DRAFT_COPY-_Fingerprint-Based_Background_Checks_for_Medicare_Provider-Supplier_Fraud_Prevention_Statement_of_Work.pdf

Fingerprint-Based Background Checks for Medicare Provider/Supplier Fraud Prevention SOW

Contract # HHSM-500-2014-RFP-0058

STATEMENT OF WORK

FOR

Fingerprint-Based Background Checks for Medicare Provider/Supplier Fraud Prevention

1 Scope

The purpose of this contract is to satisfy the enrollment requirement in Centers for Medicare &

Medicaid Services (CMS) regulation (72 FR 5862), published February 2, 2011

(http://federalregister.gov/a/2011-1686) and implemented at 42 CFR §424.518(c)(2)(B), for fingerprint-based background checks. Annually, the background check requirement is expected to affect up to 7,500 authorized representatives of Medicare providers and suppliers classified by CMS as high risk. Enrolled or enrolling providers/suppliers are responsible for fingerprint records as a condition of the application process. Fingerprint and background check records, review of Federal

Bureau of Investigation (FBI) provided criminal history record information (CHRI), and CMS disposition of the CHRI results are new requirements for the CMS Medicare provider enrollment process.

CMS is seeking a single contractor, who is a FBI- approved Channeler, to manage channeling of fingerprint records, to receive CHRI furnished by the FBI, and to store and review the CHRI for

CMS.

The contractor’s role in CMS’ implementation of the fingerprint-based background check will include performing Channeler functions as described in the requirements for Tasks 1 and 2, and

Non-Channeler functions that are described in the requirements for Tasks 3, 4 and 5.

2 Background

CMS is the largest purchaser of health insurance in the United States. CMS works to ensure high quality health care at a reasonable price and to provide information about benefits, health promotion, and choices. The loss of taxpayer dollars through waste, fraud, and abuse drives up health care costs.

CMS is pursuing an aggressive National Fraud Prevention Program (NFPP) to prevent fraudulent transactions from occurring and moving away from the “pay and chase” model. CMS’ Center for

Program Integrity (CPI), created in April 2010, is accountable for strengthening existing program integrity activities for the prevention and detection of fraud, waste, and abuse in the Medicare and

Medicaid programs and Children’s Health Insurance Program.

The Patient Protection and Affordable Care Act (Pub. L.111-149), as amended by the Health Care and Education Reconciliation Act of 2010 (Pub. L. 111-152), (collectively known as the Affordable

Care Act or ACA), makes a number of changes to the Medicare program that enhance the provider and supplier enrollment process to improve the integrity of the program to reduce fraud, waste and abuse.

2.1 Medicare Provider Fraud Prevention

CMS implemented certain provisions of ACA to establish additional screening requirements for providers and suppliers. The CMS Rule (72 FR 5862) requires certain owners of providers and suppliers, which are designated to the high level of screening, undergo fingerprint-based criminal http://federalregister.gov/a/2011-1686 background check. Based on the current definitions, fingerprint-based screening will impact the initial enrollments of providers/suppliers of Durable Medical Equipment, Prosthetics/Orthotics &

Supplies (DMEPOS) and Home Health Agencies (HHA), providers/suppliers coming back into the

Medicare fee-for-service program from a moratoria status, and existing providers/suppliers who

CMS has classified as high risk.

NOTE: For this Statement of Work, the term provider includes providers and suppliers enrolled or wishing to enroll into the Medicare program.

The fingerprint-based background check process is a screening mechanism to prevent questionable providers and suppliers from enrolling in Part A and Part B of the Medicare program. Other screening mechanisms used by CMS include (a) automated database checks of provider enrollment data and (b) physical site visits to verify the locations of providers/suppliers enrolling or enrolled in the Medicare fee-for-service program. Each category must undergo different types of screening in accordance with the risk-level assigned by CMS, as shown in the table below.

Table 1 Types of Provider Screening

Type of Screening Required Limited Moderate High

Verification of any provider-specific requirements established by Medicare (1)

X X X

Conduct license verifications, (may include licensure checks across States) (1 and 2)

X X X

Database Checks (to verify Social Security Number (SSN); the

National Provider Identifier (NPI); the National Practitioner

Data Bank (NPDB) licensure; an OIG exclusion; taxpayer identification number; death of individual practitioner, owner, authorized official, delegated official, or supervising physician

X X X

Unscheduled or Unannounced Site Visits (3) X X

Fingerprint-Based Criminal History Record

Check of law enforcement repositories (4)

X

(1) Performed for CMS by the Medicare Administrative Contractors as part of the enrollment process

(2) Performed for CMS by the Automated Provider Screening Contractor

(3) Performed for CMS by the National Site Visit Verification Contractor

(4) To be performed for CMS by contractor selected to perform the Channeler and Non-Channeler requirements described herein

The fingerprint-based checks described in this statement of work will build upon existing screening programs to create a more efficient, and effective national program as required by the provisions of the Affordable Care Act (ACA). Implementation of the fingerprint channeling requires cooperation and coordination of roles between CMS and providers that enroll through Medicare Administrative

Contractors (MAC) or the National Supplier Clearinghouse (NSC) which are described below.

CMS PEOG – The CMS Provider Enrollment Operations Group (PEOG) is designated as the

Authorized Recipient of criminal information channeled from the FBI and stored by the contractor performing the Non-Channeler functions described herein. The Authorized Recipient is responsible for the oversight of the Contractor’s performance and shall monitor the Contractor’s compliance to the terms and conditions of the Outsourcing Standards. PEOG will define the authorized users access to contract data, will be responsible for adjudication of the CHRI findings, and will address any appeals by providers/suppliers of CMS’ decisions to deny or revoke enrollment based on CHRI findings.

Medicare Administrative Contractors (MAC) and the National Supplier Clearinghouse (NSC)-

Medicare Administrative Contractors and the Durable Medical Equipment, Prosthetics, Orthotics, and Supplies National Supplier Clearinghouse (DMEPOS-NSC) are responsible for receipt and processing of Medicare fee-for-service (FFS) provider enrollments. MAC and NSC enrollment specialists complete the enrollment record (determine whether to accept, reject, further evaluate, or pass on for investigation) and update the PECOS when each enrollment record is complete. The suitability for enrollment of a provider will not be complete until CMS PEOG has reviewed the

CHRI recommendation and made an enrollment decision based on fingerprint checks of the provider’s owners. The MACs/NSC will not obtain access to CHRI obtained through this contract.

PECOS - The CMS Enrollment System is referred to as Provider Enrollment, Chain, and Ownership

System (PECOS), which is the official CMS system of record for Medicare FFS provider enrollment data. The PECOS application has an administrative interface used by CMS and the MACs enrollment specialist personnel, and an Internet-based provider interface used by applicants. The

PECOS Provider Interface is available 24 hours a day, six days a week with scheduled downtime on

Sundays.

Providers/Suppliers - Providers and suppliers enroll with Medicare through the MAC/NSC contractors using the Internet based PECOS or Medicare enrollment application Forms CMS-855A, 855I, 855B, and 855S. Medicare enrollment application forms can be found at http://www.cms.hhs.gov/CMSForms/CMSForms/list.asp. Instructions are found on the Medicare

Provider and Supplier Enrollment webpage (www.cms.gov/MedicareProviderSupEnroll). The

MAC/NSC communicates with the enrolling entity regarding the Medicare enrollment application process. CMS requires specified types of providers/suppliers to submit fingerprints as a condition of enrollment. Providers/suppliers categorized as high risk are required to submit a set of fingerprints for a national criminal background check for all individuals who maintain an ownership or management interest in the entity as specified by CMS’ policy. The provider enrollment record will not be deemed complete and ready for processing until the entity’s representatives individually submit their fingerprint records to the Contractor.

2.2 Channelers.

The Department of Justice Federal Bureau of Investigation (FBI) is the single source of the national criminal history record information (CHRI). According to the FBI Criminal Justice Information

Systems (CJIS) webpages:

http://www.cms.hhs.gov/CMSForms/CMSForms/list.asp http://www.cms.gov/MedicareProviderSupEnroll

The FBI’s authority to conduct a criminal history record check for non-criminal justice purposes is based upon Public Law (Pub. L.) 92-544. Pursuant to that law, the

FBI is empowered to exchange criminal history record information with officials of state and local governments for employment, licensing, (which includes volunteers), and other similar non-criminal justice purposes, if authorized by a state statute which has been approved by the Attorney General of the United States. The U.S.

Department of Justice has advised that the state statute establishing guidelines for a category of employment or the issuance of a license, must in itself, require fingerprinting and authorize the governmental licensing or employing agency to exchange fingerprint data directly with the FBI.

FBI-approved commercial contractors provide processing services for authorized national noncriminal justice fingerprint submissions. The contractors authorized by the FBI are referred to as

“Channelers.” The scope of FBI third party Channeler services, defined in Solicitation

CJIS_Channelers issued August 3, 2011 , states:

The Contractors will obtain contracts with Authorized Recipients and/or agreements with authorized individuals, receive national noncriminal justice applicant fingerprint submissions and collect associated fees, ensure fingerprint submissions are properly and adequately completed, electronically forward fingerprint submissions to the FBI’s

CJIS Division for national noncriminal dissemination to Authorized Recipients and/or authorized individuals, and perform other administrative tasks pursuant to the

National Crime Prevention and Privacy Compact Council’s Outsourcing Rule and

Standard. The number of Contractors that will eventually be approved is unknown at this time; however, the FBI will strive to strike a balance between the number of

Contractors it has the capability to administer (i.e. the number of connections the FBI may reasonably establish during this initiative and audit) and the number of

Contractors needed to effectively and efficiently serve the needs of the FBI, Authorized Recipients, and authorized individuals.

Third party Channeler services can only be performed by awardees selected by the FBI. In accordance with outsourcing standards that permit a third party to perform noncriminal justice administrative functions relating to the processing of CHRI, authorized private contractors are subject to the management controls and safeguards set forth in the Channelers’ contract agreements with the FBI. For purposes of this contract, CMS requires the contractor to deliver Channeler services that encompass the fingerprints, information exchange with the FBI, and delivery of CHRI results. These service requirements are described under Tasks 2, 3 and 4 of this work statement.

(See Attachment 1 and 2 for further information).

See FBI CJIS website, http://www.fbi.gov/about-us/cjis/background-checks/backgroundchk (as posted 4/6/2012).

At the time this writing, the FBI solicitation package was archived and available on the federal business opportunities website under the following link: https://www.fbo.gov/spg/DOJ/FBI/PPMS4/CJIS_Channelers/listing.html. Further information about the FBI-approved channelers program is posted on the FBI Criminal Justice Information Systems (CJIS) webpages, under the following link:

http://www.fbi.gov/about-us/cjis/background-checks.

http://www.fbi.gov/about-us/cjis/background-checks/backgroundchk https://www.fbo.gov/spg/DOJ/FBI/PPMS4/CJIS_Channelers/listing.html http://www.fbi.gov/about-us/cjis/background-checks

2.3 Non-Channelers

Implementation of the CMS Rule (72 FR 5862) requires the agency to interpret the results of collected CHRI and make a decision if potential Medicare providers and suppliers meet the requirements of the final adverse legal actions limitations on enrollment. The review and interpretation of CHRI during the CMS Medicare enrollment process, for the purposes of this contract, will be referred to as an activity of the Non-Channeler function. For purposes of this contract, CMS requires a contractor to perform Non-Channeler activities to ascertain whether the

CHRI information obtained through the FBI-Channelers contain conviction information that would result in an enrollment violation or otherwise fail to meet requirements or guidelines established by

CMS for enrollment of a Medicare provider or supplier. These service requirements are described under Tasks 4 and 5 of this work statement. (See Attachment 3 for more information).

3.0 General Contract Requirements

Independently, and as an agent of the Government, the contractor shall furnish the necessary services, personnel, materials, equipment, and facilities, not otherwise provided by the Government, as needed to perform this contract.

The contractor shall have an executed FBI-Channeler agreement, at the time of proposal submission, covering the period of performance for this award. This agreement shall be kept current for the duration of the contract period and proof of the current agreement will be required prior to the exercise of any options.

The contractor is expected to deploy and integrate its existing systems and be ready to implement the fingerprint channeling required by CMS. The contractor shall provide existing operational systems that can be modified or enhanced to meet CMS requirements and deliver, at a minimum, the capabilities and functionalities of CMS needs. Once configured, tested, and approved by CMS, the contractor’s solution shall support the CMS user environment for the life of this contract with full-time production and operational availability five days per week (Monday through Friday) during regular business hours (from 9:00 AM – 7:00 PM EST). All scheduled maintenance shall be performed outside of normal business hours.

The contractor shall provide a physical data center site that meets all FBI site security considerations, CMS Acceptable Risk Standards (ARS) and CMS Technical Reference Architecture

(TRA) requirements for FISMA-moderate level applications. FISMA requires federal agencies to implement a mandatory set of processes and system controls designed to ensure the confidentiality, integrity, and availability of system-related information. The processes and systems controls in each federal agency must follow established Federal Information Processing Standards, National Institute of Standards and Technology standards, and other legislative requirements pertaining to federal information systems, such as the Privacy Act of 1974. The data center must be FISMA certified.

The contractor shall allow at least 30 days for CMS to conduct testing and system acceptance, culminating in CMS granting Authority to Operate. Once the contractor team has obtained Authority to Operate (ATO) from CMS, then the fingerprint channeling may commence.

The contractor shall channel and store for CMS the fingerprint outcomes and identity information of individual applicants that are subject to a fingerprint-based background check to satisfy CMS

Medicare program enrollment requirements. CMS will identify the providers required to submit fingerprints. The contractor will be expected to provide customer support services to the provider community to assist them in completing their fingerprint requirement.

The contractor shall:

Obtain fingerprint-based criminal history record information (CHRI) from the FBI, Pass-through the CHRI to the Authorized Recipient (CMS), Receive the CHRI from the CMS for processing, Store and interpret the CHRI for CMS and, Deliver to CMS the contractor’s fitness recommendation indicating whether the CHRI contains enrollment violations or otherwise fails to meet requirements or guidelines established by CMS for enrollment of a Medicare provider or supplier.

All information collected, transferred, and stored under this contract contains Personally Identifiable

Information (PII) that is protected under the Privacy Act of 1974. All contractor personnel that handle the FBI CHRI and the PII for enrolling individuals shall adhere to CMS and FBI policies of protection procedures for handling, transmittal, and storage of CHRI.

The contractor shall provide data processing and storage capabilities that ensures the integrity and security of the fingerprint data, CHRI, and other case related data. These systems shall allow CMS to access this data as requested by CMS. The process is initiated by CMS sending providing notification of an individual who has received notification that fingerprints are required so that the case management record can be established.

As part of this requirement, the contractor shall provide a fingerprint channeling service to all owners or principals of providers and suppliers assigned by CMS to the high level of screening.

The performance objectives for the contractor are as follows:

a) Deliver proven commercial systems that can be adapted to service the requirements of CMS users and continued ability to maintain the system during the life of the contract.

b) Provide fingerprint channeling customer support available by website and by call center

(phone) support that is available to applicants at least 5 days a week, excluding federal holidays, during extended business hours (9:00 AM – 7:00 PM EST) ensuring telephone wait times that do not exceed 5 minutes.

c) Refer applicants to fingerprint locations with resources that maximize convenience for the applicant.

d) Receiving fingerprints through fingerprinting resources or an authorized law enforcement agencies.

e) Begin implementing fingerprint channeling services for applicants and begin performing fingerprint based checks for CMS after contract award.

f) Obtain and complete the review of FBI CHRI records within 5 days of the “CHRI needed” notice from CMS.

g) Provide to CMS accurate and complete fitness recommendations based on review of CHRI by contractor personnel and automated methods identifying whether the CHRI includes violations of CMS enrollment regulations, policies, and guidance.

h) Maintain an overall knowledge of CMS enrollment processes and procedures, adhere to

Privacy Act requirements, and provide professional customer service emphasizing courteous and timely support to CMS business partners and customers.

i) Provide CMS with system access that enables CMS authorized users independent verification, auditing, and secondary quality control review of the records and data obtained and stored by the contractor for CMS.

j) Safeguard records and data for the life of the contract and at end of the contract deliver the contractor-acquired data to CMS in a readable and usable format to CMS for its record retention purposes.

k) At all times perform the Channeler and Non-Channeler responsibilities as described in the below document and established in the contract, systems, facilities, and security programs in compliance with CMS Security and Privacy Standards and FBI standards.

l) Maintain skilled staffing appropriate to demand.

m) Support Annual Process and Operational Improvement evaluation, reporting, and implementation.

The contractor shall support coordination of workloads in a structure that ensures turnaround and response time for CMS. The contractor shall maintain communication with CMS and/or CMS-designated contractors (MACs and NSC) to ensure that the total CMS enrollment processing time goals are not impacted by the fingerprinting channeling, non- channeling or research process.

The contractor shall be proactive in notifying CMS within 24 hours of any developing situation that may impact service delivery or any other contractual issue. The contractor shall advise CMS, in advance whenever possible, of any indication that a potential problem may be developing. In the case of a known impending problem, contractor shall be forthcoming with CMS to address the risks and to identify mitigation strategies.

3.1 Overview

Step 1. Medicare provider receives letter from the MAC that informs the provider to be fingerprinted. The letter will instruct provider to contact the contractor and provide the following information:

contractor information, timeframe for completion of finger printing, assigned unique enrollment identifier, and

Personal Identifiable Information (PII).

CMS will provide a list to the contractor of all letters that have been mailed by the MAC. The

Contractor will create a case management record for the provider using the information in the list.

The Provider is solely responsible to contact the contractor and be fingerprinted within an established timeframe from dated letter received from the MAC.

Step 2: Providers will contact the contractor’s customer service. The contractor must update the case management record for the provider using the unique identifier to facilitate fingerprint completion. The case management record, at a minimum, should contain:

Unique Enrollment Identifiers defined by CMS

MAC Contractor ID

Legal Name as identified by CMS

Contact information

Date of contact

Due Date of fingerprint

Method of notification of fingerprint resources (date completed)

Brief description of actions

The contractor will track provider contact, phone calls and reported challenges using the contractor web based system. Based on provider communication, the contractor will disseminate fingerprint resources on request via letter, email or website. The contractor will continue to track communication with the provider and enter anticipated date for fingerprinting completion in case management system. In the event, the provider fingerprints are rejected by FBI for channeling, the contractor will contact the Contracting Officer (COR) for future development and timeliness recalibration. Note: The contractor shall identify and notify the provider when the provider’s complete legal name does not match the name of the owner that was listed in the CMS file or the

FBI database and for rejections.

Note: The contractor’s fingerprint channeling methods must include FD-258 card processing or digitization methods that result in user-friendly support to individuals subject to the Medicare provider fingerprint based check.

Step 3: Upon receipt of fingerprints, fingerprint information is entered into the contractor management system and prints are channeled to the FBI. The CHRI report must be received by CMS prior to contractor review; therefore, the contractor will forward the unopened CHRI Report the

CMS COR. Once this is completed, CMS will transmit the CHRI report back to the contractor for handling.

Step 4: The contractor is responsible for interpreting the CHRI within 5 business days. The contractor will filter the channeled results into categories of Pass, Incomplete or fail findings for

CMS’ review. The contractor will contact the provider for rejections and further development via letter or email. All records will be transmitted by the contractor to CMS on a weekly case management report and will include records which were rejected or had no findings. CMS will review the recommendations made by the contractor and relay the final decision back to the contractor. CMS will send the final disposition of the provider’s enrollment status to the MACs to complete the enrollment process. The contractor is responsible for maintaining a record of the fingerprint completion date, communications and a record of the channeling results for CMS’s review, as well as a record of final disposition which will be stored in non-channeling location.

Either during CMS’s internal review of the CHRI or the contractor’s recommendation, additional research information may be required by the contractor. The contractor will need to do a records search to get the required information and then transmit that information back to CMS to complete the final disposition of the provider case.

Step 5: This step is optional and only implemented when the Government authorizes additional research. All additional research will be approved by the CMS COR.

The contractor will need to do a records search to get the required information and then transmit that information back to CMS to complete the final disposition of the provider case.

3.1.2 OPTION SECTION for each task:

Beyond the base year, at CMS’ discretion, channeling requests may increase up to 10,000 each subsequent year as seen in the chart below:

YEAR

BASE CHRI

CASES

Optional CHRI exercised

Total CHRI with

Option

Base Year 7,500 7,500

Option Year 1 7,500 +10,000 17,500

Option Year 2 7,500 +10,000 17,500

Option Year 3 7,500 +10,000 17,500

Option Year 4 7,500 +10,000 17,500

The Optional CHRI collection is an optional task that can be incorporated into each option year and will be used at CMS’ discretion.

3.1.3 Executed FBI-Channeler Agreement - The contractor, and all members of the prime contractor’s teaming arrangement, shall have an executed FBI-Channeler agreement, at the time of proposal submission, covering the period of performance anticipated by CMS for this award. This agreement shall be kept current for the duration of the contract period and proof of current agreement will be required prior to the exercise of any options. The contractor shall have the capability to channel up to 7,500 individual fingerprints annually with the potential to increase in the option years.

3.1.4 CHRI Safeguarding and Handling Terms and Conditions - All contractors in the prime contractor’s teaming arrangement - including subcontractors, consultants, suppliers, associates or affiliates - shall abide by the CMS and FBI-provided terms and conditions for handling and safeguarding CHRI, as applicable to the roles assigned to each partner by the prime contractor. The applicable terms and conditions for handling and safeguarding CHRI shall be those described in the

FBI Channeler agreement awarded to the prime contractor and the Outsourcing Standards.

3.1.5 Compliance with CMS’ Security Policies - All contractors in the prime contractor’s teaming arrangement must comply with CMS security policy and acceptable risk standards.

3.1.6 Data Security and Archiving - The contractor must have the ability to channel CMS

Medicare applicant fingerprints and store them for the life of the contract and separately maintain the

CMS Medicare applicant CHRI records from the date of the record was obtained until the date of expiration of this award. CMS data shall be secured in a separate data archive data base only accessible to CMS.

3.1.7 Personnel Standards - All contractor personnel with access to CHRI shall meet the requirement of a fingerprint-based criminal history record check prior to accessing CHRI as required by the Outsourcing Standards.

3.1.8 Organizational Conflict of Interest (OCI) - In accordance with FAR 9.505, the contractor

(including all entities in the prime contractor’s teaming arrangement, its parent company, subsidiary, or other affiliated entity) shall demonstrate that there are no organizational conflicts of interest that could give rise to situations of impaired objectivity (FAR 9.505-3) affecting the contractor’s ability to render impartial advice to CMS. In addition, Contractors must disclose all actual, apparent and potential conflicts of interest and adhere to the requirements in section 10.7 of this statement of work.

4 Service Requirements

4.1 Task 1: System and Security verification

All equipment, configurations, testing, and services must be in compliance with FBI standards and policies after award.

o The Contractor shall provide a web-based system that can be accessed by up to 20 simultaneous users (CMS).

o The Contractor’s system must be able to upload a files received from CMS of all providers/suppliers required to submit fingerprints.

o The Contractor’s system must be able to upload a file listing all providers who had letters mailed, by the MAC, notifying of the need to be fingerprinted.

o The Contractor’s system must maintain any identifying information (including PII), maintain the CHRI report, and have the ability to create or update case management records based on upload of predefined formatted files, or direct access of the case via the web-based system.

o The Contractor’s case management record, at a minimum, should contain:

o Unique Enrollment Identifiers defined by CMS o MAC Contractor ID o Legal Name as identified by CMS o Contact information o Date of contact o Due Date of fingerprint o Method of notification of fingerprint resources (date completed) o Brief description of actions o The Contractor’s system shall have search capabilities that will allow searches by all categories listed:

o Unique Enrollment Identifiers defined by CMS o MAC Contractor ID o Legal Name as identified by CMS o Social Security Number o Date of birth o The contractor’s system must allow access and updates by CMS users, and record the CMS final recommendation within the case management system.

o Contractor must be able to maintain fingerprints electronically and have an auditable link to the fingerprint file.

o The Contractor’s system shall be designed to handle the base year requirements as well as the optional task requirements (if exercised).

o The contractor shall allow at least 30 days for CMS to conduct testing and system acceptance.

o The contractor shall pass an encrypted daily file via email which reports the contractor’s fitness recommendation in its review of the CHRI.

The deliverables and work products required in support of this work shall include:

a) System Security Plan (CMS ILC Template)

b) IT Risk Assessment (CMS ILC Template)

c) System Requirements and Design Document (CMS ILC Template)

d) Interface Control Document (CMS ILC Template)

e) Data Use Agreement (for access to CMS PECOS data)

f) Complete CMS sponsored Security Awareness Training for Contractor Personnel

g) Configuration Management Plan

h) Change Management Plan

i) Account Management Process Documentation

j) Incident Response Plan

k) Test Plans for Security Functionality, System Implementation Readiness and User

Acceptance Testing

l) Section 508 Compliance Testing of websites (if applicable)

m) CMS approved Authorized User Accounts

n) System User Guide

o) Contingency Plan

p) Contingency Plan Test with After Action Report

q) Inputs to CMS Privacy Impact Assessment

r) Updates to above deliverables in the event any updates to system or business requirement changes or any changes to the contractor’s operations that may impact these deliverable

The Contractor’s operating environment shall support the following requirements:

Create, change, and delete user accounts per request

Monitor security controls and report the results, and escalate problems when they occur

Perform daily backup operations, ensuring all required file systems and system data are successfully backed up to the appropriate media, recovery tapes or disks are created, and media is recycled and sent off site as necessary

Perform release management following CMS change control and approval processes for any system updates (Quarterly basis on average)

Perform daily system monitoring, verifying the integrity and availability of all hardware, server resources, systems and key processes, reviewing system and application logs, and verifying completion of scheduled jobs (such as backups, and successful completion of the daily enrollment file).

Perform daily system monitoring to verify results data is available for access each morning.

Repair and recover from hardware or software failures. Coordinate and communicate with impacted constituencies

Perform corrective maintenance to address latent defects as reported by users.

Handle all production problems that are caused by application software flaws

Work in a cooperative and ‘ready to help’ mode with CMS stakeholders

Emergency Maintenance Procedures (Unscheduled outages) o If the CMS user interface is not available for any reason outside the normal maintenance hours, the Contractor shall return the system(s) to fully operational within 48 hours

Disaster Recovery and Business Contingency Planning o Disaster recovery and business continuity plan shall be based on the level required by the CMS Information Security (IS) Acceptable Risk Safeguards (ARS) (See

(http://www.cms.hhs.gov/InformationSecurity) o The contractor shall propose a cost efficient continuity of operations plan in the event of a disaster o The contractor shall maintain recovery procedures in the event of catastrophic loss of facilities and/or related equipment required to deliver its services and provide a method by which service will be restored or maintained under a number of emergency situations. The contingency plan document detailing the standard operating procedures shall be completed, be communicated, and made readily available to Contractor employees o A return to normal operation should take no longer than seven calendar days

Hardware and Software Support

The contractor shall provide routine and remedial maintenance and support services (hardware and software) for the all solutions maintained by the contractor in support of the contract. The contractor shall ensure hardware and software are properly maintained to support interoperability between contractor-maintained data center operations and the CMS user environment and daily data exchange. Typical tasks may include, but are not limited to:

Preparing software maintenance program plans

Monitoring system operations and performance

Addressing and correcting system errors

Implementing software maintenance programs

Scheduling deployments and upgrades for minimal project disruptions

Installing software upgrades

Providing performance tuning

Providing on-site and off-site maintenance

Providing on-site after hour and weekend support

Providing maintenance to environmental systems including; power, HVAC, UPS, and fire suppression equipment

Reporting on up-time and planned/unplanned maintenance outages

Providing root cause analysis of hardware and software issues

Please see Attachments 1-3 for further FBI requirements.

4.2 Task 2: Channeling Function (publication to Medicare providers/suppliers applicants)

The contractor, and all members and sub-units of a teaming arrangement, shall have an executed

FBI-Channeler agreement, at the time of proposal submission, covering the period of performance anticipated by CMS for this award. This agreement shall be kept current for the duration of the contract period and proof of current agreement will be required prior to the exercise of any options.

The contractor shall have the capability to channel up to 7,500 individual fingerprints annually with the potential to increase in the option years.

http://www.cms.hhs.gov/InformationSecurity

CMS will provide the contractor a file that identifies the individuals who are required to undergo a fingerprint-based background check, as well as individuals that have been notified by letter of the need to be fingerprinted. This information may be delivered in a single file, or separate files. The contractor will transform and load the provider data from the files appropriately into its own system to create or update as appropriate case management entries related to each individual who is required to undergo a fingerprint-based background check.

The contractor must provide Customer Service Support that is available Monday through Friday during regular business hours (excluding federal holidays) from 9:00 am – 7:00 pm EST. The contractor shall ensure CMS customer wait times that do not exceed 5 minutes. The customer service support shall be able to receive complaints, information, contractor webpage challenges and resolution management for providers. All communication and actions should be recorded in contractor case management system. NOTE: The contractor is responsible for to notify the provider of rejection of the fingerprints by letter or email in this customer service function.

Channeling Fingerprint Data and Receipt of CHRI Reports: The contractor shall perform its channeling tasks according to the specific procedures accepted by FBI in the contractor’s Channeler award agreement. The approach and methods utilized by the Channeler to transmit fingerprints shall be those described by the contractor and approved by the FBI. The functions of the contractor, and the exact mechanism and interaction of the processes for receipt of CHRI, and submission of results is to be determined by FBI standard. In accordance with Section 3.08 of the Outsourcing Standard, CHRI Reports shall be maintained for a maximum of 30 days, or until the Authorized Recipient

(CMS) retrieves the CHRI, whichever is shorter. The CMS requirement is that all fingerprints shall be channeled electronically to the FBI.

The contractor will forward prints to FBI for channeling. The Channeler receives the fingerprint submission and relevant data and will electronically forward the fingerprint submission with the necessary information to the FBI. The contractor will receive the electronic record check result for dissemination to CMS prior to contractor review of the CHRI and within 24 hours of receipt from the FBI. The contractor’s channeling procedures must be consistent with a systematic approval of

FBI submission procedures. NOTE: The Channeler must receive CMS approval of CHRI prior to sending to Non-Channeler. The contractor shall establish administrative procedures, subject to CMS’ approval and publication, for channeling.

The CMS-specific operating standards and requirements for this contract are described below.

Publication of Administrative Procedures - The Contractor shall deliver for CMS approval, publications that are section 508 compliant and describe administrative procedures for fingerprint channeling within 10 days of contract award. The administrative procedures shall allow for Contractor fingerprint channeling, of individual identity information, and storage of the CHRI for CMS’ use on an ongoing and recurring basis as required for implementing the

Agency’s enrollment procedures for high risk providers/suppliers. The procedures shall allow fingerprints channeling from a fingerprinting resource or approved law enforcement agency.

The administrative procedures shall identify the nearest fingerprinting locations. After approving the Contractor’s written deliverables, CMS will publish and disseminate the general procedures and other administrative guidelines through the CMS enrollment website, the Medicare Learning Network, and the Medicare Program Integrity Manual.

The deliverables and work products required in support of this task shall include:

a) Procedures for Fingerprint Channeling and Non-Channeling to be published by CMS (draft submitted with the proposal, final due 10 days after award, and annual updates)

b) Identity Information collected from each applicant and stored for CMS review and retrieval.

c) A monthly file that lists all fingerprint requests including those that may have expired outside the 30 days. The active request report may be delivered as part of the Contractor’s monthly progress report.

OPTION:

Within Option years (1-4), at CMS discretion, fingerprint request can increase up to 10,000 requests as displayed in the chart below:

CASES

Optional CHRI exercised

Total CHRI with

Option

Base Year 7,500 7,500

Option Year 1 7,500 +10,000 17,500

Option Year 2 7,500 +10,000 17,500

4.3 Task 3: Non-Channeling Function (Receive and Store CHRI for CMS

The contractor shall operate and maintain systems to receive and store CHRI for CMS. The CMS-specific operating norms and requirements for this contract are described below:

o The contractor shall establish administrative procedures, subject to CMS’ approval and publication, for channeling and non-channeling and research of applicant fingerprints for Medicare provider enrollment.

4.3.1 Fingerprint and Identity Information Storage – The Contractor shall store fingerprints for every individual case in a case management system. This case management system will facilitate tracking and recall of information concerning each individual case. All fingerprint CHRI data shall be maintained in the non-channeling storage location for the life of the contract, and then transitioned to any subsequent contract.

4.3.2 Delivery of CHRI Reports - The FBI develops CHRI information and as a part of the channeling function the contractor shall deliver CHRI to CMS (the Authorized Recipient) within 24 hours in a format that meets CMS requirements for handling and transmission of PII and PHI as well as FBI standards for handling CHRI data. Any clear transmission of sensitive (PII, PHI) information over unsecure network would not be allowable. The contractor receives the CHRI from CMS to start the Non-Channeler function. CMS will work with the contractor to operationalize and configure delivery of the CHRI report. The contractor shall manage identity information data associated with each case so that it can be retrieved and stored in the contractor-furnished system/database that serves as the CMS CHRI archive.

4. 3.3 Records Management - The contractor’s system shall have an audit function to confirm that the CHRI and identity information was stored in the contractor’s system before the Channeler proceeds to expire the data. The Channeler shall provide alerts whenever any CHRI and identity information is approaching the 30 day expiration timeline. The formats for transfer of data between the Channeler and Non-Channeler shall be established by the Contractor.

The contractor shall send afile to CMS that identifies:

Unique Enrollment Identifiers as defined by CMS

MAC Contractor ID

Legal Name as identified by CMS

Date of birth

Social security number

CHRI (Yes/No, No CHRI record)

Delivered to Non-Channeler (Yes/No) for all individuals for whom CHRI was obtained as required by CMS, and their status of CHRI

Delivery to the Non-Channeler to validate that data has passed to the Non-Channeler before it is expired by the Channeler.

The daily file shall report the contractor’s automated screening results that identify cases where there is “no CHRI record”.

OPTION:

Within Option years (1-4), at CMS discretion, fingerprint request can increase up to 10,000 requests as displayed in the chart below:

CASES

Optional CHRI exercised

Total CHRI with

Option

Base Year 7,500 7,500

Option Year 1 7,500 +10,000 17,500

Option Year 2 7,500 +10,000 17,500

The deliverables and work products required in support of this task shall include:

a) Customer Support for Fingerprint submission will be available 30 days after contract award.

b) Delivery of CHRI reports to CMS within 24 hours of receipt from the FBI.

c) Updates shall be delivered weekly, with full replacement delivered monthly. The file shall report and incrementally track inbound and outbound status of fingerprints received/fingerprints required and CHRI required

4. 4 Task 4: Interpret CHRI /Fitness Recommendations

The contractor shall be required to review the CHRI contents against existing CMS regulations and guidance. The Contractor‘s review and interpretation of CHRI for each case worked, and the suitability/fitness recommendation reported to CMS shall comply with CMS policy, the Medicare

Program Integrity Manual (PIM), Provider Enrollment guidance outlined in Title 42 CFR 424.530 and 424.535 in line with felony convictions for revocation and denials in Medicare.

o The contractor shall review each CHRI according to pre-defined checklists and procedures, and make a fitness recommendation within 5 days of receipt of the CHRI. When a CHRI request resulted in “no record found” the Pass/Complete (no criminal offenses/no CHRI record) status should have already been sent to CMS in the inbound daily file and no manual review is required.

o The contractor shall store its fitness recommendation for review and approval by CMS. CMS will make a final recommendation and record its decision in the contractor’s case management system that is used to retrieve information and track communication with provider and contractor. The fitness recommendation will be made on a pass/fail basis with indicators such as: Pass/Incomplete (findings inconclusive), Fail (not suitable for enrollment). The precise definitions and field codes shall be developed and agreed upon during the implementation period of the contract. The case history stored by the contractor shall also include a rationale for every recommendation. To support its review, CMS shall have access to the entire CHRI, the individual’s identity information, the contractor’s recommendation, and the rationale for the recommendation.

o The contractor shall create a daily file which reports the contractor’s fitness recommendation.

The information passed to CMS shall communicate only whether the case was resolved with a final recommendation of “Passed Fingerprint Check” or “Failed Fingerprint Check.”

o The contractor’s fitness recommendations shall be subject to the contractor’s approved quality control plan required in Section 8.1.1. Completion of re-work to rectify quality control issues, whether identified by the contractor or by CMS, shall be performed at the expense of the contractor.

o The contractor shall flag for CMS’ review any cases where the identity information on the

CHRI does not match the identity information on the application.

The fitness recommendation made after reviewing the CHRI shall indicate :

Automatic Pass – No CHRI (pass based on automated review)

Pass for CMS Review – CHRI Record with offenses that lack final disposition (CMS will review and determine if case will be worked under Task 5, or if applicants submitted false or misleading information on the enrollment application)

Fail for CMS Review – CHRI Record with offenses and final dispositions that require CMS review (CMS will review and determine if record violates enrollment rules)

The deliverables and work products required in support of this work shall include:

a) Secure Interface for CMS authorized user access to records and CMS approval of Fitness

Recommendations written to contractor’s system

b) Daily file of fitness recommendations for CMS review and final approval

CMS will provide additional technical specifications and a definitive schedule for performance which shall include the work products and deliverables that shall be provided by the Contractor.

4. 5 Task 5 : Additional Background Research

CMS may require additional record search services that are outside the parameters of work defined under Task 4.2, 4.3 and 4.4. This additional work is to conduct record searches under limited circumstances to obtain missing disposition documentation in support of CMS’ disposition of an individual’s suitability for enrollment in the Medicare program. Individual research projects as described above will be communicated to the contractor via Technical Direction Letter, at which time the contractor will begin the necessary research and work.

Research shall involve the following procedures o Internet search o Professional data bases and Legal site search o Local courthouse record (travel must be approved by CMS/COR only)

5 Case Management The CHRI record for each individual required to undergo a fingerprint-based check shall constitute a single work request or case file, and should be able to store multiple CHRI reports.

The Contractor shall furnish and maintain a case management system capable of logging and tracking all individual work request cases.

o The contractor must have in place a method to receive individual cases, track, record, and report work status, and handle work completion for each case.

o The case management systems shall be integrated with the contractor’s customer service management. The contractor is responsible for end-to-end service management that includes managing communications about each case status with the applicants and managing communications about each case status with CMS.

o The contractor’s system shall store lists of individuals who have been fingerprinted for

Medicare enrollment including the individual’s identity information furnished at the time of fingerprint notification.

o The system shall store each provider’s complete legal name, as well as any other names used by the provider. The contractor shall identity when the provider’s complete legal name does not match the name of the owner that was listed in the CMS file.

o The system shall track on the stored lists the individual cases that CMS has indicated require fingerprints to satisfy the enrollment requirements.

o The system shall retain fingerprint CHRI data for the life of the contract o The system shall enable CMS to authorize the transfer of CHRI channeled from the FBI to be stored in the contractor’s data storage system within 30 days of its receipt from the FBI.

o The system shall track the status of the CHRI request for an individual record.

o The system shall record and store the contractor’s fitness recommendation (pass/fail) based on CHRI data.

o The system shall store a narrative explanation the contractor’s rationale for each fitness recommendation.

o The system shall capture all offenses in the entire CHRI record that are identified as felony crimes with a corresponding rationale for the contractor’s…