ODH_RFP_SRC0000033788_DOH56881_Technical_Proposal_OxBow_DMS.pdf

TECHNICAL PROPOSAL

DOH55387

Company Proprietary Information

ORIGINAL

Breast and Cervical Cancer Project (BCC) Client Management System Database

DOH55387

Issued by the Ohio Department of Health

PREPARED BY

OXBOW DATA MANAGEMENT SYSTEMS

3906 Raynor Parkway, Suite 200, Bellevue, NE 68023

402.991.8600 | www.oxbowdms.com

Company Proprietary Information

Table of Contents

1. General Information

2. Company Narrative

3. Project Narrative

4. Project Work Plan

A. Scope of Work B. Deliverables and Due Dates Attachment 1 – Financial Capability Attachment 2 – Project References Attachment 3 – Key Personnel Attachment 4 - Supplement A - State IT Policy Standard

Attachment 5 - Supplement A - Data Security and Privacy Terms

Company Proprietary Information

1. General Information

As a SaaS/Subscription Based Web Services contractor, OxBow Data Management Systems, LLC, is pleased to provide the following technical response. Our technical proposal follows the order provided in your requirements document with additional information and required appendices placed in Attachments per the Table of Contents. As documented on the title page (binder cover), trade secret information is provided in red text followed by a bracketed letter.

2. Company Narrative

(2.1.1.1., 2.1.2.) OxBow Data Management Services, LLC, formed in 2009, has been supporting CDC-grantee programs and varying Data Management Systems since 1994. The OxBow staff includes the technical architect and leadership from the initial support of Nebraska’s NBCCEDP pilot in 1994 and has provided consistent leadership and innovation to 27 States and 5 tribal programs nationwide. We currently provide support to (30) State and Tribal Health Departments providing our Med-IT® customers increased capabilities and tremendous benefits in managing their health programs compared to other supported programs. The OxBow team and Med-IT are much more than a Data Management system; we are programmatic experts and partners. With years of supporting dozens of programs and working closely with them, we have developed an understanding of procedures and nuances of the CDC supported programs that allow us to guide and assist teams in a way that just a Data Management system cannot.

Our knowledge and expertise are regularly sought out to assist with solving difficult data issues across many programs.

The OxBow team has converted and/or onboarded 11 programs in the last 8 years, of which 5 were of a similar size as Ohio. Our well documented and repeatable project plan enables our team to perform a complete program onboarding in 3 months, which includes data validation and review by the CDC. We work very closely with all programs to ensure a very thorough understanding of their needs and are always working to improve the functionality and capability to help the programs improve their data management and reporting capability. With over 75 years of combined operational experience in development of the Med-IT application, the OxBow team well exceeds the minimum requirements. Attachment 1– Financial Capability is provided as documentation to speak to the soundness and financial capability to perform the work. Attachment 2 – Project References is provided with 3 references for whom we have performed similar services and deliverables, but more are available at your request.

Our methodology is simple and falls within the industry standard of using Scrum Methodology for Project Management and the Software Development Lifecycle. By working closely with our partners, we can quickly adapt to new requirements by providing potentially shippable products every 4 weeks, if needed. Our staff is dedicated to the successful and timely delivery of Med-IT® to the State of Ohio.

(2.1.3) Med-IT® provides users with a standard user interface to generate the required Minimum Data Elements (MDE) which is in the required format for MDE submittals to the CDC. Additionally, Med-IT® also allows users to generate and download the MDE file in a CSV standard format for exporting, saving or for creating dashboards.

This flexibility makes it much easier to identify issues in the data and compare them to past MDE files, if needed.

(2.1.4.) As CDC requests changes in reporting or data gathering, OxBow Data Management Systems, LLC, is always ready to provide those CDC mandated changes in a timely manner and at no cost to the customer. Because of this, as data gathering requirements and program requirements change, the OxBow team is always ready to document necessary changes and provide a sound and approved change for the customer to ensure the best possible data capture for reporting. Because of our Agile development structure, we are always modifying or updating the system and the database to support programs and their reporting requirements.

(2.1.5.) Med-IT® includes a very flexible Open Query tools with dozens of pre-loaded queries. The OxBow team works very closely with our customers to identify queries that are needed to improve reporting as well as provide additional expertise in creating and modifying their own existing queries. The Open query tool is role-based and can allow access to specific queries as needed to assist users in improving reporting requirements. As always, the OxBow team is also available to write and modify queries as the necessity arises to ensure the program is always able to answer questions and provide very specific data to support funding and reporting requirements.

(2.1.6.) Med-IT’s built-in To Do capability allows a user or admin to assign tasks to other users or themselves.

Once the task is assigned, you can see those you have created and assigned to others as well as the ability to see those tasks that are assigned to you. Once assigned users are able to update the status to show that they have completed the task by marking it complete.

(2.1.7.) As part of the integrated billing module in Med-IT® providers or users are able upload claim data for multiple patients at one time. This is done through the EDI screen which follows the x-12 standard, referred to as the

Company Proprietary Information

837 professional or institutional format for claim submittal (version 5010). This process improves claim submission efficiency and reduces the manual data entry of claims by providers or users.

(2.1.8.) Med-IT® offers as an add-on functionality, the ability to upload and store scanned documents.

Documents must be in one of the listed formats, .pdf, .jpg, .png, but the preferred format is .pdf which provides a standard that is easy to store, smaller in storage size and much easier to view. Once the documents are uploaded, the system allows the users to associate the files with specific clients as well as identify the type of documents that were uploaded to support clinical data, enrollment or eligibility data or diagnostic related data. This is important too because when processing claim information for payment, the system performs an automated check for supporting documentation prior to allowing the claim to be processed for payment.

(2.1.9.) As part of the OxBow configuration management process, we maintain 3 distinct environments. Our internal development consists of notional data, which is where our developers deploy their code for initial testing purposes. Once the application has satisfactorily passed the internal development stage it is deployed to the test site, which again utilizes de-identified program data and allows the Oxbow team to conduct further testing and allows the customer to conduct User Acceptance Testing for new features and updates and also provides a safe space for training and allowing users to familiarize themselves with the system prior to performing data collection on the production site.

(2.1.10.) Med-IT® provides users with secure login, utilizing assigned usernames and complex passwords to secure the application. SSO login capability will soon be implemented within the system to fall in line with more stringent State security requirements for user authentication. Once the user logs into the system, all users will have been assigned a specific role for authorization purposes. These roles restrict access to clients as well as being able to limit user access to various portions of Med-IT where the user may not need access to perform their duties. These roles are identified and created by the State Administrators and OxBow is always available to assist and answer any questions as necessary.

3. Project Narrative

Since the Ohio Department of Health currently uses the OxBow solution, the traditional onboarding process will be an abbreviated version. The following describes the proven process used for programs new to Med-IT® along with portions applicable for the continued use of the solution by the ODH.

As part of the onboarding project, OxBow Data Management, LLC will identify all requirements and necessary changes that the ODH may have defined for the new award period through discussions and review of existing documentation and functionality. Those requirements will be translated into User Stories and documented in the ticket tracking/project management tool Jira. Following Scrum Methodology, our team will review and identify the changes/requirements and will prioritize, review and prepare the user stories for development in accordance with our CMMI for development processes. Once the team has reviewed and provided feedback for the user stories, the project management team will request the program to review these stories as written to ensure all requirements were identified and translated in line with the original requirements and meet the intent. If the program data did not already exist within the Med-IT® database, the OxBow team communicates with the State project team to continue discussions, ask questions, provide validation and ensure a complete and full understanding of what the status of their data is and how it was manipulated, if at all. At the end of the final conversion, the program would be requested to generate an MDE identical to the last MDE submitted to IMS for comparison. This methodology will ensure complete understanding of the data converted and how it compares to the data previously submitted. If this meets the scrutiny of the program and IMS, we consider the conversion successful and migrate that data to production and the program will go Live with using the production site for data entry and reporting. As it is, Ohio’s data has already been migrated from their prior system, and they have since submitted 14 BCC MDE files and 2 WISEWOMAN MDEs without any issues. Once a new program goes live, the program finds that. e screens and reports closely resemble the previous processes and should allow for users to easily transition to the data management system once all of the trainings are conducted. In the case of the ODH, reports and screens have already been customized to meet their specific needs over the last 7 years of using the OxBow application. Based on our experience converting almost a dozen program, the full transition process can take about 4 – 12 weeks, depending on program response time to questions and providing data. Ohio Department of Health will be able to continue normal operations uninterrupted on day one of the new contract.

OxBow Data Management Systems, LLC is comprised of a very experienced team of professionals who have performed more conversions than any other program and combined have over 75 years’ experience supporting CDC programs and specifically, the NBCCEDP and WISEWOMAN programs. Please find the attached resumes as Attachment 3 – Key Personnel for our senior management team. (2.2.2.5.) All work on Med-IT and for our customers

Company Proprietary Information is performed locally in Bellevue, Nebraska and does not subcontract work out for this project, due to the proprietary nature of the project. Our Data Management System provides ODH compliant data management, data analysis and validation, eligibility determination, provider reimbursement, program and fiscal management processes with routine and ad hoc queries and reporting.

4. Project Work Plan

OxBow’s work plan reflects the lessons learned to transition and support over a dozen different customers with our software applications. The approach breaks our work out into two main categories, transition and operations. Transition work efficiently moves a customer from their current system through implementation to full operations using OxBow’s system, while operations are the tasks to keep the system available, compliant, and provide enhancements. OxBow has successfully transitioned 11 state and tribal programs to various SaaS platforms. Over the years we have developed very effective processes for transitioning programs within a 5-phase approach: 1) requirement definition (and legacy understanding), 2) data conversion, 3) application enhancement and acceptance testing, 4) training, and 5) implementation. The transitions have taken place over a variety of time frames depending on the needs of customers as well as from numerous legacy systems. OxBow will use these proven processes, and the lessons learned to provide a smooth and effective transition for the NBCCEDP and WISEWOMAN programs and data. Once implemented, we will manage the on-going operations and upgrades/changes to maintain compatibility in compliance with the service level agreements and required reporting using our CMMI III processes. See the Scope of Work and Deliverables section for details of our approach. We believe this is the best solution for the BCCP program because it provides:

A Comprehensive & Integrated System – Our Data Management System provides a single data system which supports CDC screening programs. Not only does it support the specific CDC reporting requirements it goes well beyond that to simplify the day-to-day operations of ODH staff and other stakeholders. It includes support for Patient Navigation, real-time error checking, follow-up reports, and patient rescreening notification reports. With over 80 built in reports (using real-time data), ad hoc query capabilities, and on-demand data export ODH staff has immediate access to the information they need to excel in their management of the program and the men and women they serve.

Web-Based Enterprise System – Our Data Management System gives users convenient access to their data through secure internet access. There is no need for users to purchase special hardware or download any software:

Our System is available through standard web-browsers such as Internet Explorer, Edge, and Chrome. Access is role based, and users have their own specific usernames, passwords, and validation questions ensuring they have access to the information they need and only the information they need. There is no limit to the number of user accounts DOH may create and with the high bandwidth capabilities of our data center and the robust capabilities of the application servers ensure all users enjoy speedy response times.

Flexible – While our Data Management System is comprehensive in its capabilities, it has also been designed for maximum flexibility. Most field validation takes place through administrative user-controlled tables. ODH administrators will be able to modify these tables as needed, including adding new procedures. They will also define as many types of user roles as required to meet their needs. From a development point of view, the system uses state-of-the-art techniques for structured design and development. This allows OxBow technical personnel to make changes to the system quickly and efficiently: supporting both CDC mandated changes and helping subscribers meet their specific needs.

Accurate – As a web-based system it provides real-time access to data as it is entered by users across the State.

Reports, edit checks, and queries have access to the most accurate and up-to-date information available. Because the system also records insert, edit, and delete history on all data, users can go back and verify previously entered data if there is a question on accuracy. Redundant database servers ensure seamless continuity of operations if something were to happen with one of the servers.

Secure – OxBow staff receive annual HIPAA training to ensure all personnel are aware of our responsibility to our customers to ensure their data is as secure as possible. All communications with the application use secure

Company Proprietary Information data connections. Data is encrypted during transmission and when at rest. All data backups are further encrypted.

The data center itself provides 24/7/365 manned and monitored facilities. Data servers are further secured in dedicated locked cabinets accessible to key OxBow IT personnel. To help our subscribers meet their HIPAA security requirements they have the ability to set password reset intervals, login security levels, and define access roles for all users. To further protect data, OxBow provides a test environment for subscribers which includes de-identified client data suitable for new users for training as well as a test bed for acceptance testing new features.

Efficient – Our Data Management System helps users make better use of their time. Numerous reports help staff identify clients in need of follow-up screening, diagnostics, or navigation activities. The performance Indicator reports keep both users and administrators informed of the timeliness and completeness goals CDC monitors for program performance. The system includes options for importing of claim information using standard claim submittal formats – eliminating much of the manual entry of claims. Throughout the application there are shortcuts for entering common information such as the use of default values and keyboard shortcuts.

Scalable – As a fully hosted solution our Data Management System provides OxBow the ability to upgrade hardware as needed if programs begin to grow in scope and capacity. This is accomplished transparent to the user and is provided as part of the basic subscription costs. Our flexible design allows OxBow administrators to turn on and off various features of the application. This allows OxBow to maintain a master version of the software while providing subscribers with a custom view of their data.

Compatible – OxBow technical personnel attend all CDC data meetings and webinars in order to learn firsthand of any planned changes to data collection and/or reporting. This enables OxBow to provide support for those changes well ahead of CDC implementation.

Stable – Stability, availability and reliability are key tenants in OxBow’s approach with our Data Management system. While most users will interface with the Production interface, there exist three other platforms behind the scenes. Development work is performed at the lowest level platform. Once code has passed unit testing it is promoted to our Internal Test environment. Here it undergoes integration testing including stress and limit testing.

If it appears to function as intended within the application, it moves to the Test or Staging platform. This environment is also a customer facing interface and subscribers are provided access to this Test system. It is here that users can freely test features, receive training, and preview upcoming enhancements. Only the Production system contains actual client data. The remaining three environments use deidentified data ensuring protection of

EPHI.

(2.2.3.2.) OxBow Data Management Systems, LLC is located in Bellevue, Nebraska and is the principal office from which all work is performed. Our Data Center is also located in Bellevue, NE and all data is maintained within the United States at all times.

(2.2.3.3.) As part of this contract, we believe there will be zero amount of time needed for lead, and key project personnel to work on this project as all existing capabilities and requirements currently exist within Med-IT®. If the need arises for additional meetings, the OxBow team will make itself available to attend requirements meetings and discussions to ensure there is zero downtime for the ODH staff.

(2.2.3.4) As stated, since this application is currently used by the ODH staff, there is minimal risk for completing the project, should the lead or key project personnel become unavailable for any reason. We do work regularly to cross train and provide backup assistance for every member of the team so that in the case of an emergency, there would be minimal gaps and there would be no effect on the Med-IT system.

(2.2.3.5.) We do not anticipate any difficulties in meeting the project specifications for this project. As a current customer, we are very involved with the customers on a daily basis, standing by to answer questions or assist in any way.

A. Scope of Work (3.1.1) Med-IT® and the well-established OxBow team are offering a well-established client management system that meets or exceeds the NBCCEDP and WISEWOMAN data requirements as established by the CDC, medical billing tracking and EDI, reminder recall, case management, document uploading and ability to create query commands and create ad-hoc reports within the system. Med-IT® exceeds the CDC requirements data requirements by implementing state specific data requirements that are not included in the MDE but provide the customer more reporting metrics and to assist the state in understanding their client base more efficiently. CDC

Company Proprietary Information only requires basic information on screenings, diagnostics, treatments and outcomes and most customers want more information to potentially navigate their clients to other state programs and Med-IT support that as well as can support various other cancer and diabetes programs if desired.

(3.1.2.) As part of the subscription costs, Med-IT provides an intuitive user interface which allows users to generate an MDE file in the required CDC format for not only the NBCCEDP, but also the WISEWOMAN program. It not only will generate a file in the CDC required format but will also generate a file in a standard CSV format to allow the state the use of that data in various other reporting and dashboarding tools. When the CDC updates their Minimum Data Elements, OxBow is quick to review those new MDE reporting requirements and starts work immediately to implement them in Med-IT. Once Med-IT has been updated and is ready we will submit a test MDE file to IMS/Deloitte for review and in many cases had the new Edit Check and MDE generation completed before the CDC and IMS/Deloitte was ready to process those files on their side and several times have assisted them in identifying errors in their MDE processing tool. Several weeks prior to the MDE submissions the OxBow staff will send out reminders and assist programs with data cleanup, the creation of queries or whatever else assistance programs need to ensure their data is clean and ready for MDE submittal.

(3.1.3) The OxBow team is always available to assist with database functions and have several staff members who are able to support all aspects of the database. Customers have access to our staff through our help desk and have our email and phone numbers to discuss query modification or assistance, and we regularly have discussions with them about the best practice and method for pulling the data needed to support all of their programs and reporting requirements.

(3.1.4) Case management activities are tracked through their respective pages within Med-IT, and through various queries and reports, users can track and verify all aspects of the case management workflow. Med-IT® provides a specific form for scheduling appointments for referrals which tracks the referral type, referral date, appt date and time as well as the outcome and who the client was referred to. This form was developed to specifically support ODH and includes the ability for the user to print a customized letter for the client with appointment information.

All of the tracked screenings and diagnostics provide the user with a field to annotate results for all services and include various client activity notes. This is very important to the long-term success of providing services to clients year after year and ensuring follow-ups are completed. As part of the client enrollment process, there are screens that include enrollment, eligibility and demographic information as well as Health History which includes CDC required fields. Once a client has received services, the program can review all services through the summary of services page and can then enter and manage claims for reimbursement of services provided. The providers or state staff can enter new claims manually or can import 837 professional or institutional files to enter the claim information for reimbursement by the state.

(3.1.5.) Most every page within Med-IT® captures historical data for modifying the data. When a user inserts, edits, updates, deletes information for a specific field on a page, that data is available to review and restore by the user or an Admin. There are a couple of pages where the information is available in a csv file format for download and others are available through a change log which allows for the restoration of modified data. There is no way for users to remove this history data and allow Administrators and staff to review files for errors, modifications or any other reason at the direction of State staff members.

(3.1.6) Because we work with and support so many programs, we have found that by sharing reports we can offer some more assistance to programs. Med-IT currently has over 50 reports available to the users including, but not limited to: Demographics Report, Follow-up, Performance Indicators or Measures, Rescreening Notifications report, Billing authorization, Fund Balances, Claim approval needed, contract matching, Missing claims, partial claims, EPHI Access Log, User Activity Log, Summary of Claims, Summary of Services and many more reports designed to replace some of the regularly used queries to support CDC and State reporting requirements.

Additionally, the Open Query Tool allows for Ad-Hoc Data Extraction through user generated queries. These are very flexible and user friendly and can be a very nice addition to pulling additional data not normally included in standard reports. The ODH data team has already developed over 400 ad hoc queries they use for client management, claim validation, and to support various program dashboards among other uses. We also provide Online Help system, Online Dictionary and each page has the ability to include Help files, some of which are OxBow designed to better understand the specific page and how it is used and some are provided by the state for more specific knowledge on data they might need to include or answer regularly asked questions regarding the information on that page.

(3.1.7.) OxBow provides webinar training on all substantial system modifications or enhancements and as requested by the State, which can include additional charges. That type of additional training for providers or new employees is recorded and made available through Med-IT® so it is available for review at any time and also to

Company Proprietary Information hopefully minimize the amount of training necessary for refresher training or new user training. We are always standing by to assist as needed to ensure smooth transitions within your program.

Because the State of Ohio is a current customer, the incoming transition training will not be necessary, and Med-IT will be available day one upon contract award.

B. Deliverables and Due Dates (3.2.1.) As the incumbent provider, OxBow Data Management Systems, LLC is prepared to support the BCCP program from day 1 of the award. This deliverable is included in the Annual BCCP subscription and includes, but is not limited to:

• Support for data collection of all CDC directed Minimum Data Elements (MDE) in support of the National Breast and Cervical Cancer Early Detection Program (NBCCEDP)

• Generation of the current MDE data files

• Support for claims and billing using standard Current Procedural Terminology (CPT) codes or user defined codes in the same format

• Patient Navigation/Case Management

• Secure login

• Role based access

• History tracking of all data insert/edit/delete activities

• Standard reports including:

a. Demographics

b. Follow-up

c. Performance Measures

d. Rescreening Notifications

e. Billing Authorization

f. Fund Balances

g. Electronic Protected Health Information (EPHI)Access Log

h. User Activity Log

i. Ad-hoc Query capability

j. Ad-hoc Data Extraction utility

k. Online Help System

l. Online Data Dictionary

(3.2.2.) As the incumbent provider, OxBow Data Management Systems, LLC is prepared to support the WISEWOMAN program from day 1 of the award. This deliverable is included in the WISEWOMAN Annual Subscription and includes, but is not limited to:

• Support for data collection of all CDC directed Minimum Data Elements (MDE) in support of the WISEWOMAN:

Well-Integrated Screening and Evaluation of WOMen Across the Nation.

• Generation of the current MDE data files.

• Support for claims and billing using standard CPT codes or user defined codes in the same format

• Patient Navigation/Case Management

• Secure login

• Role based access

• History tracking of all data insert/edit/delete activities

• Standard reports including:

a) Demographics

b) Follow-up

c) Performance Measures

d) Rescreening Notifications

e) WISEWOMAN Screening Opportunities

f) LSP Status Report

g) Billing Authorization

h) Fund Balances

i) EPHI Access Log

j) User Activity Log

Company Proprietary Information

k) Ad-hoc Query capability

l) Ad-hoc Data Extraction utility

m) Online Help System

n) Online Data Dictionary

(3.2.3.) As the incumbent provider, OxBow Data Management Systems, LLC is prepared to continue to provide full access to all Scanned documents currently stored in the system and attached to clients starting on day 1. Additionally, OxBow will continue to support the uploading of new documentation in support of the BCCP and WW Program and is not limited in size. Med-IT® currently holds and maintains over 360,000 images uploaded by the ODH.

(3.2.4.) As the incumbent provider, OxBow Data Management Systems, LLC is prepared to support EDI – Electronic Data Interface functionality from day 1 of the award. This functionality allows providers the option of submitting their claims in the same format which most major insurance companies as well as agencies such as Medicaid and Medicare require. Specifically, the EDI can read text files which are generated using the X-12 standard referred to as the 837 Professional or 837 Institutional formats for claim submittal (version 5010). Providers create a list of claims using this format and then through a pre-arranged process with the program administrators securely send the file or upload it directly into the client management system database for processing. Because this will be available day one upon award, ODH will be able to continue to process claims and reimburse providers according to the current Medicare rates. To date, ODH has imported almost 13,000 claims using the EDI process – significantly reducing the time needed to manually enter claims and greatly increasing accuracy.

(3.2.5.) Following OxBow’s CMMI processes, we utilize 4 distinct and separate environments for the Med-IT® lifecycle. The technical solution for a Sprint begins in the Development environment. Here the solution is coded and undergoes initial unit testing. Daily status meetings, called Stand Ups, highlight progress, roadblocks, and planned activities. This supports Risk Management as it allows for early identification of issues and allows for rapid course corrections needed to keep progress on track. As the items in the Sprint pass the unit testing and peer reviews conducted as part of the Technical Solution phase they are promoted to Integration testing. This is the point where enhancements are tested in the context of the entire application. Defined Test Cases are used to verify that the enhancement meets the requirements and functions as expected within the application. This takes place in OxBow’s Internal Test Environment. Only OxBow technical and testing staff have access to this location. Any issues discovered at this point result in the code being returned to the Technical Solution phase for rework and retesting before they return to the Integration testing environment.

Upon successful completion of the various test cases, the code may be promoted to the Staging Environment. This environment is also known as the external test environment because it is the first opportunity for external users (customers) to interact with the new features. The same test cases plus any customer requested testing take place during this phase. Again, any issues result in the code being returned to the Technical Solution phase. From there it must pass the Unit and Integration test gates before it returns to the Staging environment for continued acceptance testing. This point is also where the Sprint Review takes place to ensure all necessary supporting elements are in place such as release requirements and documentation.

Once OxBow and the affected customers agree on acceptance of the changes, the updated system is released to the Production environment during a pre-scheduled window where there is no or minimum user activity. Oxbow’s configuration management processes allow for roll-back of the changes in the unlikely event that the newly release code does not function as intended. After a release, the OxBow team is always standing by to promptly respond to and correct any identified defects.

Company Proprietary Information

Attachment 1 – Financial Capability

Attachment 2 – Project References

Name of Client & Project Title State of South Carolina – Cancer Division Data System

Contract Value $548,000.00

Nature and Scope of Project:

The South Carolina Project is an example of a conversion project which involved conversion of Breast, Cervical, and Cardiovascular data similar to the needs of Ohio.

South Carolina was time constrained for the conversion and training due to an upcoming FPAR submittal in a new format. OxBow successfully brought them into the Med-IT® application and completed training for staff and staff trainers all within 3 months. They currently track over 240,000 NBCCEDP cycles for over 115,000 clients

– similar to the expected data needs of Ohio. In addition, South Carolina has over 900 trained Med-IT® users at provider locations across the state who are responsible for data entry and data maintenance. It is a testament to Med-IT®’s ease of use that South Carolina handles the initial and ongoing training of these users with minimum staff required.

Project Duration: Start Date Year: 2009 End Date Year: On-going

Nature of the Client:

South Carolina’s project is managed under the South Carolina Department of Health & Environmental Control (DHEC), Division of Cancer Prevention & Control. The South Carolina Department of Health has similar responsibilities to the Ohio Department of Health.

Nature of Client Audience:

Primary users of the Med-IT® system in South Carolina include high level Department of Health managers (in order to obtain higher level reports and data), Chronic Disease Division users (day to day administrators of the system), and end users in provider locations across the state (responsible for data entry and client management).

Number of Users: 920

# & Composition of Vendor Employees & Consultants Assigned:

During the transition phase OxBow dedicated 3 software developers, 1 test/requirements manager, 1 data analyst, and 1 project manager. These individuals were assigned 50-90% of their time during this phase to the project. The same team continues to support South Carolina at approximately 5-15% of the time depending on South Carolina’s current needs [a]. All staff are OxBow full-time employees and no consultants or outside contractors are used.

Client Contact Information:

Reference Contacts:

Name: Selena L Lowery, MBA, MA Title: Director Department: Division of Cancer Prevention & Control, SC DHEC Full Address: 2100 Bull Street, Columbia, SC 29201 Telephone: 803-898-1613 E-mail: LoweryS1@dph.sc.gov Relation/Role to Project: Manages the Breast & Cervical

Name: Katelyn Hastie Title: WISEWOMAN Program Manager Department: Division of Cancer Prevention & Control, SC DHEC Full Address: 2100 Bull Street, Columbia, SC 29201 Telephone: 803-612-9833 E-mail: hastieke@dph.sc.gov Relation/Role to Project: WISEWOMAN Program Manager

Name: Beth Williams Title: Data Manager

Department: Division of Cancer Prevention & Control, SC DHEC Full Address: 2100 Bull Street, Columbia, SC 29201 Telephone: 706-566-6673 E-mail: williame@dhec.sc.gov Relation/Role to Project: NBCCEDP and WISEWOMAN Data Manager

Company Proprietary Information

Name of Client & Project Title State of Texas – Breast and Cervical Cancer Program

Contract Value $1,480,200.00

Nature and Scope of Project:

The Breast and Cervical Cancer Screening Program in Texas had been supported by an in-house data application. The developers were no longer available when OPA released the latest FPAR report requirements and by the time Texas realized they did not have the expertise to update the in-house system they reached out to OxBow as recognized experts for NBCCEDP support with a ready-to-use solution. Within 5 months OxBow managed the conversion of over 500,000 screening cycles for over 300,000 women. In addition, OxBow staff conducted 10 training sessions across the state. Texas is the 4th largest NBCCEDP grantee, and they use Med-IT® to track over 800,000 NBCCEDP cycles for over 400,000 clients – well in excess of the expected data needs of Ohio. Texas Med-IT® administrators handle the initial and ongoing training of their 500+ users across the state.

Project Duration: Start Date Year: 2009 End Date Year: On-going

Nature of the Client:

Texas’s project is managed under the Texas Health & Human Services Commission (HHSC), Division of Women’s Health Services. The Texas Department of Health & Human Services has similar responsibilities to the Ohio Department of Health.

Nature of Client Audience:

Primary users of the Med-IT® system in Texas include high level HHSC managers (in order to obtain higher level reports and data), HHSC Division users (day to day administrators of the system as well as system trainers), and end users in provider locations across the state (responsible for data entry and client management).

Number of Users: 575

# & Composition of Vendor Employees & Consultants Assigned:

During the transition phase OxBow dedicated 3 software developers, 1 test/requirements manager, 1 data analyst, and 1 project manager. These individuals were assigned 80-90% of their time during this phase to the project. The same team continues to support Texas at approximately 5-10% of their time [a] depending on Texas’s current needs. All staff are OxBow full-time employees and no consultants or outside contractors are used.

Client Contact Information:

Reference Contacts:

Name: Amanda Schmidt Title: Program Evaluator and Data Manager Department: Family and Community Health Services Division, Department of State Health Services Full Address: Department of State Health Services, PO Box 149347, Austin, TX 78714 Telephone: E-mail:

Amanda.Schmidt@hhs.texas.gov Relation/Role to Project: Responsible for fiscal interface between Med-IT® and the state payment system

Name: Greg Valverde Title: Data Analyst Department: Breast and Cervical Cancer Services Women’s Health Services Health & Human Services Commission (HHSC) Full Address:

Breast and Cervical Cancer Services Women’s Health Services

Health & Human Services Commission (HHSC) 1100 W. 49th Street.

Austin TX 78756 Telephone:

E-mail: Greg.Valverde@hhs.texas.gov Relation/Role to Project: NBCCEDP Data Manager

Company Proprietary Information

Name of Client & Project Title State of Alabama – Breast and Cervical Cancer Early Detection Program

Contract Value $1,102,157.00

Nature and Scope of Project:

In 2005 the State of Alabama’s Breast & Cervical Cancer Early Detection Program transitioned from a custom Indus system to OxBow’s desktop Breast & Cervical Cancer system. In 2009, after the release of Med-IT®, their program transitioned to that system. They continue to use Med-IT® in support of their 115,000+ clients. They are also a WISEWOMAN grantee and are nearly identical to Ohio with just over 215,000 NBCCEDP cycles and over 1800 WISEWOMAN cycles. Like Ohio they are also a former CRCCP grantee hoping to regain OPA funding if that program should be expanded. In the meantime, they enjoy having access to the prior CRC screening data (nearly 5000 screening cycles) creating a comprehensive overview of screening services provided to clients over the years – the same advantage OxBow is pleased to offer the Ohio programs. Also, like Ohio, Alabama trains providers across the state on the use of Med-IT® for data entry and client management. They currently have over 2300 statewide users.

Project Duration: Start Date Year: 2005 End Date Year: On-going

Nature of the Client:

Alabama’s project is managed under the Alabama Department of Public Health, Cancer Prevention and Control Division. The Alabama Department of Public Health has similar responsibilities to the Pennsylvania Department of Health.

Nature of Client Audience:

Primary users of the Med-IT® system in Alabama include high level DPH managers (in order to obtain higher level reports and data), Cancer Prevention & Control Division users (day to day administrators of the system as well as system trainers), and end users in provider locations across the state (responsible for data entry and client management).

Number of Users: 2290

# & Composition of Vendor Employees & Consultants Assigned:

During the transition phase OxBow dedicated 2 software developers, 1 test/requirements manager, 1 data analyst, and 1 project manager. These individuals were assigned 50-75% of their time during this phase to the project. The same team continues to support Alabama at approximately 5-10% of their time [a] depending on Alabama’s current needs. All staff are OxBow full-time employees and no consultants or outside contractors are used.

Company Proprietary Information

Client Contact Information:

Reference Contacts:

Name: Nancy Wright Title: Director Department: Cancer Prevention and Control Division Full Address: RSA Tower, 201 Monroe Street, Suite 1364, Montgomery, AL 36104 Telephone: 334-206-5851 E-mail: nancy.wright@adph.state.al.us Relation/Role to Project: Director, Cancer Prevention and Control Division

Name: Mirwais Zhuben Title: Epidemiologist, Data Manager Department: Cancer Prevention Services, Alabama Cancer Prevention & Control Division Full Address: RSA Tower, 201 Monroe St. Suite 1391, Montgomery, AL 36104 Telephone: 334-206-7034 E-mail: Mirwais.Zhuben@adph.state.al.us Relation/Role to Project: Data Manager

RFQ # 6100039152

Attachment 3 – Key Personnel

POSITION

PERSONNEL

NAME

COMMITM

ENT

YEARS’ PRIOR

EXPERIENCE IN

POSITION

OTHER RELEVANT

EXPERIENCE

EDUCATION

OTHER

PROFESSIONAL

QUALIFICATIONS

Project Manager

C. Jones

30%

Has managed the transition and implementation of 11 other programs to the Med-IT® platform

BA – Network Administration

MIT – Internet Security

MBA – Project Management

Certified Scrum Master

(CSM)

MIS

Technical

Lead/ Architect

C. Wendover

80-90%

30+

Has managed the transition and implementation of 15 other programs to the Med-IT® platform

BA

Computational Mathematics

MS Data Science

CMMI Associate (CMMI

Institute)

MIS

Application Technical Developer

M. Westadt

50-60%

6+

Developed many of the reports and user interfaces within Med-IT®

BS – Ag Business and Accounting/

Marketing Master of

Information Systems

Business Analyst/Prod uct Owner

M. Heffelfinger

30-50%

3+

30+ years Managing NBCCEDP and

WISEWOMAN programs for the State of Nebraska

State of Ohio Department of Administrative Services / Office of Information Technology

Supplement A: State IT Policy, Standard and Service Requirements P a g e | 1

Company Proprietary Information

Supplement A:

State IT Policy, Standard and Service Requirements

Revision History:

Date: Description of Change:

1/01/2019 Original Version

10/18/2019

Updated to modify service descriptions, include new services, and remove older services. A new Appendix A - Request for Variance to State IT Policy, Standard or Service Requirements was added.

12/15/2020 Updated to align with current service offerings, to incorporate the Cloud

Smart strategy, and to clarify the variance request requirements.

5/13/2021 Updated to align with current Infrastructure as a Service (IaaS) Frameworks service offering.

7/19/2021 Updated to modify service descriptions, include new services, and remove older services.

02/07/2022

Updated Section 4.1. State IT Cloud Smart Strategy to clarify the scope, intent, and requirements of the service. Also, reorganized the public and private cloud information.

05/03/2022

Updated Section 4.3.6 ePayment Business Solutions audit standard.

Modified Section 3. State IT Policy and Standard Requirements to remove the references to State of Ohio IT Bulletins and revise hyperlinks.

07/10/2024 Updated the format, structure, and terminology to reflect current practices.

Modified the services to align with current offerings.

Supplement A: State IT Policy, Standard and Service Requirements P a g e | 2

Company Proprietary Information

Contents

1. Contractor Identification and Supplement Definitions

2. Overview of Supplement and Requirements

3. Proposed Variances to Supplement Requirements

4. State and DAS IT Policies and Standards

5. State IT Services

5.1. State IT Cloud Smart Strategy

5.1.1. Public Cloud Brokerage Service

5.1.2. Private Cloud Data Center Services

5.2. InnovateOhio Platform (IOP)

5.2.1. IOP Identity Service Offerings for Ohioans and Workforce

5.2.2. IOP User Experience Service Offerings

5.2.3. IOP Web Forms

5.2.4. IOP Data and Analytics Products

5.3. Enterprise Application Services

5.3.1. Artificial Intelligence Capabilities

5.3.2. Enterprise Hosted Document Management

5.3.3. Electronic Data Interchange (EDI) Application Integration

5.3.4. eLicense Ohio Professional Licensure

5.3.5. ePayment Business Solutions

5.3.6. Enterprise eSignature Service

5.3.7. IT Service Management Tool (ServiceNow)

5.3.8. Automated Ticketing

5.3.9. Ohio Benefits

5.3.10. Ohio Business Gateway

5.3.11. OAKS

5.3.12. Enterprise Geographic Information Systems (GIS)

5.3.13. OhioBuys

5.4. Application Security Architecture

5.5. Microsoft Office 365 Service

5.5.1. Microsoft 365 Apps

5.5.2. Microsoft 365 Platform Features

5.5.3. Microsoft Power Platform

5.6. Network Services

5.6.1. Ohio One Network

5.6.2. Secure Authentication

5.6.3. Wireless as a Service

5.7. Voice Services

5.7.1. Voice over Internet Protocol (VoIP)

Supplement A: State IT Policy, Standard and Service Requirements P a g e | 3

Company Proprietary Information

1. Contractor Identification and Supplement Definitions

Active Directory means the “directory service” portion of the Windows operating system. Active Directory manages the identities and relationships of the distributed resources that make up a network environment. It stores information about network-based entities (e.g., applications, files, printers, and people) and provides a consistent way to name, describe, locate, access, manage and secure information about these resources.1

Agency means State of Ohio agency.

Contractor for the purposes of this supplement, includes subcontractors or other personnel under the authority or control of the Contractor performing the work or providing the services under this Contract.

Please provide the following information in the space below: Contractor name, Contractor address, associated Contract or RFP number, and solution/product/service(s) being proposed in response to the Contract or RFP.

OxBow Data Management Systems, LLC

3906 Raynor Pkwy, Suite 200

Bellevue, NE 68123

ODH RFP #SRC0000031081/DOH56991

Med-IT®

Contract means the contract or RFP listed above under Contractor.

Customer means the Agencies, boards, commissions, institutions of higher education or local government entities that are authorized to leverage State of Ohio IT services.

DataOhio Portal established by Executive Order 2019-15D, the DataOhio Portal (DOP) displays public datasets and facilitates the request, approval, and delivery of secured datasets, providing for public access to information with transparency and ease. The portal improves Ohioan and customer interactions with Agencies.

State means the State of Ohio.

User is the individual or (system) process authorized to access a system.2

2. Overview of Supplement and Requirements

This State IT Policy, Standard and Service Requirements Supplement (“Supplement”) applies to any and all work, services, locations and computing elements that a Contractor performs, provides, occupies or utilizes in conjunction with the delivery of work to the State and any access to State resources in conjunction with delivery of work.

This Supplement specifically applies to:

1 “Active Directory” Gartner IT Glossary. Web. 3 January 2024. < https://www.gartner.com/en/information-technology/glossary/active-directory>.

2 “FIPS 200, Minimum Security Requirements for Federal Information and Information Systems.” U.S. Department of Commerce National Institute of Standards and Technology, March 2006.

<https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.200.pdf>.

Supplement A: State IT Policy, Standard and Service Requirements P a g e | 4

Company Proprietary Information

A. Major and minor projects, upgrades, and other software and systems inclusive of all State elements or elements under a Contractor’s responsibility utilized by the State;

B. Any systems development and integration activities performed by a Contractor; and

C. Any authorized change orders, change requests, Statements of work, extensions or amendments to a

Contract.

The terms in this Supplement are in addition to any Contract terms and conditions. In the event of a conflict between this Supplement and a Contract, the strictest standard prevails.

3. Proposed Variances to…