HIX PMT RFR Attachment C - MA HIX Reference Material__20220209.pdf

Massachusetts Health Insurance Exchange Program Project Management and Testing Services

Request for Responses

Massachusetts Health Insurance Exchange Program, Project Management and Testing Services Request for Responses 1 Attachment C, Reference Material

Attachment C

Reference Material

Massachusetts Health Insurance Exchange Program, Project Management and Testing Services Request for Responses 2

INTRODUCTION

This document provides a summary of certain key features of the MA HIX Program, the MA HIX Application, and the MA HIX/IES System.

It was compiled and is being provided solely as a courtesy to prospective bidders on the MA HIX Program Management and Testing Request for Responses to assist in the preparation of responses.

No information contained herein is intended to replace any existing policy, process, procedure, or contractual requirement documented elsewhere, nor is it offered as a complete representation of the MA HIX Program, the MA HIX Application, and the MA HIX/IES System, and their complexity; rather, it is a point-in-time snapshot of aspects of their current state as of the date that this RFR is published.

MA HIX/IES SYSTEM PURPOSE

MA HIX is the Commonwealth’s health insurance exchange and integrated eligibility system that serves the Commonwealth Health Insurance Connector Authority (the Health Connector) and certain MassHealth (Medicaid) populations. This includes application and eligibility determination for MassHealth’s MAGI Medicaid and Children’s Health Insurance Program (CHIP), and the Health Connector’s Qualified Health Plan (QHP) and Advance Premium Tax Credit (APTC) programs, as well as plan enrollment for QHPs.

Approximately 1.5 million Commonwealth residents are enrolled in health insurance coverage through the HIX/IES.

MA HIX PROGRAM GOVERNANCE

Additional detail regarding program governance can be found in the MA HIX Program Management Plan.

Commonwealth leadership is provided by the Executive Committee (EC) shown in Figure 1.1 below. The EC consists of senior leadership from MassHealth, the Health Connector, and

EOHHS.

Responsibilities of the Executive Committee include:

• Executive oversight of all aspects of the MA HIX Program;

• Short- and long-term strategic planning;

• Business sponsor input and approval of the HIX/IES business priorities as represented in the Functional and Technical Roadmap and Strategic Release Schedules;

• Approvals of schedule, scope and costs including approved contract task orders and change requests;

• Oversight of major program risks and issues;

• Leadership on MA HIX business events; and

Massachusetts Health Insurance Exchange Program, Project Management and Testing Services Request for Responses 3

• Executive vendor relationship management.

The HIX Program Director reports to the MassHealth Chief Operating Officer and, with oversight and guidance from the Executive Committee, is responsible for managing all aspects of the MA HIX Program. The Program Director exercises oversight of six director-level positions: Enterprise Architect, Director of Program Planning and Administration;

Application Director; Security & Privacy Compliance Director; Director of Operations and Maintenance; and Director of Integrated Eligibility Initiatives.

Figure 1.1 MA HIX/IES Executive Committee and Program Leadership

HIX Executive Committee: 3 Entities Governance Principle: Any vote that is not unanimous may be elevated to the

Secretary by any voting entity

Secretary

EOHHS

CCA Policy/Legal

CCA Operations

UMMS SMEs

MassHealth Policy/Legal

MassHealth Eligibility Operations

HIX Program Director

A&F (Oversight)

EHS Finance

EHS IT Ops

EOTSS

(Oversight)

Director, Integrated Eligibility InitiativesApplications DirectorDirector, Operations &

Maintenance Director, Program Planning

& Administration HIX Enterprise Architect Director, Security &Privacy Compliance

EHS A&F (1 vote)

Asst. Secretary

CCA (1 vote)

Executive Director

MassHealth (1 vote)

MassHealth COO

MA HIX VENDOR ENVIRONMENT

A description of the primary MA HIX Vendors is provided in Section 2.2 of the Request for Responses.

In addition, EOHHS has contracted with CSG Government Solutions, Inc. (CSG) to perform Independent Validation and Verification Services (IV&V) that comply with the Centers for Medicare and Medicaid Services (CMS) IV&V requirements.

As the IV&V Contractor, CSG advises the Commonwealth and other stakeholders invested in the MA HIX Program on several components such as project planning (e.g., schedule, management approaches and tools); procurement development, evaluation and administration;

program management and project risks; vendor integration; service level agreements (SLA's);

and any other aspect of the project that might affect its success. In addition to IV&V activities related to the project's compliance with regulations and requirements, CSG performs project-based services at the request of the HIX Program focusing on such topics as requirements traceability through the life cycle; technology design and development; and implementation

Massachusetts Health Insurance Exchange Program, Project Management and Testing Services Request for Responses 4 quality. HIX Program Vendors are required to cooperate fully with all IV&V activities related to project compliance with regulations and requirements.

Other vendors and third parties provide MA HIX-related services but are not contracted with or under the management of the MA HIX Program. These include but are not limited to print and mail vendors for the printing and mailing of member/applicant notices generated by the MA HIX, MassHealth and Health Connector call centers, and vendors providing downstream services (e.g. enrollment, billing, and payment) for MassHealth and the Health Connector.

ROLES AND RESPONSIBILITIES

The PMT Vendor will be assuming responsibility for some of the tasks and activities currently provided by the Commonwealth and current vendors. These current and anticipated future roles and responsibilities are summarized in the following table. This summary is not intended to replace, augment, or correct any other documented policy, process, procedure, contract or procurement document. It is to serve only as an illustration at a high level of the allocation of responsibilities, and is being provided as a convenience to potential Bidders solely for the purposes of providing additional context for the preparation of Responses.

Activity Current Future Program Governance and Strategic Direction

Commonwealth Commonwealth

Vendor Contract Management Commonwealth Commonwealth Vendor Dispute Resolution Commonwealth Commonwealth Program Tools Management and Administration

Commonwealth Commonwealth

Program Management Commonwealth • Commonwealth: Governance and Oversight

• PMT Vendor: Management and execution

Vendor Coordination Commonwealth PMT Vendor Deliverables Management Commonwealth PMT Vendor Document/Information Management including maintaining currency of documentation/information

Commonwealth PMT Vendor

Requirements Management (including maintaining currency of data in RM tool)

Optum PMT Vendor

HIX Application – License Optum Optum Unit testing

Optum

• Optum

• PMT Vendor (Testing function) to review and analyze results

• PMT Vendor (PM function) to coordinate/facilitates/schedules Accessibility Testing Optum • Optum

• PMT Vendor (Testing function) to review and analyze results

• PMT Vendor (PM function) to coordinate/facilitates/schedules

Massachusetts Health Insurance Exchange Program, Project Management and Testing Services Request for Responses 5

Activity Current Future Security testing (including SIT/Product/Regression Security testing)

Optum • Optum

• PMT Vendor (Testing function) to review and analyze results

• PMT Vendor (PM function) to coordinate/facilitates/schedules System Maintenance Optum • Optum (code fixes); OTS Vendor

(implementation)

• PMT Vendor to coordinate/facilitate

Technical Support Optum; Smartronix • OTS Vendor; Smartronix

• PMT Vendor to coordinate/facilitate

Application Operations Optum • OTS Vendor

• PMT Vendor to coordinate/facilitate

Testing (See Attachment A, Model Contract, Appendix C, Testing Types)

Optum • PMT Vendor (Testing function)

• PMT Vendor (PM function) to coordinate/facilitate Test Strategy and Planning Optum PMT Vendor Test case development Optum PMT Vendor Test execution (excluding unit, security, and UAT)

Optum PMT Vendor

Release Management Optum PMT vendor Schedule management Optum PMT Vendor Environment Management Smartronix • Smartronix (Primary)

• OTS vendor (secondary)

• PMT Vendor to coordinate/facilitate

Code delivery Optum • Optum; OTS Vendor

• PMT Vendor to coordinate/facilitate

Implementation Optum • OTS Vendor

• Smartronix (migration via pipeline)

• PMT Vendor to coordinate/facilitate

Product Documentation Optum • Optum

• PMT Vendor to coordinate/facilitate

Configuration Management Optum • OTS Vendor

• PMT Vendor to coordinate/facilitate

QA validation Optum PMT Vendor to coordinate/facilitate Release Readiness Review Optum PMT Vendor to coordinate/facilitate Provides Cloud infrastructure hosting and managed services

Smartronix Smartronix

Infrastructure certificate management Smartronix Smartronix Infrastructure related security services Smartronix • Smartronix

• PMT Vendor to coordinate/facilitate Identity and Access Management Optum (Optum ID) • Commonwealth (Azure AD) Identity & Access Management: User Authentication & Password Management for HIX System Users

Optum • OTS Vendor

• PMT Vendor to coordinate/facilitate

Identity & Access Management:

Privileged Access Management

Smartronix • Smartronix

• PMT Vendor to coordinate/facilitate

Reporting Services

Optum PMT Manages and coordinates among vendors

Massachusetts Health Insurance Exchange Program, Project Management and Testing Services Request for Responses 6

Activity Current Future Data Reporting Services

Optum PMT Manages and coordinates among vendors

Provide enhanced general database administration ("DBA") support.

Optum OTS Vendor

Perform database exports and refreshes required to provide databases to lower environments

Optum OTS Vendor

Import and export database tables. Optum OTS Vendor Coordinate action items, event notification, requirements development and scheduling resources for items arising out of meeting attendance.

Optum PMT Vendor

Engage in and support business process development and improvements

Commonwealth PMT Vendor

Provide technical input and investigation support of non-infrastructure related issues and errors

Optum • OTS Vendor

• PMT Vendor to coordinate/facilitate

Make changes to existing automation pipelines.

Smartronix • Smartronix

• OTS Vendor to support

• PMT Vendor to coordinate

Provides support for the Commonwealth’s automated testing initiative with Selenium.

Optum PMT Vendor

Support the HIX/IES Program in infrastructure related release management, and O&M activities.

Smartronix

• Smartronix

• OTS vendor to support

• PMT Vendor to coordinate/facilitate

COMPLIANCE AND REGULATORY ENVIRONMENT

The HIX/IES operates in a highly regulated environment, at both the state and federal level, with expansive regulations requirements for safeguards and protocols to protect systems and data.

Compliance with required safeguards and protocols is undertaken to help protect systems and data. Such requirements may change over time as new standards are implemented and the threat landscape continues to evolve. As such requirements, policies, standards, and laws evolve, the MA HIX Program environment will need to change to remain in compliance. Changes are implemented as required and are considered normal HIX/IES Program activities. A summary of applicable laws and regulations is provided in Attachment F.

PROGRAM MANAGEMENT PLAN

The MA HIX Program Management Plan (PgMP) is a comprehensive set of policies and procedures governing the MA HIX Program. In its current iteration, the PgMP reflects the current vendor mix, and is largely focused on current Optum-Commonwealth practices. The PgMP will be updated as necessary following the execution of the PMT and OTS contracts.

Massachusetts Health Insurance Exchange Program, Project Management and Testing Services Request for Responses 7

MA HIX APPLICATION OVERVIEW

1.1 Functionality

The MA HIX/IES includes application and eligibility determination for MassHealth’s MAGI Medicaid and CHIP programs and the Health Connector’s QHP, and APTC programs, and plan enrollment for QHPs. Key functions of the system include: application intake (single front door); initial eligibility determination, redeterminations, and renewals; calculation of premium amounts, subsidies, and credits; plan comparisons; and plan enrollment. Users include individuals/families; employers; brokers; state agency staff and vendors; enrollment assisters;

and Navigators.

The MA HIX/IES provides system access via three portals: (1) the public-facing Individual portal for individuals and families; (2) the public-facing Assister portal for Certified Application Counselor organizations (including Navigators) to provide assistance to individuals and families with their applications; and (3) the internal Agent portal that provides role-based access to MassHealth and Health Connector staff (and third-party customer service staff) to perform case management and customer service activities. The number of active users for each portal is provided in the table below:

MA HIX Portal active Users (as of 2/4/21)

Portal Active Users Agent 1,971 Assister 615 Individual 1,893,995

In addition to these portals, there are approximately 180 batch jobs – both automated and manual

– that are run regularly to support various data transfers and other critical operational needs for

MA HIX.

The MA HIX system is available 24 hours a day and 365 days a year, except for scheduled maintenance windows.

The most critical annual business event supported by the MA HIX is Open Enrollment (OE).

This is the annual enrollment period (pursuant to §18031(c)(6)(B)), during which qualified individuals may enroll or change coverage in a QHP. OE does not apply to individuals eligible for MassHealth. OE begins on November 1 and, in Massachusetts, ends on January 23. In support of the annual OE period, testing begins in May and annual redetermination and plan loading activities take place throughout August, September and October. Enrollment activities take place in November, December and January. While OE does not apply to individuals eligible for MassHealth, all members in “mixed households” (those with members eligible for both MassHealth and the Health Connector) are included in the OE processes. As a result, volume of the transactions on the MA HIX is highest during this time.

Massachusetts Health Insurance Exchange Program, Project Management and Testing Services Request for Responses 8

In 2020, system usage peaked in December, with an average of 689,747 user sessions across all three portals. Agent Portal usage also peaked in December, with 131,989 user sessions, while Individual and Assister Portals usage peaked in January 2021, with 547,211 and 29,412 user sessions, respectively.

1.2 Scope and Scale

The MA HIX Program’s Requirements Management tool, MicroFocus (formerly HP) Application Lifecycle Management (ALM) tool, contains more than 6,400 business requirements, largely categorized on the basis of functional group (Vital Business Function, VBF): application intake (single front door); initial eligibility determination, redeterminations, and renewals; calculation of premium amounts, subsidies, and credits; plan comparisons; and plan enrollment.

This represents a subset of MA HIX business requirements; there is a significant, yet unquantified, number of requirements captured in documentation but not reflected in ALM.

Additionally, non-functional requirements are also not documented in ALM.

The table below summarizes the requirements documented in ALM by functional group.

VBF Requirements Back Office 624 CCA Renewals 171

COLA 13

Enrollments 234 Household Composition & Income Inclusion 173 MH Renewals 199

MMIS 115

Non-Functional 58 Notices 706

PA 411

PB 56

PDM 105

Program Determination - Benefits 306 Program Determination - Processes 812 RFIs 500 Static - 2021 APTC Changes 9 Static - Accessibility 24 Static – AVR 22 Static – AVV 33 Static – CSI 27 Static - Database Logging 15 Static - DOR COMETS 70 Static - Google Tag Manager 5 Static – IDM 3 Static - MWS 18 Static - Payment Portal 7 Static - Plan Management 120

Massachusetts Health Insurance Exchange Program, Project Management and Testing Services Request for Responses 9

Static - Reports 261 Static – SOA 5

UI/UX 1011

#N/A 2 (blank) 376 Grand Total 6491

SYSTEM DESIGN

Key features of the MA HIX are summarized below:

1.3 Infrastructure

The MA HIX/IES infrastructure is built in the commercial Cloud managed by Smartronix using Amazon Web Services (AWS).

Smartronix Cloud Assured Managed Services (CAMS) performs automated monitoring and alerting on system capacity events. Smartronix also performs periodic review and analysis of the system capacity across database and application instances and engages the MA HIX Program team to adjust the capacity size on proactive basis.

Smartronix CAMS performs automated monitoring of system performance across database, application and web tier and takes remediation action when critical alerts are triggered.

The database is deployed on the AWS Relational Database Service (RDS) platform, and this allows for the configuration of performance-related parameters:

1. Scale up/down Instance Class to increase/decrease instance CPU and Memory.

2. Provisioned Input/output Operations Per Second (PIOPS) to throttle the storage I/O performance.

The application tier is deployed in the multi-node auto-scaling configuration which allows for the addition or removal of nodes quickly as needed. Additionally, the capacity and throughput of each server instance can be throttled by changing the instance type based on throughput, performance, and scale needs.

1.4 Environments

There are several environments configured for different purposes. All the environments are within the AWS virtual Palo Alto firewall for compliance. Current environments and their default availability are shown in the following table. Requests to alter the availability of existing environments or to add new environments are handled via the Change Management process.

Massachusetts Health Insurance Exchange Program, Project Management and Testing Services Request for Responses 10

Hosting Environment Availability: Minimum Availability for Established Environments

(All times are Eastern Standard Time)

Environment/Purpose

Permanent

SIT Testing Phase

UAT Testing

Phase

Automated Regression

Testing Phase

Break/Fix

Pre-SIT (Development

Phase)

Production (Prod) End user Access (Commonwealth Portal Pages)

24 x 7 x 365

Training (TRN) Training Instance, used for Commonwealth User Training

Default: OFF

PL - Development (DEV 1) Optum Release Engineering – Code shakeout environment – TT Enabled

Mon – Fri 1:30 am - 6 pm

Mon – Fri 8 am - 6 pm

Development (DEV) Optum Release Engineering – Code shakeout environment. Softheon Carrier Testing – TT Enabled

Mon – Fri 1:30 am - 6 pm

PL - Quality Assurance (QA 1) Optum Testing functional release/regression testing

1:30 am - 6 pm

Quality Assurance (QA) Optum Testing functional release/regression testing

1:30am - 6 pm

PL - Integration (INT 1) CCA and MH Acceptance Testing

Integration Test (INT) CCA and MH Acceptance Testing

Development (DEV 2) MassHealth Automation Testing

Break/Fix (Stage 1) Production break-fix staging and testing

Mon – Fri 1:30 am - 6 pm

8 am - 8 pm

Stage 2 (STG2) Similar to production with no FTI data.

Used for batch performance/security and other non-functional testing

Mon – Fri 1:30 am - 6 pm

Mon – Fri 1:30 am -

6 pm

HCSE

Sandbox Environment for Optum to test in Optum infrastructure

Mon – Fri 1:30 am - 6 pm

Mon – Fri 1:30 am - 6 pm

Time Travel (TT3) Time Travel Instance – Used for changing the system clock to trigger certain events

Time Travel (TT4) Time Travel Instance – Used for changing the system clock to trigger certain events

Staging (STG) Similar to production with no FTI data.

Used for portal performance/security and other non-functional testing

24 x 7 x 365

Massachusetts Health Insurance Exchange Program, Project Management and Testing Services Request for Responses 11

1.5 Infrastructure Availability

The HIX solution in the AWS cloud is deployed across three availability zones (each, an AZ) to improve infrastructure and service availability. The AWS RDS platform with multi-AZs enables synchronization and automatic failure detection and failover.

1.6 System Interfaces

The HIX is dependent on several external data sources to provide data and/or verify data provided by the user. These include:

• Eligibility Verification Services: These are services which query external data sources to obtain specific information used in program determination (PD). The Federal Services Data Hub (FDSH) and state-based Trusted Data Sources (TDSs) are used to query systems for information in helping in determining applicant health plan eligibility. These federal and state TDSs include:

o Federal HUB services (SSA, IRS, DHS, Non-ESI MEC and Experian) o MMIS (Non-ESI MEC and Account Transfer for MAGI) o MA-21(Account Transfer for non-MAGI) o Plan Data (MA Health Connector) o LexisNexis (MA State residency check) o USPS (Address Standardization) o Department of Revenue (DOR) o Department of Transitional Assistance (DTA) o Maximus (Premium Billing)

• Account Transfer Services: These services are used by MassHealth and the Health Connector following program determination:

o The MassHealth MMIS system, used for Medicaid enrollment, notice, and reporting for the Commonwealth.

o The Softheon QHP Service, used to process QHP enrollment, support notice generation for the QHP population, and perform billing activities (Financial Management System, FMS).

• Other External Processing Subsystems: These services perform specific processing functionality for t h e MA HIX such as identity management, notice generation, and the daily data extract (DDE) used for the Commonwealth’s reporting requirements.

1.7 Data Sources

Federal Data Services Hub (FDSH) Services These services are provided through the FDSH and used during program determination (application intake, annual renewal, and periodic data matching).

• Internal Revenue Services (IRS) – Provides two services:

Massachusetts Health Insurance Exchange Program, Project Management and Testing Services Request for Responses 12 o Income Family Size Verification (IFSV): Calculates individual’s Modified Adjusted Gross Income (MAGI), utilizing information provided on the application for assistance and the individual’s latest available tax return.

o Advance Premium Tax Credit (APTC): Calculates the maximum amount of monthly Advance Premium Tax Credit (APTC) for which a tax household is eligible.

• Non-Employer Sponsored Insurance (ESI) Minimum Essential Coverage (MEC) – Verifies eligibility/ineligibility for any of the public MEC health plans (i.e., Medicaid/CHIP, BHP, Medicare, Tricare, VHA, or the Peace Corps) when an individual applies for subsidized

QHP.

• Social Security Administration (SSA) – Performs a number of verifications and gathers additional information for applicants when an individual enters Social Security Number (SSN) information for themselves and their household members.

• Remote Identity Proofing (RIDP) Precise Identity – Utilizes Experian Credit Reporting System's Precise Gateway product via the FDSH to verify the identity of the primary account holder of a MA HIX user account.

• Verify Lawful Presence (VLP) – Retrieves immigration or citizenship status from DHS (Department of Homeland Security) for use in determining eligibility for enrollment in a Qualified Health Plan (QHP).

• Renewal and Redetermination Verification (RRV) – Sends application information via the FDSH for verification against the SSA, IRS and Medicare Trusted Data Sources (TDS) for existing member/enrollees who are eligible for program redetermination, based on MA HIX selection and bypass criteria.

Commonwealth Data Services The following are Commonwealth data services that interact with, send, receive, or use data from

MA HIX.

• MA21: MassHealth non-MAGI eligibility system, used to determine if certain individuals are eligible for MassHealth programs based on their disability status.

• Department of Revenue (DOR): Current income (employer-reported wages) information from DOR supplements Modified Adjusted Gross Income (MAGI) information when the latter is not verified via the FDSH in the eligibility determination process.

• DOR – Commonwealth of Massachusetts Enforcement Tracking System (COMETS): To support state child support enforcement activities, MA HIX/IES sends data to COMETS in response to certain eligibility data triggers.

• Medicaid Management Information System (MMIS): to support validation of minimum essential coverage (MEC) eligibility, MA HIX conducts the Medicaid and CHIP verifications through the External Member Web Service interface provided by state-owned MMIS.

• Transfer Eligible Supplemental Nutrition Assistance Program (SNAP) members to Department of Transitional Assistance (DTA): To facilitate the enrollment of eligible individuals into SNAP, send applicant/member information captured in HIX to DTA for SNAP eligibility determination.

Massachusetts Health Insurance Exchange Program, Project Management and Testing Services Request for Responses 13

• Automatic Voter Registration (AVR): To facilitate voter registration by qualified applicants via the HIX application, a HIX daily batch process selects all newly-registered individuals and creates a file for consumption by the Secretary of State’s office via the CA API Gateway.

• Health Safety Net (HSN)

• My Workspace (MWS): MassHealth application that supports electronic document management, including and includes MWS Document Processing Integration and Managed Documents Online (MDO).

Third Party Data Services These systems are neither federal nor Commonwealth-based services but they interact with, send, receive, or use data from MA HIX.

• Accenture: Supports Premium Assistance for MassHealth

• HMS: Supports Premium Assistance for MassHealth, to be decommissioned in 2021

• Maximus: Supports Premium Billing for MassHealth

• Lexis-Nexis: Identity Verification

• Softheon: Supports enrollment, notice generation and display, and billing for the Health

Connector

• Payment Portal: Supports payments to the Health Connector

• United States Postal Service (USPS): Supports address validation

• Consumer’s Checkbook: Supports plan search and selection for the Health Connector by providing health care provider and drug formulary information

• University of Massachusetts Medical School: Supports premium assistance for MassHealth

External Processing Subsystems

• Notices: There are currently approximately 30 applicant and member notices that are generated out of the MA HIX as part of the eligibility determination process. Health Connector notices and MassHealth notices have different flows and leverage different printing vendors – Softheon for the Health Connector, and both EOTSS (referred to as ITD in the context of Notices) and Standard Modern for MassHealth. MA HIX also supports notice generation in the Spanish language.

• Identity Access Management: MA HIX currently utilizes Optum ID version 2.0, Optum’s solution used for identity management; however, this expected to be transitioned to AzureAD in Q1 or Q2 of 2022.

• Daily Data Extract (DDE): An extract of data from the MA HIX database which is provided to the MassHealth and CCA data warehouses.

1.8 Environment Connectivity to External Interfaces

Connectivity to external services is established via interfaces. The specifications of each interface are provided in the appliable Interface Control Documents (ICDs). ICDs will be provided to the Contractor following Contract execution.

Massachusetts Health Insurance Exchange Program, Project Management and Testing Services Request for Responses 14

Information is exchanged via one of two methods:

• Application: Application server or the batch server initiates a request, and these requests are sent via Jboss Fuse server, which in turn changes the XML into the appropriate format for the interface. These are then sent to the service via a high-speed API Gateway that uses the signed certificates to interact with the external service and sends the response back to Fuse and in turn to the requesting application.

• FTP, using AxWay’s secured Managed File Transfer (MFT).

In addition to these two methods of information exchange, IBM’s MQ Servers are used to upload documents to the Commonwealth’s Electronic Document Management (EDM) system.

A Stub service allows for testing of the Federal Data Services Hub (FDSH), eliminating the risk of sensitive data being exposed. In certain limited circumstances where data verification is required during controlled testing, a particular environment may be connected to the FDSH, but by default all testing environments are always connected to the Stub.

RELEASE MANAGEMENT

The MA HIX Program’s Applications Team is responsible for release scope, release scheduling, and overseeing release management activities as executed by Optum in coordination with

Massachusetts Health Insurance Exchange Program, Project Management and Testing Services Request for Responses 15

Smartronix. MA HIX Program Leadership is jointly responsible for approving deployment to production for all major and minor releases.

1.9 Number of Functional Releases

There are 2-3 major functional releases each year. Historically, each major release has been followed by a minor release focused on defect remediation but in some cases includes additional functionality.

1.10 Release size

Currently, the size and scope of releases vary depending on several factors, including but not limited to business priorities, regulatory requirements, development capacity, testing capacity, and cost.

The table below provides the number of business requirements, test cases, and test executions for the four most recent Major Releases:

Release # Release Deployment

Date

# of Functional Worktracks

# of Business Requirements

# of Test Cases* # of Test Executions*

21 8/10/20 19 265 1443 2710 22 12/16/20 32 183 1204 2648

22.5 3/30/21 5 49 336 989 23 7/29/21 28 303 1857 5383

* Test cases against release requirements only, excluding such testing as regression, security, and performance.

1.11 Duration of Release Cycle

The current release cycle lasts approximately 9 months, excluding Project Close-Out activities.

Release activities and deliverables are currently governed by a contractually-defined Software Development Lifecyle (SDLC) agreed to by the Core Application Vendor and the Commonwealth.

The following illustrates a typical release schedule.

Release 24.0 Activity/Deliverable Planned Start Planned Finish Planning Fri 1/8/21 Mon 3/29/21 Requirements Wed 3/17/21 Mon 12/13/21 Design Fri 8/14/20 Tue 11/9/21 Functional Specifications Design Document (FSD) Fri 7/16/21 Fri 8/13/21 ICD Preparation Tue 10/5/21 Tue 11/9/21 System Architecture Document Thu 7/8/21 Fri 8/27/21 Technical Design Document (TDD) Wed 9/22/21 Wed 10/20/21

Massachusetts Health Insurance Exchange Program, Project Management and Testing Services Request for Responses 16

Master Test Strategy Wed 8/25/21 Fri 9/24/21 Development and Migration Mon 5/17/21 Fri 12/3/21 Sprints Mon 5/17/21 Fri 10/1/21 Sprint 0 Mon 5/17/21 Fri 5/28/21 Sprint 1 Tue 6/1/21 Fri 6/11/21 Sprint 2 Mon 6/14/21 Fri 6/25/21 Sprint 3 Mon 6/28/21 Fri 7/9/21 Sprint 4 Mon 7/12/21 Fri 7/23/21 Sprint 5 Mon 7/26/21 Fri 8/6/21 Sprint 6 Mon 8/9/21 Fri 8/20/21 Product Testing (Hardening and Regression) Mon 8/23/21 Fri 10/1/21 HCSE Testing Thu 9/9/21 Fri 10/1/21 Build 1 (24.0) Tue 6/1/21 Thu 10/21/21 Develop Code Tue 6/1/21 Mon 10/4/21 Build 1 Deploy Mon 10/4/21 Thu 10/21/21 Data Migration, Corrections, and Configuration Mon 10/4/21 Thu 10/14/21 Build 2 (24.0.1) Wed 9/22/21 Fri 11/19/21 Build 3 (24.0.2) Wed 10/27/21 Fri 12/3/21 Integration and Testing Mon 8/9/21 Tue 12/14/21 Test Design Mon 8/9/21 Fri 11/19/21 Requirement Traceability Matrix (RTM) Mon 10/25/21 Fri 12/10/21 Release Test Plan Wed 8/25/21 Mon 9/20/21 Execute Test Cases Tue 10/5/21 Tue 12/14/21 Execute SIT Test Cases Tue 10/5/21 Tue 12/14/21 Test Cycle 1 Tue 10/5/21 Fri 10/22/21 Execute Test Cases Tue 10/5/21 Fri 10/22/21 Execute Pre-prod Test cases Tue 10/5/21 Fri 10/22/21 Execute Regression Test Cases Tue 10/5/21 Fri 10/22/21 M: Defect Cutoff Fri 10/22/21 Fri 10/22/21 M: Code Freeze Mon 10/25/21 Mon 10/25/21 M: Build 1 Testing Completed Fri 10/22/21 Fri 10/22/21 Test Cycle 2 Fri 10/29/21 Wed 11/24/21 UAT Testing 1 Fri 10/29/21 Fri 11/19/21 Test Cycle 3 Wed 12/1/21 Tue 12/14/21 UAT Testing 2 Wed 12/1/21 Tue 12/14/21 Implementation Mon 10/4/21 Fri 2/4/22 Cut-over Planning Fri 11/19/21 Wed 12/15/21 Implementation Plan Fri 11/19/21 Wed 12/15/21 Deployment Checklist Tue 11/23/21 Tue 12/14/21 Configuration Guide Tue 11/23/21 Tue 12/14/21 Release Cutover Plan (RCP) Tue 11/23/21 Wed 12/15/21 O&M Transition Plan Mon 11/22/21 Thu 12/30/21 Business Preparation Tue 11/30/21 Tue 12/14/21

Massachusetts Health Insurance Exchange Program, Project Management and Testing Services Request for Responses 17

Operational Workarounds Tue 11/30/21 Tue 12/14/21 Training Mon 10/4/21 Thu 12/16/21 User Guide: Group 1 Tue 10/12/21 Wed 11/3/21 User Guide: Group 2 Wed 10/20/21 Thu 12/16/21 Go Live Tue 12/14/21 Fri 2/4/22 Go No Go Checkpoint #1 Tue 12/14/21 Tue 12/14/21 Go No Go Meeting Wed 12/15/21 Wed 12/15/21 Deploy-Go Live Thu 12/16/21 Thu 12/16/21 Deposit Escrow Fri 12/17/21 Tue 1/18/22 Upload Custom Code Fri 12/17/21 Fri 2/4/22 Evaluation and Transition Fri 12/3/21 Wed 2/9/22 Post-Production Validation Fri 12/17/21 Mon 1/10/22 Release Closeout Date Thu 1/27/22 Wed 2/2/22 Test Summary Report Fri 12/3/21 Thu 1/20/22 Lessons Learned Fri 12/17/21 Wed 1/26/22 Project Work Close out Thu 2/3/22 Wed 2/9/22

1.12 Release delivery

The current release delivery process, provided for illustration purposes only, is depicted below:

Massachusetts Health Insurance Exchange Program, Project Management and Testing Services Request for Responses 18

1.13 Technical-only releases

Technical-Only releases are underlying software upgrades that do not include application software changes. Examples include Oracle upgrades and JBoss Fuse upgrades. These upgrades go through the same testing cycles as a normal release.

TESTING

The MA HIX Program’s Applications Team is responsible for overseeing all testing activities (excluding unit testing and security testing performed by Optum and UAT performed by HIX Business Owners). Test strategy, release test plans, and test cases are developed by Optum, with review and approval provided the MA HIX Program staff with input from Business Owner subject matter experts.

Major/ Minor Release Management Process Optum Dev and QA Optum Impl Release Management Optum Deployment Team

Release documentation

Code Delivery

- Revision Number, Branch, Server

- Build URL

- Migration Scripts, write up, master doc

- Data correction scripts, write up, master doc

- SQL patches, master doc

- Properties master doc, MAHIX doc

- Batch job Doc

- Code merge

- IAD document and discussion

- Test excution reports

- Security sign off

- Release notes doc

- Defect fixes delivered (internal defects fixed, AML fixed, Accessibility, known issues, regression test result)

- Known issues list

- Static and Dynamic code reports

- Defects impact analysis

Dev and QA readiness review completed

Release readiness review complete

QA approval received

Deployment scheduled

Conduct initial validation and initiate

Deployment Complete Status communication to

Stakeholder

Deploymentment successful

Draft release documentation recevied and reviewed

Yes

Yes

Yes

Yes

No

Package delivered to Optum and release notification sent

No

No

Stakeholder Communication

Conduct release handover discussion with Optum release, QA and PMO teams

JIRA Approval

- Documentations readiness

- All internal reviews completed

No

Online Release Calendar

- Delivery date

- Production date

- Delivery JIRA reference

- PoCs for various docs

Input from PMO

- Release date

- Release version number

- Release Scope

Stakeholder Communication

Stakeholder Communication

Track smoke test result and assist in issue resolution

Assist in resolution of release/ package related deployment issues

No

Yes

Track deployment schedule with Optum QA and PM team

Verify package and start deployment

Attend deployment call and address any issues

No

Share draft release documentation and conduct review (Applocable for CD1 and CD3)

Massachusetts Health Insurance Exchange Program, Project Management and Testing Services Request for Responses 19

Testing activities are currently defined in the Master Test Strategy (MTS) and Release Test Plan (RTP) and performed in accordance with the current SDLC. The MTS and RTP for a recent major release are appended to this document.

OPERATIONS

The MA HIX Program’s Operations and Maintenance Team oversees the MA HIX/IES system stability and availability, and technical deliverables, as well as program artifacts from various project resources. In addition, this team monitors daily events to identify and mitigate risks and issues, within and outside the project, to ensure collaboration with all HIX Program Stakeholders and maximum MA HIX/IES System productivity.

Currently, the Optum Application Operations and Maintenance Team is responsible for Managed Application Services for the MA HIX/IES, including high priority Incident Management, Problem Management, Change Management, Triaging, Reporting, Batch Processes and other Operational categories. This team is responsible for managed services of the HIX Application only. Smartronix is responsible for infrastructure and infrastructure-related security operations. The Optum MassHealth Operations Command Center (MOCC) Team is currently responsible for monitoring and executing the daily operational activities needed to manage the MA HIX application and the supporting infrastructure (e.g., OptumID), and coordinates with Smartronix on resolution of infrastructure issues as necessary.

1.14 Incident Management

An Incident may be reported by a HIX Program Team member or Business Owner, Optum, or Smartronix.

If an Incident is reported by Commonwealth or Optum, a JIRA ticket is opened. As per initial Optum O&M triage, if the reported Incident is determined to be an application issue, Optum takes full ownership of the issue and works it through to resolution in accordance with the established Optum Incident Management process.

During the initial triage, if Optum O&M determines the issue to be an Infrastructure issue, Optum O&M opens a CAMS ticket and requests Smartronix to triage the issue. If it is confirmed to be an infrastructure issues, Smartronix takes full ownership of the issues and works it through to resolution following the established Smartronix’s Incident management process.

If Smartronix identifies an infrastructure issue, they will open a CAMS ticket, triage, and work the issue until resolution following Smartronix’s Incident management process.

If after initial triage it has not been determined whether the Incident is an application or an infrastructure issue, the HIX Program Team will assign an Incident Manager, who will coordinate additional fact-finding among HIX Program Vendors and any other third parties to assist in fully triaging the issue, according to established processes.

Massachusetts Health Insurance Exchange Program, Project Management and Testing Services Request for Responses 20

1.15 Incident Management Priority Level Definitions

Incident priority levels are currently defined as follows:

• Priority Level 1 (P1) means an Incident that (a) has caused the Hosted System or Managed Application to go down or become unavailable, (b) has caused the Hosted System or Managed Application to fail to perform an Essential Function for a substantial segment of the User population, as determined by Client provided monitoring tools or Client call center inbound call volume, or (c) has caused, or has potential to imminently cause, a Security Incident; and, in each case of (a), (b) and (c), for which no workaround is immediately available.

• Priority Level 2 (P2) means an Incident that (a) prevents a large number of Users from accessing or using (i) the Hosted System or Managed Application, or (ii) any of the Essential Functions of the Hosted System or Managed Application are affected such that there is significant impact on the Essential Functions, and (b) a workaround is unacceptable on a long-term basis.

• Priority Level 3 (P3) means an Incident that (a) impacts a non-critical system or component of a Hosted System or Managed Application for a limited number of Users, or (b) impacts the ability of one or a limited number of Users to access and use a primary function of the Hosted System or Managed Application; but, in each case of (a) and (b), for which there is a reasonable temporary workaround.

• Priority Level 4 (P4) means an Incident that (a) impacts a single User’s ability to access and use a function of the Hosted System or Managed Application and (b) for which a reasonable temporary workaround is available. Examples of Priority Level 4 Incidents include Incidents that: do not affect any production functions of the Managed Application or that is cosmetic in

Massachusetts Health Insurance Exchange Program, Project Management and Testing Services Request for Responses 21 nature; a software defect that exists but does not affect any functionality of the Managed Application.

1.16 Operational Workarounds

At any given time, there are between 30-50 operational workarounds used to address a production issue to compensate for gaps within the MA HIX system. The large majority of these are the result of functional gaps, i.e., functionality for which there are no system requirements. The remaining are the result of system defects. Just over one-half of all workarounds are automated; the remaining are manual workarounds. These workarounds address key business needs of both MassHealth and the Health Connector and are developed and are currently executed by the Optum Operations and Maintenance Team. Optum’s product team provides support if detailed product knowledge is required for the workarounds.

Workarounds remain in place until the underlying issue is resolved either via a defect fix or a functional enhancement.

1.17 Reporting

EOHHS receives numerous daily, weekly, monthly, and hoc reports addressing all aspects of the HIX system. Most of these reports are currently prepared and submitted by Optum, and include both application and operations-related information. The current inventory of reports is provided below. Reports are distributed via email, unless otherwise noted:

Frequency Name Summary

Daily

Health Check Report

Provides status on key system metrics, including: MWS MQ listener; Audit Eligibility Comparison Job (Batch 173); Critical batch updates; Axway file transfer status (12 file transfers); Major Batch runtimes; Enrollment & MMIS latest status;

and Batch Issue Report.

Massachusetts Health Insurance Exchange Program, Project Management and Testing Services Request for Responses 22

Standard Modern (SM) Notice Control Report

List of files sent to SM for notices printing. Fields include: Batch Number; Name of File; Notice Type; Number of Notices per file; and Number of Pages per file.

ITD Notice Control Report

List of files sent to ITD for notices printing. Fields includes: Batch Number; Name of File; Notice Type; Number of Notices per file; and Number of Pages per file.

Softheon Notices Control Report

Count of notices per notice type (e.g. Approval, Denial, RFI) generated per eligibility year.

MMIS Post Eligibility Transaction Report

Counts of total Transactions Processed as of that day; Transactions Processed in that day; number of HIX Error Transactions; and number of MMIS Error Transactions. Also includes any MMIS related post-transaction errors.

Daily High Priority deck

Slides discussed in daily 4pm call which includes high priority ticket pending with Optum, MH & CCA, Weekly Batch Summary and Backlog, Batch Transaction Dashboard, Prod Batch Schedule, MH ITD Notices Trend.

Weekly

PIM Remediation Report

Number of tickets resolved/ closed, triaged, pending triage and pending inputs from MH/ CCA.

Bi-Weekly Ops Report

A consolidated report of various activities the Optum O&M team performs. It is shared with the Commonwealth Business teams and the Project teams. This Bi- Weekly report is distributed via email and can include the following sections:

• Action Items

• Production Yearly Calendar

• Production and Stage1 Calendar

• High Priority

• Slides to be Removed

• 500 Errors

• PIM & TT Trend

• L Errors

• Members Resolution

• MMIS

• Operational Activity Breakdown

• Write-up/RCA Rating

• NCP

• Premium Assistance

• Batch Updates

• Exclusion Remediation Plan

DDE Control Report

Count of DDE files generated, their total size, and how many were sent to each agency (CCA, MH, ECG/Axway).

Premium Assistance (PA) Reports

Scripts are run proactively to monitor any potential PA related issues. If an issue is identified, then an Incident PIM is opened and follows PIM Remediation process as described in Triage Process section.

Monthly

Operations Business Report

Monthly Operations Review is distributed via email and currently includes the following:

• Accomplishments & Continuous Improvements

• Batch statistics

• Batch schedule

• PAM Report

• PIM Overview

• PIM & Trouble ticket trend

• PIM Remediation Status

• L2 Error trend

• Members Resolution trend

Massachusetts Health Insurance Exchange Program, Project Management and Testing Services Request for Responses 23

• Cat2, Cat3 & Linking errors trend

• SLA overview

• HIX Availability overview

• HIX Performance overview

• AOM team changes based on Functionality

• AOM Team Work Rationalization

Staffing report

Includes:

• Staffing Summary

• Staffing Breakdown (FTE)

• Optum O&M Organizational chart

Assister Portal report include following details:

Assister Portal Monthly Report

• First_Name

• Last_Name

• Username

• Business_Email

• Assister_Business_Id

• Organization_Id

• Organization_Name

• Role

• Account_Creation_Date

• Last_Login_Date Active

Report also produced on request

Quarterly

Business Report

The Quarterly Operations Review is distributed via email and currently includes the following:

• Accomplishments & Continuous Improvements

• Batch Statistics

• L2 Error trend

• Members Resolution trend

• MMIS Error Rate trend

• Cat2, Cat3 & Linking errors trend

• Incident PIM & Trouble ticket trend

• SLA Trends

• Quarterly Managed Application service fees/financials

• PMPM Report

• Batch schedule for Quarter

Staffing report

Staffing report is shared via email and currently includes the following sections:

• Staffing review – Hours drivers

• Optum O&M Organizational chart

• Service Summary

Ad Hoc Adhoc Report Requests

Other than above reports generated from monitoring and control reports Optum O&M creates ad hoc reports based on Business requests. In the last three year an average of 55 reports per year were requested by business.

Example: “List of Assisters who entered the application in HIX and uploaded a document to MDO in the past month.”

1.18 Daily Data Extract (DDE)

The Daily Data Extract program is a Java utility that extracts data from the MA HIX application and generates a single extract file, which is transferred to enterprise data warehouses at both MassHealth and the Health Connector to support their respective reporting efforts.

The DDE is initiated by the Argent scheduler and made available to the MassHealth and CCA data warehouse per the approved frequency and requirements established in the design and

Massachusetts Health Insurance Exchange Program, Project Management and Testing Services Request for Responses 24 development process. Extraction is scheduled as two Argent Jobs, one to extract the data and another job that transfers the files, which is chained to the end of the extraction job.

TOOLS

The HIX utilizes several tools and applications for program management, requirements management, testing, system monitoring, incident and defect management, and job scheduling.

Massachusetts Health Insurance Exchange Program, Project Management and Testing Services Request for Responses 25

Name Version Description Provided by

SharePoint Web-based repositories for documentation EOHHS MassForge Web-based repositories for documentation EOHHS

JIRA Used to track CR, Technical request, PIMs, Access requests EOHHS

ALM Track Defects and requirements Optum

Toad 13.3 Database Management Toolset, used for managing relational and non-relational databases

EOHHS / Quest

Tableau 2020.2 Data Visualization Tool Beyond Compare 4.3.4 Data Comparison Tool used to compare files & folders using simple, powerful commands Scooter Software

PL/SQL 1401

Integrated Development Environment for developing software in Oracle database environment; used to develop PL/SQL Stored-program units

Allround Automations / SMX

Dynatrace - 1.220.96 Monitor performance of applications, their underlying infrastructure, and the experience of your end users.

Dynatrace

AWS

Workspaces

3.1.8 (latest)

Fully managed Desktop Virtualization Service, which allows users to access the data, applications and resources anywhere, anytime

SMX via AWS

Axway SFTP Gateway used for Secure File Transfer Axway / SMX

Argent 10.0A- 2107-A

Job Scheduler used to Automates Job Scheduling and Batch processing Argent / SMX

LoadRunner Optum-hosted application used for running performance test scripts Optum

Splunk Splunk Enterprise & Splunk Enterprise Security;

used as a Log Management Tool Splunk

IBM MQ WebSphere Message Queuing used to exchange messages between applications IBM

Red Hat 7.8 Operating System for Linux based EC2 instances AWS / SMX

TimeShiftX Date and Time shift testing software Vornex

Selenium MH Test Automation Software LeapWork

SecureZip File compression and encryption software PKWare

Palo Alto Firewall, threat prevention, and DNS security software Palo Alto

Centrify Privileged access management Centrify

Cloudbees Software delivery automation. Cloudbees

Broadcom (formerly CA)

API Gateway, API Gateways for virtual appliances (RHEL)…