RFP_31786-00192_Amendment_2.docx

STATE OF TENNESSEE

DEPARTMENT OF FINANCE & ADMINISTRATION, BENEFITS ADMINISTRATION

REQUEST FOR PROPOSALS #31786-00192

AMENDMENT #TWO

FOR VOLUNTARY, FULLY-INSURED VISION INSURANCE PLAN

DATE: September 25, 2026

RFP #31786-0086 IS AMENDED AS FOLLOWS:

1. This RFP Schedule of Events updates and confirms scheduled RFP dates. Any event, time, or date containing revised or new text is highlighted.

(central time zone)

DATE

1. RFP Issued

August 14, 2026

5. Written “Questions & Comments” Deadline *NOTE: Submit written questions and comments on Appendix 7.14 the written questions and comments template.

2:00 p.m.

September 4, 2026

6. State Response to Written “Questions & Comments”

September 29, 2026

7. Round 2 Written “Questions & Comments” Deadline *NOTE: Respondents may submit no more than five (5) questions to the State in the 2nd round of Written Questions and Comments.

October 6, 2026

8. State Response to Written “Questions & Comments” Round 2

October 23, 2026

10. State Completion of Technical Response Evaluations

December 17, 2026

13. State Notice of Intent to Award Released and RFP Files Opened for Public Inspection

2:00 p.m.

January 28, 2027

13. End of Protest Period

February 4, 2027

14. State sends contract to Contractor for signature

February 5, 2027

2. State responses to questions and comments in the table below amend and clarify this RFP.

Any restatement of RFP text in the Question/Comment column shall NOT be construed as a change in the actual wording of the RFP document.

Key contract deliverables/milestones are outlined in Section A.18 of the pro forma contract.

As stated in RFP section 4.4.3 Subcontractors identified within a response to this RFP will be deemed as approved by the State unless the State expressly disapproves one or more of the proposed subcontractors prior to signing the Contract.

Would the State be open to the strategy of offering an additional more affordable vision option for materials only to complement the "single vision contract"?

The state is only seeking proposals for the services and requirements outlined in the pro forma contract.

51010 State Retirees 52000 Local Education Retirees 53000 Local Government Retirees 55000 State Active Employees 56000 Local Education Active Employees 58000 Local Government Active Employees

The Contractor’s call management system shall record and index all calls, except when a caller requests that the call not be recorded, such that the Contractor can easily retrieve recordings of individual calls based on the Edison ID of the caller, phone number of the caller, the caller’s name, and narrow results by the date/time of the call and/or the staff member who handled the call. The Contractor shall be able to provide a full recording of each call upon the State’s request. The Contractor shall archive the recordings for one ten years from the date of each call.

The State does not agree to this revision.

"Entire Agreement. The Group Contract is are complete and contains the entire understanding between the Parties relating to its subject matter, including all the terms and conditions of the Parties’ agreement. The Group Contract supersedes any and all prior understandings, representations, negotiations, and agreements between the Parties, whether written or oral.

Prior to implementing any major modifications to or replacement of the Contractor’s core information systems functionality and/or associated operating environment, the Contractor shall notify the State In Writing of the change or modification within a reasonable amount of time (commensurate with the nature and effect of the change or modification) if the change or modification; (a) would affect the Contractor’s ability to perform one or more of its obligations under this Contract; (b) would be visible to State system users and Members; (c) might have the effect of putting the Contractor in noncompliance with the provisions or substantive intent of this Contract; or

(d) would materially reduce the coverage amounts payable or services provided to the average Member. If directed by the State, the Contractor shall discuss the proposed change with the State prior to implementing the change. Subsequent to this discussion, the State may require the Contractor to demonstrate or attest to the readiness of the impacted systems prior to the effective date of the actual modification or replacement, if practicable."

The State does not agree to this revision.

§§164.304 – 318); rules for conducting risk analysis and risk management activities (45 CFR §164.308); requirements for security awareness training (45 CFR §164.308(a)(5)); requirements for entities to have security incident identification, response, mitigation and documentation procedures (45 CFR§164.308(a)(6)).

The State does not agree to this revision.

Contractor shall submit complete and accurate data to the State’s DSS contractor by the fifteenth twenty-fifth of each month. Complete and accurate data is defined to be data that:

The State does not agree to this revision.

The Contractor shall, at its own cost, provide the State and/or its representative with prompt and reasonable access to any data, data extracts, documents, access to systems, and other information necessary to ensure Contractor compliance with all requirements of this Contract. Such access shall be limited to information directly related to services performed under this Contract and subject to applicable federal and state privacy, security, and confidentiality requirements. Access to Contractor systems shall be provided in a manner determined by Contractor to protect system security, proprietary information, trade secrets, and information relating to other customers, including through supervised access, read-only access, reports, data extracts, or demonstrations, as appropriate.

The state does not agree to this revision.

The Contractor shall maintain single limits not less than one million dollars ($1,000,000) per occurrence. If a general aggregate limit applies, either the general aggregate limit shall apply separately to this policy or location of occurrence or the general aggregate limit shall be twice the required occurrence limit.

The State agrees to make the requested revision. See amendment item #9.

remediation and restoration. Contractor shall take all necessary measures to halt any further Unauthorized Disclosures.

The State does not agree to these revisions.

Policy (Policy 200-POL-007), available at:https://www.tn.gov/content/dam/tn/finance/artificialintelligence/Enterprise_Artificial_Intelligence_Policy.pdf. a. Data Privacy and Security Contractor shall not use, access, store, transmit, or process any State Data—including but not limited to confidential, privileged, personally identifiable information (PII), protected health information (PHI), Payment Card Industry (PCI) data, criminal justice information (CJIS), federal tax information (FTI), Centers for Medicare & Medicaid Services (CMS) data, Social Security Administration (SSA) data, Family Education Rights & Privacy Act (FERPA) data, or internal communications—through any AI tools or platforms unless:

(1) The AI tool is explicitly approved in writing by the State.

(2) The tool is operated within a secure State-controlled or approved environment.

a. Data Privacy and Security Contractor shall notify the State annually of any AI used in connection with the products and Services. To the extent the State objects to the usage of any AI used by Contractor, the State shall have the right to terminate its agreement with Contractor. Such termination will not be considered a termination for cause. Contractor shall not use identifiable State Data to train, fine-tune, or otherwise improve AI models, unless expressly authorized in writing by the State.

c. Transparency and Accountability

In accordance with applicable laws, Contractor shall clearly disclose when AI tools are used in providing services or generating content on behalf of the State. Contractor is responsible for the accuracy, reliability, and appropriateness of all AI-generated outputs.

e. Ongoing Compliance and Risk Mitigation

Contractor shall ensure continued compliance with evolving State and federal regulations related to AI. The State reserves the right, no more than once per calendar year and on at least thirty (30) days written notice, to review AI usage under this Contract at any time, provided, however, [REDACTED] reserves the right to terminate any such review if it believes, in its sole discretion, that such review jeopardizes the security or privacy of any other customer of MetLife.

f. Contractor shall further indemnify and hold harmless the State in accordance with the Hold Harmless section of this Agreement for any unauthorized disclosure, misuse, or compromise of State Data resulting from Contractor’s negligent acts or omissions, or willful misconduct, in connection with AI-related processing that violates this Contract or State policy.

The State does not agree to these revisions.

2. Monthly reports shall be submitted by the 15 25th of the following month;

The State does not agree to these revisions.

3) Paid Vision Loss Ratio Report, submitted quarterly (quarter-only and year-to-date).

*Vision Loss Ratio – Contractor shall quarterly and annually calculate its Vision Loss Ratio (VLR) and submit such calculation and supporting data to the State. VLR shall be calculated as Paid Claims + IBNR Changes divided by Premium Collected for Subscribers.

The state does not agree to these revisions.

3. Delete Pro Forma Contract Section A.12.i in its entirety and insert the following in its place.

i. System and Information Security and Access Management Requirements

1. The Contractor’s systems shall employ an access management function that restricts access to varying hierarchical levels of system functionality and information. The access management function shall:

· Restrict access to information on a “least privilege” basis, e.g., users permitted inquiry privileges only shall not be permitted to modify information;

· Restrict access to specific system functions and information based on an individual user profile, including inquiry only capabilities and the ability to create, change or delete certain data (global access to all functions shall be restricted to specified staff jointly agreed to by the State and the Contractor);

· Restrict unsuccessful attempts to access system functions to five (5), with a system function that automatically prevents further access attempts and records these occurrences.

2. The Contractor shall make system information available to duly authorized representatives of the State and other federal and state agencies to evaluate, through inspections or other means, the quality, appropriateness and timeliness of services performed.

3. The Contractor’s systems shall contain controls to maintain information integrity. These controls shall be in place at all appropriate points of processing.

4. Audit trails shall be incorporated into all systems to allow information on source data files and documents to be traced through the processing stages to the point where the information is finally recorded. The audit trails shall:

4. Contain a unique log-on or terminal ID, the date, and time of any create/modify/delete action and, if applicable, the ID of the system job that effected the action;

· Have the date and identification “stamp” displayed on any on-line inquiry;

· Have the ability to trace data from the final place of recording back to its source data file and/or document; and

· Facilitate batch audits as well as auditing of individual records.

5. The Contractor’s systems shall have inherent functionality that prevents the alteration of finalized records.

6. The Contractor shall provide the State with access to data facilities upon request.

7. The Contractor shall restrict perimeter access to equipment sites, processing areas, and storage areas through a card key or other comparable system, as well as provide accountability control to record access attempts, including attempts of unauthorized access.

8. The Contractor shall include physical security features designed to safeguard processor site(s) through required provision of fire-retardant capabilities, as well as smoke and electrical alarms, monitored by security personnel.

9. The Contractor shall implement administrative, physical, and technical safeguards designed to prevent unauthorized access to the portions of the data communications network within the Contractor’s Span of Control. Such safeguards shall be aligned with the applicable controls in the then-current edition of NIST SP 800-53, as appropriate to the services, systems, and information covered by this Contract.

10. The Contractor shall conduct a security risk assessment at least annually and communicate the results to the State in compliance with Contract Attachment C.22. The first report shall be provided by the date specified in Contract Section A.18 and annually thereafter (refer also to Contract Attachment C.22). The risk assessment shall also be made available to appropriate State and Federal agencies. At a minimum the assessment shall contain the following: identification of loss risk events/vulnerabilities; analysis of the probability of loss risk and frequency of events; estimation of the impact of said events; identification and discussion of options for mitigating identified risks; cost-benefit analysis of options; recommended options and action plan for their implementation.

11. Upon the State’s request, the Contractor shall provide designated State employees with access and applicable update authority to the Contractor’s employer portal for enrollment and reporting purposes by the date specified in Contract Section A.18. Additional users may be added at any time at the State’s request In Writing. The Contractor shall provide appropriate training and system documentation to State employees at the State’s request.

4. Delete Pro Forma Contract Section D.19 in its entirety and insert the following in its place.

D.19 Hold Harmless. The Contractor agrees to indemnify and hold harmless the State of Tennessee as well as its officers, agents, and employees from and against any and all claims, liabilities, losses, and causes of action which may arise, accrue, or result to any person, firm, corporation, or other entity which may be injured or damaged as a result of acts, omissions, or negligence on the part of the Contractor, its employees, or any person acting for or on its or their behalf relating to this Contract. The Contractor further agrees it shall be liable for the reasonable cost of attorneys’ fees, court costs, expert witness fees, and other litigation expenses for the State to enforce the terms of this Contract.

In the event of any suit or claim, the Parties shall give each other prompt notice and provide all necessary assistance to respond. The failure of the State to give notice shall only relieve the Contractor of its obligations under this Section to the extent that the Contractor can demonstrate actual prejudice arising from the failure to give notice. This Section shall not grant the Contractor, through its attorneys, the right to represent the State in any legal matter, as the right to represent the State is governed by Tenn. Code Ann. § 8-6-106.

5. Delete Pro Forma Contract Section D.20.d in its entirety and insert the following in its place.

d. The Contractor will indemnify the State and hold it harmless for any violation by the Contractor or its subcontractors of the Privacy Rules. Contractor is responsible for its costs of containing and remedying any breach under the Breach Notification Rule in accordance with applicable privacy laws, and may reimburse the State for reasonable documented costs incurred in responding to and mitigating damages caused by such breach, including legally required notice and remediation, provided that both parties coordinate their response to avoid duplicative actions. Contractor will also provide or pay for credit monitoring for affected individuals for one year or more if required by law.

6. Delete Pro Forma Contract Section D.37.a(5) in its entirety and insert the following in its place.

(5) The Contractor must annually perform Penetration Tests and Vulnerability Assessments against its Processing Environment per the NIST 800-115 definition.