Report Identifies all new enrollments or reinstated enrollments.

Monthly within 30 days of the initial report

Implementation Plan

Lays out al I of the tasks involved in the execution of the implementation of this contract.

During the transition period and before services start

7/1/2025

Implementation

Communication Materials

Flyers and email communication documents that describe the process for handling any services that started prior to 7/1/2025

During the transition period and before services start

7/1/2025

Student Verification Notice

Written notice to primary member that their dependent child's eligibility will end on the child's

22nd birthday if verification of full-time student enrollment is not received within 30, 60, and 90 days of the date of the notification.

Notices should also be sent to new hires and each year after the initial notice of approval.

30, 60, and 90 days prior to the child's 22nd birthday;

within 30 days of a new hire enrollment; annually after initial notice

Student Verification Report

List the applicable information for a dependent child who is age 22 or older and is required to submit full-time student verification documentation. Report should include all data points related to this process.

Monthly within 30 days of the initial report

Dependent Age 22 Report List of dependent children who will turn age 22 each year Annually – January 1

Direct Billing Invoices Notices to non-disabled retirees of the required premium to be paid.

Monthly within 30 days of the initial report

Annual Premium Notices

Letter to non-disabled retirees notifying them of premium rates in effect for the year.

Annually- November 1st

Claims Turnaround Report

Identifies the PPO and DHMO claims received and turnaround information on the claims adjudication process.

Monthly within 30 days of the initial report

Day-to-Day Contact's

Incident Log

Identifies each time contact is made by the OCC of a request of notification of an issue that needs to be resolved.

Quarterly within the first 30 days of the quarter

1.9.1 ACCEPTANCE/REJECTION PROCEDURES

The COR will review all deliverables to ensure accuracy, functionality, completeness, professional quality, and overall compliance with the guidelines/requirements. The

Contractor shall ensure the accuracy and completeness of all deliverables. Unless otherwise indicated, the Government will require ten (10) business days to review and/or comment on or accept deliverables. Errors, misleading or unclear statements, incomplete or irrelevant information, and/or excessive rhetoric, repetition, and/or "padding", shall be considered deficiencies and shall be subject to correction by the Contractor, at no additional cost to the

Government. If the deliverable does not meet the noted criteria, the Government will return it for correction at no cost to the OCC.

If the COR rejects any deliverable, that rejected document will be handled in the following manner:

1.9.1.1 After notification that the deliverable did not meet the acceptance criteria, the

Contractor shall re-submit an updated/corrected version within five 5 business days after receipt of Government comments. The Government will provide specific details as to why the deliverable is not acceptable.

1.9.1.2 Upon re-submission by the Contractor, the Government will reapply the same acceptance criteria. If the deliverable does not meet the acceptance criteria a second time, in addition to the Contractor being required to again fix the deficiencies, the incident may adversely impact the Contractor’s Contractor Performance Assessment Reporting System

(CPARS) rating.

1.10 SECTION 508

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998

(P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to, and use of, information and data that is comparable to people without disabilities. As such, the following requirements apply to this solicitation:

1. Products, platforms, and services delivered as part of this work statement that are ICT, or contain ICT, must conform to the Revised 508 Standards, which are located at 36 C.F.R.

§ 1194.1 & Apps. A, C & D, and available at https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines.

2. E102 / 702.10 – Web Content Accessibility Guidelines (WCAG) 2.0 guidelines success criteria level A & AA are incorporated as a requirement. The referenced WCAG criteria is available at http://www.w3.org/TR/WCAG20/.

3. A completed Accessibility Conformance Report (ACR) found at https://www.itic.org/policy/accessibility/vpat, using Voluntary Product Accessibility

Template (VPAT) Revised Section 508 Edition, Version 2.5, is required to assist the

Government in determining that the ICT products or services support Section 508 accessibility standards.

4. E202 – General Exceptions Authorized by OCC as applicable.

The following items are identified as containing ICT:

• Software Applications & Operating Systems

• Web-based Intranet and Internet Information and Applications

• Information, Documentation, and Support

Applicable Functional Performance Criteria: All functional performance criteria apply when using an alternative design or technology that achieves substantially equivalent or greater accessibility and usability by individuals with disabilities than would be provided by conformance to one or more of the requirements in Chapters 4-6 of the Revised 508 Standards, or when Chapters 4-6 do not address one or more functions of ICT.

Applicable requirements for software and Web products:

• E207 – WCAG Level A & AA Success Criteria

• E302 – Functional Performance Criteria

• E502 – Interoperability with Assistive Technology

• E503 – Application

Applicable requirements for electronic documents and/or support services:

• E205 – WCAG Level A & AA Success Criteria

• E302 – Functional Performance Criteria

• E602 – Support Documentation

• E603 – Support Services

1.11 SECURITY AND PRIVACY REQUIREMENTS

A. Compliance with Applicable Laws, Regulations, and Standards

Secure User-to-Cloud Communications Standards. All user-to-cloud service communications

(e.g., via internet) must be encrypted with the latest industry standard browser protocol.

https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines http://www.w3.org/TR/WCAG20/ https://www.itic.org/policy/accessibility/vpat

B. General Requirements

Location. Information collected, viewed, used, stored, maintained, or otherwise processed by the contractor in the performance of this contract shall be accessed, transferred, stored or processed only within the United States. In addition, the maintenance and support operations of the

Offeror’s technology and information must take place, and originate from, within the United

States.

US Persons: Federal employees, contractors, subcontractors, experts, consultants, and paid/unpaid interns hired for work within the United States or its territories and possessions and who require access to sensitive Controlled but Unclassified Information (CUI), like Personal

Identifiable Information (PII), IT systems or security items or products, shall either be U.S.

citizens or have lawful permanent resident alien status (green card holders).

The contractor shall not host any portion of the information, information system, infrastructure, or environment in facilities outside the contiguous United States, Alaska, Hawaii, and other U.S.

Territories.

Authorization to Use, Store, or Share Sensitive Information. The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The contractor shall also protect all government data, equipment, etc. by treating the information as Controlled but Unclassified (CUI) information. All information gathered or created under this contract shall be considered as (CUI). It is anticipated that this information will be gathered, created, and stored within the primary work location. If contractor personnel must remove any information from the primary work area, they shall protect it to the same extent they would their proprietary data and/or company trade secrets.

Confidentiality. The contractor agrees to assume responsibility for protecting the confidentiality of government records and data associated with this contract, which are not public information.

Deliverables. The deliverables in this contract will be considered CUI and shall not be shared with any other organization without prior written approval from the Information System Security

Officer (ISSO).

C. Security and Privacy Authorization

Authorization Boundary. The contractor shall provide a security architecture diagram(s) specific for the OCC, that clearly demarcates the information system authorization boundary and depicts all of its connections, ports, protocols, functions, services, and components, including the means for monitoring and controlling communications at the external boundary and at key internal boundaries within the system. The contractor shall address all components, connections, ports, protocols, security controls, and managed interfaces of the information system authorized for operation (e.g., routers, firewalls). The diagram must include a predominant border drawn around all system components and services included in the authorization boundary. If there are

OCC-specific components (e.g., components developed or customized for the OCC, OCC-hosted components, etc.) and/or other components supporting this solution that are not in the scope of the Offeror’s existing security documentation, then identify those components in the diagram as well, as part of a separate OCC-specific boundary since those are unique to OCC and shall be part of the OCC-specific security authorization. The diagram must be easy to read and understand. Formal names of components as they are known at the service provider organization in functional specifications, configuration guides, other documents and live configurations shall be named on the diagram and described. The contractor shall provide a key for symbols used.

This diagram shall be delivered to the Everbridge COR, Enterprise Architect, and Information

System Security Officer.

External Service Provider Compliance & Monitoring Background. The FISMA and OMB policies require that federal agencies using external service providers to process, store, or transmit federal information or operate information systems on behalf of the federal government, assure that such systems meet the information security protections commensurate with the information and system sensitivity. Federal agencies are responsible and accountable for the information security risk incurred by the use of information system services provided by external providers.

Such risk is addressed by incorporating the Risk Management Framework (RMF)1 and security requirements for external information systems and services as part of the terms and conditions of the contracts with external providers. Federal agencies can also require external providers to provide appropriate evidence to demonstrate that they have complied with protecting federal information. Prior to the implementation of the Offeror’s system or services, the OCC ensures compliance with the RMF by issuing an Authorization to Operate (ATO) or Authorization to Use

(ATU), based on its review and analysis of the external provider's security documentation

(described in detail in the next section) and assessment of customer (OCC's) security responsibilities.

1. NIST Special Publication 800-37, as amended, Risk Management Framework for Information

Systems and Organizations: A System Life Cycle Approach for Security and Privacy.

Non-Federal External Service Provider Security Documentation. Non-federal organizations with primarily non-federal customers have limitations with respect to complying with all federal requirements. As a result, the OCC obtains assurance through other industry standard security reviews, including Statement on Standards for Attestation Engagements (SSAE) No. 19.

a. Statement on Standards for Attestation Engagements (SSAE) No. 19 Requirements. The contractor shall provide the OCC with an SSAE No. 19 System and Organization

Controls (SOC) 2 Type 2 Report on an annual basis for services provided.

b. The preferred coverage period for the report is July 1 through June 30 with a bridge letter covering the three months to September 30.

c. For any gaps in the fiscal year coverage period (October 1 - September 30), the OCC will work with the contractor to complete the internal controls assessment by relying on the work performed by the Offeror’s competent and objective internal audit function per

Statement on Auditing Standards No. 128, Using the Work of Internal Auditors.

d. The submission of the results of the SSAE No. 19 SOC 2 Type 2 Report shall be as instructed per the "Security and Privacy Vendor Deliverables" section.

e. If SOC 2 Type 2 reports are not available within the last three years, the contractor shall inform the OCC to determine if there is a suitable alternative with similar level of information and detail.

f. If any portion of standard security objectives (e.g., contingency planning controls, etc.)

were not in the scope of the independent auditors testing, then the contractor shall provide a bridge letter to identify the type of test, date of test, and third party who performed the testing of those security objectives not covered by the SOC 2 Type 2 report. The contractor shall also summarize any deficiencies identified by the auditor in the bridge letter.

2. OCC Security Authorization to Use. The determination of whether to issue an OCC security authorization will be made by the OCC based on the identified risks to the OCC's data and operations. These risks include: (1) deficiencies noted in the Offeror’s most recent SOC 2 Type

2 Report, (2) the gaps identified in the IT security and privacy control assessments performed specific to OCC customer responsibility implementations as designated in the CRM.

D. Configuration Management

Security Configuration Settings. The contractor shall establish and enforce security configuration settings for information technology products employed in the ISSO.

Security Updates and Patches. The contractor shall ensure that the Dental IT system is properly maintained and monitored, to include immediate response to critical security patches, routine maintenance windows to allow for system updates, and compliance with the defined configuration management and change control processes. All patches and system updates shall be properly tested in a development environment before being implemented in the production environment.

Least Functionality. The contractor shall restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services for information technology products employed in the Dental IT system.

E. Continuous Monitoring

Compliance Reviews and Audits. The contractor shall permit and support compliance reviews and audits under applicable laws to allow the OCC to meet legal and compliance obligations and shall implement processes that allow visibility into the privacy and security controls employed and their effectiveness. The contractor shall provide the OCC or authorized designated officials with information requested by auditors in a timely manner, consistent with the respective auditor's deadline, in support of security compliance reviews and various annual audits, e.g., FISMA, Financial Statement Audit, A-123, etc.

In addition, the contractor shall provide the OCC or authorized designated officials logical and physical access to the Offeror’s facilities, installations, technical capabilities, operations, records, and databases pertinent to this contract within seven (7) calendar days upon request for these purposes.

Annual SOC 2 Type 2 Reviews. As mentioned in this SOW. "Security and Privacy

Authorization," under SSAE No. 19 requirements, the contractor shall provide the annual SSAE

No. 19 SOC 2 Type 2 report to the OCC for review in support of continuous monitoring activities. If any portion of standard security objectives (e.g., contingency planning controls, etc.) were not in the scope of the independent auditor's testing, then the contractor shall provide a bridge letter to identify the type of test, date of test, and third party who performed the testing of those security objectives not covered by the SOC 2 Type 2 report. The contractor shall also summarize any deficiencies identified by the auditor in the bridge letter.

Logging. The service provider must provide OCC audit access to any FIPS 199 Moderate, or higher data encrypted at rest and in motion in the commercial cloud at an Event Logging (EL) maturity level of EL3. An example of EL2 requirements, which is required to be satisfied for

EL3, can be found in the Copy of CISA Enterprise Logging Data Convention Link. Detailed

EL3 requirements are listed in OMB Memorandum M21-31.

The service provider shall forward all required logging data, in near real-time and on an automated basis, to centralized systems responsible for security, information, and event monitoring Security Event and Incident Management (SEIM) e.g., SPLUNK; bulk storage; and other analytical workflows or services. Data must be encrypted in transit between its source and destination.

F. Data Protection

Data Encryption. Where encryption is required, as specified by the OCC, the contractor shall ensure that encryption is established and maintained for data at rest and in transit for the duration of the contract. The encryption employed shall be equivalent to those approved in Federal

Information Processing Standards (FIPS) Publication 140-2 or 140-3.

Need to Know. CUI/Sensitive information, data, and/or equipment will only be disclosed to authorized personnel on a Need-To-Know basis. The contractor shall ensure that appropriate administrative, technical, electronic, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected.

Such measures include controls listed in NIST SP 800-171, Protecting Controlled Unclassified

Information in Nonfederal Systems and Organizations, as amended, in the following areas:

Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel

Security, Physical Protection, Risk Assessment, Security Assessment, System and

Communications Protection, and System and Information Integrity.

Data Separation. Unless otherwise directed by the OCC and/or controls are implemented to ensure adequate separation, any storage of data shall be contained within the resources allocated by the contractor to support the OCC and may not be on systems that are shared with other commercial or government clients.

General Use of Controlled Unclassified Information (CUI). The contractor shall not use any

CUI or CUI subcategories, including, Personally Identifiable Information (PII) or low-sensitivity

PII (e.g., E-mail Groups and Lists), for any purpose other than those activities necessary to the performance of this contract.

Use of Contractor Equipment. Use of contractor-owned laptops or other equipment (e.g., media storage devices, servers, etc.) to process, transmit, or store OCC information or to access the OCC network or other OCC information resources without OCC's formal approval is prohibited. This restriction does not apply to the use of non-OCC laptops or PCs to use OCC-approved virtual desktop infrastructure to remotely access the OCC network.

G. Incident Response

Notification. The contractor must report all information security incidents that potentially or actually cause the compromise of OCC information, even if the contractor believes the security incident may be limited, small, or insignificant with respect to OCC data or systems. The OCC will determine when the Offeror’s reported security incident requires additional focus and attention.

Within one hour from the time the contractor validates that an information security incident has occurred, the contractor must report the security incident information to the OCC Cyber Defense

Center (CDC): Computer.Security@occ.treas.gov, (202) 649-7930, regardless of day or time.

The contractor must provide any supplementary information or reports related to a previously reported incident directly to the OCC CDC with the following text in the subject line of the email: “Supplementary Information/Report related to previously reported incident #…