The file's text, extracted by GovTribe without its formatting.
STATE OF TENNESSEE
DEPARTMENT OF FINANCE & ADMINISTRATION, BENEFITS ADMINISTRATION
REQUEST FOR PROPOSALS #31786-00193
AMENDMENT #TWO
FOR LIFE AND ACCIDENTAL DEATH AND DISMEMBERMENT INSURANCE
DATE: October 14, 2026
RFP #31786-00193 IS AMENDED AS FOLLOWS:
1. This RFP Schedule of Events updates and confirms scheduled RFP dates. Any event, time, or date containing revised or new text is highlighted.
(central time zone)
DATE
1. RFP Issued
August 20, 2026
| 2. Disability Accommodation Request Deadline |
| 2:00 p.m. |
| August 26, 2026 |
| 3. Pre-response Conference |
| 10:00 a.m. |
| August 31, 2026 |
| 4. Notice of Intent to Respond Deadline |
| 2:00 p.m. |
| September 1, 2026 |
5. Written “Questions & Comments” Deadline *NOTE: Submit written questions and comments on Appendix 7.24 the written questions and comments template.
2:00 p.m.
September 11, 2026
6. State Response to Written “Questions & Comments”
October 14, 2026
7. Round 2 Written “Questions & Comments” Deadline *NOTE: Respondents may submit no more than five (5) questions to the State in the 2nd round of Written Questions and Comments.
October 21, 2026
8. State Response to Written “Questions & Comments” Round 2
November 4, 2026
| 9. Response Deadline |
| 2:00 p.m. |
| November 18, 2026 |
10. State Completion of Technical Response Evaluations
December 17, 2026
| 11. State Opening & Scoring of Cost Proposals |
| 2:00 p.m. |
| December 18, 2026 |
| 12. Negotiations |
| 4:30 p.m. |
| January 6-8, 2027 |
13. State Notice of Intent to Award Released and RFP Files Opened for Public Inspection
2:00 p.m.
January 28, 2027
14. End of Protest Period
February 4, 2027
15. State sends contract to Contractor for signature
February 5, 2027
| 16. Contractor Signature Deadline |
| 2:00 p.m. |
| February 12, 2027 |
2. State responses to questions and comments in the table below amend and clarify this RFP.
Any restatement of RFP text in the Question/Comment column shall NOT be construed as a change in the actual wording of the RFP document.
| Question |
| Section |
| Question |
| State Response |
| Please provide a copy of the in-force minimum premium agreement. |
| See pro forma Contract Section C.3, Payment Methodology, which provides the details of the minimum premium arrangement. |
| Please confirm who distributes claim forms to beneficiaries, and how the carrier is notified of a claim. |
| Claim forms for Basic Term Life/Basic AD&D or Voluntary AD&D are sent by the State to the insured or beneficiary. Once received by the State, it is passed on to the current contractor for administering the claim. Claim forms for Voluntary Term Life can be requested to be sent by the current contractor. |
| Please describe your current EOI process (paper, batch, SSO etc.) |
| The current EOI process for Voluntary Term Life is administered electronically after an eligible employee chooses their insurance amount in the current contractor’s system. If additional information is required, the current contractor will correspond with the applicant to collect information for a determination to be made. |
| Are there any value adds highly utilized by your employees? |
| This data is not available. |
| Please confirm who maintains the beneficiary designation records, and if they are stored on paper (including images) or electronically. |
| Beneficiaries for the Basic Term Life/Basic AD&D and Voluntary AD&D plans are maintained electronically in the State’s ERP system and beneficiaries for the Voluntary Term Life are maintained electronically in the contractor’s system. |
See amendment item #12.
| Have there been any enrollments on the Vol. Life/ADD since 2018? |
| Yes. The State has revised Appendix 7.5 for Voluntary AD&D Enrollment as of June 2026. The State has added Appendix 7.26 for yearly enrollment count in the Voluntary AD&D and Voluntary Term Life Programs. |
See amendment item #13.
| 7 |
| General Inquiry |
| Our interpretation of the term “subcontractor” as used throughout the State’s requirements and ProForma contract, are those third-party vendors that are entered into exclusively to perform services related to the State of Tennessee’s dental insurance coverages. Does the State agree with this definition? |
| No. A subcontractor is any third-party who a Contractor uses to perform services that are originally obligations of the Contractor under the pro forma contract. |
| 8 |
| General Inquiry |
| Please provide all available policies, details, and historical accounting around the Minimum Premium Arrangement for Basic Life and AD&D, including the magnitude of any annual retro, historical and latest PSR or deficit amounts, risk charges, and termination provision (terminal retros, run-out period, valuation date, etc.). |
| See pro forma Contract Section C.3. Payment Methodology, which provides the details of the minimum premium arrangement. In addition, the State has added Appendix 7.30 for the basic term life/basic AD&D monthly invoice, which provides historical and current invoices, through June 2026. Appendix 7.30 shows the monthly amount invoiced to the state, which includes the sum of retro transactions, deficits, and reserves. |
See amendment item #13.
| 9 |
| General Inquiry |
| Please confirm EAP is not being requested. |
| Confirmed. |
| 10 |
| General Inquiry |
| Are conversion/portability charges available for employee-paid coverages? |
| The State has added Appendix 7.25 for the voluntary term life ported premium rates. Conversion premium rates for voluntary term life are proprietary for the current vendor since they offer private, individual life insurance policies. See amendment item #13. |
| 11 | |
| General Inquiry | |
| Are pending reserves by coverage available as of the end of each year? | |
| Year |
| Basic Term Life/Basic AD&D IBNR Reserve at End of Year | |
| 12 |
| General Inquiry |
| Please provide historical average lives and volume by year for VADD. |
| 13 |
| General Inquiry |
| Can employee gender be added to the Basic/VADD census? |
| Yes. The State has revised Appendix 7.5. See amendment item #13. |
| 14 |
| General Inquiry |
| Can annual salary be added to the Voluntary census? |
| Yes. The State has revised Appendix 7.5 and 7.15. See amendment item #13. |
| 15 |
| General Inquiry |
| Is a recent billing invoice available including the lives and volume by age bracket? |
| The State has added Appendix 7.30 for the basic term life/basic AD&D monthly invoice, as of June 2026. See amendment item #13. |
| 16 |
| General Inquiry |
| Basic Life census volume at current rates alludes to $10.9M in annual premium. Remitted premium in the ‘Claims Conversion and Premium Experience’ workbook shows premium in the range of $8M to $9M. The ‘Enrollment and Coverage in Basic Term Life’ workbook shows premium dollars deducted as roughly double this. Please explain the premium arrangement, discrepancies between these figures, and which source is most accurate. |
| The State has revised Appendix 7.5, which reflects snapshot individual level enrollment in Basic Term Life/Basic AD&D and Voluntary AD&D as of December 2025 and June 2026, respectively, and should not be used to determine premium. See amendment item #13. |
The Premium shown in Appendix 7.1, 7.2 and 7.3 for Claims, Conversion and Premium Experience should be used to determine the amount of premium provided to the contractor, as it reflects the administrative charge and incurred claims.
The State has revised Appendix 7.4. The deduction amount in Appendix 7.4 Enrollment and Coverage REVISED reflects the total premium collected for all of the coverages in place. See amendment item #13.
The premium arrangement is described in pro forma Contract Section C.3. Payment Methodology.
| 17 |
| General Inquiry |
| Basic AD&D census volume at current rates alludes to $1.3M in annual premium. Please explain the premium arrangement, discrepancies between the significantly lower figures in the experience reporting, and which source is most accurate. |
| The State has revised Appendix 7.5 which reflects snapshot individual level enrollment in Basic Term Life/Basic AD&D and Voluntary AD&D as of December 2025 and June 2026, respectively, and should not be used to determine premium. See amendment item #13. |
The Premium shown in Appendix 7.1, 7.2 and 7.3 for Claims, Conversion and Premium Experience should be used to determine the amount of premium provided to the contractor, as it reflects of the administrative charge and incurred claims.
The State has revised Appendix 7.4. The deduction amount in Appendix 7.4 REVISED Enrollment and Coverage reflects the total premium collected for all of the coverages in place. See amendment item #13.
The premium arrangement is described in pro forma Contract Section C.3. Payment Methodology.
| 18 |
| General Inquiry |
| Have there been any changes to ported Supplemental and Dependent Life eligibility? The lives have steadily decreased over the last 5 years. |
| Effective 1/1/24, dependent spouses and children were no longer eligible for coverage in the Basic Term Life/Basic AD&D plan. There have been no changes to the voluntary term life eligibility. |
| 19 |
| General Inquiry |
| The Voluntary census shows significantly lower lives and volume for Child Life than the billing history. Are the billed figures more accurate? |
| Please clarify which appendices and/or figures include the discrepancy described in this question in Round 2 of written questions and comments. |
| 20 |
| General Inquiry |
| Given the move to Contemporary Basic Life in 2024, why does the experience show billed premium for participating dependent life in 2024? |
| Even though dependent coverage in basic term life/basic AD&D was eliminated effective 1/1/24, there is premium billed to the State for dependent life in 2024 to account for claims that took place for dependents in those programs in 2023 or prior. |
| 21 |
| General Inquiry |
| Please confirm the Basic Term Life and Basic AD&D administrative and reserve charges (cost proposal tables B and C) are to be billed separately and independently from the premium rates (tables D through J). |
| Confirmed |
| 22 |
| General Inquiry |
| What is the average age of historical Basic Life conversions? |
| 23 |
| Appendix 7.4 |
| On the June 2026 Tab there is a line for both ER paid Non Taxable and ER Paid Taxable Premium. Please clarify the difference |
| The difference is because the first $50,000 of employer-paid group-term life insurance is not taxable (ER Paid Non Taxable) and anything in excess of that amount of coverage is taxable income (ER Paid Taxable). Employees are permitted to opt coverage down to $50,000 to avoid imputed income, which is the line entry for “Basic Term Life 50K Employer Paid NonTaxable”. |
| 24 |
| Appendix 7.5 |
| Can Permaplan employees be identified on the census? |
| There are nine employees enrolled in the Permaplan as of June 2026. Identification of employee information cannot be provided. |
| 25 |
| Appendix 7.5 |
| It appears that prior to 1/1/2023 the Basic Term Life benefit was based on the employees enrollment in the state medical plan. Is there an indicator in the census that shows the Employees state medical plan enrollment? If not can one be added? |
| There is not an indicator in Appendix 7.5 Basic Term Life/Basic AD&D and Voluntary AD&D census because the requirement for state medical enrollment is no longer in place and the enrollment shown in this Appendix reflects the status as of June 2026. |
| 26 |
| Appendix 7.5/7.15 |
| Can the following information be added to the Basic Life/Voluntary Life Census |
- Date of Birth
- Gender
- Job Title
- Employee ID The State has revised Appendix 7.5 which includes year of birth, gender, and job title. Employee ID can’t be provided. See amendment item #13.
The State has revised Appendix 7.15. See amendment item #13.
| 27 |
| Appendix 7.6 |
| Can the difference between issued age and attained age be clarified? |
| Issued Age is the age of the insured when they start the policy, and attained age is the current age of the insured for determining premium and coverage amount. |
| 28 |
| Appendix 7.16 |
| Does the 2026 Q2 tab show all the currently active Waiver claims |
| Yes, as of June 2026. |
| 29 |
| Appendix 7.23 |
| It appears the Vountary life cert provided is for grandfathered employees, can the actaul Vol Life cert be provided? |
| Appendix 7.23 is the current voluntary term life certificate for all eligible employees. The State has added new Appendices 7.27, 7.28 and 7.29 for updated eligibility rules starting Jan. 1, 2027. See amendment item #13. |
| 30 |
| RFP Section 3.2.2.1.1 - Technical Proposal |
| Are you looking for one rolling document with page numbers (including the appendices or exhibits) AND then a separte rolling document with page numbers that does not include the appendices or exhibits and those in a separate document? |
Or just the one rolling document with page numbers and then the appendices or exhibits in a seperate rolling document with page numbers?
The technical response should be provided as one consolidated digital document with page numbers. All appendices or exhibits should be provided as separate, individual digital documents.
Digital Media Submission
| Please advise if the “RFP #31786-00193 TECHNICAL RESPONSE COPY” can also be uploaded onto the States digital submission platform, or if a USB flash drive is mandatory. |
| Yes, the copy may be uploaded to the digital platform. |
| 32 |
| RFP Section 3.2.2.1.1 |
| The requirement for a Technical Response Copy notes that the document should include "separate individual corresponding appendices or exhibits." Please clarify how the formatting of this document differs from the Technical Response Original, or confirm that the Copy and the Original should be identical. |
| The original and the copy should be identical. |
E-mail Submission
| Please clarify if an e-mail submission is also required in addition to the uploaded submission via the States digital submission platform. |
| An email submission is not required. You may submit your proposal either through the State’s digital submission platform or by email, as both methods are acceptable. |
| 34 |
| RFP Section 3.2.3. |
| Please clarify if hard copy binders are also being requested and if so, how many. |
| No, hard copy binders are not being requested. |
| 35 |
| RFP Section 3.3.7 |
| Section 3.3.7 states that different Respondents may offer the same subcontractor as part of their responses, provided that the subcontractor does not also submit a response as a prime contractor. Please confirm that a subcontractor may therefore have discussions with, and potentially be identified by, more than one prospective prime Respondent for this RFP, provided the subcontractor does not submit its own response as a prime Respondent. |
| Correct. Different Respondents may offer the same subcontractor as part of their responses provided that the subcontractor does not also submit a response as a prime contractor. |
| 36 |
| RFP Section 4.4.2–4.4.5; Attachment 6.2, Section B, Item B.12 |
| If a subcontractor is identified in the prime Respondent's proposal, is the subcontractor separately required to register as a Tennessee Supplier in Edison and obtain an individual Edison Supplier ID, or does the prime Respondent's Edison registration satisfy the State's supplier-registration requirement for the subcontracted scope? If separate registration is required, must the subcontractor's Edison Supplier ID be included in the proposal? |
| An Edison ID is not required for a subcontractor. |
| 37 |
| RFP Section 4.4.2–4.4.5; Attachment 6.2, Section B, Item B.12 |
| If a qualified insurance carrier is the prime Respondent and retains responsibility for all insurance administration and contract performance, may the prime identify a Tennessee-based subcontractor to provide limited participant-facing services such as employee benefits education, communications support, stakeholder engagement, and community/outreach activities, provided the prime retains responsibility for underwriting, claims administration, enrollment administration, customer service, billing, technology, reporting, and other carrier-level requirements? If yes, can the subcontractor be contracted with multiple carriers seeking to solicit for the same RFP? (which coincides with the first question) |
| Subcontractors are allowed but must be disclosed. RFP section 4.4.2 states that if a Respondent intends to use subcontractors, the response to this RFP must specifically identify the scope and portions of the work each subcontractor will perform. Refer to RFP Section B, Question #12. |
Regarding whether the same subcontractor may be used by multiple Respondents, refer to RFP Section 3.3.7. A Respondent must not submit a response as a prime contractor while also permitting one or more other Respondents to offer the Respondent as a subcontractor in their own responses. Such may result in the disqualification of all Respondents knowingly involved. This restriction does not, however, prohibit different Respondents from offering the same subcontractor as a part of their responses (provided that the subcontractor does not also submit a response as a prime contractor).
| 38 |
| RFP Section 4.4.1 |
| Will the State agree to the following revisions: the definition of “subcontractor” applies to those entities with whom the Contractor contracts to provide services solely to the State? |
| The State does not agree. |
| 39 |
| Statement of Certifications and Assurances |
| Is an electronic signature acceptable on this form? Can electronic signatures be accepted on any and all forms? |
| Yes, an electronic signature is acceptable. |
| 40 |
| A.2 (rr) |
| With respect to A.2(rr)(page 45) is the State agreeable to the following edit: Confidential State Data means any and all data that is can be accessed, processed, generated as a derivative work, stored, or hosted by the Contractor in performance of this Contract that relates to the State, its employees, members, or beneficiaries, excluding publicly available information and the Contractor's pre-existing materials, methodologies, and know-how. |
| The State does not agree to these revisions. |
| 41 |
| A.3.e Staffing |
| Will the State agree to the following revisions: that Contractor reserves the right to make final decisions regarding our own employees, but that Contractor will perform regular check-ins and accept feedback on employees and will provide ample notice prior to any staff changes? |
| Please provide the specific proposed contract language, including exact revisions to the applicable Contract Section, in Round 2 of written questions and comments. |
| 42 |
| A.3.e Staffing |
| We will work with you to ensure that our employees servicing your account meet and exceed your expectations. We hope to establish regular check-ins to ensure that is happening. We will gladly provide reasonable notice of any changes of any personnel prior to the change going into effect. However, will the State agree for us to be allowed to reserve the right to make final decisions regarding Contractor employees? |
| Per pro forma Contract Section A.3.e, the Contractor must, at the State’s written request, replace staff members or subcontractors providing core services for this contract. |
| 43 |
| A.3.e |
| We are very amenable to our clients requesting changes to our key staff members, particularly those who are account-facing, but are uncomfortable with a client having employment decision-making authority, without the possibility of appeal, for other employees in our organization as described by this language. Would the State be open to softening this language to either the Contractor considering such a staffing request, or to limiting this type of request to only those on the account team that routinely interacts with the State? |
| Please provide the specific proposed contract language, including exact revisions to the applicable Contract Section, in Round 2 of questions. |
| 44 |
| A.4.c.2 Call Center |
| Will the State agree to the following revisions, “The Contractor’s call center(s) shall maintain a quarterly average Call Abandonment Rate of four percent (4%) or less. Quarterly results will be calculated for a quarterly score as shown in Contract Attachment D #2. The quarterly Call Abandonment Rate shall be calculated by dividing the number of abandoned calls with a duration of five seconds or greater by the total number of inbound calls with a duration of ten seconds or greater during the quarter and multiplying by 100. “ |
| The state does not agree to this revision. |
| 45 |
| A.4.g Call Center |
| Will the State agree that “caller identification” is defined as the phone screen displaying an individual’s or organizations’ phone number? |
| The state does agree to meaning of “caller identification.” |
| 46 |
| A.4.h Call Center |
| Will the State agree that the Contractor complies with applicable privacy and confidentiality laws in determining whether the State can access particular call recordings? |
| The State does not agree. Refer to pro forma contract section D.24 and D.25. |
| 47 |
| A.4.h |
| Will the State accept the this addition? Some laws prevent us from providing certain call recordings. |
"Subject to the limitation of applicable law, the Contractor shall be able to provide a full recording of each call upon the State's request."
See answer to question #46.
| 48 |
| A.4(h) |
| With respect to A.4(h)(page 47), [REDACTED] is subject to insurance and privacy laws in our own right, and that we must necessarily process information on our own behalf as we administer the group policies we issue; is the State agreeable to the following edit: The Contractor’s call management system shall record and index all calls such unless a caller requests that the call not be recorded. Recordings shall be indexed so that the Contractor can easily retrieve recordings of individual calls based on the Edison ID of the caller, phone number of the caller, the caller’s name, the date/time of the call and/or the staff member who handled the call. The Contractor shall be able to provide a full recording of each call upon the State’s request, subject to applicable privacy laws. The Contractor shall archive the recordings for one year from the date of each call. |
| See answer to question #46. |
| 49 |
| A.6.h Member Communication/Materials |
| Will the State agree to the following revisions, “The Contractor will make a good faith effort to design Member materials at the sixth (6.0) grade level using the Flesch-Kincaid Index if such material may be so designed while still meeting insurance advertising regulatory requirements. The Contractor shall evaluate materials…” |
| No, the State does not agree. All of Benefits Administration’s contracts include reading level standards for member-facing materials to ensure employees understand the benefits available to them. The State reserves the right to permit occasional exceptions, however, we do not agree to the revision. |
| 50 |
| A.6.i Member Communication/Materials |
| Will the State agree that postings made to online platforms, to be augmented with printed copies to employees if requested by the member? |
The State does not understand this question. Please clarify in round 2 of written questions and comments.
| 51 |
| A.8.a Welcome Packets |
| Will the State agree that Contractor has final authority to ensure compliance with state insurance advertising laws? |
| The State does not agree. |
| 52 |
| A.9.a Member Website, Plan Microsite and Mobile Application |
| [REDACTED’s] microsites are made following a pre-approved template and include data selected in coordination with the State. Is the State amenable to a microsite which provides documents and links as requested, but which follows the Contractor’s established branding principles? |
| The State does not agree. The State has final approval on the design and layout of the microsite, which must follow state branding and style guidelines. |
| 53 |
| A.9.c Member Website, Plan Microsite and Mobile Application |
| External videos hosted on platforms such as YouTube and Vimeo can present potential privacy considerations. What entity would be expected to be responsible for the accessibility of video experiences not created by the Contractor? What types and subjects of content would the State expect to include on the site? |
| The State can advise on best practices, however, it is the Contractor’s responsibility to ensure that any video content they create, host or otherwise provide to our members is accessible. See pro forma contract section E.9. |
The State will determine the types of audio, video, or multimedia content to be included on the microsite based on what is relevant and useful to support communications for the State plan and its Members.
| 54 |
| A.9.i |
| We are able to agree to an uptime of 99.5%, with a carveout for maintenance windows like is show in Section A.11.p. below. Would the State agree to following language as a result? |
"The Contractor shall have adequate server capacity and infrastructure to support the likely volume of traffic from individuals without disruption or delay with the ability to sustain ninety-nine-point five percent (99.5%) continuous uptime, except for maintenance windows."
The State agrees. See amendment item #3.
| 55 |
| A.9.i |
| Would the State provide some additional clarification on the scope and reach of the prior approval requirement for non-governmental websites or webpages? |
| The State requests that the Contractor provide links to any non-governmental websites or pages they intend to direct members to at least two weeks in advance, allowing the State sufficient time to review the content and determine whether approval will be granted. |
| 56 |
| A.9.p Member Website, Plan Microsite and Mobile Application |
| Is the State amenable to a microsite solution which does not require additional login steps? Our microsites can include plan and benefits information without the need for further credentials. |
| As noted in Section A.9.a, the Contractor must maintain a Plan Microsite that is dedicated to and customized for the State and contains information specific to the Plan. This microsite must be accessible to all users without requiring a Member login. |
Member‑specific materials, however, will reside on the separate Member website, which is accessible only through the Member login portal.
| 57 |
| A.9.q Member Website, Plan Microsite and Mobile Application |
| Will the State agree to mobile-compatible web pages in lieu of a dedicated application? |
| Yes, the State agrees. See amendment item #4. |
| 58 |
| A.9.t Member Website, Plan Microsite and Mobile Application |
| The Contractor’s online portal can allow for the upload of documents and the filing of claims, and can be linked to from our microsite. What other data linkage does the State anticipate needing for member use? |
| The State does not currently anticipate needing other data linkage outside of what is mentioned in pro forma Contract Section A.9.t. |
| 59 |
| A.9 (u) |
| With respect to A.9(u)(page 52) [REDACTED] is in full compliance with all applicable privacy laws. We note that the requirements of HIPAA do not apply to the coverages requested. Is the State agreeable to the following edit: Within 45 days following the Effective Date, the Contractor shall provide the State with a copy of all Contractor and subcontractor online terms and conditions, online service agreements, privacy policies, |
notices of privacy policy, or other documents required to be accepted by members of the State of TN health plans when they access online accounts, services, or programs being delivered by Contractor or subcontractors pursuant to this Contract. Contractor and its subcontractors shall not require Members of the State of TN health plans to agree to online Terms of Use, Privacy Policies, Notices of Privacy Policies, or other similar documents that contain provisions which conflict with the terms of this Contract or Business Associate Agreement (BAA) between the State of TN and Contractor, or with the terms of this Contract or BAA between Contractor and its subcontractors in order to access services provided pursuant to this contract. Any terms contained in such online documents which violate this prohibition shall be deemed void and not applicable to or binding upon the State of TN plan Members.
The state does not agree.
| 60 |
| A.10.h Administrative Services |
| The Contractor’s policy allows for appeals requested in writing, to be reviewed by a specialized team and clinical resources. Updates are provided regularly during the course of the review. Does the State anticipate additional grievance procedures being necessary? |
| In addition to the formal in writing appeal process, the contractor is expected to handle the normal grievance complaints, e.g. poor customer service, slow claims processing, lack of response to questions, et. al., received during the regular course of business. |
| 61 |
| A.10.k Administrative Services |
| Will the State agree to terms that allow the Contractor to modify its Master Group Insurance Policy and certificates as it deems necessary to ensure compliance with changes in law or regulations? |
| Any edit to certificates of coverage and/or group master policies in place for this contract must be reviewed and approved by the State before official filing. |
| 62 |
| A.10.i Administrative Services |
| Will the State agree that the Contractor cannot relinquish control over our own media or legislative presence, and may not always be legally permitted to give notice when we are required to comply with regulatory or legal requests? |
| The State does not agree. |
| 63 |
| A.10.n Administrative Services |
| Will the State agree to language that Contractor shall use reasonable efforts to ensure that the State does not receive undelivered mail? |
| Please provide the specific proposed contract language, including exact revisions to the applicable Contract Section, in Round 2 of written questions and comments. |
| 64 |
| A.11.b Information Systems |
| Will the State agree our ISO 27001 certification and SOC 2 Type II report as evidence of meeting security and controls requirements? |
| The State considers a current ISO/IEC 27001:2022 certification and SOC 2 Type II examination as evidence of independent third-party assurance; however, neither document automatically demonstrates compliance with all State, federal, regulatory, contractual, or program-specific requirements. |
Acceptance is subject to review of the assessment scope, system boundaries, applicable services, data covered, exceptions, findings, corrective-action status, and the period of coverage. The Contractor remains responsible for complying with the specific security, privacy, audit, incident response, data protection, and other requirements contained in the Contract.
| 65 |
| A.11.b Information Systems |
| Which Federal and State Standards are considered applicable to this contract? [REDACTED’S] complies with all relevant regulations, but given the differences between State standards it would be helpful to know which are applicable and which are not |
| The Contractor must comply with all Federal and State laws, regulations, policies, standards, and contractual requirements applicable to the services, systems, personnel, and State Data involved in the Contract. |
At a minimum, the Contractor must comply with:
· The State’s applicable NIST 800-53 information security, privacy, risk-management, and data-protection requirements.
· The security and privacy requirements stated in the Contract, including the Information Technology Security Requirements.
· Applicable federal requirements based on the type of data and services involved, such as HIPAA, IRS Publication 1075, CJIS, FERPA, PCI DSS, CMS requirements, or other applicable authorities.
· The State’s mandatory onshore data-hosting and access requirements.
· The required security-control baseline, including NIST SP 800-53 Rev. 5 Moderate, unless a higher requirement applies or an approved exception is granted.
· The Contractor is responsible for identifying and complying with all requirements applicable to its services and must promptly notify the State if it believes a requirement is unclear or conflicts with another legal or contractual obligation.
| 66 |
| A.11.d Information Systems |
| Will the State agree that due to privacy and confidentiality law, the Contractor cannot agree to comply with providing a report that includes identifiable information in this manner? |
| The State does not agree. |
| 67 |
| A.11.f Information Systems |
| Will the State agree to contractual language providing that the Contractor shall own its proprietary business records created in the ordinary course of business including, but not limited to claims, underwriting and marketing files? |
| The State does not agree. |
| 68 |
| A.11.f |
| Will the State accept the addition of the following language to clarify how data is to be used for risk management and other necessary insurance activities? |
f. Information Use. Notwithstanding anything to the contrary, the Contractor and its affiliates (“[REDACTED Enterprise”) may disclose and use information obtained or created in connection with this Contract or the Policy as permitted or required by applicable law, contract, or regulation, including disclosures to reinsurers and service providers and responses to subpoenas, governmental authorities and regulators, and for [REDACTED] Enterprise business and risk management purposes, including actuarial research, pricing, benchmarking, and analytics. To the extent possible, Contractor will use deidentified information for such enterprise uses.
The State does not fully agree with the proposed additional language; however, portions of it have been incorporated. Please refer to amendment item #5 for details.
| 69 |
| A.11.f.1 Information Systems |
| Will the State agree to the following revisions: “Upon termination of this Contract and request by the state, subject to applicable law, the Contractor shall provide to the State or its designated agent, pertinent data identified by the State for Members to effect a transition of the Program from the Contractor. The information shall be furnished in a mutually agreeable format and medium. To ensure the continuous operation of the Program and upon 30 days’ notice, this information shall be provided to the State or its designated agent.” |
| The State does not agree to these revisions. |
| 70 |
| A.11.g |
| Will the State accept the addition of the following language to protect our rights in forms and information, as well as the edit meant to reflect the fact that the employees who will be working on the State’s plan do not sit at the underwriting company level and therefore we need the ability to share information within our broader enterprise. |
g. Information Ownership. All information, whether data or documents, and reports that contain or make references to said information, specifically and exclusively arising out of the performance of this Contract is owned by the State. The Contractor is expressly prohibited from sharing or publishing State information and reports or releasing such information to external entities, affiliates, parent company, or subsidiaries without the prior consent of the State In Writing.
This language is found in A.11.f. The State does not fully agree with the proposed additional language; however, a portion of it has been incorporated. Please refer to amendment item #5 for details.
| 71 |
| A.11.h. |
| Our maintenance windows are from 12AM - 7AM CST every Saturday and Sunday. Would the State accept an update to the language as follows? |
Any scheduled maintenance shall occur between the hours of midnight and 7:00 a.m. Central Time, Saturdays and Sundays, and shall be scheduled in advance with notification on the Member website. The Contractor shall make efforts to minimize any downtime between 7:00 a.m. and 12:00 a.m. Central Time, Saturdays and Sundays.
This language is found in A.11.g. The State agrees. See amendment item #6.
| 72 |
| A.11(h)(i)(1) |
| With respect to A.11(h)(i)(1)(pages 58-59) is the State agreeable to the following edit: System and Information Security and Access Management Requirements |
1) The Contractor’s systems shall employ an access management function that restricts access to varying hierarchical levels of system functionality and information. The access management function shall: • Restrict unsuccessful attempts to access system functions to five (5), with a system function that automatically prevents further access attempts and records these occurrences; and
• Ensure that authentication credentials are not passed in clear text or otherwise displayed or presented.; and
• Provision user access on a “need to know” basis commensurate with each user’s role, and provide for periodic review of user access rights, with access revoked when no longer required or upon termination of the user’s employment or engagement.
The State does not fully agree with the proposed additional language; however, portions of it have been incorporated. Please refer to amendment item #7 for details.
| 73 |
| A.11(h)(i)(10) |
| With respect to A.11(h)(i)(10)(page 60) is the State agreeable to the following edit:The Contractor shall conduct a security risk assessment at least annually and communicate a summary of the results to the State in compliance with Contract Attachment C. The first report shall be provided by the date specified in Contract Section A.17 and annually thereafter (refer also to Contract Attachment C.20). The results of the risk assessment shall be treated as the Contractor’s confidential information, subject to the establishment of applicable confidentiality agreement(s) reasonably required by the Contractor as contemplated in Contract Section A.13.a., and on that same confidential basis shall also be made available to appropriate State and Federal agencies. At a minimum the assessment shall contain the following: identification of loss risk events/vulnerabilities; analysis of the probability of loss risk and frequency of events; estimation of the impact of said events; identification and discussion of options for mitigating identified risks; cost-benefit analysis of options; recommended options and action plan for their implementation. The assessment shall be conducted in accordance with the following: requirements for administrative, physical, and technical safeguards to protect health data (45 CFR §§164.304 – 318); rules for conducting risk analysis and risk management activities (45 CFR §164.308); requirements for security awareness training (45 CFR §164.308(a)(5)); requirements for entities to have security incident identification, response, mitigation and documentation procedures (45 CFR§164.308(a)(6)). |
| The State does not agree. |
| 74 |
| A.11.h.2 Information Systems |
| Will the State agree to remove this section since internal system information is considered company confidential? |
| The State does not agree. |
| 75 |
| A.11.h.3 Information Systems |
| Will the State agree our ISO 27001 certification and SOC 2 Type II report qualifies as evidence of meeting controls requirements? |
| See response to question #64. |
| 76 |
| A.11.h.6 Information Systems |
| [Redacted] receives and reviews the SOC 2 Type 2 reports for our data center vendors which include physical security controls. [REDACTED] is willing to attest to the annual review of these SOC 2 Type 2 reports and provide copies. Will the State accept this as sufficient rather than physical access to our data facilities? |
| The State has removed the requirement for the Contractor to provide access to data facilities. See amendment item #7. |
| 77 |
| A.11.h.10 Information Systems |
| As [REDACTED] is not providing medical services and does not fall under HIPAA requirements, we suggest striking this item from the final contract. |
The State has removed Section A.11.i(11). See amendment item #7.
| 78 |
| A.12 (a) |
| With respect to A.12(a)(pages 60-61) is the State agreeable to the following edit: The Contractor shall establish and maintain an electronic data interface with Edison by the date specified in Contract Section A.17 for the purpose of retrieving and processing employee eligibility and premium collected information, which information the State shall also make accessible through application programming interfaces (APIs) in a machine-readable format (JSON). The Contractor shall be responsible for providing and installing the hardware and software necessary. When the Contractor requires the exchange of PII with the State, the State requires the use of second level authentication. Second level authentication is accomplished using the State’s standard software product, which supports PKI. The Contractor shall design a solution and submit to the State In Writing by the date specified in Contract Section A.17 how their design meets the requirements of this Contract using industry standard software that can transmit files in a secure fashion. The initial implementation phase of this solution and the final production solution will differ in the method of authentication. The requirement for this solution is that all files that are transmitted will be encrypted to FIPS 140-2 standards, and the method of transmission will also be encrypted. Decryption of the files that are downloaded from this solution will not be decrypted until they are securely stored within the Contractor’s environment. Additionally, federal standards require encryption of all electronic protected health data at rest as well as during transmission. The State uses public key encryption with Advanced Encryption Standard to encrypt PII. The State follows FIPS 140-2. If the State plans to adopt a different or additional encryption standard or tool in the future, the State will notify the Contractor and the Contractor shall comply. The Contractor shall establish and maintain the security of all confidential State Data according to all applicable state and federal standards within thirty (30) days of the State’s use of the new or additional encryption standard or tool. |
| The State does not agree. |
| 79 |
| A.12 (e)(1) |
| With respect to A.12(e)(1)(page 61) is the State agreeable to the following edit: Weekly Eligibility Update: To ensure that the State’s eligibility records remain accurate and complete, the Contractor shall, unless otherwise directed by the State, retrieve, via secure medium, the weekly eligibility file, in a mutually agreed upon format, from the State. Files will include full population records for all employees. |
| The State agrees. See amendment item #8. |
| 80 |
| A.12 (e)(2) |
| With respect to A. 12(e)(2)(page 61) is the State agreeable to the following edit: Weekly Termination of Eligibility Update: To ensure that the State’s eligibility and voluntary term life insurance enrollment records remain accurate and complete, the Contractor shall, unless otherwise directed by the State, retrieve, via secure medium, the weekly termination file, in a mutually agreed upon format, from the State. Files will include records for recently retired or terminated employees. |
| The State agrees. See amendment item #9. |
| 81 |
| A.12.e.3 Data Integration and Technical Requirements |
| Will the State agree to the following revisions: “Ninety eight percent (98%) of electronically retrieved, complete and accurate enrollment files processed and internal errors to be resolved by the Contractor within 3 business days of the expected file delivery date agreed upon during the file feed implementation.” |
The State does not agree to this edit.
| 82 |
| A.13.a Audit Authority |
| Will the State agree to contractual language that any audit rights are subject to applicable privacy laws and regulations? |
| Please provide the specific proposed contract language, including exact revisions to the applicable Contract Section, in Round 2 of questions. |
| 83 |
| A.13(a) |
| With respect to A.13(a) Audit Authority (page 63), is the State agreeable to the following edit: Upon sixty (60) (30) days written notice and the establishment of applicable third-party confidentiality agreement(s), if any, reasonably required by the Contractor, the State and/or its representative shall have the right to examine and audit Contractor services and pricing to ensure compliance with all applicable requirements.In the event of a cybersecurity incident affecting State Data, the Contractor’s obligations shall be as set forth in Contract Section D.36.a.(6) in lieu of an audit conducted by the State and/or its representative in connection with such incident. For the purpose of this requirement, the term, "Contractor," shall include its parent organization, affiliates, and subcontractor subsidiaries, who provide services under this Contract. With respect to subcontractors, the Contractor shall use reasonable business efforts to facilitate negotiations to permit assessments of such subcontractors.These requirements are separate and distinct from the audit requirements set forth in D.11 and E.4. |
| The State does not agree to this edit. |
| 84 |
| A.13(b) |
| With respect to A.13(b)(page 63), is the State agreeable to the following edit: The State has sole authority to shall determine who to choose for any kind of audit related to the services contained in this Contract, provided that any auditor who is not a State employee shall be mutually agreeable to the State and the Contractor and shall not be a competitor of the Contractor. This includes, but does not limit the selection to, state employees, state employees from the Comptroller’s audit staff, and BA’s consulting fir |
| The State does not agree to this edit. |
| 85 |
| A.13.b Audit Authority |
| If the State is using an authorized representative, will it be agreed that the parties will mutually agree upon such a reviewer? |
| The State does not agree to this edit. |
| 86 |
| A.13(c) |
| With respect to A.13(c)(page 63), is the State agreeable to the following edit: If the State contracts with a private entity (non-state employees) to conduct an audit of the Contractor, the State will require the auditing entity to negotiate and execute a reasonable written confidentiality agreement with the Contractor governing the scope of confidentiality of the audit. Except as expressly set forth in subsections a. and f. of this section, the Contractor shall not attempt to limit the State’s audit rights in any way or timeframe; the State in its sole authority and with upon execution of any confidentiality document such agreement shall be allowed to audit the Contractor on any contracted service, claims processing, customer service, or any other provision of this Contract by whomever the State any auditor selected in its sole authority deems appropriate accordance with subsection b. above. |
| The State does not agree to this edit. |
| 87 |
| A.13(d) |
| With respect to A.13(d)(page 64), is the State agreeable to the following edit: In no instance shall the Contractor advise the State that one set of auditors is appropriate while another set is not. In addition, theThe State may audit or re-audit any time period in accordance with the timeframe for audits listed in Contract Section D.11. Previous audits of a set of claims, providers, time periods, or any other sort of audit does not negate the State’s right to re-audit the same information again later. ThereExcept as set forth in Contract Section A.13.a., there shall be no audit blackout periods at any point during a year and any charges or fees in any form for any audits that the State chooses to exercise. |
| The State does not agree to this edit. |
| 88 |
| A.13(e) |
| With respect to A.13(e)(page 64), is the State agreeable to the following edit: The Subject to Contract Section A.13.a., the Contractor shall provide access, at any time during the term of this contract and for five (5) years after final contract payment (longer if required by law), to the State and/or its representative to examine and audit Contractor services, payments, and pricing pursuant to this Contract. The State reserves the right to request that documentation be provided for review either virtually, at the authorized representative’s location, the State’s location, or at the Contractor’s corporate site. |
| The State does not agree. |
| 89 |
| A.13(f) |
| With respect to A.13(f)(page 64), is the State agreeable to the following edit: The Contractor shall, at its own cost, provide the State and/or its representative with prompt and complete access to any data, data extracts, documents, access to systems, and other information necessary to ensure Contractor compliance with all requirements of this Contract, provided that the Contractor may withhold or redact information to the extent such access could compromise the security of the Contractor’s information systems or the confidentiality of other clients’ or third parties’ information, and such access shall not be unreasonably withheld. |
| The State does not agree to this edit. |
| 90 |
| A.13(h) |
| With respect to A.13(h)(page 64), is the State agreeable to the following edit: Upon request by the State In Writing, the Contractor shall fund the following audits, which shall be conducted by a qualified organization or representative mutually agreed upon chosen by Contractor and the State in accordance with Contract Section A.13.b., and the scope of the audit defined by the State: |
(1) A pre-implementation audit to review, at a minimum, whether the Contractor’s adjudication system is configured according to the State’s benefit design; and
(2) Any follow-up audits if significant deficiencies, as determined by the State, are noted.
The State does not agree to this edit.
| 91 |
| A.13.j Audit Authority |
| As the proposed billing model is unlikely to result in overpayment to the Contractor, will the State agree that premium shall not be withheld and that any disparity in payment will be rectified by other means? |
| The State does not agree. |
| 92 |
| A.13(k) |
| With respect to A.13(k)(page 65), is the State agreeable to the following edit: The Contractor shall maintain an internal quality assurance plan. The Contractor shall provide by the date specified in Contract Section A.17. indicating areas addressed, established criteria and standards, and methods employed to evaluate results. The plan should address, at a minimum, the Contractor’s methodology for conducting internal Claims and operational audits, including audits to determine Claims payment and processing accuracy and Claims payment turnaround. The Contractor shall notify the State In Writing at least thirty (30) calendar days in advance of any significant changes to its internal quality assurance plan. The State reserves the authority to review changes, if any, and engage in good faith discussions regarding require additional changes, where appropriate. |
| The State does not agree to this edit. |
| 93 |
| A.13.k Audit Authority |
| Will the State agree to contractual language providing that Contractor is not required to share data from insurance compliance audits that would jeopardize its privilege under applicable laws? |
This is the start of the file's text. The full file is on GovTribe.