Provider_Business_Services_RFP_OCMP-25-22321.pdf

STATE OF MARYLAND

MARYLAND DEPARTMENT OF HEALTH (MDH)

REQUEST FOR PROPOSALS (RFP)

PROVIDER BUSINESS SERVICES (PBS)

STATEWIDE ADMINISTRATION OF PROVIDER

ENROLLMENT, REVALIDATION, REENROLLMENT, AND

UPDATE ACTIVITIES FOR THE MARYLAND MEDICAID

PROGRAM

RFP NUMBER OCMP-25-22321

ISSUE DATE: May 6, 2025

NOTICE

A Prospective Offeror that has received this document from a source other than eMaryland Marketplace

Advantage (eMMA) should register on eMMA (https://procurement.maryland.gov). See § 4.2.

Minority Business Enterprises are Encouraged to Respond to this Solicitation.

https://procurement.maryland.gov/

Statewide Administration of Provider Enrollment, Revalidation, Reenrollment, and Update Activities for the Maryland Medicaid Program

Solicitation #: OCMP-25-22321

RFP Document

Maryland Department of Health RFP to Administer Provider Business Services Page ii of xi

VENDOR FEEDBACK FORM

To help us improve the quality of State solicitations, and to make our procurement process more responsive and business friendly, please provide comments and suggestions regarding this solicitation.

Please return your comments with your response. If you have chosen not to respond to this solicitation, please email or fax this completed form to the attention of the Procurement Officer (see Key Information

Summary Sheet below for contact information).

Title: Provider Business Services: Statewide Administration of Provider Enrollment, Revalidation, Reenrollment, and Update Activities for the Maryland Medicaid Program | Solicitation No: OCMP-25-

22321

1. If you have chosen not to respond to this solicitation, please indicate the reason(s) below:

Other commitments preclude our participation at this time.

The subject of the solicitation is not something we ordinarily provide.

We are inexperienced in the work/commodities required.

Specifications are unclear, too restrictive, etc. (Explain in REMARKS section.)

The scope of work is beyond our present capacity.

Doing business with the State is simply too complicated. (Explain in REMARKS section.)

We cannot be competitive. (Explain in REMARKS section.)

Time allotted for completion of the Proposal is insufficient.

Start-up time is insufficient.

Bonding/Insurance requirements are restrictive. (Explain in REMARKS section.)

Proposal requirements—other than specifications—are unreasonable or too risky. (Explain in

REMARKS section.)

MBE or VSBE requirements (Explain in REMARKS section)

Prior State of Maryland contract experience was unprofitable or otherwise unsatisfactory.

(Explain in REMARKS section.)

Payment schedule is too slow.

Other: ________________________________________________________________________

2. If you have submitted a response to this solicitation, but wish to offer suggestions or express concerns, please use the REMARKS section below. (Attach additional pages as needed.)

REMARKS: __________________________________________________________________________

Vendor Name: ____________________________________________ Date: _______________________

Contact Person: _____________________________________ Phone (_____) _______-______________

Address:

Email Address:

Maryland Department of Health RFP to Administer Provider Business Services Page iii of xi

STATE OF MARYLAND

MARYLAND DEPARTMENT OF HEALTH (MDH)

KEY INFORMATION SUMMARY SHEET

Request for Proposals

Provider Business Services: Statewide Administration of Provider

Enrollment, Revalidation, Reenrollment, and Update Activities for the

Maryland Medicaid Program

Solicitation Number OCMP-25-22321

RFP Issue Date May 6, 2025

RFP Issuing Office Maryland Department of Health (MDH or the “Department”)

Procurement Officer

Dana Wright

Maryland Department of Health (MDH)

Office of Contract Management and Procurement (OCMP)

201 W. Preston Street, 4th Floor

Baltimore, MD 21201

Email dana.wright@maryland.gov

Proposal Submissions eMaryland Marketplace Advantage (eMMA)

Proposal Submissions

Proposals will be accepted through the State’s eMaryland Marketplace

Advantage (eMMA) e-Procurement system.

Instructions on how to submit proposals electronically can be found at:

https://procurement.maryland.gov/wp-content/uploads/sites/12/2021/01/5-eMMA-QRG-Responding-to-Solicitations-Double-EnvelopeRFP.pdf

Solicitation Questions MDH.solicitationquestions@maryland.gov (Attention: Dana Wright )

Pre-Proposal

Conference

Tuesday, May 13,2025, at 3 p.m. virtually

See RFP Attachment A for directions and instructions.

Questions Due Date and Time

Thursday, June 12 , 2022 2PM Local Time

Proposal Due (Closing)

Date and Time

Monday, June 23, 2025, 2PM Local Time

Offerors are reminded that a completed Feedback Form is requested if a no-bid decision is made (see page ii).

MBE Subcontracting

Goal

This solicitation does not include an MBE subcontracting goal.

VSBE Subcontracting

Goal

This solicitation does not include a VSBE subcontracting goal.

https://procurement.maryland.gov/ https://procurement.maryland.gov/wp-content/uploads/sites/12/2021/01/5-eMMA-QRG-Responding-to-Solicitations-Double-EnvelopeRFP.pdf https://procurement.maryland.gov/wp-content/uploads/sites/12/2021/01/5-eMMA-QRG-Responding-to-Solicitations-Double-EnvelopeRFP.pdf mailto:MDH.solicitationquestions@maryland.gov

Maryland Department of Health RFP to Administer Provider Business Services Page iv of xi

Contract Type

A combination-type contract whose primary component is indefinite quantity with fixed unit prices with firm fixed price and possible time and materials (T&M)

Contract Duration

~6.5 years, including two (2) one (1)-year option periods

(A 55-month base period consisting of a seven [7]-month implementation phase [i.e., staffing/onboarding, materials development, and training] and a four [4]-year base operations period, with two [2] one [1]-year options)

Primary Place of

Performance

A physical office—either local or located within the forty-eight (48) contiguous United States (see § 2.3.3)

SBR Designation No

Federal Funding Yes

Capitalized Words, Terms, and

Abbreviations

Words, terms, acronyms, and initialisms defined or described in Appendix

1 are generally capitalized throughout the RFP to indicate their specific meaning within the context of the RFP and resulting Contract.

Exhibits

Nine (9) “Exhibits” are included in this RFP, which can be viewed from the same online library where the RFP is located on eMMA. These Exhibits are supplemental in nature to provide potential Offerors with an enhanced understanding of the services to be performed and how those services might be optimally met.

Maryland Department of Health RFP to Administer Provider Business Services Page v of xi

Table of Contents

1 Minimum Qualifications

1.1 Offeror Minimum Qualifications

2 Contractor Requirements: Scope of Work

2.1 Summary Statement

2.2 Background and Purpose

2.2.1 Provider Management/Enrollment and Revalidation

2.2.2 Provider Management Module (PMM)

2.2.3 Interactive Voice Response (IVR)

2.2.4 Call Center Ticket Capture

2.2.5 State Staff and Roles

2.2.6 Other State Responsibility

2.3 Responsibilities and Tasks

2.3.1 Controlling Federal and State References

2.3.2 Required Project Policies, Guidelines, and Methodologies

2.3.3 Project Site Requirements (Facilities)

2.3.4 Security Compliance and Controls

2.3.5 Contractor Hours of Operations

2.3.5.1 Contractor-Observed Business Days

2.3.5.2 Contractor Business Hours

2.4 Provider Business Services (PBS) Requirements

2.4.1 Implementation Phase

2.4.1.1 Project Management

2.4.1.2 User Manuals

2.4.1.3 Certification Requirements

2.4.1.4 Meetings

2.4.1.5 Reports

2.4.1.6 Training

2.4.2 Operations Phase

Maryland Department of Health RFP to Administer Provider Business Services Page vi of xi

2.4.2.1 Staffing

2.4.2.2 Provider Enrollment Call Center

2.4.2.3 Provider Enrollment and Revalidation Application Processing

2.4.2.4 Provider Outreach and Education

2.4.2.5 Contract Submission and Review Timeframes and Reports

2.4.3 End-of-Contract (EOC) Transition Phase

2.4.3.1 Return and Maintenance of State Data

2.5 Deliverables

2.5.1 Deliverable Development

2.5.2 Deliverable Submission and Minimum Quality

2.5.3 Deliverable Approval

2.5.4 Deliverable Descriptions/Acceptance Criteria

2.6 Service-Level Agreement (SLA)

2.6.1 Definitions

2.6.2 Service-Level Agreement (SLA) Requirements

2.6.3 Service-Level Agreement (SLA) Effective Date

2.6.4 Service-Level Reporting

2.6.5 Service-Level Agreement (SLA) Damage Assessments

2.6.6 Root Cause Analysis (RCA) / Corrective Action Plan (CAP) and Associated Liquidated

Damages (LD)

2.6.6.1 Root Cause Analysis (RCA)

2.6.6.2 Corrective Action Plan

2.6.7 Service-Level Measurements Table

2.7 Future Activities

2.7.1 Enrollment Site Visit Requirements

2.7.1.1 Staffing and Provisions

2.7.1.2 Duties

2.7.1.3 Quality Review and Reporting

2.7.2 Enrollment Site Visit Invoicing

2.7.3 Enrollment Site Visit Deliverables

Maryland Department of Health RFP to Administer Provider Business Services Page vii of xi

2.7.4 Enrollment Site Visit Service-Level Agreements and Liquidated Damages (LD)

3 Contractor Requirements: General

3.1 Contract Initiation Requirements

3.2 End of Contract Transition

3.3 Invoicing

3.3.1 General

3.3.2 Invoice Submission Schedule

3.3.2.1 Implementation Invoice Submission Schedule

3.3.2.2 Operations and Maintenance Invoice Submission Schedule

3.3.3 Deliverable Invoicing

3.3.4 Invoice Disqualifiers

3.3.5 Travel Reimbursement

3.4 Liquidated Damages (LD)

3.4.1 Minority Business Enterprise (MBE) Liquidated Damages (LD)

3.4.2 Liquidated Damages (LD) other than Minority Business Enterprise (MBE)

3.5 Business Continuity and Data Ownership and Access

3.5.1 Redundancy, Data Backup, and Disaster Recovery (DR)

3.5.2 Continuity of Business Operations

3.5.3 Data Ownership and Access

3.6 Insurance Requirements

3.7 Security Requirements

3.7.1 Employee Identification

3.7.2 Security Clearance and Criminal Background Check

3.7.3 On-Site Security Requirement(s)

3.7.4 Information Technology

3.7.5 Data Protection and Controls

3.7.6 Security Logs and Reports Access

3.7.7 System Security Plan

3.7.8 Security Incident Response and Management

3.7.9 Data Breach Responsibilities

Maryland Department of Health RFP to Administer Provider Business Services Page viii of xi

3.8 Problem Escalation Procedure (PEP)

3.9 SOC 2 Type 2 Audit Report

3.10 Experience and Personnel

3.10.1 Preferred Offeror Experience

3.10.2 Non-Key Personnel (NKP) Required Positions (Managerial/Supervisory)

3.10.3 Key Personnel (KP) Identified

3.10.4 Contractor Personnel Experience Equivalency (including Key Personnel submitted in response to this RFP)

3.10.4.1 Substitution of Education for Experience

3.10.4.2 Substitution of Experience for Education

3.10.4.3 Substitution of Professional Certificates for Experience

3.10.5 Work Hours

3.11 Substitution of Personnel

3.11.1 Continuous Performance of Key Personnel (KP)

3.11.2 Definitions

3.11.3 Contractor Personnel General Substitution Provisions

3.11.4 Replacement Circumstances

3.11.4.1 Directed Personnel Replacement

3.11.4.2 Key Personnel (KP) Replacement

3.11.5 Substitution Prior to and within 30 Days After Contract Execution

3.12 Minority Business Enterprise (MBE) Reports

3.13 Veteran Small Business Enterprise (VSBE) Reports

3.14 Work Orders

3.15 Additional Clauses

3.15.1 No-Cost Extensions

4 Procurement Instructions

4.1 Pre-Proposal Conference

4.2 eMaryland Marketplace Advantage (eMMA)

4.3 Questions

4.4 Procurement Method

Maryland Department of Health RFP to Administer Provider Business Services Page ix of xi

4.5 Proposal Due (Closing) Date and Time

4.6 Multiple or Alternate Proposals

4.7 Economy of Preparation

4.8 Public Information Act Notice

4.9 Award Basis

4.10 Oral Presentation

4.11 Duration of Proposal

4.12 Revisions to the RFP

4.13 Cancellations

4.14 Incurred Expenses

4.15 Protests/Disputes

4.16 Offeror Responsibilities

4.17 Acceptance of Terms and Conditions

4.18 Proposal Affidavit

4.19 Contract Affidavit

4.20 Compliance with Laws/Arrearages

4.21 Verification of Registration and Tax Payment

4.22 False Statements

4.23 Payments by Electronic Funds Transfer

4.24 Prompt Payment Policy

4.25 Electronic Procurements Authorized

4.26 Minority Business Enterprise (MBE) Participation Goal

4.27 VSBE Goal

4.28 Living Wage Requirements

4.29 Federal Funding Acknowledgement

4.30 Conflict of Interest Affidavit and Disclosure

4.31 Nondisclosure Agreement

4.31.1 Nondisclosure Agreement (Offeror)

4.31.2 Nondisclosure Agreement (Contractor)

4.32 HIPAA – Business Associate Agreement

Maryland Department of Health RFP to Administer Provider Business Services Page x of xi

4.33 Nonvisual Access

4.34 Mercury and Products that Contain Mercury

4.35 Location of the Performance of Services Disclosure

4.36 Department of Human Services (DHS) Hiring Agreement

4.37 Small Business Reserve (SBR) Procurement

4.38 Bonds

4.38.1 Acceptable security

4.38.2 Surety Bond Assistance Program

4.39 Maryland Healthy Working Families Act Requirements

5 Proposal Format

5.1 Two-Part Submission

5.2 Proposal Delivery and Packaging

5.3 Volume I – Technical Proposal

5.4 Volume II – Financial Proposal

6 Evaluation and Selection Process

6.1 Evaluation Committee

6.2 Technical Proposal Evaluation Criteria

6.3 Financial Proposal Evaluation Criteria

6.4 Reciprocal Preference

6.5 Selection Procedures

6.5.1 General

6.5.2 Selection Process Sequence

6.5.3 Award Determination

6.6 Documents Required upon Notice of Recommendation for Contract Award

7 RFP ATTACHMENTS AND APPENDICES

Attachment A. Pre-Proposal Conference Response Form

Attachment B. Financial Proposal Instructions & Form

Attachment C. Proposal Affidavit

Attachment D. Minority Business Enterprise (MBE) Forms

Attachment E. Veteran-Owned Small Business Enterprise (VSBE) Forms

Maryland Department of Health RFP to Administer Provider Business Services Page xi of xi

Attachment F. Maryland Living Wage Affidavit of Agreement for Service Contracts

Attachment G. Federal Funds

Attachment H. Conflict of Interest Affidavit and Disclosure

Attachment I. Nondisclosure Agreement (Contractor)

Attachment J. HIPAA Business Associate Agreement (BAA)

Attachment K. Mercury Affidavit

Attachment L. Location of the Performance of Services Disclosure

Attachment M. Contract

Attachment N. Contract Affidavit

Attachment O. DHS Hiring Agreement

Attachment P. Corporate Diversity Addendum

Appendix 1. Terms/Abbreviations and Definitions

Appendix 2. Offeror Information Sheet

Appendix 3. Non-Disclosure Agreement (Offeror)

Appendix 4. Labor Resume Form

Maryland Department of Health RFP to Administer Provider Business Services Page 1 of 202

1 Minimum Qualifications

1.1 Offeror Minimum Qualifications

The Offeror must document in its Proposal that it satisfies the following:

1.1.1 Within the past seven (7) years, the Offeror must have a minimum of five consecutive (5) years’ experience operating a multilevel call center in a healthcare environment whose call volume exceeded a monthly average of 3,500 answers.

Required Documentation: As proof of meeting this requirement, the Offeror shall provide with its Proposal evidence of operating such a multilevel call center in a healthcare environment. Evidence constitutes either a partial copy, via PDF, of a contract confirming such fulfilment of services by the Offeror or a signed PDF from an authorized representative—of the state or entity for which services were delivered—attesting to contractual services successfully performed by the Offeror.

1.1.2 Within the past five (5) years, the Offeror must have a minimum of three consecutive (3) years’ experience enrolling healthcare providers in a healthcare insurance plan’s network for a health insurance plan covering at least 750,000 individuals with at least 70,000 providers. (If the

Offeror meets this minimum qualification by working with multiple healthcare insurance plans, each healthcare insurance plan the Offeror worked with must have covered at least 500,000 individuals for the period of time the Offeror is using for its reference, and the Offeror must have performed enrollment functions during that plan for the entire plan’s provider network.)

Required Documentation: As proof of meeting this requirement, the Offeror shall provide with its Proposal evidence of enrolling healthcare providers in a healthcare insurance plan’s network for such stated conditions. Evidence constitutes either a partial copy, via PDF, of a contract confirming such fulfilment of services by the Offeror or a signed PDF from an authorized state representative—of the state for which services were delivered—attesting to contractual services successfully performed by the Offeror.

1.1.3 The Offeror must have a minimum of three (3) or more years’ experience as a prime contractor operating all or a substantial portion of a state’s Medicaid and/or commercial payer with provider enrollment and revalidation activities.

Required Documentation: As proof of meeting this requirement, the Offeror shall provide with its Proposal evidence of operating all or a substantial portion of a state’s Medicaid and/or commercial payer’s provider enrollment and revalidation activities. Evidence constitutes either a partial copy, via PDF, or a contract confirming such fulfilment of services by the Offeror or a signed PDF from an authorized state representative—of the state for which services were delivered—attesting to contractual services successfully performed by the Offeror.

1.1.4 The Offeror must have a minimum of three (3) or more years’ experience of provider management, credentialing, and maintenance and extensive experience leveraging the information garnered in improving enrollment and revalidation services.

Required Documentation: As proof of meeting this requirement, the Offeror shall provide with its Proposal evidence of performing services regarding provider management, Maryland Department of Health RFP to Administer Provider Business Services Page 2 of 202 credentialing, and maintenance as well as documentation detailing the progression of improved quality measures and standards based on lessons learned (i.e., relevant historical experience).

REMAINDER OF THIS PAGE INTENTIONALLY LEFT BLANK

Maryland Department of Health RFP to Administer Provider Business Services Page 3 of 202

2 Contractor Requirements: Scope of Work

2.1 Summary Statement

2.1.1 The Maryland Department of Health (MDH or the “Department") is issuing this Request for

Proposals (RFP) in order to obtain a Provider Business Services (hereinafter “PBS”) healthcare vendor to perform the activities detailed in this RFP in complete conformance with State and federal regulations and all other applicable laws, rules, policies, etc. At a high level, the vendor will provide the following support services to MDH:

A. Processing applications for new Provider Enrollment, Reenrollment of suspended or terminated Providers, Revalidation of actively enrolled Providers, and Update

Applications of active Providers (e.g., address change or new specialty).

B. Providing staffing resources to operate a Maryland Provider Enrollment and

Revalidation Call Center (hereinafter “Call Center”) in support of Provider and

Credentialer Enrollment activities.

C. Providing training on the State’s Enrollment system to Providers and Credentialers in need of assistance.

D. Optional – Conducting federally required pre- and post-Enrollment Site Visit services for new and Revalidating Providers.

Note: This is not an Information Technology (IT) solicitation. This RFP is solely for staffing resources who will utilize the Department’s IT systems (see §§ 2.2.2–2.2.4) to fulfill the obligations described herein.

2.1.2 It is the State’s intention to obtain services, as specified in this RFP, from a Contract between the selected Offeror and the State.

2.1.3 The Department intends to make a single award as a result of this RFP. See § 4.9, “Award

Basis,” for more Contract award information.

2.1.4 An Offeror, either directly or through its subcontractor(s), must be able to provide all services and meet all the requirements requested in this solicitation, and the successful Offeror (i.e., the

“Contractor”) shall remain responsible for Contract performance and service-level agreement

(SLA) compliance, regardless of subcontractor participation in the work, throughout the duration of the Contract term.

2.1.5 Sectional cross-references and hyperlinks are provided for convenience throughout this solicitation. In the event that any such cross-reference or hyperlink is incorrect, the Contractor shall nonetheless comply with the requirements, instructions, etc. stated in this RFP irrespective of section numbering or external resource.

2.2 Background and Purpose

MDH is seeking proposals from qualified vendors to support Enrollment, Reenrollment, Revalidation, and Updates (i.e., PBS) for medical Providers—including ordering, prescribing, and referring (OPR) and

Maryland Managed Care Organization (MCO) Providers—who service Medicaid, Developmental

Maryland Department of Health RFP to Administer Provider Business Services Page 4 of 202

Disabilities Administration (DDA), and Behavioral Health Administrative Services Organization (PBS) members. Furthermore, the establishment and commissioning of an MDH Medicaid Enterprise Systems

Modular Transformation (MMT) Program Management Office (PMO) to implement a new Medicaid

Management Information System (MMIS) based on Medicaid Information Technology Infrastructure

(MITA) 3.0 principles has prompted a change in business processes and necessitated additional operational support. The following subsections provide an overview of the business and technological need for and requisite performance capability of the services described in this RFP by outlining the framework and goals of the Department’s Provider Enrollment unit—and by extension, the MMT PMO.

2.2.1 Provider Management/Enrollment and Revalidation

A. The Contractor will be responsible for processing Enrollment Applications for all Providers in accordance with Centers for Medicare and Medicaid Services (CMS)/Patient Protection and

Affordable Care Act (ACA) guidelines. The Contractor will utilize an electronic Provider

Enrollment system designed and supported by the Department or its designees.

B. Additionally, Offerors have the option to propose the provision of staffing to fulfill the performance of the ACA-required Enrollment Site Visit services. The services specific to

Enrollment Site Visits are detailed in § 2.7.1 as “FUTURE.” FUTURE outlines the requirements for pre- and post-Enrollment Site Visits (hereinafter “Site Visit”), reporting, and post-Enrollment

Provider survey requirements.

C. As described in Table 2-1, the Department estimates that the Contractor will Revalidate or Enroll the following numbers of Providers.

Table 2-1. Maryland Medicaid Estimated Volume of Unique New and Revalidated Provider Enrollments During

Contract Base Years

Enrollment Type Contractor Responsibility Statewide Estimate

New Applications New Provider Enrollments 22,000 per year

Application Updates and

Change of Ownership Application Updates and changes of ownership 70,000 per year

Revalidation Applications Revalidation Applications 30,000 per year

FUTURE

Site Visits for Moderate- and High-Risk Providers and State-requested referrals

4,000 visits completed each year

Total 126,000 per year

D. Furthermore, the Contractor will be responsible for providing tier I and tier II call-center services

(see 35 for description of tier types) for Maryland’s Call Center (see § 2.4.2.2). Table 2-2 lists the call volume estimates for the first year operating each Call Center.

Maryland Department of Health RFP to Administer Provider Business Services Page 5 of 202

Table 2-2. Maryland Medicaid Call Center Estimates (Year 1)

Call Center Type Estimated Monthly Call

Volume

Estimated Call Length (in min/seconds)

Maryland Provider Enrollment and

Revalidation Call Center (Tier I)

4,000 based on 2023 7.49 2021

2.2.2 Provider Management Module (PMM)

A. The Department is currently developing—independently of this RFP—a robust, state-of-the-art

Information System (hereinafter “Provider Management Module” ([PMM]) to enhance its ability to manage Provider data and screen and enroll Providers into the State’s Medicaid Program. This

State-owned and implemented PMM will serve as the sole system to perform the aforementioned functions. Note: As requested, the Contractor shall assist the Department in testing and readying this system for operation by the established Go-Live Date (GLD).

B. The Department has interpreted CMS guidance on Provider Enrollment/management as it applies to services in support thereof and the utilization of Maryland’s MMIS and PMM in delivering them. The Contractor will assist the Department, using the State-provided system for

Provider Enrollment, Reenrollment, Revalidation, and Update services, to accomplish the following items:

1) CMS certification requirements for the State’s PMM:

a) A Provider can initiate, save, and apply to be a Medicaid Provider.

b) The system tracks the Provider Enrollment period to ensure that Provider

Revalidation is initiated at least every five (5) years.

c) The system can generate relevant notices or communications to Providers, including—but not limited to—Application status, requests for additional information, Reenrollment termination, investigations of Fraud, and suspension of payment in cases of Fraud.

2) CMS requirements for the State’s processing of Provider Enrollment Applications:

a) A State user can verify that any Provider purporting to be licensed in a state is licensed by such State and confirm that the Provider's license has not expired and that there are no current limitations on the Provider's license.

b) A State user (or the system, based on automated business rules) must terminate or deny a Provider's Enrollment upon certain conditions.

c) After deactivation, a Provider seeking reactivation must be re-screened by the

State.

d) A Provider can Appeal a termination or denial decision, and a State user can monitor the Appeal process and resolution.

e) A State user can manage information for mandatory Site Visits conducted on a

Provider in a Moderate- or High-Risk category.

https://www.medicaid.gov/medicaid/data-and-systems/downloads/smc-certification-guidance.pdf

Maryland Department of Health RFP to Administer Provider Business Services Page 6 of 202

f) A State user can view the status of criminal background checks, fingerprinting, and Site Visits for a Provider as required based on their risk level and State law.

g) The system checks appropriate databases to confirm a Provider's identity and exclusion status for Enrollment and Reenrollment and conducts routine checks using federal databases including Social Security Administration's (SSA) Death

Master File, the National Plan and Provider Enumeration System (NPPES), the

List of Excluded Individuals/Entities (LEIE), and the Excluded Parties List

System (EPLS). Authorized users can view the results of the data matches as needed.

h) A State user can assign and screen all Applications by a risk categorization of

Limited, Moderate, or High for a Provider at the time of new Application, Reenrollment, or Revalidation of Enrollment. A State user can adjust a Provider's risk level due to payment suspension or moratorium.

i) A State user can set CMS and State-imposed temporary moratoria on new

Providers or Provider types in six (6)-month increments.

j) A State user can determine network adequacy based upon federal regulations and

State plan.

k) A State user and/or the system, can send and receive Provider sanction and termination information shared from other states and Medicare to determine continued Enrollment for Providers.

2.2.3 Interactive Voice Response (IVR)

The Department is currently developing—independently of this RFP—a state-of-the-art interactive voice response (IVR) system to enhance its ability to manage Provider calls, streamlining the Provider support experience by implementing a complex call tree with detailed options and quick response times to place callers in the appropriate queues to efficiently resolve their issues. This State-owned and implemented

IVR will serve as the sole system to perform the aforementioned functions. Note: As requested, the

Contractor shall assist the Department in testing and readying this system for operation by the established

GLD.

2.2.4 Call Center Ticket Capture

The Department is currently developing—independently of this RFP—a state-of-the-art ticket capture system to enhance its ability to create and manage Provider call tickets and associate them with

Applications. This State-owned and implemented ticket capture application will serve as the sole system to perform the aforementioned functions. Note: As requested, the Contractor shall assist the Department in testing and readying this system for operation by the established GLD.

2.2.5 State Staff and Roles

In addition to the Procurement Officer and Contract Monitor, the Contractor may receive clarifying policy guidance from various State administrators and staff who report to the directors of MDH. Many of the

Contractor’s decisions impact the workflow for programs, waivers, and services within the purview of these directorates. For clarification and additional background on services, regulations, and associated

Maryland Department of Health RFP to Administer Provider Business Services Page 7 of 202 abbreviations, refer to Appendix 1 as well as the following website:

https://mmcp.health.maryland.gov/Pages/home.aspx.

2.2.6 Other State Responsibility

A. The State is responsible for providing the requisite IT systems along with the technical documentation and test data necessary to facilitate the Contractor’s performance of the work and will provide such additional assistance and services as is specifically set forth within this RFP.

B. The State, however, is not responsible for provisioning the Contractor with an operational facility or equipment. Please see § 2.3.3 for Contractor requirements regarding normal office working facilities and minimum equipment necessary for performance under the Contractor.

2.3 Responsibilities and Tasks

2.3.1 Controlling Federal and State References

The Contractor shall comply with all concomitant requirements from the following federal and State laws, regulations, and waivers as may be updated from time to time:

A. Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law (Pub. L.)

Number (No.) 104-191

B. Title 42 Electronic Code of Federal Regulations (e-CFR), Chapter IV, Subchapter C, Part 455—

“Program Integrity: Medicaid”

C. Title 45 e-CFR, Subtitle A, Subchapter C—"Administrative Data Standards and Related

Requirements”

D. 42 United States Code (U.S.C), Chapter 7, Subchapter XI—“General Provisions, Peer

Review, and Administrative Simplification”

E. 42 U.S.C., Chapter 157, Subchapter I, § 18001—“Immediate Access to Insurance for

Uninsured Individuals with a Preexisting Condition”

F. 42 U.S.C., Chapter 126—“Equal Opportunity for Individuals with Disabilities”

G. CMS, The State Medicaid Manual, Publication 45

H. Code of Maryland Regulations (COMAR)

2.3.2 Required Project Policies, Guidelines, and Methodologies

A. The Contractor shall be required to comply with all applicable laws, regulations, policies, standards, and guidelines affecting Information Technology (IT) projects, which may be created or changed periodically. The Offeror is required to review all applicable links provided below and state compliance in its response.

B. It is the responsibility of the Contractor to ensure adherence to and remain abreast of new or revised laws, regulations, policies, standards, and guidelines affecting project execution. These include but are not limited to:

https://mmcp.health.maryland.gov/Pages/home.aspx https://www.govinfo.gov/content/pkg/PLAW-104publ191/pdf/PLAW-104publ191.pdf https://www.govinfo.gov/content/pkg/PLAW-104publ191/pdf/PLAW-104publ191.pdf https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-C/part-455 https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-C/part-455 https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C https://www.govinfo.gov/content/pkg/USCODE-2010-title42/pdf/USCODE-2010-title42-chap7-subchapXI-partA-sec1305.pdf https://www.govinfo.gov/content/pkg/USCODE-2019-title42/pdf/USCODE-2019-title42-chap157-subchapI-sec18001.pdf https://www.govinfo.gov/content/pkg/USCODE-2019-title42/pdf/USCODE-2019-title42-chap157-subchapI-sec18001.pdf https://uscode.house.gov/browse/prelim@title42/chapter126&edition=prelim https://www.cms.gov/Regulations-and-Guidance/Guidance/Manuals/Paper-Based-Manuals-Items/CMS021927 https://dsd.maryland.gov/Pages/COMARHome.aspx

Maryland Department of Health RFP to Administer Provider Business Services Page 8 of 202

1) The State of Maryland System Development Life Cycle (SDLC) methodology at:

http://doit.maryland.gov/SDLC/Pages/agile-sdlc.aspx.

2) The State of Maryland Information Technology Security Policy and Standards at:

http://www.DoIT.maryland.gov—keyword: Security Policy.

3) The State of Maryland Information Technology Non-Visual Standards at:

http://doit.maryland.gov/policies/Pages/ContractPolicies.aspx.

4) CMS’ framework for the Independent Third-Party Security and Privacy Assessment

Guidelines for Medicaid Enterprise Systems.

5) Project management methodologies consistent with the most recent edition of the Project

Management Institute’s Project Management Body of Knowledge (PMBOK) Guide.

2.3.3 Project Site Requirements (Facilities)

The Contractor will be responsible for providing and maintaining all logistics associated with Call Center and Enrollment Application staff.

A. Offerors shall propose a location for the operational staff, at minimum, within the 48 contiguous

United States that meets the following requirements (note: the Contractor may leverage a facility they currently own that meets MDH requirements):

1) A facility that is no more than 30 miles from a major airport.

2) A primary Call Center that is staffed and operated during Normal State Business Hours.

3) A facility with adequate, available parking for its staff.

4) A facility with adequate off-street parking reserved for MDH staff.

Note: The Department prefers the Contractor’s operational staff be located within a 40-mile radius of the Department’s offices at 201 West Preston Street, Baltimore, MD 21201 (see136 of

“Technical Proposal Evaluation Criteria”).

B. The Contractor shall:

1) Provide access to the local facility during Normal State Business Hours to MDH resources designated by the Department without prior notice or admission. Additionally, the Contractor shall provide MDH access to other facilities used to support RFP activities.

2) Be liable for all costs associated with operations and maintenance of the facility for its staff.

3) Provide all necessary physical equipment, including—but not limited to—computers, copiers, scanners, telephones, faxes, and servers needed to support the completion of all contractual tasks.

4) At its facility, provide office space and supporting equipment for at least one (1)

Medicaid Provider Services (MPS) or MDH staff resource throughout the term of the

Contract, including but not limited to:

http://doit.maryland.gov/SDLC/Pages/agile-sdlc.aspx http://www.doit.maryland.gov/ http://doit.maryland.gov/policies/Pages/ContractPolicies.aspx https://www.cms.gov/privacy/third-party-privacy-policies https://www.cms.gov/privacy/third-party-privacy-policies https://www.pmi.org/pmbok-guide-standards/foundational/PMBOK https://www.pmi.org/pmbok-guide-standards/foundational/PMBOK https://www.pmi.org/pmbok-guide-standards/foundational/PMBOK

Maryland Department of Health RFP to Administer Provider Business Services Page 9 of 202

a) An operational, networked workstation with printer access.

b) A telephone.

c) A desk.

d) Chairs.

e) A document filing cabinet.

f) One (1) parking space for designated MDH staff.

5) Establish appropriate protocols to ensure that physical facility security and data confidentiality safeguards are maintained. The Contractor shall be responsible for the security and safekeeping of all records while they are in its possession.

6) Provide computer access with sufficient Software and support to allow MPS and MDH staff to perform monitoring functions of the Call Center.

a) Proper controls over temperature, humidity, air movement, cleanliness, and power shall be maintained to avoid computer downtime and malfunctions.

b) All site(s) shall be protected from power failures and other electrical anomalies. A suitable electrical supply shall be provided that:

i) Includes an uninterruptible power supply for equipment supporting critical business operations to support orderly shutdown or continuous operation.

ii) Is regularly checked to ensure it has adequate capacity for all electrical equipment and tested in accordance with the manufacturer’s recommendations.

iii) Provides safeguards against power outages, power surges, brownouts, blackouts, and other power failure events.

iv) Includes multiple feeds to avoid a single point of failure in the power supply.

7) Provide the appropriate insurance coverage in alignment with MDH requirements for facility operations (see § 3.6).

8) Provide the Department with an Information System Contingency Plan (ISCP) and a

Business Continuity Plan (BCP) to support all staffing operations, including any relevant subcontractors (see 47 and § 2.5.4 for reporting frequency and §§ 3.5.1–3.5.2 for additional requirements).

2.3.4 Security Compliance and Controls

A. The Contractor shall:

1) Implement incident management processes for potential Security Incidents and Data

Breaches in compliance with HIPAA (see Attachment J), MDH (to be adopted upon State publication—date to be announced), Maryland Attorney General, and HHS reporting requirements.

https://www.marylandattorneygeneral.gov/Pages/IdentityTheft/breachnotices.aspx https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/incident-reporting-policy-incident-management-reference/index.html#:~:text=4%2C%20HHS%20defines%20a%20computer,OPDIV%20Chief%20Information%20Security%20Officer https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/incident-reporting-policy-incident-management-reference/index.html#:~:text=4%2C%20HHS%20defines%20a%20computer,OPDIV%20Chief%20Information%20Security%20Officer

Maryland Department of Health RFP to Administer Provider Business Services Page 10 of 202

2) Per Security Incident, notify MDH within four (4) hours of identifying any potential or actual physical or system Security Incident and work to plan and implement corrective action to mitigate the Security Incident. The four (4)-hour notification requirement overrides the 24-hour notification requirement for Security Incident reporting found in the Business Associate Agreement (BAA) (refer to Exhibit 9 – Potential HIPAA

Violation Email Notification Template in this solicitation’s procurement library located on eMMA for additional information). (See SLA 12 in Table 3-2 of § 3.4.2 for associated

LDs.)

3) Ensure that all of its Software/application components are no less than the current major release version-1, unless otherwise approved by MDH. The Contractor shall maintain its commercial off-the-shelf (COTS) products, code frameworks, Java Archives (JARs), and other system components to a vendor- or community-supported version to current major release version no greater than N-1 throughout the term of the Contract.

B. Additionally, the Contractor shall—in some cases, as requested—support the Department in:

1) Operating IT systems in accordance with CMS standards and the State of Maryland

Information and Technology Information Security Manual (most current version) and maintaining all requisite documentation. Note: All systems that are to contain real (i.e., actual) Participant PHI or PII must meet operational standards no later than 30 days before introduction of the real data.

2) Applying roles-based access, compliant with HHS guidance and 45 CFR

164.312(a)(2)(i), to platform functionality—including administrative functions—utilizing identity management processes and tools.

3) Adhering to the State’s incident management processes for potential Security Incidents and Data Breaches in compliance with HIPAA (see Attachment J), MDH (to be adopted upon State publication—date to be announced), Maryland Attorney General, and HHS reporting requirements.

4) Identifying any potential or actual physical or system Security Incident and work to plan and implement corrective action to mitigate the Security Incident (see Attachment J).

5) Ensuring, at the time of Go-Live, that all components of the PMM and other IT systems are no less than the current major release version-1, unless otherwise approved by MDH.

The Contractor shall maintain local COTS products, code frameworks, JARs, and other

Contractor-supplied components to a vendor- or community-supported version to current major release version no greater than N-1 throughout the Operations and Maintenance

(O&M) Phase.

6) Performing and completing PMM, security, and performance testing within the MDH-established timelines.

https://doit.maryland.gov/Documents/Maryland%20IT%20Security%20Manual%20v1.2.pdf https://doit.maryland.gov/Documents/Maryland%20IT%20Security%20Manual%20v1.2.pdf https://www.ecfr.gov/current/title-45/part-164/section-164.312#p-164.312(a)(2)(i) https://www.ecfr.gov/current/title-45/part-164/section-164.312#p-164.312(a)(2)(i) https://www.marylandattorneygeneral.gov/Pages/IdentityTheft/breachnotices.aspx https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/incident-reporting-policy-incident-management-reference/index.html#:~:text=4%2C%20HHS%20defines%20a%20computer,OPDIV%20Chief%20Information%20Security%20Officer https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/incident-reporting-policy-incident-management-reference/index.html#:~:text=4%2C%20HHS%20defines%20a%20computer,OPDIV%20Chief%20Information%20Security%20Officer

Maryland Department of Health RFP to Administer Provider Business Services Page 11 of 202

2.3.5 Contractor Hours of Operations

2.3.5.1 Contractor-Observed Business Days

A. The State observes more holidays than most private businesses, including most Providers, MCOs, administrative services organizations, etc. In a typical year, there are 12 holidays observed by the State and 13 in years with general elections. The Governor can also declare

State offices to be fully or partially closed on certain days not otherwise scheduled as a holiday, such as on Christmas Eve, New Year’s Eve, due to the death of a prominent State or national personage, or due to some other momentous event. In contrast, many private businesses only observe the six (6) “major holidays” of New Years, Memorial Day, 4th of July, Labor Day, Thanksgiving, and Christmas.

B. Generally, the Department will not expect the Contractor to operate on State-Observed Holidays, during weekends, or outside Normal State Business Hours; however, in order to maximize convenience to Providers and Stakeholders for the occasional circumstance, Offerors may propose providing full or partial services in excess of the Business Days observed by the State, particularly for Enrollment Application processing.

C. Once the Contract is awarded, the Contractor must provide services in accordance with its proposed days of operation, which, thereafter, will be known as the Contractor-Observed

Business Days.

2.3.5.2 Contractor Business Hours

A. The Contractor is required to operate nine-and-one-half (9.5) hours per day, five (5) days per week, 248 days per year (249 in leap years). Any further delineation hereafter of Normal State

Business Hours, Business Days, State-Observed Holidays, etc., is to set expectations of minimum operations and to provide some nomenclature by which Contractor Personnel may be scheduled and by which the Department may clarify operational expectations.

B. The Contractor must provide the full range of services required under the Contract at least during

Normal State Business Hours. To maximize convenience to Providers and Stakeholders, Offerors may propose providing full or partial services in excess of Normal State Business

Hours, including weekend hours.

C. Section 2.4.2.2.1 requires the Contractor to provide services between 8:00 a.m. and 5:30 p.m. on

Contractor-Observed Business Days. Once the Contract is awarded, the Contractor must provide services in accordance with its proposed hours of operation, which thereafter will be known as the Contractor Business Hours.

2.4 Provider Business Services (PBS) Requirements

The Contract’s scope of work (SOW) is organized into the following sections:

A. “Implementation Phase” – Otherwise known as the “Start-up Period” or “Phase 1,” a six (6)-month developmental and implementational period initiated by the Notice to Proceed (NTP) that is succeeded by a 42-month operational phase commencing upon the Contractor’s satisfactory

Maryland Department of Health RFP to Administer Provider Business Services Page 12 of 202 technical collaboration in support of systems readiness as well as its successful materials development and onboarding and training of resources as detailed throughout the SOW.

B. “Operations Phase” – Otherwise known as “O&M” or “Phase 2,” a 42-month operational period initiated by the Contractor’s successful completion of Phase 1 and commencing on the

GLD when the Contractor begins providing the functional services as detailed in § 2.4.2.

C. “End-of-Contract (EOC) Transition” – Otherwise known as “Phase 3,” the 12-month period directly preceding the Contract Termination Date (CTD) and extending six (6) months thereafter.

Table 2-3 below provides an outline of the Deliverables and milestones to be achieved, namely during

Phase 1, along with their respective due dates. The due dates listed in this timeline (measured in Calendar

Days) are to be, at their latest, met by the time specified but may be achieved before.

Table 2-3. Scope of Work Summary Timeline

Start-up Period

Month 1

• Day N/A: Contract Effective Date (CED)

• Day 0 (TBD): NTP Date / Project Work Commences (with Key

Personnel)

• Day 5: Project Kickoff Meeting / Draft Project Management Plan

• Day 30: Final Project Master Schedule

• Day 30: Final Schedule Management Plan

• Day 30: Final Communications Management Plan

• Day 30: Final Transition-In Management Plan

• Day 30: Final Requirements Management Plan

• Day 30: Final Deliverables Management Plan

• Day 30: Final Transition-In Plan

• Day 30: Status Reporting Begins

Month 2

• Day 30–60: Non-Key Personnel Onboarded

• Day 45: Final Staffing Management Plan o Key Personnel Staffing Contingency Plan o Contractor Personnel Staffing Contingency Plan

▪ Call Center Succession Plan

▪ Provider Enrollment Application Processing

Succession Plan

▪ Outreach and Education Succession Plan o Call Center Staffing Matrix o Provider Application Processing Staffing Matrix

• Day 45: Final Training Management Plan o Customer Service Representative Resource Training Plan o Provider Enrollment Application Reviewer Resource

Training Plan

• Day 60: Final Quality Management Plan

• Day 60: Final Risk and Issue Management Plan

Maryland Department of Health RFP to Administer Provider Business Services Page 13 of 202

• Day 60: Final Change Management Plan

• Day 60: Final Organizational Change Management Plan

• Day 60: Final Privacy and Security Management Plan

Months 3–7

• Days 60–90: All Remaining Personnel Onboarded

• Days 65/90: Draft/Final Provider Manual*

• Days 65/90: Draft/Final Call Center User Guide*

• Days 65/90: Draft/Final Provider Enrollment Application Reviewer

User Guide*

• Days 65/90: Draft/Final Provider Revalidation and Enrollment Plan

• Days 65/90: Draft/Final Outreach and Education Plan

• Day 90: MDH System Training / UAT Begins

• Day 120: Draft ISCP and BCP

• Day 150: Final ISCP and BCP

Operations Phase Months 8–55

• Day 211: Operation Transition—full migration from legacy contractor of all Provider Enrollment and Call Center work

• Support daily operations for Provider Enrollment, Reenrollment, Revalidations, and Updates

• Support daily operations for Provider Call Center functions

• Outreach and Education Summary Reports

• Transition-Out Plan

• Documentation Inventory List

• Other Deliverables as determined by the Department

*These items (i.e., Deliverables/milestones) are not wholly the responsibility of the Contractor; however, the

Contractor will be required to support the Department as needed in drafting, assuring the quality/accuracy, and completion thereof.

2.4.1 Implementation Phase

A. During Phase 1, the Contractor will be responsible for supporting the Department in the closeout of systems development (i.e., PMM, interactive voice response [IVR]/automated call distribution, and ticket capture) and completing the Start-up activities (e.g., submission of project management plans, hiring of resources, onboarding and training of staff, creation of standard operating procedures [SOP], etc.) required to successfully transition to the provision of operational services.

B. The Contractor must have staff who are fully trained on MDH business functions as well as

State, CMS (ACA standards), and federal policies regarding Provider Enrollment. In order to enable a smooth transition with little to no disruption in the Provider community’s Enrollment process, it is critical that the Contractor have a timely and properly established training and quality monitoring structure in place for Contractor Personnel. Furthermore, adherence to approved Start-up timelines will be essential for the Contractor to begin successfully operating the Enrollment, Reenrollment, Revalidation, Update, and Call Center services as described in this RFP.

Maryland Department of Health RFP to Administer Provider Business Services Page 14 of 202

C. The Contractor shall:

1) In accordance with the approved “Project Management Plan” (see § 2.4.1.1.1), develop and implement all materials, trainings, processes, and procedures, consistent with the requirements identified in this RFP, to effectively manage the support and successful execution of operational services.

2) Maintain the required Key Personnel (KP) and a sufficient number of Contractor

Personnel throughout Phase 1 to successfully meet all Start-up related requirements in accordance with the approved “Project Master Schedule” (see § 2.4.1.1.1.1). (See SLA 1 in Table 3-2 of § 3.4.2 for associated LDs.)

3) Work with the Department and the incumbent contractor…