RFP_31786-00186_Amendment%20_5.pdf

STATE OF TENNESSEE

DEPARTMENT OF FINANCE & ADMINISTRATION, BENEFITS ADMINISTRATION

REQUEST FOR PROPOSALS #31786-00186

AMENDMENT #FIVE FOR SHORT-TERM DISABILITY

AND LONG-TERM DISABILITY INSURANCE

DATE: November 14, 2025

RFP #31786-00186 IS AMENDED AS FOLLOWS:

1. This RFP Schedule of Events updates and confirms scheduled RFP dates. Any event, time, or date containing revised or new text is highlighted.

EVENT TIME

(central time zone)

DATE

1. RFP Issued

August 29, 2025

2. Disability Accommodation Request Deadline 2:00 p.m. September 8, 2025

3. Pre-response Conference 1:00 p.m. September 10, 2025

4. Notice of Intent to Respond Deadline 2:00 p.m. September 11, 2025

5. Written “Questions & Comments” Deadline

*NOTE: Submit written questions and comments on Appendix 7.11 the written questions and comments template.

2:00 p.m.

September 17, 2025

6. State Response to Written “Questions &

Comments”

October 22, 2025

7. Round 2 Written “Questions &

Comments” Deadline

*NOTE: Respondents may submit no more than five (5) questions to the State in the 2nd round of Written Questions and Comments.

October 29, 2025

8. State Response to Written “Questions &

Comments” Round 2

November 14, 2025

9. Response Deadline 2:00 p.m. November 21, 2025

10. State Completion of Technical

Response Evaluations

January 6, 2026

11. State Opening & Scoring of Cost Proposals 2:00 p.m. January 7, 2026

12. Negotiations 4:30 p.m. January 12-14, 2026

13. State Notice of Intent to Award Released and RFP Files Opened for Public Inspection

2:00 p.m.

January 22, 2026

14. End of Protest Period

January 29, 2026

15. State sends contract to Contractor for signature

January 30, 2026

16. Contractor Signature Deadline 2:00 p.m. February 6, 2026

2. State responses to questions and comments in the table below amend and clarify this RFP.

Any restatement of RFP text in the Question/Comment column shall NOT be construed as a change in the actual wording of the RFP document.

RFP

SECTION

QUESTION / COMMENT

1.

Will the State agree that

Contractor may limit access to non-State specific records and/or information systems for privacy, confidentiality, and security purposes?

The State is unable to answer this question since the State does not know what “non-State specific records” are.

2.

Would the State revise current provisions that require State ownership of encryption keys and authority to conduct external penetration testing?

The State has revised language in

E.5.a(2). See amendment item #3.

3.

Would the State be open to refining the audit rights provision to exclude automatic access to

The State does not agree.

Contractor, third-party, fourth party and subcontractor’s systems?

4.

Would the State be willing to require a summary of the following instead of the full documents: (a) a forensic report in the event of a data breach, and (b) internal policies. This is industry standard and necessary for preservation of attorney-client privilege.

The State has revised language in

E.5.a(6). See amendment item #4. The

State declines to revise language regarding internal policies.

5.

Would the State consider revising the current provisions that are too broad, and ambiguous in nature such as “all information systems” and consider changing the 24-hour notice trigger to 72-hours, and limiting incidents requiring notice to those triggering notice under applicable breach law?

The State does not agree.

6.

Has the State adjusted quarterly or annual KPI scorecard metrics in the last three bid cycles?

KPI scorecard was not included in the original disability insurance contract, but there were performance guarantees. The metrics for performance have been slightly modified during each bid cycle

(contract period).

Appendix

7.21

7.

On the provided current quarterly scorecard (Appendix 7.21), the inforce carrier received a score of

16.7% for Q2 and 3 2025- the lowest performance tier and a full

58.3 points below the next performance tier. However, the

State’s response to Question

70 indicates there are no concerns with the current carrier’s

Historical scorecards are not relevant for the purposes of this procurement. The

State is focused on identifying a

Contractor that can meet the State’s expectations moving forward.

administration of the disability insurance plan.

Could the State please provide quarterly (Table A) and annual

(Table B) historical scorecards for previous 5 plan years to demonstrate whether the current carrier has made any measurable improvement or decline toward fulfilling contract requirements?

This information would help prospective carriers better understand the feasibility of meeting the State’s expectations and the intent behind these Key

Performance Indicators.

Section

A.2

Definitions, item rr.

(page 45);

8.

Does the State agree that this does not include data owned by

[REDACTED], as this is a

[REDACTED] issued insurance policy?

The State agrees if in compliance with

A.11.f.

C.3.e 9.

Please see below RFP language

C.3.e. This question arises from the highlighted sections: in “in addition to” vs “under the terms of” and “as detailed by.” Does this mean the State will reimburse for all postage and printing associated with this contract, for all State-approved marketing or communication materials, to include welcome kits, etc?

No, this does not mean the State will reimburse all postage and printing associated with the contract. The

Contractor will be responsible for all postage and printing for requirements in contract sections A.5., A.6., A.7., and A.8.

Contract section C.3.e. is referring to mailings in addition to those identified in the contract.

e. For mailings in addition to those identified in the contract, the State shall reimburse the Contractor for the following, selected actual costs in the performance of this Contract upon Contractor providing documentation of actual costs incurred.

1. Postage. The State shall reimburse the Contractor for the actual cost of postage for mailing materials produced under the terms of this Contract and as directed and authorized by the

State. 2. Printing/Production. The

State shall reimburse the

Contractor an amount equal to the actual cost of document printing/production as required and authorized by the State and as detailed by the Contract Scope of

Services as referred to in A.6.b.

Notwithstanding the foregoing, the

State retains the option to authorize the Contractor to deliver a product to be printed. The State also retains the option to approve and accept the product but not use the Contractor to print the material.

In those situations, the State shall have the discretion to use other printing and production services at its disposal.

Here is A.6.B:

b. The Contractor shall provide the

State with draft versions of all year-round communications materials and letters at least fourteen (14) Business Days prior to planned printing, assembly, and/or distribution (including web posting). The Contractor shall not distribute any materials until the

State issues approval In Writing to the Contractor for the respective materials.

E.5.a.1 10.

During current and previous bid cycles, has the State performed a compliance audit encompassing

Contract Item E.5.a.1, to determine if all data as well as system and application administration has been kept onshore? If audited, how often did the audit occur?

Was the carrier noncompliant at any point, and if so, what parts of

E.5.a.1 were not met; were there penalties, and were those issues resolved?

The State has not conducted an audit concerning E.5.a.1 during current and previous bid cycles.

E5 11.

We agree to the requirement of storing data within the United

States. However, we find it challenging to commit to performing all system and application administration strictly within the continental US. The

The State declines to revise any contract language.

reason being, we do utilize offshore resources to support and administer our systems effectively.

We want you to feel confident that we take full responsibility for the administration of customer policy and are dedicated to utilizing specialized IT service providers to enhance our customer-focused services. While we do have some approved offshore providers who can access data, this is done through secure methods such as virtual desktops hosted within The

Standard infrastructure.

Additionally, we have robust system, process, and physical security controls in place to ensure that all data resides and remains within the United States and under

The Standard infrastructure.

We insure numerous States, including several in the South

East, utilizing similar arrangements, and these practices have been effective and secure.

Understanding this additional background, would the State of

Tennessee be agreeable with how we manage system and application administration?

Thank you for your understanding and cooperation.

3. Delete Pro Forma Contract section E.5.a(2) in its entirety and insert the following in its place.

(2) The Contractor shall encrypt Confidential State Data at rest and in transit using the current version of Federal Information Processing Standard (“FIPS”) 140-2 or 140-3 (or current applicable version) validated encryption technologies. The Contractor shall adhere to NIST and CIS cybersecurity practices to protect encryption keys, information systems, and data, including following NIST SP 800-57 for key management. Upon request, the Contractor must provide the State with a decrypted copy of the Confidential State Data and provide installation and maintenance support at no cost to the State.

4. Delete Pro Forma Contract section E.5.a(6) in its entirety and insert the following in its place.

(6) If a breach has been confirmed a fully un-modified third-party forensics summary report must be supplied to the State and through the STS SIRT. This report must include indicators of compromise (IOCs) as well as plan of actions for remediation and restoration. Contractor shall take all necessary measures to halt any further Unauthorized Disclosures.

5. Delete RFP #31786-00186 Release 2 in its entirety, and replace with RFP #31786- 00186, Release #3. Revisions of the original RFP document are emphasized within the new release. Any sentence or paragraph containing revised or new text is highlighted.

6. RFP Amendment Effective Date. The revisions set forth herein shall be effective upon release. All other terms and conditions of this RFP not expressly amended herein shall remain in full force and effect.