MSPSC RFI 260061J 05022025 Posting.pdf

DEPARTMENT OF HEALTH & HUMAN SERVICES

Centers for Medicare & Medicaid Services 7500 Security Boulevard, Mail Stop B3-30-03 Baltimore, Maryland 21244-1850

OFFICE OF ACQUISITION AND GRANTS MANAGEMENT

May 2, 2025

REQUEST FOR INFORMATION (RFI)

AGENCY: Centers for Medicare & Medicaid Services

OFFICE: Office of Financial Management (OFM)

TITLE: Medicare Secondary Payer Systems Contractor (MSPSC); 260061J

PURPOSE AND OBJECTIVE

THIS IS A REQUEST FOR INFORMATION (RFI) ONLY. This RFI is issued solely for CMS’ information and planning purposes. This RFI does not constitute a Request for Proposal (RFP) or a promise to issue an RFP in the future. This RFI does not commit the Government to contract for any supply or service. CMS is not soliciting quotes/proposals. Respondents are advised that the U.S. Government will not pay for any information or administrative costs incurred in response to this RFI; all costs associated with responding to this RFI will be solely at the respondent’s expense. Not responding to this RFI does not preclude participation in any future procurement. It is the responsibility of the interested vendors to monitor this site for additional information pertaining to this requirement. Information provided in the RFI is subject to change and is not binding on the Government. The Department of Health and Human Services (HHS), Centers for Medicare & Medicaid Services (CMS), Office of Financial Management (OFM), or Office of Acquisition & Grants Management (OAGM) have not made a commitment to procure any of the items discussed, and release of this RFI is not a commitment or an authorization to incur cost for which reimbursement would be allowed or sought. All submissions become Government property and will not be returned.

Note: This RFI is limited in the specific topics covered in the questions asked. The Government may issue additional RFIs or request industry comments on other aspects of the Contract strategy as it’s being developed.

PROGRAM DESCRIPTION

Medicare Secondary Payer (MSP) involves those functions performed to identify when another payer has payment responsibility before Medicare in order to pay claims in the proper order and to recover Medicare primary payments made when another payer held primary responsibility.

REQUEST

Interested parties are requested to provide detailed answers to the questions below.

CMS requests the responses to be in MS Word/Excel and/or PDF. Responses shall highlight the respondent’s capabilities to address the questions below and include any other pertinent information relating to the market. The information obtained from the responses will inform CMS of the existing capabilities. This will aid CMS in developing the requirements for a future RFP for continuing support of the Medicare Secondary Payer Systems. Telephone inquiries will not be accepted or acknowledged, and no feedback will be provided to companies regarding their submissions.

RESPONSES DUE

The responses shall be due no later than 10:00 am Eastern Standard Time (EST) on Friday, May 23, 2025. The responses shall be e-mailed to Meghan Critzman at meghan.critzman@cms.hhs.gov and Erin Crockett at erin.crockett@cms.hhs.gov

Responses shall not exceed 15 pages including cover page and answers to questions below:

Cover Page Company information

a. Company Name

b. Company GSA Schedule o r G W A C Contract Number(s) (if applicable)

c. Unique Entity ID (UEI) Number

d. NAICS Code(s)

e. Company Address

f. Point of Contact (including phone number and email address)

g. Business Size

h. Business Classification

Questions:

1. After reviewing the MSPSC Statement of Need, how long would your firm need to transition a project of this size and scope?

2. Please provide sample performance measurements (key performance indicators and quality assurance surveillance metrics) for a project of this size and scope.

3. Are there efficient and innovative ideas for the work to be performed other than what is outlined in the MSPSC Statement of Need?

4. Has your firm utilized SAFe (Scaled Agile Framework) methodology on Federal Government Contracts?

mailto:meghan.critzman@cms.hhs.gov mailto:erin.crockett@cms.hhs.gov

5. Is your firm capable of functioning in both agile and waterfall methodologies simultaneously?

6. What insights can you give on best practices for transitioning and managing existing AWS accounts without disruption to ongoing operations?

7. Describe your experience with Machine Learning for Claims Filtering in the healthcare space.

8. What tools, technologies, and/or methodologies can be leveraged to deliver an excellent customer communication and experience with Machine Learning?

9. What access to code, data, models, documentation, software, and other technical components would your firm provide to CMS when working on a project with Machine Learning?

10. Has your firm implemented systems which required contractor staff to be competent in supporting software listed such as, but not limited to the following areas: JAVA, JEE, ASP.Net, Angular, Node.js, SpringBatch, and Websphere web apps?

If so, please describe your experience and ability to provide 125,000+ of system development hours annually to support JAVA, JEE, ASP.Net, Angular, Node.js, SpringBatch, Websphere web apps and any future developments. The 125,000 development/production support hours include 82,500 development hours and 42,500 productions support hours (one third).

11. After reviewing the MSPSC Statement of Need, what insights can you provide about existing commercial solutions, or commercial off-the-shelf (COTS) products for the work to be performed?

12. Does your firm have Capability Maturity Model Integration (CMMI) Level III certification? If yes, please provide certification information.

Attachments: MSPSC Statement of Need

Medicare Secondary Payer Systems Contractor (MSPSC)

STATEMENT OF NEED

May 2, 2025

Scope The contractor shall provide support for the operations, maintenance, enhancements and special projects for the following components of the Coordination of Benefits & Recovery (COB&R) Program systems. Maintenance and enhancement activities shall include, but not be limited to, systems analysis, design, database maintenance support, programming, unit, system/string, and limited regression testing, data analysis, system documentation, special projects, integration between the COB&R subsystems, quality assurance, and general support of CMS Medicare Secondary Payer (MSP) systems activities.

Background

MEDICARE OVERVIEW

Medicare is a nationwide, Federal health insurance program enacted in 1965 as Title XVIII of the Social Security Act (“the Act”; 42 U.S.C. § 301 et seq.) for persons 65 years of age or older, certain younger disabled persons, and persons with end-stage renal disease (ESRD). The Medicare program serves an estimated 46 million beneficiaries and processes over 1.2 billion claims per year. Fee-for-service (FFS), or “traditional,” Medicare consists of two primary parts: Hospital Insurance otherwise known as Part A, and Supplemental Medical Insurance also known as Part B. A third part of Medicare, known as “Part C” or the “Medicare Advantage” (MA) program, was established by the Balanced Budget Act of 1997 (Public Law 105-33) and allows beneficiaries to receive Medicare benefits through private managed care plans.

Finally, Medicare prescription drug coverage called “Part D” was enacted as part of the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (MMA). Medicare provides equal access to all contract services to all Medicare beneficiaries in compliance with all applicable civil rights laws, including title VI of the Civil Rights Act, as amended; sections 503 and 504 of the Rehabilitation Act, as amended; the Age Discrimination Act of 1975, as amended; the Americans with Disabilities Act of 1990, as amended; and title IX of the Education Amendments of 1972.

Medicare Part A covers some of the costs of providing medically necessary inpatient hospital care, skilled nursing facility care following hospital care, home health agency and hospice care. Individuals entitled to Social Security or Railroad Retirement benefits are automatically eligible to receive premium-free Part A benefits beginning with the first day of the month in which the individual attains the age of 65; those not entitled to such benefits may enroll and purchase Part A once they attain age 65. Also automatically eligible for Part A are: 1) people younger than age 65 who receive Social Security disability benefits (after a defined waiting period) and meet certain qualifications; 2) persons with ESRD who meet certain criteria; and 3) individuals who worked in particular Medicare-qualified Federal, state, or local government positions, provided certain conditions are met.

Medicare Part B helps pay for certain physician services (in hospital and non-hospital settings), outpatient hospital services, home health services and other medical services, equipment and supplies not covered under Part A. Part B benefits are available to almost anyone age 65 or older regardless of entitlement to Part A and to all beneficiaries entitled to premium-free Part A. Part B carries a premium and is an optional program, meaning that eligible individuals may elect or decline to enroll.

MA plans are an alternative to traditional FFS Medicare whereby individuals entitled to Part A and enrolled in Part B, except for those entitled based on ESRD, may elect to receive Medicare benefits by enrolling in a private Medicare managed care plan. The Centers for Medicare & Medicaid Services (CMS) contracts directly with qualified plans. These plans must offer the full range of Medicare benefits.

In turn, Medicare pays a fixed monthly amount for each enrolled beneficiary. MA plans may, but are not required to, offer Part D prescription drug benefits (see below for more information).

The Part D program works in a similar manner to the MA program in that benefits are offered through private plans. To be eligible to enroll in Part D, a Medicare beneficiary must be either entitled to Part A or enrolled in Part B (whether they receive benefits through FFS Medicare or through the MA program).

A beneficiary with FFS Medicare may enroll in a Prescription Drug Plan (PDP) for standalone Part D benefits. A beneficiary in the MA program must receive all Medicare benefits through the same MA plan; those that provide Part D benefits are identified as MA-PD plans.

The Medicare program’s authorizing statutes charge the Secretary of the Department of Health and Human Services (DHHS) with the administrative responsibility for the Medicare program. In turn, the Secretary has delegated the program authority for Medicare to the Administrator of CMS. Additionally, the Social Security Administration (SSA) is responsible for initially determining an individual’s Medicare entitlement and for maintaining the Medicare master beneficiary record.

The CMS administers the Medicare program through activities such as: 1) program policy and guidance formulation and promulgation; 2) contract execution, operation and management; 3) utilization record maintenance and review; and 4) general Medicare financing. The CMS performs such administration through a complex set of relationships involving the private insurance industry, state and local governments, and thousands of independent hospitals, physicians, providers, and suppliers. Sections 1816(a) and 1842(a) of the Act provide that public or private entities and agencies may participate in the administration of the Medicare program under contracts or agreements entered into with CMS. These contractors are known as “Fiscal Intermediaries” (FIs) and “carriers.” With certain exceptions, FIs perform bill processing and benefit payment functions for Part A of the program; carriers perform similar functions for Part B. However, the MMA requires that CMS phase out these contractors under Medicare Contracting Reform.

Section 911 of the MMA requires CMS to replace all FIs and carriers with competitively-procured Medicare Administrative Contractors (MACs) that will operate under Federal Acquisition Regulation (FAR) contracting standards. CMS has successfully competed and awarded all 19 Medicare Administrative Contractor (MAC) contracts.

These acquisition activities resulted in 4 Durable Medical Equipment MACs (DME MACs) and 15 combined Part A & Part B MACs, (AB MACs), which will service the majority of all Medicare providers and will replace the current fiscal intermediaries and carriers that administer the Part A and Part B programs, in specific geographic regions known as jurisdictions.

MSP Program

MSP involves those functions performed to identify when another payer has payment responsibility before Medicare in order to pay claims in the proper order and to recover Medicare primary payments made when another payer held primary responsibility. Under § 1862(a) of the Act (42 U.S.C. § 1395y(a)), items and services furnished by Federal providers, a Federal agency, or under a Federal law or contract, have been excluded from Medicare coverage (e.g., U.S. Military Hospitals, U.S. Department of

Veterans Affairs, research grants). Furthermore, § 1862(b)(2)(A)(ii) of the Act (42 U.S.C. § 1395y(b)(2)) and the implementing regulations in 42 CFR Part 411 preclude Medicare from making primary payment where the beneficiary is:

• Age 65 or older and covered under an employer’s Group Health Plan (GHP) based on the current employment status of the individual or of his/her spouse (of any age), and

• the employer has at least (20) employees, or

• the GHP is part of a multi-employer plan where at least one employer has at least (20) employees and the GHP has not requested a formal exception under 42 CFR 411.172(b) for any employee 65 or older employed at a company with less than (20) employees;

• Under age 65, entitled to Medicare on the basis of disability, and covered under an employer’s Large Group Health Plan (LGHP) based on his/her own current employment status or the current employment status of a family member. A LGHP is a plan where

• the employer has 100+ employees, or

• the GHP is part of a multi-employer plan where at least one employer has 100+ employees;

• Within the first 30 months of eligibility/entitlement to Medicare based on having ESRD and is covered under any GHP (regardless of size or employment status) that covers individuals who have ESRD;

Additionally, Medicare may not make payment where payment has been made or can reasonably be expected to be made under a workers’ compensation (WC) law or plan, under no-fault insurance, or under liability insurance (including self- insurance). An entity that engages in a business, trade, or profession is deemed to have a self-insured plan if it carries its own risk (whether by a failure to obtain insurance or otherwise) in whole or in part. A primary plan’s responsibility for such payment may be demonstrated by a judgment, a payment conditioned upon the recipient’s compromise, waiver or release (whether or not there is a determination or admission of liability) of payment for items or services included in a claim against the primary plan or the primary plan’s insured, or by other means.

Coordination of Benefits & Recovery (COB&R) Program

The CMS has an established centralized Coordination of Benefits (COB) and Medicare Secondary Payer Recovery (MSPR) program that supports the collection, management, and reporting of other insurance coverage of Medicare beneficiaries, and the collection of conditional payments or mistaken primary payments. This program provides quality customer service and a single source to Medicare providers, suppliers, beneficiaries, insurers and other stakeholders by streamlining the MSP data and debt collection processes while ensuring the integrity of the Medicare Trust Funds.

CMS established a matrix organization of independent contracts to support this program and to manage its major functions. Under the matrix organization, the combined COB&R activities will be performed by:

• Benefits Coordination and Recovery Contractor (BCRC),

• Medicare Secondary Payer Integration Contractor (MSPIC),

• Commercial Recovery Contractor (CRC),

• Workers’ Compensation Recovery Contractor (WCRC),

• Medicare Secondary Payer Systems Contractor (MSPSC);

These contractors will work in concert to encompass all of the activities necessary to ensure that the primary payer -- whether it is Medicare, employer insurance or other insurance -- pays first, then identify claims that were paid conditionally or mistakenly paid as Medicare primary, and pursue recovery in the most cost effective and efficient manner.

The following provides additional background on the activities of the MSPIC, BCRC, and CRC. The MSPSC activities and scope are provided in the following section:

Benefits Coordination and Recovery Contractor (BCRC)

The scope of the Medicare Secondary Payer Benefits Coordination and Recovery Contractor (BCRC) is to perform the following high-level functions:

• Call Center operations;

• Mail Room/Imaging operations;

• MSP Assessment and Debt Determination;

• Waivers and Appeals;

• Finance Administration;

• Outreach & Education Activities;

• Debt Collections;

• Data Collection Activities (e.g. COBA, Section 111, etc.);

• Electronic Data Interchange (EDI) Support; and

• Special Projects.

Medicare Secondary Payer Integration Contractor (MSPIC)

The role of the MSPIC is to make certain that all components supporting the MSP COB&R contract function in concert. The MSPIC would ensure all new and ongoing activities are properly communicated, handled, and managed by all COB&R supporting matrix contractors. The MSPIC would not be held responsible for the program deliverables, but would be expected to make sure all impacted components were aware and working toward the same goals.

The following is a synopsis of the activities that would be performed by the MSPIC:

• Program Release Management o Change Control Board (CCB) oversight o Problem/Change request database support o Program-wide implementation plans o Project Help Desk

• Business Analysis o Business Requirement Development o Testing and Testing support o Documentation development.

• Program-wide Document Management o Document management system.

o Document management administration.

• Security Oversight.

o Quality Assurance Oversight.

o Outreach and Education.

Commercial Recovery Contractor (CRC)

The MSP CRC functions would include the identification and development of Group Health Plan (GHP) MSP Recovery and Non-GHP recovery cases where Ongoing Responsibility for Medical care (ORM) exists, and all associated recovery activities, which include, but are not limited to:

• Identifying and developing debts;

• Responding to incoming inquiries;

• Reviewing and responding to demand defenses and rebuttals;

• Providing litigation and negotiation support;

• Performing all related Debt Collection Improvement Act of 1996 (DCIA) activities;

• Complying with all required financial activities.

Workers’ Compensation Recovery Contractor (WCRC)

The WCRC functions include reviewing submitted Workers’ Compensation Medicare Set-aside Arrangement (WCMSA) proposals to determine adequacy of proposed settlement funds in anticipating a beneficiary’s future ongoing course of medical treatment in association with his/her work-acquired illness, injury, or disease. The WCRC counters WCMSA proposals that have not anticipated future costs appropriately in light of standard medical care guidelines. As necessary, the WCRC also reconsiders additional information not previously provided in association with a previously submitted WCMSA proposal.

Outcome The outcome of this effort is the operations and maintenance of the Medicare Secondary Program and Coordination of Benefits applications which identify proper order and payer for claims and facilitate the recovery of Medicare primary payments from responsible entities. The Medicare Secondary Payer Systems Contractor (MSPSC) supports all Medicare Secondary Payer Systems (MSPS) and initiatives for the Coordination of Benefits (COB) and Medicare Secondary Payer Recovery (MSPR).

Performance Requirements Tasks/Services The contractor shall work cooperatively with other external support staff as designated by CMS. This staff shall consist of CMS, contractor personnel and other CMS Partners. The contractor shall work closely with, but not limited to, the following:

a. CMS staff

b. Benefits Coordination and Recovery Contractor (BCRC)

c. Medicare Secondary Payer Integration Contractor (MSPIC)

d. Commercial Recovery Contractor (CRC)

e. Workers Compensation Recovery Contractor (WCRC)

f. Any other staff or partners as required

System Development Management Plan (SDMP) Develop and deliver a SDMP. Provide, implement and maintain an integrated project management approach that combines the technical plans, schedule plans and the plans to meet cost objectives

AWS Cloud Operations Support The contractor will provide all necessary materials and supplies not otherwise provided by the government, to host existing MSP COB&R systems and data supporting the performance of tasks.

AWS Cloud Operations Support tasks shall include, but are not limited to, the following:

• Daily Operations

• Production Support

• Telecommunications & Networking

• Database Administration

• Storage Administration

• Systems Backup and Disaster Recovery

• Capacity Planning

• Production Software Releases

• Systems Transition

MSP systems are processed within AWS with CMS Authority to Operate (ATO) certifications. Disaster recovery availability zones must be available for immediate rollover and assumption of processing as a result of disaster per the MSPS Contingency Plan. The MSPSC MA, in compliance with the most comprehensive option noted within CMS ARS 5.1 control CP-4 (Contingency Plan Testing), performs actual Disaster Recovery failover tests from one Availability Zone to another once every 365 days.

The minimum mid-tier requirements for the production environment are:

MSPS utilize MySQL, Postgres, SQLServer and Oracle databases. Additionally, in depth experience with , RHEL, Windows, REST/ web services, data services, and 3-tier Architecture are necessary to manage these systems properly. The Medicare Secondary Payer Systems Contractor is also required to support production (Pro) and non-production development environments (Dev & Impl) as well as ensuring availability zones are provisioned and maintained to support redundancy and disaster recovery.

The MSPSC is responsible for application integration and interconnections internally and with external partners. User and batch transactions are also a significant part of system processes.

COB&R Maintenance Perform maintenance, enhancement, and special project activities.

Enhancements improve the performance or effectiveness of the COB&R program. Examples of enhancements include ICD-10 enhancements, Recovery Audit Contractor (RAC) implementation changes, as well as, implementing a consolidated imaging system.

Special projects shall include, but not be limited to: performing analysis, answering questions, and providing data to support lawsuits, audits, GAO requests, etc.

COB&R System Implementation Implementation shall include development of source code and creation of implementation products necessary for test and installation of the modification.

Code Develop the required software to meet the validated requirements.

The contractor shall develop and record software corresponding to each software unit. This activity shall include, as applicable, computer instructions, and data definitions, building databases, if necessary, populating databases and other data files with data values, and other activities needed to implement the design. For deliverable software, the contractor shall obtain CMS approval to use any programming language not specified in the contract.

Code Review Conduct a code review for each software unit prior to submitting it to the MSPIC. This code review may include CMS staff as well as contractor and MSPIC personnel. The contractor shall include a softcopy of all developed software, to include source code, executables, and any operational software, test software, scripts and data that have been developed.

Software Support Provide software support which shall include, but is not limited to, the following:

a. Analysis, programming, and unit testing, system/string testing, and preliminary regression testing to fix any software problems identified.

b. Data synchronization of databases and files,

c. Design and develop new code to meet CMS’ changing environment,

d. Perform adhoc processing such as:

(1) Creating reports,

(2) Creating extracts,

e. Document all changes Run Books,

f. Build code migration packages in GIT as appropriate,

g. Follow CMS code migration authorization process,

h. Keep the system software operational and responsive after installation,

i. Update technical and user documentation,

j. Report all software problems by opening a RT/CR,

k. Follow CMS standards.

This does not limit or define the set of activities that can be performed during the development of software code and/or making changes to the baseline system.

Software Development Files (SDF) Establish and maintain Software Development Files (SDF) that include, but are not limited to the following:

a. Requirements,

b. Design,

c. Technical reports,

d. Test plans,

e. Test results,

f. RTs,

g. CRs,

h. Schedules,

i. Code listings,

j. Notes for the software units.

Version Description Document (VDD) The VDD shall provide a summary of the features and contents for a specific release. The VDD shall identify and describe the version of the CSCIs that comprise the release, including all changes to the CSCIs since the last VDD was issued, as well as installation and operating information unique to the version described.

Operations and Maintenance (O&M) Manual Maintain the O&M Manual. The O&M Manual shall provide information for the COB&R data center operations staff to effectively handle routine production processing, maintenance, problems, and issues.

It also contains job streams, data flows, and instructions on how the system is to be operated, such as how or what to do, how to do it and when to do it.

In addition, the contractor shall maintain the System Operations and Maintenance Manual (SOMM).

Disaster Recovery Procedures Maintain a Disaster Recovery Plan for each subsystem to enable the system to be installed at a COB&R Hot Sites and successfully run in case of a disaster at the COB&R Data Centers. The contractor shall participate in tests of the disaster recovery procedures as required.

COB&R Testing The contractor shall conduct unit, system/string, load and preliminary regression testing to evaluate the system’s compliance with its specified requirements. The contractor shall also assist the MSPIC responsible for providing the test services for MSP Systems.

Delivery Delivery includes the final activities and packaging of the system after successful regression and acceptance testing.

System Efficiencies and Enhancements The CMS’ vision is to provide COB&R stakeholders with outstanding customer service by leveraging technology and innovation. The MSPSC shall support the COB&R program by evaluating current processes and implementing state of the art concepts to the program.

COBSW Cloud Support Enhancements to claims filtering The effectiveness of the MSP non-Group Health Plan (NGHP) recovery process relies upon building cases that accurately reflect the claims related to an incident or accident, where Medicare has paid primary, and the beneficiary has other insurance. This initiative is intended to evaluate a new methodology for claim identification to improve the accuracy of claims data selected for inclusion in MSP NGHP recovery cases.

Enhancements to claim filtering increase the accuracy of the claims included in recovery cases is expected to provide the following value to CMS:

• Eliminate claims that were incorrectly included in recovery cases, which today results in multiple manual steps and processes to correct.

• Increase CMS’ customers’ satisfaction by improving the overall quality of the demands they receive, which may increase the speed of recovery.

• Increase the ROI of Medicare recovery processes by reducing manual processing and mailing costs related to the rework of claims on recovery cases.

VHA/Medicare Duplicate Payment Recovery Project The Social Security Act at section 1862(a)(3) precludes Medicare from making payment for services or items that are paid for directly or indirectly by another government entity. Similarly, Centers for Medicare & Medicaid Services (CMS)’ regulations at 42 Code of Federal Regulations (C.F.R.), § 411.8 provides that Medicare does not pay for services that are paid for directly or indirectly by a government entity. Veterans Health Administration (VHA) recovery may be appropriate for claims VHA paid under 38 U.S. Code (U.S.C.), § 1725 which specifies VHA is a payor of last resort.

Based on these regulations, the CMS and the VHA will establish an interface to identify (1) those VHA enrolled beneficiaries who are also enrolled as Medicare beneficiaries, (2) specific claims where VHA and Medicare made duplicate payments for the same health care services, and (3) potential fraud, waste and abuse. Specifically, CMS will use VHA beneficiary and claims information to identify those VHA beneficiaries who are also enrolled in Medicare and where Medicare made payment on claims for which VHA also made payment. Any claims where both the VHA and CMS made payment will be reviewed by the agencies and recoupment action initiated as appropriate. CMS recoveries will be made in accordance with the Medicare recovery laws and statutes.

Place of Performance Work will be performed primarily:

_X_ At the contractor’s facility.

___Onsite at CMS (includes any Baltimore or Regional office facility).

https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.law.cornell.edu%2Fuscode%2Ftext%2F38%2F1725&data=05%7C01%7Ckara.johnson1%40cms.hhs.gov%7C2083c96bb7f947f5544308db775a6556%7Cfbdcedc170a9414bbfa5c3063fc3395e%7C0%7C0%7C638235002364549920%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=JXcq6xNu%2FeOC%2B7bvf7DJdXlNBGt00zLAaIirs6%2BkLjo%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.law.cornell.edu%2Fuscode%2Ftext%2F38%2F1725&data=05%7C01%7Ckara.johnson1%40cms.hhs.gov%7C2083c96bb7f947f5544308db775a6556%7Cfbdcedc170a9414bbfa5c3063fc3395e%7C0%7C0%7C638235002364549920%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=JXcq6xNu%2FeOC%2B7bvf7DJdXlNBGt00zLAaIirs6%2BkLjo%3D&reserved=0

Legislative Requirements Handling of Internal Revenue Service (IRS) Federal Tax Information (FTI) Under IRS Publication 1075 requirements, the CMS contractor is restricted from disclosing any IRS Federal Tax Information (FTI) data to a subcontractor. This clause currently restricts subcontracting data center requirements.

Personnel Requirements Key Personnel Throughout the period of this contract, the contractor shall provide only those personnel who are fully qualified and competent to perform their assigned work and who possess the minimum background/experience for each labor category proposed. The contractor shall designate and identify all key personnel (management, supervisory and technical) who shall participate in its day-to-day activities.

The contractor shall dedicate all key personnel 100% to this contract, unless otherwise agreed to by CMS. CMS shall provide approval of all key personnel, including all subcontractors. The contractor shall notify CMS of any key personnel leaving the program.

Staff Roster The contractor shall prepare and update a staff roster. The staff roster shall be in a CMS defined format.

The staff roster shall be updated and provided to CMS whenever there is a change to the contractor personnel.

Security The contractor shall ensure that the COB&R subsystems comply with federal and Department of Health and Human Services (DHHS) security policy and best practices. The contractor shall follow the Security guidelines in accordance with the current HHS and CMS security policies.

Security