HIX PMT RFR Attachment A - Model Contract__20220209.docx

COMMONWEALTH OF MASSACHUSETTS

EXECUTIVE OFFICE OF HEALTH AND HUMAN SERVICES

ONE ASHBURTON PLACE, 11TH FLOOR

BOSTON, MASSACHUSETTS 02108

[MODEL CONTRACT]

MASTER SERVICES AGREEMENT

BY AND BETWEEN

THE EXECUTIVE OFFICE OF HEALTH AND HUMAN SERVICES

ON BEHALF OF ITSELF AND

THE COMMONWEALTH HEALTH INSURANCE CONNECTOR AUTHORITY

AND

___[INSERT: SELECTED BIDDER]____

FOR

PROJECT MANAGEMENT AND TESTING (PMT) SERVICES IN SUPPORT OF THE MASSACHUSETTS HEALTH INSURANCE EXCHANGE PROGRAM

TABLE OF CONTENTS

APPENDICES (posted separately under “File Attachments” for this solicitation):

Appendix A: Key Performance Measures (KPMs) Appendix B: Software Testing Life Cycle [Subject to Bidder’s Response] Appendix C: Testing Types Appendix D: MA HIX Program Core Values Appendix E: Data Management and Confidentiality Agreement Appendix F: HIX Program Reporting Requirements [Subject to update from Bidder’s Response] Appendix G: HIX Program Tools [Subject to update from Bidder’s Response] Appendix H: HIX Operations and Technical Services Summary of Scope Appendix I: Transition Plan [Subject to Bidder’s Response Appendix J: Price and Rates Tables [Include final / updated Cost Response] Appendix K: Intellectual Property and Work Effort Agreement for Bidder’s Employees, Consultants and Agents

PREAMBLE AND INTRODUCTION

This Master Services Agreement (which forms part of the Contract as defined herein) is entered into as of [INSERT DATE] [and shall be effective upon the date of the last signature on the Standard Contract Form] (the “Effective Date”) by and between the Massachusetts Executive Office of Health and Human Services (EOHHS), on behalf of itself and the Commonwealth Health Insurance Connector Authority (the “Health Connector”) and [insert: Selected Bidder details] (the “Contractor”). Herein, EOHHS (also referred to as “Client”) and the Contractor are each a “Party” and together the “Parties.”

WHEREAS, Client wishes to engage Contractor to perform certain services as defined in and in accordance with the terms of this Contract, including, but not limited to:

(1) Project Management Services: Managing the MA HIX Application release process, all activities relating to management of application and infrastructure changes impacting the MA HIX Application, and executing HIX Program governance and program management policies, processes and procedures; and

(2) Testing and Validation Services: Testing the application code prior to installing into the MA HIX Application, and developing and maintaining a testing program for all application and infrastructure changes impacting the MA HIX Application.

WHEREAS, Client and Contractor may mutually agree to add additional services under this Contract, through a mutually agreed upon amendment or Task Order;

WHEREAS, Client wishes to engage Contractor to provide, and Contractor desires to perform, the services, all as described and defined in this Contract; and

WHEREAS, Contractor holds itself out as qualified to provide such services, NOW THEREFORE, in consideration of the mutual promises and agreements contained herein, and other good and valuable consideration, the receipt and sufficiency of which are hereby severally acknowledged, the Parties, intending to be legally bound, hereby agree as follows:

DEFINITIONS

The following terms or their abbreviations found in this Contract and its Appendices are defined as follows, and shall include the plural use when defined in the singular, and the singular use when defined as a plural, unless the context clearly indicates otherwise:

Acceptance, Accepted, or Accept – With respect to any Deliverable, Client’s written notice of its confirmation that such Deliverable conforms, in all material respects, with the relevant Acceptance Criteria applicable to such Deliverable established by written agreement of the Parties.

Acceptance Criteria – The objective criteria mutually agreed to by the Parties in writing or as set forth in an applicable Task Order(s) or Change Order(s), pursuant to which Deliverables shall be evaluated by Client with respect to Contractor Deliverables. In each case, such Acceptance Criteria shall be based upon the applicable specifications and requirements, and the applicable quality assurance and quality control standards, including test criteria, as set forth in the writing or applicable Task Orders or Change Orders agreed to by the Parties.

Acceptance Process – means the process for evaluation and Acceptance, as described and agreed by the Parties in writing (including a Change Order or Task Order) with regard to certain Deliverables.

Accessibility Standards and Requirements – has the meaning set forth in Section 2.4.

Accessibility Testing Vendor - has the meaning set forth in Section 2.4.

Agencies – shall collectively refer to EOHHS, MassHealth and the Health Connector.

AT/IT List – has the meaning set forth in Section 2.4.

Business Day – Any day on which employees of the Commonwealth are expected to report to work. Normal business days for EOHHS are Monday through Friday, excluding state-wide and federal holidays as may be listed from time to time on www.mass.gov.

Business Owners – MassHealth and the Health Connector, collectively.

Calendar Day – Any day of the week regardless of whether work is scheduled to be performed (i.e., includes weekends and holidays).

Centers for Medicare & Medicaid Services (CMS) – The federal agency under the Department of Health and Human Services responsible for administering, in relevant part, the Medicare and Medicaid programs.

Change Control Board (CCB) – The HIX Program’s governance body for Change Management.

Change Order – means a writing signed by the respective authorized signatories of the Parties for the purposes of amending the Services to be provided pursuant to this Contract.

Client – The Massachusetts Executive Office of Health and Human Services (“EOHHS”), with principal place of business of One Ashburton Place, Boston, MA 02108. Under this Contract, EOHHS is contracting on behalf of itself and the Health Connector.

CMS Requirements – shall mean those requirements issued by the Centers for Medicare and Medicaid Services (CMS) including, but not limited to, those relating to CMS funding requirements (including processes, standards, and architecture) for state Medicaid IT systems (42 CFR Part 433.122(b)(10-22)), Mechanized Claims Processing and Information Retrieval Systems, Data Processing Equipment and Services, MITA Medicaid Information Technology Architecture, Chapter 11 Medicaid Management Information Systems, Access to Records, Reporting and Agency Attestations, Information Safeguarding, HIPAA Compliance, Reporting and Security, and Interface requirements to be employed for all State MMIS, all as may be updated from time to time, including any successor requirements.

Commonwealth – The Commonwealth of Massachusetts, its departments, institutions, agencies, authorities, divisions and/or any combination of these entities.

Commonwealth Health Insurance Connector Authority (referred to herein as the “Health Connector”) – An independent state agency, established by M.G.L. c. 176Q, § 2(a), which facilitates the availability of health insurance plans for eligible individuals and groups and administers the Commonwealth Care health insurance program established under M.G.L. c. 118H.

Commonwealth Security Information – shall have the meaning as set forth in Appendix E: Data Management and Confidentiality Agreement.

Conditionally Approved Contractor Deliverable – shall refer to a Deliverable which has been submitted to EOHHS and is substantially complete and correct, but subject to minor clarifications or changes in order to meet full and final Acceptance by the EOHHS Project Manager as meeting the requirements specified in the Deliverable Expectation Document (DED).

Continuous Quality Improvement (CQI) – A management process and philosophy that speaks to measuring, understanding and addressing Client needs as the basis for all organizational efforts; continuous measurement of organizational processes, employing statistical measurement tools such as process flowcharts, histograms, and run charts; and improving morale by identifying processes, not individuals, as the cause of defects, and by focusing efforts upon improving such processes.

Contract – This Master Services Agreement awarded as a result of the Request for Responses (RFR, as defined herein), and all of the exhibits, attachments, appendices, and/or schedules hereto incorporated by reference, or otherwise made a part hereof, from time to time, and including without limitation, Appendix E: Data Management and Confidentiality Agreement, the Commonwealth Terms and Conditions for Information Technology Contracts, the Standard Form Contract, the RFR and the Contractor’s Response to the RFR (include without limitation, the Cost Response).

Contract Effective Date – The date on which the Contract is fully executed as set forth on the Standard Contract Form, and the date on which the Contractor shall begin to provide Services.

Contract Operational Start Date – January 1, 2023, or such later date on which the Client determinates that Contractor shall assume full responsibility for the Services as set forth in and in accordance with this Contract.

Contract Year – A twelve-month period commencing January 1 and ending December 31, unless otherwise specified by EOHHS, in writing. Notwithstanding the preceding, the first Contract Year shall commence as of the Contract Effective Date and end on December 31, 2023.

Contractor – [Insert / Name of Selected Bidder], the entity with which EOHHS has executed this Contract for the provision of Services described herein. All requirements applicable to the Contractor herein shall also be applicable to Contractor Personnel and Subcontractors.

Contractor Facilities – Any facility used by the Contractor to perform Services under this Contract.

Contractor Personnel – all personnel and staff, including full-time and part-time employees, contract employees, individual consultants, volunteers, members, directors, officers, or partners, of the Contractor and any agent or Subcontractor, or other third parties engaged by Contractor on a staff augmentation basis for the purpose of providing Services and fulfilling Contractor’s responsibilities under this Contract.

Core Values – Workplace principles adopted by HIX Program that reflect a collection of attitudes, beliefs and behaviors that contribute to a positive healthy and productive work culture, as set forth in Appendix D.

Current Vendor – The vendor currently providing the Services to be transitioned to Contractor as Services to be performed under this Contract. As of the Effective Date, the Current Vendor is OptumInsight, Inc., with a principal business address of 13625 Technology Drive, Eden Prairie, MN 55344.

Daily Data Extract (DDE) – A daily HIX/IES data file that is sent to the data warehouse for consumption by Business Owners, and, separately, posted to a Current Vendor SFTP site where the Client or the Health Connector pulls the files to their systems.

Deficiency – A defect, error, omission, weakness or other insufficiency in a Service or Deliverable as measured (a) for purposes of Acceptance, against the relevant Acceptance Criteria, and (b) for purposes of Warranty obligations.

Deliverable – Any work product, including but not limited to, a report, a document, a test script, or any other building block of an overall project, relating to and as part of a Services herein, that the Contractor must provide or perform for EOHHS, in accordance with the Contract.

Deliverable Expectation Document (DED) – A document that (1) sets expectations for delivery of a specific Deliverable, and (2) is updated to provide a consolidated source of reference and evidence of delivery in preparation for Deliverable Acceptance.

Disaster – A malfunctioning or disabling of a critical component without which the Contractor is unable to perform or provide the services required under this Contract.

Documentation – The Deliverables and Project Works in document form that may include technical, administrative, and user documentation, training materials, reports and other documentation relating to the Services hereunder. Documentation may be used herein with respect to Documentation provided by the Contractor to the Client or by other HIX Program Vendors to the Client.

End User Software – Every Software Deliverable or Software Project Work with a user interface for external and/or internal end users to allow such users to interface with such Software or a System in which such Software is embedded. For the avoidance of doubt, End User Software includes Commercial-Off-The-Shelf software (COTS), or Software-as-a-Service (SaaS) provided by a Subcontractor of Contractor hereunder that includes such an end user interface.

Enterprise Accessibility Standard – shall have the meaning set forth in Section 2.4 herein.

Executive Office of Health and Human Services (EOHHS) – The single state agency in Massachusetts responsible for the administration of MassHealth (Medicaid), pursuant to M.G.L. c. 118E, Titles XIX and XXI of the Social Security Act (42 U.S.C. § 1396b(a)), the § 1115 Medicaid Research and Demonstration Waiver, and other relevant Legal Requirements.

Executive Office of Technology Services and Security (EOTSS) – The state agency that offers responsive digital services and productivity tools to more than 40,000 state employees, who provide essential information and services to the citizens of the Commonwealth. EOTSS also serves constituents, providing them with digital services and tools that enable taxpayers, motorists, businesses, visitors, families, and other citizens to do business with the Commonwealth in a way that makes every interaction with government easier, faster, and more secure.

Federal Tax Information (FTI) – From IRS Publication 1075, FTI is a term of art and consists of federal tax returns and return information (and information derived from it) that is in the agency’s possession or control which is covered by the confidentiality protections of the IRC and subject to the I.R.C § 6103(p)(4) safeguarding requirements including IRS oversight. FTI includes return or return information received directly from the IRS or obtained through an authorized secondary source, such as Social Security Administration (SSA), Federal Office of Child Support Enforcement (OCSE), Bureau of the Fiscal Service (BFS),or Centers for Medicare and Medicaid Services (CMS), or another entity acting on behalf of the IRS pursuant to an I.R.C. § 6103(p)(2)(B) Agreement. FTI also includes any information created by the recipient that is derived from federal return or return information received from the IRS or obtained through a secondary source.

Fixed Price – A fixed total price for a defined scope of work regardless of the cost or effort to the Vendor to deliver it. Where the Contract includes Services that are assigned a Fixed Price, the Commonwealth will pay the Vendor a set amount (as defined by the Contract) for such Services, regardless of the cost to the Vendor. The Fixed Price will not change during the Contract Period, unless the Contract is amended.

Health Connector Policies – shall have the meaning as set forth in Appendix E: Data Management and Confidentiality Agreement.

Health Connector – see definition of “Commonwealth Health Insurance Connector Authority”.

Health Insurance Exchange (HIX) – An ACA-mandated information technology system designed to provide a one-stop comparison shop experience for individuals and small businesses seeking partially subsidized or non-subsidized insurance coverage. The Health Insurance Exchange aims to facilitate price and quality competition among participating carriers. The Health Insurance Exchange also aims to increase the number of insured by reducing obstacles in obtaining affordable health insurance. The Health Insurance Exchange integrates state health subsidy programs, determines eligibility, provides a seamless channel for enrollment and provides an online calculator to allow consumers to browse premium costs of private insurance.

Health Insurance Exchange/Integrated Eligibility System (HIX/IES or HIX System) –The Commonwealth’s health insurance exchange and integrated eligibility system that provides the eligibility determination foundation for both Massachusetts’ state-based marketplace (the “Connector”) and MassHealth’s MAGI Medicaid population, under the provisions of the Patient Protection and Affordable Care Act.

Health Insurance Exchange Program (HIX Program) – The HIX Program consists of related projects, subsidiary programs, and ongoing program activities that are managed in a coordinated manner to obtain benefits not available form managing them individually. These include but are not limited to MA HIX Application releases, system integration activities, interfaces, infrastructure, and security.

Health Insurance Portability and Accountability Act of 1996 (HIPAA) – shall have the meaning as set forth in Appendix E: Data Management and Confidentiality Agreement.

HIX Portfolio – The infrastructure, technology, and operations services that collectively make up the HIX System. These include Hosting, Identity Access Management, System Integration, Testing, Application Operations and Maintenance, and the MA HIX Application.

HIX Program Entities (Program Entities) – Unless the context clearly indicates otherwise, collectively, the HIX Program Team, Business Owners, HIX Program Vendors, and the HIX IV&V Vendor. For the purposes of clarity, when the Contractor is referenced separately, HIX Program Entities shall mean, collectively, HIX Program Team, Business Owners, MA HIX Application Vendor, the Infrastructure Vendor, the Operations and Technical Services Vendor, and the HIX IV&V Vendor.

HIX Program Leadership (Program Leadership) – Collectively, the HIX Program Director and unit directors, including the Chief of Staff, Director of Operations and Maintenance, Applications Director, Enterprise Architect, Security and Compliance Director, and Director of Program Planning and Administration.

HIX Program Team (Program Team) – Collectively, HIX Program Leadership and their teams.

HIX Program Vendors (Program Vendors) – Collectively, the Contractor, the MA HIX Application Vendor, the Infrastructure Vendor, and the Operations and Technical Services Vendor. For the purposes of clarity, when the Contractor is referenced separately, HIX Program Vendors shall mean, collectively, MA HIX Application Vendor, the Infrastructure Vendor, and the Operations and Technical Services Vendor.

Incident – Any event which is not part of the standard operation of a service and which causes, or may cause, an interruption to, or a reduction in, the quality of that service. Incidents may be classified according to the Reference Materials in the RFR and as may be updated and approved in writing by EOHHS from time to time.

Independent Verification and Validation Services (IV&V) – Independent third-party assessments to verify that a product or service is well engineered and to validate that these conform to Client requirements, as required under 45 C.F.R. § 95.626. IV&V are provided by the IV&V Vendor under contract to the Commonwealth to represent the interests of the Commonwealth and of CMS.

Infrastructure Managed Services (Cloud Assured Managed Services) – Management and monitoring of the Hosting Services for the AWS infrastructure.

Infrastructure Vendor – Smartronix, LLC with a principal business address of 44150 Smartronix Way, STE 200, Hollywood, MD 20636, or such other vendor(s) as Client may notify Contractor in writing.

IV&V Vendor – CSG Government Solutions, Inc, the vendor under contract to the Commonwealth to provide services as required under 45 C.F.R. § 95.626, or such other vendor(s) as Client may notify Contractor in writing.

I-9 Process – The Contractor Personnel’s employment eligibility and record-keeping requirements under the Immigration Reform and Control Act of 1986, the Immigration Reform Act of 1990 and the Illegal Immigration Reform and Immigrant Responsibility Act of 1996, as the same shall be amended from time to time.

Key Performance Measure (KPM) – The Standards related to timeliness and quality as set forth in Appendix A. The Contractor’s performance compared to these KPMs may impact payments to the Contractor in accordance with Section 4, Payment.

Key Performance Measure (KPM) Credit – The dollar value of the assessment levied against the Contractor in accordance with Section 4.2, Key Performance Measures (KPMs) and Appendix A to this Contract based on the Contractor’s performance of the KPMs. KPM Credits are calculated against the Client’s payment to Contractor as defined in Appendix A.

Key Personnel – Those individuals within the Contractor’s Personnel determined by EOHHS to be critical to ensuring that all Contract requirements are fulfilled, performance metrics are met, and Client service standards are followed and satisfied.

Legal Requirements –– In addition to those specified or referenced in this Contract, all federal, state, municipal, and local laws, statutes, ordinances, regulations, rules, sub-regulatory guidance, and other official or interpretive orders, standards, policies, or releases of or by a government authority, as they become effective, and as they may be amended, restated, or superseded from time to time, relating to this Contract and the Services performed hereunder. For the avoidance of doubt, Legal Requirements shall include, without limitation, all of the applicable Privacy and Security Requirements, CMS Requirements, and Standards, Policies, and Guidelines.

MA HIX Application Vendor – OptumInsight, Inc. (“Optum”), with a principal business address of 13625 Technology Drive, Eden Prairie, MN 55344, both the vendor of the proprietary component of the MA HIX Application and the developer (but not the vendor) of the custom components thereof.

MA HIX Application – The version of the WebInsure application that has been customized to meet Commonwealth specific requirements for the MA HIX Program. The MA HIX Application’s WebInsure components are owned by Optum and the customized components are owned by the Commonwealth.

MA HIX/IES – See “Health Insurance Exchange/Integrated Eligibility System” MARS-E – shall have the meaning as set forth in Appendix E: Data Management and Confidentiality Agreement.

MassHealth – In Massachusetts, Medicaid and the Children’s Health Insurance Program (CHIP) are combined into one program called MassHealth. MassHealth provides health care benefits to certain people living in Massachusetts. MassHealth Members may be able to get doctor visits, prescription drugs, hospital stays, and many other important services. MassHealth offers these benefits to Members directly or by paying part or all of Members’ other health insurance premiums, pursuant to Title XIX of the Social Security Act (42 U.S.C. § 1396), Title XXI of the Social Security Act (42 U.S.C. § 1397), M.G.L. c. 118E, the § 1115 Medicaid Research and Demonstration Waiver, and other relevant Legal Requirements.

Material Subcontractor – Those Subcontractors employed by Contractor that will provide material support to Contractor’s efforts to provide the Services hereunder and to meet Contractor’s specific obligations hereunder or fulfill such obligations directly. Material Subcontractors shall not include Subcontractors that provide the Contractor with goods or services ancillary to the delivery of Services hereunder, such as those that have entered agreements with the Contractor for the provision of janitorial services, utilities, office supplies, or food; provided, however, that notwithstanding such exceptions to this definition, Contractor shall comply with all Legal Requirements related to such activities and engagements.

Maximum Obligation – The maximum fees EOHHS shall be required to pay during the Contract Term.

Medicaid – see “MassHealth”. In addition, Medicaid shall mean any other state’s Title XIX program.

Medicaid Management Information System (MMIS) – The mechanized state-operated, claims processing and information retrieval system that supports Medicaid business services and maintains information in such areas as Provider Enrollment; client eligibility, including third-party liability; benefit package maintenance; Managed Care enrollment; claims processing; and Prior Authorization.

Nonconformity – A defect, error, omission, weakness, or other insufficiency in a service or deliverable performed or provided by another HIX Program Vendor (including within the MA HIX Application or HIX/IES System), as measured for purposes of assessing acceptance, quality, functionality or other applicable acceptance criteria. as set forth in the Contract, or otherwise provided to Contractor in writing by EOHHS.

Office of the Comptroller – The Office of the Comptroller is the independent and apolitical overseer of governmental and other funding sources annually. In addition, the Comptroller oversees the Commonwealth’s expenditure and payroll management and major audit functions promoting security, transparency, accountability, and service delivery across all branches of state government. The powers and obligations of the Comptroller are generally dictated by M.G.L. c. 7A.

Operations and Technical Services Vendor (OTS Vendor) – Any Entity with whom EOHHS maintains or enters an agreement for the provision of operations, maintenance, and technical services for the HIX Program, substantially similar in scope of services as described in Appendix H.

Party or Parties – shall mean, as applicable, one of or both Contractor or EOHHS.

Privacy Rule – shall have the meaning as set forth in Appendix E: Data Management and Confidentiality Agreement.

Privacy and Security Requirements – The privacy and security requirements, specifications, and standards, applicable to this Contract and the Services hereunder, including for the avoidance of doubt (and without limitation), those set forth in Section 2 hereof, and in Appendix E: Data Management and Confidentiality Agreement.

Problem Management - The process of managing the life cycle of Problems from identification, investigation, documentation, and resolution.

Problem – The unknown underlying cause of one or more Incidents.

Program Management Plan (PgMP) – The HIX Program’s governing document that details the key policies, and procedures that the program will follow to achieve the program’s outcomes.

Project Work(s) – Any documents, reports, work product and any other submissions delivered to Client, and any other materials created by the Contractor under or in connection with this Contract (including any Task Orders or Change Orders), other than the Deliverables.

Project Management – The application of processes, methods, skills, knowledge and experience to achieve specific project objectives as defined by the Client. Project Management has final Deliverables that are constrained to a finite timescale and budget.

Project Management Office (PMO) – The Contractor’s organizational unit, established under and for the purposes of fulfilling its responsibilities under this Contract, that defines, standardizes, maintains and enforces the program-related governance processes and facilitates the sharing of resources, methodologies, tools, and techniques.

Protected Information (PI) – shall have the meaning as set forth in Appendix E: Data Management and Confidentiality Agreement.

Quality Improvement Project (QIP) – A written proposal submitted to EOHHS by the Contractor consistent with Continuous Quality Improvement (CQI) requirements under this Contract. The proposal will contain recommendations for improving the effectiveness of all elements of Contractor services provided.

Request for Responses (RFR) – The Request for Responses for the Provision of Project Management and Testing Services, including all attachments, issued by EOHHS.

Service Category – One of two categories of Services to be performed by Contractor, specifically Project Management Services or Testing and Validation Services.

Services – All tasks, activities, services and other work provided, performed or required to be performed by Contractor pursuant to this Contract, including all Task Orders, and associated Deliverables and Work Products.

Severity Level 1 Nonconformity – means a Nonconformity that blocks any critical functionality of the HIX System or corrupts or causes any material loss of data or otherwise affects critical data and for which no acceptable Workaround exists to achieve the required results. Client shall have the right to declare a Severity Level 1 Nonconformity based upon its assessment of the critical current and/or potential impact to internal Users or external end Users with no further severity level analysis required by Contractor.

Severity Level 2 Nonconformity – a Nonconformity that blocks important functionality of the HIX System where there is a Workaround, affects important data elements or causes as high risk that the HIX System will not perform important functions and for which an acceptable Workaround exists to achieve the required results. A Severity Level 2 Nonconformity may render non-critical functions of the HIX System inoperable with a Workaround or corrupts elements of data for key functions of the HIX System. Client shall have the right to escalate a Severity Level 2 Nonconformity to Severity Level 1 if, in Client’s reasonable judgment, sufficient progress is not being made toward resolution.

Severity Level 3 Nonconformity – means a Nonconformity that affects a useful functionality of the HIX System or non-critical data and for which an acceptable Workaround exists to achieve the required results. A Severity Level 3 Nonconformity may render minor or noncritical functions of the HIX system inoperable for limited periods of time and does not corrupt any data in the HIX System. A Severity Level 3 Nonconformity that is persistent or that affects a significant set of end Users may be escalated by Client, in its reasonable judgment, to Severity Level 2.

Severity Level 4 Nonconformity – means a Nonconformity that is not relevant to the HIX System functionality and for which a Workaround is not required for continued performance of the HIX System. A Severity Level 4 Nonconformity does not render any function in the HIX System inoperable and does not affect any data in the HIX System. A Severity Level 4 Nonconformity that is persistent or “high volume” may be escalated by Client to Severity Level 3.

Software Testing Life Cycle (STLC) – A defined, six (6)-phase process that the Contractor shall follow to test the MA HIX Application and ensure that all quality (including both compliance with industry standards for code quality and degree to which code meets functional and nonfunctional requirements) and Legal Requirements are met. Contractor’s STLC for this Contract is provided in Appendix B.

Standards, Policies, and Guidelines – Those standards, policies, and guidelines related to the Legal Requirements, this Contract, and the Services performed hereunder including those (i) referenced in this Contract and any amended, restated or successor standards, policies, and guidelines thereto, or (ii) that EOHHS includes or otherwise sets forth in a written notice to Contractor from time to time.

Subcontractors – A third-party vendor who has entered into a written agreement with Contractor for performance of any obligation under this Contract, excluding staff augmentation contractors; provided, however, that notwithstanding the staff augmentation vendor exclusion from this definition, Contractor shall comply with all Legal Requirements related to such staff augmentation activities and engagements.

System – The combination of software, hardware, data, network components and solutions, including third-party components and open source software contained therein, as well as any updates, upgrades, new versions, releases thereto utilized by (1) EOHHS as part of the HIX Program, or (2) the Contractor in the performance of Services in this Contract.

Task Order – An amendment to the Contract that specifies additional Services to be completed by the Contractor under the terms of this Contract as further specified in the Task Order.

Testing and Validation Unit – The Contractor’s organizational unit, established under and for the purposes of fulfilling its Testing and Validation obligations under this Contract.

Test Types (MA HIX Test Types) – The types of testing utilized for the MA HIX Program, detailed in Appendix C.

Time and Materials – Payment to the Contractor on the basis of the actual cost of direct labor, at the specified hourly rates, the actual cost of materials, travel, and equipment usage.

Transition Period – The period of time from Contract Effective Date up until the Contract Operational Start Date.

Transition Plan – A detailed written plan prepared by the Contractor and approved by EOHHS in writing which identifies all activities, schedules, data transfers Contractor Personnel and human resource issues, physical site issues, and any and all other issues associated with assuming full responsibility for the Services and all duties associated with this Contract, as set forth in Appendix I.

Turnover Plan – A plan prepared by the Contractor and approved by EOHHS explaining the Contractor's duties, processes, procedures and protocols regarding its responsibilities and Services under this Contract, and an approach for how such work and Services would transition to EOHHS or its agent upon the termination, expiration or non-renewal of this Contract.

Unconditionally Approved Deliverable – shall refer to a Deliverable which has been submitted to EOHHS and has been accepted by the EOHHS Project Manager and contains no Nonconformities or defects and meets the requirements specified in the Deliverable Expectation Document (DED).

User – An employee or representative of MassHealth or the Health Connector who has been granted access and assigned a username to access and utilize a System.

Warranty Period – The six (6) month period following the Contractor’s final submission of a Deliverable or Project Work to EOHHS.

Workaround – A temporary solution to a Deficiency or Nonconformity which results in the return of any Deliverable (or deliverable in the case of another HIX Program Vendor) to functional or operational status and which permits Client to perform its critical business functions. A Workaround may be deemed permanent as part of Acceptance (or acceptance in the case of another HIX Program Vendor), subject always to the express written agreement of the Parties.

CONTRACTOR RESPONSIBILITIES

Facilities Location The Contractor shall provide and maintain appropriate facilities as the principal places of business for the performance of its responsibilities under this Contract, for all Contractor Personnel. Such facilities must meet all Legal Requirements including those set forth in Section 2.1.B.1 and Section 2.1.B.3-4, below. In addition, no Services shall be performed from, and no data relating to the Services shall be received, processed, stored, maintained, kept, transmitted, or disposed of, outside of the United States without the express written agreement between the Parties, which agreement may be withheld by EOHHS for any reason.

As of the Contract Effective Date, the principal place of business is located at [insert address here] The Contractor shall not change the locations of facilities set forth in Section 2.1.A.1 without the prior approval of EOHHS and shall notify EOHHS of any proposed change at least 180 Calendar Days in advance of such proposed change.

Facility Features The Contractor shall ensure that office space, telephones, and computer equipment and networks, and other facility requirements EOHHS deems necessary to support performance of the Contract, are in a location conducive to system interface requirements with the Executive Office of Technology and Services and Security (EOTSS) and fully functioning no later than thirty (30) Calendar Days after the Contract Effective Date.

The Contractor shall provide an industry-standard off-site storage facility, to store records per applicable record retention statutes, regulations, rules, and policies. The Contractor shall ensure that the facility is located outside the Disaster range (within 20 miles of the of the Contractor's principal place of business) with its power supplied by a different utility company than the Contractor’s principal place of business.

The Contractor shall ensure that in the Contractor's principal place of business, any facilities including for off-site storage used by the Contractor and its Subcontractors in the performance of this Contract meet health care industry, state and federal standards for physical and data security (as well as any more stringent standards required under this Contract) and are covered by the appropriate insurance, with no less coverage than set forth in the RFR.

4. The Contractor shall ensure that it complies with the obligations in this Section and this Contract with respect to any Contractor Personnel working-from-home or providing Services or support thereto from any remote offices or facilities.

On-Site Presence EOHHS may, from time to time and with reasonable notice, request specified Contractor Personnel be on-site at the HIX Program office for a specified purpose and duration. Upon such request, the Contractor shall:

Make every good faith effort to comply with such request, and if unable to do so, shall work cooperatively with EOHHS to reschedule such visit for a mutually-agreeable time; provided that if such visit is for the purpose of an external audit or other meeting scheduled by an oversight agency, the Contractor shall comply.

Make every effort to utilize cost-effective means of transportation and accommodations.

Be reimbursed for travel and incidental expenses as set forth in Section 4.3, Travel Expenses.

Organizational Structure, Staffing, and Training Organizational Structure and Staffing The Contractor shall at all times ensure that the operation is flexible, scalable, and has the appropriate staffing, infrastructure, technology, and processes to provide Services and meet KPM standards set forth in this Contract appropriately and securely, in a manner that is conducive to satisfying all obligations under this Contract.

The Contractor shall maintain an organizational structure and staffing plan that supports and enables each of the Services detailed in the Contract. Such structure and staffing plan shall:

Reflect distinct units or teams responsible for each Service Category, and Be flexible, scalable, and responsive to fluctuations in demand that may impact any of the Services provided under this Contract.

The Contractor shall proactively project and anticipate potential fluctuations in demand (e.g., MA HIX Application release cycle, planned business events such as Open Enrollment) and adjust operational and administrative staffing accordingly to mitigate any negative impact in Services provided.

The Contractor shall reactively adjust to demand fluctuations by ensuring Contractor Personnel have the toolsets and processes to identify and escalate early warnings of standard deviations to anticipated volumes (e.g., new or irregular requests, patterns, or segments).

The Contractor shall designate, subject to approval by EOHHS, Key Personnel, as follows:

As of the Contract Effective Date, Contractor’s Key Personnel are:

· [insert: Title – Name]

· [insert: Title – Name];

EOHHS will have the final approval of all staff proposed as Key Personnel;

The Contractor shall ensure that, for the duration of the Contract, Key Personnel are assigned exclusively and full-time (defined as 8 hours per Business Day) to perform their job functions related to this Contract;

The Contractor, over the term of the Contract, including any extensions, shall take no action inconsistent with the terms of this Contract (in particular, the RFR, and the Contractor’s Response thereto) regarding the availability and assignment of named individuals to positions identified as Key Personnel, without the prior written approval of EOHHS; and The Contractor shall immediately notify Client in writing with the names and departure date of any departing Key Personnel and Contractor shall further confirm to Client in writing that such departing Key Personnel’s access to any HIX System has been terminated contemporaneously with their departure as a Key Personnel of Contractor. The Contractor shall notify Client in writing with the name(s) and resume(s) of any suitable and proposed replacements for approval by Client:

· for terminations, no later than the date of the termination;

· for resignations, no later than ten (10) Business Days prior to the effective date of the resignation;

· for transfers/promotions no later than thirty (30) Business Days prior to the effective date of the transfer; and

· for sudden or unanticipated vacancies, immediately or as soon as practicable.

The Contractor shall remove any Contractor Personnel upon request of the EOHHS for:

Inadequate performance: Within thirty (30) Calendar Days of notification; and Unprofessional conduct, including but not limited to insubordinate or disrespectful behavior toward Commonwealth personnel or violation of any Legal Requirement, including the EOHHS Workplace Policies: Immediately or within no more than fifteen (15) Calendar Days of notification, as determined by EOHHS in its sole discretion.

Notwithstanding sub-section 6 above, EOHHS may request, and Contractor shall comply with, immediate termination of access to any of its facilities, systems or applications for any Contractor Personnel if it determines, in its sole discretion, that such termination is necessary to safeguard the security of any Commonwealth or HIX Program Entity data, system, or personnel.

The Contractor shall promptly fill any positions relevant to the performance of the obligations set forth in this Contract that become vacant during the course of this Contract, with replacement of any Key Personnel, and any other position upon request of EOHHS, subject to EOHHS approval. If new Contractor Personnel are designated or existing Contractor Personnel are replaced pursuant to the terms of this Section 2.2, the Contractor shall smoothly transition such new or replacement Contractor Personnel into the project at no cost to EOHHS, providing such Contractor Personnel with the appropriate training to eliminate any delays in implementation or working under the Contract.

Contractor shall be responsible for meeting all of the requirements of this Contract notwithstanding any staffing deficiencies or vacancies.

The Contractor shall conduct background checks on all Contractor Personnel prior to their assignment or designation to perform services under this Contract. Such background checks shall include:

confirmation of residence history;

employment history;

education history;

verification of identification;

work authorization status;

a criminal background check in accordance with the Legal Requirements, including but not limited to 101 C.M.R. 15.00;

drug screening; and a FACIS Level 3 search of government databases for sanctions by federal and state agencies.

The Contractor shall also be responsible for obtaining signed attestations or other similar documentation with respect to the above and any other Legal Requirements or as reasonably requested by EOHHS.

The Contractor shall maintain an alphabetical listing of the names, titles, responsibilities, telephone numbers, e-mail addresses, and Social Security numbers (as required for systems access) for all Contractor Personnel and Subcontractor personnel who will perform Services under the Contract and provide such listing to EOHHS no later than thirty (30) Calendar Days prior to the Contract Effective Date and upon any changes to the listing The Contractor represents and warrants that it has completed the I-9 Process for all Contractor Personnel hired for employment in the United States who are performing Services in the United States and that all such Contractor Personnel are authorized to work for Contractor in the United States. Contractor acknowledges and agrees that Client is under no obligation to assist Contractor in obtaining any work permits for such Contractor Personnel to work in the United States.

In no event will any Contractor Personnel be considered employees of Client. For the avoidance of doubt, neither Contractor nor any of Contractor Personnel are entitled to any medical or dental coverage or life or disability insurance from Client, or entitled to participate in any Client pension or any other benefits afforded to any Client employees. All matters governing the employment of Contractor Personnel shall, as between Client and Contractor, be Contractor’s full responsibility. Contractor shall be responsible and liable for all actions and inactions of the Contractor Personnel, including without limitation, such Contractor Personnel’s compliance with the terms of this Contract. Contractor assumes full responsibility for the actions of Contractor Personnel while performing Services.

Contractor shall be responsible for the supervision, direction and control of all Contractor Personnel performing Services. Contractor shall be responsible for the payment of compensation (including withholding of taxes and Social Security), contribution to workers’ compensation and unemployment compensation, overtime, disability benefits and any other legally required benefits or compensation or discretionary benefits or compensation for Contractor Personnel who are assigned to perform Services.

In addition to, and notwithstanding anything to the contrary contained in, the Commonwealth Terms and Conditions for Information Technology Contracts, Contractor agrees to fully defend, indemnify and hereby hold Client Indemnitees harmless from and against any amounts payable resulting from a third-party claim, suit, demand, loss, damage, cost, expense or liability, including reasonable attorneys’ fees, relating to (a) any violation of immigration law by Contractor or Contractor Personnel and (b) Contractor’s obligations to its employees and other Contractor Personnel. Any immunity or exclusivity of any labor, workers’ compensation, or similar statute applicable to Contractor will not in any way limit or preclude Contractor’s obligation to provide indemnification hereunder. The foregoing indemnity will not be limited in any manner whatsoever by any required or other insurance coverage maintained by Contractor.

Contractor shall ensure that each and all Contractor Personnel providing Services under this Contract (for the avoidance of doubt, inclusive of employees, agents, and subcontractors), shall, prior to rendering any Services under this Contract, sign the “Intellectual Property and Work Effort Agreement for Vendor's Employees, Contractors, Consultants, and Agents” (the “IPAWE Agreement”) which is attached hereto as Appendix K.