OCTA_Comprehensive_SOW_CMS_Section111_Liability_Reporting.DRAFT.07-10-26.docx

ORANGE COUNTY TRANSPORTATION AUTHORITY

STATEMENT OF WORK

CMS Medicare Section 111 Reporting Services Non-Group Health Plan Liability Claims | Procurement Draft | July 10, 2026

1. Background, Purpose, and Workload The Orange County Transportation Authority (OCTA) is fully self-insured and self-administers its liability claims. OCTA is the Responsible Reporting Entity (RRE) for applicable Non-Group Health Plan (NGHP) liability reporting under Section 111 of the Medicare, Medicaid, and SCHIP Extension Act. OCTA seeks a qualified contractor to serve as its CMS reporting agent for liability claims only and to provide managed compliance, technical, submission, correction, and support services.

OCTA’s current reporting arrangement with Verisk is expected to end December 31, 2026. The replacement service must be fully operational no later than January 1, 2027. Origami Risk will remain OCTA’s claims system of record and primary operational interface. The contractor shall integrate with Origami and shall not replace it. As part of implementation, the contractor shall coordinate the orderly transfer and reconciliation of OCTA’s existing CMS Section 111 reporting data and available historical ISO ClaimSearch results from Verisk into Origami. OCTA will retain final responsibility as the RRE; the contractor will perform the reporting-agent services necessary to support timely, accurate, documented compliance.

*Included only as workload context. Ongoing ISO ClaimSearch services are outside this procurement; the limited one-time migration of available historical ISO results is included. Counts are grouped by loss-date fiscal year (July 1–June 30). Historical volumes are estimates and do not guarantee future work.

2. Objectives and Governing Requirements Maintain uninterrupted Section 111 reporting during transition from the incumbent provider and throughout the contract term.

Submit complete and accurate liability-claim data, correct errors promptly, and preserve auditable proof of transmissions, CMS responses, corrections, and acceptance.

Use Origami as the primary source/interface and minimize manual duplicate entry through secure, tested data exchange and clear exception workflows.

Preserve reporting continuity by migrating and reconciling existing Verisk-managed CMS records and available historical ISO results into Origami before production cutover.

Monitor and implement then-current CMS NGHP User Guide requirements, alerts, technical specifications, reporting thresholds, and civil-money-penalty compliance expectations.

3. Scope of Services Transition and implementation. Assign a project manager; conduct kickoff; inventory current RRE configuration, TIN/reference data, open reportable claims, submission history, and unresolved errors; prepare and execute a transition plan; coordinate with OCTA, Origami, CMS, and the incumbent; complete mapping, testing, user acceptance, training, cutover, and contingency planning without a reporting lapse.

Incumbent data migration and reconciliation. Coordinate with OCTA, Verisk, and Origami to obtain, securely transfer, map, test, load, validate, and reconcile OCTA’s existing CMS Section 111 reporting data into Origami. The migration shall include, to the extent maintained by Verisk and made available to OCTA, Medicare eligibility/query history; claim input files; CMS response and disposition files; accepted, rejected, and pending record statuses; open errors; TIN reference information; ORM and TPOC history; RRE configuration; submission receipts; correction history; and audit-support records. The contractor shall also coordinate a one-time migration into Origami of available historical ISO ClaimSearch results or related OCTA claim-level ISO data that Verisk is legally and contractually permitted to provide. The contractor shall prepare source-to-target control totals, identify duplicates and gaps, maintain an exception log, resolve discrepancies within its control, and certify in writing that migrated records are complete, readable, traceable, and usable in Origami. Any item that cannot be transferred shall be documented with the reason, impact, and recommended disposition. Ongoing ISO ClaimSearch services are not included.

Origami integration. Design, configure, test, document, and maintain secure API, SFTP, or other mutually approved exchange with Origami. Map required eligibility/query, claim, TIN, ORM, TPOC, diagnosis, response, disposition, and error fields. Return response files, statuses, error messages, and actionable correction instructions to Origami or another OCTA-approved workspace. Provide a controlled manual fallback for outages.

RRE and account administration. Support OCTA’s existing RRE registration and reporting profile; maintain required account representative/account manager information at OCTA’s direction; manage reporting-agent access; maintain TIN reference files; calendar submission windows; and assist with annual profile validation, certifications, and attestations. OCTA shall remain the owner of its RRE credentials and data. No registration or contact change may be made without OCTA’s written approval.

Eligibility and production reporting. Process Medicare eligibility/query activity and produce, validate, transmit, and reconcile all required liability claim and TIN files. Support applicable ORM and TPOC reporting, updates, deletes, terminations, and resubmissions. Confirm receipt and acceptance and retain traceable control totals and file histories.

Pre-submission edits and error resolution. Apply meaningful validation before transmission, including required-field, date, threshold, duplicate, diagnosis/ICD-10, amount, TIN, and cross-field logic. Translate CMS error codes into claim-specific instructions, identify the responsible party, track aging, and correct and resubmit until accepted. Distinguish contractor/integration defects from OCTA data decisions.

Compliance monitoring and advisory support. Monitor applicable CMS guidance and alerts, explain operational impact, update validation/submission processes, and give OCTA written notice of material changes. Flag records that may approach a reporting deadline or civil-money-penalty exposure and preserve documentation supporting timely compliance. Provide technical/compliance guidance, not legal advice.

Operational support and quality control. Provide named account and technical contacts; user training and job aids; periodic data-quality reviews; reconciliation of source, transmitted, rejected, and accepted records; and documented root-cause/corrective-action analysis for recurring defects.

Audit, inquiry, and transition-out support. Support CMS or OCTA inquiries and audits with file histories, receipts, correction logs, process documentation, and relevant correspondence. At contract end, provide a complete, usable export and cooperate with OCTA and any successor so that OCTA retains uninterrupted access and reporting continuity.

4. Deliverables and Schedule

5. Performance Standards and Service Levels Timeliness: 100% of required submissions shall be made within the applicable CMS window when OCTA has supplied necessary data and decisions by the agreed cutoff. The contractor shall immediately document and escalate any threatened deadline.

Accuracy and reconciliation: Each production cycle shall reconcile source records, transmissions, responses, accepted records, rejected records, and pending OCTA actions. Contractor- or integration-caused defects shall be corrected at no additional charge.

Migration acceptance: Migrated data shall reconcile to Verisk source extracts by record count and status. Any variance shall be listed in an exception log and accepted in writing by OCTA. Production readiness shall not be certified until OCTA approves the migration reconciliation and confirms that required records are accessible in Origami.

Continuity: Maintain documented backup, recovery, and alternate-submission procedures sufficient to meet CMS deadlines. Planned maintenance affecting OCTA shall be communicated at least five business days in advance when practicable.

6. Roles and Responsibilities Contractor responsibilities include the services, staffing, tools, testing, secure connectivity, reporting-agent expertise, quality controls, documentation, incumbent-data migration, reconciliation, and coordination required by this SOW. OCTA will provide timely access to authorized data and personnel, authorize Verisk to release OCTA-owned or transferable records, make claim and legal/reportability decisions reserved to the RRE, review migration exceptions, approve material configuration changes, and coordinate Origami access. The contractor shall lead migration coordination and provide technical specifications, mapping, validation, reconciliation, and certification. Origami will provide the authorized import method and reasonable technical coordination under OCTA’s separate arrangement. Completion dates dependent on Verisk or Origami cooperation shall be promptly escalated, but the contractor remains responsible for managing and documenting the transition.

7. Data Security, Privacy, and Records Use OCTA data solely to perform this SOW and only to the minimum extent necessary. Do not sell, mine, combine, or use the data for unrelated analytics, product development, or advertising.

Encrypt protected and confidential data in transit and at rest; use role-based access, multi-factor authentication, logging, secure development/change control, vulnerability management, backups, and documented incident response. Provide current independent security assurance (such as SOC 2 Type II or equivalent) upon request.

Notify OCTA immediately, and no later than 24 hours after discovery, of any suspected unauthorized access, disclosure, loss, or material security event involving OCTA data; preserve evidence; investigate; mitigate; and provide written updates and a final root-cause report.

Use subcontractors/cloud providers only as reasonably necessary and approved or disclosed as required by the agreement. Bind them to confidentiality, security, privacy, retention, and deletion obligations at least as protective as the contractor’s. The contractor remains responsible for their acts and omissions.

Retain reporting records for the period required by then-current CMS guidance and the agreement, and return or securely destroy OCTA data at contract end, subject to documented legal retention obligations.

8. Contractor Minimum Qualifications At least three years of demonstrated NGHP Section 111 reporting-agent experience, including liability/self-insured programs; experience with public entities is preferred.

Current expertise in CMS registration, query and claim files, TIN reference files, ORM/TPOC reporting, response/error codes, technical specifications, alerts, audit support, and civil-money-penalty compliance.

Demonstrated secure integration experience with Origami Risk or a comparable risk/claims information system, plus at least three references for comparable services.

Adequate implementation, account-management, technical, compliance, and backup staffing to meet the January 1, 2027 go-live and ongoing service levels.

9. Assumptions and Exclusions Assumptions. One OCTA RRE; an anticipated three-year term, subject to the final agreement; one production Origami environment plus reasonable testing; low and variable claim volume; remote service unless OCTA approves otherwise; OCTA remains the final decision-maker for reportability and source-data accuracy; OCTA will provide necessary authorizations for Verisk and Origami coordination; Verisk will make OCTA-owned or otherwise transferable data available in a commercially reasonable electronic format; and Origami will provide an authorized import method. The firm-fixed price includes all implementation, incumbent-data migration and reconciliation, integration, training, account support, reporting, validation-rule maintenance, routine volume fluctuations, and changes required to remain compliant with CMS guidance. Historical volumes are planning information only and do not create a minimum purchase commitment or a basis for transaction charges.

Excluded services. Workers’ Compensation reporting (handled separately by OCTA’s TPA); Medicare Set-Asides; Conditional Payment Resolution; Medicare Advantage/Part C or Part D lien resolution; general claims administration or adjusting; legal advice; ongoing ISO ClaimSearch searches, licensing, or subscription services; Origami licensing; and unrelated recovery, lien, or settlement services. The one-time migration and reconciliation of available historical ISO results or related OCTA claim-level ISO data from Verisk into Origami is included. Any other optional service must be separately described, priced, and authorized in writing by OCTA.

10. Firm-Fixed-Price Proposal Requirements The agreement shall be awarded on an all-inclusive firm-fixed-price basis for the full three-year term. The awarded price shall not be adjusted based on the contractor’s actual costs, claim volume, staffing effort, support usage, or experience performing the work. Offerors shall submit both pricing presentations below. OCTA may select either presentation at award, and the total evaluated price shall include every amount payable for the complete three-year term.

Pricing Option A — All-Inclusive Three-Year Price: State one total firm-fixed price for the entire three-year term and identify the fixed annual installment amount payable for each contract year. The annual installments may differ to reflect the implementation effort in Year 1, but each amount shall be established at award and remain fixed.

Pricing Option B — Fixed Implementation Plus Fixed Annual Service Prices: State one firm-fixed price for implementation, transition, Verisk data migration, reconciliation, Origami integration, testing, training, and production cutover. Separately state a firm-fixed managed-service price for each of Contract Years 1, 2, and 3. All amounts shall be established at award and remain fixed.

Under either pricing option, the fixed price shall include all labor, project management, technical resources, systems, secure data exchange, implementation, incumbent-data migration, test and production loads, reconciliation, exception resolution, certification, Origami integration and maintenance, Medicare eligibility queries, CMS claim and TIN submissions, corrections, resubmissions, error resolution, account administration, training, meetings, routine reports, regulatory and validation updates, audit support, and transition-out assistance required by this SOW.

The contractor shall not separately charge by claim, claimant, eligibility query, file, record, submission, correction, resubmission, rejection, error, support hour, meeting, report, user, or routine interface activity. There shall be no minimum transaction commitment, usage tier, automatic overage charge, annual escalation, or pass-through charge unless OCTA expressly identifies and accepts the charge in the awarded agreement. Contractor-caused rework and ordinary changes necessary to comply with CMS requirements are included in the firm-fixed price.

Additional compensation is permitted only through a written amendment executed by OCTA before the additional work begins and only for a material expansion beyond this SOW, such as adding another RRE, adding Workers’ Compensation reporting, or integrating an additional claims system not identified herein. Routine claim-volume fluctuations, changes in the number of Medicare-eligible claimants, and ordinary CMS technical or reporting updates do not constitute a compensable scope change. OCTA does not guarantee any minimum volume.

11. Acceptance, Change Control, and Contract Closeout Acceptance: Deliverables are accepted when they materially conform to this SOW, agreed specifications, test cases, and security requirements. OCTA will identify material deficiencies; the contractor shall correct them promptly and resubmit without additional charge. Payment does not waive latent defects or continuing obligations.

Migration acceptance: The incumbent-data migration is accepted only after OCTA receives and approves the final data inventory, mapping, test results, source-to-target reconciliation, exception log, and contractor certification, and confirms that required CMS records and available historical ISO results are accessible and usable in Origami.

Change control: No material change to data use, architecture, hosting, subcontractors, RRE configuration, transmission method, deliverables, schedule, or price is effective without OCTA’s prior written approval through the agreement’s change process.

Closeout: OCTA owns its claim data, RRE information, configuration decisions, submission/response histories, reports, and OCTA-specific documentation. The contractor shall provide these in commonly usable formats and complete orderly knowledge transfer and access termination.

Procurement Draft | July 10, 2026 | Page 1 of 11