Recovery Audit Contractor Services

The Texas Health and Human Services Commission (HHSC), Office of Inspector General is requesting qualifications for Recovery Audit Contractor Services under RFQ HHS0017023, with responses due September 9, 2026, and a pre-proposal conference on August 13, 2026. The contractor will identify and recover Medicaid improper payments across Texas Medicaid fee-for-service and Managed Care Organization programs under the state Medicaid plan and federal regulations. A VetHUB Subcontracting Plan is required for all respondents, with a VetHUB utilization goal of 23.7%.

Minimum qualifications include at least two years of recent business experience in public healthcare program integrity services, financial solvency documentation, and a Medical Director or Physician Panel holding active Texas medical licenses plus a Certified Coder with current credentials from an accredited coding organization. Respondents must possess TX-RAMP Certification Level 2 or equivalent FedRAMP certification. Key personnel must include a Review Manager and other specialized Medicaid-experienced staff. The contractor must maintain comprehensive qualifications per detailed Scope of Work requirements (Exhibit F).

HHSC anticipates awarding one or more contracts for an initial three-year term with options to extend for up to two additional years, plus potential continuity extensions of up to twelve months at HHSC's discretion. Historical compensation for similar transactions is approximately $10 million per state fiscal year, though HHSC makes no guarantee of volume, usage, or total compensation. The contractor is compensated solely through contingency fees based on improper payments actually recovered, with rates not to exceed the federally allowed maximum of 12.5%. Contract is contingent upon appropriations and fund availability.

Evaluation criteria weight qualifications at 30%, experience at 30%, project work plan at 20%, and technical proposal at 20%, using a 10-point scale. Demonstrations may distinguish between respondents, with scoring per Exhibit M. The notice of award is tentatively anticipated for March 2027, with a contract effective date of April 2027. Questions are due August 17, 2026. The contractor must deliver a fully functional online portal within 60 calendar days of execution and comply with all data security, privacy, HIPAA, SOC 2 certification, and SIEM requirements. Liquidated damages range from $500 to $35,000 for non-compliance, and the contractor must maintain a 95 percent success rate on second-level appeals.