HSS27002-BRSTFDPERF_appB.pdf

RFP HSS 27 002 Appendix B

SUPPORT FOR THE WIC BREASTFEEDING PREFORMANCE

IMPROVEMENT PROJECT

RFP HSS-27-002

Appendix B

Scope of Work and Project Requirements

Business Case BC0003104

RFP HSS 27 002 Appendix B

1 Project Overview

1.1 Background and Purpose

The State of Delaware Department of Health and Social Services (DHSS), Division of Public Health (DPH), seeks to procure a vendor system and professional services to provide quality improvement (QI), data analysis, and reporting services related to breastfeeding outcomes for the Delaware Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) Breastfeeding Peer Counselor Services.

DHSS defines the “project” in Appendix B as the totality of contractor work and activities throughout the contract period, which is delineated by a set of project lifecycle phases. The purpose of Appendix B is to define the project lifecycle and phases; define the project team organization and roles; define the project deliverables; and define the project requirements (business, functional and technical requirements).

1.2 Project Lifecycle

The contractor shall organize and manage the project based on five distinct lifecycle phases: a Planning Phase, a Configuration and Customization Phase, a Testing and Deployment Phase, an Operations and Support Phase, and a Project Transition-Out Phase. Each phase is represented by a set of mandatory deliverables and activities required by the contractor. DPH acknowledges that some aspects of the phases, specifically the stated activities and deliverables, may not apply depending on the system used by the vendor associated with the stated professional services.

1.2.1 Planning Phase

The Planning Phase includes all the mandatory deliverables and activities required by the contractor to proceed with the Configuration and Customization Phase:

• Schedule and conduct meetings with the project team to discuss the requirements; and finalize the format and content for each deliverable.

• Schedule and conduct meetings with the current vendor (Gibbous) regarding legacy data conversion planning, transition planning, and continuity of reporting.

• Finalize contractor and stakeholder staffing for all project phases

• Finalize subcontractor and/or vendor contracts, if applicable

• Provide deliverable: Project Schedule

• Provide deliverable: Change Management Plan

• Provide deliverable: Continuity of Operations Plan

• Provide deliverable: Data Conversion Plan

• Provide deliverable: Architecture Network Diagram

1.2.2 Configuration and Customization Phase

The Configuration and Customization Phase includes all the mandatory deliverables and activities required by the contractor to proceed with the Testing and Deployment Phase:

• Schedule and conduct meetings with the project team to review the project status and schedule, and to discuss the deliverables and activities associated with this phase

• Spin-up the cloud instance for the SaaS product

RFP HSS 27 002 Appendix B

• Configure the product

• Customize the product, if applicable (e.g., interfaces, data conversion, etc.)

• Implement the Data Conversion Plan

• Update the Project Schedule

• Provide deliverable: Training Plan

• Provide deliverable: Test Plan

• Provide deliverable: Product Deployment Plan

1.2.3 Testing and Deployment Phase

The Testing and Deployment Phase includes all the mandatory deliverables and activities required by the contractor to proceed with the Operations and Support Phase:

• Schedule and conduct meetings with the project team to review the project status and schedule, and to discuss the deliverables and activities associated with this phase

• Implement the Test Plan

• Implement the Training Plan

• Implement the Product Deployment Plan

• Update the Project Schedule

• Provide deliverable: User Guide

• Provide deliverable: Data Element Dictionary

1.2.4 Operations and Support Phase

The Operations and Support Phase includes all the mandatory deliverables and activities required by the contractor:

• Schedule and conduct meetings with the project team to review operations monitoring and quality control reports, issue tracking, and change control tracking

• Implement the Continuity of Operations Plan

• Implement Change Management Plan

• Provide ongoing maintenance and support

• Securely maintain all data and facilities

1.2.5 Project Transition-Out Phase

Upon termination of the contract, the contractor will provide a finalized copy of the Data Element Dictionary, and a copy of the database based on an agreed format and delivery method.

RFP HSS 27 002 Appendix B

2 Project Team

2.1 Project Organization Chart

RFP HSS 27 002 Appendix B

2.2 DHSS and Stakeholder Contact Information

2.2.1 Delaware Health and Social Services (DHSS)

Name / Role Organization / Email Phone Helen Arthur DHSS Executive Sponsor

Division of Public Health helen.arthur@delaware.gov

302-608-5742

To Be Determined DHSS Project Manager

Chip Finch DHSS Technical Manager

Information Resource Management alfred.finch@delaware.gov

302-255-9256

Joanne White DHSS Program Manager

Division of Public Health joanne.white@delaware.gov

302-741-2900

Charmaine Sampson DHSS Subject Matter Expert

Division of Public Health charmaine.sampson@delaware.gov

302-382-6914

Felix Almonte DHSS IS Systems Support

Division of Public Health Felix.Almonte@delaware.gov

302-802-5150

RFP HSS 27 002 Appendix B

2.3 DHSS Roles

2.3.1 Information Resource Management (IRM)

In support of the DHSS and Office of the Secretary - Administration, the mission of Information Resource Management (IRM) is to provide quality, efficient and cost-effective support in the management of technology resources. IRM provides DHSS divisions with information technology planning and management, information technology purchasing, network telecommunications, and help desk services. IRM is represented on the project team as the DHSS Project Manager and the DHSS Technical Manager.

2.3.2 Department of Technology and Information (DTI)

The Department of Technology and Information (DTI) is the state’s central information technology (IT) organization. DTI establishes and enforces the State’s IT policy and standards and provides enterprise technology services that enable other organizations to effectively fulfill their missions.

DTI does not participate in the project directly but is available to the Project Manager as necessary.

2.3.3 DHSS Executive Sponsor

The DHSS Executive Sponsor represents DPH senior management and is responsible for the success of a project and provides sustainability, strategic planning, guidance and resources to the project team and DHSS Project Manager as necessary. The DHSS Executive Sponsor does not typically attend project meetings.

2.3.4 DHSS Project Manager

If appointed to the project, the DHSS Project Manager serves as primary DHSS coordinator for all project phases, attends all project meetings, works with the Contractor Project Manager to maintain the project plan and schedule, ensures all IRM, DPH and other stakeholder staff attend meetings as necessary, and manages work assignments as required (e.g., review deliverables, perform testing, etc.). The DHSS Project Manager will report to a Project Steering Committee made up of representative managers from the DPH, IRM and DTI. This Committee will meet monthly to review project status, progress, and issues. The Project Steering Committee will report to an Executive Sponsors group. The Executive Sponsors group will be made up of representatives from DHSS, DTI, OMB, and the Division. They will meet quarterly to discuss overall project status, progress and issues, risks, project management, funding, staffing, sponsor issues, stakeholder participation and tasks planned for the upcoming quarter.

If a DHSS Project Manager is not appointed to the project, then the Contractor Project Manager will assume primary responsibility to manage the project.

2.3.5 DHSS Technical Manager

The DHSS Technical Manager serves as primary coordinator for all project phases on behalf of IRM, attends all project meetings, works with the project team to maintain the project plan and schedule, and provides DPH and the contractor with consulting support, facilitates any configuration and/or customization required within the state network, and manages the work assignments of IRM and DTI staff as required (e.g., review deliverables, perform testing, etc.).

RFP HSS 27 002 Appendix B

2.3.6 DHSS Program Manager

The DHSS Program Manager serves as primary business lead for all project phases on behalf of DPH, attends all project meetings, works with the project team to maintain the project plan and schedule, disseminates program information to the contractor as needed (e.g., business requirements, processes, workflows, forms, reports, etc.), and manages work assignments of program staff as required (e.g., review deliverables, perform testing, etc.).

2.3.7 DHSS Subject Matter Expert (SME)

The DHSS Subject Matter Expert (SME) contributes program knowledge and information in all project phases, attends project meetings as required, and reports to the DHSS Program Manager.

2.3.8 DHSS Information Systems Support Specialist (ISSS)

The DHSS Information Systems Support Specialist (ISSS) serves as the DPH liaison between program staff and IRM, and between program staff and contractor IT staff. The ISSS participates in all project phases, attends all project meetings, and ensures the business requirements are properly communicated to the contractor and that program staff understand DTI policies and standards, and contractor information system processes and data. The ISSS reports to both the DHSS Technical Manager and DHSS Program Manager.

2.4 Contractor Roles

2.4.1 Contractor Project Manager

The Contract Project Manager serves as the chief liaison to the DHSS Project Manager for all project phases, has authority to make day-to-day decisions, facilitates all contractor activities (e.g., application, database, financial, legal, training, etc.); facilitates all deliverables; maintains the project schedule; schedules, hosts and leads all project meetings; authors and distributes agendas, meeting notes and weekly status reports; and ensures contractor staff attend project meetings as necessary. The Contractor Project Manager reports to the Contractor Project Director.

2.4.2 Contractor Application Manager

The Contract Application Manager facilitates all SaaS product configuration, documents and communicates system-related issues and downtime, coordinates with the contractor’s Help Desk as necessary, attends all project meetings as required, and contributes knowledge and information to inform the authoring of deliverables (e.g., Project Plan and Schedule, Architecture Network Diagram, Test Plan, etc.). The Contractor Application Manager reports to the Contractor Project Manager.

2.4.3 Contractor Database Manager

The Contract Database Manager develops and maintains the contractor’s databases, maintains data storage and retrieval systems, troubleshoots database issues, implements database recovery procedures and safety protocols, attends all project meetings as required, and contributes knowledge and information to inform the authoring of deliverables (e.g., Project Plan and Schedule, Data Conversion Plan, Interface Control Documents, Data Element Dictionary, etc.). The Contractor Database Manager reports to the Contractor Project Manager.

RFP HSS 27 002 Appendix B

2.4.4 Contractor Training Manager

The Contractor Training Manager develops and maintains training materials; schedules and conducts training sessions; communicates with users; attends all project meetings as required;

and contributes knowledge and information to inform the authoring of deliverables (e.g., Project Plan and Schedule, Training Plan, etc.). The Contractor Training Manager reports to the Contractor Project Manager.

RFP HSS 27 002 Appendix B

3 Project Deliverables The following subsections define the requirements and minimum data content for each deliverable. Section 1.0, Project Overview, stipulates which project phase the contractor will provide each deliverable. During the project phases, each deliverable is formalized and submitted to DHSS separately as a standalone document and is updated throughout the project per the contractor’s Change Management Plan. The Project Schedule, and Test Plan, are submitted to DHSS in Microsoft Excel format. All other deliverables are submitted in Portable Document Format (PDF) format.

3.1 Project Schedule

The contractor shall provide the Project Schedule in Microsoft Excel format and include task number, task description, assigned staff, task dependencies, task start and end dates, task duration, percentage completed, task completion date, and a project calendar depicting all tasks.

For the duration of the project, the contractor will deliver to DHSS weekly an updated Project Schedule. The contractor will define tasks at a sufficient level to track the work assignments of contractor, DHSS, and stakeholder staff, which at a minimum include deliverables, configuration, customization, data conversion, training, testing and deployment. During the Operations and Support Phase, the Project Schedule will include issue resolution, change management, system downtime, or any other event or activity that requires tracking.

3.2 Change Management Plan

The Contractor shall provide their Change Management Plan in PDF format and describe the change management process, both in terms of configuration and customization, define the method to request change, the process to rank and prioritize change requests (via a Configuration Control Board or equivalent), define the role of DPH, include a sample of any forms and artifacts used in the change management process (e.g., change request form, approval form, UAT, etc.), and list the project deliverables that will be updated (e.g., project schedule, test plan, approval form, user documentation, etc.).

3.3 Continuity of Operations Plan

The contractor shall provide their Continuity of Operations Plan in PDF format and describe their backup and recovery process of applications and data. The contractor shall identify any associated vendors, provide documentation of recovery procedures and testing, define the communication method for alerting DPH of a disaster or event requiring the execution of the Continuity of Operations Plan, and define the Service Level Agreement (SLA) time to return to operations following notification to DPH.

3.4 Data Conversion Plan

The contractor shall provide their Data Conversion Plan in PDF format and describe their method to transform and import legacy data from the current database hosted by Gibbous. The contractor shall describe the approach to ensure data quality before and after the data conversion process, describe the manual and/or automated controls and methods to validate the conversion, and describe the process for data error detection and correction. The contractor shall include in their plan a data conversion specifications table that lists all source tables and fields, the target table and field for each source field, and a data value mapping and rules for data transformation.

RFP HSS 27 002 Appendix B

3.5 Architecture Network Diagram

The contractor shall provide an Architectural Network Diagram in PDF format and depict the application and database servers, laboratory, other contractor facilities if applicable, interfaces, DHSS users, and providers. The diagram will clearly document the location of all servers, the laboratory and contractor facilities; and the diagram will clearly document the IP and port specifications.

3.6 Training Plan

The contractor shall provide a Training Plan in PDF format that describes their approach to training, including a curriculum to demonstrate all core system functionality (e.g., user login;

product configuration; online inquiry and update of patient information and hearing test results;

reports; and use of the web portal). The contractor shall provide a copy of all training materials.

3.7 Test Plan

The contractor shall provide a Test Plan in Excel format and document the test cases associated with unit and integrated testing. The contractor is required to work with the DHSS Project Manager to identify the staff for testing, review the Test Plan with staff before testing begins, and facilitate one or more meetings with staff to execute the Test plan together. The contractor shall include in the Test Plan test cases for all core systems functionality. The contractor will include a summary for each test case, and a series of test steps for each test case; each test step will include a test step summary, user instructions for executing the test step, the expected outcome, the actual outcome, and testing notes.

3.8 Product Deployment Plan

The contractor shall provide a Product Deployment Plan in PDF format and describe their approach to deployment, describe the method to communicate with users, providers and other stakeholders, include communication templates, and include a readiness checklist for facilities, environments, applications, databases, interfaces, operations, Help Desk, providers and other stakeholders, describe their method to monitor operations and quality control, and include sample reports associated with operational monitoring and quality control.

3.9 User Guide

The contractor shall provide a User Guide in PDF format and include instructions and screen samples to navigate and use all core system functionality. The contractor will include a table of contents, organize, and group the content by core functionality, and provide instructions for contacting the Help Desk, if applicable.

3.10 Data Element Dictionary (DED)

The contractor shall provide a DED in PDF format and document all the table names, table descriptions, field names, field descriptions, field attributes, field positions, field sizes, valid values and primary keys associated with the application database and indicate whether each field is available in the Decision Support System. The contractor shall organize the DED with each table presented alphabetically as a separate section, order the fields for each table by position in the database, and depict the field information in a spreadsheet-like format.

RFP HSS 27 002 Appendix B

4 Project Requirements

4.1 Contractor Knowledge and Experience

The contractor shall meet the following minimum qualifications to be considered responsive:

• Demonstrated experience (minimum of five (5) years) providing data analysis and quality improvement services for public health programs, preferably WIC or maternal and child health programs.

• Documented experience analyzing breastfeeding-related data and program performance metrics.

• Experience working with state or federally funded programs, including compliance with applicable reporting and confidentiality requirements.

• Demonstrated capacity to securely manage and analyze protected health information (PHI) and sensitive program data.

• Experience producing standardized, professional reports suitable for government review and federal submission.

• Ability to provide services statewide and participate in required meetings.

• Proven organizational capacity to assume and continue the scope of work currently performed by the existing State vendor, including transition planning and continuity of reporting.

4.2 Offshore Prohibitions

Offshore is defined as not being within the United States or its territories. Offshore storage and transmission of DHSS data is prohibited. Onshore project data and project artifacts including backup and recovery files in any form shall not be accessed by offshore staff and shall not be copied, processed, transmitted, or moved offshore. The contractor is prohibited from using State data in any form even if masked or obfuscated for offshore testing. All aspects of User Acceptance Testing and production operations will take place onshore.

Associated Link:

Offshore IT Staffing Policy

4.3 Data Classification Policy

The contractor shall abide by the terms and conditions established by the Delaware Data Classification Policy, which defines the roles and responsibilities of a Data Steward based on the data classification. The data classification for this procurement is State of Delaware Confidential.

Associated Link:

Data Classification Policy

4.4 Terms and Conditions Governing Cloud Services and Data Usage The contractor shall abide by the terms and conditions established in Terms and Conditions Governing Cloud Services and Data Usage Policy, which govern remote hosting/cloud systems and accessing/storing State data outside of the State network. The Terms and Conditions Governing Cloud Services and Data Usage Agreement has columns identifying which provisions are mandatory depending on whether the data is Public or Non-Public. The data

RFP HSS 27 002 Appendix B classification for this procurement is Non-Public. The mandatory clauses are identified by the checkmark in the appropriate Public/Non-Public column in each agreement.

Associated Links:

Terms and Conditions Governing Cloud Services and Data Usage Agreement Terms and Conditions Governing Cloud Services and Data Usage Policy

The contractor has the option to conditionally accept, or reject, any clause in the agreement. In such cases, the contractor will list the agreement clause number, state whether the clause is “accepted conditionally” or “rejected” and describe the reasoning and/or controls that are present to provide the same or similar compliance. Any exception identified by the contractor will be vetted by Delaware Department of Technology and Information (DTI) and the Delaware Deputy Attorney General (DAG). Individual clauses may be negotiated and updated by the DTI and DAG and the negotiated agreement version will be attached to the final contract.

During the Operations and Support Phase, the contractor will renew the Terms and Conditions Governing Cloud Services and Data Usage Agreement every 12 months.

4.4.1 Criminal Background Check

All Contractor staff working on this project will be subject to a Criminal Background Check (CBC).

The contractor will be solely responsible for the cost the CBC. DHSS will review the CBC results.

DHSS at their sole discretion may request that contractor staff be replaced if their CBC result is unsatisfactory.

4.4.2 Cyber Liability Insurance

All data in transit must be encrypted whether transmitted over a public or private network. If the Contractor cannot comply with the requirement to encrypt data at rest, then Contractor must purchase adequate Cyber Liability Insurance to protect the contractor and the State from data breaches and other cyber security issues. The selected Contractor will present a valid certificate of cyber liability insurance for attachment to the contract prior to contract signature.

4.5 HIPAA Regulations and Standards

The contractor shall certify compliance with Health Insurance Portability and Accountability Act (HIPAA) regulations and requirements as described in Department of Health and Human Services, Office of the Secretary, 45 CFR Parts 160, 162 and 164 along with the updated ARRA and HITECH act provisions, as well as all HIPAA requirements related to privacy, security, transaction and code sets, and provider enumeration. The proposed solution must meet these cited requirements.

4.6 Business Associate Agreement

Any information system that stores or processes Protected Health Information (PHI) is covered by HIPAA regulations. As such, a Business Associate Agreement (BAA) must be signed by the contractor to acknowledge agreement with federal and state policies and standards. This agreement/contract must be in force prior to testing or production implementation of this data exchange. During the Operations and Support Phase, the contractor will renew the BAA every 12 months.

RFP HSS 27 002 Appendix B

4.7 DHSS Data Rights

All DHSS data (Public and Non-Public) related to services provided under this contract will remain the sole property of DHSS. De-identified or derived/aggregated DHSS data is not exempted from this requirement. This provision shall survive the life of the contract. Contractor does not acquire any right, title, or interest in DHSS data under this contract. Except as otherwise required by law or authorized by DHSS in writing, no DHSS data shall be retained by the Contractor for more than 90 days following the date of contract termination. After the 90-day timeframe the following provisions will remain in effect: contractor will immediately delete or destroy this data in accordance with NIST standards and provide written confirmation to DHSS; contractor is expressly prohibited from retaining, transferring, repurposing, or reselling DHSS data except as otherwise authorized by DHSS in writing; contractor retains no ongoing rights to this data except as expressly agreed to by DHSS in the contract.

4.8 UAT and Training Environments

The UAT and Training environments must be secured at a level equivalent to the security in place for the production environment. It must be sized and architected such that production-sized files can be copied over into UAT. The architecture must be equivalently configured so that performance and load testing will essentially produce the same results and expectations as testing in the production environment. Depending on the type of data (i.e., top secret/highly confidential, behavioral health) and specific security requirements around this data, there may or may not be an expectation to mask field values in the UAT and Training environments. Copying production data into lower environments may be prohibited, especially for role-based training.

Lower environments with production data that are secured in the same manner may be exempt from masking requirements as well however this may be subject to DHSS or Federal policies and regulations that override this potential exemption or explicitly disallow production data being copied into lower environments. The division Deputy Attorney General will be consulted on what is allowed/disallowed in non-production environments.

4.9 Data Masking in Non-Production Environments

While securing production data is of critical importance, migration of that data to lower environments presents its own set of challenges as lower environments typically are not as secure as the production environment. Masking production data in lower environments usually involves deletion or obfuscation of actual PII-related field values such that they have no meaning as plain text and there is no identifiable method of translation back to the original values. If there are plans to copy production data to a less secure environment, Contractor will describe in detail their proposed masking strategy. If there is no expectation that production data will be copied into less secure environments, Contractor will describe their proposed test data generation plans and state clearly in this section that masking of production data is not required under this proposal.

4.10 Scope of Services

The selected vendor shall provide quality improvement (QI), data analysis, and reporting services related to breastfeeding outcomes for the Delaware Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) Breastfeeding Peer Counselor Services. Services shall build upon and/or replace the scope currently performed by the State’s existing vendor, Gibbous, while ensuring continuity of data analysis, reporting, and quality improvement activities.

The contractor shall utilize breastfeeding-related data generated by both state-employed and contracted breastfeeding peer counselors, as provided through Delaware WIC’s electronic data systems.

RFP HSS 27 002 Appendix B

All the following components listed in section 4.10 are mandatory.

4.10.1 Data Receipt, Integration, and Validation

The Contractor shall:

• Receive breastfeeding-related program data from Delaware WIC staff in a secure manner (e.g. secured email). Data will be provided in text or Excel format. The contractor can anticipate receiving at a minimum five files per month, each containing approximately 1,500 records with a dozen or less fields. Examples of the data content include:

• Breastfeeding contacts, which measure the number of successful versus unsuccessful contacts made by phone or text message.

• Risk information, which lists all risk factors captured in the DE WOW system, such as low birth weight, low hemoglobin, and other maternal or infant-related risks.

• Risk factor information, which lists risk factors by code along with the associated participant ID.

• Food and participant information, which tracks food package assignments by participant category.

• Integrate data from state-employed and contracted breastfeeding peer counselors.

• Conduct data validation to assess accuracy, completeness, timeliness, and consistency.

• Identify missing data, discrepancies, duplication, or documentation concerns.

4.10.2 Breastfeeding Outcome Analysis

The Contractor shall analyze Delaware WIC breastfeeding performance measures, including but not limited to:

• Breastfeeding initiation

• Breastfeeding duration at defined intervals (e.g., 1, 3, 6, and 12 months, as available)

• Breastfeeding exclusivity

• Timeliness and frequency of peer counselor contacts

• Comparative outcomes between state-employed and contracted peer counselors

Analyses shall be stratified by clinic, county, and demographic variables, as permitted by data availability and confidentiality requirements.

4.10.3 Quality Improvement Assessment

The Contractor shall:

• Conduct a participant web-based survey minimum of annually, compatible with a variety of devices (e.g. mobile phones and devices, desktop computers).

• Identify trends, strengths, and opportunities for improvement in Delaware WIC’s breastfeeding services.

• Assess variation in outcomes across peer counselor employment models, clinic sites, and service delivery methods.

• Provide evidence-based, actionable quality improvement recommendations aligned with USDA WIC guidance and best practices.

• Identify areas where data collection, documentation, or workflow improvements may enhance program performance.

RFP HSS 27 002 Appendix B

4.10.4 Quarterly Breastfeeding Quality Reports

The Contractor shall submit Quarterly Breastfeeding Quality Improvement Reports that include:

• Executive summary of key findings

• Visual presentation of breastfeeding performance metrics

• Comparison to prior quarters and historical trends

• Identification of emerging issues or risks

• Summary of recommended quality improvement actions

• Detailed summary of participants, successfully contacted, unsuccessfully contacted, and never contacted.

Quarterly reports shall be reported within thirty (30) calendar days following the end of each calendar quarter.

4.10.5 Annual Comprehensive Breastfeeding Report

The Contractor shall submit an Annual Breastfeeding Outcomes and Quality Improvement Report that includes:

• Annual breastfeeding performance analysis

• Multi-year trend analysis, where data are available

• Evaluation of peer counselor program effectiveness

• Summary of quality improvement recommendations and progress

• Report format suitable for submission to USDA and inclusion in state planning and reporting documents The annual report shall be submitted within sixty (60) calendar days following the end of the contract year.

4.10.6 Data Visualization

The Contractor shall:

• Develop standardized data visualizations to display key breastfeeding metrics and peer counselor performance indicators.

• Provide at least two (2) infographics centered around breastfeeding data annually

• Ensure data visualizations are accessible and interpretable by program leadership and supervisory staff.

• Provide data visualizations in formats approved by Delaware WIC (e.g., PDF, Excel, PowerPoint, or web-based platforms).

4.10.7 Technical Assistance and Consultation

The Contractor shall provide:

• Ongoing technical assistance related to data interpretation and quality improvement.

• Participation in scheduled meetings (virtual or in-person) to present findings and respond to program questions.

4.10.8 Data Security, Confidentiality, and Compliance

The Contractor shall:

• Comply with all applicable federal and state confidentiality and data security requirements, including USDA WIC regulations and HIPAA, as applicable.

• Maintain secure data transfer, storage, and destruction procedures.

RFP HSS 27 002 Appendix B

4.10.9 Transition, Continuity, and Knowledge Transfer

To ensure continuity of services provided by the current vendor; the new vendor shall:

• Support transition activities at contract initiation, including review of existing methodologies and reports.

• Document analytical methods, metric definitions, and reporting processes.

• Ensure Delaware WIC retains ownership of all data, analyses, and reports.

• Provide transition support at contract conclusion, including data and documentation handoff.

4.11 Data Element Dictionary (DED)

The contractor shall provide a DED and document all the table names, table descriptions, field names, field descriptions, field attributes, field positions, field sizes, valid values and primary keys associated with the application database and indicate whether each field is available in the Decision Support System. The contractor shall organize the DED with each table presented alphabetically as a separate section, order the fields for each table by position in the database, and depict the field information in a spreadsheet-like format.

4.12 Data Conversion Summary

The contractor shall describe their approach and methodology to transform and import legacy data from the current database hosted by Gibbous. The contractor shall describe the approach to ensure data quality before and after the data conversion process, describe the manual and/or automated controls and methods to validate the conversion, and describe the process for data error detection and correction.

4.13 Change Management Summary

The contractor shall describe their approach and methodology to change management. The contractor shall summarize their change management process, both in terms of configuration and customization, summarize the method to request change, summarize the process to rank and prioritize change requests (via a Configuration Control Board or equivalent), summarize the associated artifacts (e.g., change request form, approval form, UAT, etc.) and deliverables (e.g., project schedule, test plan, approval form, user documentation, etc.), and summarize the role of

DPH.

4.14 Continuity of Operations Summary

The contractor shall describe their approach and methodology to ensure all systems and data are securely and routinely backed up; and recovered timely following a natural disaster, power outage, cyber security attack, or any other event that impacts systems or data. The contractor shall identify any associated vendors, summarize backup and recovery procedures, summarize the testing and certification process, summarize the communication method for alerting DPH of a disaster or event requiring the execution of the Continuity of Operations Plan, and reference the Service Level Agreement (SLA) time to return to operations following notification to DPH.