SOW MRR 082724_DRAFT.docx

Attachment 4

DESCRIPTION/SPECIFICATIONS/PERFORMANCE WORK STATEMENT

C. 1 Background

The mission of the U. S. Securities and Exchange Commission (SEC) is to protect investors, maintain fair, orderly, and efficient markets, and facilitate capital formation. The SEC’s Office of Human Resources (OHR) currently provides services to approximately 4,350 SEC employees nationwide. A list of SEC locations is available on the SEC’s public website: www.sec.gov.

The SEC provides and shall continue to provide health care benefits to eligible employees, spouses, and eligible dependents through the Office of Personnel Management’s (OPM) Federal Employee Health Benefits (FEHB) program. Information about this program is available at www.opm.gov.

The SEC provides and shall continue to provide a Supplemental Benefits Program (SBP) to all employees eligible for Federal Employee Health Benefits (FEHB). The SBP includes employer paid dental and vision insurance for all eligible SEC employees and their eligible dependents. The SBP also enables SEC employees to select and pay for benefits from a package of voluntary benefit plans. A contractor manages the SBP using an exclusive employee enrollment website, an approved package of insurance plans and information systems to manage and transmit employee eligibility and payroll deduction information for the effective administration of the SBP. The contractor is responsible for processing all insurance claim actions and securely managing all data related to the SBP.

The SBP enables SEC employees to select benefits using an enrollment website and automated processes support the collection of any premiums owed by employees through payroll deduction. The SBP transmits and receives information files from the SEC through SEC’s payroll provider, Department of the Interior (DOI), in secure data file feeds to provide employee enrollment census data and payroll deductions for benefits chosen by employees. The file format of the data transmitted/received between SBP and DOI must retain the current file structure and format of the existing processes.

The contractor operates a customer service call center and maintains an on-site representative for assistance with employee questions and claims processing.

Any contractor’s system containing employee personally identifiable information (PII) is subject to Security Assessment and Authorization (SA&A) testing for security purposes, and user acceptance testing (UAT) for functionality purposes.

C. 2 Scope

The U.S. Securities and Exchange Commission’s (SEC) Office of Human Resources (OHR) oversees provision of benefits to SEC employees. The Contractor shall provide SEC employees with a Supplemental Benefits Program (SBP) consistent with the requirements of Title 26 of the Internal Revenue Code, Subtitle A, Chapter 1, Subchapter B, Part III, Section 125.

The SBP shall at a minimum be comprised of the following items:

C.2.1 Dental Plan

The Contractor shall provide a comprehensive core dental plan to eligible SEC employees and their eligible dependents (spouse, domestic partner, dependent children) at no cost to the employee (the SEC pays the basic overall premiums), and a Dental Buy Up plan for employees interested in paying an incremental difference in premiums for an enhanced plan.

The Contractor shall provide dental care from A rated insurance companies or better. The Contractor shall meet or exceed the current core and buy up dental plans detailed in the attached certificates. Plan minimum coverage requirements shall be adjusted for inflation since the inception of the prior contract and shall be adjusted for inflation over the course of the upcoming period of performance to ensure employee benefits coverage remains consistent with existing standards and rising costs. The Contractor’s pricing shall include options for annual increases.

C.2.2 Vision Plan

The Contractor shall provide a comprehensive core vision plan to eligible SEC employees and their eligible dependents (spouse, domestic partner, dependent children) at no cost to the employee (the SEC pays the basic overall premiums), and a Vision Buy-Up plan for employees interested in paying premiums for an enhanced plan.

The Contractor shall provide vision care from A rated insurance companies or better. The Contractor shall meet or exceed the current core and buy up vision plans detailed in the attached certificates. Plan minimum coverage requirements shall be adjusted for inflation since the inception of the prior contract and shall be adjusted for inflation over the course of the upcoming period of performance to ensure employee benefits coverage remains consistent with existing standards and rising costs. The Contractor’s pricing shall include options for annual increases.

C.2.3 Medical Evacuation Insurance for International Trips

The Contractor shall provide Medical Evacuation Insurance to all SEC employees who travel overseas on official SEC and/or approved business by the SEC.

C.2.4 Voluntary Benefits Package

The Contractor shall provide a package of voluntary benefits from A rated companies or better at discounted group rates that includes at a minimum, short-term disability (STD) and long-term disability (LTD) insurances, optional term life insurance, a group legal plan, auto, home, critical illness, accident and hospital indemnity insurances for eligible SEC employees. The voluntary benefits program shall provide the variety and quality of benefits that promotes the maximum level of employee participation. The Contractor shall provide voluntary benefits that meet or exceed the current benefits detailed in the attached certificates. These voluntary benefits will be paid for entirely by the SEC employee.

C.3 Eligible Program Participants

C.3.1 Employee Eligibility. All full-time and part-time SEC employees who are eligible for Federal Health Benefits (FEHB) are eligible for SBP, including FEHB eligible Schedule C Appointments, Re-Employed Annuitants, Presidential Appointees and Management Fellows.

a. The SEC defines full-time employees as employees whose scheduled work hours are 40 hours or more per week, or 80 hours biweekly, per pay period.

b. The SEC defines part-time employees as employees whose scheduled work hours are 16-32 hours per week, or 32-64 hours biweekly, per pay period.

c. For STD and LTD insurance eligibility, “part-time employees” are employees whose scheduled work hours are 40-64 bi-weekly, hours per pay period.

C.3.2 Dependent Eligibility. The following dependents of eligible employees are eligible to participate in the SEC’s SBP:

a. The legal spouse(including common- law spouse);

b. The domestic partner (as defined by the agency’s Domestic Partner program), with a signed Declaration of Domestic Partnership on file with the Office of Human Resources.

c. The dependent children, (including legally adopted children, children under legal guardianship, foster children and stepchildren) and dependent children of a domestic partner to age 26.

· For Dental and Vision; Adult children are eligible to participate in SBP until the end of the calendar year in which they turn 26 years old, when the employee remains eligible and is employed by the SEC.

· For Life Insurance; Coverage eligibility begins at 15 days old and ends when the child reaches age 26 (or to the end of age 25).

· Child regardless of age who is mentally or physically handicapped, who is unable to earn a living and is dependent for financial support, provided the disabling condition began before age 26, would be eligible for coverage beyond age 26.

C.4 Business Requirements

C.4.1 Compliance

Section 508 Accessibility. The Contractor’s products and services shall comply with the Information and Communication Technology Accessibility Provisions set forth by the Architectural and Transportation Barriers Compliance Board (also referred to as the “Access Board”) in FAR 39.203(a). The complete text of Section 508 Final Provisions can be accessed at Section 508 Law.

HIPAA. The Contractor’s products and services shall comply with the Department of Health and Human Services (HHS) Health Insurance Portability and Accountability Act (HIPAA) requirements. The Contractor shall provide SEC employees with HIPAA notices of privacy practices.

Affordable Care Act. The Contractor’s products and services shall comply with the Affordable Care Act, to include dependent eligibility to age 26.

C.4.2 Security

The Contractor’s work, site, personnel, and service shall adhere to Federal requirements and SEC regulations. The Contractor shall provide SEC with the access and information necessary to assess the ability of the subscribed service as operated by the Contractor under this contract to meet these requirements.

The Contractor shall provide for real-time intrusion detection and active security monitoring of the service’s Internet site. The security mechanisms built into the service shall meet or exceed current best practices for electronic commerce.

The Contractor’s service shall protect all communications between remote SEC users and the Contractor’s systems that are conducted over the Internet or other public networks. The service shall initiate and control a secured session with a remote user’s system and shall maintain a secure interface until the session ends.

The Contractor shall establish and maintain individual user accounts to provide access to service.

The Contractor shall maintain security logs and access audits for the service’s Internet site and shall make them available to the SEC. The Contractor shall provide the SEC with access and information necessary to conduct periodic security audits on service to ensure proper safeguards are being maintained and potential security threats are minimized.

The Contractor shall ensure its employees and all subcontractors fill out required SEC forms accurately, timely and completely. The Contractor’s employees and subcontractors with access to SEC data, must pass and have a favorable security clearance determination in order to work on the contract with the SEC. The Contractor shall provide weekly reports of cleared personnel. The Contractor must notify the Contacting Officer (CO) if a sub-contractor is hired and provide a reason for the use of a sub-contractor. The CO must approve the use of a sub-contractor under the contract.

C.5 SBP Management and Administration

The Contractor shall provide the COR with a Management and Quality Assurance Plan that, at a minimum, includes how the Contractor plans to successfully accomplish: marketing and communications, program implementation, reporting and administration, and quality assurance. The plan shall meet the COR’s expectations and shall be incorporated into the contract.

The Contractor shall provide all education, planning, estimating, programming, project management, supervision, and inspection of work. The Contractor shall provide the SEC a single point of contact for every aspect of the SBP.

The Contractor shall provide a web-enabled (i.e., entries are made on a web browser and computations are reported through a web browser) application that provides employees with direct online access to their personal SBP accounts to view personal benefits information, complete automated forms, and submit benefit transactions electronically. The Contractor’s web application shall use an extranet delivery system that eliminates the need for the SEC to create, staff, and maintain its own information technology (IT) infrastructure. All operations pertaining to the web application shall be performed “server side” without the use of “cookies,” downloads of code, or client-side software.

The Contractor shall provide a toll free customer service line that will be available 8 a.m. to 7 p.m. eastern time where SEC employees and their eligible dependents nationwide can obtain answers and have their problems/issues resolved. Operating hours of the customer service line may be adjusted based on demonstrated lack of volume and at the SEC’s discretion.

The Contractor shall develop and implement customer satisfaction and claims service performance metrics, with SEC’s approval, and report on these metrics as requested.

At the SEC’s discretion, the Contractor may provide an on-site SBP customer service representative who is knowledgeable on all of the content in the insurances and who will serve on a part-time or full-time basis to provide expert assistance to eligible employees at the SEC’s Washington, DC location.

The Contractor shall educate SEC employees about available benefits and opportunities to enroll, and inform them of benefit changes. At the request of the SEC, the Contractor may be asked to travel to regional offices as well as Headquarters to educate employees about the SBP program. The Contractor shall design, produce and distribute, subject to SEC approval, summary plan descriptions, enrollment guides, brochures and other marketing materials.

The Contractor shall host visual pictures, videoconferences, webinars, tutorials that can be used to market the benefits under the program. All materials are subject to SEC approval before use.

The Contractor shall adjudicate, verify coverage and process claims within established timelines.

All eligible SEC employees shall be automatically enrolled in the core dental and vision plans on plan inception. Eligible employees shall have at least 60 days thereafter to enroll their eligible dependents in the plans. During this period, eligible employees shall have the opportunity to decline coverage.

The minimal initial period of enrollment for any employee or dependent in the dental and vision plans shall be one year, except for separation from the SEC including resignation, retirement, dismissal, or death. Enrollment for less than one year shall be accepted by the Contractor under the following circumstances: newly hired employees, change in marital status including domestic partnerships, birth, adoption, assumption of guardianship of a child, death of a dependent or change in employment of spouse. These employees shall be given the opportunity to participate in the SHBP program within 60 calendar days of the Qualifying Life Event (QLE).

Initial enrollment in voluntary insurance programs shall be controlled by the Contractor. Non-insurance voluntary benefits shall be available to all employees at all times unless there is an additional liability associated with utilization.

The SBP program shall include an annual open enrollment period during which current employees may enroll in the program, select from the various SBP insurance options, or change services. The open enrollment period shall match and parallel the open enrollment period established by the OPM FEHB program. Any new program changes to SBP benefits shall be made available to SEC employees on January 1 of each year.

The Contractor shall administer COBRA coverage for all SBP-related benefits for departing SEC employees. At a minimum, the Contractor shall provide COBRA initial rights notification, coverage election, change, and termination processing, coverage period tracking, including multiple qualifying events, coverage continuation and conversion notices, and billing and payment processing.

C.6 Claim Handling

The SEC does not control or monitor the claims processing for voluntary benefits under the SBP. The Contractor shall establish procedures for handling insurance claims as follows:

The Contractor shall maintain dental and vision insurance files for each eligible employee that include, at a minimum, receipts and proof of paid claims, requests for claim reimbursements, and an accounting of paid benefits.

The Contractor shall seek to ensure timely claim payments and resolutions for SEC employees. In circumstances where Coordination of Benefits on dental claims with the Contractor and FEHB is at an impasse, the Contractor shall take primary responsibility for paying the claim.

The Contractor shall provide the insured SEC employees with instructions and the necessary claim forms for each type of benefit that can be claimed under the contract.

The Contractor shall provide SEC employees with the ability to submit all claims directly to the Contractor. The Contractor shall settle all properly submitted claims within 10 business days after receiving the claim.

The Contractor shall provide the individual claimant with a report that includes details of the claim, the date received, the amount claimed, and the amount approved for reimbursement.

The Contractor shall ensure that no employee is paid short or long- term disability benefits for the same hours as the employee receives pay from the SEC. The Contractor shall establish a procedure, with SEC’s approval, to confirm dates of benefit payments do not overlap with the employee’s SEC hours worked or paid leave.

C.7 Reporting

The Contractor shall provide SEC with the following regular reports:

Bi-weekly report of SEC employees under active disability claims. ISR and SSR Reporting.

Semi-annual User Access Reports Quarterly and Annual utilization and financial Summaries. Monthly Call Center Activity.

Bi-Weekly Personnel Security Clearance List.

Customer Satisfaction and Claims Service Performance Metrics. Ad Hoc reports as needed for program administration and support.

Security logs upon request

C.8 System Requirements.

The Contractor shall have a systems security Authorization to Operate (ATO) as a Federal Government Contractor. The Contractor shall be FedRamp Certified if hosting its application on the Cloud.

The Contractor’s web-enabled service shall accommodate concurrent access without degrading the quality or accessibility of the service. The service shall have sufficient capacity to meet all functional and performance requirements specified in this performance work statement. The service shall provide SEC personnel with an intuitive click and key-stroke user interface using standard Internet browsers. The service shall support the current version level of the browsers. The system shall provide immediate online acceptance or rejection of user responses.

The Contractor shall work with SEC’s IT representatives to establish data formats, processes, and procedures that will ensure the efficiency of system set-up and data integrity and will support ongoing system administration. The files for data transmission between SBP and DOI must retain the current file structure and format of the existing processes.

The Contractor shall incorporate initial personnel information from the SEC into its system(s) before the SBP goes live for SEC employees. The Contractor shall receive and incorporate an encrypted feed of updated personnel information provided by the SEC on a bi-weekly basis into its files within 5 days after receiving the updated file. The Contractor shall maintain the currency, accuracy, and consistency of the data in its system so that claims are not wrongfully denied. The Contractor shall maintain current benefit transaction information for all participating SEC employees and their dependents.

The Contractor’s system shall (1) process open and non-open season transactions from employee input;

2) produce a summary view of pending transactions for employees; 3) cancel a transaction based on employee input; and (4) provide confirmation of completed/successful transactions. The service shall allow for an electronic confirmation and approval.

The Contractor shall periodically archive all SEC data associated with the service components including

(1) all benefit transactions; (2) a history of all benefit transactions and cancellations; and (3) all data necessary to audit and reconstruct benefit actions. The Contractor shall store the detail in a database with the ability to export using CSV files provided on Encrypted Removable Media or via a secure transmission method.

The Contractor shall provide an integrated backup strategy for its system that includes daily, weekly, monthly, and yearly full system backups. The Contractor shall retain daily and weekly system backup media for 4 weeks; monthly system backup media for 12 months; and yearly system backup media for 3 years. The Contractor shall store system backup media off-site in an environmentally controlled, secure location approximately 30 miles from the Contractor’s production site.

The Contractor shall provide recovery processes and procedures including: (1) database recovery and file recovery from backup locations; and (2) annual testing of recovery procedures and backup accuracy.

The Contractor shall provide procedures for disposing of sensitive data to be approved by the SEC.

Unless the SEC specifically directs the Contractor otherwise, at the conclusion of the SEC’s relationship with the Contractor, regardless of the cause or timing, the Contractor shall archive and return all SEC data within the service using CSV files provided on Encrypted Removable Media or via a secure transmission method and in a readable format. The Contractor shall then dispose of (and certify to the SEC that it has disposed of) all SEC data within the service as specified in the Contractor’s data disposal procedures.

The Contractor shall provide technical support in fulfilling SEC requirements for (1) testing the Supplemental Benefits (SBP) system, including any subsystem, prior to putting it into production; and (2) deploying the successfully tested system while in production.

The Contractor shall support, at a minimum, (1) application information security C&A testing; (2) QCTC compliance testing for usability and section 508 accessibility; and (3) UAT for functionality.

PII consists of information that characterizes and can be traced to a specific individual. The Contractor shall notify the SEC of all entities (that is, systems, companies, individuals) that will retain PII on SEC employees under this contract as such entities are all subject to the federally mandated SA&A testing for moderate-rated impact systems.

Each contracted personnel (CP) who has access to PII covered under this contract must complete the applicable onboarding and offboarding procedures prescribed by the SEC. A favorable suitability determination must be provided by the Personnel Security Office (PERSEC) office prior to CP commencing work or gaining access.

The Contractor shall provide a project plan and schedule to (1) support certification and accreditation (C&A) testing, billing and contractor application configuration, contractor application demonstrations, billing and contractor quality assurance testing, QCTC testing, UAT testing, and billing and contractor end-to-end testing, and fix problems that arise; (2) remediate identified security issues; (3) provide the information necessary to support all testing and deployment requirements; and (4) deploy the successfully tested system into production.

C.9 Schedule of Deliverables The Contractor shall provide the following deliverables to the COR, unless otherwise specified, in a format compatible with Microsoft Office Suite products. The Contractor shall return revised documents to the COR within 3 business days of receiving feedback on the draft document from the COR. If the Contractor has not received feedback from the COR on a document within 14 days after the contractor submits the document, the Contractor may consider the document approved.

C.8 Recovery processes and procedures, final

COR

Within 3 business days after receiving feedback from the COR

Report of recovery procedure and backup accuracy testing

COR

As requested, within two business days of testing

Procedures for disposing of sensitive data, final (incorporated into the contract)

COR

Within 3 business days after receiving feedback from the COR