J.1_HITECH_PFDC_SOW.pdf

RFP-CMS-2015-XXXX – Section J-1 Payment File Development Contractor

Statement of Work (SOW)

HITECH Payment File Development Contractor

I. Scope

The Centers for Medicare & Medicaid Services (CMS) intends to award a five year contract (one year base period with four option years) to a Payment File Development Contractor (PFDC) to assist CMS in disbursing Electronic Health Record (EHR) incentive payments to eligible Medicare professionals (EPs) and hospitals (EHs) under the Health Information Technology for Economic and Clinical Health (HITECH) Act. The contract shall focus on the final performance years and close-out of the HITECH program; the tasks include: making payments to EPs and EHs, closing out accounts, processing meaningful use audit and cost report audit demand letters, collecting and reporting on receivables, debt referrals to the US Treasury, processing and handling Remedy tickets, managing/monitoring extended repayment plans, making manual payments and manual adjustments to payments, and working with all associated stakeholders in helping to finish the HITECH program. The PFDC also ensures proper oversight of funds control and accounting related to these payments, recoveries and communications, as well as participating in the annual Chief Financial Officers (CFO) Audit and Office of Management and Budget (OMB) Circular A123 Audit. The close out during the option years of this contract will include additional work for the PFDC associated with Ad Hoc actions/reporting, National Level Repository (NLR), and other system support and responsibilities associated with this contract to ensure a smooth program conclusion.

A. Background

Title IV of Division B of the American Recovery and Reinvestment Act of 2009 (ARRA) (Pub. L. 111-5) amends Titles XVIII and XIX of the Social Security Act (the Act) by establishing incentive payments for EPs and EHs to promote the adoption and meaningful use of Health Information Technology (HIT) and qualified Electronic Health Records (EHRs). The expanded use of HIT and EHRs is considered essential in order to significantly improve both the quality and value of American health care. Collectively, these provisions, together with Title XIII of Division A of ARRA, are termed the HITECH Act.

The incentive payments are part of a broader effort under the HITECH Act to accelerate the adoption of HIT and the utilization of qualified EHRs; importantly, the incentive programs outlined in Division B Title IV of the HITECH Act are considered to be the keys to inducing providers to actively utilize HIT.

EPs and EHs are eligible for the EHR incentive payments if, among other requirements, they “meaningfully use” certified EHR technology. Meaningful use is a term defined by CMS that describes and helps measure the use of HIT in order to further the goals of information exchange among health care professionals.

The provider registration and verification of eligibility for HITECH incentive payments is managed through the NLR; the NLR is hosted at a CMS Enterprise Data Center (EDC). The NLR is the designated system of records for the HITECH initiative that contains all provider registration/attestation documentation, banking information for each recipient, calculates the recipient payments amounts, verifies meaningful use, checks for duplicate payments, and maintains the incentive payment history files.

The Medicare Administrative Contractors (MACs) and various Medicare systems will interface with the NLR to provide information related to allowed charges, EH payment amounts, the recipient name, National Provider Identifier (NPI)/CMS Certification Number (CCN)/Taxpayer Identification Number (TIN), and banking/payment details for each recipient [account/routing numbers for Electronic Funds Transfer (EFT) deposits and an address for paper checks]. The NLR will compile a single file from these data with complete payment information on all eligible recipients for each monthly payment cycle in an agreed upon format that the PFDC will receive from the NLR. The PFDC will develop two separate files from this NLR file: 1) the National Automated Clearinghouse Association (NACHA) standard payment file that shall be sent to the Medicare bank for processing EFT payments; and 2) a positive pay paper check payment file that the PFDC shall use to disburse paper checks. CMS is reserving the right to require the PFDC to issue paper check payments to providers that do not receive their HITECH payments through EFT deposits.

A.1. Payment Process Overview

The process for making monthly HITECH payments is based upon the established Demonstration Payment System (DPS) model that is used to make demonstration payments for CMS. The payment process for the HITECH initiative is as follows:

• MACs and various Medicare systems interface with the NLR in order to provide information related to allowed charges, EH payment amounts, the recipient name, NPI/CCN TIN, and banking/payment details (account/routing numbers for EFT deposits and an address for paper checks) for each recipient.

• The NLR identifies whether the meaningful use criteria have been met, verifies eligibility, calculates payments for EPs and EHs, checks for duplicate payments, and compiles a single payment file in an agreed upon format using XML.

• The PFDC receives the D7 payment information file from the NLR monthly/daily. The PFDC shall develop two separate files from this NLR file: 1) the NACHA standard EFT payment file that is sent to the Medicare bank for processing the EFT deposits; and 2) a positive pay/checks issuance paper check payment file that the PFDC uses to disburse paper checks. The NACHA standard EFT file contains the recipient banking information and includes the remittance advice embedded in the CMS approved payment file format; the paper check payment file contains the recipient mailing addresses.

• The PFDC must also produce a summary file/payment request for the monthly payment that includes the amount by payee type (EPs and EHs) and the total amount for that monthly payment cycle. As required by CMS, the PFDC shall also implement a supplemental monthly payment cycle to make payments to providers submitted to the PFDC on the supplemental D7 payment file; coordinate with CMS OFM, OESS, and OIS to receive the supplemental D7 payment file and to prepare a summary report/payment request for CMS to ensure funds certification and Treasury request no later than the first payment cycle of the following month; update the NLR with a D8 return file that includes the payment actions for this supplemental payment file; include the supplemental payments on the following month Payment Cycle Report.

• The PFDC shall include reviewing each D7 file for potential duplicate (and potential prior D7 file duplicate) payments, this should be based on fields like: amount, name, address, etc. CMS shall be included in decisions made on duplicates and review of files for duplicates.

• The PFDC applies Federal Payment Levy Program (FPLP) withholding for tax and non-tax debt to EFT and paper check HITECH payments in accordance with the US Treasury FPLP requirements and ensures that the remittance advice is designated with the appropriate (PLB) reason code for the FPLP withholding.

• CMS reviews and approves the total payment amount on the summary file/payment request including both EFTs and paper check payments. CMS authorizes the transfer of funds for the total amount to the Treasury through the DPS and HIGLAS and notifies the PFDC of the approval/authorization for payment.

• The PFDC forwards the completed EFT payment file and the positive pay/checks issuance file through a CMS approved secure network to the Medicare bank and also maintains the positive pay/checks issuance file to disburse paper checks and to coordinate with the Medicare bank to prevent fraudulent check usage.

• The Treasury deposits the total payment amount for the current monthly payment cycle into the bank account established for the PFDC with the Medicare bank; after the Treasury deposit is received in the PFDC account by the Medicare bank, the bank deposits the EFTs in the respective recipient bank accounts and the PFDC mails the paper check payments with attached remittance advice to the recipient addresses.

• The Medicare bank sends a return file with a payment confirmation to the PFDC. The PFDC reconciles the return file with the completed EFT payment file; the reconciliation includes accounting for both the paid/correct records (EFTs) and the errors from the return file; the PFDC reconciles paper check payments using the clears file from the Medicare bank that contains the list of all checks that have been processed and paid by the bank.

• The PFDC uploads a payment history file that contains the successful payment records (EFTs and paper checks) into the NLR; the PFDC also uploads the errors from the return file into the NLR for correction by the MACs and reprocessing in the next monthly payment cycle or on another routine basis to be established by CMS; all returned checks with undeliverable addresses are indicated on the payment history file as DNF (do not forward).

• The PFDC receives all corrected banking information including account/routing numbers and payment addresses from the NLR on the D7 payment information file.

• The PFDC prepares and sends 1099s to all providers that received HITECH incentive payments during the calendar year.

• The PFDC maintains the HITECH bank account with the participating Medicare bank.

• The PFDC updates the NLR and CMS records/reports to account for both overpayments and underpayments resulting from either: 1) cost report settlements for EHs; and/or 2) over and underpayments to EPs.

• The PFDC issues multiple overpayment demand letters to EH or EP payees, as applicable.

• The PFDC maintains a lockbox with the Medicare bank to receive and process overpayment refunds, identifies and resolves issues with overpayment refunds, and ensures/maintains proper funds control for all overpayment collections.

• The PFDC refers uncollected overpayments to the Treasury for recoupment after 60 days from the date of the demand letter.

• The PFDC reports to CMS weekly on collection activities and lockbox receipts, monthly through the Aging of Receivables Report, and quarterly on the CMS 750/751 reports.

B. Purpose

The purpose of this SOW is to award a five year contract (one year base period with four option years) to a PFDC to assist CMS in disbursing EHR incentive payments to eligible Medicare professionals (EPs) and eligible hospitals (EHs) under the HITECH Act. The contract shall focus on the final performance years and close-out of the HITECH program; the tasks include: making payments to EPs and EHs, closing out accounts, processing meaningful use audit and cost report audit demand letters, collecting and reporting on receivables, debt referrals to the US Treasury, processing and handling Remedy tickets, managing/monitoring extended repayment plans, making manual payments and manual adjustments to payments, and working with all associated stakeholders in helping to finish the HITECH program. The PFDC also ensures proper oversight of funds control and accounting related to these payments, recoveries and communications, as well as participating in the annual Chief Financial Officers (CFO) Audit and Office of Management and Budget (OMB) Circular A123 Audit. The close out during the option years of this contract will include additional work for the PFDC associated with Ad Hoc actions/reporting, National Level Repository (NLR), and other system support and responsibilities associated with this contract to ensure a smooth program conclusion.

C. Technical Considerations

The services required under this SOW are to be provided by a contractor with experience developing/modifying and supporting software, interfacing with the CMS data center and the VDCs/EDCs, preparing provider files for payment, sending NACHA standard EFT payment files to the Medicare bank through a CMS approved secure network, developing positive pay payment files to make paper check payments to providers, maintaining a Medicare bank account and ensuring proper funds control, accounting for both overpayments and underpayments, collection services and efforts for recovery of all overpayments, and updating recipient payment information. The contractor shall conduct FPLP on all payments in compliance with US Treasury requirements and pre-note all payments in compliance with NACHA rules. The PFDC shall have access to two interfaces within the NLR - the D7 payment information file and the D8 payment history file - and shall be required to exchange these files with the NLR. The PFDC shall be FISMA and 508 compliant and meet all security, compliance and liability requirements that are identified in the MAC contracts at time of award.

The PFDC shall have the necessary equipment and facilities to:

1. Prepare and disburse over 500 paper checks per month

2. Prepare, disburse, reconcile accounts receivable/payable, track and report at least 13,000 payments per month.

3. Routinely make Medicare payments in excess of $1 billion.

4. It is required that the PFDC have a CMS approved accounting system (like Deltek Costpoint) or another dual entry accounting, segregation of duties and audit trail CMS approved software.

5. Issue and track at least 500 demand letters per month.

6. Make a minimum of 600 demand calls a month and receive at least 400 calls a month dealing with overpayment collection and other customer issues.

7. Have a system in place to handle storing, navigating, editing, reconciling, sending, receiving, preparing XML files from main XML file and quality assuring large XML data files (44 lines, 28 fields and approximately 93,000+ records per month) sent between multiple systems/parties; be capable of processing these files in other formats as required by CMS.

D. Workload Estimates

CMS recommends the PFDC use the following assumptions:

1) Only FFS Medicare EPs and EHs will receive payments through the PFDC and Medicare bank;

Medicaid providers will be paid separately through the state.

2) EHR incentive payments will steadily decrease over the length of this award. Routine monthly payments to EPs will end after FY2017; payments to EPs thereafter shall be limited to appeals or other corrections/ adjustments. Routine monthly payments to EHs shall continue through 2020 based on cost report audit, appeals, or other corrections/adjustments.

Total estimated HITECH participation for EHs and EPs.

EHs

(a) Year 2016 – 5000 total Medicare EHs

(b) Year 2017 – 5000 total Medicare EHs

(c) Year 2018 – 5000 total Medicare EHs

(d) Year 2019 – 5000 total Medicare EHs

(e) Year 2020 – 5000 total Medicare EHs EPs

(f) Year 2016 – 400,000 total Medicare EPs

(g) Year 2017 – 400,000 total Medicare EPs

(h) Year 2018 – n/a

(i) Year 2019 – n/a

(j) Year 2020 – n/a

4) Demand Letter Workload Estimates:

• The demand letter volume shall range from 50 to 500 letters per month.

• The second reminder demand letter shall range from 0 to 200 per month

• The number of extended repayment requests reviewed shall range from 0 to 25 per month.

• The number of debts referred to Treasury shall range from 20 to 200 per month.

• The number of debts disputed after the referral to the US Treasury shall range from 0 to 50 per month.

• The number of appeal updates reviewed shall not exceed 40 per month.

• The number of EH or EP outgoing calls shall not exceed 800 per month.

5) Manual Payments/Manual Adjustments to Payments

• The number of manual payments or manual adjustments to payments shall range from 0 to 150 per month.

II. Business Requirements

Independently and not as an agent of the Government, the PFDC shall furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government, as needed to perform the requirements of this SOW.

A. The PFDC shall be responsible for the following requirements/tasks:

1) Develop and maintain connectivity with the CMS data center and the NLR and conduct routine testing of this connectivity; comply with all CMS requirements for participation with testing NLR system releases related to the PFDC (in accordance with the CMS systems life cycle including design, development, user testing, validation testing, round trip testing and modification to documentation, etc.);

ensure testing includes all external stakeholders and is coordinated with the schedule maintained by CMS and the HITECH testing contractor; provide testing staff resources and support for all future NLR system releases related to the PFDC. Conduct monthly data integrity/quality assurance (DIQA) testing between the PFDC internal system and the NLR to ensure that the data reported from these systems are synchronized; coordinate with the NLR contractor to fix data problems and/or inconsistencies between these systems; ensure PFDC internal systems are in compliance with the NLR EXtensible Markup Language (XML) file format or other format as required by CMS; and implement exception handling changes with the NLR as required. With approval from CMS, obtain data that is missing from the payment information file using external data resources as necessary for the purpose of making accurate payments.

2) Receive the monthly/weekly D7 payment information file from the NLR. Review the file for completeness and any potential inaccurate payments (including, but not limited to, potential duplicates).

Develop two separate payment files from the D7 payment information file: 1) the NACHA standard format EFT payment file for processing the EFT deposits; and 2) a positive pay paper checks issuance file used to disburse paper checks and prevent fraudulent check usage; send both of these files to the Medicare bank, in accordance with bank standards. The NACHA standard EFT file shall contain the recipient banking information and include the remittance advice embedded in the CMS approved payment file format; the paper check payment file shall contain the recipient mailing addresses. The PFDC shall also produce a summary report/payment request in an agreed upon format for this monthly payment that, at a minimum, includes the amount by payee type (EPs and EHs), total amount withheld for FPLP, and the total gross and net amounts for that monthly payment cycle; the summary report/payment request shall be used by CMS for the purpose of making Treasury requests for funding the monthly payment cycle. The PFDC shall also produce a pre-payment detail file that shall include all the prospective payees and payment amounts for the monthly HITECH payment; CMS and the PFDC shall use this file as internal control documentation to support the summary report gross/net payment amounts and to check for duplicate payments within the file and against prior payments. The PFDC shall cooperate with CMS, OIG, contractors and other stakeholders in the review of PFDC internal controls and payments and shall forward all payment policy documents, payment files, financial records and other PFDC documentation as requested. The PFDC shall instruct the Medicare bank to pre-note the account/routing number information for all payees on the payment information file before making EFT payments.

3) Forward the summary report/payment request and detail file for the monthly payment cycle to CMS for approval. After receiving CMS approval and notification of the Treasury deposit in the HITECH bank account, securely transmit the completed NACHA standard EFT payment file with the remittance advice to the Medicare bank. For any summary report/payment request or detail file that does not receive approval from CMS, ensure the necessary corrections are made to the file and resend to CMS for approval.

4) After receiving CMS approval and notification of the Treasury deposit in the Medicare bank, send paper checks with attached remittance advice to providers on the positive pay payment file; this task shall include printing checks, preparing/attaching remittance advice, addressing and stuffing envelopes, correcting addresses as needed, resending return mail, tracking payments, and maintaining paper check payment records.

5) Reconcile the completed payment file with the return file and the payment confirmation received from the Medicare bank; the reconciliation shall include accounting for all EFT and paper check payments for that monthly payment cycle; notify CMS of any payment errors/EFT rejections.

6) Send the D8 payment history file to the NLR, in the required format. The D8 payment history file shall include all data elements necessary to update the payment status of all payees receiving payment during the monthly payment cycle; the D8 payment history file shall also be used to update the NLR on reissues, adjustments, overpayment collections, file errors, etc. on a daily basis. The D8 payment history file shall include payment recipient information derived from the EFT confirmation file and the paper check clears files. Both these files shall be forwarded to the PFDC by the Medicare bank as part of the return file;

these files shall convert/update the payment status of the corresponding recipients in the NLR.

7) Send the errors in banking information in a payment history D8 file to the NLR for correction by the MACs. Receive records with corrected banking information from the NLR on a D7 payment information file and include these corrected records for payment on the next monthly payment cycle.

8) Ensure that the NLR has been updated through a daily D8 payment history file with actions taken on all recipients.

9) Comply with all applicable CMS rules, regulations and reporting requirements.

10) Respond to HITECH Customer Service Help Desk (HBOSC) questions and Remedy tickets related to monthly payments as required. The contractor shall meet weekly with CMS staff to assist in developing an efficient process to handle payment related inquiries and Remedy tickets; and research/respond to inquiries from the help desk about lost or stale dated check payments. The contractor shall respond to all Remedy tickets designated as high priority in one business day; all medium priority Remedy tickets in three business days; and all low priority Remedy tickets in five business days.

11) Prepare/send 1099s annually no later than January 31 to the prior year payment recipients in accordance with Treasury regulations; comply with requirements for resolving IRS B notices, per CMS’s instructions, when necessary.

12) Maintain the HITECH bank account with the participating Medicare bank.

13) Maintain lockboxes with the participating Medicare bank for managing overpayment collections.

14) Issue demand letters and account for receivables for all overpayments processed through the NLR resulting from: 1) cost report adjustments/settlements for EHs; 2) overpayments to EHs and EPs identified through meaningful use audits; or 3) administrative errors. Issue Meaningful Use and Cost Report demand letters per the monthly D7 payment information file; issue manual demand letters per Remedy ticket requests; manage the demand letter templates and coordinate changes with CMS and the NLR making sure applicable Medicare rules are followed (per CMS instruction, when necessary); make manual payments and manual adjustments to payments as required and approved by CMS. The contractor shall send two demand letters per demand (the number of demand letters may be changed by CMS), the original demand letter and a subsequent demand letter, issued 45 calendar days after the initial demand letter postmark. The contractor shall also attempt to make telephone contact with the debtor 35 calendar days after the initial demand letter postmark and every five business days for up to three attempts, per CMS’s instructions; if no contact is made with the provider after three attempts the debt shall be referred to Treasury for FPLP offset collections. The PFDC shall create and submit a call log, in a format to be determined by CMS weekly. All debt not collected by the 60th calendar day shall be referred to Treasury unless the debt is under appeal, included in an extended repayment plan or from CMS instruction. Prior to debt referral to Treasury, the contractor shall attempt to verify the demand letter address/name using internet searches and CMS data/data extracts as necessary; these activities shall be included in the weekly report to CMS. CMS reserves the right to alter the collection efforts to better suit CMSs needs (i.e.

number of demand letters, calls, and internet searches). The contractor shall maintain a HITECH phone line and have at least two live person involved in the call flow during business hours 9-5 EST. Hold times shall not exceed an average of 5 minutes without answering. Dropped calls shall be limited to less than 10 percent of calls on hold. A designated HITECH voice mailbox shall be set up with clear instructions on what is needed for the PFDC to service/answer the caller’s request. The contractor shall submit a monthly call log showing all incoming calls and the statistics involved once a call is received;

including, but not limited to: received, on hold, hang ups, voicemails, call duration, hold duration, answered and time taken to reply to voicemails. On request, the contractor shall provide CMS with call logs, scripts, and caller flow charts, to be approved and changed per CMS’s instruction.

15) Submit a weekly report which shall include, but is not limited to, statistics and information dealing with: demand letters issued, demands outstanding, reconciliations of received payments, lockbox collections, phone calls made/received, internet searches, EH and EP communications, updates on outstanding debts, and other statistics and information to be decided by CMS.

16) Submit a monthly Accounts Receivable report that includes a summary of the weekly reports along with information and statistics on demand letters, efforts to collect all debts outstanding and detailed information on debt owed by individual EHs and EPs. The information included in the report and the report format shall be decided by CMS at a later date and shall evolve to CMS’s collection reporting needs when required by CMS.

17) Work in conjunction with CMS to improve the process for collecting and reporting outstanding debt as listed above in steps 14-17. This shall include ad hoc reporting, analyzing and trending collection data, preparing reports and presentations based on collections and weekly meetings on process oversight and improvement.

18) Update the NLR and CMS records/reports to account for overpayments and underpayments as well as voluntary returns from providers. Review provider’s documentation to determine if the required information was submitted. Determine if the provider qualifies for an extended repayment plan;

approve/deny repayment requests up to 6 months in length; submit recommendations for approval of repayment plans greater than 6 months to CMS; monitor repayment requests and monthly payments;

default providers if two consecutive payments are missed; resume collection activities; provide CMS with monthly extended repayment plan reports.

19) In coordination with the Medicare bank, accept and process overpayment collections received though the lockboxes and ensure proper funds control for all overpayment collections. Review deposits and supporting documentation; identify the registrant and the reason for the deposit (demand letter or voluntary refund); contact provider if insufficient information was received in order to process the collection; post and apply cash receipts to individual debts; process Non-Sufficient Fund (NSF) updates when a provider’s payment is reversed by the bank; offset other HITECH payments against existing overpayments; issue a D8 to notify the NLR of the collections; submit quarterly funding true-up to transfer collections to CMS.

20) Refer uncollected overpayment debt to the Treasury after 60 days from the date of the demand letter by entering uncollected debts into the Debt Collection System (DCS) for referral to the US Treasury;

process monthly collections made by the US Treasury; recall debts from the US Treasury when necessary (e.g. appeal, repayment plan, bankruptcy); respond to Treasury disputes and proof of debt inquiries;

process monthly Return To Agency (RTA) files from CMS; provide CMS with monthly aging of receivables report to document debt collection activity; supply CMS with monthly 1521, 1522, and quarterly 750 and 751 reports.

21) In coordination with the Treasury, apply FPLP tax and non-tax withholding to the monthly D7 payment information file before the payment file is forwarded to the Medicare bank or paper check payments are made; this task includes the following specific requirements:

a) Send an extract file derived from the monthly D7 payment information file that includes payee (legal) names and TINS to the Treasury for every monthly payment cycle.

b) Receive a match file from the Treasury with the outstanding debt amounts for any recipients with FPLP applied.

c) In compliance with Treasury FPLP policy and withholding formulas, produce the tax/non tax withholding amounts for each payee with FPLP debt and send an offset file to the Treasury with the FPLP debt to be collected for each affected payee on the extract file.

d) Receive an acknowledgement file from the Treasury verifying the debt amounts to be collected and ensure that the total FPLP debt amount collected for the monthly payment file is forwarded to the Treasury according to an agreed upon schedule.

e) Ensure that the gross payment amount; the net amount after FPLP is applied; the FPLP offset amounts;

and the FPLP PLB Reason code for the withholding are included on the EFT payment file sent to the Medicare bank and the positive check payment file for issuing paper checks.

f) Ensure that the payment (EFT or paper check) to each recipient with FPLP applied is the net amount reflecting the offset.

e) Ensure the remittance advice reflects the offset with the proper FPLP PLB code.

f) Send the gross payment amount, the net payment amount, and the offset amount as well as the PLB code explaining the FPLP offset into the NLR on a D8 payment history file.

22) Develop a contingency payment plan within 30 days of contract award. The PFDC must implement the contingency plan - in whole or in part - as a result of either NLR failures or deficiencies in order to make accurate HITECH payments, per CMS instruction; this may include accessing the NLR, PECOS, IDR, CWF, or other systems as necessary to gather the provider payment information to make accurate HITECH payments.

23) As required by CMS, coordinate with OESS and OIS to develop and implement an alternative technical and procedural solution to resolve problems associated with making payments to HITECH payees with incorrect or questionable payment information on the D7 file. This solution shall include:

accepting Remedy tickets from OESS to put providers on hold if the payment information requires additional validation release; releasing up to 50 providers on hold biweekly with approval from OESS after the payment information has been validated and issuing these payments off the monthly payment cycle; void cancel providers with invalid payment information with OESS approval; process alternative D7 payment information files from the NLR with providers released from hold whose status has been recoded from reissue to initial by OESS after payment information has been corrected; process and pay these corrected records during the monthly payment cycle.

24) Verify payee TINs through the IRS prior to issuing 1099s as instructed by CMS.

25) Monitor the XML D7 files to prevent duplicate or other improper payments.

26) Implement a second monthly payment cycle to make payments to providers submitted to the PFDC on the supplemental D7 payment information file; coordinate with CMS OFM, OESS, and OIS to receive the supplemental D7 payment information file on or about the 15th calendar day of the month and to prepare a summary report/payment request for OFM/FSG/DFSE to ensure funds certification and Treasury request no later than the first payment cycle of the following month; update the NLR with a D8 payment history that includes the payment actions for this supplemental payment file; include the supplemental payments on the following month Payment Cycle Report.

27) Assist in the implementation of sequestration as required by CMS in the event the sequestration requirements change and manual effort or workarounds are temporarily needed; the contractor shall be responsible for ensuring that the sequestration amounts have been applied correctly and that all eligible net payment amounts reflect this reduction. The contractor shall also be responsible for updating their financial reporting to include these payment reductions.

B. Report Requirements

The PFDC shall provide CMS with Monthly Progress Reports; these reports shall include but not be limited to a summary of all activities associated with the requirements detailed in Section II as well as bank reconciliation statements for that monthly payment cycle; weekly collection report; monthly aging/ Accounts Receivable report; and monthly extended repayment plan report. The PFDC shall provide CMS with monthly CMS 1521/1522 reports as well as quarterly CMS 750/751 reports. The PFDC shall provide

CMS with a Final Report at the end of the contract period that shall include project accomplishments and recommendations.

1) The PFDC shall provide CMS with a Summary Report containing information required by CMS for payment authorization/approval for each monthly payment.

2) The PFDC shall provide CMS with the quality assurance reports, documentation, materials, and ad hoc reporting identified in Section II and III of this SOW.

3) The PFDC shall provide CMS with access to files, reports, and data on a per request basis.

4) The PFDC shall provide CMS with verification of FISMA and 508 compliances.

5) The PFDC shall provide CMS with the ARRA and Subcontractor reports (as applicable) by the due dates required in the deliverables schedule SOW Appendix A items 10 - 15.

6) The PFDC shall prepare the weekly PFDC project schedule and shall coordinate with both CMS HITECH and contractor staff to update the HITECH integrated project schedule on a weekly basis.

C. Government Furnished Property

N/A

D. Personnel Requirements

Project Manager: requires senior/expert level project management experience on projects and/or programs, including managing and evaluating agency acquisition investment performance, developing and managing a program budget, with a minimum of 4 years of program and project management experience within the last 5 years. Project managers must have thorough training, experience, and other development activities and demonstrated capabilities in the following areas:

• Knowledge and skills to manage and evaluate moderate to high-risk programs or projects that require significant acquisition investment and agency knowledge and experience.

• Ability to manage and evaluate a program and create an environment for program success.

• Ability to manage and evaluate the requirements development process, overseeing junior level team members in creation, development, and implementation.

• Expert ability to use, manage, and evaluate management processes, including performance-based management techniques.

• Expert ability to manage and evaluate the use of earned value management as it relates to acquisition investments.

Note: Resume required

E. Transition to New PFDC (if necessary)

Work performed as the PFDC shall occur in three phases: transition, fully operational and close out. The day after the Task Order award is the first day of the transition period. The transition period will last no longer than 90 days. The replacement PFDC shall develop and submit a transition plan with the project kick off meeting that defines the milestones, resources, and constraints of the transition and addresses how the PFDC proposes to meet the requirements of this SOW by the fully operational date. The transition plan shall be modified and updated continuously after these initial submissions to reflect any changes in the project, as they occur, until the PFDC is fully operational. During the transition time, the replacement/incoming PFDC shall train its staff, test hardware and software, receive and test files from the incumbent PFDC and successfully prepare its operations for the fully operational period. At the conclusion of the transition period, the fully operational period begins. The PFDC shall assume all functions prescribed in this SOW during the fully operational period until close out.

F. Contract Close Out

Contractor shall ensure that all pertinent data, information and Standard Operating Procedures (SOPs) pertaining to the HITECH effort are securely sent to CMS, per CMS’s instruction. Any auditable information dealing with the HITECH program must be stored in a way that clearly labels and organizes the information. CMS reserves the right to review this information prior to its submission and provide feedback as to how it should be organized.

III. QUALITY ASSURANCE

The PFDC shall develop a Project Plan; the Project Plan shall contain a draft version of the Payment Methodology and an Earned Value Management System (EVMS) plan. The PFDC shall develop a Connectivity Plan and Testing Protocol for all data interface and file transfer tasks associated with this SOW. Following CMS approval of the Connectivity Plan/Testing Protocol, the PFDC shall submit the final version of the Payment Methodology. The PFDC shall conduct routine quality assurance testing according to the test plan on the HITECH payment system to ensure data quality/integrity/security, including data integrity testing between the NLR and the PFDC systems, and include the results from these tests in the monthly progress reports. The PFDC shall also develop a Contingency Payment Plan for review and approval by CMS that can be implemented no later than 30 days from contract award in the event that the current process of issuing payments has issues and the HITECH payments must be made using an alternative payment process. The PFDC shall also submit a Final Report that contains a summary of completed requirements/tasks, milestones, as well as a self-assessment review and revisions to the Payment Methodology.

The PFDC shall follow the requirements in the Medicare Financial Management Manual, Chapter 7 Internal Control Requirements regarding audit trails, internal control, risk assessment, documentation, and certification. The PFDC shall develop a HITECH Payment Policy Manual that details the various HITECH as well as OFM policies for making HITECH payments, overpayment collection, debt referral, etc.; this manual shall be appended to the Final Methodology. The PFDC shall work with CMS to develop and implement a change management system to include: receiving change requests, implementing changes, developing a release schedule, and conducting change testing in accordance with CMS change management requirements. The PFDC processes shall follow the CMS System Development Life Cycle (SDLC). The PFDC shall develop and maintain system documentation in compliance with CMS standards and make this documentation available to CMS upon request. The PFDC shall develop disaster recovery plans for these systems and include these plans in the system documentation. The PFDC shall also work with CMS to develop problem/incident notification and response requirements. The PFDC shall provide CMS with other ad hoc reports as directed.

IV. SECURITY REQUIREMENTS

The Contractor shall comply with the security requirements defined in the Business Partner System Security Manual (BPSSM) (also known as IOM Publication 100-17), and the CMS Information Security (IS) Acceptable Risk Safeguards (ARS) Including CMS Minimum Security Requirements (CMSRs), found at www.cms.hhs.gov/informationsecurity.

The Contractor shall comply with the CMS Information Security Handbook and all CMS policies, standards and procedures contained within the handbook. These documents can be found on the following website: www.cms.hhs.gov/informationsecurity.

The Contractor shall comply with the Federal Information Security Management Act of 2002 (FISMA) (Public Law 107-347) requirements set forth in Section 912 of MMA.

The Contractor shall comply with and utilizes standards and guidelines promulgated by the National Institute of Standards and Technology (NIST) in its entity-wide information security program. The NIST website is located at:www.csrc.nist.gov.

The Contractor shall comply with the applicable standards; implementation specifications and requirements of the HIPAA security rule covering electronically protected health information.

V. APPENDICES

SOW Appendix A ITEMS TO BE FURNISHED AND DELIVERABLE SCHEDULE

VI. REFERENCES

• CMS Business Partners System Security Manual, Transmittal 9, CMS Pub 100-17, June 20, 2008 http://www.cms.gov/manuals/downloads/117_systems_security.pdf

• CMS System Security Plans (SSP) Methodology, Version 3.0, October 28, 2002 http://www.cms.hhs.gov/InformationSecurity/Downloads/ssp_meth.pdf

• Medicare Financial Management Manual, Chapter 7 Internal Control Requirements. Included as attachment J.11

• Federal Information Security Management Act of 2002 (FISMA), November 27, 2002 http://csrc.nist.gov/policies/FISMA-final.pdf

• CR 7143 – HITECH Overpayment Collection Procedures http://www.cms.gov/manuals/downloads/117_systems_security.pdf http://www.cms.hhs.gov/InformationSecurity/Downloads/ssp_meth.pdf http://csrc.nist.gov/policies/FISMA-final.pdf

SOW Appendix A

ITEMS TO BE FURNISHED AND DELIVERABLE SCHEDULE

The PFDC shall submit all required reports and deliverables to CMS in accordance with the following schedule. Reports and/or deliverables submitted under this contract shall be in accordance with the SOW entitled: In Accordance With (IAW).

ITEM # DESCRIPTION QTY/RECIPIENT DELIVERY

1) Monthly Progress Report with 1 cy – COR Monthly Bank Account Reconciliation 1 cy - Contracting Officer

IAW SOW Section II.B.1

2) Monthly Payment Summary/Payment

Request /Prepayment Detail Report 1 cy – COR Monthly IAW SOW Section II.B.2 1 cy - Contracting Officer IAW with the payment cycle

3) Project Kickoff Meeting/ COR 1 week after Transition Plan Contracting Officer award

4) Project Plan/Draft Methodology/ 1 cy – COR 2 weeks after EVM Plan IAW SOW III 1 cy - Contracting Officer award

5) NLR CMS Data Center 1 cy – COR 2 weeks after

Connectivity Plan IAW 1 cy - Contracting Officer award SOW II.A.1 and SOW III

6) Connectivity Testing Report 1 cy – COR 3 weeks after

IAW SOW II.A.1 and 1 cy - Contracting Officer award

SOW III.

7) Final Methodology 1 cy – COR 4 weeks after IAW SOW III 1 cy - Contracting Officer award

(Note: HITECH Payment Policy Manual IAW SOW III shall be appended to the Final Methodology)

8) Weekly Collections Report 1 cy – COR Weekly

9) Monthly Aging of Receivables Report 1cy - COR Monthly

10) Final Report 1 cy – COR End of

IAW SOW II.B.1 1 cy - Contracting Officer contract

11) HITECH 1cy – COR Monthly as Integrated Project Schedule Report required

ARRA Reporting Requirements

12) Draft LMI Quarterly Report Data 1 cy - Contracting Officer Quarterly

IAW SOW II.B.6 4/3, 7/3,

10/3, 1/3

13) Quarterly on-line data base update On-Line Quarterly

IAW SOW II.B.6 4/10, 7/10,

10/10, 1/10

14) Quarterly Report Correction On-Line Quarterly Window, IAW SOW II.B.6

15) ARRA Monthly Report 1 cy - Contracting Officer Monthly

IAW SOW II.B.6 5th of each month

Subcontract Reporting Requirements

16) Standard Form 294 On-Line 4/30 and 10/31 Contract Section H http://www.esrs.gov/ of each year

IAW SOW II.B.6

17) Standard Form 295 On-Line Annually Contract Section H http://www.esrs.gov/ 10/31

IAW SOW II.B.6

SOW Appendix B

SECTION 508 - ACCESSIBILITY OF ELECTRONIC AND INFORMATION

TECHNOLOGY

(a) This task order is subject to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) as amended by the workforce Investment Act of 1998 (P.L. 105-220). Specifically, subsection 508(a)(1) requires that when the Federal Government procures Electronic and Information Technology (EIT), the EIT must allow Federal employees and individuals of the public with disabilities comparable access to and use of information and data that is provided to Federal employees and individuals of the public without disabilities.

(b) The EIT accessibility standards at 36 CFR Part 1194 were developed by the Architectural and Transportation Barriers Compliance Board ("Access Board") and apply to contracts and task/delivery orders, awarded under indefinite quantity contracts on or after June 25, 2001.

(c) Each Electronic and Information Technology (EIT) product or service furnished under this contract shall comply with the Electronic and Information Technology Accessibility Standards (36 CFR 1194), as specified in the contract, as a minimum. If the Contracting Officer determines any furnished product or service is not in compliance with the contract, the http://www.esrs.gov/ http://www.esrs.gov/

Contracting Officer will promptly inform the Contractor in writing. The Contractor shall, without charge to the Government, repair or replace the non-compliant products or services within the period of time to be specified by the Government in writing. If such repair or replacement is not completed within the time specified, the Government shall have the following recourses:

1. Cancellation of the contract, delivery or task order, purchase or line item without termination liabilities; or

2. In the case of custom Electronic and Information Technology (EIT) being developed by a contractor for the Government, the Government shall have the right to have any necessary changes made or repairs performed by itself or by another firm for the noncompliant EIT, with the contractor liable for reimbursement to the Government for any expenses incurred thereby.

(d) The contractor must ensure that all EIT products that are less than fully compliant with the accessibility standards are provided pursuant to extensive market research and are the most current compliant products or services available to satisfy the contract requirements.

(e) For every EIT product or service accepted under this contact by the Government that does not comply with 36 CFR 1194, the contractor shall, at the discretion of the Government, make every effort to replace or upgrade it with a compliant equivalent product or service, if commercially available and cost neutral, on either a contract specified refresh cycle for the product or service, or on a contract effective option/renewal date;

whichever shall occur first.

Section 508 Compliance for Communications

The contractor - National Government Services (NGS) - shall comply with the standards, policies, and procedures below. In the event of conflicts between the referenced documents and this SOW, the SOW shall take precedence.

Rehabilitation Act, Section 508 Accessibility Standards

1. 29 U.S.C. 794d (Rehabilitation Act as amended)

2. 36 CFR 1194 (508 Standards)

3. www.access-board.gov/sec508/508standards.htm (508 standards)

4. FAR 39.2 (Section 508)

5. CMS/HHS Standards, policies and procedures (Section 508)

In addition, all contract deliverables are subject to these 508 standards as applicable.

Regardless of format, all Web content or communications materials produced, including text, audio or video - must conform to applicable Section 508 standards to allow federal employees and members of the public with disabilities to access information that is comparable to information provided to persons without disabilities. All contractors (including subcontractors) or consultants responsible for preparing or posting content must comply with applicable Section 508 accessibility standards, and where applicable, those set forth in the referenced policy or http://www.access-board.gov/sec508/508standards.htm%20(508 standards documents above. Remediation of any materials that do not comply with the applicable provisions of 36 CFR Part 1194 as set forth in the SOW, shall be the responsibility of the contractor or consultant.

The following Section 508 provisions apply to the content or communications material identified in this SOW:

36 CFR Part 1194.21 a - l

36 CFR Part 1194.22 a - p

36 CFR Part 1194.31 a - f

36 CFR Part 1194.41 a – c

The contractor shall provide a completed Section 508 Product Assessment Template and the contractor shall state exactly how proposed EIT deliverable(s) meet or does not meet the applicable standards.

The following Section 508 provisions apply for software development material identified in this

SOW:

For software development, the Contractor/Developer/Vendor shall comply with the standards, policies, and procedures below:

Rehabilitation Act, Section 508, Accessibility Standards

(1) 29 U.S.C. 794d (Rehabilitation Act as amended)

(2) 36 CFR 1194 (508 Standards) 36 CFR Part 1194.21 (a – l) 36 CFR Part 1194.31 (a – f) 36 CFR Part 1194.41 (a – c)

(3) www.access-board.gov/sec508/508standards.htm (508 Standards)

(4) FAR 39.2 (Section 508)

(5) CMS/HHS Standards, policies and procedures (Section 508)

a. Information Technology – General Information (http://www.cms.hhs.gov/InfoTechGenInfo/)

For web-based applications, the Contractor shall comply with the standards, policies, and procedures below:

Rehabilitation Act, Section 508, Accessibility Standards

(1) 29 U.S.C. 794d (Rehabilitation Act as amended) http://www.access-board.gov/sec508/508standards.htm http://www.cms.hhs.gov/InfoTechGenInfo/

(2) 36 CFR 1194 (508 Standards) 36 CFR Part 1194.22 (a – p) 36 CFR Part 1194.41 (a – c)

(3) www.access-board.gov/sec508/508standards.htm (508 Standards)

(4) FAR 39.2 (Section 508)

(5) CMS/HHS Standards, policies and procedures (Section 508)

a. Information Technology – General Information (http://www.cms.hhs.gov/InfoTechGenInfo/)

Recipient Addresses:

Frank Chartier, MBA, CORIII

OFM/FSG/DFSE

7500 Security Blvd., (Mail Stop N3-03-26) Baltimore, MD 21244-1850

(410) 786-8075…