t \II. Attach - Department of Vermont Health Access

$: t \II. Attach - Department of Vermont Health Access$
Surn or VrnvroNt, CoNtRlcr FoR PnnsoNu, SnnvrcnsDrp.q.ntNInNT oF VBnuoNr Hrar,rn AccnssEQHnllrn Sor,uuoNs, Itttc.

CONTRACT AMENDMENT

It is hereby agreed by and between the State of Vermont, Department of Vermont Health Access

(the "State") and EQ Health Solutions, lnc., with a principal place of business in Baton Rouge,

Louisiana (the "Contractor") that the contract between them originally dated as of May 29,2015,

Contract # 28739, as amended to date, (the "Contract") is hereby amended effective July 1, 2018,

as follows:

L Maximum Amount. The maximum amount payable under the Contract, wherever such

from $24,113,480.00 toreference appears in the Contract, shall be changed

923,320,217.00; representing a decrease in the amount of $793,263.00. t

11. Attachment A. Specifications of Work to be Performed. The scope of services in the

Contract is hereby deleted in its entirety and replaced as set forth in the Attachment Abeginning on page 3 of this Amendment. The appendices of Attachment A are amended

as follows:

Appendix I. Functional Requirements, of Attachment A is hereby deleted in its entirety

and replaced as set forth in Appendix I beginning on page 117 of this Amendment.

Appendix II. Non-Functional Requirements, of Attachment A is hereby deleted in its

entirety and replaced as set forth in Appendix II beginning on page 178 of this

Amendment.

Appendix III. Non-Enumerated Requirements, is hereby added to Attachment Abeginning on page 225 of this Amendment.

11I. Attachment B. Payment Provisions. The payment provisions are hereby deleted in their

entirety and replaced by the Attachment B beginning on page240 of this Amendment.

IV. Attachment C. State Provisions for Con and Grants. Attachment C ishereby deleted in its entirety and replaced by the Attachment C effective December 15,20llbeginning on page 253 of this Amendment.

V. Attachment F. Agencv of Human Services' Customarv Contract Provisions.Attachment F is hereby deleted in its entirety and replaced by the Attachment F effective

May 16,2018 beginning on page260 of this Amendment.

\II. Attach . Attachment I is hereby added to the

Contract beginning on page 267 of tlns Amendment.

VII. Taxes Due to the State. Contractor further certifies under the pains and penalties ofperjury that, as of the date this contract amendment is signed, the Contractor is in good

P,lcn 1 or 268CoNrru,cr #28739

AurNnvrnNT # 2

standing with respect to, or in full compliance with a plan to pay, all taxes due the State

of Vermont.

Sr.q.rn or Ven*ronr, CoNTRAcT FoR PnRsolvc, SnnvrcnsDpplnrunnt or Vpnuoxr Hn^lr,rn AccpssEQHn,n rn Sor,urroNs, INc.

Vlll.Certification Reeardinq Suspension or Debarment. Contractor certifies under thepains and penalties of perjury that, as of the date this contract amendment is signed,neither thJ Contractor nor the Contractor's principals (officers, directors, owners, orpartners) are presently debarred, suspended, proposed for debarment, declared ineligibleor excluded from participation in federal programs, or programs supported in whole or inpart by federal funds.

The Contractor further certifies under pains and penalties of perjury that, as of the datethat this contract amendment is signed, the Contractor is not presently debarred,suspended, nor named on the State's debarment list at:

http l//bgs. vennorrt. sov/purchasi n g-contraqting/_debannent

This document consists of 268 pagos. Except as modified by this Amendment No. 2, allprovisions of the Contract remain in full force and effect.

Plcn 2o1268Conrru,ct #28739

Aupnonnnnr # 2

STATE OF VERMONT

Dnpl,nrunNT oF VnnuoNr Hn.lr,rn Accnss

CORYGUSTAFSoN,CoMMISSIoNER DATE

NOB I South, 280 State DriveWaterbury, VT 05671 -1010Phone: 802-247-0239Email: Cory.Custafson(4).vermorrt.gov

CONTRACTOR

EQ Health Solutions, Inc.

GTnq GoTEMI, PRESIDENT AND CEO DeTE

8440 Jefferson Highway, Suite 101

Baton Rouge, LA 70809225-248-7003

[email protected]

;;?8?E$?1r9",? 3,,9'tt3"-i, Juty 27,2o1B """t?',,n;_"#l/u!i%3i!"8i,,

Juty 26,2018

Sr^q.rn oF VERMoNI, CoNtru,cr FoR PnnsoNnr, SnnvrcnsDrpmrivrnNT oF VERMoNT Hrll,rn AccnssEQHn,Llrn Sor,urroxso INc.

ATTACHMENT ASPECIFICATIONS OF WORK TO BE PERFORMED

A. ACRONYM CATION3DES : Triple-Data Encryption Standard

A2A: Application to ApplicationACO : Accountable Care OrganizationAHS : Agency of Human ServicesAI: Action ItemANSI: American National Standards Issue

API : Application Programming Interface

APM : Application Performance MonitoringATNA: Audit Trails and Node AuthenticationB2B: Business to BusinessBI : Business IntelligenceBPEL: Business Process Execution LanguageBPMN: Business Process Modeling NotationCIA : Confi dentiality, Integrity, AvailabilityCIF- Clinical Integration Framework

CMS : Centers for Medicare and Medicaid Services

COTS : Commercial Off-The-ShelfCPU: Central Processing UnitCR: Change RequestDAD : Deliverables Acceptance DocumentDBA : Database AdministrationDBMS : Database Management SystemDED : Deliverables Expectation DocumentDi|dZ : Demilitari zed ZoneDOC: Department of CorrectionsDOD: Department of DefenseDVHA: Department of Vermont Health Access

EDI: Electronic Data InterchangeEDIFACT: Electronic Data Interchange for Administration, Commerce,

and TransportationEMPI: Enterprise Master Patient IndexESB : Enterprise Service BusETL : Extract-Transform-LoadFR : Functional RequirementGUI- Graphical User InterfaceHHS - Health and Human ServicesHIE: Health Information ExchangeHSE: Health and Human Services EnterpriseHTML: Hypertext Markup LangaageHTTP : Hl,pertext Transfer ProtocolIAM: Identity and Access Management

Plcu 3 or 268CoNrnlcr # 28739

AvrnNounNr # 2

Srarn or VnnmoNro Coxrnncr FoR Pnnsonal SnnvrcnsDnp.lnrvrnNT oF VnnuoNr Hnlr,rn AccnssEQHnar,rn Sor,urrons, INc.

IIOP : Internet Inter-ORB ProtocolIIS : Internet Information SystemsIPSec: Internet Protocol SecurityIT : Information TechnologyITIL : Information Technology Infrastructure LibraryITILv3 : Information Technology Infrastructure Library, Version 3

J2EE: Java2 Platform, Enterprise EditionJAD: Joint Application DesignJDBC : Java Database ConnectivityKPI: Key Performance IndicatorsLAN: Local Area NetworkLDAP : Lightweight Directory Access ProtocolLUN: Logical Unit NumbersMCI: Master Client IndexMITA : Medicaid Information Technology ArchitectureMMIS : Medicaid Management Information SystemM&O: Maintenance and OperationsMOM : Message-Oriented MiddlewareMOSS : MS Office SharePoint ServerMPI: Master Provider IndexNE: Non-EnumeratedNTP : Network Time ProtocolOCM : Organizational Change ManagementODBC: Open Database ConnectivityOLAP: Online Analytical ProcessOLTP : Online Transactional ProcessingPDF: Portable Document FormatPHI: Protected Health InformationPII : Personally Identifi able InformationPKI: Public Key InfrastructurePMBOK: Project Management Body of KnowledgePMI: Project Management lnstitutePMP: Project Management PlanPOC: Plan of CarePOX: Plain Old XMLRl : Release I (same as Rl Final)Rl.01 : Release 1.01 (minimal viable product)Rl Final: Release 1 Final (same as Rl)R2: Release 2R3 : Release 3RBAC: Role-Based Access ControlsRDMS : Relational Database Management SolutionsREST : Representational State TransferRIA: Rich Internet ApplicationSAN: Storage Area NetworkSDLC: Software Development Life Phase

Pr,cB 4o1268CoNrna,cr #28739

AvrnNounNT # 2

Surn on Vpnnaoxt, Contru,cr FoR PnnsoN,rl. SnnvrcrsDnpanrvrnNT oF VnnvroNr HnllrH AccrssEQHn,ll,rn SolurroNs, INc.

Plcn 5 or 268CoNrRAcr #28739

AvrnnovrnNr # 2

SLA: Service Level Agreement

SLR: Service Level RequirementS/MIME : Secure/Multipurpose Internet Mail Extensions

SME: Subject Matter ExpertSNMP : Simple Network Management ProtocolSNTP: Simple Network Time ProtocolSOA : Service Oriented ArchitectureSOAP: Simple Object Access ProtocolSSL: Secure Sockets LayerSQL: Structured Query LanguageTCP/P: Transmission Control Protocol (TCP) / Internet Protocol (IP)

TLS : Transport Layer SecurityUAT: User Acceptance Testing

UCS: Unified Computing System

UDDI: UniverSal Description, Discovery and IntegrationVCCI: Vermont Chronic Care Initiative

VHC: Vermont Health ConnectVPN: Virtual Private NetworkW3C: World Wide Web ConsortiumWAN : Wide Area NetworkWS: Web ServicesWSDL: Web Services Description LanguageWSFL: Web Services Flow LanguageWS-I : Web Services InteroperabilityXHTML: eXtensible HyperText Markup LanguageXML: eXtensible Markup LangaageXML: XML Process Definition LanguageXSLT: Extensible Style sheet Language Transformations

B. AUTHORIZED REPRESENTATIVES OF THE STATE:AII deliverables and work products described within Attachment A of this contractare subject to review and approval by the Authorized Representative of the State ordesignee(s) prior to being accepted. Payment shall not be made until a deliverable orwork product is formally accepted and approved.

Kelly GordonProject & Operations DirectorDepartment of Vermont Health Access

NOB 1 South280 State DriveWaterbury, VT 05671-1 010

Kelly. Gordon@vermont. gov802 -24 | -0146 (Waterbury)802-87 9-11 87 (Williston)

Sr,lrn or VanuoNt, CoNrn-ncr FoR PnnsoN.q.r, SnnvrcnsDnpmtnnnNT oF VnnnnoNr Hnar,rn AccnssEQHn,t lrn Sor,uuoNs, Ilvc.

Pacn 6 or 268Conrnacr #28739

AunNounNr # 2

C. AUTHORIZED REPRESENTATIVE OF THE CONTRACTOR:Mayur YermaneniEQHealth Solutions, Inc.8440 Jefferson Highway, Suite 101Baton Rouge, LA [email protected]

All work performed under this agreement shall be done under the direction and sole discretionof the Authorized Representative of the State. No work shall be performed unless directed bythe Authorized Representatives of both parties.

D. OVERVIEWCare Management technical operations arepart of the State's Medicaid Operations and areadministered by the Department of Vermont Health Access (DVHA). Through thiscontract, the State is acquiring a Care Management Solution for the Agency of HumanServices (AHS), including predictive modeling, risk stratification, and clinical/healthanalyics. Contractor shall provide such technology and services (hereinafter "Contractor'sSystem" or "Solution") in accordance with all requirements set forth in this Contract. AHSprograms provide direct care management services to Vermonters, and also oversee andmonitor services provided through contracted providers. The Contractor's System shallsupport Vermont Chronic Care Initiative (VCCI) operations, including the high-riskpregnancy population. Ultimately, additional Care Management Programs and Initiativesmay leverage this solution. The State and Contractor shall work together to develop themost efficient and cost-effective approach for the State.

E. OBJECTIVESThe project objectives are to acquire, design, and implement a Care Management Solutionto support individual and population-based approaches to health management, beginningwith the care management activities for VCCL

The Solution will support VCCI's care management needs in the following areas:

i. Utilize clinically relevant predictive risk modeling tools and gaps in care analysis ofvarious Member populations for early screening, case identification, and riskstratification of Medicaid Members including, but not limited to:

a. Members who will benefit most from some form of care managementintervention(s) (e.g., those with high utilization patterns, multiple providers,multiple conditions, polypharmacy, care gaps, possible readmissions and thosewho are at risk for complications resulting from chronic disease).

b. Members who are not currently at risk but may become at risk in the future.c. Members whose future inpatient admissions, readmissions, and Emergency

Department visits can be prevented.ii. Proactive outreach to Members'who are at risk, and to their providers, to offer

information, guidance, and support to:

Srarn or VpnuoNt, CoNtru.cr FoR Pnnsons, SnnvrcnsDnpl,nrunNT oF VnnvroNr Hnar,rn AccnssEQHnar,rn SolurroNso INc.

a. Improve health outcomes by: closing gaps in care, increasing adherence to

evidence-based care, increasing the use of preventive care, and improving self-

management and provider management of chronic illnesses.

b. Lower healthcare costs by minimizing redundancies and reducing utilizationand expenses.

iii. Develop, monitor, share, and reassess an evidence-based Plan of Care to ensure

clinically appropriate health care information and services are provided and

communicated to improve the health outcomes of Medicaid Members.

iv. Coordinate effrcient and effective delivery ofhealth care with Medicaid Members, their

providers, and community partners by removing communication barriers, bridging

gaps, and exchanging relevant and timely Member information.v. Conduct real-time care management analytics that include the ability to collect multiple

sources of data as closely from the originating source as possible (including hospital

census, claims data, pharmacy data, and clinical/bio-medical data from providers) to

identify opportunities that a Member or provider can take to improve clinical and

financial outcomes.vi. Provide robust and User-friendly reporting capabilities and Web-based tools necessary

to effectively conduct Vermont MMIS Care Management strategic planning, quality,

and performance management including clinical, utilization, and financial changes

among intervened populations.vii. Provide additional Care Management capabilities including:

a. Receive custom assessments, care plans, services from provider Agencies forState review

b. Communicate State authorization of care plans, services, and providers toprovider agencies and Members.

c. Conduct comparative analysis of provider agencies.

d. Interface with other Agency Case Management solutions for State reporting and

tracking.e. Interface with other appropriate solutions for the Agency.

Statement of WorkThe Contractor must provide a Statement of Work which details the work to be performed

consistent with the requirements for the Care Management project. The Statement of Workmust detail the work activities and tasks required to execute the project as identified by the

Project Management Strategy, Implementation Strategy, and Project Work Plan'

The Contractor will provide the following services for the Care Management Solution:

i. Collaborate and coordinate with the State to successfully implement and maintain the

care management solution.ii. Leverage PMI best practices in the areas ofprogram integration, program management,

implementation, productivity, and process improvements.

iii. Leverage Sub-Contractor's resources.

iv. Provide transparency to the State by disclosure and discussion of costs, issues, and

opportunities, including early warning and identification of the same.

v. Formulate a team to coordinate and lead care management implementation to a

successful completion:

Pacn 7 o1268CoNrnq,cr # 28739

AunNuunNT# 2

SrarB or vnnvroNt, coNtnncr FoR PrnsoN.q,L Srnvrcns pacn g or 26gDnpmrunNT or vrnvroNr Hn.rr,rn Accnss coNrnq.cr # 29739EQHrar,rn Solurrons,Inc. AunNounNr # 2

a. Determine and operate govemance structures for the Contractor's project team.b. Interface with the State's business and program governance bodies as required.c. Perform the configurations and customizations required to the Contractor's

product to meet the State's business requirements.vi. Implement the Contractor's System in a series of releases.vii. Starting with the first release date, establish a team to maintain and support the

implemented system until the scope of work termination date while maintaining servicelevels within the targets agreed by the State.

viii. Establish the work breakdown structure for the program.ix. Identify intemal and external dependencies.x. Evaluate and coordinate the (re)structuring of the Contractor's project teams on an

ongoing basis in conjunction with the State's project manager.xi. Publish weekly project status reports to the project stakeholders.xii. Provide reports to the executive management.xiii. Conduct meetings with the Contractor's steering committee on the cadence agreed to

with the State.xiv. Conduct meetings with the Department's leadership teams per the cadence agreed to

with the State.xv. Operate the Change Control Board and evaluate the financial viability of the proposed

changes.xvi. Identify and manage risks and issues for the Care Management project.

F. FUNCTIONAL R.EQUIREMENTSo All in-scope Functional Requirements (FR) and Non-Enumerated (NE) Functional

Requirements pfeviouslv outlined in this section are found in Appendix I andAppendix III. respectivelv.

G. TECHNICAL REOUIREMENTSTechnical and Non-Functional Requirements also are found in Appendix II.

1. Architecture & Policy Requirementil. Service Oriented ArchitectureThe Contractor's System will be distributed service-oriented system architecture (SOA). TheContractor's System shall be comprised of loosely coupled standard based Web services thatprovide an Application Programming Interface (API) so that the services can be invoked fromthe Rich Internet Application (RIA) User interface or a dependent service. Each service will be awell-defined encapsulated set of functionalities that does not depend on the context or state ofother services or functions.

The primary transport protocol for external facing services will be HTTPS (X.509 certificate) toensure that all traffic is encrypted and secure 256bitor better.

The Contractor's service communication or integration will be achieved through standarddescription protocols such as the Web Services Description Language (WSDL) interface format.Web services in the environment will be distributed across multiple clustered and load balancedvirtual sorvers. Production services will be centrally published via the WS-Discovery protocol to

Srnrn or VnnivroNt, CoNtn-lcr FoR PnnsoN.q'L SnnvlcrsDnp.lntvrnNT oF Vrnuoxr Hnar,rn AccnssEQHn.r.r,rn SolurroNs, INc.

a Discovery Proxy service registry to ease discovery on the network for State applications

utilizing a fixed proxy URL.

Each Contractor System service will be managed in compliance with change management

policies ensuring all changes are authorized and accurate. Web service security will be

configured for each service by endpoint policies via (WS-Policy) where requirements such as

r""*ity tokens, type of encryption, and privacy rules are established. Each service will utilize

the Brokered Authentication pattern where the service validates the credentials presented by the

State issued by a third party that both the State of Vermont and Contractor trust.

All software architecture documents and artifacts (views/viewpoints) will be modeled per

ISO/IEC/IEEE 42010 Architecture Description Template as part of the Vermont Enterprise

Architecture Program Requirements.

All SOA Services will be reviewed, classified, and cataloged prior to use. The documentation

Artifacts and Templates will be provided to the Contractor by the State of Vermont Enterprise

Architecture SOA Governance Team. Duplicate services will be rational and tiered

appropriately.

All WSDLs developed for the State will conform to the WSDL Development Standards.

The Contractor's System's SOA -related messages will be formally defined with XSD

(preferable) or DTDs. SOA artifacts will be stored in the State of Vermont's SOA Repository.

The Contractor's System's implemented services will rely on WS-Policy configuration for

message reliability (WS-Reliable Messaging).

The Contractor's System will be aligned with and leverage the HSE Platform when available and

at a date that is determined by the State and allows reasonable time for the Contractor to execute.

The Contractor's System shall be designed, built, and deployed with enterprise architecture best

practices including substantial reliance on highly configurable SOA components. The-Contractor

will be compliant with the State's SOA architecture standards as the State's needs

change.

b. HSE Platfurm AlignmentThe Contractor will provide service-oriented architecture that will allow for effective future

integration within the State's computing ecosystem.

The Contractor will leverage the Oracle "stack" and will redirect selected services to those the

State has invested in and are hosting in their infrastructure whenever and wherever possible.

The Contractor will work closely with the State to determine what products are appropriate

candidates for integration, Master Data Management (MDM), Identity Access Management

(IAM), Consent Management, and will look to utilize those that meet the intent and requirements

of the project while also providing what is necessary to support core functionality. Integration

Pacn 9 or 268

CoNrnacr #28739AvrnNovrnNT # 2

Sr,Lrn or VnnvroNt, CoNrucr FoR pnnsoivar, SnnvrcnsDnpmtvrnNT oF VnnvroNr HBlr ru AccrssEQHn^u,rtr SolurroNso lr'lc.

touch points are User authentication, clinical data exchange, member eligibility, priorauthorization, claims, and email system.

c. Technical StandardsThe Contractor's System shall be architected as a multi-tiered enterprise application composed ofseveral loosely coupled autonomous modules. The general architecture of the Contractor's Systemshall follow a service oriented (SOA) pattern and the application will be broken up into verymanageable distinct pieces of functionality, or services. The Contractor's System architecture willallow encapsulation of the State's business needs into an interchangeable component that willbeeasily plugged into the system.

The presentation layer will be developed on lll%native browser-based technology.

The Contractor's data will be warehoused in a certralized relational database system (RDMS)which will be a comprehensive, integrated management and analysis platform that will providetremendous scalability, performance, and security standardized naming conventions for ai objecttypes in the RDMS.

d. (IsabilityThe Contractor's System must be designed to provide a browser based, or a Rich IntemetApplication, that will utilize feature rich applications that will be updated over the Wide AreaNetwork (WAN) and the Internet and will deliver a consistent User experience to VermontCitizens, AHS employees, providers, contractors, and partners.

The Contractor will send and retrieve data in the background without interfering with or delayingUser interface behavior in the browser. As newer browsers are released and are more capable ofsupporting technologies such as HTML5, the Contractor will capitalize on those improvementsand incorporate them in the application.

The Contractor's System shall provide a dynamic Graphic User Interface (GUI) that allows accessto information based on a lJser's role and associated permissions. Configurable functions as wellas the current state of User interaction at any given point in time will be achieved via configurablebusiness rules or branching logic that is associated with real-time responses within the application.

The Contractor's System shall present only what is relevant to, or required of, the User toaccomplish a specific data entry or review scenario while still ensuring all pertinent data iscaptured. All fields will include appropriate User entry validation such as data type, masking, andlength.

The Contractor will use zero footprint technology, architecture, and applications that can be"styled" or "skinned" to the AHS color palette uttd iogo.

The Contractor will provide secure single sign-on options to integrate into an existing client portal.Single Sign-On Options will include:

1. SAML 2.0 Tokens and protocol2. Encrypted Post

Pacr 10 or 268CoNrnacr #28739

AnnnNnvrnNT # 2

Srarn or VnnvIoNt, Contn-lcr FoR PnnsoNar- SnnvrcssDnpantvrnNT oF VrnvroNr H'nar,rn AccpssEQHnllur Sor,uuoNs, INC.

PAGE 11 or 268

CoNrru.cr #28739AvrrNovrpnr # 2

e. IntegrationThe Contractor will integrate between disparate external trading partners via secure standards

based XML web services.

The Contractor will analyze each of the State's available service contracts to understand the

methods and data associated with each. A gap analysis will be performed to identify those instances

where the Contractor's functionality cannot be fully supported and simply remapped. Where there

is an identified gap, the Contractor shall provide the State with a proposed plan for augmenting

the State's services. Where a State managed service is not available, the Contractor will continue

the integration until an equivalent replacement is implemented by the State. The Contractor willbe fully capable of integrating with the State-wide HIE system and public registries to aggregate

additional data that AHS cannot manage directly. Where bi-directional services are required, a

service registry will be available for the State that supports the use of Web Services Description

Language (WSDL) to discover all services and understand each contract.

The following table indicates the Contractor's current services.

Enterprise Master Patient Index(EMPI)

Claims WarehouseClinical Data RepositoryService AuthorizationsMember EligibilityMedication DatabaseHealth EducationHome and Community Based Services

repository-

The interoperability features and capabilities of the Contractor's System shall leverage the State's

deployments of Master Data Management / Master Person Index technologies to present a 360-

degree view of patient clinical datato the Users.

The abovementioned will apply when integrating future capabilities that the State may require.

f. Scalability and ErtensibilfuThe Contractor will deliver the highest levels of reliability and scalability to support any State IT

initiative now and in the future. The Contractor's System will be co-located (does not share any

resources with other datacenter clients) and will be completely isolated on the Contractor's own

hardware.

The Contractor's System shall be delivered from a highly configurable network load balanced

(NLB) web farm of virtualized data center servers (these servers shall be clones of each other)'

The Contractor will not only keep up with the latest trends or changes but also adopt them when

proven stable.

The Contractor will have the Scalability and Extensibility to:

1. Have the ability to meet future growth\

Business Rules EngineBusiness Intelligence/Analytics

PlatformWorkflow EngineMember CensusProvider @hysician/Facility)Clinical Guidelines/CriteriaMapping/Geocoding

surn or vnnvroNr, coNrrucr FoR PrnsoNar, Snnvrcns plcr 12 or 26gDnpanrnanNT oF'vnnuoxr HplI,ru Accrss coNrnacr # 2g739EQIInalrn SolurroNs,INc. AvrnNuunNr # 2

2. Be configurable3. Have the flexibility to keep up with changing technology and regulatory needs4. Be easy to maintain

The Contractor's system will scale for multiple business units with different missions. (Forexample, if Department 'x' and Department 'y' both want to take advantage of automated casemanagement, the Contractor's System shall handle increasing Users while maintainingresponsiveness and insuring security, privacy, etc.)

g. Business Analytics & ReportingNEG.G.1 The Contractor's System shall support the Business Intelligence (BI) functions and willdeliver a balanced set of capabilities to the intemal State Users across three (3) areas: informationdelivery, analysis, and development. (Rl FINAL) AdditionallyNEG.G.2theContractor's Systemshall include the reporting for both canned and ad hoc reports and will have the ability to providedashboard capabilities to the State Users. NEG.G.2-1 The Contractor's System shall include thereporting for both canned and ad hoc reports, based on a person's user role and permissions, andwill have the ability to provide dashboard capabilities to tire State Users. (Rl FINAL)

NEG.G.3 The Contractor will design, develop, and execute complex data mining models andanalysis. These models will be made available and used to generate Business Intelligencedashboards. NEG.G.3-l The Contractor will design, develop, and execute complex data miningmodels and analysis. These models will be made available as Online Analytical Process (OLAP),which includes all capabilities inherent in the use of data cubes and additional capabilities inherentin the Tableau product, to Business Intelligence dashboards or ad hoc reporting, (Rl FINAL)

NEG.G.4 The Contractor's System shall provide dashboard views, graphs, and simple tables, andhighly detailed reports which drill-down to the raw data.

All reports will be available in both hardcopy and in softcopy.

NEG.G.4-1 The Contractor's System shall provide dashboard views, graphs, and simple tables,and highly detailed reports which drill-down to the raw data. All reports will be available insoftcopy with the ability to download and print hardcopy. (Rl FINAL)

NEG.G.5 The Contractor's data will be warehoused in a centralized relational database systemwhich will be a comprehensive, integrated management and analysis platform that providesscalability, performance and security. (Rl FINAL)

NEG.G.6 Data system elements that the Contractor will use in report generation and submissionprocess include:

L lnformation collected by system which incorporates User entry validation andedits to ensure data integrity on User entry. (Rl FINAL)

2. NEG.G.7 Information recorded in relational database and analyzed by analyticsteam.

3. Advanced data mining structures to deliver complex aggregations to thereporting services.

4. Statistical analysis software used to create highly complex data analysis for adhoc reports.

Srnrn or VnnvroNt, CoNtucr FoR PnnsoNar- SnnvrcnsDnp,tnnvrnNT oF VrnvroNr Hnllrn AccnssEQHnalru SoLurroNS, INC.

Plcn 13 or 268CoNrnlcr # 28739

AunxumnNr # 2

5. Submission of information either hardcopy or electronic as prescribed by AHS.

NEG.G.7-| Data system elements that the Contractor will use in report generation and submission

process include: 2. Information recorded in relational database and analyzed by analytics team. 3.

Advanced data mining structures to deliver complex aggregations to the reporting services. 4.

Statistical analysis software (John Hopkins ACG) used to create highly complex data analysis for

ad hoc reports. 5. Submission of information either hardcopy or electronic as prescribed by AHS.

(Rl FINAL)

NEG.G.8 The reporting process the Contractor will use will include these key elements:

1. Individual(s) or other sources responsible for providing the data and

information.2. Identification of the individual or process responsible for generating the report.

3. Determination of reporting media, such as hard copy or electronic (PDF, Excel,

etc.).4. Distribution parameters such as authorized recipients and number of copies.

5. NEG.G.! Creation of a logging system to track report generation and receipt.

6. Individuals authorized to request modifications in formats, distribution, and

schedules.7. NEG.G.8 Maintenance of information and data confidentiality.8. NEG.G.9 Establishment of retention schedules for archiving, disposal, and

destruction'9. NEG.G.8 Report quality assurance, and validity checking.

NEG.G.8-l The reporting process the Contractor will use will include these key elements: 1.

Individual(s) or other sources responsible for providing the data and information. 2. Identification

of the individual or process responsible for generating the report. 3. Determination of reporting

media, such as hard copy or electronic (PDF, Excel, etc.). 7. Maintenance of information and data

confidentiality,g. Report quality assurance and validity checking (Rl FINAL)

NEG.G.Q-I The reporting process the Contractor will use will include these key elements: 5.

Creation of a logging system to track report generation and receipt 8. Establishment of retention

schedules for archiving, disposal, and destruction. (Rl FINAL)

NEG.G.10 The Contractor's System shall be capable of generating scheduled predefined reports

as well as conducting ad hoc studies and analyses that provide meaningful information.

NEG.G.l0-1 The Contractor's System shall be capable of conducting ad hoc studies and analyses

that provide meaningful information. (Rl FINAL)

NEG.G.I1 The Contractor's System's capabilities will provide dynamic, and interactive data.

These Contractor's System capabilities will provide a view of all longitudinal data from the

origination of the contract. (Rl FINAL)

NEG.G.|2 The Contractor's System shall incorporate User entry validation and edits to ensure

data accuracy and completeness. Data quality and accuracy will be achieved at the database level

through integrity constiaints such as entity relationships, primary keys, foreign keys, and default

srlrn or vnnvroNt, coNrnacr FoR pnnsoN,lr, snnvrcns pacn 14 or 26gDnpmrvrnNT oF'vnnuoNr Hpar,rn Accnss coNrnq,cr # 2g739EQHnalrn SolurroNsr lnc. AvrnNovrnnr # 2

values. Advanced data mining structures will deliver complex aggregations to the Contractor'sSystem's real-time web reporting services. (Rl FINAL)

NEG.G.13 The Conhactor's System shall provide the AHS management teams with the data andinformation necessary to evaluate and validate program policies and procedures, and to administerall contract responsibilities. (Rl FINAL) The Contractor's System's real-time web-based reportingmodule provides prior authoization review activity, statuses, and authorization numbers forproviders and recipients. NEG.G.l5 The Contractor's System shall be fully compliant withMedicaid Federal and State security regulations and will make all reports and associated exportsavailable to providers and parties specified. (Rl FINAL)

NEG.G.16 The Contractor's System's dashboards will summaize apanel of common utilizationmetrics as well as a "heat" map depicting PM/PM costs. Active trend series and bar graphs will beconnected to present the User with a series measure over time, as well as a "Top 5" bar chart andaverage for each metric at the current hierarchy.

NEG.G.16-l TheContractor'sSystem'sdashboardswillsummarizeapanelofcommonutilizationmetrics as well as a bubble chart depicting unit medical costs compared to average group size andaverage PM/PM costs. Active trend series and bar graphs will be connected to present the userwith a series measure over time, as well as a "Top X" capabilities and average for each metricwithin the current hierarchy. (Rl FINAL)

NEG.G.l7 The Contractor's System's dynamic filtering capabilities will allow a User to analyzethe data for any time period to pinpoint areas of interest that could indicate potential issues wherecourse correction is needed.

All data can be exported to Excel, PowerPoint, or image format.

NEG.G.17-1 The Contractor's System's dynamic filtering capabilities will allow aUser to analyzethe data for any time period within the data to pinpoint areas of interest that could indicate potentialissues where course correction may be needed. All data can be exported to Excel (.csv),PowerPoint, or image format. (Rl FINAL)

2. Regulatory Policies, Audit Complianceo and Securitya. GeneralThe Contractor will:

i. Adhere to, harmonize, and enable federal and local regulations.ii. Protect and secure the information assets within the Contractor's System.iii. Enable Identity and Access Management.iv. Ensure. State data, including but not limited to personally identifiable information, tax

information, or HIPAA protected information, will be isolated and protected.v. Leverage an MS Office SharePoint Server (MOSS) environment.

The Contractor's security policies will be designed to prevent unauthorized personnel fromaccessing a building, resource, or stored information to minimize the risk of data breaches andinappropriate access to information.

Srarn or VcnvroNt, CoNtru,cr FoR PrnsoNar, SnnvrcrsDnp.q,nnvruNT oF' Vnnuonr Hnl'LrH AccnssEQHn,r.lrn Sor,urroNs, INc.

The Contractor's IT infrastructure will be isolated behind physical firewalls and intrusion detection

and prevention systems ensuring security and privacy of all data. In accordance with HIPAAsecurity requirements, all of the Contractor's computer systems will be protected from access by

unauthoriz"d per.on. through the use of frequently changed passwords, access codes, and other

safeguards. The telephone voice messaging system and e-mail system can only be accessed

through individualized pass codes.

All Internet applications will use 256-bit SSL AES or better standard encryption for secured

transmission of information over the Internet.

The Contractor's activity logs for all Windows server based systems will be enabled by default

and record system events continuously. The logs will provide thorough detail regarding logon, file

access, system error, event ID, security access alerts, and document print tracking. The Contractor

will ensure activity logs are routinely backed up.

The Contractor will have a comprehensive HIPAA compliance program that includes all required

privacy and security regulations. The Contractor will comply with all HIPAA requirements,

specifrcally the administrative simplification provisions of the law, and the aSsociated rules

p.rUtlrtt"d by Health and Human Services (HHS), the Department of Defense (DoD) Health

information Privacy Regulation (DoD 6025.19-R), the HIPAA Security Compliance

Memorandum (HA Policy 60-010), and the Security Standards for the Protection of Electronic

Protected Health Information. The Contractor's HIPAA policy will cover paper security, access to

data processing resources, passwords and security incident reporting, software licensing, remote

computer usage, virus, e-mail and application development security considerations.

The Contractor's policies and procedures will maintain security and confidentiality of patient

medical information, review data, and any other data identified as individually identifiable. Each

Contractor employee will be required to review and sign a confidentiality protocol upon

employment und *ill receive annual documented training to maintain security awareness and

policy.

The Contractor will monitor all health care IT related legislation and regulatory bodies to ensure

all requirements are met or exceeded.

The Contractor will monitor local and federal regulations to ensure that the Contractor's System

at all times meets or exceeds compliance. The Contractor will remain informed of any legislation

that will directly or indirectly impact work provided to the State. The Contractor will adhere to

federal security policy and laws.

The Contractor will contract with third party security firms as agreeable to the State of Vermont

to conduct annual security audits and examine the network security controls from the perspective

of an independent source.

The contractor's third-party security firm will review the following:i. Any agfeements, contracts, work obligations, or statements of work.

ii. Efficiency of network connections and their current security status.

Plcn 15 or 268

CoNrRr.cr #28739AvrnNounNT # 2

Srarp or vnnuoNr, CoNrnlcr FoR PnnsoNu, Snnvrcns PAGE 16 or 26gDnpmrvrnNT oF vnnuoNr Hnar,rn Accnss GoNTRACT # 2g739EQHrar,ru Sor,urroNs, INc. AvrnNtvrnilr # 2

iii. Current policies and procedures, and how those relate to data access.iv. Engagement management tools, controls, and reporting.v. Level of compliance in regard to regulatory requirements.vi. Current industry standing, and corporate health, of the service provider.

The Contractor's security firm will conduct application penetration testing using a well-developedmatrix of existing threats, wlnerabilities, and real-world recommendations to identify anypotential security weaknesses. A report will be produced by the firm, and shared with the State,detailing the results of the audit and any detected deficiencies or threats.

The Contractor will apply a data sensitivity matrix to all data sources to understand the associatedsensitivityrating (high, medium, and low) and the required level of controls needed to secure each.

The Contractor will monitor and control the entire software development environment from thisplatform and will be tightly coupled to development and change management practices and toolswhere software development lifecycle (SDLC) is managed.

b. Security Architecture and DesignThe Contractor will maintain in-house a certified security specialist that holds one or more of thefollowing certifi cations :

1.

ii.iii.iv.

Information Assurance Manager (IAM).Information S ystem S ecurity Manager (IS S M) Certifi cation.Certified Federal Information Security Act (FISMA) Auditor.International lnformation Systems Security Certification Consortium (ISC2) CertifiedInformation S ystem S ecurity Pro fes sional (CIS S P).Information Systems Audit and Contract Association (ISACA) Certified in Risk andInformation Systems Control (CRISC).ISACA Certified in the Governance of Enterprise IT (CGEIT).EC Council Certified Ethical Hacker (CEH).Certified EC-Council Instructor (CED.Health Information Trust Alliance (HITRUST) Common Security Framework (CSF)Practitioner.Certified HIPAA Professional (CHP).Certified HIPAA Security Specialist (CHSS).

V

vl.vii.viii.

ix.

X

xi

The Contractor will analyze the surface area vulnerability of Contractor's Systems to ensure allknown vectors of attack are considered and hardened well beyond industry best practices. TheContractor will perform a security related review of all functional and technical specifications toensure vulnerabilities are not introduced to the system using SDLC and ITIL infrastructure changecontrol processes.

The Contractor's System shall not allow access without secure User authentication and resourceauthorization (specific functionality). A11 login User names must be unique and be associated withan industry best-practices strong password. Users must change passwords on a configuredexpiration timeframe and the reuse of passwords will be limited.

Sr.lrn or VnnvroNt, CoNtru.cr FoR PrnsoNar, SrnvrcosDnpmrvrnNT oF Vrnnnonr Hnllrn AccnssEQHn,,LLru Sor,urroNs, INc.

The Contractor will use VPN appliances to secure all remote connectivity needs withininfrastructure. These appliances will provide intrusion detection and prevention, malware

protection and packet level scanning real-time while continuing to maintain a very low latency and

responsive connection

The Contractor's System shall be deployed on a no single point of failure topology that allows the

Contractor to recover from a failure of any element within the infrastructure. Fault tolerance and

failovers are accomplished with both redundancy of critical hardware such as routers, switches,

firewalls, and server hosts load balanced servers and routing.

The Contractor will:i. Provide security-related input into IT infrastructure, system, and application design.

ii. Leverage published industry standards and models to apply security best practices.

iii. Support, enable, and extend the security policy by providing specific security-related

guidance to decision makers.

iv. contain the capability to provide user and site authentication.

v. SupportVPN access.

vi. Include the ability to recover from a failure of any single element.

vii. Be easily serviceable.viii. Support the establishment and active management of data sensitivity levels.

ix. Include application and system hardening processes.

The Contractor will provide an Information Security Risk Assessment Procedure as required bythe Centers for Medicare and Medicaid Services: https://www.cms.gov/Research-Statistics-Data-

and- Systems/CMS - Information-Technolo gyllnformationS ecurity/downloads/I S-RA-Procedure.pdf.

c. Identity and Access Management (IAM)The Contractor will ensure integration platform services as these become available. The Contractor

will support all service methods for creating lJsers, deleting or de-provisioning lJsers, verifyinglogin credentials, changing passwords, and applying roles or permissions.

The Contractor will enable a consistent integrated login experience across all User interfaces

including ICN Procedure codes, regardless of the platform it is being accessed from. The

Contractor will ensure identification of Users and their associated security is abstracted from the

data source that persist it.

The Contractor will ensure the audit trail is centralized, consistent, and verbose in its level of data

capture and supports the scrutiny of security analysis or forensics meeting all compliance

requirements for chain of cirstody and activity.

The Contractor will ensure User accounts are augmented by a profile provider. This provider

allows for the addition of typed property values to be added to a User to store all additional

information required to provide context for functionality like business rules, workflow, processes,

and User preference managed from the respective User's profile screen and can also be managed

by authorized administrative Users in the security module.

PAGE 17 os268CoNrnncr # 28739

AuruNuvrnNT # 2

Sr^q.rn oF vERMoNr, coNrnacr FoR PnnsoN,c.L snnvrcns p.lcn 18 or 26gDBpmrurNT oF vnnvroNr Hnru,rn Accnss coNrnc.cr # 2g739EQHrar,rn Solurroxsr INc. AvrnNuvrnxr # 2

The Contractor will be in compliance with T3.47 RBAC and an HL7 permissions catalog needs tobe developed for role-based access among HIT/HIE services. RBAC is to be provided byimplementation of a SOA provider that delivers a standard interface.

The Contractor will:i. Enable Vermont AHS to identify Users in different contexts so that Vermont AHS

policies and User preferences can be applied consistently.ii. Deliver an integrated login experience for Users across applicable Vermont AHS

systems and channels.iii. Enable coherent audit trails and chain ofcustody records needed for security forensics

and compliance requirements.iv. Support the proactive management of User access to Vermont AHS resources including

de-provisioning when needed.v. Enable Vermont AHS to consistently identify Participants so that customer service can

be more effective.vi. Support the use of an industry standard Directory for identification and authorization.

d. ApplicationEnuyptionThe Contractor will provide:

i. Encryption of database columns and indexes for data at rest.ii. Encryption of flat files at rest and in motion.iii. Network encryption at the session layer (or lower) to secure communication streams

that traverse un-trusted networks; and to provide encryption for sensitive data in motionacross any network.

iv. Field-level encryption so custom applications can secure pertinent information withina communication stream.

v. Key management for secure creation, storage, and retrieval of encryption keys.

The Contractor will utilize transparent data encryption (TDE) a full-database-level bulk encryptiontechnique for all data at rest.

The Contractor will ensure any data that is written into the database file is encrypted including alldatabase columns and indexes and that data that is in use is not encrypted.

Data in motion will be proteoted by the SSL/TLS protocol standard between the server and anybrowser clients consuming or writing data over untrusted networks.

The Contractor's database schema will include several instances where cell or field-levelencryption will be implemented for those scenarios where the database is accessed by a non-browser based custom application that may or may not be protected over a secure protocol or hasthe potential of storing data locally for.later use.

The Contractor will support strong asymmetric keys for encryption approach.

e. Privacy and ConsentThe Contractor will ensure role-based access within the Contractor's System shall conform to the

State's policies regarding sensitive information.

The Contractor's System must be able to identify and delineate between internal and external Users

(Users outside the Agency) and must give them different levels of visibility to System data. When

displaying data, identification information tying the records back to specific Participants must be

omitted where appropriate.

In addition, the Contractor's System's configurable security elements (roles, permissions) include

the ability to store User specific configurable data fields, such as an email address, to facilitate

automated notifications and indicators such as internal/external User or department that can be

leveraged by business rule logic to support workflow.

The Contractor's System shall reset passwords without requiring a customer service

representative. Data elements only necessary to manage the account are displayed and are de-

identified to an appropriate level to ensure privacy.

f. SecurityThe Contractor will deliver a Security Plan that will address, but not be limited to, the following

subject areas.1) Security Audit2) Database SecuritY3) Software and Hardware SecuritY4) Data BackuP5) Disaster RecoverY

Security AuditThe foliowing list of capabilities is leveraged by the Contractor to provide all auditing and

monitoring of pertinent events and changes across the infrastructure:

Srlrr oF VERMoNT, CoNTRACT FoR PnnsoNar- SnnvrcnsDnr,.lnrN{nNT oF VnnvroNr IIn.c.LrH AccnssEQHn.c.LrH SoLUTIoNS, INC.

Log Collection

Automated collection of log files

Supports Windows Event Logs - both' evt

and .evtx formats

Supports Syslog log files

Configure to clear or not clear log files

Collects all generated events

Collects only certain types of events

Can export log data from one source toanother

PacB 19 or 268

CoNrRAcr # 28739AvrrNtnrnNT # 2

Log Archiving

Compression of log data

Can provide email notification of failedarchive attempts

Can automatically retry failed archive

attempts

Continues from last collected event

Scheduled time

Percent fulI (threshold)

Opens zr;pped event log files (; evt) forfevlew

Srarn or VnnvroNro Conrrucr roR pnnsoNnr, SnnvrcrsDBplntvrBNT oF VnnvroNr Hr.lLrH AccBssEQHnar,ur Sor,urroNs, INc.

Log Consolidation and Storage

Secure log aggregation and storage forWindows Event Logs and

Syslog data from devices and Oss

Supports SQL databases for log data

Provides log normalization

Supports automated compression

Monitoring

Agentless monitoring

Real-time monitoring

Configurable polling

Servers go offline/online

System shutdowns/restarts

Detect and track changes toUsers/groups/computers

Detect and track unauthorized accountusage

Detect and track printer activity

Detect policy changes

Detect account lockouts

Track logon activity

Track errors and wamings

Track changes/deletions onfi les/folders/registry keys

Ability to create custom "alarms" for logmonitoring

Reporting

Provides out-of-the-box predefined reports

Provides access to log reports via browser

Can report daily, weekly, or monthlyresults for defined data

Ability to create custom reports

Configurable report formats

Data Formats

Syslog

SQL

MS Access

. evt Log Format

Comma Delimited Text File

HTML Report Format

Comma-Delimited Report Format

Alerts and Notifications

Define alerts for events of interest

Define alert for a single event

Confi gurable thresholds

Provi des predefined a larms

Alerts.on devices and OSs supportingSyslog

Define events as either high risk,medium risk or low risk

Notification Support

Network pop-ups

E-mail messages

Pager

Short e-mail messages

Syslog messages

Database insertions

NetBIOS broadcast notification

Supports regulation of notifi cations

Sends notifications to multiple e-mailaddresses

Log Analysis and Management

Provides a tree view of events and datafor analysis

Supports extensive fi ltering options

Create custom filters for review

Provides predefined filters

Supports choice of log type to manageincluding:

Pacn 20 or 268CoNrnacr # 28739

AvrnNovrnNT # 2

Surn or VnnvroNt, CoNtru,cr F'oR PnnsoN,q,L SnRvtcnsDnp.qntvrpNT oF Vnnuoxr Hnar,tn AccpssEQHnu,ur SolurroNso INc.

HTMLbased reports Application

Security

System

DNS Server

Directory Service

File Replication Service

Audit ComplianceThe Contraitor shall contract with third party security firms, to be approved by the State ofVermont's Agency of Digital Services Security Division, which meet the State's minimum

qualification req.tire*ents, to conduct annual security audits and examine the network security

controls from the perspective of an independent source. The Contractor will be proactive in

handling security requirements that come from within the organization, as well as from outside

regulators. The contracted security firm will review the following:i. Any agreements, contracts, work obligations, or statements of work.

ii. Efficiency of network connections and their current security status.

iii. Current policies and procedures, and how those relate to data access.

iv. Engagement management tools, controls, and reporting.

v. Level of compliance in regard to regulatory requirements.

vi. Current industry standing, and corporate health, of the service provider.

The Contractor shall ensure the security firm conducts application penetration testing annually and

prior to major application releases using a well-developed matrix of existing threats,

vulnerabilities, and real-world recofilmendations to identifu any potential security weaknesses as

part of network security audit. Additional vulnerability assessments will be run quarterly. A report

is produced by the firm detailing the results of the audit and any detected deficiencies or threats.

The Contractor will immediately remediate any deficiencies or threats known, discovered, or

reported, and create controls for associated policies and procedures. The Contractor will make

available the results of audits, penetration tests, vuln".ubility assessments, and the consequent

remediation or mitigation steps to the State.

Database SecurityThe Contractor will ensure confidentiality, integrity and availability (CIA) of the Database

Management Systems responsible for managing data related to the proposed Contractor's System.

The following are Contractor's Systems and approaches to ensuring CIA.

Confidentiality:i. Data Encryption - Detailed in 1.6.3 Application Encryption.

ii. Access Control - Authentication with strong passwords.

iii. Object level authentication - Access to specific tables, stored procedures, views etc.

willbe restricted at the User level.

iv. Upgrades and patches - As soon as patches and upgrades are available and thoroughly

tested, they will be released to production.v. Intrusion Detection and Prevention (IDS) - Packet level network IDS and profiling

PAGE 2lo1268CoNrru.cr #28739

AnrnNovrnNT # 2

Srarn or vnnnnoNr, coNrnacr FoR PERSONAL snnvrcns PAGE 22 or 26gDrpmrvrnNT or vnnvroNr Hnar,rn Accnss coNrnacr # zg73gEQHn.l.r,ur Sor,urroNsr INc. AvrnNuunNr # 2

with alerts.Integrity:

i. Database Backups - Enterprise level SAN replication at the block level. Data is de-duped and transmitted to disparate data center for immediate restoration of data in theunlikely event of comrption.

ii. Track and Audit - Capture all security related events and all changes to databaseobjects and raw data.

iii. Constraints - Database design standards include enforcement of entity relationships,primary keys, foreign keys and default values.

iv. Hardware Configuration - Redundant Disk Anays (RAID l0/5) to provide datapartitioning/striping to reduce risk of data loss on drive failure.

Availability:' i. Scalable redundant hardware - Multiple routers, switches, and virtual izationhosts.

ii. Fault tolerance and failovers - deploy a no single point of failure infrastructure.Yirfila'lization of web servers in conjunction with Network Load Balancing (NLB)across the server farm.

iii. Disaster Recovery - In the event we the primary location is lost, the Contractor willreal-time replicate to a hot site that can be promoted to primary with no loss of data.

Software and Hardware SecurityThe Contractor will ensure all server operating systems are properly deployed, configured, andmanaged to meet the highest security standards and guidelines concerning HIPAA, HITECH andFISMA Compliance. The Contractor will adhere to the following guidelines in the form ofsystem/confi guration management and proactive preventive maintenance :

i. A1l of server and client operating systems are setup and maintained by qualified SystemAdministrators.

ii. Strictly adhere to best practices and software lifecycle management directives.iii. All servers are periodically scanned for malicious software, unnecessary services and

access.iv. Patch, upgrade, and test each operating environment for the latest releases. Procedures

in place to control the installation of software on operational systems.v. Remove or disable all unnecessary services, applications, and network protocols where

practical.vi. All security-related events on critical or sensitive systems are logged and audit trails

saved.vii. Access to services are logged and protected through access-control methods.viii. Adhere to Least Privilege concepts and practices to include governing all Privileged

User access.ix. Perform periodic security and penetration testing.x. Allow Third Party audits to include review of controls within the server operating

systems.xi. Conduct periodic reviews of server logs to identifli suspicious activities.

The Contractor will enforce enterprise security policies on all mobile devices, such as restrictingaccess to hardware and software, managing wireless network interfaces, and automatically

Sr.lrn or Vnnuonto CoNtnl.cr FoR Pnnsoxu, SrnvrcrsDEpARTMENT oF VBnvroNr Hnl.r,rn AccnssEQHn.rr,rn Sor,utroNs, INc.

monitoring and reporting when policy violations occur. The Contractor will adhere to the

following guidelines:i. - -Develop

and maintain a mobile device security policy which defines which types ofmobile devices are permitted to access corporate resources, the degree of access, and

how provisioning should be handled'

ii. Implement and test all prototypes of mobile devices solution(s) before rolling into a

production environment.iii. Fully secure each mobile device before allowing user access.

iv. Support strongly encrypted data communications and data storage, and remotely

wiping the device if it is lost or stolen and is at risk of having its data recovered by an

untrusted party.v. Require authentication before accessing organization resources, resetting forgotten

passwords remotely, automatically locking idle devices, and remotely locking devices

suspected of being left unlocked in an unsecured environment.

vi. Restrict which applications may be installed (through whitelisting or blacklisting),

installing and updating applications, restricting the use of synchronizalion services,

digitally signing applications, distributing the State's applications from a dedicated

mobile application store, and limiting or preventing access to the enterprise based on

the mobiie devices' operating system version or mobile device management software

client version.

The Contractor will ensure the security of Web Servers through augmentation of traditional

security mechanisms consisting of frameworks based on use of authentication, authorization,

confidentiality, arid integrity controls. The Contractor will adhere to the following guidelines:

i. Use Secure Socket Layer and Transport Layer Security (SSL and TSL). Secure Sockets

Layer uses a public key to encrypt data transferred over the SSL connection.

ii. Counter Denial of Service (DoS) attacks through replication of data and services for

improved availability. Replication and redundancy can ensure access to critical data in

the event of a fault and will enable the Contractor's System to react in a coordinated

manner to overcome disruPtions.iii. Use logging of transactions to improve non-repudiation and accountability. Non-

repudiation and accountability require logging mechanisms involved in the entire Web

Service transaction.iv. Use threat modeling, harden operating environments with the latest fixes, patches and

configurations, and conduct software security testing to include scheduled penetration

testing. The Contractor's solutions will provide a secure operating environment to

withstand avaietY of attacks.

v. Patch and upgrade the operating Contractor's System (OS), remove or disable

unnecessary -sirvices

and applications, configure OS User authentication, and

periodically test the security of the OS.

vi. Use performance analysis and simulation techniques for end to end quality of service

and quality of protection.vii. Use Web Service security standards, tools, and techniques required for traditional

security mechanism, such as firewall, intrusion detection systems (IDS), and secured

operating systems.a. These controls are in effect before implementation or deployment of Web Services

Pacn 23ot268CoNrnl,cr #28739

AnnnNowrnNT # 2

srarn or vnnvroNr, conrmcr F'oR pnnsoNal sBnvrcns pAcn24or 26gDnpanrvrnNT o['vnmaonr Hnalrn Accnss CoNrnacr # 29739EQHnn rn Sor,urroNsr INc. AvrnNounnr # 2

applications.viii' Support web browsers that use the latest security measures/controls and are supported

by the provider.ix. Only support the last three (3) browser versions to ensure the latest security

architecture.x. Use the latest utilities to conduct an optimization study, which enables us to maintain

a proactive security posture in terms of browser types, versions and configurations.

g.,Sl,,Rs and PerformanceThe Contractor shall proactively monitor the performance of the System's applications and rapidlyrespond to, and address, performance issues across the entire System. The Contractor will captureWeb page response times from the State end point down to the backend database calls. TheContractor's performance monitoring will provide dashboards with drill down capability, reports,and customized alerts to provide a mechanism for stakeholders (including State staff) to reviewS LRJperformance management.

All SLRs and performance metrics will be demonstrated during the Operational Readiness Testing.

3. Performance RequirementsThe Contractor will ensure that all data transmitted over the Internet is encrypted using 256bit ata minimum SHA1 encryption over an SSL connection.

Security and software updates will be regularly scheduled to insure the Contractor's systemsremain secure, and compatible with the latest browsers and performance. Regular system updateswill be communicated and scheduled in advance and will not be performed during peak usagetimes.

The Contractor will monitor the performance of both the storage and virtual infrastructures. TheContractor will provide real time monitoring and alerting with customizable thresholds toproactively address performance issues before they become a problem.

The Contractor will isolate and optimize performance and utilization of virtual machines, physicalservers and storage resources, and investigate Users identified by the APM tool's algorithms asdissatisfied or frustrated to identify and fix their issue, improving overall system performance.

The Contractor's monitoring solutions will be role-based and provide real-time dashboards withdrilldown capabilities described in this requirement. The Contractor's System configurationscreens will allow for easy customization.

The Contractor's System architecture will support:i. Internal State Workers and external participants.ii. Mission-criticalservices/ServiceLevelAgreements.iii. Ease of management.iv. Ability to upgrade (ease and compatibility).v. Virtualization and resource management.vi. NetworkPerformanceRequirements.vii. Meeting System response time requirements.

Sr^q,rr or VnnvroNt, CoNtnncr FoR PrRsoN,q.L SBnvrcrsDnp.q,ntvrnNT oF VnnuoNr Hn,qlrn AccpssEQHn,t r,rn SolurroNs, Iittc.

PAGE 25 or 268CoNrnacr #28739

AvrnlrovrnNr # 2

viii. The Contractor's System must provide data dashboard capabilities to facilitate real

time graphical display of technology performance metrics with drill-down capability

aligned with IT Operations (Jser's role and permissions.

4. Performance Monitoring and ManagementThe Contractor's performance Monitoring and Management will include the methods for centrally

managing system resources such as servers, backup, archiving, and recovery equipment, databases,

and applicutiont. The Contractor's methods will address auditing, tracing, and scanning the

Contractor's System.

The Contractor will be proactive in diagnosing any problem across each critical layer.

All dashboards will be monitored daily by the Contractor's systems engineers and logs will be

archived and available for auditing purposes.

The Contractor will monitor through a unified dashboard all hardware assets as well as all software

service interfaces such as relational databases.

The Contractor's System shall leverage all registries as well as draw data from the current MMIS

system to obtain teneficiary eligibility on a routine periodic schedule as determined' The

iontractor's System shall interface with the future Integrated Eligibility System to obtain

eligibility information. The Contractor's System shall interface with the Vermont HIE system to

obtain detaits of interaction with and services provide to beneficiaries by the provider in real-time.

The Contractor's System shall be capable of Exchange/Outlook integration with support from local

IT resources to ensure security and fault tolerance.

5. System AvailabilitYThe Contractor is responsible for delivering a cost-effective, high-availability environment that

minimizes the frequency and impact of system failures, reduces downtime, and minimizes

recovery time in the event of catastrophic failure.

The Contractor will provide a multi-redundant architecture which ensures the availability of the

Contractor's System.

The Contractor ensures that when one path is taken out of production temporarily for maintenance,

a redundant path will pick up the load and keep the Contractor's Systems available during the

maintenance cycle. All of the Contractor's high-density servers will be 'hot' capable so they do

not need to be powered down or taken out of commission in order to scale.

The Contractor's System shall be hosted in Tier 3 orhigher data centers, and will be equipped with

multipath burstable bandwidth from the hosting facilities.

The Contractor will identify software bottlenecks, excessive calls to the database, suppressed

errors, and system responses falling outside the minimum acceptable standards. The Contractor

will immediately fix found issues to ensure issues do not make it into the production environment.

The Contractor's Development Team will monitor the production environment using APM to

proactively identify and resolve issues not detected during the development process.

Srarr or VnnvroNro CoNrucr FoR pnRsoN.lr, SnnvrcnsDnp,lnrunNT oF VnnvroNr Hnar,tn AccnssEQHn,t lrn Sor,urIoNs, INc.

Pacn 26o1268CoNrnncr #28739

AprBNounNr # 2

6. IT Component Capacity PlanningThe Contractor will plan, size and control the system as IT Component Capacity needs change.The Contractor's plan will address, but not be limited to the following system areas:

i. Database Storage Capacityii. Real-time Integrated / Centralized Databaseiii. Data Warehouse and Data Martsiv. Knowledge Basev. Audit Log Storage

The Contractor's database instances will be centrally hosted on a primary Storage Area Network(SAN) and will be replicated real-time to a secondary site.

The Contractor will actively analyze the health of the storage systems at both the hardware andsoftware layer. The Contractor will maintain a very conservative overhead of free raw capacitythat will be immediately provisioned to grow logical drives for the databases, documentrepository or integrated knowledge bases.

All storage area networks will be full fiber channel with redundant fiber channel switches.

a. System Administration and Supporti. Account Administration

The Contractor's System shall include both authentication and authonzation mechanisms.Authentication will follow industry best practices for password strength and resetfrequency. The Contractor's System shall also automatically log a User out if a period ofinactivity is exceeded. The authoization framework will allow an administrator to securethe Contractor's System down to the object (button, menu item etc.) level. Any givenUser's access will be limited to exactly what their role or responsibility entails. EachUser's security profile will include roles. Given permission can be "denied" to exclude itfrom a given User's role.

ii. System AdministrationThe Contractor will provide ongoing support and maintenance, including customizationofthe Contractor's System computing ecosystem. The Contractor will have the State staffperform functions such as account administration, configuration of rules, reference filechanges, etc. The contractor's overall management framework will include:

1. Application management and monitoring2. Web services management3. Systems management and monitoring4. Event management5. Identity and Access Management6. Network management and monitoring7. Performance monitoring8. Print Prioritization& Management9. Workload Management

The Contractor will use technology for realtime User and application performancemonitoring (APM), as well as provide real-time actionable intelligence to rapidly respondto and address performance issues across entire software portfolio.

Srnrn or VnnvroNt, CoNtrucr FoR PnnsoNl,L SnnvrcnsDnpantvrnNT oF VnRvroNr Hnar,rn AccpssEQHnar,rn Sor,urroNs, INc.

Prcn 27 o1268Cor'lrru,cr # 28739

AvrnNovrnxr # 2

The Contractor's System shall provide advanced drill down reporting, dashboards, and

customized alerts to provide'a single viewpoint for support and technical personnel and to

proactively monitor application performance,

The Contractor's System shall capture Web page response times from the User end point

down to the backend database calls to ensure Web pages meet or exceed the SLAs set forth

in Section I - Maintenance Requirements, subsection 2 - Service Level Requirements ofthis Contract.

The Contractor will monitor web service performance, web requests, end-to-end monitor

Internet Information Systems (IIS) application pools, web site availability, load balancing

status, IIS logs and Windows events for all production Web sites. When one of the

thresholds for a monitor is exceeded, alerts will be automatically sent to the appropriate

staff, depending on the nature of the alert, a scripted action such as restarting an IIS

application pool will be automatically triggered.

The Contractor will provide active and passive monitoring of items such as Central

Processing Units (CPU), disk and memory utilization, device up time, and custom monitors

for production related services such as SQL processes, anti-virus, and in-house developed

applications. When one of the thresholds for a monitor is exceeded, alerts are automatically

."trt to the appropriate staff and depending on the nature of the alert, a scripted action such

as restarting a service will be triggered. When alerts are received regarding CPU, disk, and

memory utilization for the servers, the Contractor will proactively add resources where

needed without the need to shut down or restart the system.

The Contractor will analyze Syslogs, operating system events, World Wide Web

Consortium (W3C) \IIS logs, and perform automated reporting and alerting on the log data.

The Contractor will use unified threat management network security appliances. The

Contractor will provide centralized logging for all security events and logs while

conducting network security monitoring, analytics, reporting, and alerting'

The Contractor will monitor health, availability, and status of all network and system

devices in the infrastructure via Simple Network Management Protocol (SNMP) traps and

Syslogs. The Contractor will give each'account access levels that are in direct relation tojob functions using the Least Privilege Rule.

The Contractor will use bandwidth monitoring on all firewall interfaces which includes

VPN tunnels. The Contractor will monitor performance of both storage and virtual

infrastructures analytics-based IT management software solution designed to isolate and

optimize performance and utilization of virtual machines, physical seryers and storage

resources.

The Contractor will monitor at the server level using real time monitoring and alerting withcustomizable thresholds and proactively address performance issues before they become a

problem.

Surn or VnnuoNr, CoNrnacr F,oR pnnsoN.tr, SnnvlcnsDrpantnnpNT oF VnniuoNr Hnar,tn AccnssEQHnnlrn Sor,urroxs, INc.

lv.

v

Plcn 28 or 268Coxrnacr # 28739

AunNnnnoNr # 2

The Contractor will manage the performance of the virtual infrastructure. Performance datawill be abstracted to health, risk, and efficiency measures based off key performanceindicators and will be displayed in a roles-based access dashboard.

The Contractor will utilize a full IT service management software package built on ITIL(Information Technolo gy lnfrastructure Library) best practices.

The Contractor will track, report, and manage key ITIL processes, and track, monitor, andmeasure the workload to meet or exceed service level agreements.

iii. Audit TrailContractor shall track infrastructure and applications at a granular level across all tiers andcapture all transactions, end-to-end, from a User click, to the database record and back.The Contractor will provide accurate and timely reporting, granular business transactiongrouping and precise SLA management.

All dashboards will be monitored daily by systems engineers and logs will archived andavailable for auditing pu{poses.

Data BackupThe Contractor will use offsite storage. Data backup should be stored offsite in the eventof a physical disaster. The Contractor will ensure data is replicated near real-time andfailover is automated. Full online scheduled file level backups are snapped locally andreplicated to disparate DR data center. Database and application backup procedures mustbe updated to include backups for the Contractor's System. Full online data backups mustoccur, as well as offline backups using tape storage.

Data ArchivalThe Contractor's following data retention policies will dictate the lifecycle of data and thetimeframe at which operational databases will be truncated and archived:

1. The Contractor will maintain seven (7) years of data at the highest performingtier of storage and archive the expiring longitudinal dataset on a quarterly basisto lower tiers.

2. The Contractor will schedule maintenance utility flags for all candidate dataand will perform the archival in a hierarchical approach to ensure all datadependencies are considered.

3. The Contractor's archived data will remain retrievable via a databasemanagement system but will be segregated by schema to exclude it from theContractor's System during normal operation. This data can be restored to theproduction tier of storage by archiving utilities if necessary.

Disaster RecoveryThe Contractor will develop a High Availability & Disaster Recovery Plan for the entireContractor's System driven by State's Recovery Time Objectives. The Contractor will havea thoroughly tested Disaster Recovery Plan and Business Continuity Plan on file that can

vl.

Surn or Vnnuoxt, CoNtnacr F'oR PBnsoN,ll, SnnvrcnsDspA,nrMnNT oF VnnvroNr Hn.qltH AccnssEQHralrn Sor,uuoNso INc.

be executed in the event of an unforeseen emergency/disaster. The Contractor's computer

systems will be protected against catastrophic faitrure and business intemrptions.

The Contractor will conduct annual testing of the above-mentioned plans to determine their

validity and determine any need for revision to meet the current situation of IT resources

and peisonnel. The Contractor will ensure thatdatais protected and operations will resume

as soon as possible.

The Contractor will provide immediate redundancy locally to a secondary hardware

footprint as well as a secondary location within wide area network (WAN). The

Corrtractor's WAN will be comprised of private circuits that do not carry pdblic traffic.

In the event of a catastrophe which results in the loss of the Contractor's primary location,

a series of automated failovers and manual failovers will be enacted to cutover andpromote

the secondary location to reestablish a production environment. This will be accomplished

within required recovery time objectives with virtually no loss of data.

b. TechnicalDocumentationThe Contractor will provide comprehensive technical documentation consisting of detailed

functionality, architecture, design and code sections. The functionality section will describe the

intent of the application or module and subsections will include use case diagrams, site maps and

a field matriridentifying key data columns. The architecture section will document the overall

structure of the software including components and application interfaces. The design section willinclude an object diagram, an entity relationship diagram and a data dictionary. The code section

will list file names and the database schema structure.

Each iterative production release will include the associated technical documentation along with

the release notes.

c TechnicalEnvironmentsThe Contractor will establish:

i. Multiple environments (e.g., development, testing, training, and production)'

ii. Procedures used to migrate software from one environment to another.

iii. Steps needed to maintain the synchronization between environments.

The Contractor's software development lifecycle process will include several carefully managed

and monitored environments to include: development environment, test environment, stage

environment, and production environment.

When the Contractor's software has been fully tested, a cross-functional team of developers,

system administrators, and quality assurance analysts, led by a project manager, will prepare for

the migration process. The Contractor will document risks and resources will be assigned to

facilitaie the roll-out and review the standardized procedures. Before any software is migrated, a

full system backup will be created to ensure the integrity of data.

PncB 29 o1268CoNrru,cr #28739

AnnnNuunNT # 2

surn orvnnuoNr, coNrnacr FoR pnRsoNar. snnvrcns pacn 30 or 26gDnpanrunNT oF vrnuoNr Hnllru Accuss coNrnlcr # zg73g

AvrnnnmnNr # 2EQHnalrn Sor,urroNs, INc.

After implementation, the software will be validated in the new environment by the Contractor'srelease team. The Contractor shall provide a report regarding validation in the new environment.The State will review the report and provide comments.

H. IMPLEMENTATION1. Project Management

a. Project ManagementThe Contractor shall follow project management methodologies that are consistent with the projectManagement Institute's (PMD Project Management Body of Knowledge (PMBOK) Guide. Allstaff and subcontractors proposed to be used by the Contractor shall be required to follow aconsistent methodology for all Contract activities.

The Contractor will provide a Project Manager (hereinafter referred to as "PM") whose effort willincorporate all the tasks necessary to successfully implernent the project. These tasks will include,among others consistent with the PMBOK methodology, updating Project Plans, assigning staff,scheduling meetings, developing status reports and reviewing them with the State, addressingproject issues and change orders, and preparing presentations for State stakeholders. TheContractor's PM shall have overall responsibility for the project deliverables, schedule, ffidsuccessful implementation of the project as planned and all activities of Contractor's resources.The Contractor and subcontractor will use a unified project management tool set approved by theState Authorized Representative(s)

The State's PM shall supervise the Contractor's performance to the extent necessary to ensure thatthe Contractor meets performance expectations and standards. The Contractor's PM shall workclosely with the State's PM on a day-to-day basis. The Contractor's PM shall be on-site in Vermontas the State may require during the entire project based upon an agreed project schedule. TheContractor's PM shall be required to schedule and facilitate weekly project team status meetingseither on-site in Vermont or via tbleconference.

The Contractor PM shall provide weekly written Status Reports to the State PM. Status Reportsshall include, but not be limited to:

i. The status of tasks and deliverablesii. Issues and risksiii. Upcoming activities

The State PM will determine the exact format and content of the report document at or before theproj ect kickoff meeting.

The state shall require the following Project Management Deliverables:i. Contractor PM to work with State project team to finalize a detailed project work plan

(in Microsoft Project). The Contractor shall maintain and update the project plan (i.e.,project schedule) on a regular basis (at least weekly, if not daily).

ii. Project kickoff meeting.iii. A detailed Project Management Plan (PMP) that aligns with the State's Project

Management Plan for this project.iv. Weekly project status reports as defined above.v. Up-to-date project issues log.vi. Up{o-date risk log.

Sr.q.rn or Vnnvront, CoNtntcr FoR PnnsoNar, SnnvrcnsDnpanrvrnNT oF VnnvroNr Hrll,rn AccnssEQHru,rn Sor,uuoNs, INc.

P.a.cn 31or 268

CoNrRAcr #28739AunNonrnNr # 2

vii. Weekly project team meetings which shall include meeting agendas and meeting

discussion log, action items and update issues and risk logs accordingly.

viii. Stakeholder register.

#il ith Vermont AHS's program and project management team to

align business objectives, establish key metrics and management reporting requirements to ensure

on time, on budget delivery, with quality.

Joint eovemance structure between Contractor and the State

1.tt. Stut" PM and State Vendor Manager (hereinafter referred to as "VM") shall supervise the

Contractor's performance to the extent necessary to ensure that the Contractor meets performance

expectations and standards. The Contractor PM will work closely with the State PM and VM on a

day-to-day basis.

b. Project Work-planThe Contractor's planning management model must be approved by the State and shall align with

Vermont AHS's program and project management team, as business objectives and projects are

implemented, in addition to instituting key planning metrics and standard reporting mechanisms

to insure on time, on budget delivery, with quality. The Contractor's planning management

capability will support the overall organization in realizing its goals and in the process also help

better collaboration with the project management teams.

c. Organizational Change Management Plan

The Contractor shall develop and implement a comprehensive Otganizational Change

Management (hereinafter referred to as "OCM") plan for both internal and external staff across

functions, roles, and locations that are impacted by the Care Management Solution. The

Contractor's OCM plan will address how various State staff are anticipated to react to the change

and the development of open, timely, and consistent communication of the solution's benefits. The

plan also will address relevant training and coaching to help staff understand what is expected ofih"-, and will identify continuous feedback mechanisms to measure and adjust OCM activities.

The Contractor will:i. Use an Organizational Readiness Assessment approved by the State Authorized

Representative(s) to determine the organizational readiness of the DV_H+, other State

agencies, stakeholders, ald providers to adopt the Care Management Solution.

ii. Identify and evaluate key organizational focus areas, impacts, and risks that need to

be addressed to achieve program outcomes.

iii. Identify, analyze, and address differential impacts to various stakeholders and end-

Users.iv. Identify and evaluate the organizational capabilities (structure, stratqgy, systems,

skills, style, staff, values, etc.) required to effectively leverage the functional and

business capabilities deployed by the care Management Sblution.

v. Develop recommendations for the future organizational structure (business,

technology and Partners).vi. Develop an overall organizational change management strategy that complements the

implementation roll-out plan with specific attention to the following:

Sr.Lrn or vnnvront, contnacr FoR pnnsorrur, snnvtcrs pacn 32 ot 26gDnplRrvrnNT or vnRuoNr Hn,rr,ru Accnss coNrucr # 2g739EQHnu,rn SolurroNsr INc. ANrnNoNrENr # 2

1. Accelerated adoption of behaviors, attitudes, and operational practices requiredfor impacted staff to support the change;

2. No intemrptions to service delivery during Care Management program roll-out.vii. Develop and deliver a robust communication strategy consistent with DVHA's

operating culture and information needs of different stakeholders.viii. Conduct Change Impact Assessments to determine the impact on affected stakeholders,

including business processes, people, and technology implications to inform contentfor future communications and training activities.

ix. Conduct Periodic Assessments that track successful change adoption among affectedaudiences, and inform the OCM plan by providing structured feedback on what isworking well and identifying risks or issues.

The OCM plan will identify and evaluate the capabilities (skills, structure, roles/responsibilities,governance, etc.) required to effectively leverage the functional and business capabilities deployedby the Care Management Solution and develop recommendations for the future organizationalstructure (busines s, technolo gy, and p artners).

d. Change & Release ManagementThe Contractor shall provide a centralized solution to automate and control the software changeand release management process.

Change and release management will contain:i. Library Management-The classification, control, and storage of the physical

components of the applicationii. Version Control-The maintenance, tracking, and auditing of modifications to an

application's components over time, faciliiating the restoration of an application toprior development stages.

iii. Turnover Managemeht-The automated promotion of software changes across differentphases of the lifecycle (e.g., development, unit test, systems test, and production),including management of the approval process, production turnover, and softwaremigration control.

The Contractor shall use a change management portal, designed using ITIL and State of Vermont'sbest practices, as a central point of control over the change process that tightly integratestechnology with process. The portal will have the ability to create extensible workflows toensure that any change introduced into the IT infrastructure follows a regulated process, therebypreventing unauthorized change and eliminating the potential for system downtime or systemdegradation.

The change managernent portal includes a centralized fully customizable change dashboard. Usingthe portal, the Contractor and State will identify "key performance indicators" or process metricsthat are particularly important to the State that will be carefully designed, implemented, andmonitored.

e. Sofnuare Configuration ManagementThe Contractor will provide the automatic capture and storage of IT Service to Application,Application-to-component, and component-to-component relationships.

Srarn or Vnnn routo Contucr FoR Pnnsoxer, SnnvrcnsDnpanrunNT oF Vnnvroxr Hnar,rn'AccEssEQHnnr,rn Sor,uuoNs, INC'

The Contraptor will maintain the history of relationships and any transformation required of IT

servioe to Application, Application-to-Component, and Component-to-Component to

appropriately -uttug" and document configuration changes whioh affect the application and the

pioc"ssing environment. Management and documentation will include, but not be limited to,

source control, version control, profiles, and securityplans.

f. RelationshipManagementThe Contractor shall be responsible for the following

i. Identifying ali stakeholders, including:1. ThJse people or groups directly or indirectly involved in the project.

2. Those who are key to an effective implementation, the key decision makers and

those accountable for the delivery of the benefits'3. People in the suPPort functions.

ii. Establishing stakeholdei's baseline positions and identifying stakeholder's issues.

iii. Mapping stakeholders and assessing their needs and requirements.

iv. pormuliting a stai<eholder Management Plan using the results of the stakeholder

mapping.

g. Issue and Risk Managementihe Contractor shall be responsible for risk and issue management, including the identification,

assessment, logging, tracking/monitoring, reporting, espalation, resolution, and closeout of an

issue.

The Contractor and the State of Vermont will determine when an issue is resolved, and the State

of Vennont will approve the closeout of an issue.

h. Qualtty ManagementTheZontractor shall be responsible for quality management, which includes providing a QualityManagement Plan and performing assurance and quality conhol. The Conkactor QualityManagement Plan shall have the following elements:

Detailed definition of all deliverables by phase and associated acceptance criteria.

Defined deliverable review process.

Disciplined deliverable review process.

Regularly scheduled reviews of key project phases and milestones.

Identified tngetperformance areas and proposed methods of measurement; establish

the baseline metrics for the agreed upon goal areas; and assist the State in determining

the level of achievement of the performance goals.

The Contractor's internal qualrty management program will ensufe that the Contractor's System

shall detriver returns and business value in accordance with the envisaged usage, both functional

as well as technical,

A Quality Management Plan is required to guide the prOject team regarding qualityprocesses and

ptor"g improvement practices. The Contractor's Quality Management Plan will avoid rework and

iefects in ihe final product/deliverable(s). The Quality Management Plan will have the ability to

track quality at any stage of the project, and provide a capability to identify defects, problems,

complaints, etc. during each stage of the project.

Pacn 33 o1268CoNrnacr #28739

AMENDMENT # 2

1.

ii.iii.iv.v.

srarn or vnnuonro coNrucr FoR ppnsoN,q.r, snnvrcns p.q.cn 34 or 26gDrp,lnrurNT oF vnnuoNr Hnar,ru Accnss coNrn.tcr # 2g739EQHnar,rn Sor,urroNs, INc. AnnnNnvmNr # 2

The Contractor will define a system/process for quality control and establish, with the State,accepted standards of performance and measure against these standards. The Quality ManagementPlan will provide metrics that measure performance against standards.

The Contractor will recommend changes to the policies and practices in a manner that improvesthe quality of deliverables.

The Contractor shall:i. Set up a regular cadence of intemal and external inspections.ii. Schedule inspections with a specific pu{pose, e.g. entry and exit gates in a processiii. Establish criteria for each inspection.iv. Develop an expectation that peer reviews, code reviews, and document walkthroughs

are conducted and documented on a regular basis.v. Set up a process for random inspections ofthese review processes.

The Contractor's Quality Management Plan will include:i. Reportingii. Metrics managementiii. Documentationmanagementiv. Continuous improvementv. Adoption and alignment with the quality standards of the State

The Contractor shall identify the measurable aspects of the project such as conformance todocumentation templates, number of errors in a State document, number of defects identified,milestones met on time, schedule delays, etc.

The contractor will develop a Quality Management process that will:i. Include stakeholder participation in the quality process.ii. Include key quality messages in a cadence (weekly, bi-weekly, monthly, etc.).iii. Keep stakeholders informed and involved in process improvements.iv. Keep the information consistent.v. Track and report trends once an established pattern of metrics emerges.vi. Provide a dashboard in a "pull" location such as a SharePoint@ but also push it out to

key stakeholders; the dashboard will simple and easy to populate.vii. Provide intemal and extemal quality reviews and readouts at all levels internal and

external.viii. Provide quality audits.ix. Provide process analysis.x. Take each high-level measurement and apply a formula for achieving a metric with

expected inputs and output.xi. Establish a standard format for the metric, e.g. a percerrtage, aratio, a sum, etc.xii. Ensure the data necessary to create the metric is readily accessible and is correct, and

the measurements will be relevant.xiii. Align quality management tool usage with the project.xiv. Provide analysis, determine root cause, identify a solution, and execute continuous

improvement.

The Contractor will consistently report quality metrics.

Srarr or VnnvroNto CoNtnacr FoR PnnsoNar, SuRvrcrsDnp.qnrurNT oF VrnuoNr Hnllrn AccnssEQHn,Llrn Sor,unoNs, INc.

Pncn 35 or 268

CoNrru,cr # 28739AvrnNnnlnNr # 2

The Contractor, with the inclusion of the State, will provide inputs/outputs to quality measures.

The Contractor will align measurements, acceptance, and timelines to the project. Measures,

tracking of inputs/outputs will be monitored.

The Contractor will collaborate with stakeholders to evaluate lessons learned, and publish an

After-Action Report. A template with requirements and key quality measurements (requirement

traceability) will be prepared.

The Contractor will:i. Establish a quality control process to monitor, measure, and manage quality process'

ii. Createrealistic metrics and establish a quality dashboard.

iii. Establish tool sets to be used.

iv. Report on continuous improvement (from ground up).

v. Initiate internal audits to check the effectiveness of quality processes on the project.

rhe contraiffi?lHil:lH?tfiI',tt;" 0",,, into the project pran.

ii. Drive communication process to create a quality friendly environment.

iii. Conduct a lessons learned process post project delivery'

i. Security and Regulatory ManagementThe Contractor will maintain physical and logical security relative to the services it provides. This

will include an overview of the policies and practices to prevent, detect, and resolve security

breaches. In addition, the Contractor shall demonstrate experience and abilityto meet all regulatory

requirements (e.g., FISMA, HIPAA, and Vermont Statutes).

The Contractor will provide an information security structure that is based upon the ISO27001

framework which is in line with HIPAA and HITECH acts. The following minimum activities are

performed to ensure current and future compliance:i. A11 health care associates are mandated to undergo four stages of e-learning sessions

on HIPAA; they must complete an assessment on their HIPAA understanding.

ii. All health care associates are mandated to undergo e-learning session on revised

HITECH act and liability of a business associate.

iii. All employees are mandated to complete a course on acceptable use policy annually,

which covers aspects for privacy and security.

iv. ln addition to above, an information security awareness training program is conducted

for associates, and security controls agreed to by the State are briefed to associates

semi-annuallY.v. The staff follows a detailed and well-documented approach to risk management.

Facility level risks and account security risks assessments are conducted on an annual

basis where physical security risks and risks associated with compliance controls

agreed in MSA to comply with HIPAA/HITECH and State Statutes. Account level

security risk assessment and vulnerability assessments are conducted on a quarterly

basis checking the operating effectiveness of the controls.

vi. SAS 70 / ISO 27001 and Third-party audits are performed to check the control

effectiveness in addition to above said internal audit. The Contractor shall notify the

State's Agency of Digital Services Security Division to review and approve before live

data is entered into any third-party system.

srlrn or vnnvroNr, conrnacr FoR pnnsox,q,r, Srnvrcns plcn 36 or 26gDnpaRruBNT oF Vnnvronr Hn.qlrHAccnss CoNrnq.cr # 29739EQHnn rn Sor,urroNs, INc. AvrnNovrnNr # 2

vii. Security awareness notes are sent to all associates on a monthly basis.

Securing Customer InformationThe Contractor will have appropriate operation and technological processes and procedures thatare designed to safeguard against unauthorized access, loss, destruction, theft, use or disclosure ofdata. These controls will meet or exceed the requirements listed below.

Process Controls:i. The Contractor will act only on the basis of State instructions with respect to State data

that is processed.ii. The Contractor will not disclose State data to a third partyunder any circumstance other

than at the specified request of the State.iii. All rights, title, and interest in personal data shall remain vested solely with the State.iv. Periodic risk assessment and audits of accounts are conducted.

People Controls:The Contractor will have a well-defined Acceptable Use Policy goveming the safeguard ofconfidential information. All associates will read, understand, anA sign the AcJeptable Use policydocument. Associates who fail to comply with this policy are subject to disciplinary action,including revocation of his / her privileges. Violations of this policy may result in termination.

i. The Contractor's associates are required to sign a Non-Disclosure Agreement (NDA)ii. Stringentbackground checks are carried out on all personnel.

Technical Controls:i. Sen'ers will be hardened to standards.ii. Servers are housed in secure data centers with physical access given only to authorized

members of the system support team. Physical access to data centers and any server ismonitored continuously from a c;entralized building management system.

iii. DoD compliant tool such as Darik's Boot and Nuke (DBAN) tool is used for disksanitation.

This table references Non-Functional Requirements T3.55 and T3.56

Contractor's Role Contractor' s Responsibilities

Intrusion DetectionSystem (IDS)monitoring team

Todetect all types of malicious network traffic and computerusage. This includes:

o Network attacks against vulnerable services

o Data driven attacks on applications

o Host based attacks such as privilege escalation

o Unauthorized logins and access to sensitive files, andmalware (viruses, Trojan horses, and worms)

o Report breaches discovered by the intrusion detectionsystem

Srarn or VnnivroNt, CoNtnncr FoR PnnsoN.c,L SnnvlcnsDnp.qntvrnNT oF VnnvroNr HnllrH AccrssEQHnru,rH SoLurIoNs, INc.

P.tcn 37 or 268

CoNrru,cr #28739AvrnNovrnNr # 2

Network and SystemSupport (NSS)engineers

Any real or suspected aof computer systems or

dverse event in relation to the securitycomputer networks can be termed as a

logical security breach. A logical security incident can be

defined as network or host activity that potentially threatens thesecurity of computer systems, includes activity such as:

o Attempts (either failed or successful) to gain unauthorized

access to a sYstem or its data

o Unwanted disruption or denial of service

o The unauthoized use of a system for the processing orstorage of data

o Changes to system hardware, firmware, or software

characteristics without the owner's knowledge, instruction,or consent

Administration(Physical Security)team

Physical security incident is the act of violating an explicit or impliedphysical security policy. Incidents include activity such as:

o Attempts (either failed or successful) to gain unauthorized

accsss to the facility

o Riots / strikes which could adversely affect any of the

Contractor' s or subcontractor' s locations

o Theft of property

Intemal / external (GISto raise on their behalf)audit team

Ensure this by conducting periodic compliance activities includingrisk assessments and security audits.

Global InformationSecurity (GIS) team

Development and maintenance of security and continuity related

policies, procedures, standards and gUidelines. Ensure that the above

security policies are being followed and adhered to. Conduct periodicactivities risk assessments and securi audits.

Every associate is responsible to report any suspected / actual security

compromise and this is reiterated through regular training programs

and securi run from time to time.

Associates

Communication of Security CompromiseAll incidents are reported to the State of Vermont contacts and are accessible through the intranet,

intemet, email, intercom, or through toll-free telephone numbers. The incident reporting facility is

available 24x7 and permits anonymous incident reporting. Based on the severity of the incident,

escalation to concerned parties within defined timeframes as specified below:

i. A security incident or event is notified to the local incident response team and Global

Information Security (GIS) team.

ii. The local incident response team immediately acts on the notified incident.

iii. Perform impact analysis and provide necessary support.

iv. If the incident is low impact and can be resolved within an hour, the incident report is

submitted to the corporate incident response team and it is documented in the GIS

Portal.

srarn or vnnmoNro coNrrucr F'oR PnnsoN.q,L snnvrcns pacp 3g or 26gDnpanrunNT oF'vnnvroNr HnalurAccnss coNrnacr #zg73gEQHnar,rn Sor,urronsr INc. AurNnvrnNr # 2

v. If the incident is high impact or cannot be resolved within an hour, the team escalatesto senior management.

vi. The corporate security and incident response team acts on the incident immediately.vii. Designated State contacts will be informed of incidents as soon as they are escalated.viii. If the incident is not resolved within 4 hours from the time of incident, inform the local

Business Continuity Planning (BCP) team in case the incident warrants an invocationof the BCP.

ix. Based on the severity level, the team updates the State, project managers, and accountmanagers.

All communications are sent through one or more of the following systems:i. E-Mailii. Telephone / Mobileiii. Hotlineiv. Fax

The Contractor will establish an Emergency Contact Center (ECC) with a toll-free number,wherein Users can call 2417 and inform any incidents. The ECC is manned by trainedprofessionals, who have access to detailed information on location of nearest medical facilities,civic authorities, support teams etc. Based on the type of incident and nature of emergency, ECCprovides support to the User.

2. Environment Installation and ConfigurationThe seven.(7) environments include:

#Environment

NameDescription

Users DataPHI

(yes/no) Security Level

I Production * State users* eQH Level2Support* OperationsSupport

Live Data Yes HigVCertified

2 DisasterRecovery

State users Live Data Yes High/CertifiedSame as Production

J Staging(Vendor QA)

* State users,* eQH Leve72Support* OperationsSupport

Live Data(Copy ofPROD)

Yes High/CertifiedSame as Production

4 Training State users/Dev/CMTTesting/eQTestins

ObfuscatedData

No Medium

Srarn or VnnuoNt, CoNtru,cr FoR PnnsoNl'L SnnvlcnsDnplntvlnNT oF VnnuoNr Hn.AI,tn AccnssEQHnn rn Sor,urroNs, Inc.

PAGE 39 or 268

CoNrru,cr #28739AvrnNovrnNr # 2

5 UserAcceptanceTesting

Each of these environments will be managed by the Contractor's configuration management team.

The training and production environments reside on a web farm hosted in a perimeter network and

are isolated from the intranet by firewalls and gateway appliances. The hardware and software

hosting of all non-development environments are detailed in Sectipn G. Technical Requirements

in this Contract.

A subset of the configuration will kept in an XML file that allows for runtime configuration ofenvironment specific code. The abstraction of these configuration items allows a different version

of this file to be used for each environment and can be managed in source control in their respective

branch.

The change management process, specifically the release plan, includes steps for the promotion ofconfiguration values from development to production.

3. Knowledge Transfer & TrainingThe Contractor shall provide a Knowledge Transfer and Training Plan, The Contractor shall

identify and evaluate the knowledge to be transferred, The Contractor will determine for technical

personnel:i. The knowledge to be transferred.ii. How the knowledge will be used.

iii. Targeted Users of the knowledge, their leaming styles and levels of expertise.

iv. What knowledge is critical for success'

v. How the knowledge will be located and accessed by Users.

vi. How the knowledge will be maintained and updated.

The Contractor will determine for managers and end Users:

i. The knowledge needed to achieve current performance.

ii. Users of the knowledge.iii. What knowledge will deliver new value in the future'

The Contractor shall validate and document the knowledge. The Contractor will document all

platforms, tools and databases, and all relevant hardware and software configurations. The^Contractor

will develop and validate a complete inventory of all current system documentation,

will determine the value and application of each artifact, and will identify any gaps that need to be

corrected to effectively capture system knowledge'

The Contractor shall publish and share the knowledge. The Contractor will provide detailed system

documentation of items including but not limited to User profiles, transaction volumes, batch

windows, system environments, security and access control procedures, maintenance practices,

StateUsers/Dev/CMT Testing/eQ

ObfuscatedData

No Medium

UATLowDummy

DataNoTest Dev/eQ

Testing/CMTTesting

6

LowDummyData

NoDev7 Development

Sr.trn or vnnvroNr, conrnacr FoR PERSoNAL snnvlcps plcn 40 or 26gDrplnrmpNT oF vnnvronr Hn,tr,rnAccnss coNrucr # 29739EQHnu,ru SoLurroNs,INc. AurNovrnNr # 2

and issue resolution process. The Contractor will share this knowledge using the State's preferredmethod of exchange, including but not limited to publishing materials on shared sites andrepositories, both belonging to the State or provided and managed by the Contractor. Allknowledge repositories will facilitate efficient contextual discovery of comprehensive topicalinformation.

The Contractor will determine the best method of knowledge transfer based on factors such as:i. The type of knowledge to be transferred.ii. The purpose for transfening the knowledge.iii. The receiver's level of expertise.iv. The receiver's learning styles and preferences.v. Whether the knowledge will be applied in the same or a different environment.

The Contractor will develop training approaches that address the needs of different learning styles.After the Knowledge has been transferred and used by the recipient, the Contractor will conductan assessment of effectiveness of the knowledge transfer relative to the expected results.

il. Training StrategtThe Contractor will provide relevant, thorough, and timely education and training, and willidentify specific educational opportunities and provide individualized instructions throughout theimplementation and operational phases.

The Contractor will develop a technical and User training strategy that includes:i. Training State personnel who work on the project.ii. Training AHS and other State Users.iii. Training AHS executives.iv. Training AHS IT staff to ensure technical capabilities exists to support maintenance

and operations needs of the system.v' Method of training each of the above classifications, including approximate numbers

to be trained, estimated duration of each training component, and method to ensuretraining success. Methods include but are not limited to:

1. State-wide workshops to train Users on our program, polices, technology, andclinical decision support tools.

2. Frequent scheduled and ad-hoc webinars.3. Videos on specific system tasks and workflow related processes.

4. Design, Development, Customizationa. System Design MethodologyThe Contractor must conduct Joint Application Design (JAD) sessions at its Vermont location tofully explore and understand the functional requirements for the Care Management Solution, andoutline the number and topics of each session to be held.

The Contractor will apply component-based approaches to improve usability, extensibility,performance and maintenance which will provide the following benefits:

i. Avoiding large-scale and unnecessary rework.ii. Managing the risk of Impact on deployed systems and Users.iii. Improveusability, extensibility, performance and maintenance.

Sr.r.rn or VnnuoNt, CoNtru,cr FoR PnnsoNar, SnnvrcnsDnp.lnrvrBNT oF Vnnvroxr Hnal,trr AccnssEQHn,rlrn SolurroNs, INc.

The Contractor will utilize JAD sessions to design systems. This includes a cross sectional team

of key stakeholders with both technical and business expertise. During JAD sessions for thib

project, the Contractor and the State will come to a complete consensus on any given deliverable

and discuss those topics specific to each work stream module such as Document Management,

Workflow Management etc. across the functional requirements. These will be identified in the

Work Plan / Work Breakdown Structure (WBS).

JAD will include the following:

1 JAD Plan- the project managers will meet with the business sponsors to establish JAD

session deliverables and milestones of the JAD sessions. They will establish a JAD

Plan that includes:

a. The functional requirements needed.

b. Clear, understandable, measurable, and attainable goals.

c. The scope and limitations of the project.

d. Timelines.

2. Assemble the team. The Project Leader will develop a list of team members and clearly

define their roles and responsibilities.

3. Kickoff, The JAD sessions will start off with a kick-off meeting at which the executive

sponsor is present. Each team member will be guided to understand what he or she is

expected to do.

4. Execute the JAD sessions. The Contractor will facilitate and record the activities and

decisions of the sessions.

5. Closure. At the conclusion of the JAD sessions, the detailed design specification

document shall be produced by the Contractor within the timeframe agreed upon during

the planning stage. The solution will be presented to the JAD team and if warrarrted, a

prototype demonstrated. State approval will be obtained to proceed, as will evaluation

of the JAD process.

b. System Development Methodology

The Contractor will employ a System Development Methodology that corresponds to industry-

standard best practices approved by the State of Vermont. The Contractor will provide constant

and consistent communication, risk mitigation, collaboration, innovation, and continuous process

improvement to quickly adapt to business requirement changes and deliver functionality'

Dashboard reports will be available to team members and stakeholders alike to provide complete

transparency at every phase of the software development life cycle (SDLC). The Contractor will

ensure that the stakeholders are getting the needed functionality using ITIL v3 processes' including

change management. At every software release cycle, the project manager and stakeholders will

actively engage in an interactive demonstration of the latest functionality in the software. Product

feedback will be taken back to the development team and worked into the work item backlog to

correct anypotential issues immediately, instead of waiting until the end of the SDLC. The change

Prcn 4lot268Conrnlcr # 28739

AvrnNounNT # 2

surn or vnnivroNr, coNrucr FoR PnnsoN,q.L Snnvrcns PAGE 42 or 26gDnp,rnrunNT oF vnnuoNr Hnar,rn Accnss coNrucr # 2g739

AvrcNnnnnNr # 2EQHn,tlrn Sor,urtoNso Iwc.

management portal will automate and audit the workflow for change requests based on ITIL v3best practice guidelines and will adhere to internal change management policies.

Each work item of the project will have a mandatory business requirement, detaileddesign/technical specification, and test plan document linked to the stored document repository.Project transparency will be delivered through reports and dashboards.

The Contractor will employ Agile Methodology to develop its solution. Management of sprintsand other Agile components is solely the responsibility of the Contractor, but the State of VermontProject Team will be available for consultation on significant barriers or blockers during sprints.A small team of Business Analysts and Technical staff from the State of Vermont Project Teamwill participate with the Contractor's team to determine appropriate goals for each sprint and willreview sprint output to determine if the goal has been met. The intent is to provide the Contractorwith timely feedback and is in no way to be considered a formal approval. The Contractor is stillliable for formal deliverables listed within this contract. State of Vermont team will be informedand consulted at appropriate checkpoints leading up to production of formal Design deliverables.These checkpoints will be subject to approval by the State of Vermont and will be documented inthe work plan.

c. System Customization MethodologyContractor's System customizations will be accomplished by following the same process as theinitial VCCI development and will be prioritized by the product owner as described in "ChangeManagement", "System Design" and "system Development" life-cycle methodologies. Eachcustomization will follow the same process as any standard new development and will beprioritized.

d,. Datu Conversion Strategt, Approach and Timeline.The Contractor will create aDataMigration Plan, logical and physical extract, transform and load(ETL) plan detailing how existing State data will be migrated. This plan will include the tools usedfor migration and the Contractor's Acceptance Criteria that will be applied by its QualityAssurance team, subject to State approval. The plan will include:

i. Reconciliation process(es) and data checking reports.ii. Data profiling - The process of examining the data as it moves from source(s) to

target(s) and collecting statistics and information about that data. This profiling willprovide metrics on data quality (e.g. whether the data conforms to particular standardsor patterns) and business risk.

iii. Data validation checks - The ability to look at each data record to make sure theinformation is valid and of good quality.

iv. Validation mechanisms - The use of web services or other programmatic solutions toensure codes such as zip codes and other dataare valid and de-duplicated.

Srarn OF VERMONI, CONtnnCT FOR PnnSOnu, SnnvrCnS PACn 43 Or 268

DnpmrnnnNT oF VnnuoNr IInlLrH Accnss Conrru,cr # 28739

EQHnalru SolurroNsr lltc. AnnnNounNr # 2

v. Data stand ardization checks - Ensure that the data transition adheres to predetermined

sets of standards set by internal enterprise IT, such asHLT,ICD9/10, CPT@ and HPCS

codes.

The Contractor will ensure data integrity and consistency throughout all phases of the project, and

will work with DVHA to identify its transition data. The State will make a formal request on behalf

of the Contractor to the data source entity. The data for each transition project will be transmitted

via a secure FTP site provided by the Contractor. The Contractor will work closely with those

parties identified to get file specifications (format, layout etc.) and mapping to understand all the

various types of datasets.

Gap analysis will be performed to determine if the transition dataset includes all data elements

required to successfully extract, transform, and load (ETL) into the system. Gap issues will be

resolved in a logical and physical plan on how the data will be migrated. Included in the plan will

be the tools used formigration and the Acceptance Criteriathat will apply an execution of the

conversiorVtransition plan with an Acceptance Test. Reconciliation and data checking reports will

be run to determine that all quantitative and qualitative metrics are achieved post-migration, and

"data fixes" will be limited as much as possible with a thorough design plan.

e. Data Transition Strateglt, Approach and Timeline

The Contractor will develop a Data Transition Strategy, Approach, and Timeline to ensure

coordinated activities between the Contractor and the source entity are fully documented.

f. Testing Strateglt and Approach

The Testing plan will address the Unit Testing, System Integration testing (end-to-end application

testing), stress testing, performance testing, and UAT testing, backup and recovery testing and

installation testing. Interim testing, such as that done during Agile development, willbe delivered

to the State of Vermont Project Team according to a schedule outlined in the Work Plan. Interim

testing does not relieve the Contractor of delivering formal test results as described elsewhere in

this Contract.

Testing starts with the exploration of the requirements, elaborating on the User stories from

different perspectives. Testing is a continuous and integrated process where all parties in the

project are involved. Testing will be performed throughout each construction iteration. Testers will

be embedded in the development team and will actively participate in all aspects of the project.

Programmers and testers will work side-by-side and share the single role of quality assurance.

The test team will perform parallel, independent testing throughout the project and will be

responsible for the end-of-lifecycle testing performed during the release/transition phase of the

project. The goal of performance testing is not to find bugs, but to eliminate bottlenecks and

establish a baseline for future regression testing.

sr,lrn or vnnvroNr, coNrucr F'oR prnsoNnr, snRvrcns plcn 44 osz6gDnp.lnrvruNT oF vnmnoNr Hnar,rn Accnss conrnacr # zg73gEQHnar,rn Sor,urroNsr Iwc. AunNuvrnNr # 2

i. Performance Testing1. The Contractor will develop a Performance Testing plan that includes a clearly defined

set of expectations relevant to the component being tested. For example, for a Webapplication, the following would be included in the Performance Testing plan:

a. Expected load in terms of concurrent Users or.HTTP connections.b. Acceptable response time regardless of the expected load.

2. The following tools will be used to identify and resolve bottlenecks, at no additionalcost to the State:

a. At the application level, profilers will be used to spot inefficiencies in code (forexample, poor search algorithms).

b. At the database level, profilers and query optimizers will be used to gather alldatabase level statistics for performance testing.

c. At the operating system level, utilities or specialized kernel monitoringsoftware will be used to monitor hardware resources such as CPU, memory,swap, and disk I/O.

d. At the network level, systems engineers will use packet sniffers and variousutilities available in our environment to understand issues related to networktraffrc, switching and routing.

e. Black-box testing will also be done as part of Performance Testing.3. The Contractor will employ tools tltat can simulate concurrent Users/HTTP

connections and measure response times.4. The Contractor will leverage its existing Coded UI automation tests and will include

testing all given use case scenarios to capture performance for typical system activities.

ll.

lll.

Load TestingThe Contractor will increase the load on the Contractor's System via automated toolsas part of Performance Testing. The load is defined in terms of concurrent Users orHTTP connections and the associated traffic that can concurrently produce.Performance testing uses load testing techniques and tools for measurement andbenchmarking purposes and uses various load levels. Load testing operates at apredefined load level, the highest load that the system can accept, while still functioningproperly.

Backup and Recovery TestingThe Contractor will conduct testing of Backup and Recovery processes at intervalsdetermined in the Work Plan. The Disaster and Recovery Plan will verify backups canbe recovered when needed within the targeted r'ecovery time. Testing of backup andrecovery will be performed on a regular basis. This is done at least once a year andmore frequently if infrastructure changes (hardware or software) are introduced via thechange management process. All Contractor System modifications affecting data willbe reflected in an updated Backup and Recovery Testing plan.

Surn or VnnvroNt, CoNtucr FoR PnnsoNn, SlnvrcnsDnpannvrnNT oF VnnuoNr Ilnar,rn AccnssEQHn.lr,rn Sor,utloNs, INc.

The Contractor will make the backup and recovery testing as realistic as possible. The

Contractor will restore the targeted application and associated databases to the

secondary site and apply previously described performance and load testing scenarios

to determine if the Contractor is capable of achieving the base line performance metrics

outlined in the SLA.

5. Deploymenta. Release Development and Rollout PlanningThe Contractor wili release working software to the end User according to project schedule. The

Contractor will take a release to the targeted end User base upon successful testing and training.

The Contractor's process will ensure the accurate sequencing of deployment steps/activities to

make each ielease as successful as possible.

The Contractor will utilize an established release planning process that will engage the project

team and will result in defect free release candidates. A candidate will include all requirements

and functionality identified for the release. The Contractor will test, fix, and distribute a stable

release only with the approval of the State. The release is pre-UAT tested by the Contractor in the

testing environment. Once testing is complete, and there are qo identified defects/issues, the

release is scheduled for User Acceptance Testing (UAT). The Contractor will provide training

such that the UAT team can effectively test. UAT is conducted to obtain confirmation that the

Contractor's System meets all mutually agreed upon requirements and functionality. Static and

dynamic .o.rr"" code testing shall be completed, and flaws remediated before production. Flaws

that cannot be remediated must be accepted by the State's Chief Information Security Officer or

her/his designee. Upon achieving successful UAT, a release to production date is scheduled for

implementation.

b. Implementation StrategltThe Contractor will develop and deliver a Transition to Operations Plan for each released

implementation. The Plan will include staging activities, end User training, date and times for go-

live, implementation support services, activities to address system stabilization, and system

acceptance criteria. The Contractor will utihze a results-driven incremental (RDI) implementation

and ieployment strategy to effectively manage State specific releases. RDI consists of self-

contained implementati,on sequences or phases where each achieves a certain business result or

goal.

The project Work Plan details the projected delivery dates of all "Immediate" and "Future"

requirements that map directly to the work packages in the WBS. These work packages are

logically grouped functional requirements.

c. Transition to Maintenance and OperationsThe Contractor will, in concert with the State, manage system stabilization activities, monitor

SLRs, create and maintain an issue 1og, and work to achieve systems acceptance utilizingpredetermined criteria. At the point in which the system is stable and accepted, the Contractor willperform maintenance requirements activities as outlined in this Contract, and the release will be

entered into warrantY.

P.tcn 45 or 268

CoNrn-q.cr #28739AvrnxounNT # 2

srnrn or vnnuonr, conrucr F'oR pnnsoNar, srnvrcps pncn 46 or,26gDnplnrvrnNT oF'vnnuonr Hnar,rn Accnss coNrnq.cr # zg73gEQHnalrn Sor,urroNsr Inc. AvrnNnvmNr # 2

d,. Lessons LearnedPhased Rollout Schedule will focus on a specific objective. Each successive phase will leveragethe work and experience from prior phases.

6. Quality ManagementThe Contractor will provide Quality Management of the requirements through the traceabilitymatrices, configuration management activities, change readiness, metrics to analyze quality goals,and management of defects and issues tracking. The Contractor's Quality Management willinclude, but not be limited to, the following elements:

i. The State's management of the requirements. This includes the identification ofinconsistencies between the requirements, and the project's plans and work products.

ii. The State's Requirements Traceability Matrices (RTM) that will be used forrequirements management, and will map where in the software a given requirement isimplemented.

iii. The State's configuration management activities that include: baseline control andmonitoring of the software library. Approved changes to baseline software andlordocumentation should be made properly and consistently in all products, and nounauthorized changes are to be made.

iv. The practices and procedures that will be followed for reporting, tracking, andresolving problems or issues identified in software development, solution transition,and solution maintenance.

The purpose of the RTM is to ensure that all requirements defined for the Contractor's System aretested in the Testing Protocols. The Contractor will capture all the requirements and map them torelevant scenarios and test cases. The Contractor will create a RTM that captures the relationbetween business requirements, application features/functionality and the test design (testscenarios and test data). The RTM will be created at the very beginning of the project and it willform the basis of the project's scope.

The RTM will have bi-directional traceability, and the RTM will track the requirement "forward"by examining the output ofthe deliverables and "backward" by looking at the business requirementthat was specified for a particular feature of the product. The RTM is also used to verify that allrequirements are met and to identify changes to the scope when they occur.

The Configuration management process will include:

t.ii.iii.iv.

Identifying configurable items and defining configuration control approach.Identifying document and source code libraries.Defining and creating User groups and access control to be administered.Identifying State supplied products including documentation, tools, libraries etc.Naming conventions to be adopted:

1. Includes document / code labeling convention.2. Labeling convention to be used when using a tool.3. Criteria for base lining and identification of baselines.

Change management process - Tracking changes to configurable items over theapplication / project life-cycle.Policies for archival and disposition of project items.

vl.

vii.

Sr^q.rr or VnnnnoNt, CoNtru.cr FoR PnnsoN.q'L SnnvrcnsDnplnrvrnNT oF' VnnvroNr Hnar,rn AccnssEQHn,tlru Sor,urroNs, INc.

viii. Configuration audits - responsibilities and administration.

ix. Tracking versions, changes to configurable items and status accounting.

All of the above processes are documented in the Software Configuration Management Plan.

Throughout the lifecycle of this Contract, the Change Management process will apply to any

change that potentially affects the project scope, baseline, objectives, budget, implementation/

deployment strategy, staffing plan or content of key deliverables.

While this engagement the Change Management process may be triggered due to the followingreasons:

i. Changes in the existing requirements.ii. New additions in requirements.iii. Requirements deferred for future releases.

iv. Change in timelines.v. Change in scope.vi. Change in assumptions.vii. Any changes to software, hardware, tools and any new tool implementations for

supporting the applications in scope.

The impact of these change requests when initiated across various phases is described in the table

below:

Changes to existing Requirements Low

Addition of New Low

Requirements deferred for future releases Low

Changes in Timelines Low

Scope changes Low

Changes in Software/ Ilardware/Tools Medium Medium Hish

The total scope of work for the project defined in this Contract must be approved by the State

before the commencement of the project. The State or the Contractor may request change to this

original scope of work at any time using a formal Change Request. The Change Request must

indicate: scope, source of funds, payment provisions, points of contact, ownership of data and any

applicable data use agreement, and project specifics including goals, deliverables, phasing,

expected timelines and estimated duration. No Change Request may increase the maximum

amount payable under this contract, substantially deviate from the scope of this contract, or deviate

from any term in any part or attachment to or of this contract.

The Change Request will be evaluated for its impact on the scope, schedule, quality and cost ofproject and the evaluation reviewed in a meeting between the Contactor and the State. Based on

Prcn 47 or268CoNrru,cr #28739

AvrnNnivrnNT # 2

HighMedium

4!sbLow

High

gtghLow

Hish

HighMedium

Triggers of Change RequestsRequirementAnalysis/Planning

TestDesign

TestExecution

sr.q.rn or vnnuoNr, conrrucr FoR PERSoNAL spnvrcns PAGE 4g or 26gDnplnrunNT oF vnnuoNr Hr.ql,rn Accnss coNTRAcr # 29739EQHnllrn Sor,urroNso INc. AvrnnnvrnNr # 2

both parties' review and the mutual agreements reached, necessary Change Requests will beexecuted to the planned effort, budget, schedule and resource planning.

Both parties recognize that the Change Request process does not obviate the need for State orfederal regulatory review of amendments to the scope, budget, or maximum amount of thisagreement.

The Change Request process shall not be used in lieu of the amendment process where anamendment is appropriate. Each Change Request must clearly define payment either by rate perhour or deliverable received and approved. Each Change Request must be pre-approved beforeany work shall begin. The State will not pay for services that are not previously approved in aChange Request by both authorized representatives listed within this section. The StateAuthorized Representative and the DVHA Business Office have final authority over whether ornot a Change Request is initiated under this agreement, and a Change Request will beimplemented only upon the request of the State Authorized Representative(s). All the ChangeRequests will be recorded with the details of the requester and approver, resolution, business andtechnical impact, impact to schedule and cost, and dependencies on other rollouts.The Contractor will introduce and implement a metrics program which will help the State inmoving towards 'metric driven' organization. Performance at project level will be tracked. Metricswill be used for the following:

i. Run time status and reporting.ii. Risk index for health of program from schedule and quality perspective.iii. Positive influence on the upstream quality.iv. Realigning test strategy and plan.v. Readiness decision for quality sign off.

The Contractor will track the engagement at various levels to ensure that all aspects of theengagement including project delivery, infrastructure, quality processes, resource managementand financial issues are addressed.

Contractor Roles and Respons ibilitiesAccount Director - Owns the entire process - testing, delivery, and relationship, maintains SOW,contracts, invoicing and acts as the first point of escalation.

Project Manager - Acts as the single point of contact for the overall project, testing and ensuresthat the engagement progresses as per the pre-determined State objectives and deliverycommitments.

Test Lead - Designs the program test strategy and manages process enhancements, tools andapproaches for efficient delivery. Identifies testing requirements and test plans and test reports.

Testers - Designs and executes test cases, provides status updates, participates in meetings withproject managers as well as testing and development teams.

Defects will be measured and tracked. Following steps will be followed by the Contractor to ensuredefect resolution:

i. Each defect, as it is discovered, will be identified and recorded. Defect tracking sheetwill be stored on a shared location accessed by both the Contractor onsite and offsitetesting team and the State testing team.

Sr.trn or VBnuoNt, CoNtntcr FoR PnnsoN.ql, SnnvrcnsDnpantvrnNT oF VnnvroNr Hnu,rn AccnssEQHnn rn Sor,utloNs, Iltc.

ii. Defect will be assigned to the lead developer for module/component from the

implementation team.

iii. Lead developer from the build team will change the status to "ready for re-test."

iv. Once the defect is ready for retest, all the test cases impacted by the defect or the related

components will be executed to ensure that the defect has been rectified. Then the team

will change the defect status as "fixed and verified."v. Then the iest lead from the QA team will co-ordinate with the developer from the build

team to close the defect and finally the build team will change the defect status as

"closed."vi. Defect prevention meetings will be conducted at regular intervals between the testing

team and the development team to discuss the test execution and defect analysis.

vii. Only when the re-test has been successfully completed with no critical failures, testing

will be signed off.

7. CMS CertificationThe Contractor will develop a comprehensive project plan aligned with the State's project plan

and based on CMS requirements for the Care Management sub-system. All high-level project

planning components (scope, requirements, WBS, schedule, test plan, etc.) are to be developed by

ihe Contractor and approved by the State, as well as requirement artifacts and Contractor's System

documentation. The Contractor will create its Care Management sub-system certification plan for

sub-system review citeria, documentation and certification checklist completion that complied

with the overarching MMIS CMS certification plan.

The Contractor must participate in and support all planning activities associated with Federal

certification of the MMIS Solution. Planning activities will ensure that Vermont's Medicaidportfolio meets all CMS requirements and perforrnance standards to qualify for the highest eligible

Federal Financial Participation (FFP) rate retroactive to the first day of complete operation. While

certification application activities will occur post-implementation, the Contractor should start

preparation at the beginning of the project and continue through each step of the design,

devilopment, testing and implementation of the Care Management Solution.

PAGE 49o1268CoNrnacr #28739

AvrnNnivrrcNT # 2

responsible for:Including plans for cMS certification as part of the Project Kick-off.Adhering to CMS Standards and Conditions in all deliverables.

Mapping all requirements, gaps, use cases, testing artifacts, workflows,training documents, change management artifacts, and other applicable

artifacts to the corresponding MITA Business Area and Process.

In conjunction with the State Project Team and CMS, determining which ofthe MECT criteria are applicable to the Care Management project and

certification effort.Meeting all MECT criteria applicable to the Care Management solution'

Collaborating with the State in developing a tailored CMS Certification

Checklist, based on the CMS Certification Toolkit for those processes

supported and impacted by the Care Management Solution.

Supporting the State in all discussions with CMS regarding certification

related to the Care Management solution'Developing and executing required and suggested remediation efforts to

The Contractor isi.

ii.iii.

iv.

vi.

vii.

viii.

Srarn or vnnvroNt, coNtnacr FoR prnsoNar, snnvrcns p,rcn 50 or 26gDBplRrvrnNT oF vnnuoNr Hn,tr,rrr Accrss coNrnacr # 2g739EQHnalrn SolurroNsr INC. AunNounnr # 2

achieve certification.ix. Assisting the State in preparing certification documents and reports related to

the Care Management Solution.x. Participating in the in-person or virtual review with CMSxi. Responding to CMS post-review questions and comments

The Contractor is responsible for preparing all documentation and operational examples todemonstrate relevant criteria are met and Care Management Solution operations address allbusiness functions and performance standards and business model expectations for certification.The Contractor will participate in preparation and planning sessions prior to the certificationreview and will participate during the virhral or in-person review with CMS. The Contractor willhelp the state with mitigation of questions and findings CMS delivers to the State after the review,until all outstanding questions and action items are resolved to CMS' satisfaction.

A subsystem certification checklist will be developed in collaboration with the State for theproposed Care Management Solution as a baseline gap analysis to .determine the scope of workrequired to meet certification. The Contractor will ensure all related Contractor's Systems reviewcriteria specified in the Federal and state laws and regulations are met.

The Contractor will provide its strategy and plan for CMS Certification activities with sufficientdetail to convey alignment with the State's plan, a thorough understanding of the process, and keypoints leading to review. This deliverable will include the Certification plan with work activities,and a Microsoft Project Plan.

The Contractor will provide Evidence Packages with appropriate descriptions, development Sprintnumbers, deployrnent release notes, defect resolution, system documentation, reports, test cases,test scenarios, testing results production compliance evidence and screenshots, along with anyother pertinent information relative to the development, testing and deployment of productfunctionality. Requirements traceability will demonstrate upstream and downstream linkages,including mapping to the RFP and through all fully executed change requests.

The Contractor will support the State in all discussions related to this subsystem. The Contractorwill author all required documentation and create operational examples to demonstrate all criteriafor certification, while making sure the Contractor's System meets or exceeds performancestandards and business model expectations. Any issues identified during this certification processthat are associated with the Care Management System will be immediately remediated by theContractor's team through change management process. The Contractor will collaborate with theState and CMS to understand the deficiency and develop the plan to correct it based on theirsuggestions.

I. MAINTENANCE REOUIREMENTS1. Production Support and Transition

The Contractor shall follow ITIL V3 service management methodology as is described in detailSection G, (subsection 6.a.ii) System Administration and Support.

Sr^c.rn or VnniuoNt, CoNtrucr FoR PnnsoNar, SnnvtcnsDnpl,nrnnnNT oF' Vnnvroxr Hnu,rn AccnssEQHn.lr,rn Sor,uuoNs, INc.

^. Integrated Support ModelThe Contractor's services will include callJogging, management, monitoring, and maintenance.

Inherent components are:

i. Tiered Supportii. Service p-rformance at each tier base-lined, monitored, measured and reported

iii. Change management Processiv. Continualserviceimprovements

The support to be provided by the Contractor is indicated by the table below:

b. TransitionThe Contractor is responsible for planning and coordinating resources to ensure specifications for

the deployed Contraitor's System are realized to identifr, manage, and limit risks that could

intemrpt ihe system in operation. The Contractor will fully coordinate resources required to

successfully deploy and operate the System

c. Pre-Transition PlanningThe Contractor will engage the State Authorized Representatives to acquire an approved project

transition plan.

Transition Due Diligence is performed by the Contractor and all artifacts shall be documented.

Resource coordination will identiff, streamline, fit, and track across the capacities of people,

procedures and tools the Contractor will provide and consume timely information. The Contractor

will align resources to generate the targeted outcomes of the deployment.

PAGE 51 or 268

CoNrRr.cr # 28739AvrnNnmnNT # 2

Level ofSupport

Highlight of each Level

Database (DB)], and standard request fulfillment. For more complex requests, the

Ll teams shall defer to L2lL3 teams

) Focus on enhancing the SOPs and KBs through the course of the engagement to

ensure increased fulfillment of requests at this layer

Ileveraging

tandardsS Practiceofveti8x5 and P)-(soShall repeticoverage perfolmprovideBaseofresolution elTOrSknown (KB)acJibased Knowledgevities,

Level l

fixes/workarounds, root cause analysis, KBs

/SOP creation for repetitive incidents and enhancement of Knowledge Management

artifacts

) Staffed with functional specialists with knowledge of applications and associated

business processes with experience in direct business interaction

) Service restoration through temporaryLevel2

) Permanent fixes, application strengthening, continuous service improvement

) Dedicated team with technology-baged sharing across applications

) Staffed with application developers'and technical analystsLevel3

srarn or vrnvroNr, CoNrnacr FoR pnnsoNu, SnRvrcns pacn 52 or 26gDnpaRrryrnNT oF vnnuonr Hn.lI,rn Accnss coNrnncr # 2g739EQHnllrn Sor,urroNso INc. AvrrNnvrBNr # 2

A Configuration Management System will be available for all stakeholders to reference themodel/profile of each component of the Contractor's System.

The Contractor's timing will be represented in terms of schedules where lead-time will be providedfor accommodating anticipated stakeholder impacts of the deployment as it progresses from designto implementation to production.

d. TransitionThe Contractor will have its Subject Matter Experts (SMEs) travel to the State's preferred locationfor the transitioning of all required knowledge elements to State staff or designated entities.

Information regarding usability, supportability and operational requirements with both deploymentevent and aftermath will be coordinated with the State by the Contractor. A combination ofscheduled and on-demand information delivery regarding the service deploynent will beestablished and maintained for stakeholders, organized for User-friendliness per the stakeholder'srespective role. ,A.. knowledgebase (KB) will be generated during the Transition phase.

e. Steady StateThe Contractor's transition teams will provide support during the Service Stabilization period thatimmediately follows 'Go Live' (also referred as Steady State) to ensure a smooth and trouble-freemove from transition to maintenance and operations mode.

2. Service Level RequirementsThe parties hereby agree that the State shall pay avaried service charge based upon differentlevels of performance by the Contractor, as set forth in the table below. Under no circumstancesshall the paynent of a service credit hereunder relieve the Contractor of its obligation to addressand fix system defects or other performance issues pertaining to a service level requirement orany other obligations under this Contract. The State shall have the right to terminate thisContract for cause whenever Contractor's successive or accumulated service level failuresamount to "Chronic Under-Performance", which is defined as any of the following occurrences:

(A) Four or more of the SLRs numbered 1 through 9,15,76 or 17 are not met in a single month;or(B) Four or more of SLRs numbered 10 through 74 are not met in a calendar year; or(C) The same SLR is not met for three (3) times within a rolling 12-month period.

SLR Number andName

Service Level Requirement

After deployment of Release 1, Contractor shall monitor andreport monthly on the following SLRs numbered I through

7b, 9, and 15 throush 17

ContractorAssessment ofService Credits(sc)

SLR 1

Online AvailabilityThe components of the Solution under Contractor control asdelivered into production shall be available 99.75%. Theavailability percentage will be verified with evidence from theContractor.

Scheduled maintenance will be allowed with the prior approval ofthe State of Vermont (SoV). An ongoing monthly maintenanceschedule requires just one approval. Additional scheduledmaintenance requires SoV approval at least 2 business days in

[$ 5000.00] for eachtenth ofpercentagepoint below thecontracted level ofavailability

Sr,trr or VsRMoNt, CoNtru,cr roR Pnnsoxar, SnnvlcnsDnpantvrnNT oF VnrunoNr Hnlr,rn AccnssEQHnlr,rn Sor,urronso INc.

P^lcn 53 or 268

CoNrru.cr #28739AvrnNnvrpNr # 2

advance. Scheduled maintenance should occur outside normal

business hours.

SLR 2Online Search andLookup QueriesResponse Times

The Contractor's System response time during operations will be

5 seconds or less for 95 percent ofthe search and lookup queries

(does not include ad hoc queries and analytics). Maximumresponse time for search and lookup queries will not exceed 15

seconds except for agreed to exclusions. The Contractor shall

investigate tickets from SoV that report response times exceeding

the maximum response time and provide an analysis to SoV.

The system response time is defined as the time it takes for the

server to serylce a

[$500.00] per 0.5

seconds that themonthly averageresponse timeexceeds themaximum response

time. Seconds willbe rounded up to thenearest 0.5 ofasecond.

SLR3Dashboard ReportResponse Times

The Contractor's System shall return each Dashboard report(main, patient, provider, etc.) within 5 seconds or less, 95% ofthe time.

For each dashboard

[$ 500.00] per 0.5

seconds that themonthly average

response timeexceeds themaximum response

time. Seconds willbe rounded up to thenearest 0.5 of asecond.

SLR 4Static StandardReport ResponseTimes

The Contractor's System shall return a Static Standard report

within 5 seconds or less, 95% of the time.[$ 500.00] per 0.5

seconds that themonthly averageresponse timeexceeds themaximum responsetime. Seconds willbe rounded up to thenearest 0.5 ofasecond.

SLR5Parameter-basedReport ResponseTimes

The Contractor's System shall return a parameter-based report

within 20 seconds or less, 95% of the time.[$ 500.00] per 0.5

seconds that themonthly average

response timeexceeds themaximum response

time. Seconds willbe rounded up to thenearest 0.5 ofasecond.

SLR 6

Online ApplicationResponse Times

The Contractor's System shall achieve performance forinteractive transactions other than the reporting-relatedtransactions above, conforming to the minimum acceptable

performance standard of 5 seconds response time, for 95% ofinteractions.

[$ 500.00] per 0.5

seconds that themonthly averageresponse timeexceeds themaximum responsetime. Seconds willbe rounded up tb thenearest 0.5 ofasecond.

Srarn oFVERMont, CoNrucr F,oR pnnsoNnr, SnnvrcnsDnp,tnrvrnNT oF VnnuoNr Hnar,rn AccnssEQHrar,rn Sor,uuoNs, INc.

Pacn 54 or 268CoNrnncr #28739

AnarNounNr # 2

SLR 7aSoftwareMaintenanceRequestResolution Times:*Severity 1 -Emergencv

The service provider must resolve (i.e. find and deploy the finalsolution to Production) Severity I Maintenance requests within 4hours.

[$5000.00] per houror portion ofan hourbeyond the 4-hourtime requirement.

SLR 7bSoftwareMaintenanceRequestResolution Times:*Severity 2 -Urgent

The service provider must resolve (i.e. find and deploy the finalsolution to Staging) Severity 2 Maintenance requests within 24hours.

[$ 2000.00] per houror portion ofan hourbeyond the required24-hour timerequirements.

SLR 9 SubmittedTicket ResponseTimes toSubmitters

Tickets submitted by a user of the Contractor's system shall becategorized by the Defect Triage Group and a response(containing information related to the categorization) shall be sentto the ticket submitter. These tickets may be categorized asDefects, User Education issues, Change Requests, Governanceissues, SoV data issues, etc. Each ticket shall be response to, viaemail, phone call or automated means, and shall be received bythe submitter within five (5) business days.

[$ 100.00] perresponse sent afterfive (5) businessdays or not sent atall.

SLR 8Quality of CodeDelivered toUAT

Software deployed to the UAT environment for testing shall fixwithout defect the targeted defects for which it was deployed andadditionally not introduce any new defects (i.e. defects notcurrently in the backlog). Otherwise, the SoV may request aProcess Improvement review of the Contractor's UAT deployprocess.

SLR 10Disaster RecoveryRTO

The Contractor's System's Recovery Time Objective (RTO) willbe within 4 hours. In case of a disaster that affects the CareManagement operations, the entire service will be restored within4 hours.

[$ 500.00] per eachl0 minutes or part of10 minutes over theRTO.

SLR 11

Disaster RecoveryRPO

The Contractor's System's Recovery Point Objective (RPO) willbe no more than I hour ofdata loss. In case ofa disaster thataffects the Care Management operations, I hour of data inputs tothe Contractor's System (but no more) may be lost and needs tobe re-entered

[$ 500.00] per eachl0 minutes or part ofl0 minutes over theRPO.

SLR 12Record Retention

The Contractor's System shall include the capability to maintainall data according to State-defined records retention guidelines(i.e., record schedule). General schedules can be found at:https : //www. sec. state.vt.us/archives-records/iecords-mana gement/records-retention/general-record-schedules. aspx.Agency records schedules can be found at:https ://www. sec. state. vt.us/archives-records/records-management/records-retention /asency-record-schedules. aspx.Specific retention disposition orders can be found

[$ 100.00] per recordinstance out ofcompliance with thedefined retentionschedule.

After the start of the UAT phase for each Release, Contractorshall monitor and report monthly for the following SLRsnumbered 8

Contractor shall moaitor and report annually on the following


SLRs numbered l0 l4


SLR Number andName

ContractorAssessrnent ofService Credits (SC)

SLR Number andName

ContractorAssessment ofService Credits (SC)

Srnrn or VnnvroNt, CoNtru.cr FoR PrnsoN,l'r, SrnvrclsDnplnrurnNT oF VnnvIoNr Hnnl,rn AccnssEQHnu,rn Sor,urroNs, INc.

Pacr 55 or 268Coxrnacr #28739

ANrnNrivInNr # 2

at https ://www. sec.state.vt.us/archives-records/records-managemenVrecords-retentiolvdisposition-orders. aspx.

In general, record retentions range from 3 to l0 years. In addition

to the above, note that case records including Child Support-

related data must be retained for a minimum of 3 years after Case

closure and the youngest child in the case is 18 years old.

SLR 13

DocumentRetention

The Contractor's System shall the capability to maintain

all images and electronic documents according to State-defined

document retention guidelines (i.e., record schedule). General

schedules can be found at:

https://www. sec. state.vt.us/archives-records/records-mana gemenVrecords-retention/general-record-schedules. aspx.

Specific retention disposition orders can be found at:

https ://www. sec. state.vt.us/archives-records/records-mana gement/records-retention/disposition-orders. aspx.

In seneral. document retentions range from 3 to 10

[$ 100.00] per

document instanceout of compliancewith the definedretention schedule.

SLR 14

Online CaseRetention

The Contractor's System shall provide on-line access of all active

cases and up to 12 months for closed cases.[$ 100.00] per case

instance out ofcompliance with thedefined retentionschedule.

SLR 15Eligibility RulesModifications

Tickets submitted by a user of the system that request one ormore supported modifications to the Eligibility Rules shall be met

within 15 business days. To meet this SLR, eQHealth shall make

the modification available for SoV testing by deploying it to the

UAT or Staging environment. Supported modifications follow:

1) Change the Order of execution of existing Eligibility Rules;

2) Make an existing Eligibility Rule ACTIVE;3) Make an existing Eligibility Rule INACTIVE;4) Change content of an existing Eligibility Rule;

5) Delete an existing Eligibility Rule;6) Add an Eligibility Rule;7) Update the View current Eligibility Rules;

Upon completion of the ticket eQHealth shall email SoV the

updated VCCI Eligibility Rules file reflecting the change(s)

made.

[$ 100.001Perbusiness day orportion of a businessday exceeding thespecified limit of 15

business days.

COMPLIANCEPROCESS1) Within 5 businessdays of the ticket'ssubmissioneQHealth and SoVshall meet to beginevaluating the ticketand the work neededto complete it. 2)Once that evaluationis complete, theticket's status shallbe changed to "AtDevelopment",which serves as thisSLR's Start time. 3)The ticket's End timeshall be tentativelyset once themodifications havebeen made in theUAT or Stagingenvironment. 4)Once SoV verifiesthe modifications are

correct, the tentativeEnd time becomesthe actual End time.

Srarn or VnnvroNt, CoNtRl,cr FoR pERsoNAL SnnvrcnsDnpantvrnNT oF' VnnvroNr Hn,tr,ru AccnssEQHnllrn Solurrolvs, INc.

Pacn 56 or 268CoNrru,cr # 28739

AvrnuounNr #2

However, if SoVtesting finds an issuewith themodifications, theclock resumes andsteps 3 and4 arerepeated.

SLR 16LetterModifications

Tickets submitted by a user of the system that request one ormore existing letter modifications shall be met within 5 businessdays. To meet this SLR, eQHealth shall make the modificationavailable for SoV testing by deploying it to the UAT or Stagingenvironment.

[$ 100.001perbusiness day orportion of a businessday exceeding thespecified limit of 5business days. Theticket's End timeshall be tentativelyset once themodifications havebeen made in theUAT or Stagingenvironment.

SLR 17Incident Reports

An official Incident Report, required for all Severity I andSeverity 2 incidences, shall be submitted to key SoV stakeholders(Business, QA Test Lead, Project Management, Technical Lead,etc.) within 15 business days of the immediate resolution of theincident. An official Incident Report will contain at a minimumthe following: (1) Incident Number and Priority; (2) Reporr Date;(3) Type of Incident; (4) Impacted Area(s); (5) Resolution Status;(6) Resolution Details; (7) Point of Contact Information; (8) RootCause Analysis, including Corrective Actions; (9) Conclusion.

[$ 100.00] perbusiness day orportion of a businessday exceeding thespecified limit of 15

business da)rs. Timedetermination willbe taken from therecorded End time ofthe JAMA ticket (forthe incident) and theemail dateltimestamp sent to theSoV keystakeholderscontaining theattached IncidentReport.

Defects uncovered during User Acceptance Testing (UAT) and in Production will be categorizeddue to Severity. Severity is determined by the relative importance and re3ponse time requirementsfor the type ofdefect encountered.

Production Defect Severitv Response RequirementsSeverity 1 4 HoursSeverity 2 24 HoursSeverity 3 - 5 N/A. These defects are to be prioritized (see Priority Level definitions) jointlyby the State and the Contractor and scheduled accordingly for investigation, correction anddeployment into production.

Defect Severity Definitions :

i. Severity I .- A complete loss of service, the customer's business operations are halted, or acritical system failure that impacts the entire user community and no workaround is possible.

Srarn or VrcnuoNt, Colttru.cr FoR PnnsoNar- SnnvlcBsDnpanrunNT oF VnnvroNr Hn,c.LrH AccESS

EQHo.rlrn Sor,uttoNs, Inc.

Pacn 57 or 268

CoNrnacr #28739AvrnnounNr # 2

ii. Severity 2 - Service is degraded, resulting in a loss of major functions for a substantial

portion of the customer's user community. The customer's business operations are severely

ii-it.d though the customer may do some work. A workaround may be possible.

iii. Severity 3 - Service is functioning but with a loss of minor functions to a limited number ofusers. The customer's business operations can continue due to a temporary workaround.

iv. Severity 4 - Service is functioning but one person is experiencing a problem. The

customer's business operations are unaffected.

v. severity 5 - Defect is a cosmetic issue. warranty Requirements

The Contractor shall be responsible for fixing any elrors that occur during the first Contract year

and the two subsequent Contract years following the State's acceptance of each release deployed

at no additional cost. The Software Warranty period applies to all "corrective" maintenance /reactive modification of the Contractor's System performed after completion of deployment to

correct discovered faults with any functionality within the scope of original software development

efforts. All such fixes are required to occur in a reasonable timeframe (depending on severity as

defined above in Section I, subsection 2. Service Level Requirements) and shall be produced at no

additional cost to the State of Vermont.

The Contractor shall provide two (2) years of Application Warranty following deployment of each

release at no additional cost. The Contractor shall provide the equipment needed to support its staff

for duration of the project. The Contractor shall be responsible for the root cause analysis activities

to demonstrate whether a defect is related to the scope of functionality delivered by the Contractor.

The Contractor will meet Service Level Requirements by proactively reviewing performance

indicators on a daily basis, and immediately taking corrective action when an indicator is not in

compliance.

The Contractor will provide all prescribed warranties as outlined to cover any defects directly

related to the upprorr.d final scope and associated technical requirements of each release phase.

Any defects discovered during the warranty period will be remedied at no additional costs to the

State.

The Contractor will comply with all State warranty requirements.

3. Maintenance & OPerationsThe Contractor will provide a Base Software Maintenance period to begin with confirmation from

the State that the project deployment has been successfully completed and ending five (5) years

starting two (2) months prior to Release 1 go-live date. Two (2) one-year optional extension

periods must also be provided. The five (5) year agreement will be subject to annual review and

renewals. The State, at its discretion, may conduct a market pricing survey to determine if the

current pricing affangement is in the best interest of the State. Based on the results of third party

,rr*"yr, the State rnay choose to negotiate different terms or pricing with the Contractor. The

Software Maintenance periods include "adaptive" maintenance / modification of the Contractor's

System performed after completion of deployment to keep the Contractor's System usable in a

"hutrg"d or changing environment, and "perfective" maintenance which is modification of the

srarn or vnnvroNr, coNtnrcr FoR pnnsonar, snnvrcns pacE 5g or 26gDnp.q.nrunNT oF Vnnvroxr Hnar,rn Accnss Coxrru.cr # 2g739EQHnar,rn Sor,urroNs,INc. AvrnNovrnNr # 2

Contractor's System after completion of deployment to improve performance or maintainability.During this period, the Contractor shall be in charge of Software Maintenance, and optionaliyhosting and operating the Contractor's System and providing Disaster Recovery services.

The Contractor must provide Base Software Maintenance period to begin Release 1 go-live. TheContractor shall communicate and document all software faults that are not part of the scope ofthe original development effort during the Software Maintenance period. For all Contractor Systemenhancements (over 20 hours of effort) that are not part of the original scope, the Contractor shallanalyze the changes and provide cost estimates for performing those changes to Vermont AHS.

The Contractor will provide two (2) one-year optional Software Maintenance periods at theexpiration of the initial five (5) years of Software Maintenance period. The State shall be able toexercise its option to sign-up for services similat to those offered in the initial softwaremaintenance period.

a. Production Support StaffThe Contractor must provide:Ongoingmaintenance and support services, including a flexible and scalable approach to providingthe various types of personnel, including:

1. Architect2. Business Analyst/Functional Lead3. Change Management Lead4. CommunicationA.{etwork Specialist5. Database Administrator6. Database Designer7. Help Desk Specialist8. Hardware Specialist9. Operations LeadlManager10. Project Director11. Project Manager12. Programmer13. Quality Assurance Manager14. Security Systems Engineer15. SystemsAdministrator16. Technical Writer17. Test LeadlManager18. Tester19. TrainingLeadlManager20. Training Specialist

Termination Assistance Services strategy will include documentation and knowledge transfer toVermont AHS which may include other subcontractor(s).

Contractor's System operations support, including the levels of support offered and the process forrequesting support. In addition, the Contractor will provide a sunmary of the proposed strategyfor maintaining and repairing the Contractor's System:

i. Base Software Maintenance Period.ii. Incident and maintenance request reporting.

Srarn or VnnvroNt, CoNtru,cr FoR PnnsoNl't, SrnvrcnsDrpLnriunNT oF VnnuoNr Hnar,ur AccnssEQHn.llrn Sor,uuoNs, INc.

iii. Optional Extension Software Maintenance Periods

Pacr 59 or 268

CoNrnq.cr #28739AvrnNrvrnNr # 2

The Contractor will ensure due diligence in personnel selection by following a two-stage filtering

process for selecting the project staff which includes:1. Round I - Review by Care Management SMEs within Healthcare SME.

2. Round 2 - Review by Contractor Account Director.

The Contractor's Project Manager shall be responsible for the smooth on-boarding of Team

Members as per the program guidelines. The on-boarding process orients a Team Member to:

i. The general industry trends and news related to the program sponsor.

ii. The program's objectives, scope, and existing related information (e.g., PMP).

iii. The current status of the program.

iv. The program's overall otgarization strucfure

v. The program time and expense guidelines.

vi. For Team Members who travel, program travel,lodging and per diem guidelines.

vii. overview of the program's standard operating procedures.

viii. The approved process to request access to building and computing facilities'

ix. Orientation to the Team Member's project/sub-team'

x. Specific duties and expectations of the new Team Member.

xi. Detailed review of the tools and procedures the Team Member will execute to perform

required duties.xii. Overview of Program Sponsor's security and confidentially requirements.

xiii. Any other information required by contractual or compliance obligations.

The Contractor's Project Manager, in coordination with the Team Member, is responsible for

identifying the training needed to improve a Team Member's skills as required by the program.

The following are the Termination Assistance activities that will be carried out by the Contractor

to mitigate ttre transfer risk as much as possible while accomplishing the very important task ofknowledge transfer.

The Contractor team will identify relevant knowledge areas in close co-ordination with Vermont

AHS teams to identify the skills that have to be disseminated. The following kind of training, but

not limited to, will be provided as necessary:

l. lrain the Trainer-This mode of training enables State designated trainers (Core

Ieam) to gather User level knowledge regarding the application. Once trained,

it is their responsibility to train rest of the State Users. However, should the

State need Contractor team's services to train all of its lJsers, the same can be

made available to the State, through a Change Request'

2. Application Administration training-The core members of the State's team are

imparted Application Administration training. Contractor team trainers impart

training on the operational procedures.

3f#'#r:{,i;i:rlxilift Ji:trii:::r,il'"'"fi ;:ffix''.H"'.T',ir:;

p"rrf,"ctive and become ready to support the application in due course.

srarn or vBnvroNr, coNrnncr FoR pnnsonn Snnvrcns pacn 60 or 26gDnp.lnrunNT oF VrnvroNr Hnar,rn Accnss Coivrucr # 2g739EQHr,tlrn Sor,urroxs,INc. AvruNovrnNr # 2

b. SystemAdministrationThe Contractor's System shall automatically collect events logs from each system and store theinformation in a centralized database for a period of 90 up to 365 days, at which time they arepurged from the system. Log files will be archived to a different data store, if needed, beyond thespecified time period. After the logs files are collected, the Contractor will perform eventcorrelation and analysis for security related events and will send alerts when certain thresholds aremet.

The Contractor will keep a history of changes made to the Contractor's System over time and willrapidly respond to and address performance issues across our entire Contractor's System softwareportfolio. The Contractor's System shall provide advanced drill down reporting, dashboards andcustomized alerts to provide a single viewpoint for not only the State, but the Contractor's supportand technical personnel to proactively monitor application performance. The Contractor's Systemshall have the ability to capture Web page response times from the State end point down to thebackend database calls, application exceptions and much more, the Contractor will ensure theentire Contractor's System meets or exceed the agreed upon SLAs

The Contractor will monitor Web requests end-to end, monitor IIS application pools, web siteavailability, load balancing status, IIS logs and Windows events for all production Web sites.When one of the thresholds for a monitor is exceeded, alerts will be automatically sent to theappropriate staff and depending on the nature of the alert, a scripted action such as restarting anIIS application pool is automatically triggered.

The Contractor's System shall, at a minimum,utilize public key/private key encryption SecureSocket Layer (SSL) certificates , a 4096-bit key length with 256-bii encryption strength issued bya trusted Certificate Authority, for website security.

The Contractor's System shall be capable of Single sign-on (SSO) integration to any LightweightDirectory Access Protocol (LDAP) compliant repository for authentication.

The Contractor's seryer, network and database maintenance will be performed on a monthly basis.A four-hour maintenance window will be preiuranged for the 3rd Wednesday of each month. TheContractor will work with the State regarding maintenance and maintenance windows.

The Contractor's public facing servers will be located in Demilitarized Zone (DMZ). The DMZnetwork will be configured with limited connectivity to the internal resources. The use of accessrules for the servers in the DMZ will only allow traffic configured for specific IP address and portnumber to segregate traffic from the internal network. Remote access will be handled by virtualprivate networks (VPN). The firewall will perform deep packet inspections on VPN traffic withthe use of gateway anti-virus, anti-malware and anti-spyware protection.

The Contractor's System shall provide a User friendly Web based security administration modulethat allows authorized State system administrators to self-service manage granular authorizationprofiles specific to each User. All User accounts will be created with a uttiqrr. Ur"rname and strongpassword. Passwords require a change at a minimum of 90 business days and will be configuredat the State level to be changed on a more frequent basis.

The Contractor's securitymodule will provide a User's restriction to specific memberpopulations.Security administrator will grant access to one or more "Groups" that are named entities within a

Sr,c.rn or VnnvroNto Coxtru.cr FoR Pnnsonar, SnnvrcnsDEpARTMENT oF VpnvroNr Hn.c.LrH AccnssEQHnnlrn Sor,uuoNs, INc.

Pacn 61 or 268

CoNrnlcr # 28739AurnNnvrnNr # 2

State Program. Users will then be assigned specific roles (care coordinator, coach, MD reviewer,

RN, customer service, etc.). A particular User may have one role assigned in a given group and a

very different role in another depending on things like resource needs, credentials, working

privileges etc. Roles may include permissions such as delete, add, make determination, edit/view,

and search functionalities and many more.

c. Data and Document RetentionThe Contractor will implement and comply with industry standard backup procedures and

Vermont AHS' backup requirements, as well as Vermont AHS' record and document management

policies. The Contractor's System data (images, letters, and databases) will reside on the latest

technology which provides data safeguarding, backup time, recovery and operational efficiencies.

All data will be backed up near real-time and will be capable of any required Recovery Time

Objective (RTO) or Recovery Point Objective (RPO) to be defined by the State.

The Contractor will enable resource consuming activities to be offloaded from the virtual host

servers to the storage system to improve resource utilization and performance. The Contractor's

System shall create a near-instant, file system consistent, point-in-time copy or snapshot of the

individual virtual machine and the entire datastore on which the virtual machines reside. After the

snapshot is created it is then automatically replicated to another datacenter for disaster recovery

purposes. The Contractor will be able to restore virtual machines at a gtanular level; virtual

machine, entire virtual machine datastore or virtual machine disk.

For backup and recovery of databases, the Contractor's System will be configured for hourly, near-

instant, point-in-time snapshots of the database and the Logical Unit Numbers (LUNs) on which

the database files are stored. The Contractor will verify the snapshot for consistency and finally

replicates a copy to an offsite datacenter. The Contractor's System shall support both up to the

minute and point-in-time recovery methods through the automated replaying of transaction logs.

A clone or copy of the production database will be used to recover missing or deleted data without

having to restore a production database.

All data volumes will be protected. Each volume will be configured forhourly, near-instant, point-

in-time snapshots of the entire volume. The snapshots will be replicated on a nightly schedule to

another datacenter for disaster recovery. The User-driven recovery model will allow for Users to

recover single files or entire directory structures almost instantaneously.

The Contractor will maintain an effective records management program that will meet all State

requirements for record security, retention, privacy protection, and disposition. The Contractor

will employ registered health information administrators (RHIA), who participate in the

development of corporate records management policies and procedures and oversee

implementation of all protocols for intake, routing, tracking, storage, transfer and disposition and

ensure compliance with HIPAA regulations as well as all contractual requirements.

surn orvnnvroNro coNrnacrFoRpERsoNAL snnvrcns pacn 62o126gDnplnrvrnNT oF vnnvroNr Hunr,rn Accnss coxrRlcr # 2g739EQHw,rn Sor,urrons, INc. AwrnNlivrnNr # 2

The Contractor's HIPAA compliance program must be comprehensive and include all requiredprivacy and security regulations. The Contractor will comply with all HIPAA requirements,specifically the administrative simplification provisions of the law and the associated rulespublished by HHS, the DoD Health Information Privacy Regulation (DoD 6025.19-R), the HIPAASecurity Compliance Memorandum (HA Policy 60-010), and the Security Standards for theProtection of Electronic Protected Health Information. The Contractor's policy must cover papersecurity, access to data processing resources, passwords and security incident reporting, softwarelicensing, remote computer usage, virus, e-mail and application development securityconsiderations. In addition to policies and procedures for data system access, the Contractor willhave also developed and implemented policies and procedures for maintaining security andconfidentiality of patient medical information, review data, and any other data identified asindividually identifiable. Each employee is required to review and sign confidentiality protocolupon employment and receives annual documented training to maintain security awareness andpolicy.

The Contractor will employ a fulltime staff of highly qualified systems engineers experienced inmanaging state and federal contracts under the Federal Information Security Management Act(FISMA). The Contractor must develop, document, and implement a corporate wide program toprovide security for the information systems in support of operations and assets.

il. System Managementi. Application Monitoring

The Contractor's application monitoring services will ensure the Contractor's Systemmaintains a high level of availability and performance for the State and its Users. TheContractor's ITIL V3 based approach will emphasize the importance of a continual cycle

. of monitoring, reporting and subsequent action in the case of availability and performancerelated exceptions. The Contractor's primary goal will be to reduce down time throughmonitoring and management at first level (Level 1) as outlined in our Integrated TieredSupport Model.

The Contractor shall:1. Reduce downtime through monitoring availability and performance of

applications.

2. Resolve an incident before it can impact the business (proactive detection andresolution), thereby moving from reactive to proactive Service Delivery.

3. Provide insights through trend analysis of ticket / event data (dataanalytics) inorder to achieve suppression ofevents / alerts.

4. Detect unauthorized changes and ensures organizational compliance.

5. Integrate operations center at level l, thereby considerably improvingoperational effi ciency.

6. Automate repetitive manual monitoring tasks, for example manual "ready-for-business" checks.

Sr,trn or VnnuoNt, CoNtnacr F'oR PERSoNAL SrnvrcnsDrplnrvrnNT oF VnnvroNr Hn,qltH AccnssEQHnnlrn Sor,uuons, INc.

PacB 63 or 268

CoNrru.cr #28739AunNuuBNr # 2

7. Eliminate noise or false-positive application events through root cause fixes or

by optimizing event threshold levels.

8. Implement advanced monitoring techniques resulting in the reduction of mean

time to detect major incidents.

ii. ActivitiesThe Contractor will:

l. Monitor the availability of applications, related interfaces and infrastructure at

Level 1.

2. Monitor the availability of related databases at Level 1.

3. Ensure application performance is within acceptable levels as defined in SLAs..

4. Continuously monitor various application events and logs.

5. Manage events with automatic generation ofAdministrative Alerts and dispatch

through most effective means (text, Email etc.).

6. Report exceptions and create incident tickets for the same.

7. Resolve incidents where there is a KB match and escalate unresolved incidents

/ issues toL2 lL3 as per the SLA time frames via escalation procedures.

8. Monitor performance and capacity of applications and underlining

infrastructure against the baselines.g. Validate and correlate events generated either through emails or application

monitoring systems.10. Raise Incident with the relevant service catalog owner in case of an

infrastructure issue.

11. Notify the State on the infrastructure incident and resultant application

unavail ability (if anY)

12. Follow up with the service catalog owner to restore the services.

13. Analyze the corresponding incidents and give feedback to the State.

t4. Provide hand-offs with the Level-2, Level-3 application and Infrastructure

teams.

iii. Process OverviewEvent correlation - The Contractor shall correlate events to integrate the management ofalerts from multiple systems including applications, infrastructure, network etc', in a

coherent manner thus reducing false positives and prioritize citical events. Through the

intelligent rules and the topology information of the environment, the Contractor's event

correlation engine will be able to diagnose the root cause of failures and create exceptions

for the same.

Run Book Automation -The Contractor shall create a routine compilation of procedures /workflows which will contain the steps to begin, stop, and supervise the application system.

An effective run book provided by the Contractor will allow analysts, with prerequisite

expertise, to effectively manage and troubleshoot an application system. Through run book

automation, these processes can be carried out using software tools in a predetermined,

effective and accurate manner.

sr.lrn on vnnmoNr, coNrrucr FoR prnsoNt snnvrcns p.q.cn 64 or 26gDnp,mtmnNT oF'vnnuoNr Hnar,rn Accrss coNrnlcr # 2g739EQHn,llrn Sor.urroNsr INc. AvrnNowrnnr # 2

Proactive pattern analysis and trends - The Contractor shall establish a proactivemonitoring process through trend analysis of incidents / events by means of data analytics.This will help in reducing influx through problem management.

LI Utility Layer - The Contractor's Ll UtilityLayer will result in s5mergized Applicationand Infrastrucfure operations.

iv. Metrics

An end User can initiateContractor's Product S

support via a button provided in the Contractor's System or theupport Services Helpdesk can initiate a session from the

Contractor's helpdesk module by providing an invite link.

v. System Operations Support ServicesThe Contractor's Software Support Helpdesk (SSH) will provide support through directUser and internal stakeholder interaction via phone, email and help desk system. The SSHwill be a one-stop-shop for all software change requests, User assistance, system issues anddata corrections.

The Contractor's staff will be highly trained and be comprised of certified professionalswith real-world experience using the Contractor's products and will know how to resolveissues quickly and efficiently.

The SSH will have .a customer service-oriented directive with a focus on customersatisfaction and service level agreements. Communication will be prompt and accuratewith customers both internal and extemal. Customers will have the ability to engage the

Number of incidents

related to capacity and

performance of the

application

Number of run-books

automated

Number of false positivealerts on vs. total number ofalerts

Number of applications

where monitoring is notautomated

Number of events that

were not auto - ticketedNumber of trend analysisreports generated and acted

upon in a month

Yo avallability ofapplications

Number of events

misrouted due to wrongcategorization

No of newly added eventmonitoring rules to increase

monitoring effectiveness

Transaction time /response time for onlineapplications

Number of event

eliminated throughpermanent fixes (event toproblem management

integration)

Service Metrics Value Add Metrics Service Analytios Metrics

Surn or VnnuoNt, CoNtru,cr FoR PnnsoNx- SnnvrcosDpp.qntvrrNT oF VBnuoNr Hnll,ur AccnssEQHnn lrn Sor,uuoNs, Inc.

P.tcn 65 or 268CoNrn,lcr #28739

AnnnnounNr # 2

SSH through several options including a toll-free phone number, email, or web-based

entry. A11 requests for service will be logged in the corporate helpdesk management system

to enable measurement and easy transition between support staff.

1. Helpdesk Management SYstem

The Contractor's Helpdesk System will allow Users to report, view, and update

incidents. The Contractor's System shall use a work flow status bar to represent

each of the process stages an incident must go through before it is successfully

resolved and closed. The work flow will track the entire process from the

submission of an incident (New) throughout the life cycle until the request is

successfully closed (Closed).

Incident types will be assigned to designate which IT department should handle the

request. In addition, incidents will be prioritized and worked based on severity.

Severity I and Severity 2 defects are to be worked immediately and don't go

through the standard Defect Resolution process. Severity 3 - 5 defects are

prioritized and worked via the standard Defect Resolution process. Priority

assignments are as follows: 1 - critical, 2 -High,3 - Medium, and 4 - Low.

The requestor will be notified by email once the ticket has been resolved. If the

requestor has additional questions after the incident has been closed, the ticket can

be reopened.

Tickets for incidents will include record of the requester, requester's contact

information and the details of the incident.

The Contractor will:1. Maintain automated telephone system to comply with contractual

obligations.2. Maintain website functionality and Contractor's provider helpline module.

3. Ensure adequate staffing for customer service lines proportionate to call

volume.4. Remain available in queue to accept incoming customer service line calls

within answer timeframe.5. Manage operations to ensure contract performance standards are achieved,

and:6. Enable automated response service to be activated, indicating office closure

' from 5:00 P.M.-8:00 A.M. each business day, through weekends and on

state-apProved holidaYs.

7. Enable alternate automated response service to be activated, indicating

close of the office for prior aulhoization/certification line and customer

service calls, after 5:00 P'M., weekends and on holidays.

2. Toll-free Phone SystemThe Contractor will provide a toll-free customer service line. It willbe staffed from

8:00A.M. To 5:00P.M. EST, Monday through Friday, excluding the following

approved State holidays:New Year's Day Martin Luther King Day

Srarn or VnnuoNto CoNrucr F,oR pnnsoN,c,L SnnvrcrsDnpantvrnNT oF Vnnvroxr HnllrH AccnssEQHnu,rn Sor,urroNs, INc.

President's DayMemorial DayBennington Battle DayVeteran's DayChristmas Day

Plcn 66 or 268CoNrucr # 28739

AunNovrnNr # 2

Town Meeting DayIndependence DayLabor DayThanksgiving Day

Customer service representatives receiving a call of a clinical nature or memberspecificprocess issues will perform a warm transfer (remaining on the line until theconnection is completed) to a supervisor who assists the caller.

The Contractor will maintain an automated voicemail message system.1. If a representative is not available within 30 seconds, the caller will be offered

the option of continuing to hold, or to leave a voice mail message that will bereturned on the same business day if received within the last hour of the day.

For calls received outside ofbusiness hours:1. Customer Services line hours of operation will be stated2. Customer will have the option to leave voice mail message that will be returned

within one business day

Performance Standards :

3. System Incident ReportsThis shall contain Summary-level incident statistics and shall be included in theregular project status report. Statistics provided will include:l. Incidents reported by category verses SLAs2. Pass, fail, and in progress defect resolution counts3. Defect categoization and aglng

4. Adaptive Maintenance Reports and Adaptive System Enhancement ReportsThese deliverables shall provide summary-level fix statistics provided inPowerPoint format and included in the regular project status report. Statisticsprovided will include:l. Fixes available for deployment2. Summary test results for proposed deployments3. Short-term (4 week) deployment schedule

Busy signals encountered (blocked calls) None

Call response time (average speed of answer) 90olo answered within 30 seconds

Unanswered calls (abandoned calls) No more thanl0o/o of call volume

Response call to messages (voicemail) Within t hour

Response call to messages (after business hoursvoicemail)

Within 1 business day

Perfonnance Indicator Performance StandardRe Business HoursBusiness Hours

Srlrn or Vnnuoxt, CoNtRlcr FoR Pnnsox-q.L SnnvrcnsDEpARTMENT oF VnnvroNr Hnlr,rn AccnssEQHn.lr,rn Sor,urronso INc.

In addition, detailed release notes in Word format will be made available in

preparation for each release approval meeting. This will include:

1. List of defects to be delivered in this release

2. End-User impact of each defect in business language

3. Cross references to incident tickets4. Test results

The Contractor's support team shall propose releases according to the agreed

maintenance cycle atrd th" availability of fixes for release. Fixes for high-severity

defects can be released on an accelerated schedule with State's approval.

All of the Contractor's System enhancements that exceed an estimated 200 hours

and are not included as part of the original requirements scope and will be treated

as a change order. The Contractor will provide a separate functional requirement

and detailid cost estimate to the State for review and approval prior to performing

the enhancements. All warranty and maintenance periods (Base, Optional)

discussed in Section I, subsection 3 "Warranty Requirements" will also apply to all

approved enhancements'

e. Defect Resolution and Solution Acceptance

The Clntractor's defect tracking and resolution management will assess and prioritize defects.

i. Scope SeverityThe following table provides guidelines for ranking of the Scope of a defect:

Value GuidelinesSffity I - fiomplete loss of service, the customer's business operations are halted, or a

critical system failure that impacts the entire user community and no workaround is possible.

Sbverity-2 - Service is degraded, resulting in a loss of major functions for a substantial portion

of the customer's or". "o*rnrrrrity.

The customer's business operations are severely limited

though the customer may do some work. A workaround may be possible. Severity 3 - Service

is fuictioning but with a loss of minor functions to a limited number of users. The customer's

business opoutiotrr can continue due to a temporary workaround. Severity 4 - Service is

functioning but one person is experiencing a problem. The customer's business operations are

unaffected. Severity 5 - Defect is a cosmetic issue.

ii. PrioritvPriority Level (Production and UAT) definitions

Severity Defects of 3 - 5 are to be prioritized as follows:

priority 1: Critical - Defect should receive immediate effort to fix and deploy to the UAT

environment for SoV testing;

priority 2: High - Defect's prompt resolution is important and prioritized for next

available sprint.

priority 3: Medium - Defect's resolution may be prioritized for a later sprint.

P,lcn 67 on 268

CoNrnq.cr # 28739AvrnxounNT # 2

srarn or vnnuonr, coNrrucr FoR pnnsoNn snnvrcns PAGE 6g or 26gDnp.q.nrMrNT oF VnnvroNr Hnlr,ru Accrss CoNrnacr # 25739EQHnuru Sor,urroNs, INc. Aururunxr # 2

Priority 4: Low - Defect's resolution is a nice-to-have.

iii. Actions

The Contractor will have an established set of action requirements for each range ofcalculated priority value.

The Contractor will follow a process for defect resolution and acceptance:

Defect Discovery - Identification and reporting of potential defects. The informationcaptured here will be enough to reproduce the defect and allow development to determineroot cause and impact.

Defect Analysis & Prioritization - The development team will determine if the defectreport corresponds to an actual defect, ifthe defect has already been reported, and what theimpact and priority of the defect is. Prioritization using the previously described scoringapproach and scheduling of the defect resolution will then managed by the overall changemanagement process for the software development organization.

Defect Resolution -The Contractor's development team will determine the root cause,implement the changes needed to fix the defect, and document the details of the resolutionin the Team Foundation Server defect management software, and will include suggestionson how to verify the defect is fixed.

Defect Verification - The build containing the resolution to the defect will be identified,and testing of the build is performed to ensure the defect truly has been resolved, and thatthe resolution has not introduced side effects or regressions. Once all affected branches ofdevelopment have been verified as resolved, the defect can be closed.

Defect Communication - This encompasses automatic generation of defect metrics formanagement reporting and process improvement pu{poses, as well as visibility into thepresence and status of defects across all disciplines of the software development team. Thedefect log captures and reports all attributes ofa defect for transparency to all stakeholders.

System Acceptance -The defect is thoroughly validated. This is first facilitated by arevised/improved automated test that encompasses the identified defect and passes as wellas a subsequent successful User Acceptance Test. Any related documentation is updatedand the item is then released to production.

iv. Hosting and Disaster Recoverv ServicesThe Contractor's environments will be sized in accordance with planned use and beinclusive of all hardware, storage, networking, backup/restore, database, file system,monitors and other items as required to comprehensively support the effort.

Upon the State's determination that these environments are no longer required, and uponcompletion of any mutually agreed migration and direction from the State, theseenvironments will be decommissioned by the Contractor. Any Contractor hardware usagecharges arising from the use of this equipment shall no longer be the responsibility of, nor

Surn or VBnuoNt, CoNtru,cr FoR PrnsoNu, SrnvrcnsDrplntvrpNT oF VnnuoNr Hn.qlrn AccrssEQHnar,rn Sor,urtoNs, INc.

Pncn 69 or 268CoNrru,cr #28739

AunNuunNr # 2

billed to the State, and all State data or other artifacts resident on this hardware shall be

destroyed or otherwise deleted.

In advance of use, and .in consideration of State procurement, installation and

commissioning cycles, the iontractor will specify all required environments to support the

Contractor's System for the ongoing specification, design, development of the project

associated with subsequent phases including, but not limited to the following

environments:1. Full Production OPeration2. Production Replica for Fault Resiliency / Onsite Disaster Recovery

Purpo ses and defect/issue resolution purposes

3. Off-site Disaster Recovery Replication (see Disaster Recovery Section

below)4. Other environments deemed necessary by the Contractor to support

production oPerations

These environments will be sized in accordance with planned use and be inclusive of all

hardware, storage, networking, backup/restore, database, file system, monitors and other

items as required to comprehensively support the ongoing development operation of the

Contractor'i System as well as to support the debugging or resolution of issues within the

production environment.

Upon notification by the State of receipt of the hardware to support these environments in

the State Data Center, the Contractor shall install, configure and commission for ongoing

use in the project this hardware within the State Data Center should the State select this

option.

As a priced option in Attachment B - Pa5rment Provisions (expressed annually on a

monthly basis) for the ongoing operation of Infrastructure related activities.

The Contractor will specify all required environments to support the Contractor's System

for the ongoing operation of the production system in the event of a disaster or outage

condition associated with the following environments:1. Full Production OPeration2. Systems Development inclusive of then current code bases and associated

data associated with the development effort3. Other environments deemed necessary by the Contractor to support

production operations in the event ofan outage or disaster

These environments will be sized in accordance with planned use and be inclusive of all

hardware, storage, networking, backup/restore, database, file system, monitors and other

items as required to support limited development effort during the disaster or outage

condition as well as to not adversely impact or jeopardize phases that are being developed.

The Contractor's Hosting and Disaster and Recovery Service, as a priced option in

Attachment B - Payment Provisions in this Contract, shall provide the ongoing provision

of a disaster recovery site (not at a state facility) for the solution.

sr,trn or vnnuoxro CoNrucr FoR psnsoNar, snnvtcrs pacn 70 or 26gDrpanrvrnNT oF vpnuonr Hnar,rn Accnss CoNTRACT # 2g739EQHr,rlrn SolurroNso INc. AvrBNovrnNr # 2

The Contractor's computer systems (non-production, production and disaster recovery)will be hosted in premier commercial datacenter facilities in disparate geographicallocations across the country. Each facility will allow delivery of the highest levels ofreliability through multiple-provider fiber trunk access, redundant power sources andmultiple backup generators. The facilities will include 24 X 7 security guards and closed-circuit surveillance video. Access to the datacenter floor will be gained by a two-factorauthentication security system requiring a security badge swipe as well as a biometric handor fingerprint scan. An additional mantrap will prevent "tailgaters" from followingpersonnel into the hosting area. The collocated rack that hosts the Contractor's Systemequipment will have an additional keypad lock to gain physical access.

The Contractor will have isolated non-production environments to support thespecification, design, development and quality assurance of the project. The Contractorwill have training and UAT staging environments that facilitate all release activities. Whena development cycle or iteration includes tangible content, the Contractor will demonstratethat to all stakeholders via web conferencing products or directly from the internet on thestaging environment.

The Contractor's production environment shall have state-of-the-art systems that arestable, always available, with little to no unplanned outages that can be scaled quickly andeasily as the State's needs change. This production environment will have highlyredundant, fault tolerant architecture and topology.

The Contractor's Disaster Recovery (DR) environment shall mirror the productionenvironment in both hardware and software. The Contractor's System shall achieve levelsof recovery time and recovery point SLAs through the Contractor's near real-timereplication from the production environments. Each production environment will have ageographically disparate DR site ensuring that in the event of a catastrophic failure at theproduction datacenter the Contractor can resume operations from the DR site withoutintemrption

All environments will be managed by ITIL service management approach. ServiceDelivery processes will include Service Level Management, Capacity Management,Availability Management and Continuity Management. The Contractor's centralizedservice catalog will capture all information technology within the enterprise. Each servicein the catalog will have its own change management, configuration management and

' service desk policies and procedures to compartmentalize the enterprise into a highlystructured and more efficient operational unit.

J. TURN.OVER/TRANSITION PHASEThe Contractor will develop and execute a Turnover/Transition Out Plan to be approved by theState, as defined in Attachment D of this Contract.

K. Desien. Development and Implementation (DDn & ON-GOING TASK-RELATEDDELIVERABLE(S) & APPROVAL PROCESSAll work must be pre-approved by the State Authorized Representative(s) stipulated under SectionB.

Sr.lrn or VnnvroNt, CoNtucr FoR PnnsoN,c.L SnnvrcnsDnpl,nrunNT oF Vrnnnoxr Hrnr.rn AccnssEQHnar,rn Sor,urroNso INc.

All work must be reviewed and accepted by the State Authorized Representative(s) before the

Contractor may submit an invoice to the State.

Task 0 - Proiect Monitorins and Status Reportile (Recurrine Deliverable)Project monitoring provides a high level timely and accurate picture regarding all key metrics

related to project health. The following are components of the Project Monitoring and Status

Report (referred to as Progress Reports in 11.13 and 11.14 of the Non-Functional Requirements,

Appendix II).i. Financial status (earned value method)ii. Schedule (milestones and tasks)

iii. Issues and risksiv. Change ordersv. Action items

Project monitoring will include periodic reporting of the following activities:i. Graphical status of scope, schedule, and budget (red, yellow, or green)

ii. Status of work completed against the Project Work Plan

iii. Objectives for the next reporting periodiv. State responsibilities for the next reporting periodv. Recovery plan for all work activities not tracking to the approved schedule

vi. Projected completion dates compared to approved baseline key dates

vii. Escalated risks, issues (including schedule and budget), and action items

viii. Disposition of logged issues and risksix. Important decisionsx. Actual/projected Project Work Plan dates versus baseline Project Work Plan milestone

dates

xi. Budgeted to actual budget figures, and estimated cost at completion (or similar forecast

of remaining costs)xii. One-page graphical summary of the Project Work Plan status of all major tasks and

subtasks for each Phase in a Project Plan

Upon project initiation (Kickoff), the Contractor will provide required project status reporting.

A11 quantifiable Key Performance Indicators (KPI) data will be represented in a graphical manner

and the Contractor will provide real-time electronic access to project Dashboards to State

Authorized Users.

ContractorosResponsibilities

o Projectreport card\dashboard (scope, budget &schedule)

o Issues and mitigation plan discussion with State

. Key issues for Escalationo Action items

State's Responsibilities o Define the schedule for recurring ProjectMonitoring and Status frequency

o Raise concems on the project report. Update on the State related action items and issues

Prcn 7loF268CoNrru.cr # 28739

AvrnnrnlnNT # 2

St.trn or Vnnvrout, CoNtru,cr FoR PrnsoNar, SnnvrcesDtplRrunNT oF Vrnvronr Hnalur AccnssEQHw,rn Solurroils, INc.

Location o Conference Call and\or Webinaro Onsite meeting as necessary

Task I - Proiect Initiation and PlanningTask 1A - Project Kick-off Presentation

The Contractor will conduct project initiation activities as well as ongoing project planning andmanagement throughout the duration of the Contract.

Project Initiation will include the development and approval of the formal Project Charter. TheProject Charter encapsulates the formal project description, scope, authoization, business needsand objectives. Key team member introductions and points of contact determined between theState and Contractor for near term tasks. A Project kick-off presentation will be delivered tostakeholders detailing the following:

i. Project Overview (mission, goals and objectives)ii. Projecl Schedule (high level)iii. Project scope (in and out of scope)iv. Project approach (projectplan)v. Objectives and Definitionsvi. Artifactsvii. Project timeline (schedule, budget)viii. Project team roles and responsibilities (project organizational chart and team members)ix. Project management (logistics, governance, meetings, issue management, change

management, change control, issue/risk management, communication plan)x. Keys to successxi. Next Stepsxii. Questions and Answers (Q&A)xiii. Resources

ContractortsResponsibilities

Upon Deliverable disposition (Rejection / Not Accepted)Contractor shall have five (5) business days to resubmit.Organize & moderate the meeting, take minutes and follow-

on action itemsStateo s Responsibilities o Identify the Key stakeholders to participate in the

meetingo Clarify expectations and validate the project scopeo Establish the project single point of contact on the

State side, core team and the extended team for thescope ofthe project.

o The state will complete review of all payment baseddeliverables within ten (1'0) business days.

o Subsequent state reviews of previously rejected / Notaccepted deliverables will be returned withdisposition with five (5) business days.

Location Contractor Office Location

Pacn 72o1268CoNrnq.cr #28739

AvrnNnvrBNT # 2

Surn or VnnuoNt, CoNtm.cr FoR PnnsoN.q.r- SnnvrcnsDBp,qnrvrnNT oF VnnvroNr Hrar,rn AccnssEQHnnlrn Sor.urloNs, INc.

Plcn 73 or 268

Conrnlcr #28739AunNtiunNr # 2

Task 18 - Project Management Plan

The Contractor will develop the Project Management Plan to manage project execution and willdocument the actions necessary to define, prepare, integrate and coordinate the various planning

activities. This plan also defines how the project is executed, monitored and controlled and when

applicable closed. It encompasses several subsidiary plans discussed in the following sections. It

is a tivlng document and is progressively elaborated by updates throughout the course of the

project.

The Care Management Project Management Plan shall address the initiating, planning, executing,

controlling, andilosing processes. The Project Management Plan will consist of the following sub-

plans:

a. Scope Management Plan - This plan documents the project vision and goals, items that are

in-scope andout-of-scope and their prioritization, dependencies between the scope items,

and risks associated with the inclusion and removal of items from scope. The plan also

defines the process used to modi$r project scope.

b. Cost Management Plan - The Contractor is responsible for developing a plan that

indicates how project costs/budget will be incurred, controlled, and reported. The plan must

include the finalized cost and budget for the project. Cost-related progress report formatting

will be developed and included by the Contractor, consistent with AHS requirements and

format, with inputs from State team members, and must include a tracking of costs to the

project budget baseline.

c. niik Uanagement Plan - Development of a Risk Management Plan is required. The

Contractor, with the support of State team members, must submit a baseline Risk

Assessment (800-30 Risk Assessment methodology) to the State's Project Manager withinone (1) month of the project initiation.

d. guaitty Managemeni Plor- The Contractor's plan must have the following elements:

i. Defined qualityassuranceresponsibilities.ii. Detailed definition of all deliverables by project phase and associated acceptance

criteria.iii. Defined deliverable review process.

iv. Disciplined deliverable review process.

v. Regularly scheduled reviews of key project phases and milestones.

vi. Identified target performance areas and proposed methods of measurement,

baseline metrics for the agreed upon goal areas, and the level of achievement of the

performance goals as determined with the State.

e. Human Resource Management Plan - The plan for this initiative will be tied to the

proposed project timeline and phases. The Contractor is responsible for proposing the

potential rolei and responsibilities for staffing the different activities, articulating what the

Contractor will need to provide and what the State should provide.

f. Schedule Management Plan - The plan developed by the Contractor must include the

following:i. How the project schedule will be monitored for variances.

ii. What types of corrective actions will be taken to address schedule variances during

the life of the project.iii. The process, roles, and responsibilities involved in making changes to the project

srarn or vrnuoNr, coNrnncr FoR pnnsoNar, snnvrcns PAGE 74 or 269DnpmrvrnNT oF'vnnmoNr Hnllrn Accrss coNrnq.cr # 29739EQHnn ru Sor,uuoNsr INc. AvrnNuivrnNr # 2

schedule.. g. Communication Management Plan- The plan must detail the varying levels and needs of

the project's stakeholders for information regarding the project, status, accomplishments,impact on stakeholders, etc. As part of Communication Management, issues must belogged and reported bi-weekly and the plan must detail the escalation mechanisms for issueresolution. As part of the Communication Management Plan, the Contractor must alsoaddress Issues Management, wherein an issue is defined as a problem that cannot beresolved with current resources and must be escalated to management or other parties forresolution. Issue management is the process of identifiring, communicating, tracking, andresolving issues throughout the life cycle of a project and in a timely manner. It includescategorizing and prioritizing issues, as well as determining an escalation path for issuesunresolved within a predetermined length of time. It is the responsibility of each projectteam member to identify, communicate, and log issues into an issue list. Issue Managementmust include the processes, tools, and techniques used in issue identification and analysisand must describe how issues are tracked, monitored, reported on, and resolved. It mustalso identify roles and responsibilities throughout the issue life cycle as well as describehow escalation will be initiated if needed.

i. Closure Approach -Upon

the completion of the Base and Extension OperationsPeriods, the Contractor will perform all activities necessary to close out the Project.This includes:

ii. Performing formal Contract closure.iii. Updating process documentation and transferring this to the State.iv. Transitioning any relevant process andlor solution responsibilities over to the State

Project team, or to another contracted Contractor.v. This includes updating and transferring all solution documentation, performing

formal Contract closure, and transitioning any relevant solution responsibilitieiover to the State Project team.

h. Change Management Plan - The Contractor must adhere to the Change ManagementPlan, which will be developed by the Contractor and approved by the State AuthorizedRepresentative(s). The plan describes how the Change Control Board (CCB) will managethe process for review, acceptance and rejection ofchange requests. For any decisions thatcannot be made by the CCB or project management team, the decision will be escalated.In the Change Management Plan, change requests will be:

i. Drafted by the Contractor.ii. Reviewed and edited by the State project Manager.iii. Approved or rejected by the CCB with direction from State management, as

necessary.iv. Implemented by the Contractor, as necessary.

The Contractor must perform updates to the project schedule and cost estimates when changerequests are approved.

Surn orVrnmoNt, CoNtru.cr FoR PsnsoNA'L SnnvrcrsDEPARTMENT OF VNNiVTONT HN.q.LTH ACCTSS

EQIIn.r,r,rn Soluuonso INc.

Contractorts.Responsibilities

Development and maintenance of the following:Scope management planCost management planRisk management plan

Quality management planHuman resource management PlanSchedule Management Plan

Communications planClosure approach

Change management plan

State's Responsibilities Review, comment and approve

Location N/A

Task IC - Project Work plan and fully resourced Schedule

The Contractor will develop a Project Work plan that will include the Work Breakdown Structure

(hereinafter referred to as "WBS"), which decomposes the total project scope into smaller

deliverable oriented components or work packages. The WBS is then sequenced in a Logic

Network or Gantt Time Chart detailing which activity logically precedes or follows another. This

determines critical paths and dependencies of work items throughout the project. The work

packages are estimated to determine the overall project schedule as well as the specific resources

necessary to complete each package.

The Contractor shall maintain and update applicable portions of the Project Schedule no less than

bi-weekly to reflect the current status of the Project with a comparison made to the Initial and

Baseline Project Schedules. The Project Schedule shall be consistent with available State and

contracted project resources. The State resources will be identified by the State and communicated

to the Contractor prior to Schedule development. The State shall have direct electronic access to

the Project Schedule as well as all Deliverables and working papers for immediate review and

coordination of schedules and plans. The Contractor shall document any work plan or schedule

changes from the plan submitted with the Contractor's original Proposal'

The Contractor shall provide a Project Work Plan and Schedule to include identification and

integration of all Phases of the Project, the sequences of the Phases, the duration of the Phases,

andihe duration of the Project. The Contractor will deliver a Project calendar in Microsoft Project.

The Project Schedule shall identiff the resources to be provided by both the Contractor and the

State, together with the scheduled dates those resources will be required. It shall consider State

holidays, holidays that will be observed by the Contractor staff, periods during which the State has

advised that data processing systems will be unavailable to the Contractor, and the resources that

the State has committed to providing in the Contract. The Project Work Plan and Schedule, once

accepted by the State, will form the Baseline Work Plan and Schedule for the overall Care

Management Project. As part of the Project Work Plan and Schedule, the Contractor shall prepare

and submit a WBS that encompasses all activities from Project Initiation and Planning to Project

Closeout. The WBS shall define the Project's overall objectives by identifying all Project tasks

and Deliverables.

Pl,cs 75 ot 268CoNrnq.cr # 28739

AvrnNlvmNT # 2

Sr.trn or VnnvroNt, CoNtnacr FoR pnRsoNar, SrnvrcnsDnpantvrnNT oF' VnnvroNr Hn.rr,rn AccnssEQHnlr,ur Sor,urroNs, INC.

P,q.cn 76or.268CoNrrucr # 28739

AunxonnnNr # 2


Develop and update bi-weekly the following:o Work Breakdown Structure (WBS)o Gantt chart(s)o MS Project calendaro Resource assignments

Stateos Responsibilities Review and coordinate schedule and planLocation N/A

Task lD - Requirements Analysis, system Design and Development strategyThe Contractor will develop a clear understanding of the State's Care Management Solution needsand document them in terms of a strategy document. The Contractor will perform a RequirementsAnalysis throughout the project to gain a clear understanding of the intent, expectations, andconstraints associated with each functional and non-functional requirement. The Contractor willapply the information gathered to the overall project scope. This living document will serve as aguiding document for the development of the Contractor's System. The document will also outlinethe Contractor's methodology to achieving the clear understanding of the project. The Contractor'sprocess will include meetings with appropriate stakeholders and Users to determine therequirements by a system of Q&A to identify utilization, functionality, etc. This process thentranslates into a detailed system design documents that specifies the system requirements andoverall architecture.

The Contractor shall provide a Requirements Analysis, System Design and Development StrategyDocument that includes, but is not limited to, a description of:

i. The business processes and the functionality that the Care Management Solution willprovide. Please note, the State prefers that business processes for the Care ManagementSolution be generated using a Business Process Management tool that will ensure thebusiness processes will be stored and re-used by the State as needed.

ii. The methodology that will be used to:a. Analyze and validate requirements.b. Select, configure, and develop the components of the Solution.c. Create a coherent and integrated system design.

iii. The intended use of Commercial Off the Shelf (COTS) software in the creation of thesolution.


o Develop a strategy document that will demonstrate theContractor's understanding of the State care managementprogram needs.

o Document will outline various business processes that will beused in the development of the product

The document will further outline the process to:Analyze and validate requirementsSelect; configure and develop the components of the solutionCreate a coherent and

o

a

o

State'sResponsibilities

Review, comment. and approve

Location N/A

Sr.trn or VrnuoNto CoNtn,l,cr FoR PrnsoN.ql SnnvtcnsDnpantvrnNT oF VnnvroNr Hrar,rn AccnssEQHnar,rn Sor,uuoNs, INc.

Task IE - System Implementation Strategt

The Contractor will develop a System Implementation Strategy that will detail all components

necessary to ensure an on time, on budget, well-orchestrated and quality solution. The deliverables

for this task will include, but not be limited to the work plan, development approach or

methodology, integration approach, conversion strategy (where applicable), testing and

deployment strategy.

The document shall include the strategy for the implementation of all functional requirements,

starting with VCCI go-live through fulI solution implementation, to ensure that all functionality

required of the Care Management System is implemented. The Implementation Strategy must

provide aphased approach where pre-defined success criteria for each release provide input to key

"go-no go" decision points.

The Contractor's System Implementation Strategy shall also identify any technical challenges

(which, if any, are the sole responsibility of the Contractor to resolve) and include the deployrnent

schedule of the releases.

The Contractor shall provide a System Implementation Strategy document to include, but is not

limited to, the following components:i. Project implementation Planii. Target end-User population included in the Project

iii. VCCI Go-Live and Full Implementation success criteria, by release

iv. Deployment schedule by release

v. Workflow analysis and documentationvi. Technology components required for the Project, by release

vii. Identification of the source systems to be integrated, by release

viii. Identification of technical challenges the Contractor must overcome to implement the

Contractor's SYstem


r Project implementation plano Deployment scheduleo Success criteria by releaseo Rollback plano Workflow analysis and documentationo Required technology components for project. Analysis of source systems for integration by

releaseo Technical risks or challenges to implement

Contractor's System


Location N/A

Task IF - Master Testing Strategt

The Contractor will develop a Master Testing Strategy detailing the framework for overall testing

methodology and will include the environments, tools, processes and monitoring and controlling

P.lcn 77 ot268CoNrnr,cr #28739

AurNounNT # 2

Sr.trn or vnnuoNr, coNrrucr FoR ptnsoNal snnvrcns plcn 7g or 26gDnpl,nrvmNT oF vnnvroNr HEALTH Accnss coNrrucr # 29739EQHnu,rn Sor,urroNs,INc. AnnnNovrnNr # 2

metrics. The core of this strategy aggregates all the information from the requirements,Contractor's System design, and acceptance criteria into a detailed plan for testing. The MasterTesting Strategy will detail how the Contractor will conduct testing throughout the project toensure all development meets State expectations.

The Master Testing Strategy will ensure that the Contractor has identified the major system testingactivities and associated deliverables. A separate and complete set of testing as outlined belowshall be required for each Release or module of functionality that will be put into production.Complete testing shall also be required for every Contractor's System interface that is built andput into production. The testing functions of the Project shall be iterative and span the entire lengthof the Project.

The Contractor will employ a robust test methodology based on standards set by one of thefollowing organizations in the execution of the required system testing activities:

i. Software Engineering Institute (SEI), such as the Capability Maturity Model (SEIcMM)

ii, Intemational Standards Organization, such as ISO9000iii. Institute of Electrical and Electronics Engineers (IEEE), such as IEEE 829 Standard

for Software and System Test Documentation and related standards

The Contractor shall be responsible for populating the test system(s) with the data necessary toensure the validity of the testing for all phases of testing. State staff shall not be required tomanually enter data to pre-populate the test environment for any test phase. The Contractor shalluse an automated test management tool suite to manage, assess, track, and perform the requiredtest and deployrnent support activities. The Contractor shall have a software-based defect trackingsystem capable of providing an acceptable level of detail and reporting and facilitating thefollowing functions:

i. Capture - Details about each defect will be recorded when the defect is discovered,including a description, sSrmptoms, sequence of steps to re-create it, type, and severity.

ii. Review and Assignment - Project management shall be able to review all open issuesand assign a priority level and resources responsible for resolution.

iii. Estimate and Resolution - Those assigned to resolve the defect shall be able to recordan estimated duration and delivery date, and provide adequate explanation uponresolution.

iv. Track status and history- A complete history of each defect shall be maintained so thatthe life cycle of each defect can be tracked and reported on.

v. Management reporting - The defect tracking system shall provide recurring reports toProject Management throughout the Project.

The Contractor shall provide the Master Testing Strategy deliverable that shall include:i. The test methodology to be employed for overall Contractor's System testing.ii. The automated method of populating the test systems with data.iii. Identification of the software-based tracking system that will be employed.

Additionally, the Strategy document shall also identify and include the strategy for testing eachProject Phase:

Sr.lru or Vnnmont, CoNtRLcr FoR PrnsoNg, SnnvrcnsDnpLnrunNT oF VnnvroNr Hn.c.Lfir AccpssEQHrnlrn Sor,urroNs, INC.

i. Unit and Integration Testingii. System Testingiii. End-to-End Testingiv. User AccePtance Testingv. Performance and Load Testingvi. System Regtession Testingvii. Security Testingviii. Conversion testingix. Interface Testingx. operational Readiness Testing (includes test cases and scripts)


Test methodology based on acceptable industrystandards

Automated method of populating data for system

tests

Identification of software tracking system forcapture of 'all testing activities capable ofproviding the required detail and reporting

Strategy for unit, system, end-to-end, lJseracceptance, performance, regression and security

o

o

a

testing


Location N/A

Task lG - Requirements Traceability Plan

The Contractor will create a Requirements Traceability Plan which will describe the process and

tools utilized to document the life of a requirement providing multi-directional tracking between a

given requirement and all dependent/associated requirements and other artifacts such as use cases,

workflow diagrams, business rules, test cases, etc. as well as to relevant MITA Business Process

Areas and MITA Business Processes. This plan provides a framework to capture any change made

to a requirement as well as the governance related items specific to the change management

pro""rr. Additionally, the plan provides dependent artifact mapping to items such as functional

and technical system design documents described in following task sections.

The Contractor shall provide a Requirements Traceability Plan to detail the methodology for

tracking the specific Functional and Non-Functional requirements of the Project. The

Requirements Traceability Plan shall identify the methods, tools and technologies used to capture,

catalog and manage the Contractor's System requirements to ensure traceability to the process

workflows and detailed requirements identified in the Contract.

The Contractor shall provide a Requirements Traceability Plan document to include the approach

and method of capturing and majntaining requirements traceability throughciut the development

and deployment process. The plan shall, include:i.

- The process the Contractor shall utilize to identiff how the requirements traceability

matrix will be developed, validated, and maintained throughout the life cycle of the

Pacn 79 o1268CoNrru,cr #28739

AnnnNuunNT # 2

Sr.trr or vrnuoNr, coNrucr FoR pnnsoNar, snnvrcns pacn g0 or 26gDnpmrvrnNT oF vnnnnoNr Hnlr,rn Accnss conrnrcr # 29739EQHnn rn Sor,urroNs,INc. Annnuovrnnr # 2

Contract.ii. How requirements are validated.iii. How any new requirements (if any), as approved through the State's Change Control

Process, are analyzed and managed.iv. How the State works with the Contractor to ensure traceability of requirements to the

delivered Care Management Solution.v. Identification and implementation of the tool to be used to perform requirements

traceability.vi. Approach and methodology to track the Project requirements including:

a. Mapping the requirements to a unique identifier in the tool.b. Mapping the requirements to all associated artifacts such as use cases, workflow

diagrams, business rules, test cases, etc. as well as to relevant MITA BusinessProcess Areas and MITA Business processes.

c. Mapping the requirements to the individual test events.d. Mapping the requirements to the individual test cases, scripts and procedures.

vii. Approach for updating the status of the requirements based on the results of each testevent.

a. Each test event will include an identifier that will be linked to the correspondingrequirement(s) in the Traceability Matrix. The test event will include status ofthe event (Pass/Fail) as well as a link to any defects identified as a result of thetest.

Identification of the requirements by status (e.g., satisfied, waived).Identification of the reports to manage and validate the requirements, including TestCoverage by test event.


Requirements Traceability process, tracking tooland matrix document maintained and validatedthroughout the projectCompliance with change management process andtrackingPlan to ensure State requirement visibility andvalidation through implementation including testcoverage

Reporting to manage and validate all requirementsand

a

a

a

a

Stateos Responsibilities Periodic review of Traceability Report. Participate inchange management pro cess

Location o Conference call and\or Webinaro Onsite meeting as necessary

TASK 2 - Rqquirements Analvsis and Svstem DesisnTask 24 - Functional Specification and System Design DocumentA focused and detailed Requirements Analysis will be conducted by the Contractor to clearlyunderstand each requirement included in the final system scope. This involves frequentcommunication with Contractor's System Users to determine specific expectations so that the finalContractor's System meets the State's needs rather than attempting to mold User expectations.

vl11

ix

Sr,c.rn or VnnuoNt, Contru,cr FoR PnnsoNar, SunvrcnsDnpLnrvrrNT oF VnnuoNr HBar,rn AccnssEQHn,lr,rn Sor.uuoNs, INc.

Plcr 81 or 268Courru,cr #28739

AMnNoN,InNr # 2

This analysis provides the development team with a model of system information, function and

behavior which translates into data, architectural and component-level designs. The following are

the objectives of this analysis:

i. Identify specific needs

ii. Evaluate feasibilityiii. Technical analysisiv. Allocate functions to system elements

v. Establish schedule and constraintsvi. System definitions

The requirements analysis process bridges directly to Contractor's System Design. System Design

includes the architecture, components, modules, interfaces, and data to meet each requirement as

well as the logical and physical design of data flows, inputs and outputs of the system.

The Traceability Plan will include an associated Functional Specification and Contractor's System

design artifact for each requirement. The Functional Specification is geared towards the

Coniractor's System LJser's perspective and is the artifact that describes the requested behavior.

Typically, a mockup design is included when the requirement is related to a User interface

component. This document will not describe the technical aspects of the requirement and how itwill-be implemented. Instead, it focuses on expectations when interacting with the Contractor's

System. The goal of the Functional Design document is to inform the developers on what to build,

instruct the testers on how to test, and leJ the stakeholders know exactly what they are getting'

The technical implementation of each requirement is captured in the Contractor's System Design

document. This document details the system requirements, operating requirements, architecture,

files and database design, input formats, output formats, processing logic and external interfaces.

In order to ensure that the Contractor fully understands the system requirements, the Contractor

must lead and facilitate the process for reviewing and validating the detailed Functional and Non-

Functional Requirements documentation. The Contractor shall also conduct Joint Application

Design (JAD) sessions to fully explore and understand the functional requirements for the Care

Manigement Solution, and to identify any gaps that the Contractor shall address in order to comply

with the requirements identified in this Contract. Based upon the outcome of the JAD sessions, the

Contractor .hull do"ntnent in detail the design and development actions necessary to fully meet

DVHA's requirements. The Contractor shall lead and facilitate the process for developing the

Functional Specifications and System Design Document.

The Contractor shall develop and provide the State with Functional Specifications and System

Design Document, including, but not limited to:

111.

iv.

A comprehensive list of functional specifications to implement the Functional

Requirements, that assures no intemrption of VCCI services.

Recommendations on how to close specific gaps that require changes to the State's

business processes.

Business rules defi nition.Reporting capabilities and prebuilt reports.

User profiles and security role permissions (Roles and Privileges Matrix).

1

il

srlrn or vnnuoNr, conrucr F'oR pnnsoN.q,L Snnvrcns p.q.cn g2 or 26gDnpanrvrnNT oF VnnuoNr Hnar,rn Accnss CoNrrucr # ZS73g

ANrnNIunIBNr # 2EQHnllrn Sor,urrons, Inc.

vi. Contractor's System functionality traceable back to the Requirements TraceabilityMatrix.

vii. Contractor's System overview diagrams illustrating which Solution componentsprovide what functionality, linking back to the functional capabilities.

viii. Domain model.ix. Data IntegratiorVlnterface Design Document Contractor will gather data

specifications from internal/external hosted systems, servers, applications that will beused in the CARE target architecture.

x. Use Cases - a list of workflows mapped to business processes mapped to Contractor'sSystem requirements.

xi. User Interface screens for the Contractor's System.xii. Identification of functions or User roles that initiate workflow, receives the workflow,

and any processes that occur as a result of the workflow.xiii. List of assumptions made during the design as well as recommended next steps and

required actions that shall be confirmed by the State before the development.

'Contractor'sResponsibilities

a Facilitate the elicitation, documentation, review andvalidation of all requirements via Joint Application Design(JAD) Sessions and one-on-one SME interviewsCatalog of functional specifications (indexed andsearchable)

Schedule and conduct JAD sessions (-31) aroundfunctional and non-functional requirements with keySME(s)Create the necessary artifacts associated (example;frnalized business requirement, business rules, processflows etc.)Finalize the design requirementUpdate the overall system architectureIdentify the data sources/ data connectivityIdentify State software & integration

a

a

a

State'sResponsibilities

Key SME(s) participate in the JAD sessionsAnalyze & validate the requirementsState -off on the final

a

o

o

Location a

a

Contractor location for larger JAD sessionsState location for one-on-one meetinss with SME(s)

Task 28 - Data Integration and Interface Design DocumentThe Contractor will develop Data lntegration and Interface Design Documents for each identifiedintegration point. A catalog will be developed enumerating and describing each that will includeinformation regarding endpoint addresses, protocols (tcp/ip, http(s)), payloads (data types,formats) and security configuration. A diagram or conceptual model will also be created for eachintegration detailing the source and target systems. All data translation/mapping will be includedas well as any logical transformations of data.

Srlrn or VnnvroNt, CoNtru.cr FoR PnnsoNu, SnnvlcnsDnpl,ntvrnNT oF VnnuoNr Hnnr,rn AccnssEQHn.l.r,rn Sor,uuoNso INc.

This document must be developed based on outputs from the design sessions conducted with the

Contractor and the State. The Data Integration and Interface Design Document must include the

following components:i. Entity RelationshiP Diagramsii. Data Flow Diagramsiii. Data Dictionaryiv. Data Transformation and Loadingv. Processing controlsvi. Data Test plansvii. Conversion Testing resultsviii. Processes to manage Contractor's System installation and configuration

ix. Data backup proceduresx. InterconnectionSecurityAgreement

The Data Integration and lnterface Design Document must include the interface definitions and

design.

The Contractor must conduct a walkthrough of the final Data Integration and Interface Design

Document with the Care Management Solution Project team to validate the contents, the

incorporation of all information from the design sessions, and the incorporation of all Non-

Functlional Requirements. Approval of the Data Integration and Interface Design Document is

required before development can begin.


a Contractor will develop aData Integration and

Design Document to include EmergencyDepartment diagrams, data flow diagrams, data

dictionary, data transformation and loading process

controls, data test plans, data bactup procedures

State's Responsibilities Review, validate and approve the document

Location N/A

Task 2C - System Architecture

The Contractor will author an overall System Architecture document, which includes a conceptual

model or diagram that is a representation of the components that make up the Contractor's System,

the relationships between these components and the design principles and patterns that govern

their development. An architectural framework or industry best practices reference model will be

leveraged to provide effective visualization for all stakeholders to understand the broad scope and

compGxities of the Contractor's System. This deliverable will be maintained throughout the

project as system components are added or changed to reflect the most current state'

The Contractor shall develop a System Architecture, which details the SOA model-driven

framework being used across all the domains (e.g., services, trust and security, infrastructure) that

enables the development of service-oriented models to facilitate the interaction and

communication of technologies. This document shall describe the set of technologies that support

Care Management Solution operations, incorporating the industry best practices and standards. It

PAGE 83 or 268

CoNrru,cr #28739AunNnunNT # 2

Sr.r,ru or vnnvroxro coNrnlcr FoR ppnsonu, Snnvrcns p.q.cn g4 or 26gDnpmrvrnNT oF vnnvroNr Hrar,rn Accrss coNrnlcr # 29739EQHnlr,ru Sor,urrons,INc. AunNuvrnNr # 2

shall detail the COTS package components, design patterns, information architecture, technologyinfrastructure and the conceptual, logical and physical architectures for the Contractor's targeteibaseline System.

The Contractor shall provide the System Architecture deliverable incorporating details of anyCOTS packages thatare part of the Solution. This System Architecture shall define and document:

i. A conceptual architecture that will produce a design to fulfill Care Managementstakeholder's functional expectations.

ii. A logical architecture that identifies the SOA layers, Contractor, Service Customers,Service Broker(s), and object dependencies. To complete the logical design model, theContractor shall define the interfaces for each service, and include data field definitionsand their validation rules.

iii. A physical architecture that defines the various services of the Contractor's System andhow they shall be implemented. This shall also include details around the integrationlayers, potentially using Web Services, and various other integration technologies.

iv. A detailed list of all the proposed production environment platforms, includingHardware, OS, Networking, and all COTS and third-party systems/tools/ utilities, etc.

v. The details of Security, Privacy and Consent Management Plan for Care Management.vi. The Security Plan will provide the technical approach to satisfy the following:

a. Networksegmentationb. Perimeter securityc. Contractor's System security and data sensitivity classificationd. Intrusion management

e. Monitoring and reportingf. Host hardeningg. Remote access

h. Encryptioni. State -wide active directory services for authentication !

j. Interface securityk. Security test procedures

l. Managing network security devicesm. Security patch managementn. Secure communications over the Internet

vii. Detailed diagrams depicting all security-related devices and subsystems and theirrelationships with other systems for which they provide controls will be within theSecurity Plan.

viii. The High Availability and Disaster Recovery approach and plan describing how theContractor's System shall enable the State to provide information to its members in theevent ofa disaster.

Sr.q.rn or VrnvroNt, CoNtRl,cr FoR PERSoNAL SnnvrcnsDnpl,nrunNT oF VpniuoNr Hnu,ru AccrssEQHnar,rn Sor,unoNs, INc.

ix. How the architecture design features ensure that the Contractor's System can scale as

needed for future transaction volumes, storage requirements, and Contractor's System

usage expands over the next 10 years'

x. How the Contractor's System shall ensure performance based on expected data and

User loadin g,targetsource systems and target platforms. Areas that shall be addressed

are expected Contractor's System performance during peak transaction volumes and

key critical business activities.

xi. How the Contractor's System shall meet capacity requirements, including:

a. A description of how Contractor's System capacity and capacity requirernents

were calculated, including all formulas and calculations used in capacity

planning for the State. This shall include:

1. Business CaPacitY Management

2. Service CaPacitY Management

3. IT Component Capacity Management

4. Capacity Management Processes

5. Capacity Management Tools lnfrastructure

6. Descriptions of how capacity utilization will be monitored and capacity

thresholds will be established.

7. A description of corrective and escalation processes that will be used in

the event arry capacity thresholds are reached.

ContractorosResponsibilities

System Architecture document will include:a

a

a

o

a

a

a

a

Conceptual architectureLogical architecture layers

Physical architectureEnvironment defi nitionsSecurity, privacy and consent management plan

Disaster recovery planSystem scalabilitySystem performance

Stateo s Responsibilities Review, comment and provide feedback

Location N/A

Task 2D - Technical Design Document

The Contractor will author an overall Technical Design document (TDD) that details the system

characteristics (topology), design pattems, programming standards, naming conventions, entity

relationship diagram, third party libraries and development tools used to build the Care

Management System. The Technical Design Document will reflect the final requirements for

Contractor's System configuration and operation. This document must be developed based on

outputs from the technical design sessions conducted with the Contractor and the State.

The Technical Design Document must include the following components:

Plcn 85 or 268CoNrRLcr #28739

AurBNnvrnNT # 2

srlrn or vnnuonr, coNrucr FoR pnnson.q.r, snnvrcns PAGE g6 or 26gDnp,tnrurnNT oF vnnuoNr Hralrn Accnss colqrrucr # 29739EQHnalrn Sor,urroNso INc. AvrnNovrBNr # 2

i. Detailed description of Contractor's System architectureii. Entity Relationship Diagramsiii. Data Flow Diagramsiv. Data Dictionaryv. Data steward and data governance approach to the solutionvi. Business processes as mapped to enterprise platform componentsvii. Processing controlsviii. Processes to manage Contractor's System installation and configuration Data backup

proceduresix. Security controlsx. Availability and resilience controls such as load balancing, failover capabilities, and

fault tolerance

The Contractor may propose alternatives to any of these components, but they must be clearlyjustified and have the prior approval of the Care Management Solution Project team.

The Technical Design Document must include the interface definitions and design (includingXML/SOAP specifications for file formats), the new Contractor's System design based onreviewing existing class diagrams, sequence diagrams, updated object models that represent theinternal workings and designs of the containing subsystems that will expose the services, and thecomponent specification (details of the component that will implement the service) and serviceassignment to each layer defined in the Contractor's System architecture.

The Contractor must conduct a walkthrough ofthe final TDD with the State to validate its contents,the incorporation of all information from the design sessions, and the incorporation of all non-functional requirements. Approval of the TDD is required before development can begin. The finalTDD, once formally approved by the State, will, together with the approved FunctionalSpecifications and Design Document, constitute the complete Contractor's System definition forthe new Care Management Solution.

These two (2) deliverables will constitute the agreement between DVHA and the Contractorregarding the functionality and operation of the new Care Management Solution. The two (2)documents will be the documentation used by the Contractor during Contractor's Systemdevelopment and use cases, and will be the basis for the development of the User Acceptance Test(uAr).

Contractor'sResponsibilities

o Interface definitions and designo Object modelso Service architecture

State's Responsibilities Review, validate and approveLocation N/A

TASK 3 - Svstem Confisuration and DevelopmentTask 3A - System Implementation PlanThe Contractor will develop a System Implementation Plan that describes how the Contractor?sSystem shall be deployed and transitioned into the production operational environment. This plan

Sr.trn or VnnuoNto CoNtru,cr FoR Pnnsonar, SrnvrcnsDnpantvrnNT oF VrnvroNr Hnalrn AccnssEQHnar,ru Sor,urroNs, INC.

is utilized by change management and configuration management personnel during scheduled

implementations. The plan includes the overview of the Contractor's System, a brief description

of ihe major tasks involved, the implementation task schedule, the resources needed to support the

implementation effort and any site-specific requirements and a Rollback plan. An Implementation

Plan will also be created for each major release focusing on just the tasks associated with the

release scope. Post-implementation performance monitoring will be conducted to determine ifeach implementation is successful.

The Contractor shall develop a System Implementation Plan document that incorporates the final

Design DocumentS for Contractor's System implementation. This document shall be developed

based on outputs from the planning and design sessions conducted with the Contractor and the

State. The plan shall include detail on the following components:

i. Description of functionality for each implementation release (starting with VCCIcapacity to go-live).

ii. Releases from VCCI goJive through full implementation.iii. Roll-out/implementation schedule for each release.

iv. Points-of-contact to include individual names and contact information for each member

of the implementation team, Contractor and State.

v. Major tasks.vi. Security and privacy.vii. ImplementationsuPPort.viii. Hardware, software, facilities and materials for all Environments.

ix. Personnel and staffrng requirements.x. Outstanding issues and the mitigation plan for each'

xi. Implementation impact and otganizational change issues.

xii. Performancemonitoring.xiii. Configurationmanagementinterface.xiv. Risks and contingencies.xv. Implementationverificationandvalidation.xvi. Definitions of the criteria for both success and failure of the System Implementation

for each release.xvii. Exit plan and strategy addressing portability of Solution in the event the State wants to

bring the Solution back in-house.

The Contractor will provide a separate System Implementation Plan for each major functionalityrelease of the project, to include the elements outlined above and the following components:

i. Projectimplementationroadmap.ii. Target end-User population included in the implementation.

iii. Deployment schedule for the release.

iv. Technology components required for the Project release.

v. Identification of the source systems to be integrated for the release.

Plcn 87 or 268

CoNrru,cr # 28739AvrnNuunNT # 2

Srnrn or VrnvroNro Conrucr FoR PnnsoN.c.L SnnvrcnsDnpmtnnrNT oF VnnvroNr Hn.ql,ur AccnssEQHn,rlru Sor,urroNs, INc.

PAGE 88 or 268CoNrru.cr # 28739

AvrnNourNr # 2


o Release plans and schedules. Implementationsupporto Issues and mitigation plano Organizational change managemento Performancemonitoringo Training

State's Responsibilities Review, comment and approveLocation N/A

Task 38 - Duta Integration and Synchronizution Plan, including multiple testfiles(MMlS/claims, PBM, eligibility, VCCI legacy, etc.)

The Contractor will develop aData Integration and SSmchronization Plan that will detail all pointsof integration between the Care Management Solution and external systems. The plan will includethe gnalysis and design tasks required to understand the data, layout, protocol and frequency ofexchange. The testing, verification and validation phases of the plan will include the exchange oftest files resulting in final sign-off from all stakeholders. The Care Management Solution shalladdress the State's need for integration ofreal-time operational data of the State's relationship witha Member during service delivery, as well as integration and aggregation of data from a variety ofsiloed source systems into operational data stores, data warehouse and data marts. This data shallbe usable for operational and performance reporting (static I canned and ad hoc), shared analytics,and State-wide alerts.

The Contractor shall perform the necessary data integration arrd synchronization work toimplement the Care Management Solution in compliance with the requirements of the Statementof Work. The Contractor shall develop a detailed plan to validate all integlation andsynchronization routines, as well as the accuracy and integrity of all data integrated from the sourcesystems or otherwise generated.

The Contractor shall design, develop, and implement the technology infrastructure required toenable the Data Integration in the functional and technical specifications of this Contract andintegration of operational data residing in the existing siloed State systems. Operational DataIntegration shall focus on combining select data elements from a variety of existing data sourcesto present a dynamic / temporary view of authoized and relevant Member information, as well asthe State's relationship with that individual across all Departments and programs within the scopeof the Care Management project.

The Contractor shall provide an analytical data integration infrastructure that includes consistentdata across the Enterprise to meet the analytics needs for each Program. This data must be availablein a form suitable for the required analytics and reporting functionality, and available to authorizedUsers.

The Contractor shall provide aData Integration and Synchronization Plan to include all theelements of operational and analyical data integration described above.

Sr.lrn or VnnuoNt, CoNtru,cr FoR PnnsoNar, SnnvtcnsDnp.q,ntNIsNT oF VnnvroNr Hnar,rn AccnssEQHnn rn Sor,uuoNso INc.


a

a

Identify and catalog integration points

Analyze data payloads and s5mchronizationschedule

Data integrity and validation proceduresa

a Exception handling

State's Responsibilities Review, comment and provide feedback

Location N/A

Task 3C - System Maintenance and Support Plan

The Contractor System Maintenance and Support Plan deliverable will include the processes,

policies and responsibilities of the product support services team. Contractor's System

modifications post DDI phase can be required due to defects or evolving original requirements.

The documentation, tracking, impact analysis, testing and maintenance release process will be

detailed in this plan.

The Contractor shall provide a written plan for the Maintenance and Operations Support of the

Care Management Soiution into the Production Environment. The following documentation shall

be prepared by the Contractor and included in the System Maintenance and Support Plan provided

to the State:i. Development of Contractor2s System support structure and organization, including

estimates of manpower requirements to support operation and maintenance of the

Contractor's SYstem.

ii. contractor's System Installation and Administration Manual.

iii. Completed Code.iv. Operating Procedures Manual: Includes Diagnostic procedures, backup and restore

procedures, and disaster recovery procedures.

v. Maintenance Manual: Information to aid in analyzing and debugging the software,

apart from information already available in other delivered documentation.

vi. Maintenance and repair policies and procedures.

vii. Updated system architecture diagrams and inventory (systems, servers, etc.) that

clearly identify what is in the pilot and in production use.

viii. Care Management Solution Database Schema.

ix. Complete Data Dictionary.x. Contractor's System "Run Book" as defined by the State'

The Contractor shall provide a System Maintenance and Support Plan to include the elements

defined above.


o Development of system support structure and

organizationo Operating procedures manualo Maintenance manual

State's Responsibilities Review and comment

Location N/A

Plcn 89 or 268CoNrnlcr #28739

AunNonlnNT # 2

Sr.lrr or VnnvroNr, CoNrucr F,oR pnnsoNlr, SrnvrcnsDnplnrvrpNT oF VnnproNr Hn,q.LtH AccrssEQHnalrn Sor,urroNs, INc.

PacB 90 or 268CoNrnr,cr # 28739

AvrnNuvrpnr # 2

Task 4 - TestinsTask 4A - Test Plan

The Contractor's Test Plan will detail the systematic approach to thoroughly testing allcomponents of the Contractor's System. The plan includes u rtrut"gy for design verificatioi andcompliance, acceptance testing and regression testing. Each requirement will be tested via one ofseveral methods such as coded unit tests, manual testing and automated User interface testing. Thethree major components of the plan include:

Test coverageTest methodsTest responsibilities

1.

ii.iii.

The Contractor will be responsible for the development of a Detailed Test Plan, which includesthe following testing events:

a. Unit and Integration Testing - The Contractor shall perform Unit and Integrationtesting a, nr.err*y during ihe configuration/development process. The Sta-te willrequire the presentation of Unit and tntegration test plans and results duringscheduled development review meetings.

b. System Testing - The Contractor's System testing is aimed at proving that theContractor's System meets the stated requirements and objectives by validating thetotal system in a real-world scenario. This testing shall be performed by theContractor and supported by a limited number of State subject matterexperts/power-Users (not end-Users) at the sole discretion and to the limit deemedappropriate by the State Project Manager. Contractor's System testing will becombined into a single test phase to provide streamlined testing withoutcompromising the testing objectives.

c. Entry Criteria - The feature set, although largely defined and static, may still notbe completely finalized. The software has been unit tested, and there is a high levelof confidence the completed care Management software is ready.

d. System Test Execution -The Contractor's System Test shall utilize "real" data, andshall be performed by the Contractor or a third party. The Contractor's System testshall be intended to demonstrate the critical business functions of the Contractor'sSystem and the overall effectiveness of the User-facing aspects. The Contractorshall provide and the State shall accept the System Test Plan before it is executed.The Contractor shall incorporate the following activities during System Testing:

i. Demonstrate Critical Business Function Scenarios (as defined by andapproved by the state) - data and processes must be fully integrated acrossfunctional areas and that integration fully demonstrated.Transaction Testing (as defined by and approved by the State).Error Message Testing.Documentation Testing (as defined by and approved by the State).Help Systems Testing (as defined by and approved by the State).Demonstrate the complete Sequence of Functional Business Tasks (asdefined and approved by the State).End-to-end business process testing (as defined and approved by the State).Report Generation and Printing.

11.

iii.iv.V.

vi.

vii.viii.

Srarn oF VERMoNI, CoNtru.cr FoR PrnsoN.ll SnnvtcnsDnp,qnrvroNT oF VrnvroNr Hrllrn AccnssEQHn,ll,rn Solurrons, INc.

Pacn 91 or 268CoNrRAcr #28739

AvmNnunNr # 2

ix. Interface Testing (A11 Interfaces included in the module/system).

x. Demonstrate the Complete Sequence of Functional Business Tasks (as

defined and approved bY the State).

xi. Usability/InterfaceTesting.xii. Reliability Testing.xiii. Performance Testing (stress, load testing).xiv. Security Testing.xv. System Recovery and Restoration Testing.

xvi. Regression Testing.xvii. Integration Testing.xviii. Integrity Testing.

e. Exit Criteria _ The results of the System Test are to be presented to the State for

approval before the development Contractor's System status can be promoted to

UAT stage for end User testing. This presentation shall take the form of a livedemonstration of Contractor's System functionality as outlined below. The State

shall define, no less than 20 business days before the start of System Test phase,

the criteria necessary for State approval of test results, including requirements forpresentation of the results to the State and timeframes for State review.

f. (Jser Acceptance Testing _ The pulpose of User Acceptance Testing is to confirm

that the Contractor's System is developed according to the State's business

functionality, performance, and technical requirements and that it is ready for

enterprise deployment and operational use. During UAT, selected State End-Users

will compare the Contractor's System's functionality, features, and performance to

the State's System Requirements Documents, Design documents and State

documented UAT exit criteria.g. Entry Criteria - Prior to moving from System Testing to UAT, the Contractor's

System's feature set shall be fully defined and static. The Code shall be complete

and frozen. The final release version shall have been built from source control. This

final version shall have passed a formal Contractor QA acceptance test, which also

covers "installation" instructions on how to update the server and end User

documentation.h. Pre-Test - The Contractor shall perform the following activities prior to User

Acceptanee Testing (UAT):Build the UAT System release.

Develop and document the software build instructions for UAT.Install and configure the UAT release Contractor's System components and

database(s) on the State's testing environment.Develop and provide the required UAT Test documentation (e.g., end User

guides, systems administration manuals, LJser help files) and provide to the

State for approval for use during UAT activities.All Engineering Change Requests (ECRs) completed.Load database(s) with complete and validated production-ready dataset.

Develop comprehensive UAT Scripts that test each and every requirement

as specified in this SOW in a logical and business process-oriented manner'

1.

ii.iii.

1V

vi.vii.

sr.lrn orvnnvroNr, coNrrucrFoRPnnsoxar, srnvrcns pacn 92o126gDnpanrvrnNT oF vnnuoNr Hnl.LrH Accuss conrnq,cr # 29739EQHnar,rn Sor,urroNs, INc. AnnnunvrnNr # 2

viii. Conduct UAT - There are a number of activities that the Contractor and theState must perform for the completion of the UAT. The following activitiesshall be performed:

a. Identification of the required State and Contractor resources tosupport UAT activities.

b. Provide Contractor resources to support UAT activities.c. Development of the defect resolution management plan

(Contractor).d. Review and acceptance of the defect management plan (State).e. Development of the overall UAT Test Plan and schedule

(Contractor).f. Development of required UAT Test Cases (Contractor).

lx. Each requirement identified in the Contract shall be tested by at least oneTest Case. One Test Case may provide for the testing of multiplerequirements Review and acceptance of UAT Test Cases (State).

. x. Compilation of all relevant data needed to permit State to validate that theContractor's System meets all functional, operational, performance, andsupport requirements. This shall include:

a) The Project Statement of Work (State).b) Systems Requirements Documents (State).c) Software Requirements Document (State).d) Requirements Tractability Matrix (Contractor).e) Systems Configuration Management Data (Contractor).

D End-User Documentation (User manuals, systems administrationprocedures, and training documents) (Contractor).

g) State Approved UAT Test Plan (State).xi. Compiling and evaluating the UAT Test Results (Contractor) and State

.. approval of the UAT Results and corrective actions (State).xii. State acceptance of the overall Contractor's System and its readiness for

production deployrnent (State).xiii. The Contractor shall prioritize all problem/error tickets within two (2)

business days. Any severity 1 (causing the contractor's System to fail toperform abasic business function) problem shall be resolved within four (4)hours. The acceptability of remedial fiies will depend on the nature of theproblem, but shall be solely at the State's discretion. when UAT tests arererun, the reruns shall be treated as any other UAT test activity anddocumented accordingly.

xiv. Software shall be feature complete. Changes taking place must beconsidered by state a low risk to the underlying stability of the software.The software shall have been rigorously tested by the contractor's eA andthe original software developer's QA. There shall be a high level ofconfidence the software is working as State and members will expect.

i. Exit Criteria - The requirements for release from UAT are zero Severity 1 andSeverity 2 defects. The State desires but does not require zero Severity 3 defectsbefore deploying to production. The Release Committee will review the defects and

Srarn or VnnuoNto CoNtucr FoR Pnnsonu, SnnvrcnsDnpmrunNT oF' VnnuoNr Hn.ql,rn AccrssEQHnar,rn Sor,urroNs, INc.

P.tcn 93 or 268CoNrru,cr #28739

ANarlculvlnNr # 2

make a recommendation to the State whether to release to production or not. The

State and Contractor Project Managers will meet and mutually agree on an

acceptable level of Severity 4-5 defects in order to move forward. Defect levels ofseverity are as defined above.

i. All known problems are to be reviewed by the Release Committee. No

outstanding problems should affect overall customer expectations for the

Contractor's System. Supporting materials such as release notes, User

manuals and training manuals shall be in final form and shall also have been

verified by the Contractor's QA or other appropriate reviewers. State

support (if applicable) shall be fully prepared to support the product at this

point.ii. The Contractor shall present in person the results of the completed User

Acceptance Testing process to the State. The Contractor shall also prepare

u r"pott detailing any remaining defects of all severities and the expected

impacts of each, and deliver the Report at the same time as the presentation.

The State will review the results and approve or reject the completion of the

UAT phase.

Performance Testing - The Contractor shall perform Performance Testing.

Performance Testing shall include both Stress and Load Testing to verifyContractor's System performance in accordance with the SLRs.

k. System Regression Testing - The Contractor shall perform Regression Testing

throughout the testing process to verify Contractor's System integrity after

functional improvements or fixes have been made as a result of Contractor's

System Integration and User Acceptance test activities. Regression testing shall be

disigned to confirm that fixes have not created any new problems and that the

results are as planned. The results will also define the Contractor's System baseline

configuration to be released to the State. The Contractor team shall document all

tests performed. It shall be the responsibility of the Contractor to ensure all

automated test scripts have been assessed to ensure their proper function. The

Contractor shall provide a Test Plan that includes the elements outlined above and

a detailed schedule for each of the activities to be completed within the test phase,

including the individuals (named and role) responsible for the completion and/or

approval of each activity. Activities in the Test Plan shall include, but are not

limited to:i. Definition of the Test Phase and Objectives

ii. Entrance Criteria for the Test Phase

iii. Exit Criteria for the Test Phase

iv. Key milestones (i.e., relationship in terms of timeframes days / weeks /months, to predecessors and successor tasks) associated with each Testing

Phase, including:v. Test Case Approvalvi. Test Environment Readiness

vii. Test Start and End dates

Sr,trr on VnnuoNr, Conrucr FoR pnnsoNal SnnvrcnsDrp,tnrnasNT oF'VnnuoNr Hn,ll rn AccpssEQHnar,rn Sor,urroNs, Inc.

PAGE 94o1268CoNrnncr #28739

AnrnNunapxr # 2

viii. Code Baseline Configuration Establishedix. Code Freeze Date(s)x. Required Approval Dates for Test Cases, Entrance and Exit Criteria, etc.xi. Regression Testing start and end datesxii. Test Results Review Meeting Completionxiii. Code Promotion GoA.{o-Go Decision


Unit and integration testingSystem testingUser acceptance testing protocolsEvaluation of UAT test resultsRegression testingPerformance testingRelease test schedule

State's Responsibilities a

a

Conduct UAT testingffon release to

Location UAT testing will be conducted online in Contractor'sprovided UAT environment.

Task 48 - Test Scenarios, Test Cases and Test Scripts

The Contractor will author Test Scenarios, Cases and Scripts for all functional and non-functionalrequirements in a logical and business process-oriented manner. All UAT material will bedeveloped and executed in concert with State participation. The development methodologyleveraged will include the use of User Stories created bythe Contractor and the State. A User Storyis a description, in general language, that captures what a User does or needs to do as part of hislherjob function as it relates to the Contractor's System. Each User Story has associated testscenario(s), test case(s) and test script(s) that will effectively and accurately validate and verifythat the expected results are produced. The Test Scenarios, Test Cases and Test Scripts will coverall test events defined above and will be co-developed with State staff involved. The TestScenarios, Test Cases and Test Scripts will also be supported by Contractor-developed data sheetsthat reference the test cases to the Requirements to ensure comprehensive coverage of each testevent specified.

The test scenarios will describe the functionality that will be tested and more specifically theactions of a given actor or User. Test scenarios are typically made up of one or more test cases.

Test scripts are a set of instructions that are performed on the Contractor's System to test thefunctionality. Each User Story and associated test scenario/case will have an authored test scriptthat will provide full coverage. In addition, automated testing via unit tests and User interfaceautomation will be conducted to ensure regression coverage of previously developed code base.

To ensure that the Contractor's System has been thoroughly tested, the Contractor shall provideTest Scenarios, Test Cases and Test Scripts as well as data sheets to include all of the elementsdefined above to ensure comprehensive test coverage of each and every requirement as specified

Sr.lrr or VrRvroNto CoNtnacr FoR PnnsoN,q'L SnnvtcnsDnpanrnnnNT oF VnnvroNr HEALTH AccnssEQllnllrn Sor,urroNs, INc.

in this contract. The Test Scenarios, Test Cases, Test Scripts and data sheets will map to the unique

identification numbers assigned to all requirements in the Requirements Traceability Matrix'


a Use cases encapsulation process flows and system

functionalityState's Responsibilities Review, comment and provide feedback

Location N/A

Task 4C - Documented System Results

The Contractor will capture all testing results via the Team Foundation Server (TFS) tracking

system. The TFS allows all stakeholders to monitor and track test progress and success/failure.

Management reporting will be available to easily visualize KPIs, trends and overall project testing

activity. Complete traceability from the requirement to the development and eventual test result is

available real-time electronically.

The Contractor shall provide comprehensive Documented System Test Results for each test event

identified for State review and approval. The Contractor shall provide Documented System Test

Results that include all of the test activities identified above, with the following components for

each test event:i. Test Coverage Matrix for each Test Phase identified above (excluding Unit and

Integration Testing).ii. Completed Systems Requirements vs. Functionality Tested Matrix for each phase and

for the Final System DeliverY.iii. Defect Reports.iv. Monthly Test Issues and Mitigation Reports.

v. Test Phase Final Results Report and Corrective Action(s) Plan.


o System results documento Reporting (defects and corrective actions)o Performance based on SLAs

Stateos Responsibilities Review and participate.

Location N/A

Task 5 - TrainineTask 5A - Training Plan

The Contractor's system Training Plan shall include a comprehensive approach to delivering the

most effective modality of training for each type of identified User. The use of multiple types ofmedia (written, video) and delivery (classroom, webinars) will be outlined including topic

boverage and schedule.

The Care Management training must provide the following benefits to the State:

i. Build adoption of person-centered service delivery to support the objectives ofVermont's 'Agency of One' vision.

ii. Increase collaboration and coordination among programs through use of the Care

P.q.cr 95 or 268CoNrnacr #28739

AvrnNoryrnNT # 2

sr,q.rr or vnnuoNr, coNrucr FoR pnnsoNu, snnvrcps PAGE 96 or 26gDnpanrunNT oF vrnuoNr Hulrn Accnss coNTRAcr # 2g739EQHnu,rn Sor,urroNsr INc. AvrnNoryrnNr # 2

Management Solution for activities such as service referrals and collaborative casemanagement.

iii. Enable authorized Contractor's System Users to be self-sufficient in the use andextension of the Contractor's System through the various configuration and parameterchange capabilities.

iv. Provide the State the ability to efficiently and effectively assume trainingresponsibilities subsequent to implementation.

The Contractor shall provide a Training Plan that meets the requirements described above and thefollowing components:

i. Overview stating the purpose and scope of the Training Plan that meets therequirements of the Training Curricula.

ii. Detailed description of the training model for adult learners.iii. Flow diagrams and detail for the training curriculum for each functional area and

integration into the end-to-end business process.iv. Specific training curricula targeted and delivered to the different Users in a manner that

meets their specific needs including, but not limited to Care Management Solution Usertraining focusing on hands-on Care Management Solution usage to enable Users toaccomplish their day-to-day activities including performance management throughbusiness analytics and reporting.

v. Training Materials Development Plans.vi. Role of the 'Training Team.'vii. Documentation style standards forthe development oftrainingmaterial (e.g., document

format, refer€nces, acron5rms, font).viii. Plan for review of training material.ix. Approach to prototyping and testing training materials with training recipients.x. Approach to modifying or adjusting training materials based on the results of the

Evaluation of Training.xi. Training Equipment Plans: Contractor shall provide all training facilities and

equipment.xii. Training Methodology and Delivery plans.xiii. Identification of the training mix including, but not limited to: Web-based learning, in-

person learning, learning-labs, and informal learning. Because of the constraints relatedto scheduling staff out of the office for multiple training sessions, Contractor shalldevelop a training mix that leverages use of on-line training tools and self-guidedlearning material that is supported by in-person training.

xiv. Identification ofplan to motivate and engage Care Management Solution Users to leamabout and use the System and complete the training.

xv. The logistical plan for preparing and delivering the training solution.xvi. Training Schedule: Schedule and timeline of training development, delivery, and

evaluation.

Srarn or VnnmoNt, CoNtnacr FoR PnnsoN.c'L SnnvrcnsDEpARTMENT or VnnnnoNr Hn,qlrn AccnssEQHo.urn Sor,urrons, Inc.


a Training approach across all releases

o Modalityo Types of Users

Training schedule, curriculum and agenda pera

release

State's Responsibilities a

a

O

Identify training particip ants

Participate in trainingProvide feedback

Location Contractor's facility, webinar and video

Task 58 - Training Manualg End-User Guides and Materials

The Contractor will develop a comprehensive Training Plan that will include materials such as

manuals, end-User guides uttdl,'id"or. Training manuals will be available in electronic format and

indexed for easy navigation to specific content or functionality. End-User guides will be available

within the Contractork System r,'iu h"lp menus and shortcuts. The video content will be available

from a training web site and will include use case scenario video topics.

The Contractor shall develop training materials in such away as to allow for the capability oftraining to continue beyond initial deployment. This construction includes the ability to modularize

the maierial. All training material shall have a consistent look and feel and shall be provided in a

soft copy format so thai the State may easily make modifications to the materials. A11 training

materials shall be maintained to reflect the latest version of the Care Management Solution and

the changes resulting from evaluations and use during acceptance, pilot testing, and

implementation. All training material shall be maintained in a centralized on-line repository'

The Contractor shall be responsible for developing and providing training materials and for

training State staff on Contraitor's System operations. The Contractor shall employ professional

trainin! staff (not technical staff) to conduct training sessions and to prepare training and User

materials. The State shall have approval over Contractor-provided staffing used for training and

over the format/content of the training to be given. The State and Contractor staff shall work

together to develop the format/content for the training and User materials that the Contractor shall

p.odrr"". These materials shall be provided to the State in both hard and soft copy. The State must

accept these materials before they are distributed to State staff for use.

Training Manuals, Guides, and Materials shall include, but not be limited to:

i. Instructor/Trainer Guides shall provide the ability for State staff to perform the training

on a continuing basis'ii. Trainee Packages shall provide the trainees exercises and usable examples with which

to practice the lessons provided during formal training.

iii. Contractor's System User Manual shall provide Care Management Solution

information. It should be as non-technical as possible and emphasize program

collaboration, and related business functions in the explanation of Care Management

Solution features, specific workflows, functions, modules and tools and the detailed

procedures for using the Care Management System. The Contractor's System User

Manual shall be designed for ease of use so that any User, regardless of his or her

P.lcn 97 or 268CoNrnacr #28739

AvrnNounNT # 2

sr.rrp or vrnryroNr, coNtnacr FoR pnnsoNar, snnvrcrs pacr 9g or 26gDnplnriuaNT oF VnnvroNr Hn.q.LrH Accnss CoNrnacr # Zg73gEQHnar,ru Sor,urrons, INc. AvrnxnvrnNr # 2

function, can readily locate, identify, understand and use the information. The manualshall include a description of the problems and issues that may arise in using the CareManagement Solution and the procedures for resolution. The manual shall includecopies of all screens with instruction on the use and function of each, including thedefinition of all data elements. Contractor's System User Manual shall include a catalogof all reports, forms, letters, and other system-generated documents (generated eitherautomatically by the Contractor's System or by the User). This catalog shall include acopy of each report, form, letter, or document together with a description of its contentsand step-by-step instruction on how to produce it.

iv. Desk Aids shall provide quick access to solutions and information that Users mostfrequently need.

v' User tips, which shall be designed as short messages that can be sent to recent traineeswith reminders about short-cuts, features, and other relevant information to promoteend-User adoption and use of the Care Management Solution.


a

a

o

Training manualsEnd-User scenario videosGeneral materials (Job aides, etc.)

State's Responsibilities Review, comment and approveLocation N/A

Task 5C - Conduct TrainingThe Contractor shall conduct system training for all participants for each release. The Contractorshall provide the training facility. The training will include Contractor's System functionalityand process flows. The training shall be conducted via classroom and webinar as per the State'sproposed training schedule. The training will include live system exercises for participants tonavigate while in training.

Task 5D - Documented Evidence of successful End-user LearningThe documentation of end-User training by the Contractor shall be specific to the type of trainingdelivered. For training delivered via classroom and Webinar a class roster wili be generateJincluding date, time and topics of training. Training conducted via the video website wiil capturethe authorized User name, dateltime and specific videos accessed. Post training User satisfactionsurveys shall be conducted after each training session to understand the effectiveness of thetraining and leverage as a continuous feedback loop to improve training content and delivery.

The Contractor shall provide Documented Evidence of Successful End-User Training at the endof each phase of training. Evidence shall include:

i. Tracking of trainee attendance and completion of training courses and modules.ii. Actions addressing any deficiencies in the proficiency of the current cohort of trainees

based on the results of the evaluation of training effectiveness.iii. An action plan to adjust or modify future training based on the evaluation outcomes.

Location Contractor' s hosting environment

Sr,trn or Vnnuoxt, CoNtnacr FoR PnnsoN,q.L SnnvtcnsDrpanrunNT oF' Vnnuonr Hnl'LrH AccnssEQHn^Llrn Sor,urroNs, INc.


o Training logso Training improvement action plan. conducttrainingsatisf@

State's Responsibilities Participate in training satisfaction surveys and

feedback

Location N/A

TASK 6 _ enlovmentTask 64 - Deployment Plan

The Contractor shall develop a Deployment Plan that defines all tasks required to release changes

to each Contractor's System environment. Each plan includes the manual and automated steps and

required tools or scripts to "roll out" a specific change set. In addition, each deployment plan

includes a ooroll back" plan to entirely reverse any deployment that was unsuccessful. An

Implementation Plan wiil also be created for each major release focusing on just the tasks

associated with the release scope. Post-implementation performance monitoring will be conducted

to determine if each implementation is successful.

The Contractor shall produce a detailed plan for deployment of the planned functionality for each

release. Moreover, the Contractor shall provide a Deployment Plan that documents all the activities

that need to be accomplished to successfully migrate the Care Management Solution from the

testing environment tolhe production environment. The Plan shall provide a detailed schedule ofactiviiies with key "go" l"no-go" decision points identified throughout the deployrnent process.

In addition, the pian-shall detail a back out and recovery process to be triggered in the event the

tumover to production fails.


a

a

a

a

Deployment schedule

Deployment environment and configurationRelease notes

Rollback plan

State's Responsibilities a Verify, validate and si ff post

Location Target environment. Developmento Testo UATo Productiono Disaster

Task 68 - System Incident and Defect Resolution Report

The Contractor will develop System Incident and Defect Resolution Reports that will be readily

available to Authorized Users electronically real-time from the tracking systems. The Contractor

will provide reports to the State that are designed to meet all requirements. The State will review

and comment on the layout and content of these reports, or the Contractor will propose, and the

State Auth oized Representative(s) will approve, the layout and content of these reports to meet

all requirements.

P.lcn 99 or 268CoNrru.cr #28739

AunNoiunNT#2

srarn op vrnuoNr, coNrru.cr FoR pnnsoNn, snnvrcns plcn 100 or 26gDnpanrvrnNT oF VBRruoNr Hnnr,rn AccEss CoNrnAcr # 2g73gEQHnn rn Sor,urroNsr INc. Aunirlovrni,qr # 2

The Contractor shall document all incidents and defects that occur during System Deployment thatare part of the Contractor's System scope and communicate with the Care Management ProjectManager within a reasonable, agreed upon time frame, on a regular basis. The System IncidentReport must contain the priority of the incident, a description of the incident, incident resolutionstatus, and the proposed course of action for remedying all open incidents.

All defect resolution requests that are part of the Contractor's System scope that occur during theWarranty period must be documented and communicated with the Care Management projectManager within a reasonable, agreed upon time frame, on a regular basis. The Defect ResolutionReport must contain the description of the maintenance request, resolution status, and the proposedcourse of action for remedying all open defect resolution requests.

All changes and fixes will be implemented based on amutually agreed upon schedule. All changeswill go through all phases of testing by the Contractor and the State Project Team. The Contractorshall document the test results and provide to the State for approval before a decision is made toput the new release into production. The Contractor shall update all required Contractor's Systemdocumentation as appropriate and provide to the State at the conclusion of any Contractor's Systemchanges.


a

o

Report content and designCapture appropriate data to support report content

o Defects, resolution, timeframesState's Responsibilities Verify and validateLocation N/A

Task 6C - Completed Detailed Functional and Technical Specffications Traceability MatrixThe Contractor will author and maintain a cross-tabular document listing all individualContractor's System requirements with columns representing the functional and technicalspecifications completeness as well as an identity cross reference to the Test Matrix. An electronicreport will also be developed for real-time access with links to each associated specificationdocument for viewing. This will also be available via reporting from the TFS system previouslydescribed in Task 4C.

After completion of each release and upon final Contractor's System delivery, the Contractor shallassemble, update, and provide an updated Complete System Design, Requirements, andSpecifications document to the Care Management Project. The document components shallinclude:

i. Updated Functional Requirements with disposition in the Functional Specifications andDesign Document (see Task 2A).

ii. Updated Technical Specifications with disposition in the Technical Design Document(see Task 2D).

Srarn or VnnuoNt, CoNtm,cr FoR PnnsoNa,r, SnnvtcrsDnp.q,ntNIrNT oF VnnvloNr llrar,tu AccnssEQHnu,nr Sor,urIons, INc.


a Updated Functional Requirements with each

release

Updated Technical Specifications with each

release

a

State's Responsibilities N/A

Location N/A

Task 6D - System Source Code and Documentation

The Contractor's Team Foundation Server (TFS) system used to manage all aspects of the

Contractor's System development process includes web-based source code and documentation

repositorier. Ctr. Contractor's System source code repository provides historical versioning,

branching and merge capabilities. The document repository can be accessed from the web and has

check irVout, approval and versioning capabilities as well. The Contractor will work with the State

to determine the personnel that require authoizatron to access either repository.

At the completion of the Project, the Contractor shall conduct a review with the State and identifu

any doc.rmentation that must be updated as a result of changes during the three-year warranty

period. The three-year waranty period starts after the full scope of the Project is released into

production. The Contractor will be required to update the documentation and provide it to the State

for review and Final Acceptance.

The following shall be updated and provided to the State's Project Manager at the completion ofthe Project:

i. Functional Specifications and Design Documentationii. System Architectureiii. TechnicalDesignDoc-umentationiv. Data Management and Synchronization Plan

v. Test Cases and Test ScriPts

vi. Training Manuals, End-User Guides, and Materials

vii. Final versions of the Contractor's System software files

The Contractor shall also transfer allfinalizedrequired documentation to the State. The format and

the medium of transfer will be at the discretion of the State.


Update all artifacts associated with Care Management system

throughout project:Functional specifi cation and design

System architectureTechnical design documentation

Data. management and synchronization plan

Test cases and test scriPts

Training manual, User guides and materials

Final versions of the system software files (code)

State's Responsibilities N/ALocation Contractor' s hosting environment and offsite replication location

PAGE 101 or 268

CoNrru,cr #28739AvrnnounNT # 2

srarn or vnnuonr, CoNrucr FoR pnnsoNar, srnvrcns plcn 102 or 26gDnpanrvmNT oF vnnl{oNr Hnru,rs Accnss coNrnrcr # 2g739EQHnllrn Sor,urroNso Inc. AvrnnnvrnNr # 2

Task 6E - Deployment

The Contractor will deploy all the functionality associated with each release to the productionenvironment for live usage. Additionally, prior to the deployment of the production environmentthe Contractor's System shall be deployed in stage, test, and training environments for purposesof testing of contractor's system functionality and training of the users.

Task 6F - Performance SLAsThe performance SLAs will be captured via the Contractor's application monitoring tool, networkmonitoring tool and Care Management relational database. An SLA deliverable report will bedeveloped to aggregate and communicate all SLAs at the required State frequency throughout theproject. The sLAs are included in Section I, subsection 2 of this contract.

The Contractor shall provide ongoing compliance monitoring and reporting for the Service Levels(Performance Measures and Associated Remedies) above and included in dltail in Non-FunctionalRequirements.


a Track/capture all appropriate data elements toproduce each SLACompliance monitoringa

a VE to ensure SLAState's Responsibilities ReviewLocation N/A

TRANSITION TO OPERATIONSTASK 7 - Phase and Proiect Closeout. Svstem Acceptance" Maintenance and OperationsProceduresTask 7A - Readiness Approval

The State and Contractor will jointly develop readiness criteria for Go-Live for each majorsoftware release. Criteria will be jointly monitored and a Go-Live decision will be made *h"ncriteria are successfully met, as determined by the State.

Task 7B-Complete Phase Closeout

The Phase Closeout shall be facilitated by the Contractor with a comprehensive template. Thetemplate includes scope review, financial analysis, documentation, lessons learned andadministrative closure or sign-off as well as turnover to operations where applicable.

The purpose of the Phase Closeout task is to identify the conclusion of a Project Lifecycle phaseand Closeout and gather the required approver signatures. This document will signify that allrequired deliverables for the Project Phase being closed have been completed and approved withthe date of approval for each deliverable indicated. The document shall also list Exit Criteria andthe status of each for the Project Phase and Closeout. The Contractor shall provide documentationto support Phase Closeout to include the elements described above and the following components:

i. State validation that all deliverables for the Phase have been provided, accepted, andplaced in the Project repository.

Sr.q.rn or VBnuoNt, CoNtru.cr FoR PBnsoN.q,r, SnnvrcnsDnpLRtvruNT oF VnnuoNr Hp,llrn AccrssEQHnal,rn SolurroNs, INc.

ii. State validation that all Exit Criteria for the Phase have been met.

Pacn 103 or 268

CoNrnq.cr #28739AmnNuunNr # 2


o Prepare release closeout report to include release

functionality, User acceptance testing results,

requirements traceability and training completionrecords, and Data Dictionary.Release acceptance criteriao

a Transition to (production) plan

State's Responsibilities Validation and acceptance

Location N/A

Tssk 7C - Document Compendium Gap AnalysisThe Contractor will inventory all deliverables and artifacts and identify gaps in alignment with

CMS certification and MECT requirements and with current processes and practices. The gap

analysis will prioritize non-recurring deliverables. The goal is to ensure final documentation is

representative of the final solution produced and deployed, and reflects the processes used to

dwelop the deployed product. The Contractor will provide a summary of all needed updates for

all relevant artifacts. The State will review and approve the gap analysis findings and action

plans, and when acceptable, will approve through a Deliverable Acceptance Document (DAD).

Stutr upproval of Task 7C enables the Contractor to implement gap closure action plans to

complete Task 7D.

An approved Deliverables Expectation Document (DED), created by the Contractor and

approved by the State, is required in advance of completing this deliverable.

Task 7D - Document Compendium Upd'ates

The Contractor is responsible for monitoring and updating all artifacts associated with the care

management system throughout the project. Final documentation should be representative of the

final solution and current processes and practices at the conclusion of DDI that were used to

develop and deploy the product. Only items impacted during M&O, such as the Requirements

Tracea^bility tvtatrix (RTM) tool (Deliverable 6C), change requests, administrative and operations

manuals, etc., will be updated during M&O. Upon State approval of Task 7C-Document

Compendium Gap Analysis, the Contractor will implement the approved action plans to

.o*pl"t" revisions and updates to the documents identified in the Gap Analysis and approved by

the State. The Contractor will update the deliverables as approved by the State, update the

deliverables archive, and update the A100 artifact "Document Registry" to reflect any changes'

The final set of deliverables and artifact documentation reflecting the final product provided to

the State will be a Project Closeout exit criterion.

An approved DED, created by the Contractor and approved by the State, is required in advance

of completing this deliverable.

Task 7E - Maintenance and Operations Guid'e

The Contractor will develop and deliver a written comprehensive Maintenance and Operations

(M&O) Guide, which will include how the transition from Design, Development, and

implementation (DDI) to Maintenance and Operations (M&O) will occur and how activities will

Sr,lru or Vnnuoxr, Coxrucr FoR prRsoN.q.L SunvrcnsDnplnrnrnNT oF' VnnvroNr Hnaltu AccnssEQHralru Sor,urroNs, INc.

occur during M&O. The Guide will include the composition, roles and responsibilities of theContractor's M&O team related to all activities and processes that will be performed duringM&O. The Guide must enable State persoinnel to understand the processes and procedures forM&O activities, including but not limited to defect reporting and resolution, systemenhancements, change control processes, testing, End User training and support services, reportgeneration and special analyses, system incident reporting, cadence for system maintenance-andupdates, transition of base product enhancements to the Vermont system, SLR reporting andprocess improvements, and all other key support activities of the caremanagement solution inthe production environment. This will be a living document and will be updated regularly in acadence described in the Guide and approved by the State.

An approved DED, created by the Contractor and approved by the State, is required in advance ofcompleting this deliverable.

Task 7F -System Acceptance/Project Closeout

System Acceptance/Project Closeout is the final deliverable for the Design, Development andImplementation (DDI) phase of the project. It identifies the conclusion of DDI and signifies thatthe entire system and supporting operations and activities are ready to move into the Maintenanceand Operations phase. System Acceptance/Project Closeout shall be facilitated by the Contractorwith a comprehensive template. .The template includes scope review, financial analysis,documentation, lessons learned and administrative closure or sign-off as well as turnover tooperations. The Contractor will, in concert with the State, manage system stabilization activities,monitor ST.Rs, create and maintain an issue log, and work to achieve systems acceptance utilizingpredetermined criteria

The Contractor will create a State-approved System Acceptance Checklist and Exit Criteria andprovide evidence that all criteria are met, including completion of the following tasks:

i. Jama RTM review and action plan completed to address any gapsii. VCCI eQSuite@ Reports gap analysis and implemented action plan for approved reports.

Approved reports are located at the following links on the SoV and eQHealth Sharepointsites:SoV:

tsll5l 78087D87 A4-1498-4F9C-8C67-


AunNuvrnNT # 2

7I 7D 5

EOH:

20 I 8 0426%20Reportine%20Trackine.xlsxiii. 504/508 Compliance results verifying completion of collaborative assessment,

compliance or approved action plans for addressing any gaps during M&oiv. SoV SLA Security Review results verifying compliancev. SLA Performance Review (most recent Monthly SLA Report)vi. Pilot completed and action plans implemented for transferring Customer Service

responsibilities to the Contractorvii. Document Compendium Gap Analysis and Updates (DADs)viii. Maintenance & Operations (M&O) Guide (DAD)

Srl'rn or VnnuoNt, CoNtru.cr FoR PnnsoN.c'L SnnvrcnsDnpantvrnNT oF VnnvroNr Hrl.LrH AccnssEQHnar,rn Sor,urrons, INc.

ix. VCCI System Administrator Manual (DAD)x. Defect Resolution criteria fulfilled and action plans approved for remaining defects

xi. Certification Deliverable 8A (DAD)xii. Customer Assessment complete and action plans developed and approved

The Contractor will provide evidence that all task deliverables have been updated and approved as

required by the State, transition to operations planning is complete and documented, users

understand Maintenance and Operations procedures and End lJsers, including System

Administrators, have been successfully trained on these procedures so they can execute them

successfully. The Contractor will provide evidence that an agreed upon defect resolution plan and

criteria have been successfully achieved.

In the event there are gaps in fulfilling the requirements on the System Acceptance Checklist and

Exit Criteria, the Contractor will create and implement Action Plans to close gaps. The State willvalidate that all System Acceptance and Exit Criteria on the approved checklist for Project

Closeout have been met before moving to the Maintenance and Operations phase. Waiving any

criteria is at the sole discretion of the State Authoized Representative. At the point at which all

System Acceptance and Closeout Criteria are met and written approval has been provided by the

Siate througlr a Deliverable Acceptance Document (DAD), the Contractor will perform required

maintenanci activities as outlined in this Contract and the Maintenance and Operations Guide, and

the release will be entered into warranty.


a Project clobeout report to include fulfillment of allSystem Acceptance and Exit criteria, and

completion of any Action Plans to address gaps.

State's Responsibilities Validation and acceptance

Location N/A

An approved DED, created by the Contractor and approved by the State, is required in advance

of completing this deliverable.

TASK I - CMS Certification PlannineTffivelopacomprehensiveprojectp1analignedwiththeState'sprojectplanand based on CMS requirements for the Care Management sub-system. All high-level project

planning components (scope, requirements, WBS, schedule, test plan, etc.) are to be developed by

ihe Contractor and approved by the State, as well as requirement artifacts and Contractor's System

documentation. The Contractor will creat'e its Care Management sub-system certification plan for

sub-system review citeria, documentation and certification checklist completion that complies

with the overarching MMIS CMS certification plan.

The Contractor must participate in and support all planning activities associated with Federal

certification of the MMIS Solution. Planning activities will ensure that Vermont's Medicaidportfolio meets all CMS requirements and perfornance standards to qualify for the highest eligible

Federal Financial Participation (FFP) rate retroactive to the first day of complete operation' While

certification application activities will occur post-implementation, the Contractor should start

PAGE 105 or 268CoNrntcr # 28739

AmnNonnnNT # 2

Sr.trn or vnnuoNr, coNrmcr FoR pERsoNAL snnvrcns pacn 106 or 26gDnpanrvruNT oF vnnuonr Hrar,rn Accrss coNrnq.cr # 29739EQHralrn Sor,urroNs,Ixc. AunNnunNr # 2

preparation at the beginning of the project and continue through each step of the design,development, testing and implementation of the care Management Solution.

The Conhactor is responsible for:i. Including plans for CMS Certification as part of the Project Kick-Off.ii. Adhering to CMS Standards and Conditions in all deliverables.iii. Mapping all requirements, gaps, use cases, testing artifacts, workflows,

training documents, change management artifacts, and other applicableartifacts to the corresponding MITA Business Area and Process.

iv. In conjunction with the State Project Team and CMS, determining which ofthe MECT criteria are applicable to the Care Management project andcertification effort.

v. Meeting all MECT criteria applicable to the Care Management solution.vi. Collaborating with the State in developing a tailored CMS Certification

Checklist based on the CMS Certification Toolkit for those processessupported and impacted by the Care Management Solution.

vii. Supporting the State in all discussions with CMS regarding certificationrelated to the Care Management solution.

viii. Developing and executing required and suggested remediation efforts toachieve certification.

ix. Assisting the State in preparing certification documents and reports related tothe Care Management Solution.

x. Participating in the in-person or virtual review(s) with CMS.xi. Responding to CMS post-review.questions and comments.

An approved DED, created by the Contractor and approved by the State, is required for each ofthe CMS certification deliverables described below.

Task 8A -.Care Management Subsystem Certification Planning

The Contractor will provide a comprehensive project plan that is aligned with the State's projectplan and based on CMS Certification requirements for this subsystem. The plan will include allhigh-level project planning components such as scope, milestones, and task dependencies neededto facilitate the activities necessary to obtain CMS certification. The plan will cover ReviewCriteria, Evidence Packages, Testing Scenarios, Certification Readiness Assessment and ChecklistSatisfaction. It will demonstrate a thorough understanding of the State's plan, the certificationprocess, and key points leading to CMS review. This deliverable will include the Certification planwith work activities, and aMicrosoft Project Plan.

Formal acceptance by the State of the strategy and plan documents will trigger the State to producea Deliverable Acceptance Document (DAD) for payment.

Task 88 - CertiJicution Review Criteria and Testing Scenarios

The Contractor will provide Evidence Packages with appropriate descriptions, development Sprintnumbers, deplo5rment release notes, defect resolution, system documentation, reports, testing

Sr,trn or VnnivroNt, Contnl,cr FoR Prnsonar, SnnvrcnsDnp.qnnvrrNT oF VnnmoNr Hn,llrn AccnssEQIIn.tlrn Sor.urIoNs, INc.

scenarios, test cases, testing results, production compliance evidence and screenshots, along with

any other pertinent informition relative to the development, testing and deployment of product

functionaliiy. Requirements traceability will demonstrate upstream and downstream linkages,

including mapping to the RFP and through all fully executed change requests.

Successful submission to the CMS repository of all formally approved Evidence Packages willtrigger the State to produce a Deliverable Acceptance Document (DAD) for payment.

Task 8C - CertiJication Readiness Assessment

The Contractor will provide a Certification Readiness Assessment with evidence to demonstrate

that testing scenarios, test cases, testing results, production compliance evidence, information

relative to the development, testing and deployment of product functionality, requirements

traceability and any other review criteria have been satisfied as determined by the State.

Formal approval of the Certification Readiness Assessment results will trigger the State to produce

a Deliveiable Acceptance Document (DAD) for payment'

Task 8D - CMS Cerffication Review and Acceptance

The Contractor is responsible for preparing all documentation and operational examples to

demonstrate relevant criteria are met and Care Management Solution operations address all

business functions, performance standards and business model expectations for certification' The

Contractor will participate in preparation and planning sessions prior to the certification review

and will participate during the virtual or in-person review with CMS. The Contractor will help the

state with mitigation of questions and findings CMS delivers to the State after the review, until all

outstanding questions and action items are resolved to CMS' satisfaction.

Receiptbythe State of aLetterof Certification from CMS will triggerthe State to produce a

Deliverables Acceptance Document (DAD) for payment.


o Develop CMS certification checklist for care

management sub-sYstem. Support State discussions with CMS regarding

certificationo Prepare all required documentation for care

management sub-system certificationo Participate in certification reviewso Assist with mitigation of post-review questions

and findings from CMS

State's Responsibilities Provide resources to adequately test certificationscenanosReview and deliverables

o

a

Location Certification environment

PAGE 107 or 268

CoNrnacr #28739AvrnNovrnNT # 2

Surn or VnnvroNro CoNrucr roR pnnsoNu, SnnvrcnsDnpaRrvrnNT oF VnnvroNr Hnalrn AccnssEQHnu,rn Sor,urloNs, INc.

Pacn 108 or 268CoNrRAcr #28739

AunNovrnNr # 2

TASK9-SvstemM&OTask 9A - System Incident Reports - M&OThe Contractor will deliver System Incident Reports throughout the project. This will beaccomplished via the ITIL compliant web-based Service Desk module which includescomprehensive incident management capabilities with flexible reporting. Incident reportingincludes high level dashboards as well as parametenzedreports at a granular level. Ad-ho" qrrcryfunctionality is available to authorized Users to answer specific questions related to incidents.

The Contractor must complete the following services. (The Contractor may propose additionaldeliverables as needed to achieve the task goals of System Maintenance and Operations):

System Incident Resolution - Maintenance and Operations of the Contractor's System includessoftware faults that are not a part of the scope of the original development effort. All incidents thatoccur as part of ongoing operations must be addressed and resolved within a reasonable time frameas per the SLAs.

Adaptive Maintenance - All changes and fixes will be implemented based on a mutually agreedupon schedule. All changes will go through all phases of testing by the Contractor and the Stat".The test results must be documented and provided to the State foi approval before a decision ismade to put the new release into Production. All relevant Contractor's System documentation willbe updated and provided to the State at the conclusion of any Contractor's System changes.

System Enhancements - If the State determines that Contractor's System enhancements arerequired, it will submit a request for those modifications to the Contractor. The Contractor willanalyze the changes and provide a cost estimate for performing those changes to the CareManagement Solution. These cost estimates will be negotiated based on rates proposed and agreedto. The State can then decide whether it wishes to move forward with the requested enhancernents,which will be incorporated as a change order to the Contract. All incidents that occur during theBase and Optional Extension M&O periods.must be documented and communicated with the Statewithin a reasonable, agreed upon timeframe, on a regular basis. The Contractor's System IncidentReport must contain the severity of the incident, a description of the incident, incident resolutionstatus, and the proposed course of action for remedying all open incidents.


a Prepare ongoing Contractor's System incidentreportsIncident resolution statuso

State's Responsibilities Review and commentLocation N/A

Task 98 - Adaptive Maintenance Reports

The Contractor will deliver Adaptive Maintenance Reports throughout the project. The ChangeManagement Tracking system includes verbose reporting for all types of Contractor's Systernchanges including those associated with previously deployed requirements and functionality. Each

Srarn or VsnvroNt, CoNtnacr FoR PBnsoN,q,L SnnvrcnsDap.qnrvrnNT oF VnnuoNr llnal,rn AccnssEQHnalur SolurroNs, Ixc.

item includes a detailed description of the "As Is" and "To Be" adaptive change. A real-time

parameterized report can be executed to view the details of each change.

All adaptive maintenance requests that occur during the M&O period must be documented and

communicated with the State within a reasonable, agreed upon timeframe, on a regular basis. The

Adaptive Maintenance Report must contain the description of the maintenance request, resolution

status, and the proposed course of action for remedying all open maintenance requests'


a

a

Prepare Adaptive Maintenance Reports

Adaptive maintenance status

Stateos Responsibilities Review and comment

Location N/A

Task 9C - System Enhancement Reports

The Contractor will deliver System Enhancement Reports throughout the project. Contractor's

System Enhancements are managed by the change management tracking system as previously

described. The same data capture and reporting capabilities are available for changes specific to

the "Enhancement" change type. Detail descriptions of the Contractor's System enhancement willbe provided in the associated release notes. Corresponding training materials will be updated to

reflect changes.

A1l Contractor's System enhancement requests (changes requiring 200 or more hours of effort)

that occur during the M&O period must be documented and communicated with the State within

a reasonable, agreed upon timeframe, on a regular basis. The System Enhancement Report must

contain the des-ription of the enhancement request, progress, and the test results and outcome ofeach request.

ContractortsResponsibiHties

a

a

Prepare System Enhancement Reports

System enhancement status

State's Responsibilities Review and comment

Location N/A

Task 9D - VCCI System Administratot ManualThe Contractor is responsible for developing a VCCI System Administrator Manual that provides

documentation for Stut" rrrp"*isory and administrator positions to execute technical and

administrative features of the care management solution in support of End Users and daily

operations. The Manual will include detailed step-by-step instructions on how to perform tasks to

keep the system running effectively. The Manual will include but not be limited to the following

major components:

i. Administrator Menu, containing multiple sections, including Managing Reports, Adding

Providers, Changing Passwords, Managing Plans of Care, Survey Configuration, etc'

ii. Configuration Settings, including Dictionary, Dropdown Lists, Filtering Dropdown Lists'

other Configuration Settings, Case Manager Assignment, and Documents

iii. User Activity RePorts

Pacn 109 or 268CoNrnacr #28739

AvrnNovrnNT # 2

St.trn or Vnnuont, Conrnncr FoR pnnsonar, SnnvrcnsDrplRrvruNT oF VnnuoNr Hnar,rn AccnssEQHrar,rn Solurrons, INc.

iv. User Requests from Outside Agenciesv. Ticket Managementvi. Schedule of Data Loads and Analyses, such as ACG, eligibility, claims, etc.

This will be a living document and will be updated regularly in a cadence described in theManual and approved by the State.

An approved DED, created by the Contractor and approved by the State, is required in advanceof completing this deliverable.

Task 9E - Tier 2 Service Desk Plan

The Contractor's Tier 2 Service Desk Plan will describe the required Contractor's Systems,processes and procedures necessary to effectively support all stakeholders and Users of the CareManagement System. The plan will detail the "hand-off'or escalation from the Tier 1 team andthe policies and procedures by which each ticket is processed. This includes hours of operation,severity level turnaround timeframes, and communication mechanisms and reporting.

The Contractor is responsible for developing a Tier 2 Service Desk Plan that indicates how supportwill be provided and how escalated incidents are resolved. The Service Desk shall use ITii v3compliant Incident and Problem Management processes. The plan must include a proposedorganizational structure, service level commitments related to the resolution of logged incidents(based on issue priority or severity), and metric reporting for monitoring the Contractor's Systemand Service Deskperfonnance. The Service Desk shall use an ITIL v3 compliant COTS IT ServiceDesk solution and shall electronically interface with the Contractor's defect and qualitymanagement tools.


Contractor's System support structure andorganizationProcesses and policiesSupport tools (ticketing, voice mail etc.)Hours of operationCommunication and escalation

State's Responsibilities ReviewLocation N/A

L. TASK RELATED DELIVERABLES: PROJECT TIMELINETask Deliverable 1-C, Project Work Plan and Schedule, and the updated Project Schedulerepresent the approved schedule of record for tracking progress against completing andapproving all contract deliverables. Deliverables are considered approved when the State issuesa Deliverables Acceptance Document (DAD) signed by the State's authorized representative.

Deliverable 6-D, System Source Code and Documentation, for each release will be due uponreceipt of payment by Contractor for approved task DeliverableT-B,Phase Closeout and,7-FProject Closeout/System Acceptance.

P.q.cn 110 or 268CoNrRr,cr #28739

AvrnnnmnNT # 2

Surn or VnnvroNt, CoNtnacr FoR PnnsoN,q,L SnnvlcnsDrpantnnnNT oF VsRMoNr Hnllilr AccsssEQHnllur Sor,urronso INc.

Pacn 111 or 268

CoNrnacr #28739AurnNounnr # 2

Updated code will be delivqed to the State quarterly after Contractor receives the M&Opayments for the quarter.

M. CONTRACTOR PROJECT ORGANIZATION & STAFFING1. Staffing PIanThe following staffing plan details the Contractor personnel, level, roles and responsibilities, and

team reporting relationships and identifies the approach to providing "shoulder-to-shoulder" team

reporting relaiionships for key staff roles. This plan shows Contractor's personnel hours by phase,

by personnel level and by role for the entire project.

a. The term "Key Project Personnef', for purposes of this Contract, means Contractor personnel

deemed by the 3tut" u. being both instrumental and essential to the Contractor's satisfactory

performance of all requirements contained in this Contract. The Key Project Personnel shall be

engaged throughout both the implementation and operations periods. Changes to the positions and

responsibilities shall only be allowed with prior written permission from the State. Certain Key

Project Personnel, as further described in the Staffing Tables, are to be full-time and dedicated

solely to the Vermont Care Management account.

b. Location of Contracted Functions and Personnel

i. During the maintenance and operations (M&O) period, the Contractor's Key Project

Personnel and Subject Matter Experts will participate via telephone in Care Management-

related meetings as scheduled by the State. Additionally, during the first six months after

System Acceptance, Contractor Key Project Personnel andlor Subject Matter Experts as

r"qnested by the State will visit the Vermont State offices once each month for project

oversight and status reporting, transition and implementation of the M&O Plan, CMS

Certification preparedness and review, requirements gathering for Change Requests and

system enhancements, and training on such things as report design, system enhancements,

and functionality that introduces changes to User's workflow. Monthly onsite visits willnot be fewer than two fu|| business days and more than five full business days, determined

by an agendaand schedule developed collaboratively by the Contractor and the State.

In addition to the Contractor's Certification Lead, Contractor Key Project Personnel willbe onsite for the following certification activities:

a. Planning for the CMS Certification Review session, including preparing

content and identifying presenters;

b. Participating in practice sessions for the CMS Certification Review session;

c. Participating in the CMS Certification Review session.

After the first six months post-System Acceptance and provided M&O is operating

effectively and in accordance with the approved M&O Plan, monthly Project Status

meetings may occur via telephone and onsite visits may be reduced to once each quarter.

The Project Status Report will be distributed a minimum of 48 hours in advance of the

monthly meeting scheduled by the Contractor. Onsite visits will continue throughout the

contract term as needed for determining requirements for Change Requests and new

functionality, and to provide training for major deplo5rments.

sr.ArE oF vnnuoNr, coNrucr FoR pERsoNAL Snnvlcns PAGE ll2 op 26gDrp.c,RrNrnNT oF vnnuoxr Hnalrn Accrss coNrnlcr # 29739EQHnllrn Sor,urroNsr lllc. AprnNnvruNr # 2

ii. The State and the Contractor shall establish appropriate protocols to ensure that physicalproperty/facility security and data confidentiality safeguards are maintained.

iii. The Contractor must ensure Key Project Personnel have, and maintain, relevant currentlicense(s) andl or certifi cation(s).

iv. The Contractor shall seek and receive State approval before hiring or replacing any KeyProject Personnel and all Vermont-based staff. The Contractor shall remove Key ProjectPersonnel, if requested by the State, as well as develop a plan for the replacement of thatKey Project Personnel, all within two (2) weeks of the request for removal.

v. The Contractor must provide the State with written notification of anticipated vacancies ofKey Project Personnel within two business days of receiving the individual's resignationnotice, the Contractor's notice to terminate an individual, or the position otherwisebecoming vacant. Replacements for Key Project Personnel shall have qualifications thatmeet or exceed those specified in this Contract and shall be subject to approval by the State.The Contractor shall provide the State with status update reports every 30 days on theprogress of the replacement candidate recruiting process until a qualified candidate is hired.The Contractor shall have in place a qualified replacement within ninety (90) calendar daysof the last day of employment of the departing Key Project Personnel. Contractor shallagree to provide the first thirty (30) days of a replacement resource with equivalent skill atno additional charge.

vi. The State's right to request replacement of Contractor personnel hereunder relates solelyto the removal of individuals from work on this Contract with the State and does not createany employrnent or principal-agent relationship. Nothing in this Contract authorizes theState to direct the Contractor's termination of, or other adverse action related to, theemplo5rment of any individual.

2. Key Project PersonnelThe following table provides Contractor Key Project Personnel positions, corresponding roles andresponsibilities for the project, and minimum qualifications for each.

a. Roles and Responsibilities of contractor Key Project? personnel

Sr. Account Executive

Primarypoint of contact with the State's contract administrator, caremanagement director and other State executive sponsors for activitiesrelated to contract administration, overall project management andscheduling, coffespondence between the State and the Contractor,dispute resolution, and status reporting to the state for the duration ofthe contractAuthorized to commit the resources of the Contractor in matterspertaining to the implementation perfofinance of the contract.Responsible for ensuring all contractor-required resources identifi edby project manager are staffed on time. Responsible for addressingany issues that cannot be resolved with the Contractor's projectManager. Senior business expert in the area of care managementsystems with a strong understanding of the Contractor's businessapplicationIs expected to work 30Yo on site with State staff during the DDI Phase.

Roles and ResTitle

Sr.c.rr onVnnvroNt, Coxtnacr FoR PnRsoNal SnRvrcnsDnp,qnrvrnNT oF VnnvroNr Hnl.LrH AccnssEQHn,q.Lrn Sor-urroNs, INc.

Pacn 113 or 268

CoNrnlcr # 28739AvrnNnvrnNr # 2

Account Director

Responsible for the Engagement working with both State Leadership,

steering committees and Contractor & Subcontractor teams. Closelywork with Sr. Account Executive to ensure all the proglam operations

are being conducted as per the vision. Work with State team to

facilitate the escalation issues. Responsible for oversight of the Care

Management Project team. Responsible for all business aspects of the

reporting. To ensure all the program are being met on-time and on

budget. Expected to work 25Yo of the time onsite with State staffduring the DDI Phase. Twenty-five percent onsite commitment willconsist of an average of 4.5 business days per calendar month. The

scheduling of these days will be submitted and agreed upon by Project

Management no later than the 23rd day of the preceding month.

Project Manager

Providing onsite management of the project and is the chief liaison forthe State for design, development, and implementation project

activities as well as the project's maintenance and operational phase.

Authorized to make day-to-day project decisions. Responsible forfacilitating the project by using the project management processes,

or ganizing the proj ect, and

managing the team work activitiesconsistent with the approved workplan. Responsible for scheduling and reporting project activities,identifying resource requirements well in advance, coordinating use ofpersonnel resources, identifying issues and solving problems, and

facilitating implementation of the Contractor's System. Hostingweekly onsite status meetings, monthly milestone meetings, as well as

interim meetings. Will assign Contractor staff to those meetings as

appropriate. Will provide an agenda and develop minutes for each

meeting. Providing expert guidance ensuring that care management

policy and business rules as defined by the State are correctlyimplemented in the Contractor's solution. Advising the State regarding

best practices and recommends modifications to business processes,

which improve the overall care management program. Is expected to

work 100% on site with State staff during the DDI Phase' Must hold

current certification.

Data lHealthInformaticsAnalyst

Responsible for all State data requirements and reporting needs

including those that exceed the standard reporting package and the

information available through the decision support tool provided bythe Contractor. Providing ad hoc reporting, predictive modeling and

risk stratification reporting as requested by AHS staff and otherprogram staffs (once on-boarded). Management of procedures

associated with Contractor's Systems change orders Ensuring the

integrity of data used for care management predictive modeling, riskstratification, etc. Is expected to work 25Yo on site with State staff

Srarr or VnnuoNt, Coilrucr FoR pERsoNAL SnRvrcrsDnp.rRrunNT or VnnuoNr Hrar,rn AccnssEQHnl.I,rn Sor,urroNso Inc.

P.lcn 114 or 268CoNrnncr #28739

AvrnnrvrnNr # 2

during the DDI Phase. Twenty-five percent onsite commitments willconsist of an average of 4.5 business days per calendar month. Thescheduling of these days will be submitted and agreed upon by ProjectManagement no later than the 23rd day of the preceding month.

Account Manager

Responsible for business aspects of the project to ensure the overallproject goals are being met and that the Project Team has all thenecessary resources in terms of skill sets, knowledge and all itemsrelated to scope. Is expected to work l0o/o on site with State staffduring the DDI Phase.

Clinical ProgramAnalyst

A clinician who is responsible for clinical workflow design andbusiness rules based on theVermont Care Management program. Subject matter expert providingknowledgebase of the current product to the team and the necessarydesign and configurations changes required for customizing to AHSneeds. Is expected to work 60Yowith State staff durine DDI Phase.

Staff Contingency PlanThe Contractor shall:

a. Maintain a Contingency Plan that shows the ability and process to add more staff ifneeded to ensure the project's deliverables are met on the due date(s) and go-live dates.

b. Provide a plan to monitor the project, and how a determination to deploy contingencystaffing will be made.

3. Staff ManagementThe Contractor shall:

a. Have internal standards, policies, and procedures regarding hiring, professionaldevelopment and human resource management.

b. Ensure a continuous and steady influx of skilled and qualified resources to projectteams at all times.

c. Have a Human Resource Management Plan in place tied to the proposed projecttimeline and phases. The Contractor is responsible for proposing the potential roles andresponsibilities for staffing the different activities, articulating what the Contractor will

. need to provide and what the State should provide.

4. Training Policies and ProceduresThe Contractor shall ensure the training and ongoing education of its personnel. The Contractorshall ensure that all Subcontractor's staff receive training on and have an in-depth understandingof eQSuiteobefore Subcontractor's staff begins its engagement on the project. ForSubcontractor's staff thatthat will be on the project at its inception, this training shall becompleted prior to Task 1A Project Kickoff Presentation, and shall include, but not be limited tothe following:

Sr,q.rn or VnnuoNt, CoNtru,cr roR PnnsoNar, SnnvrcnsDnpantunNT oF VnruioNr Hnnr,rn AccnssEQHn,l,r,rn Sor,uuoNs, INc.

Pacn 115 oF 268CoNrru,cr # 28739

AvrpNrnanNr # 2

Two weeks

General introduction to the assignment:

Case management for VermontContract requirements by functionalateaWork plan and phasingProgram organizationTeam building exercises

Hands on training on the major care

management workflows from theperspectives of a case worker,manager,and system administrator, including:Creating a case for various scenarios

Case managementReporting and analyticsSystem administration and

customization

ProgramManagerProjectManagerChangeManagementLeadHealthInformationAnalystTraining/OCMLead

AssignmentMobilization,Application UseCases, andProcess Flows

One WeekDatabaseAdministrators

Administration of the eQSuite@

databases:Logical and physical architecture of the

system as configured in development,test, staging, and productionenvironmentsDatabase entity relationship diagramsand data flowsUse of third party tools, especially

Extract, Transform, and Load (ETL)Routines for backup and restore

Periodic maintenance tasks (run book)

DatabaseAdministration

One Week

Hands on training on the major Care

Management workflows from theperspectives of a case worker, manager,

and system administrator, including:Creating a case for various scenarios

Case managementReporting and analyticsSystem administration and

customization

IT BusinessAnalystIT BusinessAnalyst(Consulting)ClinicalBusinessAnalystClinicalBusinessAnalyst(Consulting)

Application UseCases forBusinessAnalysts

KNOWLEDGETRANSFER

TYPE

CONTENTWill include, but is not limited to:

AUDIENCETo include,

but not limitedto:

DURATION

Sr.lrn or Vnnvroxt, Coxtucr FoR PnnsoNn SnnvrcBsDnpmtvrpNT oF VnRvroNr Hn.ql,rn AccnssEQHrar,ru Sor,urroNs, INc.

PAGE 116 or 268CoNrnq,cr #28739

AvrnNuvrnNr # 2

TechnicalWriter

Application UseCases forQualityAssurance andTraining

QA AnalystsTrainers

Hands on Hands on training on the majorCare Management workflows from theperspectives of a case worker, manager,and system administrator, including:Creating a case for various scenariosCase managementReporting and analyticsSystem administration and

customization

One Week

5. Contractoros Use of Vermont StaffThe Contractor's staffing plan shall include the number of resources (both business andtechnical), anticipated role and responsibilities, level of participation (e.g., part time, full time)and necessary capabilities/ skills ofState Staff.

N. WORK PLANThe Contractor shall submit the project work plan (i.e., Project Schedule) deliverable for Stateapproval within thirty (30) days of project initiation.

O. REOUEST FOR APPROVAL TO SUBCONTRACTPer Attachment C, Section 19, if the Contractor chooses to subcontract work under this agreement,the Contractor must first fiIl out and submit the Request for Approval to Subcontract FormAttachment H (Required Forms) in order to seek approval from the State prior to signing anagreement with any third party. Upon receipt of the Request for Approval to Contract form, theState shall review and respond to the request within five (5) business days. Under no circumstanceshall the Contractor enter into a sub-agreement without prior authoization from the State. TheContractor shall submit the Request for Approval to Contract form to the State AuthoizedRepresentative(s) and to : AHS.DVHAGrantsContracts@vermont. gov

Should the status of any third party or Subcontractor change, the Contractor is responsible forupdating the State within fourteen (14) days of said change. For the avoidance of doubt, theContractor shall remain liable for the satisfactory performance of all work required under thisContract. Additionally, a prior written approval under this section will not constitute anamendment to the Contract unless it changes the general terms and conditions or the terms ofpayment in the base Contract.

Srarn orVBnvroNt, CoNtru,cr FoR PnRsoNu- SnnvrcnsDnp.qnrNInNT oF VBnuoNr Hnar,rn AccnssEQHnn rn Sor.uuoNs, INC.

APPENDIX I - Functional Requirements

Pacn ll7 os268Conrn,lcr # 28739

AunNrnnnNr # 2

FR FunctionalFRl General (includes Document Management;

and Community Provider/Partner Portal; AlMember, Authorized Representative,

erts and Notifications; WorkflowCentralized

Establish Case Criteria (includes Rules Management; Candidate Identifi cation /DeterminationRisk Stratification

FR2

Establish Case (Intake: Outreach; Case Assi )FR3

FR4 Perform Screening and Assessments

FR5 Treatment Plan and Outcomes

Manage Case Information (includes Case Documentation; Scheduling; Disposition;Case ClosureCare

FR6

Manage Population Health OutreachFR7

FR8Authorization D etermination (includes Referral Management; S ervice and

Treatment PlanFR9

ReportingFRlOConsent ManagementFR11

FRl2 Sample List of Reports

Section TitleNumber

Document tPlannedRelease

Requirementnumber

Requirement

R3The solution must pre-populate a letter with a date based on

rules.

businessNEl.10-001

R3The solution must have document management capabilities.FRl.10-001

R3The solution must provide letter templates.FR1.10-002

R3The solution must provide forms.FR1.10-003

R3The solution must allow a user to customize a template.FR1.10-004

R3FR1.10-005 The solution must store documents

R3The solution must be able to generate a form in hard copy.FR1.10-006

R3The solution must be able to generate a letter in hard copyFR1.10-007

General

Srarn or VnnuoNr, CoNrucr FoR pnRsoNu, SrnvrcnsDpplnrryrnNT oF' VnruroNr Hnalrn AccESSEQHual,rn Sor,urroNs, INc.

PAGE 118 or 268CoNrRlcr # 28739

AivrnNovrnxr # 2

FR1.12-001 The solution must allow a user to create state referral forms R3

FR1.12-002 The solution must allow a user to update state referral forms. R3

FR1.12-003 The solution must allow a user to delete state referral forms R3

FR1.12-004 The solution must allow a user to create letter templates. R3

FRl.12-005 The solution must allow a user to delete letter templates. R3

FR1.12-006 The solution must allow a user to update letter templates R3

Alerts and NotificationsFR1..24-

001The solution must allow a user to receive an alert based on user role. R3

FR1.24-

002solution must capture a user's preferences for his/her subscription to

notificationsThe R3

FR1.24-

003The solution must allow a user to subscribe to notifications based onbusiness rules.

R3

FR1,.24-

004The solution must allow a user to unsubscribe to notifications based onbusiness rules.

R3

FR1.87 solution must send an alert to a user based on business rules. (FRl.38)The R3

General

FR1.69-

001solution must have the ability to catalog imaged documents.The R3

FR1.83-

001The solution must have the ability to link all family member records. R3

Centralized MailingThe solution must be able to print a document for insertion into an envelopebased on business rules.

Setup Criteria

R3FR1.85-

001

Number Requirement PlannedRelease

FR2.7-001

must display a definition associated with each criterion withinThe solutionthe same window

R3

FR2.8-001

The solution must allow a user to create a criterion for vccl population R3

FR2.8-002

must allow a user to update a criterion for VCCI populationgroup.The solution R3

FR2.8-003

ution must allow a user to delete a criterion for VCCI populationThe sol R3

FR2.8-004

The solution must allow a user to record criterion for vccl population R3

Estatrlish Case Criteria

Srlrn or VrnvIoNto CoNtn-ncr FoR PnnsoNar, SnnvrcnsDnplnrvrnNT oF VBnruoNr HBalrn AccpssEQHnar,ur Sor,urroNs, Inc.

Pacn 119 or 268

CoNrR.q.cr # 28739AunNuuBNr # 2

R3The solution must allow a user to create a criterion for High-Risk pregnancyFR2.8-005

R3FR2.8-006

The solution must allow a user to update a criterion for High-Risk pregnancy

ationR3The solution must allow a user to delete a criterion for High-Risk pregnancyFR2.8-

007R3FR2.8-

008

The solution must allow a user to record criterion for High-Risk pregnancy

R3FR2.8-009

The solution must allow a user to create a criterion for Pregnant women

R3The solution must allow a user to update a criterion for Pregnant womenFR2.8-010

R3FR2.8-011

The solution must allow a user to delete a criterion for Pregnant womention

R3The solution must allow a user to record criterion for Pregnant womenFR2.8-012

R3FR2.8-013

The solution must allow a user to create a critenon for Post-Partum women

R3FR2.8-0t4

The solution must allow a user to update a criterion for Post-Partum women

R3The solution must allow a user to delete a criterion for Post-Partum womenFR2.8-015

R3FR2.8-016

The solution must allow a user to record criterion for Post-Partum women

tionRisk Stratification and Determination

R3The solution must send a notification to a user based on business rules.FRl.88

Case AssignmentPlannedRelease

Requirementnumber

Requirement

As Additional Staff to CaseR3NE3.6-

001

The solution must provide resource availability functionality

The solution must validate case assignment changes against resource

Conduct Outreach

R3N83.6-002

R3The solution must send a notification to a user based on business rules.

.JFRl.88

R3The solution must send an alert to a user based on business rules. (FR3.7)FRl.87

R3FR 1.88 The solution must send a notification to a user based on business rules.

Establish Case

Establish Case

Sr.q.rn on VnnvroNr, Conrnncr FoR pnnsoNnr, SnnvrcnsDnpaRrvrnNT oF VnnuoNr Hnnr,rn AccpssEQHnalrn Sor,urroxs, INC.

Pncn 120 or 268CoNrnacr # 28739

AupNovrnNr # 2

FR3.10-001

The solution must record the elapse time between outreach assignment andoutreach is acknowledged.

R3

FR3.21-001

The solution must allow a user to close a program specific case. R3

FRI.88 The solution must send a notification to a user based on business rules.(FR3.21)

R3

Assign Case ManagerThe solution must allow a user to send an alert based on business rules.FRl.87

Member's Profile S

R3

FR4.3-001

The solution must populate a member medication list from PBM with thefollowing parameters:a) Amount of pills.b) Measurement unit.c) Dosage.d) Date filled.e) Pharmacy.f) Prescriber.

R3

Perform Screening and AssessmentsFR4.8-001

The solution must populate the following data fields in screeningsa) Demographics,b) Clinical data,c) Previous pregnancy history,d) Primary Care Provider,e) Obstetrics (OB) Provider,f) Dental Provider,g) Dental history.

R3

FR4.8-002

The solution must populate the following data fields in assessments :

a) Demographics,b) Clinical data,c) Previous pregnancy history,d) Primary Care Provider,e) Obstetrics (OB) Provider,f) Dental Provider,g) Dental

R3

Requirementnumber

Requirement PlannedRelease

Develop Action PlansFR5.34-001

The solution must allow a user to save an action plan. R3

Perform S and Assessments

Manage Treatment Plan and Outcomes

Srarn or VnRvroNt, CoxtRLcr FoR PnnsoNl.r- SnnvrcBsDnp,q.nrN{nNT oF VpnvroNr Hr,lr,rn AccnssEQHnl.r,rn Sor,urroNs, INc.

Pacn l2l ot 268CoNrru.cr #28739

ArurNotrruNr # 2

R3The solution must allow a user to email an action plan.FR5.34-002Provide Education Materials

R3FR5.45-001

The solution must allow a user to batch education materials.

R3FR5.45-002

The solution must allow a user to print batched education materials.

Case DocumentationPlannedRelease

Requirementnumber

Requirement

R3N86.5-001

The solution must include the following attributes for every issue

a)priorityb)outcome typec)date identifiedd)source of identificatione)reviewer

R3The solution must allow a user to schedule a meeting.NE6.11-001

R3N86.1 1-

oo2The solution must allow a user to delete a meeting.

R3The solution must allow a user to update a meeting.NE6.1 1-

003R3The solution must allow a user to search for a meeting by attendees.NE6.1 1-

004R3NE6.13-

001

The solution must provide mapping functionality which will be available inprovider search tool

R3The solution must provide mapping functionality which will be av

module.

ailable inNE6.13-002

R3N86.14-001

The solution must be able to provide printable maptment.

directions to each

Close Program EnrollmentR3The solution must use nationally recognized grouper to determine gaps

metrics for medication adherence

lnN86.24-001

R3The solution must use nationally recognized grouper to determine gaps inpharmacy metrics for prescribed drug adherence

NE6.24-002

R3NE6.24-003

The solution must use nationally recognized grouper to determine gaps inrates.metrics for

R3The solution must use nationally recognized grouper to determine gaps infor adherence with therapvpharmacy metrics

NE6.25-001

Manage Case Information

Surn or Vnnnroirlt, CoNtnncr FoR pnnsoNar, SrnvrcnsDnpanrvrBNT oF Vnnuoxr Hnnr,rn AccnssEQHrar,rn Sor,urroNs, INc.

PAGE 122o1268CoNrnrcr # 28739

AvrnNtvrnNr # 2

Case DocumentationRequirementnumber


FR6.14-001

solution must be able to connect the mother's case with a newborn'scase.

The R3

FR6.14-002

The solution must be able to connect the mother's case with multiplenewbom's cases.

R3

FR6.17-001

The solution must allow a user to record a revision of a members casehistory with the following parameters:a) Needs assessmentb) Plan of Carec) Community Providersd)Community Partnerse) Case file

i contact datesii contact times.

R3

SchedulingFR6.26-001

solution must provide a calendar form with the following parameters:a)Appointment category,b)Meeting type,c)Start date,d)End date,e)Start time,f;End time,g)Attendees list,h)Meeting location,i)Meeting instructions,

The R3

FPi6.27-001

The solution must allow an attendee to be added to an appointment. R3

FR6.27-002

The solution must allow multiple attendees to be added to an appointment R3

FFi6.27-003

The solution must allow multiple attendees to be removed from anappointment.

R3

FR6.27-004

The solution must allow an attendee to be removed from an appointment. R3

FR6.30-001

solution must allow an appointment creator to attach a document to anThe R3

FR6.30002

The solution must allow an appointment creator to attach multiple documentsto an appointment.

R3

FR6.30-003

ution must allow an appointment creator to remove an attachmentThe solfrom an appointment.

R3

FR6.36-001

The solution must save an appointment invite. R3

Case Information

Sr.trn or VnnuoNt, Contru.cr FoR PnnsoN-q,L SnnvrcBs

DnpnnrvrnNT oF VnnNloNr Hw,rn AccnssEQHnar,rn Sor,uuoxs, INC.

Prcn 123o1268CoNrru.cr #28739

AvrnNnupnr # 2

FR6.37-001

The solution must electronically deliver an appointment invite to all

attendees

R3

FR6.38-001

The solution must allow an appointment attendee to accept an invite R3

FR6.38-002

The solution must allow an appointment attendee to

invite.

tentatively accept the R3

FR6.38-003

The solution must allow an appointment attendee to decline an invite. R3

FR6.38-004

The solution must allow an appointment attendee to propose a new time for

an

R3

FR6.39-001

The solution must report on appointment attendee's RSVP R3

FR6.40-001

The solution must allow a meeting attendee to include a message to RSVP R3

FRl.88 The solution must send a notification to a user based on business rules.

.41

R3

FR6.43-001

The solution must send an updated appointment invite to all attendees R3

FR6.44-001

The solution must highlight an appointment location change as part of the

invite.

R3

FR6.44-002

The solution must highlight an appointment date change as part of the

invite.

R3

FR6.44-003

The solution must highlight an appointment time change as part of the

invite.

R3

FR6.44-004

The solution must highlight a meeting location change as part of the updated

invite

R3

FR6.44-005

The solution must highlight a meeting date change as part of the updated

invite.

R3

FR6.44-006

The solution must highlight a meeting time change as part of the updated

invite.

R3

FRl.88 The solution must send a notification to a user based on business rules.

.46

R3

FR6.49-001

The solution must provide a map of the appointment location. R3

FR6.50-001

The solution must allow a meeting attendee to retrieve directions to a

location.

R3

FR6.51-001

The solution must populate the meeting location address when an attendee

to retrieve directions.

R3

FR6.52-001

The solution must display miles to an appointment location. R3

FR6.87-001

The solution must allow a referral acknow ledgement to be printed. R3

FR6.95.001

The solution must highlight the changes made to the referral R3

Surn or VnnnnoNr, CoNrucr FoR prRsoNal SnnvrcrsDrpanrvrnNT oF VBruroNr Hrar,rn AccEssEQHrlr,rn Sor,urroNs, INc.

Pacu 124o1268CoNrRAcr #28739

AvrnNnlrnNr # 2

FR1.88 The solution must send a notification to a user based on business rules. R3

FR6.101-001

The solution must have the ability to report on transitions betweenCommuni

R3

FR6.101-002

ution must have the ability to report on transitions betweenThe solCommunitv partners.

R3

FR6.101-003

The solution must have the ability to report on transitions between levels of R3

FR1.87 must send an alert to a user based on business rules. (FR6.101)The solution R3

Close EnrollmentFR6.116.001

must update a survey with a status of death when the reason forenrollment closure is death.

The solutioncase

R3

FR6.116.002

116.002 The solution must update a survey with the date of death whenenrollment closure is death.

FR6.the reason for case

R3

FR6.116003

The solution must update a member's plan of care with a status of deathlrylren the reason fol r4le program enrollment closure is death.

R3

FR6.116004

The solution must update a member's plan of care with the date of deathwhen the reason for case enrollment closure is death.

R3

FR6.1l600s

must update a gap in care with a status of death when the reasonenrollment closure is death.

The solutionfor case

R3

FR6.116.006

must update a gap in care with the date of death when thegram enrollment closure is death.reason for case pro

The solution R3

Care CoordinationFR6.120-001

must display contact information of internal unit staff involvedin member's plan of care.

The solution R3

Manase Population Health OutreachNumber Requirement Planned

ReleaseNE7.4.001

must be able to assign a user in real time to work with a clinicallead at apartner site based on zip code.

The solution R3

NE7.4.002

solution must be able to assign a user in real time to work with a clinicalartner site based on a nurse's

Thelead at a

R3

NE7.7.001

able to assign a member to a Case Manager based onThe solution must bebusiness rules.

R3

NE7.7.002

The solution mustbased on business

be able to assign a provider practice to a Case Managerrules.

R3

NE7.7.00J

solution must be able to assign a clinical lead to a case Manager basedon business rulesThe R3

Care Coordination GoalsNE7.28.001

The solution must allow a user to create a measure of improvement for adisease.

R3

NE7.28.002

must allow a user to edit a measure of improvement for aThe solutiondisease.

R3

Manage Population Health Outreach

Srarn or VnnvroNt, CoNtnncr FoR PnnsoNar, SnnvrcasDnpaRtvrnNT oF VrnwroNr Hnar,nr AccnssEQHnar,rn Sor,urroNso INc.

P.tcn 125 or 268CoNrnq,cr #28739

AMENDMENT # 2

R3NE7.28.003

The solution must allow a user to delete a measure of improvement for a

diseaseR3The solution must allow a user to report on a measure of improvement for a

disease.NE7.28.004

R3NE7.28.005

The solution must allow a user to create a performance

measure for a staff member.

improvement

R3The solution must allow a user to edit performance improvement measure for

a staff memberNE7.28.006

R3NE7.28.007

The solution must allow a user to delete performance improvement measure

for a staff memberR3The solution must allow a user to report performance improvement measure

for a staff memberNE7.28.008

R3The solution must record utilization on any data element of integrated care

coordination.NE7.28.009

R3NE7.28.010

The solution must allow a user to create a cost saving initiative on integrated

care coordination.R3The solution must allow a user to edit a cost saving initiative on integrated

care coordination.NE7.28.0ll

R3The solution must allow a user to delete a cost saving initiative on integrated

care coordinationNE7.28.072

R3NE7.28.013

The solution must allow a user to record a cost saving initiative on integrated

care coordination.of Services

R3The solution must allow a user to monitor medication adherence

interventton.NE7.38.001

R3The solution must allow a user to report on medication adherence

interventionNE7.38.002

R3NE7.38.003

The solution must allow a user to monitor on medication reconciliation

intervention over timeR3The solution must allow a user to report on medication

intervention.

reconciliationNE7.38.004

R3NE7.40.001

The solution must allow a user to monitor depression screening intervention.

R3NE7.40.002

The solution must allow a user to report on depression screening

intervention.R3The solution must allow a user to report on depression screening scoring

interventionN87.40.003

R3NE7.40.0o4

The solution must allow a user to monitor depression screening sconng

intervention.R3NE7.40.0

05

The solution must allow a user to monitor depression screening results.

R3The solution must allow a user to report on depression screbning results.NE7.40.006

R3NE7.44.001

must allow a user to monitor on-going assessment of amedical intervention over time.

The solution

Srarr or VnnvroNr, CoNrrucr FoR prnsonlr, SnRvrcnsDnplnrvrBNT oF VnnryroNr HBar,rn AccnssEQHnurn Sor,urrons, Inc.

P.rco 126ot268CoNrrucr # 28739

AvrpNptrnNr # 2

NE7.44.002

The solution must allow a user to report on on-going assessment of aparticipant's medical intervention over time.

R3

NE7.44.003

The solution must allow a user to monitor on-going assessment ofparticipant's psychosocial intervention over time.

R3

NE7.44.004

The solution must allow a user to report on on-going assessment ofparticipant's psvchosocial intervention over time.

R3

NE7.46.001

The solution must allow a user to monitor provider notification of care co-ordination enrollment intervention.

R3

NE7.46.002

The solution must allow a user to report on provider notification of care co-ordination enrollment intervention

R3

NE7.46.003

The solution must allow a user to monitor engagement level of individual oncare co-ordination intervention.

R3

NE7.46.004

The solution must allow a user to report on engagement level of panel ofon care coordination intervention.

R3

NE7.50.001

The solution must support care co-ordination integration with the followingcomponents:a) Clinical treatment guidelines,b) Disease prevention strategies ,c) Patient self-care education,d) Social suooort services.

R3

NE7.50.002

The solution must report a cost savings to the payer for each of the followingcomponents:a) Clinical treatment guidelines,b) Disease prevention strategies,c) Patient self-care education,

Social sernces

R3

Health OutreachNumber Requirement Planned

Release

FR7.18.001

The solution must be capable of receiving population data from censusdata.(G4. 1 0) Admission and discharge

R3

FR7.18.002

The solution must be capable of receiving population data from vitalstatistics. G4.t

R3

FR7.18.003

The solution must be capable of receiving population data from eHealthof FR7.18.004

R3

FR7.18.004

The solution must be capable of receiving population data from Birth R3

FR7.18.005

The solution must be capable of receiving population data from Death R3

FR7.18.006

The solution must be capable of receiving population data from Breast andCervical Cancer G4.t3

R3

Sr,q.ru or VnnvroNt, CoNtnacr FoR PnnsoNn, SBnvrcnsDnpLRrunNT oF VnnvroNr Hr.qlrH AccnssEQHn,Llrn Sor,urroNso INc.

PAGE 127 o1268CoNrnacr # 28739

AwrnNovrnur # 2

R3The solution must be capable of receiving population data

Immunization Registry. (G4. 1

fromFR7.18.007

R3The solution must be capable of receiving population data from ACO'sFR7.18.008

R3FR7.18.009

The solution must be capable of receiving population data from Blueprint.

R3The solution must allow a user to schedule an appointment with a ClinicalLead at a Provider site.

FR7.6.001

PlannedRelease

RequirementNumber

R3NE8.5.001

The solution must use a nationally recognized grouper tothat indicate a member's adherence with

determine the

number of medicationR3The solution must use nationally recognized grouper to determine

duration of each medicationtheNE8.5.00

2R3NE8.5.00

-l

The solution must use nationally recognized grouper to determine the

ratiomedicationR3The solution must use nationally recognized grouper to

continuous medication availabilidetermine the

ratio cNE8.5.004

R3The solution must use nationally recognized grouper to determine

the condition is untreated.

the risk ifNE8.5.005

R3FR8.6.00I

The solution must provide care coordinators with access to current MMIS-data.sourced

R3The solution must provide care coordinators with access to current

The solution must have access to current community provider registry

2-r-t-

datadata.sourced

hne2-l-1.the

FR8.6.002

R3FR8.6.00J

R3FR8.6.004

The solution must have access to current community partner registry

through the emergency line2-l-Idata

Referral ManagementPlannedRelease

Number Requirement

R3The solution must acknowledge the receipt of a referralN89.2.00I

R3The solution must allow a user to accept a referral.NEg.2.002

R3NE9.2.00J

The solution must allow a user to decline a referral

R3The solution must allow a user to record referral status.NE9.2.004

R3The solution must allow a user to report on the referral status.NE9.2.005

Manage Registry

Authorization Determination

Srarp or VrnnaoNr, Contnacr FoR pnnsoNn SnnvrcnsDnplntnnnNT oF' VnRvroNr Hn.rr,ru AccnssEQHrn ru SolurroNs, INc.

P.c.cn 128 or 268CoNrnacr #28739

AvrnNomrNr # 2

FRl.88 The solution must send a notification to a user based on business rules.(NEe.2)

R3

NEl0.1.001

The solution must provide clinical performance reports for any populationlevel.

R3

NEI0.1.002

The solution must provide operational performance reports forlevel.

any R3

NEl0.1.003

The solution must financial for ation level.reports any popul R3

NEl0.1.004

The solution must provide member satisfaction reports for any populationlevel

R3

NEl0.1.005

The solution must provide quality of life reports for any population level R3

NE10.2.001

solution must provide clinical performance reports at a program level.The R3

NE10.2.002

The solution must provide operational performance reports at aprogramlevel.

R3

NE10.2.003

The solution must provide financial reports at a program level R3

NE10.2.0o4

must provide member satisfaction reports at a program levelThe solution R3

NE10.2.005

solution must provide quality of life reports at a program level.The R3

NE10.3.001

The solution must report on clinical performance on member level. R3

NE10.3.002

ution must report on operational performance on a member levelThe sol R3

NE10.3.003

solution must provide financial reports on a member level.The R3

NE10.3.004

The solution must report on member satisfaction on a member level R3

NE10.3.005

The solution must report on quality of life on a member level R3

NE10.4.001

must produce an outcomes report using data from the followingsources:a) claimsb) information collected in the care management systemc) other state agenciesd) other state programse) providers

The solution

ACO

R3

NE10.6.00l

The solution must report on services. R3

N810.6.002

The solution must report on programs. R3

Reporting Requirements

Sr^lrn or VnnuoNt, CoNtru.cr F'oR PERSoNAL SnnvrcnsDnpLnrnnnNT oF' VnnvroNr Hnar,rn AccnssEQHrllrn Sor,urroNso INc.

Prcn 129o1268CoNrru.cr #28739

AvrnNuvrnnr # 2

NE10.6.003

The solution must report on clinical outcomes' R3

NE10.6.004

The solution must report on financial outcome. R3

NE10.6.005

The solution must monitor services. R3

NE10.6.006

The solution must monitor programs. R3

NE10.6.007

The solution must monitor clinical outcomes. R3

NE10.6.008

The solution must monitor financial outcomes. R3

R3NE10.7.00t

The solution must provide the ability to create an eligible population report

on any combinations of the following parameters:

a) age

b) genderc) zip code .

d) acuitye) primary diagnosisf) secondary diagnosisg) predicted riskh) PCP

recel careINE10.8.001

The solution must provide a provider population report on any

of the following parameters:

a) age

b) genderc) zip coded) acuitye) primary diagnosisf) secondary diagnosisg) predicted riskh) pcpi) populations receiving care

health service area

combinations R3

NE10.9.001

The solution must provide the ability to create an enrollment statistics

product program using any combination of the following parameters:

a; Referrals b) opt-out c) engaged d) unable to contact e) unable to reason f)

cases closed reason for cases closed health condition.

R3

R3NE10.9.002

The solution must provide the ability to create a health condition product

NE10.9.003

The solution must provide the ability to create a population participation

product program report using combination of the following parameters a) #

of participants engaged with a CC by severity level b. Total # of activeparticipants with an individuahzedplan of care.

R3

Surr or Vunvroxro CoNrnlcr F.oR pnnsoxar, SnnvlcnsDnpLnrunNT oF Vrnvronr Hrar,rn AccnssEQHn,t r,rn Sor,utroNs, INc.

PAGE 130 or 268CoNrnncr #28739

AvrnNovrnNr # 2

NE10.9.004

The solution must provide the ability to create clinical condition specificproduct program report.

R3

NE10.9.005

The solution must provide the ability to create a utilization specific productprogram using any combination of the following parameters:a) % of enrollees with 2 or more MD office visits within the last l2 monthsb) % of enrollees getting a flu vaccine c) vo of enrollee getting pneumoniavaccine within last 5 years d) Other Wellness/Preventive care screemngsbased on the member population

R3

N810.9.006

The solution must provide the ability to create preventative specific productprogram using combination of the following parameters:a) o/o of enrollees with 2 or more MD office visits within the last 12 monthsb) % of enrollees getting a flu vaccine c) % of enrollees getting pneumoniavaccine within last 5 years d) other Wellness/Preventive care screeningsbased on the member population

R3

NEl0.10002

The solution must report on sub scores in a member's assessment resultsPH UN

R3

NE10.10003

The solution must report on a member's satisfaction survey results. R3

NEl0.10004

The solution must report on a member's plan of care outcomes. R3

NE10.10.005

The solution must report on a member's length of program participation. R3

NEl0.1 1 .

001The solution must provide the ability to create an admissions financial report. R3

NEl0.l I002

The solution must provide readmissions financial report. R3

NEl0.11003

The solution must provide a length of stay financial report. R3

NEl0.11004

The solution must provide the ability to create an admissions financial reportfor specific conditions

R3

NEl0.1100s

The solution must provide a pharmacy cost financial report in relation tooverall costs.

R3

NEl0.l3-001

The solution must report on staff productivity over a predefined timeframe. R3

FRl0.14-001

The solution must report on caseload by staff over a predefined timeframe. R3

FRl0.16-001

The solution must have the ability to create a geographic variability ofchronic diseases report containing the following parameters:a) zip codeb) provider practicec) PCPd condition

R3

NEl0.17-001

The solution must provide a report with the following parameters:a. conditionb. % of enrolled members with completed assessmentsc. medication adherence

R3

Srarn or Vanvronto CoNtru,cr FoR PBnsoxll, SnnvrcnsDnp^c.RrivIBNT oF VBnuoNr Hnllrn AccnssEQHn.Llrn Sor,unoNs, INc.

PAGE 131 or 268

CoNrnq,cr # 28739AvrrNnvrnNr # 2

NE10.20001

The solution must provide a report with the following parameters:

a. AlCb. ED utilization

R3

NE10.23-001

The solution must provide a program-specificincluding the following parameters:

a. percentage ofcaseload capacityb. case with GA (General Assessment)

operational metrics report

c. staff

R3

R3NE10.27-001

The solution must provide a report comparing a Member's health profile to

member file and overall populationpro

NE10.30-001

The solution must provide a Member Report with the following parameters:

a. Member satisfaction surveyb. Plan of Care outcomesc. of

R3

NE10.32-001

The solution must provide a PCP Performance Report

parameters:a. PCPb. provider practicec. HSA

with the following

b. patients with chronic conditions within goalhange for those conditions

c. outreachd. patient datae. visit plannersf. trends over time

R3

NE10.33-001

The solution must provide a HRSA clinical.measure report for FQHC(Federally Qualified Health Center) based on HRSA requirements

R3

FRl0.5.001

The solution must provide the ability to archive reports R3

FRl0.5.002

The solution must provide the ability to delete reports R3

FRl0.l3.001

The solution must generate a report in real time based on a schedule

determined by the user

R3

FRl0.13002

The solutibn must be able to distribute a report to a subscribed user in real

time based on business rules.

R3

FRl0.13.003

The solution must allow a user to subscribe to a report distribution. R3

FRl0.13004

The solution must allow a user to unsubscribe to a report distribution. R3

FRl0.27-001

The solution must provide multi-dimensional Financial reports. R3

FR10.27-oo2

The solution must provide multi-dimensional Budget forecasting. R3

FR10.27-003

The solution must provide multi-dimensional Cash flow reports. R3

Srarn or VrnvroNr, CoNrnncr FoR pBnsoN,rr, SnnvrcnsDnplnrvrnNT oF Vnnvroxr Hnar,rn AccnssEQHnalru Sor,urroxs, INc.

Pncn 132 or 268CoNrnacr #28739

AvrnNrvrnNr # 2

FR10.27-004

The solution must provide multi-dimensional Recipient cost and User ofservices reports.

R3

FR10.27-005

The solution must provide multi-dimensional cost/benefit analysis reports. R3

FR10.27-006

The solution must provide multi-dimensional Prescription drug policy R3

FR10.27-007

The solution must provide multi-dimensional Cost and User ofprescription R3

FRt0.27-008

The solution must provide multi-dimensional Recipient participation reports. R3

FR10.27-009

The solution must provide multi-dimensional Eligibility and benefit designreports.

R3

FR10.27-010

The solution must provide multi-dimensional Geographical analysis reports R3

FRl0.27-011

The solution must provide multi-dimensional Program planning reports. R3

FR10.27-012

The solution must provide multi-dimensional Policy analysis reports. R3

FRl0.27-013

The solution must provide multi-dimensional Program performancemonitoring reports.

R3

FR10.27-014

The solution must provide multi-dimensional Medical assistance policydevelopment reoorts

R3

FRl0.27-015

The solution must provide multi-dimensional capacity planning reports R3

FR10.27-016

The solution must provide multi-dimensional Provider participation reports R3

FR10.27-017

The solution must provide multi-dimensional Service delivery patternsreports

R3

FR10.27-018

The solution must provide multi-dimensional Adequacy of and access to care R3

FR10.27-019

The solution must provide multi-dimensional euality of care reports. R3

FR10.27-020

The solution must provide multi-dimensional Outcomes assessment reports. R3

FR10.27-02r

The solution must provide multi-dimensional Disease management reports R3

FR10.27-022

The solution must provide multi-dimensional External reporting reports. R3

FRl0.27-023

The solution must provide multi-dimensional Public information reports R3

FR10.36001

The solution must have the ability to create a report to analyze effectivenessof Medicaid dollars to Medicaid

R3

FR10.36002

The solution must have the ability to create a report to analyze effectivenessofother agencies in support ofcare management goals.

.R3

FR10.37.001

The solution must allow a user to enter free-form text to be associated witheach

R3

Surn or VnniuoNt, CoNtrucr FoR PtnsoNar, SnnvrcnsDnpanrunNT oF VnnuoNr Hn,lr,rn AccpssEQIIn,lr,rs Sor,urtoNso INc.

PAcE 133 or 268

CoNrnc.cr #28739AivrnNntvrnnr # 2

FR10.37.oo2

The solution must allow a user to enter the following parameters to be

associated with a report: free-form text note field, name, date, timeR3

FRl0.38.001

The solution must be able to calculate the BMI for a member based on height

and weieht.

R3

FRl0.38.002

The solution must have access to a member's BMI from their medical

records

R3

FRl0.39001

The solution must be able to report on inpatient facility admission data on an

ad hoc basis.

R3

FR10.40001

The solution must collect the following data elements for High-Riskpregnancy:a) Gestational age at referralb) Date of contact with memberc) # of phone callsd)# of office visitse)# of home visitsf) Date closedg) Last Menstrual Period (LMP)j) Final Expected Due Datei) Date of initial prenatal visitj) Number of prenatal visitsk) Maternal oomplicationsl) Date of postpartum visitm) Birth weightn) NICU stayo) Heightp) Weight at LMPq) BMIr) Progesterone screenings) Tobacco use screeningt) Post-partum depression screeningu) Prenatal visits

R3

FR10.40.002

The solution must be able to create a High-Risk Pregnancy report with any

combination of the following parameters:

a) Gestational age at referralb) Date of contact with memberc) # of phone callsd)# of office visitse) # of home visitsf) Date closedg) Last Menstrual Period (LMP)j) Final Expected Due Datei) Date of initial prenatal visitj) Number of prenatal visitsk) Maternal complicationsl) Date of postpartum visitm) Birth weight

R3

Surn or VnnvroNr, CoNrn-tcr FoR PnnsoNar, SnnvrcnsDupanrunNT oF VnnvroNr Hnar,rrr AccnssEQHralrn Sor,urroNs, Inc.

PAGE 134o1268CoNrnq.cr # 28739

AvrnxovrnNr # 2

n) NICU stayo) Heightp) Weight at LMPq) BMIr) Progesterone screenings) Tobacco use screeningt) Post-partum depression screeningu) Prenatal visits

FR10.46001

The solution must allow a user to update a survey response based on businessrules.

R3

FR10.46.002

The solution must allow a user to delete a survey response R3

FR10.47001

The solution must provide an analysis tool for a user to review surveyresponses.

R3

FR10.49001

The solution must have the capability to display a population dashboardrepoft as per business rules.

R3

FR10.49.002

The solution must have the capability to display a program dashboard reportas per business rules.

R3

FR10.49003

The solution must have the capability to display a member-based dashboardreport as per business rules.

R3

FR10.s0-001

The solution must report an analysis of service(s) given to a member bycondition.

R3

FR10.52001

The solution must collect data on high risk families by zip code. R3

FR10.52-002

The solution must collect data sets of children in custody for department ofchildren and families by zip code.

R3

FR10.52003

The solution must report on data on high risk families by zip code R3

FR10.52004

The solution must report on geographical data sets of children in custody fordepartment of children and families.

R3

FR10.54-001

The solution must have the ability to generate federal required reports forcare

R3

The solution must have the ability to generate state required reports for care R3

Consent

FR10.54-002


FRl.88 The solution must send a notification to a user based on business rules(FRl1.3)

R3

FRl1.6-001

The solution must record the consent with a combination of the followingparameters:

the consent from Membera) Entity

R3

Consent Man

Srlrn or VnnuoNt, CoNtucr FoR PnnsoNar, SEnvrcssDnpa.nrnnnNT oF VnRvroNr Hnl.LrH AccnssEQHnnlrn Sor,urrons, INc.

Pacr 135 or 268

CoNrRl.cr # 28739AvrnNuvrpnr # 2

b) Providers who can share information.c) Entities who can share informationd) Individuals who can share informatione) Type and focus of the information covered (granularity and parameters to

be determined by Vermont PolicY)f) Types of information (e.g., benefit and eligibility information, medical

records, assessments, test results, claims and payments)

g) Areas of sharing (e.g., behavioral health, mental health, chronic care,

High-Risk Pregnancy)h) Purpose of the sharing of information (e.g., congruency and coordination

of care, continuity of care)

i) Expiration conditions of the consent:

i. Period of time from date consent is givenii. Specified end dateiii. Specific event (e.g., end of required collaborative

service delivery, end of treatment)Consent status

R3The solution must populate the following attributes when a member is

providing the consent:a) First name,b) Last name,c) Date of Birth.

FRl1.7.001

R3NE12.3.001

The solution must be integrated with Vermont health information exchange

R3NE'12.3.002

The solution must create claims continuity of care records'

R3The solution must create clinical continuity of care recordsNE12.3.003

R3The solution must create data profile at the member facility level.NE12.3.004

R3NE12.3.005

The solution must create data profile at physician facility level

R3The solution must create data profile at provider facility levelNE12.3.006

Health Care Reform

CR059 - Governance ReviewPlannedRelease

RequirementNumber

R3FRl.15-001

The solution must allow a user to soft delete a program segment.

R3FR1.15-002

The solution must allow a user to update a program segment.

Srarr or VnRvroxr, CoNrnlcr FoR pnnsoNnr, SrnvrcrsDnp,rnrurNT oF VrnvroNr Hnar,ru AccnssEQHnl.lrn Sor,urroNs, INC.

PAGE 136 or 268CoNrnrcr # 28739

AvrnNuvrrcNr # 2

FRl.15-003

The solution must allow a user to document the reason for removal of aSE

R3

FRl.15-004

The solution must allow a user to document the reason for updating a programsegment.

R3

FRl.15-00s

The solution must allow a member to enter free form comments. R3

FRl.15-006

The solution must allow a supervisor to edit program status details. R3

FR7.8-001

The solution must provide consistent session note types throughout thesolution.

R3

FR10.42-001

The solution must allow a supervisor to soft delete a survey based on businessrules.

R3

FR10.42-002

The solution must display a confirmation message when a survey is softdeleted.

R3

FR10.42-003

The solution must allow a user to finalize an incomplete survey. R3

FR10.42-004

The solution must confirm a survey has been "finalized incomplete" R3

FR10.42-005

The solution must report on "incomplete survey closed" status. R3

FR10.47-001

The solution must provide an analysis tool for a user to review survey R3

FR10.s8 The solution must archive a survey associated with a pervious enrollment. R3

CR074 - Reportine FR Scope Alignment and ReconciliationNumber Requirement Planne

dRelease

FR10.29-001

The solution must send a report via email. R3

FRl0.3-001

The solution must save a report template. R3

FR10.3-002

The solution must provide access to view a report template. R3

FR10.3-003

The solution must allow a user to delete a report template. R3

FR10.3-004

The solution must allow a user to update a report template. R3

NE10.21-001

The solution must report an overview of clinical outcomes for specificconditions by program episode.

R3

NE10.24-001

The solution must report the count of total Emergency Department visits for amember by hospital.

R3

NE10.24-002

The solution must report the count of total Emergency Department visit for amember for a predefined time period prior to CM intervention.

R3

Srarr or VrnuoNt, CoNtucr FoR Pnnsonar, SnnvrcnsDnpanrunNT oF' VnnvroNr Hnl.r,rn AccnssEQHr.lr,rn Sor,urroNso INc.

Plcn 137 or 268

CoNrru.cr #28739AurnNnvrnNr # 2

NE10.24-003

The solution must report the count of total Emergency Department visit for a

member for a predefined time post CM intervention.R3

NE10.28-001

The solution must report clinical metrics of VCCI eligible members' identified

conditions

R3

NE10.28-002

The solution must report clinical metrics of VCCI target members' identified

conditions

R3

NE10.28-003

The solution must report clinical metrics of VCCI enrolled members'

identified conditions.

R3

NE10.28-004

The solution must report the progress of a goal R3

NE10.28-005

The solution must report the progress of an intervention. R3

NE10.28-006

The solution must report the achievement of a goal on completion. R3

N810.28-007

The solution must report the achievement of an intervention on completion R3

FRt0.50-002

The solution must report on the impact analysis of service(s) given to a

member by condition.

R3

NE7.48-001

The solution must report on utilization pattern by provider R3

NE7.48-002

The solution must report on the adherence to condition specl fic standards ofcare.

R3

NE7.57-001

The solution must report on member collaboration. R3

NE7.57-002

The solution must report on member engagement. R3

SFR2.31 The solution must load an ACO- attributed members data file based on

business rules to determine vccl eligibility, with the following set ofcomponents:i) Re_uniqueJd Member IDii) Last_Nameiii) First_Nameiv) ACO-FLAG (0 [not attributed; or I [attributed])v) ACO_Start_Date

ACO Date should be last date of the current month's

R3

FR10.55 attributed to ACOThe solution must be able to report the list of members

based on business rules.

R3

FR10.56 The solution must allow a user to run a report to compare the ACO attribution

list from different

R3

FR2.32.001

The solution must allow a user to identify ACO-attributed members based on

the following information from the ACO-attributed file:i)ACO Flagii) ACO Start Date

ACO Date

R3

FR2.33 The solution must allow a user to identify a member who has

ACO.transitioned to R3

Srlrr or Vrnvronr, CoNrnacr FoR pnnsonnr, SnnvrcnsDnpanrvrnNT oF VnnuoNr Hn,rr,rn AccnssEQHn,rlrn Sor,urrons, Inc.

P.q.cn 138 or 268CoNrntcr # 28739

ANraNoNInNr # 2

FR2.34 The solution must flag ACo - attributed members as vccl ineligible. R3

FR10.57001

The solution must allow a user to report the outcomes of vccl populationbased on business rules.

R3

FRl0.57002

The solution must allow a user to report the outcomes of ACo populationbased on business rules.

R3

FR10.57.003

The solution must allow a user to compare the clinical outcomes report ofACO clinical outcomes of VCCI

R3

FF.7.22 The solution must display clinical data received from VHIE. R3

FF.7.23-001

The solution must maintain Laboratory(LAB) data in a datamodel R3

FR7.23-002

The solution must maintain Immunization/vaccine(vxu) data in a datamodel.

R3

FR10.58-001

The solution must report on Laboratory (LAB) data. R3

FR10.58-002

The solution must report on Immunization/ Vaccine (VXU) data. R3

FPt7.24-001

The solution must receive CCD files from the VHIE. R3

FP.7.24-oo2

The solution must maintain CCD files received from the VHIE. R3

FF.7.24-003

The solution must allow a user to view CCD files. R3

FRl.89 The solution must send a VHIE generated alert to a user based on businessrules G4

R3

Document ManagementNumber Requirement Planne

dRelease

FR1.1 Contractor's System will store State-approved letter templates.The R1FINAL

FR1.2 The contractor's System will allow users to access appropriate lettertemplates based on need and role.

R1

FINALFRl.3 contractor's System will pre-populate letters with the profile of the user,

which includes but is not limited to:a) First and last name b) Title c) Department

number, etc.)d) Contact information (email address" phone

The R1FINAL

FR1.4 The Contractor's System will pre-populate letters with the date R1

FINALFRl.5 The Contractor's System will allow Users to enter freeform text to

communicate notes / comments (number of characters as approved by theuirementsState

R1FINAL

General

Srarr or VnnuoNt, Coxtrucr roR PnnsoNc, SnnvrcnsDnp.lntupNT oF VnnmoNr Hnar,rn AccnssEQHnll,rn Solurronso INc.

P.l,cn 139 or 268

CoNrnlcr # 28739AnnnNovrnNr # 2

FRl.6 The Contractor's System will save the completed letters and associate it withMember's record.

R1

FINAL

FRl.7 The Contractor's System will allow for scanned documents to be associated

with Member's Plan of Care or record

R1

FINAL

FRl.8 The Contractor's System will allow for Users to edit letters R1FINAL

FR1.9-1 The Contractor's System will be able to access, pull, and lormat Member's

data into appropriate letters (e.g. Discharge summary will show Member's

from to st-Chronic Care then batch and

R1

FINAL

FR1.9-1* The Contractor's System will be able to access, pull, and format Member's

data into appropriate letters (e.g., Discharge summary will show Member's

from to Chronic Care then batch and mail

R1

FRl.10-1 The Contractor's System willbe able to include, at a minimum, the followingdocument management capabilities: a. Accessible letter templates and forms

b. Updateable templates through the ticketing process. Contractor will release

the updated templates to SoV for testing in an agreed upon timeframe c. Store

documents and files d. Generate materials in both hard copy and electronic

format, including forms and letters e. Create letter templates and forms for the

following areas: i. Community Provider/Partner materials ii. General

correspondence/notices for Community Provider/Partners and Members

The Contractor's System will be able to include, at a minimum, the followingdocument management capabilities: a. Accessible letter templates and forms

b. Updateable templates through the ticketing process. Contractor will release

the updated templates to SoV for testing in a timeframe mutually agreed upon

by the State of Vermont and the contractor, but shall not exceed 5 business

days after Contractor receives requirements. The requests are limited to the

current document management framework of the application. c. Store

documents and files d. Generate materials in both hard copy and electronic

format, including forms and letters e. Create letter templates and forms for the

following areas: i. Community Provider/Partner materials ii. Generalfor Provider/Partners and Members

R1

FINAL

FR1.10t The Contractor's System will be able to include, at a minimum, the followingdocument management capabilities :

a. Accessible letter templates and formsb. On-line, updateable templates that allow Users to customize on an as-

needed basisc. Store documents and filesd. Generate materials in both hard copy and electronic fOrmat, includingforms and letterse. Create letter templates and forms for the following areas: i. Community

Provider/Partner materialsii. General correspondence/notices for Community Provider/Partners and

Membersiii. Letters (financial, denial, EOMB, Notice of Decision, etc')

iv. Coordination of Benefits Letterv. Prior Authorization Letters

R2

Sr,q.rn or VnnuoNr, CoNrucr r.oR pERsoNAL SnnvtcnsDnpanrvrnNT oF VrnnaoNr Hnar,rn AccrssEQHnalrn SolurroNso INc.

P.tcn 140 or 268CoNrnacr #28739

AunNrvrpNr # 2

FRl.l0** The Contractor's System will be abledocument management capabilities :

to include, at a minimum, the following

a. Accessible letter templates and formsb. on-line, updateable templates that allow users to customize on an as-needed basisc. Store documents and filesd. Generate materials in both hard copy and electronic format, includingforms and letterse. create letter templates and forms for the following areas: i. communityProvi der/Partner material s

ii. General correspondence/noti ces for community provider/p artners andMembersiii. Letters (financial, denial, EOMB, Notice of Decision, etc.)iv. Coordination of Benefits Letterv. Prior Authorization Letters

R3

FRl.12. a

FRl.12-1The contractor's System will allow users, with appropriate access levels, tocontact eQHealth in order to create / modify / delete / update State-approvedreferral forms, letter templates, and other appropriate documentation. Thiswill be done by following an easy-to-use, well-defined process and at noadditional cost to the State.

R1FINAL

FR1.l2*FRl.12. aFRl.12-1

The Contractor's System will allow (Jsers, with appropriate access levels, tocreate / modify / delete / update State-approved referral forms, lettertemplates, and other appropriate documentation. The contractor's System willallow users, with appropriate access levels, to contact eeHealth in order tocreate / modify / delete / update State-approved referral forms, lettertemplates, and other appropriate documentation. This will be done byfollowing an easy-to-use, well-defined process and atno additional cost to theState.

R2

FRl.l2** The contractor's System will allow users, with appropriate access levels, tocreate / modifu / delete / update State-approved referral forms, letter

and other documentation

R3

Authorized and Provider/Partner PortalFRl.14 The Contractor's System will validate the information provided by the

Member, community Provider/P artner, and Authorized Repres entative.Validation will be based on at least:

a) Required field completionb) Field content types (e.g., names must not contain numbers)c) Acceptable values (e.g., no birth dates before Illll90A)d) values based on available real-time and stored data sources (e.g., vccl

information about the Medicaid Provider verifi cation

R2, R3

FRl.14*The Contractor' s System will validate the information provided by theMember, community Provider/P artner, and Authorized Repres entative.Validation will be based on at least:

a) Required field completionb) Field content types (e.g., names must not contain numbers)

values no birth dates before llllIc

R2

Srlrn or VnnvroNto CoNtnacr FoR PnRsoN,q,L SnRvrcnsDupLRrvrnNT oF VunvroNr Hnal,rn AccnssEQHp,r,lrn Sor,urroNs, INc.

Pncn 141 or 268CoNrru.cr #28739

AvrBNuupnr # 2

d) values based on available real-time and stored data sources (e.g., vinformation about the Member, Medicaid Provider verification)

CCI

R1The Contractor's System will grant and limit access to

Provider/P artner, and Authorized Representative to view/update information,Member, Community

based on User ro access ruleand

FRl.15

WorkflowR1.01The Contractor's System will allow Users to save the data at any point during

afeadata across theFRl.t6

R1The Contractor's System will automatically save work-in-progress and notify

the User that the data was savedFRl.17

Rl.01The Contractor's System will allow Users to continue wiworkflow and other components of a process atearf a single component has

not been

th other steps ofFRl.18

Rl.01FRl.19 The Contractor's System will notify Users when mandatory data fields are

R2The Contractor's System will have workflow management to

electronically send referrals or other documentation through theallow Users to

hierarch for review andlor denial

FRl.21

Alerts and NotificationsR1FINAL

The Contractor's System will have the capability to generate

notifications for Users to see aI" any stage of the case management process

The following Alerts will be introduced in Rl.02:. Case Assigned. Participant Reassigned. Member Deceased. Issues, Goals and Interventions are Closed

alerts andFR1.22-1

R1

FINALFP.I.22-2 The solution must send alerts to users

R1FINAL

The solution must allow anauthoized user to configure alertsFP.l.22-3

R1FINAL

The solution must send notifications to usersFP.L.22-4

R1

FINALhe solution must allow an atrthoized user to configure noti fications.FR1.22-5

R3The Contractor's System will allow Users to subscribe and unsuand rolebased onalerts and

bscribe toFRl.24

FR1.24-1 The solution must capture a client's preferences for his/her subscription to

alerts

FFtt.24-2 The solution must capture a client's preferences for his/her subscription to

notifications.R2The Contractor's System will allow for electronic mailing (e-

of alerts and notificationsmailing),

andbaFR1.25

Srlrn or VnnuoNr, Contrucr FoR pnnsoNlt SnnvrcnsDnpaRrunNT oF Vnnvronr Hnllur AccrssEQHnalrn Sor,uuoNs, INc.

PAGE 142ot268CoNrrucr # 28739

AivrnNovrnNr # 2

FRl.26 The contractor's System will prompt user to indicate action needed /rgquested for a specific alert

R1FINAL

FRl.27 The Contractor's S will allow User to alerts and notifi cations R1FR1.27-1 The Contractor' s System will display the priority of alerts and notifications as

defined by policy. Any changes to the priority can be managed through theR1FINAL

FR1.28 The Contractor' s System will allow User to search for alerts by Member, alertetc.

R1

FINALFR1.29 The Contractor's System will allow User to track age of alerts and

notificationsR1

FINALFRl.30 The Contractor'

or unread alertss System will allow managers / supervisors to view pendingand notifications of their staff.

a. The contractor's system will push these alerts and notifications tomanagers / supervisors after predetermined timeframe based on program

R1FINAL

FRl.30-1 The Contractor' s System will allow managers / supervisors to viewnotifications of staff includine details such as status

RIFINAL

FRl.31 The contractor's System will allow the author of an alert / notification toindicate an overdue date andlor time. The contractor's System will allow theauthor of an alert / notification to indicate an date and/or time

R1FINAL

FRl.31-1 The Contractor' s System will allow the author of an alert / notification toindicate an overdue date and/or time

R1FINAL

FRl.32 The contractor's System will send alerts/notifications to appropriate Userswhen a condition has been achieved. This may include but is not limited to:

a) Medication filledb) Progress towards goal (e.g., partially achieved in first visit and needs to be

addressed at next visit)c) Member contact requirement, per program policyd) Urinalvsis completed for substance abuse patients

R1FINAL

FRl.32-1 The contractor's System will send alerts/notifications to appropriate userswhen a condition has been achieved. This may include but is not limited to: a)Medication filled b) Progress towards goal (e.g., partially achieved in firstvisit and needs to be addressed at next visit) c) Member contact requirement,per program policy d) Urinalysis completed for substance abuse patients.The following Alerts will be introduced in Rl.02:

in Careo

RIFINAL

FRl.33 The Contractor's System will send alerts/notifications to Usubscribed or been assigned to these types of notifications,

sers who have: (1)(2) the correct

access and have a valid reason for this data

RIFINAL

FR1.36 The contractor's System will automatically create alerts based on beste. where cable

R2

FR1.36-1 The Contractor' s System will automatically create alerts based on bestpractice (e.g., prenatal checkpoints), where applicable. The following Alertwill be introduced in R1.02: . P in Care

R1FINAL

FRl.37 The Contractor' s System will allow Users to modify System-generated alerts RI

Sr,q.rn or VnnuoNt, CoNtnacr FoR PnnsoNu, SnnvrcnsDnplntvrnNT oF VrRuoNr Hnar,rn AccnssEQHn.r.r,rn SolurroNs, INc.

P.l,cn 143 or 268

CoNrnacr #28739AunuounNr # 2

FR1.37-1 The Contractor's System will store rules for system-generated alerts. Anyupdates to the alerts rules can be managed by submitting a ticket request to

the Contractor

R1

FINAL

FRl.38 The Contractor's System will send alerts to Users ofMember admissions and

discharges from hospitals, nursing homes, residential care facilities,

bed services for Mental and out of home services

R3

GeneralFRl.39 The Contractor's System will include decision support tools such as but not

limited to: a) Links to appropriate program policies aligned to appropriate

data items b) Clinical links (e.g., McKesson, InterQual) c) Standards of care

d Case

R1

FR1.40 The Contractor's System will have the ability to automatically populate the

appropriate data elements when supplied in any approved electronic format,

the execution of the business and calculations

R1

FINAL

FRl.41. a

FRl.41-1The Contractor's System will have the capability to interact

systems as needed to collect, track, and report on programswith otherat the Member and

level.

R1FINAL

FRl.42 The Contractor's System will have the capability to save all forms, reports,

documents, screens, etc. based on User role and program policy

The Contractor's System will have an easy-to-use and well-formatted print

functionality for all forms, reports, documents, screens, etc. based on User

role and

Rl.01

Rl.01FR1.43

FRl.44 The Contractor's System will provide the ability to associate a single

electronic document with multiple members if appropriate (e.g., household)R2

FRl.45 The Contractor )S System will send a notification to appropriate User when a

deadline, per policy, is approaching ( e., a PA request must be acknowledgedwill notify appropriate User at thewithin 'X I hours The Contractor' System

'N'th hour if has to be made

FR1.46 The Contractor's System will provide Users the ability to review data entered

on forms to submissionThe Contractor's System will have a spell check function for all text (e.g.,

secure case notes

R1FINALRIFINAL

FR1.47

FR1.48 The Contractor's System will automatically save information as Users

forms

R1

FINAL

FRl.49 The Contractor's System will allow Users to submit forms when allinformation is

Rl.01

FRl.50 The Contractor's System will validate that all mandatory data fields have been

completed when a Community ProvidetlPartnet, Referring Party, or User

attempts to submit a form (Note: this includes performing validations when

from one screen to the next

R2

FRl.50. a

FR1.50-1The Contractor's System will validate that all mandatory data fields have been

completed when a USer attempts to submit a form (Note: this includes

validations when from one screen to the

R1

FINAL

FRl.51 The Contractor's System will allow a User to change screens

forwards without lo data entered

(backwards or R1

Surn or VnRmoNt, CoNrnlcr roR pERsoNAL SnnvrcnsDnplntvrnNT oF VnnuoNr HnaLrn AccnssEQHn,tlrn Sor,urroNs, INc.

Pacn 144o1268CoNrnacr # 28739

AunNovrnNr # 2

FRl.51-1 The Contractor' s System will allow a User to change screens (backwards orforwards) from Surveys to other tabs within a case without losing data entered

Rl.01

FRl.53 The Contractor' s System will inform the Community Provider/Partner,Referring Party, or User of errors on the form based on the validationsperformed

R2

FRl.54 The Contractor's System will allow the Community Provider/partne4Referring Party, or User to review and update the form if there are correctableeffors

R2

FRl.54. a

FRl.54-1The contractor's System will allow the User to review and update the form ifthere are correctable errors

R1

FINALFRl.55 The contractor's System will allow for a system administrator to indicate

and fields in formsRIFINAL

FRl.56 The contractor's System will provide the ability for users to format text inThe Contractor's System (e.g., capitalization, special characters, hishlisht,

underline

R2

FRl.57 The contractor's System will display a progress indicator on all forms thatmore than one screen

RIFINAL

FRl.59 The Contractor's System will allow Users to upload acceptable file types asdefined The Contractor's S

R1FINAL

FR1.60-1 The SysteminformationVCCI, COU

will have rules-based access control at the case level and displaybased on the following: a) User role and program affiliation (e.g., etc.)

RI.01

FRl.61 The contractor's System will have a User interface written in English(including warnings, notifications and User prompts) free of grammaticalerrors and

RI.01

FRl.62 The contractor's System will contain written language targeted to the averageadult level. Note: This to all

R1

FINALFRl.63 The contractor's System will provide the capability to determine an

individual's language preference to be used on notices, correspondence andother materials

R1

FINAL

FRl.63-1 The Contractor's System will provide the capability to determine anddocument an individual's I

R1

FINALFRl.64 The Contractor )

S System will maintain a record ( audit trail) of all changeschanges or User

e.g.made to data1n the Contractor' s System System initiatedinitiated changes. This should be readily searchable by UMember ID. This must include but is not limited to:

ser ID , system ID or

a) The user ID of the person who made the change or system ID if thechange was system generated b) The date and time of the change

c) The information that was changed d) The data before and after it wase The data source if the was

Rl.01

FR1.65 The Contractor's System will record the date, time, and name of UsersMember information

Rl.01

FRl.67 The Contractor' S System will use industry standard taxonomy(les) includingbut not limited a. CMS' Heal th Plan Identifi er )Identifi er o

to:b National Provider Identifier

(HPID and Other EntityRl.01

Srarn or VnnvroNto Contn,lcr FoR PrnsoNnr, SnnvrcnsDnp^q.RtNInNT oF Vnnvronr HBnlrn AccnssEQHnurn Sor,urroNs, INC.

P.q.cn 145 or 268CoNrnq,cr #28739

AvrnNovlnNr # 2

FRl.68 The Contractor's System will provide online access to clinical guidelines

protocols approved by the State

a) The State will have the ability to select homegrown, national andlot

commercial (regularly updated) clinical guidelines and protocols (e.g.,

PubMed) to allow for different departments to view or use b) The

Contractor's System will have the capability to protect commercial

and

Contractors intellectual property

R1

FINAL

FRl.69 The Contractor's System will have the ability to support catalo ging/indexing

of all imaged documents

R3

FRl.70 The Contractor's System will allow more than one User to be logged in to and

enter data in the same at the same timeR1

FINAL

FRl.71 The Contractor's System will provide a real-time view of all Users accessing

a case

R1

FINAL

FRl.72 The Contractor's System will provide menus that are understandable by non-

technical Users and provide secure access to all functional areas

Rl.01

FRl.73 The Contractor's System will provide the ability to incorporate a non-

restrictive environment for experienced Users to directly access (direct call) a

screen or to move from one screen to another without reverting to the menu

structure

Rl.01

FRl.74 The Contractor's System will provide an online help system, available

any screen and any screen field, that provides a description of and the

processing performed by a screen or window, data entry format and

from

restrictions, explanation of error messages and other information helpful to

the User

R1

FR1.74-1 The Contractor's System will provide an online help system, available fromany screen

R1

FINAL

FRl.75 The Contractor's System will provide the ability to generate drop-down lists

to identifii options available, valid values, and code descriptions, by screen

field

Rl.01

FRl.76 The Contractor's System will allow lJsers, with appropriate access levels, to

edit drop-down list options

R1FINAL

FRl.77 The Contractor's System will have the ability to utilize the followingstandards for all system screens, windows, and reports: a) All headings and

footers standardized b) Cunent date and local time displayed c) Allreferences to dates displayed consistently throughout The Contractor's

system d) All data labels and definitions consistent throughout the

Contractor's System and clearly defined in User manuals and data element

dictionaries e) A11 generated messages should be clear and sufficientlydescriptive to provide enough information for problem correction and be

written in full English text f) Specifu User (name) with assobiated data input

g) All dropdown lists displayed consistently throughout the Contractor's

System h) All search results displayed consistently throughout the

Contractor's S 1.e. Name formats

R1

FINAL

Srarn or VnnuoNr, CoNrnncr FoR pnRsoNar, SrRvrcnsDnpmrvraNT oF VBnvroNr Hnalrn AccnssEQHrar,ru Sor,urroNs, INc.

P.q.cn 146 or 268Coxrnacr #28739

AvrnNrunNr # 2

FR1.77-1 The contractor's system will have the ability to utilize the followingstandards for all system screens, windows, and reports: a) All headings andfooters standardized b) Cunent date and local time displayed c) All referencesto dates displayed consistently throughout The contractor's System asMM/DD/YYYY e) All generated messages should be clear and sufficientlydescriptive to provide enough information for problem correction and bewritten in full English text f) Specify User (name) with associated data inputg) All dropdown lists displayed consistently throughout the contractor's

R1.01

FF.t.77-2 The Contractor's System will have the ability to utilize the followingstandards for all system screens, windows, and reports: a) All headings andfooters standardized b) Current date and local time displayed c) All referencesto dates displayed consistently throughout The contractor's System d) Alldata labels and definitions consistent throughout the Contractor's System andclearly defined in User manuals and data element dictionaries e) All generatedmessages should be clear and sufficiently descriptive to provide enoughinformation for problem correction and be written in full English text f)Specify User (name) with associated data input g) All dropdown listsdisplayed consistently throughout the Contractor' s System

R1FINAL

FRl.78 The Contractor' s System will displaypertinent Member information on allMember screens. This includes but is not limited to:

a) Member's date of birthb) Contact information (primary and alternative)c) Social security number

R1

FR1.79 The contractor's System will pre-populate data fields based on previouslyentered data entrv

R1

FRl.80 The Contractor's System will be flexible enough to allow role-based Users theability to easily and quickly reconfigure based on changing businessrequirements (e.9., approved letter templates, updated fields in the electronicreferral form

R2

FRl.80. a

FRl.80-1The contractor's System will be flexible enough to allow role-based Users tocontact eQHealth in order to reconfigure based on changing businessrequirements (e.g., approved letter templates, updated fields in the electronicreferral fo.m). This will be done by following an easy-to-use, well-defined

and at no additional cost to the State.

R1FINAL

FRl.81 The contractor's system will have the ability to display free-form narrativenotes in chronological or reverse chronological sequence, by timeline forspecific medical condition, including but not limited to:

a. Ability to review history of a case progress towards goal (e.g., note orpattern) without having to scroll through all notes from present to 'X'timeback

R1FINAL

FRl.83 The contractor's system will associate an individual Member record with theMember's family in The Contractor's System for use in data look-up

R3

CentralizedFRl.85 The contractor's System will have an efficient method for preparing hard

materials for insertion in a wide of R3

Srarn or VnnwroNt, CoNtnncr FoR PnnsoNL SnRvrcnsDnp,q,RtN{nNT oF VnnvroNr Hn.lr,rn AccnssEQHnal,rn Sor,urrons, INc.

P.q.cn 147 os268Cournq.cr # 28739

AvrnNoiunNr # 2

Setup CriteriaPlannedRelease

RequirementNumber

R1FINAL

The solution must allow a user to submit a ticket to request a

order of execution of the eligibility ruleschange to theFR2.1-

001

R1

FINALFR2.1-002

The solution must allow a user to submit a ticket to request an eligibility rule

be made active.R1

FINALThe solution must allow a user to submit a ticket to request an

be made inactive. timeframe mutually agreed upon by the State of Vermont

and the Contractor but shall not exceed 15 business days after the Contractor

receives requirements. The requests are limited to the approved eligibility

eligibility rule

rules framework of the application

FR2.1.00J

R1

FINALFR2.1-004

The solution must allow a user to submit a ticket to request a content

to an eligibility rule. The user will be able to submit a ticket to the Contractor

in order to select all, multiple or single criterion. The update will be released

for SoV testing in a timeframe mutually agreed upon by the State of Vermont

and the Contractor, but shall not exceed 15 business days after the Contractor

receives requirements. The requests are limited to the approved eligibility

change

rules framework of theR1

FINALThe solution must allow a user to submit a ticket to request the deletion ofan

ruleFR2.1-00s

R1FINAL

FR2.1-006

The solution must allow a user to submit a ticket to request the addition of an

eligibility rule.

R3The solution must allow a user to submit a ticket to request an update to the

view of an rule.FR2.1-007

R3FR2.8 The Contractor's System will allow for capturing of multi

to identify various population groups, including but not limited to:

a. vccl b. Hi-Tech c. High-Risk Pregnancy d. Pediatric Palliative care

Program e. Others as defined by the State f. Pregnant/post-partum women g.

ple criteria in order

Children to 6

RulesRl FinalFR2.13 The Contractor's System will allow for capturing of multiple sets of eligibility

rules in order to determine proglam eligibility for various AHS care

management programs, including but not limited to:

a. VCCI b. High-Risk Pregnancy c. Pediatric Palliative Care Program d.

Others as defined the StateRl.01FR2.14 The Contractor's System will maintain a record (e.g., audit trail) of

changes made. This must include but is not limited to: a) The User ID of the

person who made the change b) The date and time of change c) The

all

d The data before and after it wasinformation that was

Risk Stratification and Eligibility Determination

Establish Case Criteria

Sr.lrn or VrnvroNr, CoNrnncr FoR pnnsoN,q,r, SnnvlcnsDrpmrurNT oF VnnnnoNr HBar,ru AccnssEQHn,r.r,rn Sor,urrouso INc.

Pncn 148 or 268CoNrnc,cr # 28739

AunxovrnNr # 2

FR2.15 The contractor's System will conduct risk stratification to identify thespecific intervention populations (e.g., top 5%o, populations with gaps in care,specialty groups) including by geographic area

R1.01

FR2.16 The contractor's System will utilize clinically relevant predictive riskmodeling tools and gaps in care analysis for early screening and caseidentifi cation of Members

R1

FR2.17 The Contractor's System will identifu candidates that meet the predefinedcriteria

R1

FINALFR2.18 The Contractor's Systenr-will accept data from multiple sources to validate

program eligibility including but not limited to:a) claims b) clinical/Bio-MedicalData c) Data from Eligibility systems

R1

FR2.18-1program eligibility including but not limited to: a) Claims c) Data fromEligibility systems

The Conhactor's System will accept data from multiple sources to validate RIFINAL

FR2.19 The Contractor's System will accept and automatically screen all electronicreferrals for program eligibility

R2

FR2.20 The Contractor's System will automatically screen Candidates, in real-time,against applicable program eligibility rules and determine program elieibilitv

R2

FR2.21 The Contractor's System will provide supporting information and/ordocumentation as to why a Candidate was deemed ineligible

R2

FF.z.22 The Contractor's System will provide the ability for a User to reviewsupporting information and/or documentation of the criteria and/or eligibilityrules that a candidate did not meet at any point in time. The contractor'sSystem will not redirect a User to another screen to review the information

RIFINAL

FF.2.23 The Contractor' s System will allow a lJser, with appropriate access rights, tooverride the contractor's System's eligibility determination. For example,additional information gathered outside of the contractor's System becameavailable to overturn System's determination

R1FINAL

FF.2.24 The Contractor's System will allow a User to scan and associatedocumentation to support the User's overriding of the Contractor's System'seli gibility determination

RIFINAL

FP.2.26 The Contractor's System will log the date and time the Member wasdetermined to be eligible

R2

FP.2.27 The Contractor's System will have the ability to support flexible rules-basedlogic to determine care management program eligibility criteria for: a)Individual Member b) Target populations c) others as identified by theState during requirements and accepted via formal change control

RIFINAL

FR2.28 The Contractor's System will have the ability to use historical data to identifypotential participants for specific programs, including but not limited tohistorical data from the following programs:

a) Pediatric Palliative Care Program b) High Risk Pregnancyc) Department of Mental Health d) children with Special Health Needs e)

Alcohol and Drug Abuse Program f) Inpatient and Emergency Services g)concurrent review h) clinical operations unit i) tnpatient Psychiatry j)Substanee Abuse

R1

Srlrr or VnnuoNt, CoNtru,cr FoR PrRsoN.q,L SnnvrcnsDnpanrvrnNT oF VnRvroNr Hr.q.LrH AccEssEQHnalrn Sor,urroxs, INc.

Pacr 149 on 268CoNrnq.cr # 28739

AvrnNnunNr# 2

R3The Contractor's System will notify appropriate User when,

a Member's program eligibility needs to be re-determined (e.g., annual

redetermination, clinical change occurred)

based on policy,FF.2.29

The contractor's System will provide users a step-by-step process for R1

Conduct Outreach

FR2.30re-determination

PlannedRelease

RequirementNumber

R2The Contractor's System will support member outreach servlces

initiating contact with program-eligible Members, conducting intake

assessments) provided by User (Case Manager or third party)

(e.s.,FR3.1

Rl.01The Contractor's System will support member

initiating contact with program-eligible Members, conducting intake

assessments User Case

outreach services (e.g.,a

1

FR3FR3

1

1

R2FR3.2 The Contractor's System will automatically route Eligible Member's contact

information to User (Case Manager or third party) for outreach for non-direct

referrals l. an electronic referral The Contractor's S

R3FR3.3 The Contractor's System will notify User of the need for outreach or

intervention based on established criteria, including but not limited to:

a) Gaps in immunizations b) Clinical measures c) Other prescribed orpreventive care d) Missed schedules

R2FR3.4 The Contractor's System will allow Users (Case Manager or third party) to

log each contact made and'method used (e.g., electronic communication,

call outreach effortsR1.01FR3.4.a

FR3.4-1The Contractor's System will allow Users (Case Manager) to log each contact

made and method used (e.g., electronic communication, phone call) during

outreach effortsR2FR3.5 The Contractor's System will allow Users (Case Manager or

of each contact made during outreach efforts1og the outcome

third party) to

Rl.01FR3.5.aFR3.5-1

The Contractor's System will allow Users (Case Manager) to log the outcome

of each contact made during outreach efforts

Rl.01FR3.6 The Contractor's System will provide a predetermined list (e.g.,

menu) of contact outcomes which may include but is not limited to:

a) Contact made b) Left a voicemail c) Unable to leave voicemail

d) Met with Member in hospital, facility, etc.

dropdown

R3The Contractor's System will send alerts lnotifications to User (responsi

party) based on predetermined time intervals if the User has not

acknowledeed the case and taken action

bleFR3.7

R2FR3.8 The Contractor's System will escalate the case if the User has notthe case and taken action, based on pro policvacknowledged

R1The Contractor's System will allow User (Case Manager or third party) to

acknow outreach tFR3.9

Establish Case

Srarn or VnnvroNt, CoNrnacr FoR pERsoNAL SnnvrcnsDnpanrnrnNT oF VunvroNr Hnar,rn AccnssEQHn,tlru Sor,urroNs, INc.

P.tcB 150 or 268CoNrnq.cr # 28739

AvrnNrvrnNr # 2

FR3.l0 The contractor's system will track the time before outreach assignment isacknowledged

R3

FR3 11 The Contractor's System will display Member's contact information Rl.01FR3.12 The contractor's System will allow users to edit and/or add to Member's

contact information and indicate type (e.g., home, office, mobile) such as butnot limited to:

a) Primary phone number b) Secondary phone number c) Email address

Rl.01

FR3.13 The Contractor's System will allow Users to add additional contacts (e.g.,Member's care taker, legal guardian) and associated contact information toMember's case. Information includes but is not limited to: a) Primaryphonenumber (e.g., home, office, mobile) b) Secondary phone number (e.g., home,office, mobile) c) Email address d) Relationship to Member

RI.01

FR3.14 The Contractor's System will allow Users to send electronic communicationif an email address is available

R2

FR3.l5 The contractor's system will record all electronic communication andassociate it with the Member's case

R2

FR3.16 The Contractor's System will allow Users to document Member's decision toaccept or decline services of any and all programs Member is eligible for

Rl.01

FR3.l7 The Contractor's System will provide a predetermined list (e.g., dropdownmenu) of reasons for declining services

Rl.01

FR3.19 The contractor's System will allow a case Manager to reassign outreachefforts to an appropriate party

R2

FR3.20 The contractor's system will allow a user to create a Member case record(e.g., Member has accepted program-specific services) for each new case

R1.01

FR3.21 The Contractor's System will allow a User to close a program-specific caseand have the Contractor's System automatically notify (via email or hard copyletter) appropriate parties (including Authorized Representative, Member,Community Provider/Partner, and referral source) if the Member chooses notto effoll in the care

R2-R3

Assign Case ManagerFF.3.22 The Contractor's System will store Case Manager profiles which include but

is not limited to:a) Skill set / scope of practice b) Geographic location c) Caseloadd) Schedule I avallabilitv e) Co-management team

R1

FF.3.22-1 The Contractor's System will store case Manager profiles which include butis not limited to: a) competency/ Scope of practice b) Geographic location c)Caseload d) Schedule / availability

R1

FINAL

FR3.23 The Contractor 's System will allow Users, with appropriate access levels, toedit Case Manaser orofiles

R1

FINALFR3.24 The contractor's system will have the capability to automatically and/or

allow users to manually assign an appropriate case Manager, as determinedby specific program, based on alignment of Case Manager's prof,rle withMember's needs / profile

Rl.01

R1FINAL

Surn or Vnnvronto CoNtRl.cr FoR PnRsoN.q,L SnnvrcnsDpplntvrnNT oF VnnuoNr Hnu,rn AccsssEQHnalru Sor,urroNs, INc.

PlcB 151 or 268

CoNrru.cr #28739AMENDMENT # 2

Automatic assignment will exclude behavioral health

and will be achieved in Rl.03conditions for Rl.02

FR3.25 -1 The solution must have the ability to route a case to a staff member

FF.3.25-2 The solution must have the ability to assign a case to a staff member. R1

FR3.26 The Contractor's System will notify appropriate Case Manager of case

assignment

R1.01

FR3.27 The Contractor's System will send reminders / alerts to Case Manager, based

on predetermined time intervals, if the Case Manager has not acknowledged

the

R3

R2FR3.28 The Contractor's System will escalate the case if the Case Manager has not

acknowledged the assignment and taken action within predetermined

based on

FR3.29 The Contractor's System will have access to Case Managers schedules (e.g.,

vacation time) and will not assign or escalate if the Case Manager is

scheduled to be out ofoffice

R1

FR3.30 The Contractor's System will allow Case Manager to document decision to

accept or decline the case assignment

Rl.01

FR3.31 The Contractor's System will provide a list of applicable Case Managers forcase reassignment in the event the originally assigned Case Manager declines

assignment. The list may be based on but is not limited to: a) Geographic

location / neighboring county b) Telephonic community partner The

Contractor's System will provide a list of applicable Case Managers for case

reassignment in the event the originally assigned Case Manager declines

assignment. The list may be based on but is not limited to:

a) Geographic location / neighboring countyb) Telephonic community partner

c) Conflict of interest (e.g., family membe

R1

FINAL

FR3.31-1 The Contractor's System will provide a list of applicable Case Managers forcase reassignment in the event the originally assigned Case Manager declines

assignment. The list may be based on but is not limited to: a) Geographic

location / neiehboring county b) Telephonic community partner

Rl.02

Additional Staff to Case

FR3.33 The Contractor's System will allow authorized User to document assignment

of additional care team members (and roles) who do not have access to the

Contractor's S

R2

FR3.34 The Contractor's System will display a list of all Users who are currently or

were previously involved in Member's case

R1

FINAL

FR3.35 The Contractor's System will display a list of all current or previous programs

a Member is involved inR2

FR3.36 The contractor's System will display a list of Staff roles (e.g., Nurse) and

Internal Units for a User to select fromR2

Srarn or Vnnvronr, CoNrrucr FoR pnnsoN.q,L SnRvrcnsDnr.rRrunNT oF Vnnuour Hnar,rn AccnssEQHnll,rn SolurroNs, INC.

PAGE 152 or 268CoNrnlcr # 28739

AMnNrorvrBNr # 2

FR3.37 The Contractor's System will display a list of Users, based on role selected, inalphabetical order beginning with the last name

Rl.01

FR3.38 The Contractor's System will display a list of Internal Units in alphabeticalorder

R2

FR3.39 The contractor's System will allow for case Manager to search for a User(e.g., Care Manager) and/or Internal Unit based on multiple searchparameters, such as but not limited to:

a) Begins with b) Ends with c) Exact match

R2

FR3.40 The contractor's System will allow for all, multiple, or single options to beselected

FR3.41 The contractor's system will allow for case Manager to select reason foradditional case assignment from a predetermined list (e.g., dropdown menu)

R1

FR3.42 The Contractor's System will have access to Staff email addresses R2FR3.43 The Contractor's System will send a notification to the newly assigned Staff

andlor Internal UnitsR2

FR3.43.aFR3.43-1

The Contractor's System will send a notification to the newly assigned Staff RlFINAL

FR3.44 The contractor's system will allow for newly assigned Staff andlor InternalUnit to or decline case assignment

R2

FR3.44.aFR3.44-1

The Contractor's System will allow for newly assigned Staff to accept ordecline case assignment

Rl.01

FR3.45 The contractor's System will allow newly assigned Staff andlor Internal Unitto select from a predefined dropdown list of answers to accept or decline caseassignment

R2

FR3.45.a The contractor's System will allow newly assigned Staff to select from apredefined dropdown list of answers to accept or decline case assignment

R1

FR3.46 The Contractor's System will allow Users to document and save caseassignment decision

Rl.01

FR3.47.a The Contractor's System will allow Case Manager to assign a specificMember Problem, Goal, and/or Intervention to newly assigned Staff fromdefined down list

R1

FR3.47-l The Contractor's System will allow Case Manager to assign a specificMember including the components of the case (IGI) to newly assigned Stafffrom defined drop down list

R1

FINAL

FR3.48.a The contractor's System will allow newly assigned staff to assign specificMember Problem, Goal, and/or Intervention from defined drop down list

RI

FR3.48-t The Contractor's System will allow newly assigned Staff to assign a specificMember including the components of the case (IGI) from defined drop downlist

R1FINAL

FR3.49.aFR3.49-1

They System will send a notification to the case Manager of newly assignedStaffls decision

RI.01

Srarn or VrnvroNt, CoNtnacr FoR PBRsoNa,r- SnRvrcnsDnpanrvrrNT oF VnnvroNr Hnar,rn AccnssEQHn.Llrn Sor,urroNs, INc.

Pacn 153 or 268CoNrRlcr # 28739

AunNovrnNr # 2

GeneralRl.01FR3.50 The contractor's System will have the ability to support supervisory

operations for the management of workflow including:a) As si gnments/re- as si gnments and prioritiesb) Status querying and monitoring of individual documents and other work

steps or productsc) Work allocation and load balancingd) Approval for work assignments and work deliverables via a tiered

approache) Ability to take necessary action or provide notification when corrective

action is needed, including the ability to modify or abort a workflow process

f) Monitoring of key information regarding a process in execution,

including:i. Estimated time to completionii. Staff assigned to various process activities111. error conditions

Rl.01The Contractor's System will allow Users to skip and return to screens

outside of the workflowFR3.51

R2FR3.52 The Contractor's System will allow Users to create a case for a Member who

has not been determined ble

Member's Profile SummaryPlannedRelease

Number Requirement

R1FR4.1 The Contractor's System will display an easy-to-read summary of Member's

profile, based on lJser's role and access level and state and federal policy,(health background and needs) which includes but is not limited to:

a) Basic demographics (e.g., need for interpretation services) b) Risk acuity

c) Allergies d) Code status e) Involved Community Providers/Partners f)Most recent lab data g) Most recent appointments and upcoming

appointments h) Prior history i) Previous case workers j) Reenrollment or

new case k) Clinical triggersl) Notes m) Completed assessments n) Gaps in care (e.g., Member with

elevated A1c, Member with 4 ED visits in past 6 weeks, Member withmedication fill gaps) o) Advanced care directives p) coLST / PoLST q)

Date of last successful contact with Member r) socio economic indicators ofhealth s other insurance sources

Rl.01The Contractor's System will display an easy-to-read summary of Member's

profile, based on lJser's role and access level and state and federal policy,(health background and needs) which includes but is not limited to: a) Basic

demographics (e.g., need for interpretation services) b) Risk acuity c)

Allergies d) Code status f) Most recent lab data g) Most recent appointments

and upcoming appointments h) Prior history i) Previous case workers j)Reenrollment or new case k Clinical Notes m

FR4.1-1

Perform Screening and Assessments

Sr.tru or VnnuoNro CoNrnacr FoR pnnsoN.{r, SnnvrcnsDrpanrunNT oF VnnuoNr Hrlr,rn AccnssEQHnnlrn Sor,urroNs, INc.


AvrnNuvrnNr # 2

assessments n) Gaps in care (e.g., Member with elevated Alc, Member with 4ED visits in past 6 weeks, Member with medication fill gaps) o) Advancedcare directives q) Date of last successful contact with Member r) socioeconomic indicators of health s) other insurance sources

FR4.1-2 The contractor's System will display an easy-to-read summary of Member'sprofile, based on user's role and access level and state and federal policy,(health background and needs) which includes but is not limited to: a) Basicdemographics (e.g., need for interpretation services) b) Risk acuity c)Allergies d) code status e) Involved community Providers/Partners f) Mostrecent lab data g) Most recent appointments and upcoming appointments h)Prior history i) Previous case workers j) Reenrollment or new case k) Clinicaltriggers l) Notes m) Completed assessments n) Gaps in care (e.g., Memberwith elevated Alc, Member with 4 ED visits in past 6 weeks, Member withmedication fill gaps) o) Advanced care directives q) Date of last successfulcontact with Member r) socio economic indicators of health s) other insurancesources

Additional fields identified during JAD session will be available in Rl.03o Risk factorso

R1

FINAL

R1FINAL

FR4.2 The contractor's System will allow Users, with appropriate access levels, togenerate and print a Member's profile summary

Rl.01

FR4.3 The contractor's system will auto-populate a Member's medication list inreal-time. Information includes but is not limited to:

a) Amount ofpills b) Date filled c) Pharmacy and Prescriber

R2, R3

FR4.4 The contractor's System will allow case Managers to reconcile Member'smedication list to monitor use and continuity of care

R1FINAL

FR4.5 The Contractor's System will allow for printing of Member's medication list Rl.01FR4.6 The Contractor's System will provide a history of the AHS programs a

Member is enrolled in. This includes but is not limited to programs:a. Previously applied to b. Currently eligible for c. Previously part of

R1

Perform Screening and AssessmentsFR4.7 The contractor's System will allow lJsers, based on role, access to completed

screenings and assessments. Information includes but is not limited to: a)Results b Date c AS

RI.01

FR4.8 The Contractor's System will auto-fill data fields in screenings andassessments as much as possible and where applicable. This may include butis not limited to Member information such as:

a) Demographics b) Clinical data c) Previous pregnancy historyd) Primary care Provider e) obstetrics (oB) Provider f) Dental provider g)

Dental history

R3

FR4.9 The contractor's System will use branching logic to determine assessmentquestions

Rl.01

Srarn or VnnuoNt, CoNtrucr FoR PnnsoN.q'L SnnvrcnsDppnnrvrnNT oF Vunvroxr Hnar,rn AccnssEQHnl.lrn Sor.urroNs, INc.

P,tcn 155 or 268

Conrnq.cr #28739AunNlunNr # 2

R1.01FR4.10 The Contractor's System will display assessment questions in abut will allow for User to move

logical order,

Rl.01The Contractor's System will allow for quick and easy responses to

assessment questions (e.g., dropdowns, radio buttons, freeform text)FR4.11

R1

FINALFR4.12 The Contractor's System will save in progress based on preset intervals

R1

FINALThe Contractor's System will flag incomplete assessments for follow-upFR4.13

R1FINAL

FR4.14 The Contractor's System will alert point-in-time Case Manager if assessment

R1.01The Contractor's System will save completed assessments

with Member's Plan of Care

and associate itFR4.15

R1.01FR4.16 The Contractor's System will maintain a record (e.g., audit trail) of all

involved in conducting an assessment. This must include but is not limited to

a) The User ID of the person who initiated the assessment

b) The User ID of the person(s) who updated / edited the assessment (Users

with edit rights to be identified by State)

c) The date and time of changes and assessment completiond) The information that was changed

parties

e The data before and after it wasR1.01The Contractor's System will provide nationally recognized screening

assessment tools for chronic conditions, psycho-social, behavioral, substance

abuse, mental health, etc. with branching logic to prevent redundancy and

and

inform the Plan of Care

FR4.17

R1The Contractor's System will notify Case Managers and/or appropriate care

team members when an assessment is due / needs to be redone (e.9., PHQg

assessments are done quarterly, High Risk Pregnancy Follow-up), as defined

by program policy

FR4.18

FR4.20

Create Plan of Care

R1FINAL

The Contractor's System will have the ability to add new assessment tools,

based on State

PlannedRelease

RequirementNumber

R1FR5.1 The Contractor's System will pre-populate and generate a

evidence-based, integtated Plan of Care (POC) and document date of creation.

Common POC fields may include but is not limited to:

a) Problem (must be case relevant/specific and measureable)

b) Problem status i) Stages of change c) Priority d) Goal(s)

e) Barrier(s) f) Intervention(s) g) Status h) Self-management

logical and

Plan

Treatment Plan and Outcomes

St.trn or VnnuoNt, CoNtnacr F,oR pnnsoN,c.L SnRvtcnsDrpantvrnNT oF VnnvroNr Hnar,rn AccnssEQHnt rH Sor,urroNs, INc.

P.q.cn 156 or 268CoNrrucr # 28739

AvrsNnvmNr # 2

FR5.l-1 The Contractor's System will pre-populate and generate a logical andevidence-based, integrated Plan of Care (POC) and document date of creation.common Poc fields may include but is not limited to: a) problem (must becase relevant/specific and measureable) b) Problem status i) Stages of changec) Priority d) Goal(s) e) Barrier(s) f) Intervention(s) g) Status h) Self-management

Rl.01

FR5.2 The contractor' s System will generate evidence-based, disease-specifi cinterventions based on standard nursing Dx and be case management specific.Interventions are program-specifi c and support evidence-based care.

Rl.01

FR5.3 The Contractor's System will provide a recommendation as to which servicesare applicable, based on answers submitted to program-specific assessments.For example, for the Pediatric Palliative care Program (PPCP), the followingservices are provided:

a) Care Coordination b) Family Training c) Expressive Therapyd) Skilled Respite e) Anticipatory Grief Counseling / Bereavement

Counseling

R3-+3R1

FR5.4 The contractor's System will allow for case Manager to edit / modify thedetails of a System-generated POC from a predefined list (e.g., dropdownmenu) that includes but is not limited to:

a) Problem (e.g., medication non-adherence, missing action plan(s), potentialknowledge deficit)b) Relevant Goals (e.g., medication adherence, Member understands how,

when, and why he or she needs to take medication)c) Relevant Interventions (e.g., phone call, review medication education,

coaching, face-to-face, care coordination)

Rl.01

FR5.5 The contractor's System will display list of problems, relevant goals andinterventions in an organized way, i.e., evidence-based by disease, bycondition, by readiness for change

Rl.01

FR5.6 The contractor's system will allow for a user, with appropriate access rights,to update the dropdown list of Problems, Interventions, and Goals

RIFINAL

FR5.7 The Contractor's System will consolidate Problems, Goals, and Interventionsif more than one disease is being addressed (i.e., redundant problems, goals,and interventions will not show up if applicable to multiple diseases) and linkback to each problem.as appropriate (LDL level link to both diabetes andcAD)

Rl.01

FR5.8 The contractor's System will allow for case Manager to assign target dates toMember's Goals and Interventions

Rl.01

FR5.9 The contractor's System will auto-populate target dates, where appropriateand based on program policy

R1

FINALFR5.11 The Contractor's System will save Plan of Care and associate it with

Member's caseRl.01

FR5.12 The Contractor's System will allow Case Manager to enter additionalcomments (freeform text) in defined sections for provider communication

RIFINAL

FR5.13 The contractor's system will display prior summaries for users to modify(e.g., to update

R2

Stl.rn or Vnnuont, CoNtru,cr FoR PnnsoNl, SrnvrcnsDnpLnrvrnNT oF VrnuoNr Hn.q.LrH AccnssEQHn.Llrn Sor,urronso lt'lc.

PAGE 157 or 268

CoNrru,cr #28739AvrrNnunNr # 2

FR5.14 The Contractor's System will provide an easy-to-document and effective

method to track Member's progress and outcomes (e.g., goal addressed,

interventron

Rl.01

FR5.15 The Contractor's S will allow for of a Member's entire POC Rl.01

FR5.16 The Contractor's System will provide a printable summary of Member's POC

that highlights pertinent information based on evidence-based best practice to

be shared with PCP (hard copy or electronically)

Rl.01

FR5.17 The Contractor's System will allow for the POC to be saved and emailed

el from within The Contractor's S

R2

FR5.17. The Contractor's System will allow for internal users to send and receive

the POC within The Contractor'sR1

FR5.17-1 System will allow for the POC to be exported as a PDF so it can be emailed or Rl.01

FR5.19 The Contractor's System will have the ability to provide role-based access to

Member's POC

R1

FR5.21 The Contractor's System will provide Users, with appropriate access rights, a

real-time view of Member information entered by registered Communityproviders/Partners. This includes but is not limited to information found in

Irn- assessments b Member's Care Plan

R3

Action Plans

FR5.26 The Contractor's System will automatically display condition-specific Action

Plan to Member's Plan of Care

R1

FINAL

FR5.27 The Contractor's System will allow for Case Manager to select Action Plan(s) R1FINAL

FR5.28 The Contractor's System will allow for all, multiple, or single Action Plan(s)

to be selected at one time

RIFINAL

FR5.29 The Contractor's System will auto-populate Action Plan(s) with available

information, where appropriate (e. g., Member contact information)R1

FINAL

FR5.30 The Contractor's System will allow for Case Managers (with appropriate

rights) to edit / modify Member's Action Plan(s). Action Plans must be in

simple, clear, concise language at an appropriate reading level for Member

R1

FINAL

FR5.31 The Contractor's System will allow for Community Providers/Partners (with

appropriate rights) to edit / modify Member's Action Plan(s). Action Plans

must be in simple, clear, concise language at an appropriate reading level for

Member

R2

FR5.32 The Contractor's System will save Action Plan(s) and

Member's Plan of Care

associate it with R1

FINAL

FR5.33 The Contractor's System will allow for printing of Action Plan(s) R1

FINAL

FR5.34 The Contractor's System will allow for Action Plan(s) to be saved and

emailed from within The Contractor'sR3

FR5.34. The Contractor's System will allow for internal users to send and receive

Action S within The Contractor's S),

R1

Srarr or VrnuoNr, CoNrnacr F.oR pnnsoxar, SnnvrcrsDnpaRrunNT oF Vnnvrorrlr Hrar,rH AccrssEQHnnr,rn Sor,urroNso INc.

PAGE 158 oF 268CoNrnncr # 28739

AvrnxovmNr # 2

Provide Education MaterialsFR5.36 contractor's system will have a repository of accepted, up-to-date and

nationally recognized electronic education materials for Case Managers toprovide to Members, that are written at an appropriate reading levetloth

for Member

The RFINAL

FR5.37 contractor's System will maintain a repository of contractor and state-provided accepted, up-to-date and nationally recognized electronic education

The

materials for Users e. health co case

R2

FR5.38 contractor's system will recommend education materials applicable toMember's Plan of care. List of educational materials germane to thecondition will be searchable and automatically displayed for userconsideration.

The R2

FR5.39 Contractor's System will allow Case Manager to select appropriateeducation materialsThe R2

FR5.40 The contractor's System will allow for all, multiple, or single educationmaterials to be selected at one time

R2

FRs.42 's System will allow for education materials to be emailedfrom within the Contractor's S

The Contractor R2

FR5.43 contractor's system will allow for education materials to be saved andTheattached to emails

R1

FR5.44 The contractor's system will allow for printing of education materials R1

FINALFR5.46 s System will save the selected education materials and

associate it with Member's Plan of Care

The Contractor' R1

FRs.46-1 contractor's System will save the selected education materials andassociate it with Member's record by uploading it in the Attachments sectionand document in session notes.

The R1FINAL

Case DocumentationNumber Requirement Planne

dRelease

FR6.1 flexibilityThe Con stractor' S will the for Ua toserystem provide modifyofdates Member's Sal

Rl.01

FR6.2 contractor's system will display list of all Problems, Goals, outcomesand Interventions associated with MemberThe R1.01

FR6.3 Contractor's System will allow Users to hide and unhide completedInterventions and GoalsThe R1

FINALFR6.4 's System will allow Users to sort by components of the pOC,

including but not limited to: Interventions, Problems, Goals and outcomes

The Contractor

e. intervention due da condi

Rl.01

FR6.5 contractor's System will allow users to select by components of thePOC, including but not limited to: Interventions, problems, Goals and

The

Outcomes intervention due condi

Rl.01

FR6.6 Thebes

contractor's System will allow for all, multiple, or single interventions toelected

R1

Case InformationM

Srarn or VnnvroNt, CoNtru.cr FoR PrnsoN.c.L SnnvrcBsDnrLRrvrBNT oF VrnvroNr Hn.q.r,rn AccrssEQHn,urn Sor,urroNs, INc.

P.tcn 159 or 268CoNrntct # 28739

AvrrNovrpur # 2

FR6.6-1 The System will allow for interventions to be selected and edited Rl.01

FR6.7 The Contractor's System will display a structured and standard form to

document completed Interventions that includes but is not limited to:

a) Date b) Mode (e.g., telephone, electronic community, face-to-face, letter)

c Duration 1n mrnutes Outcome e Notes

Rl.01

FR6.8 The Contractor's System will provide a dropdown list of outcome types forInterventions

R1.01

FR6.9 The Contractor' s System will allow for freeform text (notes) Rl.01

FR6.10 The Contractor's System will save updates and associate it with Member's

Plan of Care

Rl.01

FR6.l1 The Contractor's System will maintain a record (e.g., audit trail) of al1

changes made. This must include but is not limited to:

a) The User ID of the person who made the change b) The date and time ofchange c) The information that was changed d) The data before and after itwas

Rl.01

FR6.12 The Contractor's System will allow Users, with appropriate access rights, to

update or augment Member's contact informationRl.01

FR6.13 The Contractor's System will allow Users to designate a primary mode ofcontact

Rl.01

FR6.14 The Contractor's System will be able to connect the mother's case information

with the newborn's case information

R3

FR6.15 The Contractor's System will have the ability to monitor Member data to

determine if referred andlor authorized services are

R2

FR6.16 The Contractor's System will support follow-up actions as needed to identi fyservices delivered (claims payment information), issues impeding delivery ofservice andl or Member's

R2

R3FR6.17 The Contractor's System will have the ability to update a Member's case

history with possible revisions including but not limited to: a) Needs

assessment b) Plan of Care c) Associated Community Provider/Partner list

Case file information contact dates and times

The Contractor's System will allow Users to enter freeform text to

communicate supervisory review / comments

R2FR6.20

FPi6,22 The Contractor's System will accept claims data in both ICD-9 and ICD-I0formats

R1FINAL

FR6.25 The Contractor's System will display a calendar with options for different

views (e.g., work week, fullweek, day, month)R2

FR6.26 The Contractor's System will provide a structured and standard calendar form

that includes but is not limited to:a) Appointment category (e.g., Employee PTO, Member intervention,

services) b) Meeting type (e.g., phone call, in-person) c) start and end date

d) Start and end time e) Attendee list f) Meeting location g) Meeting

instructions h) Reminder I alert schedule (e.g., one week before, one day

2 hours

R3

Sr,rrn or VnnuoNr, CoNrucr F,oR pnnsoN,qr, SrnvrcnsDnpanrvruNT oF Vnniuoxr Hnar,rn AccnssEQHnalrn Sor,uuoNs, INc.

PAGE 160 or 268CoNrntcr # 28739

AvrnNnvrnNr # 2

FFi6.27 The contractor's system will allow for multiple attendees to be added to anqppointment

R3

FR6.28 The Contractor's System will allow email addresses to be manually entered R2FR6.29 The Contractor's System will provide a directory to store contact information R2FR6.30 The contractor's system will allow meeting creator to attach documents R3FR6.31 The Contractor's System will have access to Member calendars based on

appointments previously / currently scheduled in the contractor's systemR2

FR6.36 The Contractor's System will save appointment invites R3FR6.37 The Contractor 's System will electronically deliver appointment invites to

attendees listed (email address )R3

FR6.38 The contractor's System will allow attendees RSVP options which include:a) Accept b) Tentative c) Decline d) New time proposed

R3

FR6.39 The Contractor's System will track attendee RSVPs R3FR6.40 The Contractor's System will allow attendees to include a message to RSVP R3FR6.41 The Contractor's System will noti fy appointment creator of RSVP responses R3FR6.42 The contractor's system will allow appointment creator to modify meeting

detailsR2

FR6.43 The contractor's system will electronically deliver updated appointmentinvites to attendees listed

R3

FR6.44 The contractor's System will highlight the changes made to the appointmentdetails (e.g., location, date, time) as part of the updated invite

R3

FR6.45 The Contractor's System will allow appointment creator to cancel anappointment

R2

FR6.46 The contractor's system will electronically deliver a notification that anappointment has been cancelled to attendees listed

R3

FR6.47 The Contractor' S System will delete a cancelled appointment from calendars R2FR6.48 The ContraCtor's System will log the time, date, and User ID of the User who

theR2

FR6.49 The contractor's System will provide a map of the appointment location R3

FR6.50 The contractor's System will provide attendees the option to retrievedirections to meetins location

R3

FR6.51 The contractor's system will pre-populate the destination address based onthe appointment'location'detail when attendees opt to retrieve directions

R3

FR6.52 The Contractor's System will display miles to location R3FR6.56 The Contractor's System will allow for appointment creator to set

appointments as a recurrence. with overall start and end datesR2

FR6.58 The Contractor's System will allow Members and CommunityProviders/Partners to respond to meeting invites via respective portal account

R2

Sr.lrn or Vnnvroxt, CoNtru.cr FoR PnnsoN.q,L SnnvrcnsDnp.qnrNInNT oF VrRivroNr Hn,q,I,tn AccnssEQHnalru Sor,urroNso INc.

Plcn 161 or 268

CoNrnc.cr # 28739AunxovrnNr # 2

Document Case DispositionFR6.59 The Contractor's System will provide a simple and efficient method for

documenting a case's disposition status. The method may include a structured

and standard form that will include areas such as but is not limited to:

a) Member's progress towards achieving Goal(s) (improvement made, no

improvement, etc.) b) Risk level (high, medium, low) tied to a program or

Goal c) Opportunities available d) Case in transitione Death date Incarcerated out

RlFINAL

FR6.60 The Contractor's System will provide a pre-determined list (e.g., dropdown

men of tions for each of the areas addressed

RlFINAL

FR6.61 The Contractor's System will provide a brief defi nitiorVdescription for added

clarification for each of the predetermined list (e.g., dropdown menu) ofdi tion

R1FINAL

FR6.62 The Contractor's System will not move the User away to another windowwhen the definition/ is accessed

R1FINAL

FR6.63 The Contractor's System will provide a section to allow Users to enter

freeform text notes

Rl.01

FR6.64 The Contractor's System will save case disposition and associate it withMember's Plan of Care

Rl.01

FR6.65 The Contractor's System will maintain a record (e.g., audit trail) of allchanges made. This must include but is not limited to: a) The System as the

entity that made the change b) The date and time of change c) The

information that was changed d) The data before and after it was changedThe

Contractor's System will maintain a record (e.g., audit trail) of all changes

made. This must include but is not limited to:

a) The User ID of the person who made the change b) The date and time ofchange c) The informaiion that was changed d) The data before and after itwas

Rl.01

TransitionFR6.66 The Contractor's System will provide a structured and standard method to

initiate a referral

R1

FINAL

FR6.67 The Contractor's System will pre-populate the referral form with the profile

of the User logged into the Contractor's System (e.g., Case Manager).

Information includes but is not limited to: a) First and last name b) Title c)

Department d) Contact information (email address, Phone number. etc.)

R1

FINAL

FR6.68 The Contractor's System will pre-populate the referral form with the referral

date

R1

FINAL

FR6.69 The Contractor's System will pre-populate the referral form with the profile

of the Member that is being referred. Information includes but is not limited

to:a) First and last name b) Date of birth c) Language(s) spoken

d) Residential address e) Contact information (email address, phone number,

etc. 51S

R1FINAL

FR6.70 The Contractor's System will allow User to enter freeform text to

communicate notes / comments such as but not limited to:Rl.01

Suru or VnnuoNt, CoNrnacr FoR prRsoNlr, StnvrcnsDnp,lnrunNT or VnnvroNr Hnar,tn AccBssEQIInar,rn Sor,urroNs, INc.

PAGE 162ot268CoNrrucr # 28739

AvrnNourNr # 2

a) Reason for referral b) Referral urgency c) Explanation of attacheddocuments

FR6.71 The contractor's System will allow user to request referral acknowledgement R2

FP!6.72 The Contractor' s System will allow electronic documents to be attached to thereferral

R2

FR6.73 The contractor's System will display a pre-developed list of availableCommunity Providers/Partners, including but not limited to:

a) Substance Abuse Treatment Facilityb Food Bank

R2

FR6.74 The Contractor's System will allow User to search for appropriateCommunity Provider/Partner based on multiple combinations, such as but notlimited to:

a) Services / programs provided b) Community Providers capacityc) Proximity to Member's residential address d) Proximity to public

e s

R2

FR6.75 The Contractor's System will display a list of qualified CommunityProviders/Partners that meet the search criteria

Rl.01

FR6.76 The Contractor's System will allow User to further refine or expand criteriabased on results

R1

FR6.77 The contractor's System will allow for all, multiple, or single communityProviders/Partners to be selected at one time

RI

FR6.78 The contractor's system will save and associate referral with Member's planof Care

Rl.01

FR6.79 The Contractor's System will allow for printing of a referral R1FINAL

FR6.81 The Contractor's System will allow a User to send the referral electronicallyto identified Community s)/Partner(s)

R2

FR6.82 The contractor's system will send a secure notification to communityProvider(s)/P s) that a referral has been made

R2

FR6.83 The Contractor's System will provide a method for CommunityProvider/Partner to acknowledge receipt of referral if requested by the User.The method may include but is not limited to a structured and standard formthat includes:

a) community Provider/Partner's first and last name (main point of contact)b) community Provider/Partner's contact information (email address, phonenumber, etc.) c) Status of referral (accepted, waitlisted, declined)

R2

FR6.84 The contractor's system will allow community Provider/Partner to enterfreeform text to communicate notes / comments to referral acknow ledgement

R2

FR6.85 The contractor's System will allow community Provider/Partner to attachfiles to referral acknowledgement

R2

FR6.87 The Contractor's System will allow for ofreferral acknow R3FR6.88-1 The Contractor's System will display a list of referrals that have been made as

well as capture/display referral outcome such as - a) Refenal successful b)Referral in Progress, c) Referral withdrawn, d) Referral Unsuccessful

R1FINAL

Sr,c.rn or VnruuoNt, CoNtru.cr FoR PnRsoNnl SnnvrcnsDnpnnruBNT oF Vnnuonr Hr.ll,rn AccnssEQHn,rlrn Sor,urroNs, INc.

P.tcB 163 or 268

CoNrnq.cr # 28739AvrnNnvrnNr # 2

FR6.89 The Contractor's System will display a summary of information regarding a

submitted referral, which may include but is not limited to:

a) Date and time of referral b) User who submitted referralc) Member information d) Community Provider/Partner informatione) Service lprogramrequested f) Referral status

RI

FR6.89-1 The Contractor's System will display a summary of information regarding a

submitted referral within the system, which may include but is not limited to:

a) Date and time of referral b) User who submitted referral c) Member

information d) Community ProviderlPartnet information e) Service / program

requested 0 Refenal status

R1FINAL

FR6.90 The Contractor's System will allow for referrals to be searched by multiplefilters, such as but not limited to:

a) Date and time of referral b) User who submitted referral c) Member

information

R1

FINAL

FR6.91 The Contractor's System will allow original referrer to modify a

referral

submitted R1

FINAL

FR6.92 The Contractor's System will save and associate modified referral to

Member's Plan of Care

R1FINAL

FR6.93 The Contractor's System will maintain a record (e.g', audit trail) of allchanges made. This must include but is not limited to: a) The User ID of the

person who made the change b) The date and time of change c) The

information that was d The data before and after it was

Rl.01

FR6.94 The Contractor's System will allow a User to send the modified referral

electronically to identifi ed s

R2

FR6.95 The Contractor's System will send a notification to CommunityProvider/Partner and highlight the changes made to the referral since the

submitted referral

R3

FR6.96 The Contractor's System will allow for printing of a modified referral R1

FINALFR6.98 The Contractor's System will allow User to document and save reason for

and associate it with Member's Plan of Care

R1FINAL

FR6.99 The Contractor's System will send a cancellation notice to

Provider/Partner that referral has been withdrawnCommunity R2

FR6.100 The Contractor's System will maintain a record (e.g., audit trail) ofreferrals. This must include but is not limited to:

a) The User ID of the person who withdrew the cancellation

withdrawn

b The date and time cancellation notice was sent

R1

FINAL

FR6.10l The Contractor's System will have the ability to track transitions between

levels of care and Community Provider/Partners and alert Users when

transitions occur

R3

Close Program EnrollmentFR6.l02 The Contractor's System will display Problems in the Plan of Care that have

not been met. The Contractor's System will hide Problems that have been

but will the for a User to view at an trme

Rl.01

FR6.103 The Contractor's System will provide a simple and

closing a case for a Program enrollmentefficient method for Rl.01

Srlrn or VnnvroNr, CoNrrucr FoR pnnsoNar, SnRvrcnsDrpanrnrnNT oF VnnuoNr Hnar,rn AccrssEQHnalrn Sor,urroNs, INC.

P.lcn 164 or 268CoNrnacr # 28739

AvrnNnvrBlcr # 2

FR6.104 The contractor's system will allow for all, multiple, or single problems to beselected and updated with the same status, which can include but is notlimited to: a) Resolved b) Unresolved c) Partially resolved

Rl.01

FR6.105 The contractor's system will allow for all, multiple, or single Goals to beselected and updated with the same status, which can include but is notlimited to:

a) Met b) Unmet c) Partially met

Rl.01

FR6.106 The contractor' s System will automatically close outstanding Interventionsthat are associated with a Goal that has been statused as 'Met'

R1

FINALFR6.107 The contractor's System will save changes and associate it with Member's

Plan of CareR1

FINALFR6.108 The Contractor's System will allow for User to select reason for case closure

from a predetermined list (e.g., dropdown menu)Rl.01

FR6.109 The Contractor's System will provide a section to allow User to enterfreeform text (notes )

Rl.01

FR6.110 The Contractor's System will alertcurrently scheduled for Member

User of future appointments that are R2

FR6.111 The Contractor's System will allow User to moditi andlor cancelappointments

R2

FR6.112 The Contractor's System will allow User to designate the case as 'closed' Rl.01FR6.113 The Contractor's System will update and save case status and associate it with

Member's Plan of CareRl.01

FR6.114 The Contractor's System will maintain a record (e.g., audit trail) of allchanges made. This must include but is not limited to:

a) The User ID of the person who made the change / closed caseb) The date and time of change / closed casec) The information that was changedd) The data before and after it was changed

Rl.01

FR6.115 The contractor's system will allow users to set alerts / notifications forcertain Goals andlor Problems to follow-up on, along with appropriate contactinformation, after a case has been statused as closed

RI

FR6.116 The contractor's System will allow for all, multiple, or single components ofthe record to be selected and updated with the status of "Death" and the dateof death when the reason for Case Pro enrollment closure is death

R3

Care CoordinationFR6.118 The contractor's System will provide role-based access to Internal Units

based on need to view Member detailsR2

FR6.119 The contractor's system will display Internal units that are involved in aMember's Plan of Care

R2

FR6.120 The contractor's System will display contact information of Internal Units(main point of contact) that is involved in a Member's Plan of Care

R3

GeneralFP.6.t22 The contractor's system will have the ability to search care management data

(according to role-based access defined by the State) by any of the following:Member name, Member ID, and/or Community Provider/Partner ID

Rl.01

Srarn or VrnvroNt, CoNtRlcr FoR PrnsoN.q,L SnnvrcrsDupanrvrnNT oF VpnvroNr Hn,c.LrH AccnssEQHn,tI,rn Sor,urroNso INc.

PacB 165 or 268CoNrntcr # 28739

AvrnNourNr # 2

R2FR6.123 The Contractor's System will have the ability toassigned/decided by the State) to case management data, including but not

limited to: a) Program data and imaged documentation b) Member

information (e.g., hospitalization, LTC facility, pharmacy, PA information,State Plan services) c) Claims data, including pharmacy claims d) Historical

case, claims and enrollment data e) Eligibility information f) Benefit

packages g) Community Provider/Partner information h) Case notes i)Case activity codes j) Others as identified by the State and accepted via

provide role-based access (as

formal change controlThe Contractor's System will have the ability to monitor Rl.01FR6.124

Health Outreach

to

member adherence

PIannedRelease

RequirementNumber

R1

FINALThe Contractor's System will have the ability tobased on a preset schedule and using near real-time data, to be determined by

the State/Department, as well as on an ad-hoc basis. Panel report parameters

may include but is not limited to:a) Disease b) Population age range c) Provider (including offtce location

when locations

pull various Panel reportsFR7.1

R1.01FR7.2 The Contractor's System will store profiles of Users, which includes but is not

c locationlimited toR1

FINALFR7.3 The Contractor's System will automatically assign an appropriate User

locationon

based

R1

FINALThe Contractor's System will have the ability for User to capture contact

information of Clinical Leads at Provider sites including but not limited to:

a) Office address b) Contact information (email address, phone number, etc.)

c) Specialty area(s)

FR7.4

R1

FINALFR7.5 The Contractor's System will allow Users to log contacts with Clinical Leads

at Provider sitesR4 R3FR7.6 The Contractor's System will allow Users to schedule

Clinical Leads at Provider sites

appointments with

R1

FINALThe Contractor's System will save log of contactsFR7.7

R1FR7.8 The Contractor's System will allow Users to track conversation history and

action items with Community Partners around Population-Based Healthin-Care

R1

FINALThe Contractor's System will have a repository of appropriate, el

education materials

ectronicFR7.9

R1FINAL

The Contractor's System will allow Users to select appropriate educationImaterials based on

FR7.10

R1FR7.11 The Contractor's System will allow Users to select all, m

educational materials at one timeultiple, or single

Health OutreachManage

Srlrn or VnnuoNr, CoNrucr FoR pnnsoNar, SnRvrcnsDrpnnrvrnNT oF VnRvroxr HEALTH AccnssEQHnalrn Sor,urrons, Inc.

PAGE 166 or 268CoNrntcr #28739

AivrnnuvrrNr # 2

FR7.11-1 's System will allow Users to select educational materials forThe Contractorthe member

RFINAL

FR7.12 contractor's System will allow Users to electronically send educationalmaterials to Clinical Leads at Provider sites

The R1

FR7.13 The Contractor'associated with

s System will allow for education materials to be saved andation Health record

RI

FR7.14 The Contractor's S will allow for of education materials R1FR7.16 The Contractor's System will

performance measures basedallow the User to document and update Program

on an agreement with Clinical Leads forpopulation or practice

R1

FR7.17 The Contractor's system will provide the ability to use MMIS data to supportpopulation health analyses

R1FINAL

FR7.18 contractor's System will have the ability to receive population data fromvarious extemal entities. Data should include but not be limited to: a) Censusdata b) Vital statistics c) Public health data d) Vermont Health InformationExchange e) eHealth Exchange f) other as identified by the state duringrequirements validation and accepted via formal change control

The R3

FR7.19 The Contractor's System will'have the ability to track and maintain detail forpopulation health initiatives including but not limited to:

a) originator / source of inquiry b) Data source(s) used c) Strategy (orstrategies) developed in response to data analysis d) Trends (ED/Ip) byHospital Service Area e) Others as identified by the State during

validation and via formal control

R1

contractor's System will monitor Emergency Department admissions, re-hospitalizations, short stays and re-admissions for recidivism, and

FR7.20

M

The

for intervention

R1

FINAL


FR8.4 The Contractor's System will have the ability to track information as neededfor

R1

FINALFR8.5 The contractor's System will have the ability to create a patient health

registry with information about Members who may be experiencing a clinicalgap in adherence to clinical standards and barriers

R1

The Contractor's System will have access to up-to-date CommunityFR8.6 R3

Referral

MMIS and2-7-1Provider/Partner data


FR9.2 Contractor's System will allow documents to be attached to bothTheand electronic referrals.

R2


Srarn or VnRvroNt, CoNtnACT FoR PnnsoNal SnRvrcns

Dnp.q.nrNInNT oF VnnvroNr Hnar,rn AccnssEQHnllrn Sor,urroNs, INc.

Pacn 167 or268CoNrru.cr #28739

AvrnNuivrBNr # 2

R2FRg.6 The Contractor's System will allow Users to acknowledge

and notify Referring Party of candidate's eligibility or ineligibilityelectronic referrals

R2FRg.7 The Contractor's System will allow Users to notifli Referring Party of referral

statusR1

FINALThe contractor's System will allow User to enter freeform text to

notes / comments to referral acknowcommunicateFRg.8

R1

FINALFR9.9 The Contractor's System will allow User to attach files to referral

acknowR2The Contractor's System will allow for inter-agency referrals,

include but is not limited to: a) Date and time of refenal b) Referring party

name, contact information (e.g., email address, phone number), and role /department c) Member name and contact information d) Reason for referral

e) Preferred outcome f) Referral condition (new referral, resubmission) g)

Notes

which willFRg.10

R1FR9 11 The Contractor's System will pre-populate inter-agency

contact information, which may include but is not limited toreferrals with User's

a Role/Title dFirst name b Last name c

PlannedRelease

RequirementNumber

R1

FINALFRl0.1 The Contractor's System will be capable of pulling reports in

CSVformats

different file

R1FINAL

The Contractor's System will allow different access levels of viewing and

versusanalFRl0.2

R2The Contractor's System will save previously pulled reports for qfuture access

uick andFRl0.3

R3FR10.4 The Contractor's System will create and maintain an auditable list of all Users

and whichthat accessedR3The Contractor's System will provide a mechanism to archive and delete

oftain order toFRl0.5

R1FR10.6 The System will provide the ability to upload external data sets

BVAnalytics area of the vendor product. The Contractor's System willwithin the

the abili to external data setsR1

FINALThe Contractor's System will have the ability to produce charts, graphs, etc.

trends etc.in order to showFRl0.7

R1

FINALThe contractor's System will have access to multiple data sources

but not limited to: a) Claims b) Surveys c) Clinical/Bio-Medical DataincludingFR10.8

R1

FINALThe Contractor's System will have access to multiple data sources including

but not limited to: a ClaimsFR10.8-1

R1

FINALThe Contractor's System will provide reportingby the Contractor, such as but not limited to: a) Statistical tools i.

regression ii. Predictive modeling iii. risk stratification b)

tools, set-up and configured

Comparing c) Filtering d)

FRl0.9

Reportin

Sr,rrn or Vnnvronr, CoNrucr F,oR prnsoNar. SrnvrcnsDnpnRrwrnNT oF Vnnuoxr Hnar,rn AccEssEQHno-rn Sor,urroxso Inc.

Pacr 168 or 268CoNrnacr #28739

Avrnivnvrnxr # 2

FRl0.10 The contractor's System will have the capability for a user to select specificdataparameters, including but not limited to Member, Provider, and metricsand allow drilling down to view more detailed information, where available

R1FINAL

FRl0.r 1 The contractor's System will allow saving and attaching reports to aMember's Plan of Care or Population Health Management record

RIFINAL

FRl0.12 The Contractor's System will allow printing of reports R1FINAL

FR10.13 The contractor's System will provide reports, set-up and configured by thecontractor, to be automatically generated based on a predefined schedule anddistributed to subscribed Users on a periodic basis. Distribution may be as anelectronic attachment or a notification, alerting User that the report is ready tobe downloaded

R3

FRl0.14 The contractor's system will have the capability for users to specify certainfor standard

R1

FRl0.14-1

The Contractor's System will have the capability for Users to specify certainparameters for standard reports through the ticketing process. The followingcc Reports will be included in Rl.02: . Resource utilization Breakdown(RUB) - Overall, By Age, By Gender .IJtllization Measures -Hospitalization, ED visits, chronic condition Prevalence. clinical - chroniccondition Registry, Pharmacy Measures . Predictive - chronic conditionRegistry, Pharmacy Measures, Actuarial Cost Projections . programRecommendations - care coordination Program Profiles, care CoordinationProgram Projections . Population Reports (Frogram Metrics) - StandardReport, Provider Report, Productivity Report, Program Assessment Report .Population Reports - Encounters Report

The following BI Data Models will be included: ACG, GIC, program Metrics,and Encounters

R1FINAI-

FRl0.15 The Contractor's System will display a template for the user to specify reportparameters, which includes but is not limited to:

a) Reporting period (last month, last quarter, customized date range, etc.) b)Population characteristics c) Geography d) Member e) CommunityProvider/Partner f) Practice g) Community h) State (both cost and clinicalresults)

R1FINAL

FRl0.16 The Contractor's System will allow Users to specify one or multiple R1FINAL

FRl0.18 The Contractor's System will pull detailedthe Contractor, such as but not limited to:

reports, set-up and configured by

a) Cost reports (i.e., significant changes in spending per member, costsavings) b) Hospital admissions (based on claims data) c) ED usage (basedon claims data) d) Emergency Department visits e) provider visits fl caseduration g) Individual (e.g., Members with Diabetes Assessment completed,Members without lab data, date of last visit, etc.) g) Hospital service Area i)Dx specific (Members with Diabetes on Problem list, even if not primary) j)urinalysis completed for substance abuse patients k) case Manager's

toward achievement Case effectiveness l.e.

R1

Surn or VBnvroNt, CoNtru,cr FoR PnnsoNar, SnnvrcnsDnpanrvrnNT oF VBnvroNr IIn.q.LrH AccnssEQHnalrn Sor.urroNs, INc.

P.q.cn 169 or 268

Colrrntcr #28739AnlnNonnnxr # 2

measure reduced or no ED visits, measure reduced or no ambulatory sensitive

IP admission)

FRl0.19 The Contractor's System will leverage HEDIS for program performance

measurement

R1

FR10.20 The contractor's System will produce Panel reports that include gaps ln cafe

for specific conditions and provider grouDS

R1

FRt0.21 The Contractor's System will be able to track and measure outreach R1

FR10.22 The Contractor's System will be able to create a clinical metrics dashboard R1

FR10.24 The Contractor's System will have the ability to collect, track, and report on

outcome mgasures

R1

R1FR10.25 The Contractor's System will have the ability to generate reports to monitor

and cost ofcare to members

FR10.26 The Contractor's System will provide the ability to access and report on

encounter data for the purpose of monitoring appropriateness of care

R1FINAL

FR10.27 The Contractor's System will provide multi-dimensional, flexible, ad hoc

reports across business functions, set-up and configured by the Contractor,

which meetbut are not limited to the following reporting needs: a) Financial

reporting b) Budget forecasting c) Fiscal planning and control d) Cash flowe) Recipient cost and User of services f) Cost/benefit analysis g) Prescription

drug policy h) Cost and User of prescription drugs i) Recipient participationj) Eligibility and benefit design k) Geographical analysis l) Program

planning m) Policy analysis n) Program performance monitoring o) Medical

assistance policy development p) Capacity Planning q) Providerparticipationr) Service delivery pattems s) Adequacy of and access to care t) Quality of

care u) Outcomes assessment v) Disease management w) External reporting

x Public information

R3

FR10.28 The Contractor's System will provide the ability to generate a listing of allstandard on-line reports available, the description ofeach report, and provide

a link to the most recent

R1

FR10.29 The Contractor's System will provide a process by which reports may be

delivered by email in accordance with HIPAA rules

R3

FR10.30 The Contractor's System will provide the ability for Users to extract data,

manipulate the extracted data, and specify the desired format and media of theR1

FINAL

R1FRl0.31 The Contractor's System will provide the ability to track and store detailed

information regarding all reporting requests including but not limited to: a)

Who requested the information b) Date c) Time d) What the report included

e com Route the entire on-line

FR10.32 The Contractor's System will be able to collect, track, and report on

individual staffR1

FRl0.33 The Contractor's System will provide the ability to generate a high-cost

member report to determine potential participation in care managementRIFINAL

Surn or VnnvroNr, CoNrnacr FoR PnnsoN,rr, SnnvrcnsDnplntnanNT oF VnnvroNr Hnar,rn AccussEQHn,urn Sor,urroxs, INc.

PAGE 17O oF268CoNrnq.cr # 28739

AivrnnnvraNr # 2

FR10.34 The Contractor's System will have the ability to query both clinical andclaims data for Members in order to analyzeperformance of current programsand to conduct "what-if' analyses

Rl, R2

FR10.36 The Contractor's System will have the ability to query data and extract reportsto analyze effectiveness of Medicaid dollars granted to Medicaid programsand other agencies in support of care management goals

R3

FRl0.37 The Contractor's System will support the entry of free-form text field(number of characters as approved by the State during requirementsvalidation) associated with each request/analysis, including identification ofUser and date/time entered

R3

FRl0.38 The Contractor's System will have access to Body Mass Index (BMI) data,both by System calculation (based on height and weight) and from medicalrecords

R2, R3

FR10.39 The contractor's system will allow for ad hoc reporting of inpatient facilityadmission data

R3

FR10.40 The contractor's System will collect and report on appropriate High-RiskPregnancy data elements, set-up and configured by the Contractor. Thisincludes but is not limited to: a) Gestational age atreferral b) Date of contactwith member c) Amount and type of contact (e.g., phone call, office visit,home visit) d) Date closed e) Last Menstrual Period (LMP) f) FinalExpected Due Date g) Date of initial prenatal visit h) Number of prenatalvisits i) Maternal complications j) Date of postpartum visit k) Birth weightD NICU stay m) Height n) Weight at LMp o) BMI p) progesteronescreening q) Tobacco use screening r) Post-partum depression screening s)Prenatal visits

R3

FR10.4l The contractor's system will allow Users to pull ad hoc reports. parametersand data elements may include but are not limited to:

a) Geographic location b) Staff engagement c) Clinical metrics d)Financial metrics e) Family satisfaction f) Unplanned utilization (i.e.,Emergency Department visits for hard-to-manage pain) g) cost expenditurecomparison (children with comparable illness enrolled in PPCP versus notenrolled in PPCP) h) Diagnostic couplingi) causation / correlation (e.g., do the interventions lead to reduced costs,

what interventions speci fically) j) Cost-benefit analysis

R1

FR10.42 The contractor's System will allow an atthoized user to design a surveyinstrument for Members, family members, and CommunityProviders/Partners. The survey instrument must be highly configurabledepending on the needs of the surveyor

R2

FRl0.43 The contractor's system will allow an atthoized User to distribute theelectronic survey to Members, appropriate family members, and communityProvider/Partners. The survey can be distributed via multiple channels,including but not limited to: a) Phone b) Mail c) Online (i.e., CommunityProvider/Partner Portal) d) Email

R2

FRl0.44 The Contractor's System will allow an authoized User to schedule predefinedsurveys as a recuffence (e.g., every 3 months post intervention for up to 12months)

R2

Srarn or YnnuoNt, CoNtnacr FoR PrnsoN,q,L SnnvtcnsDpp,q.nrvrnNT oF VnnuoNr Hranrn AccESS

EQHnnlrn SolurroNs, INc.

PAGE 171or268CoNrnacr #28739

AvrnNtunNr # 2

FR10.45 The Contractor's System will accept User entered survey results (online) and

manually entered results by an authorized User

R2

FRl0.46 The Contractor's System will update the Survev Response data stores R3

FR10.47 The Contractor's System will have analysis tools for authorized Users to

revlew

R2, R3

FR10.48 The Contractor's System shall have the capability to generate and displaypopulation, program and member-based dashboard reports, set-up and

configured by the Contractor, based on claims and intervened data.

Population and program-based dashboard reports may include but is notlimited to:

a) Characteristics of a population (e.g., Number and percentage of program

participants by program type, percentage of participants enrolled in multiplepro$anls / services, highest-cost diseases, geographic conditions) b) Program

and collaboration caseload information (e.g., Number of cases by program, bycase manager worked on in a day, status (active / inactive), aggtegate view ofalerts and notifications, referrals received, new messages / shared notes,

defined case milestone and outcome objectives) c) System performance and

quality assurance reports (e.g., Data quality, System performance) d)

Program performance (e.g., correlation between program interventions and

cost, deeper cost diseases)

Member-based dashboard reports may include but is not be limited to:

a) Member's program participation compared to Member populationparticipation and overall population participation b) Member's health profile

to Member and overall ation

R3

FR10.49 The Contractor's System will have the ability to automatically or manuallypopulate, maintain and display multiple indicators at the Member level (e.g.,

disease management, TBI)

R1

FINAL

FR10.50 The Contractor's System will have the ability to conduct analysis of Member

services rendered and its direct impact on Member's conditionR2, R3

FRl0.51 The Contractor's System will collect and report on geoglaphic data sets to

include high use and high cost patterns (i.e. diabetes gaps in care and

associated care costs in the etc.

R1

FR10.52 The Contractor's System will collect and report on geographic data sets to

include but is not limited to:a) High risk families b) Children in custody for Department for Children

and Families

R3

FR10.53 The contractor's System will provide geographic mapping / hot spotting forpredefined high-risk Members and populations (e.g., zip code mapping of

ED Users

RI

FR10.54 The Contractor's System will have the ability to generate federally/state

required reports for Care Management as determined by the State.

R3

Srlrn or VnnvroNT, CoNTRACT FoR prnsoNar, SnRvrcrcsDnpanrnnnNT oF Vnruroxr HEALTH AccnssEQHn,Llrn Sor,urroNs, INc.

Pacn 172 oF 268CoNrnrcr #28739

AvrnNuvrnNr # 2

Consent ManagementNumber Requirement Planne

dRelease

FRI 1.1 The contractor's system will have the capability to allow a user to recordconsent that is given by a Member in order to share his/her informationbetween two or more agency programs and associated CommunityProviders/Partners. Agency can include other parts of state govemment.

R2

FRl1.2 The Contractor's System will support security controls to limit the entry ofconsent information to those with appropriate S ystem-level access

R1

FRl1.6 The contractor's System will record the consent and associated updates in acentral location. The consent may contain but is not limited to: a) Entityobtaining the consent from Member (pre-populated from user information)b) Specific Providers and I or entities contained in the consent (e.g., agencies,departments, program, services or providers who can share information) toallow two-way sharing of information c) Specific individuals contained in theconsent to allow two-way sharing of information d) Type and focus of theinformation covered (granularity and parameters to be determined byVermont policy) e) Types of information (e.g., benefit and eligibilityinformation, medical records, assessments, test results, claims and palmrents)f) Areas of sharing (e.g., behavioral health, mental health, Chronic Care,High-Risk Pregnancy) g) Purpose of the sharing of information (e.g.,congruency and coordination of care, continuity of care) h) Expirationconditions of the consent: i. Period of time from date consent is given ii.Specified end date iii. Specific event (e.g., end of required collaborativeservice delivery, end of treatment) iv. Other conditions

R2 R3

FRl1.7 Contractor's System will automatically populate information related tothe Member providing consent. Member information may include, but is notlimited to:

a) First and Last Name b) Date of Birth

The R3

FRl1.8 The Contractor's System will provide the option to indicate if a third party isproviding consent on behalf of a Member (conservatorship, parent, otherauthorized third party, etc.)

R1FINAL

FRl1.9 The Contractor's system will allow a User to capture verbal consent from aMember in order for Member to participate in the program and/or for caseManager to speak to Member's Authorized Representative

R1FINAL

FRl 1.1 1 The Contractor's System will provide a printer-friendly version of the consentas well as the canned forms for printing

Rl.01

FR11.14 The Contractor's System will have the capability to attach a soft copy of theconsent to a Member record. Note: The benefit of attaching a soft copy of theconsent is the ability to store Member signature. Access rights within TheContractor's System cannot be enforced until the data is entered.

R2

FR 5111 The Contractor's System will maintain an auditable record of all consentsrecorded, accessed and access attempts as well as additions, changes anddeletions to the consent

Sr.q.rn or VnnuoNt, CoNtn-a,cr FoR PnnsoN,q,L SrnvrcnsDnpaRrvrnNT oF VnnvroNr Hn.qlrH AccnssEQHn,tlrn Sor,urroNs, Inc.

Plcn 173 or 268

CoNrRtcr # 28739AvruNtvrnNr # 2

FR11.16 The Contractor's System will allow Users to capture a Member revoking

consent at any time and will notify authorized Users who will take appropriate

action

R2

FRl1.l6-1

The System will allow Users to A) capture a Member revoking consent at any

time

R1.01

FRl1.17 The Contractor's System will allow Users to capture a Member modifyingconsent at any time

R1.01

FRl1,19 The Contractor's System will allow Users to search for a Member's consent

record

R2

FRl1.20 The Contractor's System will display a list of all consent records matching the

search criteria

R2

FR11.21 The Contractor's System will allow a User to update the Member consent

record

R2

FRl1.23 The Contractor's System will allow Users to print or email a copy of the

updated consent record to the Member or another User, as appropriate and

within oolicy

R2

State of Vermont - Care Management Reporting Requirements

ReportingRequirement

Description Data Source Report orOuerv

Audience Freque

1 StaffPerformance

NEl0. 1 3 Provides detailson Staff productivity overa predefined timeframe.Staff parameters mayinclude the individual,departments, etc. R3

Contractor'sSystem

Report

Query

VCCIManagement andVCCIStaff

Ondemand

2 CapacityPlanning

NE1 0. l4 Provides detailson caseload by staffovera predefined timeframeR3

Contractor'sSystem

Report

Query

VCCIManagement

Ondemand

J VCCIMemberPopulationCount

NE10.15 Provides countof total (unduplicated)VCCI members enrolledin the Program over a

predefined timeframe as

well as total count ofmembers by condition,location, provider (Rl)

Contractor'sSystem

Report

Query

VCCIManagement

Ondemand

4 GeographicVariability byChronicDiseaseincludingchronic

NEI 0. 1 6 Provides detailson population report ongeographic variability ofchronic diseases - "hotspotters" by geographyand practice (prevalence

Contractor'sSystem

MMIS

Report

Query


Ondemand

Srarn or VnnvroNr, CoNrucr FoR pnRsoNn SnnvtcnsDppanrunNT oF Vnnuour Hn.q.LtH AccnssEQHn,urn Sor,urroNs, INc.

P.tcn 174or268CoNrnc.cr # 28739

AnnnNrunNr # 2

diseaseprevalence bypractice

of condition(s) by a)region, b) providerpractice) R3

5 MemberAdherence

NEl0. I 7 Provides detailson member adherence tomedication for a specificcondition as well as

percentage of enrolledmembers with completedassessments andmedication adherenceissues R3

Contractor'sSystem

PBM System

Needs tobe point intime, andable to pullat anytime.


Nearrealtime

6 MembertsGap in Care

NEl0.18 Identifiespossible members withgaps in care based ontheir condition (R1)

Contractor'sSystem

MMIS

Needs tobe point intime, andable to pullat anytime.


Nearrealtime

7 RegionalSnapshot

NEl0.19 Providespro gram information forspecific geographicalareas (R1)

Contractor'sSystem

Report

QueryVCCIManagement andVCCIStaff

Ondemand

8 Clinicaloutcomes byMember

NEl0.20 Providesoverview of clinicaloutcomes achieved bymember such as

improved AIC (AlC),less ED utilization, etc.(R3)

Contractor'sSystem

Report

Query


Nearrealtime

9 Clinicaloutcomes byPlan of Care

Provides overview ofclinical outcomesachieved by differentplans of care for specificconditions

Contractor'sSystem

Report

Query


Ondemand

10 Plan of CareMetrics

NEl0.22 Provides a

summary of the plan ofcare metrics by condition,etc. (R1) S

Contractor'sSystem

Report

Query


Ondemand

11 VCCIOperationalMetrics bothon individual

NEl0.23 ProvidesProgram-specificoperational metricsincluding but not limitedto:

Contractor'sSystem

Report

Query


Nearrealtime

Srlrn or VnnvroNt, CoNtnlcr FoR PnnsoNu. SnnvrcnsDnp.lnrNInNT oF VnnuoNr llnll,rn AccnssEQHn.lr,rn Sor,urroxs, INc.

P.tcn 175 or 268

CoNrnq.cr # 28739AMnNnrvrnNr # 2

and teambasis

- Percentage of caseloadcapacity, those withSNA, etc. based on givenmetrics re: staff. (R3)

I2 EmergencyDepartmentVisits

Provides a count of totalEmergency Departmentvisits by Member for apredefined time frameand hospital; review ofutilization of hospitalservices versus setting uppredefined hospital;during specifiedtimeframe --i.e. 3 monthsprior to CM intervention,then 3-month s/p CMintervention.

Contractor'sSystem

MMIS

Report

Query


Ondemand

13 ReferralSources

NEl0.25 Providesinformation on externalreferral sources TheContractor's System has

captured (Rl)

Contractor'sSystem

Report VCCIManagement andVCCIStaff

Ondemand

14 Assessmentsby ConditionoAcuity

NE10.26 Provides thenumber and type ofassessment by condition,acuity (R1)

Contractor'sSystem

Report VCCIManagement andVCCIStaff

Ondemand

15 MemberDashboard

NEl0.27 ProvidesMember's health profilecompared to Memberpopulation profile andoverall population profile(R3)

Contractor'sSystem

MMIS/enterprise

Dash-board


Ondemand

I6 ClinicalMetricsDashboard

Provides a dashboardwith clinical metrics,including but not limitedto-- Asthma, PrescriptionAdherence- CHF, ACEI/ARBAdherence- CHF, Preferred BetaBlocker Adherence- Diabetes, Annual LipidPanel (1 or more)- Achievement of

Contractor'sSystem

MMIS

Report

Query


Ondemand

Surr or Vnnuonr, CoNrrucr FoR PnnsoNaL SnnvtcnsDnplRrvrnNT oF' VnnvroNr Hnar,rn AccnssEQHnar,rn Sor,urroNs, INc.

Pacr 176 or 268CoNrntcr # 28739

AvrnNnvrpNr # 2

goals/intervention orprogress toward goals- Social needs

t7 Memberreports

NEl0.29 Provides cost ofservice for each memberfor a predefinedtimeframe (6 month lookback) (Rl)

Contractor'sSystem

MMIS

Report

Query


Nearrealtime

18 Providerreports

NE10.30 Contractor'sSystem

Report orQuery


Ondemand

t9 SASHDashboardReports

NEIO3I Provide a pointofreference forpopulation and individualhealth of SASHparticipants through avisual representation ofthe number ofparticipants within a

specific SASH site, or forall SASH sites, with afocus on key data pointsand measures collectedby SASH

Contractor'sSystem

Report SASHwellnessnurses,carecoordinators, andoperations

managers

Ondemand

20 BlueprintPCPPerformanceReports

NEl0.32 Provideperformance informationon PCPs in terms ofmeasures for keepingpatients with chronicconditions withingoalhange for thoseconditions to includedrill-down into outreachreports, specifi c patientdata and visit planners,and trending over time(such as l2-month lookback). These reportswould providecomparative analyses onproviders against otherproviders within apractice, within the HSA,and across the State. (R3)

Contractor'sSystem

Report BlueprintPCPs

Ondemand

Sr.lrn or VnnvroNt, CoNtru.cr FoR PnnsoN,q'L SnnvrcnsDnpaRtnnnNT or VrnvroNr Hn,q.r,rn AccnssEQIIn.lr,ur Sor,urroNs, INc.

Pr.cB 177 0t268CoNrnacr #28739

AMENDMENT # 2

2l FQHC UDSReports

NEl0.33 Clinicalmeasure reports requiredby HRSA for FQHCs.For example, patientsages 18 - 75 with a

diagnosis of diabetes,who meet all thenumerator targets of thiscomposite measure: Alc< 8.0, LDL < 100, BloodPressure < 140190,Tobacco non-User andfor patients withdiagnosis of ischemicvascular disease dailyaspirin use unlesscontraindicated. (R3)

Contractor'sSystem

Report FQHCS,Bi-State

Ondemand

22 To Do ListReports

NEl0.34 List those itemsthat have beiome due(based on a previouslyentered date) for the Userto work on. For example,a tobacco counselor mayindicate follow up with apatient who wasn't readyto be contacted to quitsmoking until after theholidays. (Rl)

Contractor'sSystem

Report All Users Ondemand

23 VisitCommentreport

NEl0.35 Print a

chronological summaryof interactions andoutreach for a patientrecord for sharing withother providers not usingThe Contractor's System.(Rl)

Contractor'sSystem

Report All Users Ondemand

Srarn or VnnvroNr, CoNrnacr FoR pnnsoNar, SnnvrcnsDnplRrvrnNT oF VnnvroNr Hn.q.LrH AccnssEQHnalrn Sor,urroNso INc.

IXII-

Pacn 178 or 268CoNrrucr # 28739

AvrBNnvrnNr # 2

G Generalized System Behavior RequirementsG1 UsabilityG2 Audit / ComplianceG3 Service Level Requirements (SLRs )and

PerformanceG4 Interface ListG5 General

T Technology RequirementsT1 bility / InterfacesT2 Scalability and ExtensibilityT3 Regulatory and SecurityT4 Health and Human Services Enterprise (HSE)

Platform AlignmentI Change Process Requirements - ImplementationII12 Environment Installation and ConfigurationI3 Knowledge Transfer & TrainingI4 Design, Development & CustomizationI5 Deployment16 Quality Managemento Process Requirements -o1 Production Support & Transition02 Defect Resolution and Solution Acceptanceo3 System Administrationo4 System Management

This Contract includes four (4) non-functional requirements categories andnineteen (19) sub-categories. The requirernents in each category and sub-category appear in a separate tab in this workbook. The categories and sub-categories are:l.lir i.):rLrrcriiLtlu ii'iliiilr

Srarn or VonvroNto CoNtnacr FoR PnRsoN.q,L SnnvrcnsDnplnrNInNT oF VrnvroNr Hral,rn AccnssEQHnu,rn Sor,urroNs, Inc.

Prcn 179 or268CoNrnq,cr # 28739

AnnnNrunxr # 2

The Contractor's System will provide a User interface that

will be simple and consistent throughout all areas and

Usabitity Requirements

Rl FINALGl.1

functions of the Contractor's S

Rl FINALThe Contractor's System will minimizethe number ofmouse clicks / User interaction to complete any action

Gt.2

Rl.01The Contractor's System will use a Graphical User Interface(GUD to help the User navigate to the next logical step in

the workflow, or freely navigate to other parts of The

Contractor's System functionality, and then allow the User

to return to complete the in-process task

Gl.3

RI.01GT.4 The Contractor's System will speak the Users'language,

with words, phrases and concepts familiar to the User, rather

than System-oriented termsR3-R4The Contractor's System will accommodate diverse

populations of Users including those with disabilities and

limited English proficiency as defined in section 504 of the

Rehabilitation Act of T913

Gl.5

Rl.01Gl.6 The Contractor's System will follow real-world Vermontterminology and conventions, making information appear ina natural and logical order

Rl.01The Contractor's System will allow the Users to easily

navigate to a variety of functions available to them withouthaving to move sequentially through excessive menus and

screens

GI.7

Rl.01The Contractor's System will include at minimum the

following features and capabilities :

a) Drill down and look up functionality to minimize re-

entry of information across multiple screens

b) Multi-tasking and multiple window capability, includingsplit screens

c) Search capabilities to allow retrieval by Provider,

Member, procedure code, NDC or others as defined by the

Stated) Ability to tab and mouse through data fields and screens

and to change tab order

Gl.8

Rl.01Gl.9 The Contractor's System will support undo and redo, orprovide onscreen confirmation/acceptance to the User to

confirm a change that is permanent and cannot be "undone"Rl FINALGl .10 The Contractor's System will provide Users with a clearly

marked "emergency exit" for the instances when a User

mistakenly chooses a function and such "emergency exit"must be simple with minimal

Number RequirementDescriPtion Planned Release

Suru or VrnuoNt, CoNtnacr FoR PrnsoNnr, SrnvrcnsDnpanrivrnNT oF VnnuoNr Hnlt,rn AccrssEQHnnlur SolurroNs, INc.

Plcn 180 or 268CoNrR.rcr #28739

AvrnNovrnNr # 2

G1.1 1 The Contractor's System will follow standardizedconventions and limit the use of words, situations, or actionsthat have multiple meanings

Rl FINAL

Gt.t2 The Contractor's System will eliminate error-proneconditions or check for them and present Users with aconfirmation option before they commit to the action

RI.01

Gl.13 The Contractor's System will minimizetheUser's memoryload by making oblects, actions, and options visible

Rl FINAL

Gl .14 The Contractor's System will provide the option to haverollover / tooltip help or context messages

R2

GI.15 The Contractor's System will provide all User instructionsin a visible or easily retrievable location, when apBropriate

Rl FINAL

GI.16Gl.16-1

The Contractor's System will cater to both inexperiencedand experienced Users

Rl FINAL

Rl FINALGI.18 The Contractor's System's effor messages will be expressed

in plain language, precisely indicate the problem, andsuggest a solution

Rl.01

Gl.19 The Contractor's System will use colors where they enhanceUser experience and System usability while complying withall disability requirements notated elsewhere in these

R3

Gt.20 The Contractor's System will allow the User to navigate toany functional component from a client landing pase

Rl FINAL

GT.2T The Contractor's System will alert the User withinformation relevant to required next steps

Rl.01

Gr.22 The Contractor's System will provide drop down and listboxes for all key entry, and text entry will display existingvalues for selection (system based auto fill) (but specificallydisallow User browser based autofill )

Rl.01

Gt.23 The Contractor's System will accommodate point and clickselection and check box entry for all relevant data entries toensure that the User does not have to enter textual datathatmay already be available to the Contractor's System

R1.01

Gt.24Gl.24-l

windows where usability is enhanced

The Contractor's System will facilitate data entry and willcontain pop-up list boxes for code fields in processing

Rl.01

Gt.25 The Contractor's System will provide field level on-screenedits with limited User override capabilities

Rl.01

Gt.26 The Contractor's System will provide the ability to makefields visible/invisible depending on parameters, LJser

4gb!$ consent, and access controls

Rl FINAL

GT.27 The Contractor's System will not show fields not accessibleto a given User based on access rights, member consent, norwill The Contractor's System show fields not in use

Rl.01

Surn or Vrnvronto CoNtucr FoR PnnsoNl,l, SnnvtcnsDnp,qntNInNT oF VnnuoNr Hn.q.r,rn AccnssEQHnalur Sor,uuoxs, Ilvc.

PAGE L81 or 268

CoNrru,cr #28739AvrnNnunNr # 2

G1.28 The Contractor's System cursor will automatically advance

to the next logical input field when the maximum allowednumbers of characters have been entered for the keyed fieldor when the User ses the "Enter"

Rl.01

Gt.29 The Contractor's System will provide the option of having a

selection from the drop down boxes automatically take the

User to the next field

Rl.01

G1.30 The Contractor's System will provide validation checks at

the time of each field entry as the default mechanismRl.01

Gl.31 The Contractor's System will identify invalid entries to the

User as immediately as

R1.01

GT.32 The Contractor's System will provide the ability to suggest

or automatically change entries that do not conform to data

entry standards, to be defined in the detailed system design

and meta data models in collaboration with the State

Rl.01

Gl.33 The Contractor's System will be designed to include onlythe necessary information and functionality on screens and

will be based on the Ljser's access level and the User's

confizuration

R1.01

GL.34 The Contractor's System will be designed to include logicaltransitions between screens and level of detail duringnavigation

Rl.01

Gl.35 The Contractor's System will provide templates for data

entry with identified mandatory and data fieldsRl.01

G1.36 The Contractor's System will allow incomplete data sets to

be saved for completion of the workflow at a later timeRl.01

Gt.37 The Contractor's System will highlight and flag required

and incomplete data fieldsRl.01

G1.38 The Contractor's System will include a graduated system ofalert levels to allow Users to determine urgency and

relevancy

R1 FINAL

G1.39 The Contractor's System will allow configuration ofnotifications by a User, for a User by a supervisor, and for a

User by a System administrator

R3

G1.40 The Contractor's System will allow for the request of orentry of data from extemal devices (e.e. tablets)

R1.01

G1.41 The Contractor's System will notify the User when a source

system is unavailable / inoperable and notify User. The

Contractor's System will display any alerts on the landingpage if a login is possible, or in an error web page if loggingin isn't possible.

R2

G7.42 The Contractor's System will not require Users to reenter

data due to validation errors if the Contractor's Systems can

auto-correct based on the entered data or the User can

navigate to the entry error to correct the entry

Rl.01

Surn or VnnvroNr, CoNrnacr FoR pnnsoNar, SnRvrcnsDppantvrcNT oF VnnuoNr Hnalrn AccnssEQHrar,rn Sor,urroNs, INc.


AvrutwpNr # 2

GT.43 The Contractor's System will enable central workflow alertsand transactional status. The Contractor's System willcentralize pending work items for the User as in a "workqueue"

Rl.01

Gt.44 The Contractor's System will have the capability to pushmessages to the intended workers without requiring them tospecifically inquire for the data

RI FINAL

G1.45 The Contractor's System will provide a hover option overstate defined fields to generate a description of the dataelement

R3

Gt.46 The Contractor's System will provide linked access to helpfunctions which contain the appropriate information andsearch of all help information from every window, based onUser profiles

Rl.01

G1.48 The Contractor's System will be available on commonlyused browsers including, but not limited to, Chrome andFirefox and Microsoft Internet Explorer 9 or later versionswith the ability to provide data over a web browser interface(i.e. HTML over HTTP), and will include the capability toencrypt the data communicated over the network via SSL(HTML over HTTPS)

R2

Audit and

G2.l

uirements

The Contractor's System will maintain a record (e.g. audittrail) of all additions, changes and deletions made to data inthe system. This should be readily searchable by user ID ormember ID. This must include, but is not limited to:a) User ID of the person who made the change, b) date andtime of the change, c) Physical, softwarelhardware andlornetwork location of the person while making the change, d)Information that was changed, e) Outcome of the event, f)Data before and after it was changed, and g) Which screenswere accessed and used

R1.01

G2.2 The Contractor's System will allow an authorizedadministrator to set the inclusion or exclusion of auditableevents based on organizational policy & operatingrequirements/limits

R3

G2.2-1 The Contractor's System will allow an authorizedadministrator to request the inclusion or exclusion ofauditable events based on organizational policy & operatingrequirements/limits

R1.01

G2.3 The Contractor's System will support logging to a commonaudit engine using the schema and transports specified inAudit Trails and Audit Lo specifications. (

Rl FINAL

Srnrn or Vnnuoxto CoNtucr FoR PERSoNAL SnnvrcnsDnpanrivrrNT oF VnnvroNr Hnanrn AccnssEQHp,lLrn Sor,utroNs, INc.

Pacn 183 or 268

CoNrru.cr #28739AvrnNnvrunr # 2

G2.4 The Contractor's System will be able to detect security-

relevant events (as defined in NIST 800-53 moderate

baseline, rev 4) that it mediates and generate audit records

for them. At a minimum the events will include, but not be

limited to:a) Start/stop b) User logirVlogout c) Session timeout d)

Account lockout e) Member recordcreated/viewed/updated/deleted f) Scheduling g) Query h)

Order i) Node-authentication failure j) Sigpature

created/validated k) P ersonally Identifrable Information(PII) exportl) PII importand restore o

m) Security administration events n) Backup

Audit Event listed in IRS 1075

Rl.01

G2.5 The Contractor's System will provide authorized

administrators with the capability to read all auditinformation from the audit records in the following twoways:1) The Contractor's System will provide the audit records ina manner suitable for the User to interpret the information.The Contractor's System will provide the capability togenerate reports based on ranges of System date and timethat audit records were collected.2)The Contractor's System will be able to export logs into

text format in such a manner as to allow correlation based

on time (e.g. Coordinated Universal Time [UTC]

R1.01

G2.6 The Contractor's System will be able to perform timesynchronization using NTP/SNTP, and use thissynchronized time in all securitv records of time

R1.01

G2.7 The Contractor's System will have the ability to format forexport recorded time stamps using UTC based on ISO 8601

Rl FINAL

G2.8 The Contractor's System will prohibit all Users read access

to the audit records, except those Users that have been

sranted explicit read access

Rl.01

G2.9 The Contractor's System will protect the stored auditrecords from unauthonzed deletion. The Contractor'sSystem will prevent modifications to the audit records

RI.01

G2.t0 The Contractor's System will prevent modifications to the

audit records

Rl.01

G2.17 The Contractor's System will provide logging, reporting and

accessing elTors and exceptions

Rl.01

G2.12 The Contractor's System will provide capability forintegrating consent audit trails and data access audit trails ina consolidated searchable system for search/report to

support consent rule enforcement or investigation includingaudit trails based on rules or policies

Rl.01

Sraru or VrnvroNr, CoNrrucr FoR pnnsoNu, SnnvlcnsDnplnrvrnNT oF' VnnuoNr Hnar,rn AccEssEQHualrn SolurroNs, INc.

Pacn 184 or 268CoNrnncr # 28739

AvrnNuvrnnr # 2

G2.13 The Contractor's System will generate and protect consentaudit events at the same or better levels as other data accessaudit records

Rl.01

SLRs and Performance

G3.1 The Contractor's System response time during operationswill be 5 seconds or less for 95 percent of the search andlookup queries (does not include ad hoc queries andanalyics). Maximum response time for search and lookupqueries will not exceed 15 seconds except for agreed toexclusions. The Contractor shall investigate tickets fromSoV that report response times exceeding the maximumresponse time and provide an analysis to SoV The systemresponse time is defined as the time it takes for the server to

Rl FINAL

servlce aG3.2 The Contractor's System shall return each Dashboard report

(main, patient, provider, etc.) within 5 seconds or less, 950loof the time (

Rl FINAL

G3.3 The Contractor's System will return a Static Standard reportwithin 5 seconds or less, 95olo of the time (

Rl FINAL

G3.4 The Contractor's System will retum a parameter-basedreport within 20 seconds or less, 95olo of the time.

Rl FINAL

G3.5 The Contractor's System will achieve performance forinteractive transactions other than the reporting-relatedtransactions above, conforming to the minimum acceptableperformance standard of 5 seconds response time, for 95o/oof interactions

Rl FINAL

G3.6 The components of the Solution under Contractor control asdelivered into production shall be availabl e 99.7 5%o. Theavailability percentage will be verified with evidence fromthe Contractor. Scheduled maintenance will be allowedwith the prior approval of the State of Vermont (SoV). Anongoing monthly maintenance schedule requires just oneapproval. Additional scheduled maintenance requires SoVapproval at least 2 business days in advance. Scheduledmaintenance should occur outside normal business hours.

Rl FINAL

G3.7 The Contractor's System will be architected with no singlepoint of failure, supporting a high-availability enterprise

Rl.01

G3.8 The Contractor's System's hours of operations will be24hours per dav. 7 davs oer week- and 365 days a year (

Rl FINAL

G3.9 The Contractor 's System will have the ability to supportsession replication and transparent failover using high-availability architectural options

Rl.01

G3.10 The Contractor's System will be designed to support theplanned Vermont systems and any anticipated expansion inscope of connectivity

Rl.01

Sr,lrn or VnnvroNt, CoNtnacr FoR PrnsoNlr, SnnvrcrsDnpl,ntnlrNT oF VrnuoNr Hrar,rn AccnssEQHnn rn Sor,urroNs, INc.

Plcn 185 or 268CoNrru,cr #28739

AvrnNounNr # 2

G3.11

with expanded system usage

The Contractor' s System Administration staffi ng

requirements and workload should be minimally impactedRl FINAL

G3.72

capacity added), up to specified limit

The Contractor's System must be built so that there is a near

linear relationship between each additional server added,

and the additional load that can be accommodated (load vs.

R1.01

G3.13

restored within 4 hours

The Contractor's System's Recovery Time Objective (RTO)

will be within 4 hours. In case of a disaster that effects the

Care Management operations, the entire service will be

Rl FINAL

G3.r4 The Contractor's System's Recovery Point Objective (RPO)

will be no more than t hour of data loss. In case of adisaster that effects the Care Management operations, t hourof data inputs to the Contractor's System (but no more) maybe lost and need to be re-entered

Rl.01

G3.15 The Contractor's System will use fully redundant networkand hardware. Hardware components (such as processor

and memory) should have built-in redundancy to allow a

second component to take over in the event of a failure inthe primary component. Similarly, redundant paths should

also exist for networks

Rl.01

c3.16

havins to acquire additional hardware

The Contractor's System will leverage virtualization to

expedite disaster recovery. Yirtualization enables system

owners to quickly reconfigure system platforms without

Rl.01

G3.17 The Contractor's System will have the ability to support

either a Production and hot (real time replication) disaster

recovery design or a multi host site Production design that

would allow one site to seamlessly be offline and the other

site would maintain service without intemrption

Rl.01

G3.18 The Contractor's System will include a disaster recoveryplan and provide contingency plans for State lookupcapabilities and online collaboration in the event of adisaster

Rl.01

G3.19

error (

The Contractor's System will provide the ability to recover

from data loss due to end User error and end applicationRl FINAL

G3.20 The Contractor's System will provide the ability to perform

archival/incremental backups and the ability to performoperVclosed database backups

Rl.01

G3.27 The Contractor's System will provide tools for managing an

environment that supports both high availability and disaster

recovery

Rl.01

Srarn or VnnvroNr, CoNrrucr FoR PnnsoN.q,L SnnvrcnsDnpmrvrnNT oF VnnuoNr Hn.q.r,rn AccnssEQHnllrn Sor,uuolrs, INc.

PAGE 186 or 268CoNrucr # 28739

AvrnnuvrnNr # 2

G3.22 The Contractor's System will include the capability tomaintain all data according to state defined records retentionguidelines (i.e. record schedule). General schedules can befound at: httos://www.sec- vt.us/archives-records/records-mana gement/records-retention/ general -record-schedules.aspx. Specific retention disposition orderscan be found at : http s : //www. ses. state. vt.us/archives-records/records -mana qement/records-retention/dispo sition-orders.aspx.In general, document retentions range from 3 to 10 years. Inaddition to the above, note that case records including ChildSupport-related data must be retained for a minimum of 3years after Case closure and the youngest child in the case is18 years old.

Rl.01

G3.23 The Contractor's System will include the capability tomaintain all images and electronic documents according tostate defined document retention guidelines (i.e. recordschedule). General schedules can be found at:https ://www. sec. state.vt.us/archives-records/records-mana gement/records-retentiorV general-record-schedules.aspx. Specific retention disposition orders can befound at: httos://www vt.us/archives-records/records -mana gement/resords-retention/dispo sition-orders.aspx.In general, document retentions range from 3 to 10 years.

Rl.01

G3.24 The Contractor's System will provide on-line access of allactive cases and up to 12 months for closed cases

Rl.01

G3.25 All software developed and delivered by the Contractormust be free of viruses, malware, backdoors

RI.01

G3.26 The service provider must resolve Severity I Maintenancerequests within 4 clock hours (Rl.01)

Rl.01

G3.27 The service provider must resolve Severity 2 Maintenancerequests within 24hours

Rl FINAL

G3.28 Severity 2 Maintenance requests are to be prioritized (seePriority Level definitions) jointly by SoV and the Contractorand scheduled accordingly for investigition, correction anddeployment into production.

Rl FINAL

G3.29 All priority 3 or higher defects (testing defects) resultingfrom software development activities shall be resolved bythe Contractor prior to the software being delivered for UserAcceptance Testing and prior to deploynent to production

Rl FINAL

G3.31-1 The Contractor must resolve priority 2 test defects within anaverage of 3 (three) days, but no more than a maximum of 5(five) days. Defects with Severity levels of I through 5 shallbe responded to within 8 (eight) hours of defect notification.Response is defined as the identification of a fix and an

Rl.01

Sr.q.rn or VnnvroNt, CoNtrucr FoR PnnsoNar, SnnvrcnsDnr.q.RrvrnNT oF VnnvroNr Hn.lr,rn AccnssEQHru,rn Sor,urroNso INc.

Pncp 187 oF 268CoNrnacr #28739

AnnnNovrpxr # 2

estimate of the time frame for UAT to beginRl.01G3.32-l The Contractor must resolve priority 3 test defects within an

average of 4 (four) days, but no more than a maximum of 7(seven) days. Defects with Severity levels of 1 through 5

shall be responded to within 8 (eight) hours of defect

notification. Response is defined as the identification of a fixand an estimate of the time frame for UAT to begin.

Rl.01c3.33-1 The Contractor must resolve priority 4 test defects within an

average of 5 (five) days, but no more than a maximum of 8(eight) days. Defects with Severity levels of 1 through 5

shall be responded to within 8 (eight) hours of defect

notification. Response is defined as the identification of a fixand an estimate of the time frame for UAT to begin.

Rl.01The Contractor must resolve priority 5 test defects within an

average of 6 (six) days, but no more than a maximum of 10

(ten) days. Defects with Severity levels of 1 through 5 shall

be responded to within 8 (eight) hours of defect notification.Response is defined as the identification of a fix and an

estimate of the time frame for UAT to begin

G3.34-l

InterfaceList

Rl FINALG4.1 The Contractor's System will draw data from the current

MMIS system to confirm beneficiary eligibility on a

monthly schedule. The Contractor's System will interface

with the future Integrated Eligibility System to confirmbenefi ciary eligibility in real-time

Rl.01The Contractor's System will obtain beneficiarydemographics from the current MMIS system on a monthlyschedule. The Contractor's System will obtain beneficiarydemographics from the new EMPI and future MMISsystems on a monthly schedule

G4.2

Rl.01G4.3 The Contractor's System will obtain medical and pharmacy

paid claims details from the current MMIS system on a

weekly schedule. The Contractor's System will obtain

medical and pharmacy paid claims details from the new

MMIS system on a daily scheduleR2G4.4 The Contractor's System will interface with the current

MMIS system to obtain surgical procedure codes on a

weekly schedule and from the new MMIS system on a dailysehedule

Rl.01The Contractor's System will obtain the master list ofProviders and their demographics from the current MMISSystem on a weekly basis. The Contractor's System willinterface with the future MPI system and new MMIS system

G4.6

Number Requirement Description Planned Release

Srarn or Vnnuronr, CoNrnacr FoR PnnsoNar, SnnvrcosDnp.q.nrivruNT oF VnnvroNr Hpaltn AccnssEQHrllrn Sor,urroNs, INc.

PAGE 188 or 268CoNrnq.cr # 28739

AvmNuvrnNr # 2

as necessary to obtain the master list of Providers and theirdemographics in real-time.

G4.7 The Contractor's System will interface with the currentMMIS system on a weekly schedule and the future MMISsystem in real-time to obtain third party liability information

Rl FINAL

G4.8 The Contractor's System will interface with the VermontHIE system (VHIE) to obtain details of interactions with andservices provided to beneficiaries by the provider in real-time

R2

NFRG4.8-001

The solution must interface with the Vermont HIE system(VHIE) to receive real-time information on select clinicaldata attributed to Medicaid members.

R3

NFRG4.8-002

The solution must provide updated Medicaid populationinformation to the VHIE system based on business rules

R3

NFRG4.8-003

The solution must provide an on demand real time interfaceto the VITL Access.

R3

G4.10 The Contractor's System will draw census data (includingEmergency Department Visits and In-patient Stays) from anumber of hospital systems on a mixture of weekly anddaily schedules and will interface to receive this informationin real-time in the future. Hospital systems include, but arenot limited to: Fletcher-Allen, Copley, Central VT,Northwestern Med Center, NVRH, Bennington, andRutland.

R3

G4 11 The Contractor's System will obtain lab results in real-timeftom the statewide HIE system supported by VermontInformation Technolo gy Leaders

R3

The Contractor's System will uniquely identify eachG5.l Rl.01

General uirements

VEPro and AuthorizedMember ProviderG5.2 The Contractor's System will authenticate Users before

access to functionalitrr requiring a loginRl.01

G5.3 The Contractor's System will provide a mechanism to limitaccess to view/update information, based on User role,access rights, member consent, and program rules

Rl.01

G5.6 The Contractor's System will link the services received by aMember to the:

) Billing provider c) Plan of carea) Prior authorization b

Rl.01

Interoperability / Interfaces uirementsPlanned ReleaseNumber RequirementDescription


Srlrn oF VERMoNI, CoNtucr FoR PnnsoNar, SnnvrcnsDBranrvrBNT oF VnnvroNr Hn,tlrn AccnssEQHnalrn Solurrons, INc.

PLcB 189 0r 268CoNrru.cr #28739

AvrnNrunnr # 2

T1.1 The Contractor's System's interfaces will secure and protect

the data and the associated infrastructure from a

and ve.

Rl.01

Tl.2 The Contractor's System will be able to support Applicationto Application (A2A) synchronous and asynchronousmessaging using web services. The messaging capabilities

will be able to support a wide variety of A2A patterns

including, but not limited to, the following:- Data look-up and retrieval- Datalook-up with services provided by other applications- Simple bulk data transfer tolfrom other S

R2

Tt.3 The Contractor's System's interface infrastructure willcontinue to operate despite failure or unavailability ofindividual technology components such as a server platformor network connection.

RI.01

Tl.4 The Contractor's System's interfaces must be scalable to

accommodate changes in scale including changes in Userpopulation, transaction volume, throughput and

geographical distribution. The Contractor's System will be

capable of making any changes to the interface data

elements/layouts easily, and to test those changes.

R3

Tl.6 The Contractor's System will provide the capability toperform source to destination file integrity checks forexchanse ofdata and alert appropriate parties with issues

Rl.01

Tt.7 The Contractor's System's components will be committed toan advanced approach to interoperability using web services

and Service Oriented Architecture (SOA) aligned with State

standards and vision for interoperability

Rl.01

T1.14 The Contractor's System's ,message and data formats willbebased on logical representations ofbusiness objects rather

than native application data structures

Rl.01

T1.15 The Contractor's System's data transformations will be to

and from normalized formats. Normalized data formats

facilitate composition and reduce the number oftransformations that must be created and maintained. Acanonical data representation that spans the enterprise can be

used but is not required. A federated approach to data

normalization is also possibleT1.16 The Contractor's System will avoid point-to-point

integrations. Application integration, both internal and

external, will go through the central ESB except whenrequired by the State of Vermont for external applicationintegration.

R2

Tt.t7 All System services will be classified with one of thefollowing values: Presentation, Process, Business, Data,

Access, or Utility

Rl.01

Srarn or VnnvroNr, Contrucr FoR pnnsoN.lr, SnnvrcnsDnpLnrunNT oF VnnvroNr Hn,rr,rn AccEssEQHnalrn Sor,urroNs, INc.

PncB 190 or 268CoNrucr # 28739

AurNovrnnr # 2

T1.18 a) All software architecture documents and artifacts(views/viewpoints) will be modeled per ISO/IEC/IEEE42010 Architecture Description Template as part of theVermont Architecture Proglam Requirements

Rl.01

T1.19 A11 System services will have key stakeholder/ownersidentified following the ADM Architecture Model. RoleMatrix should include s/w developers, integrationists,technologists, Enterprise Architects, Business Leads,Testing teams, UAT Teams.

R2

TT.24 The following metadata attributes will be tracked for allservices in the services catalog: {name, lifecycle stafus,class, description, owner, version, revision history, releasefrequency, versioning policy, deprecation policy, messageexchange patterns, compensating transaction support,availability requirements, volume, max message size,security SLA, logging requirements)

R2

T1.26 The Contractor's System will be designed, built anddeployed with extensible and modular enterprisearchitecture best practices including substantial reliance onhighly configurable SOA components. The Contractor'sSystem will undergo, at aminimum, 2 iterations integratedwith HSEP development environment. Each iteration willhave a maximum period of 10 days. The Contractor'sSystems will have an alpha deployment on HSEP stagingEnvironment and also will have, at a minimum, three weeksof UAT Testing by Business SMEs on the HSEP StagingEnvironment

Tt.27 The Contractor's System will provide reliable, once-onlydeli of messages (reliable and non-repetitive deliverv).

R2

T1.29 The Contractor's System will provide the functionality thatprovides reliability for applications, services or messageflows:' Load balancing' High availability' Fault tolerance'Failover' In-order delivery' Transaction support' Executionpnoitization' M es s a g e pioitization. Tests for Hi ghAvailability and Failover must be completed prior to therelease to UAT.

RI.01

T1.30 The Contractor's System will provide the technology thatmanages the metadata and provides the features needed tosupport the reliable operation of services

R2

T1.31 The Contractor's System will provide support for integratingwith applications with SOA and event-driven architectures.

R2

Surn or VnRuoltt, CoNtru,cr FoR PERSoNAL SnRvrcnsDnp,qntNInNT oF' VnnvroNr Hnllrn AccnssEQHr,ll,rn SolurtoNs, INc.

P.lcn 191or 268Conrru,cr #28739

AvrnNounNr # 2

R2The Contractor's System will have the ability to track amessage from its origin to its destination (inside a firewall),inquire on the status of that message and address exceptions(for example, resend the message if a target times out).

Usually implemented via a warehouse for archivingmessages together with the associated tracking and loggingdata.

Tt.32

Rl.01The Contractor's System will have the ability to use

standards-based communication protocols, such as TCP/P,HTTP, HTTP/S and SMTP. 'Protocol bridging: The abilityto convert between the protocol native to the messagingplatform and other protocols, such as Remote MethodInvocation (RMI), IIOP and .NET remoting.

T1.33

Rl.01T1.34 The Contractor's System will seamlessly work with the

technology and programs that act as glue, transformingamong protocols, connecting to databases and linking pre-

SOA Application Programming Interfaces (APIs) to the

SOA backplaneR2T1.36 The Contractor's System will have the capability to work

with security policy manager for Web services that allowsfor centrally defined security policies that govern Web

services operations (such as access policy, logging policy,and load balancing)

R2T1.37 The Contractor's System will have the capability to integrate

with the VT MDM technology for Enterprise Master Person

Index (EMPD implemented as part of the HSE Platform in acentralized or registry style implementation. The State ofVermont has invested in enterprise licenses for Oracle

MDM and strongly prefers that it is used however if the

bidder cannot leverage this functionality initially it mustprovide for a probabilistic person index or person record

function.Scalability and Extenstbility Require'ments

Rl.01T2.l The Contractor's System will be designed for ease ofmaintenance and readily allow future functionalenhancements. This will be accomplished through use ofmodern design principles for Service Oriented Architecture,applyng principles of modularity, interface abstraction, and

loose coupling.Rl FINALT2.2 The Contractor's System will be adequately flexible to keep

up with ever changing technology and regulatory changes'

This will be accomplished by separating workflow and

business rules into their own separate tiers.

Numtrer RequirementDescriPtion Planned Release

Suru or VnRivroNro CoNrnacr FoR PnnsoNal SnnvrcnsDnplRtvrnNT oF VnnvroNr Hnar,rn AccnssEQHn,t lrn Sor,urroNs, INc.

Pacr 192ot268CoNrnncr # 28739

AvruNonanNr # 2

T2.3 The Contractor's System will be scalable and adaptable tomeet future growth and expansiorVcontraction needs suchthat The Contractor's System can be expanded on demandand be able to retain its performance levels when addingadditional LJsers, functions, and data

RI FINAL

T2.4 The Contractor's System will provide screens that are highlyre-configurable, providing ability to reposition and renamefield labels I data fields, remove or "turn-off'unused fieldsmaintain data, and allow addition of custom-defined fields

Rl.01

T2.5 The Contractor's System will enable the State to modify thelabels and arrangement of information in the data modeldocumentation templates and can create custom data fields (

Rl.01

T2.6 The Contractor's System will provide the ability to createand/or modify edits and business rules which determine thecorrestness/integrity of data

Rl.01

T2.7 The Contractor's System will provide the ability for on-lineaccess by any site connected to the organization Wide AreaNetwork (WAN)

Rl.01

T2.8 The Contractor's System will provide the capability forremote access in compliance with existing State / Federalconnectivity/security policies

RI.01

T3.1

& Security uirements

The Contractor's System will, at a minimum, provide amechanism to comply with security requirements andsafeguard requirements of the following Federal agencies /entities:- Health & Human Services (HHS) Center for Medicare &Medicaid Services (CMS)- Administration for Children & Families (ACF)- NIST 800-5314, MARS-E- Federal Information Security Management Act (FISMA)of2002- Health Insurance Portability and Accountability Act(HIPAA) of 1996- Health Information Technology for Economic and ClinicalHealth Act (HITECH) of 2009- Privacy Act of 1974- e-Government Act of 2002- Patient Protection and Affordable Care Act of 2010,Section 1 56 1 Recommendations- Vermont Statute 9 V.S.A. S 2440. Social .security numberprotection

R1.01

:l9)- Vermont Statute 9 V.S.A. 2435. Notice of

Sr.lrn or VrnuoNt, CoNtrucr FoR PERSoNAL SnnvrcnsDnpLnrurNT oF VsRMoNr Hr.ql,rn AccnssEQHnnr,rn SolurroNso INc.

Plcr 193 or 268

CoNrnacr #28739AvrnNnvrnNr # 2

breaches(https : //le eislature. vermont. gov/statutes/s ection/09/06210243

5)

T3.2 The Contractor will provide all their corresponding NIST800-53 procedures and policies to the State security officer

Rl.01

T3.3 The Contractor's System will be in compliance with allapplicable State and Federal laws and regulations, including42 CFR Part2 and Health lnsurance Privacy and

Accountability Act (HIPAA) including privacy and member

consent for release requirements (As per CR014 to be

excluded from Rl.01)

Rl FINAL

T3.3-1 The contractor's System will be in compliance with allapplicable State and Federal laws and regulations, including42 CFR part2 and Health Insurance Privacy and

Accountability Act (HIPAA) (HIPAA language only forMVP)

Rl.01

T3.5 The Contractor's System will accommodate diversepopulations of Users including those with visual and hearing

impairments, persons with low and moderate educationallevels, and the elderly

R3

T3.6 The Contractor's System will conform with the sub-parts ofSection 508 of the Rehabilitation Act of 1973, and any other

appropriate State or Federal disability legislation

R3

T3.7 The Contractor's System will conform and support the

Medicaid Information Technolo gy Architecture (MITA)v3.0 or later, and be compliant with CMS Seven Standards

and Conditions

RI.01

T3.8 The Contractor's System will comply with all applicable

State security policies and adhere to all legal, statutory, and

regulatory requirements, as determined by Vermontleadership

Rl.01

T3.9 The Contractor's System will implement security controls inaccordance with all Federal and State security policy and

regulations

Rl.01

Srlrr or VnnvroNr, CoNrrucr FoR PnRsoN.tr, SrnvrcnsDnp.q.RrvrnNT oF VnnuoNr Hnnr,rn AccnssEQHnurn Sor,urrons, Inc.

Pacr 194o1268CoNrRAcr #28739

AvrnNnvrnur # 2

T3.10 The Contractor's System will comply with accessibilityrequirements described in 45 CFR 85 and with State ofVermont accessibility requirements located athttp ://www.vermont. gov/portal/policies/accessibility.phpand included in the set of policies and standards recentlycreated for the Vermont Health Connect systems - in theprocurement library - an equivalent set of policies andstandards for the new Medicaid Operations systemsincluding Care Management and MMIS will be created inthe near future.

R3

sT3.11 The Contractor's System will adhere to the accessibilitystandard as outlined in the web guidelines and based on theW3C level 2 accessibility guidelines:(http://www.w3 .org/TR/WCAG 1 0/tull-checklist.html).

R3

T3.12 The Contractor's System will comply with Vermontstandards as defined by the state

T3.13 The Contractor's System will meet:- NIST 800-53 rev4 Moderate baseline- IRS pub 1075, which points back to NIST 800-53 rev 3- CMS requirements, which points back to NIST 800-53rev3 moderate baseline- Guidance from CMS including MITA Framework 2.0 andHarmonized Security and Privacy Framework

R1.01

T3.t4 The Contractor will adhere to the principle of "Fail Safe" toensure that a system in a failed state does not reveal anysensitive information or leave any access controls open forattacks

Rl.01

T3.15 The Contractor's System will allow for controlled access toparticipant records. Users will be able to view participantdata within The Contractor's System at the State-definedlevels of access based on User security privileees.

Rl.01

T3.16 The Contractor's System will maintain a level of securitythat is commensurate with the risk and magnitude of theharm that could result from the loss, misuse, disclosure, ormodifi cation of information

R1.01

T3.17 Information security will be built into The Contractor'sSystem from its inception rather than "bolted on" after theContractor's System has been implemented

R1.01

T3.18 The Contractor's System will support security at the objectlevel (e.g. View, Index)

Rl.01

T3.19 The Contractor's System will support security at the rowand column level

Rl.01

T3.20 The Contractor's System will support auditing at the objectlevel (i.e. Table, Column)

Rl.0l

T3.2r The Contractor's System will provide the ability forconcurrent Users to simultaneously view the same record.

Rl.01

Srarn or VnnuoNto Contu.cr FoR PnRsolcA,r, SnnvrcnsDnpl,RrvrnNT oF' VnnivroNr Hnl.LrH AccnssEQHn,r,r,rn Sor,urroNs, INc.

Plcn 195 or 268CoNrru,cr #28739

AvrpNovtrNr # 2

documentation and/or templ ate

T3.22 The Contractor's System will provide protection to maintainthe integrity of data during concurrent access

Rl.01

T3.23 The software used to install and update The Contractor'sSystem, independent of the mode or method of conveyance,

will be certified free of malevolent soflware ('omalware").

Contractor may self-certifu compliance with this standard

through procedures that make use of commercial malware

scanning software.

Rl.01

T3.24 The Contractor's System will be configurable to prevent

comrption or loss of data akeady accepted into theContractor's System in the event of a System failure (e.g.

inteerating with a UPS, etc.)

Rl.0l

T3.25 The Contractor's System will support protection ofconfidentiality of all Protected Health Information (PHI)delivered over the Internet or other known open networks

via encryption using Advanced Encryption Standard (AES)and an open protocol such as TransportLayet Security(TLS), Secure Sockets Layer (SSL), Internet ProtocolS ecurity (IPsec), XML encryptions, or S ecure/MultipurposeInternet Mail Extensions(S/MlME) or their successors. ThisSvstem will be subiect to external Audit checks.

Rl.01

T3.26 The Contractor's System, when storing PHI on any deviceintended to be portable/removable (e.g. smartphones,portable computers, portable storage devices), will support

use of a standards based encrypted format using AES ortheir successors

R2

T3.27 The Contractor's System, prior to access to any PHI, willdisplay a State-approved configurable warning or loginbanner (e.g. "The Contractor's System should only be

accessed by authorized Users"). In the event that a System

does not support preJogin capabilities, the Contractor'sSystem will display the banner immediately followingauthorization.

Rl.01

T3.28 The Contractor will review and analyze the key risks to the

important assets and functions provided by The Contractor'sSystem to certify that the CWE/SANS Top 25 MostD angerous S oft ware Errors (http ://cwe.mitre. org/t op25)have been mitigated and document the mi

Rl.01

T3.29 The Contractor will review The Contractor's System and

certify that the code and any new development meets orexceeds the OWASP Application Development Security

Standards outlined on the www.OWASP.org site (currentlyhttps://www.owasp.o rgl images/ 4/4e/OWASP-ASVS 2009-Web_App_Std-Release.pdf ) and document in writing that

they have been met.

Rl.01

Stlrn or Vrnvroivt, CoNrnlcr FoR Pnnsoulr, SnnvrcnsDnplnrunNT oF VnnvroNr Hnar,rn AccnssEQHnllrH Sor,urroNs, INc.

PAGE 196 or 268CoNrnncr # 28739

AvrnNnunnr # 2

T3.30 The Contractor's System will support a form of Userauthentication

Rl.01

T3.31 The Contractor's System upon detection of inactivity of aninteractive session will prevent further viewing and access tothe Contractor's System by that session by terminating thesession, or by initiating a session lock that remains in effectuntil the User reestablishes access using appropriateidentifi cation and authentication procedures. The inactivitytimeout will be confizurable.

Rl.01

T3.32 The Contractor's System will enforce a limit of(configurable) consecutive invalid access attempts by aUser. The Contractor's System will protect against further,possibly malicious, User authentication attempts using anappropriate mechanism (e.g. locks the account/node untilreleased by an administrator, locks the account/node for aconfigurable time period, or delays the next login promptaccording to a configurable delay aleorithm).

R1.01

T3.33 The Contractor's System will provide the capability toprevent database administrators from seeing the data indatabases theymaintain (Rl.01)

Rl FINAL

T3.34 The Contractor's System will support grouping Users byRoles, functional departments or other organization tosimplify securi ty maintenance

Rl.01

T3.35 The Contractor's System will provide the ability to maintaina directory of all personnel who currently use or access theContractor' s System/IVR/SQL database

R1.01

T3.36 The Contractor's System will provide the ability to createand maintain a directory of external providers to facilitatecommunication and information exchange

T3.31 The Contractor's System will provide the ability to identif,certain information as confidential (e.g. PII, PHI, etc.) andonly make that accessible by appropriately authorized Users

Rl.01

T3.38 The Contractor's System will restrict access to summarizedinformation according to organizatiorral policy, scope ofpractice, and iurisdictional law

Rl.01

T3.39 The Contractor's System must be able topermissions with a User using one or more of the followingaccess controls: 1) Role-Based Access Controls (RBAC;Users are grouped by role and access rights assigned to thesegroups) 2) context-based (role-based with additional accessrights assigned or restricted based on the context ofthe

such as time-of-day, workstation-location,

associate

transaction

Rl.01

l [i qo 0 ri ij iii\], il t r i/ j l 1.,\r ir({i.tiif; i$l1 i;zl ilirr r rt t lt ir r'r t(i

Number RequirementDescription Planned Release

Sr.trn or Vnnvront, Contru,cr FoR PrnsoNar, SnnvrcnsDnpa,nrwrnNT oF VBnvroNr Hnar,ru AccBssEQHn.Llrn Solurrolts, lNc.

Pacn 197 or268CoNrru.cr #28739

AvrnNnunNr # 2

emergency-mode, etc.)

T3.40 The Contractor's System will provide the ability to prevent

specified User(s) or groups from accessing confidentialinformation such as a beneficiary's SSN, medicationinformation and other confidential data

Rl.01

T3,41 The Contractor's System will provide the ability to limitaccess to certain confidential information such as a

beneficiary's SSN and other confidential data to providers

directly involved in service of the patient, or providers

involved in review of the service

R1.01

T3.44

specified tasks

The Contractor's System will enforce the most restrictive set

of rights/privileges or accesses needed by Users/groups orprocesses acting on behalf of Users, for the performance of

Rl.01

T3.45

to Users or Soups

The Contractor's System will provide the ability forauthorized administrators to assign restrictions or privileges

Rl.01

T3.46

System to ensure history of User's identity and actions

The Contractor's System will support removal of a User'sprivileges without deleting the User from the Contractor's

Rl.01

T3.47 The Contractor's System will be able to support RBAC incompliance with the HL7 Permissions Catalog

RI FINAL

T3.48 The Contractor's System will be capable of operating withinan RBAC infrastructure conforming to ANSI INCITS 359-

2004, American National Standard for InformationTechnology - Role Based Access Control

Rl.01

T3.49 The Contractor's System will provide more-advancedsession management abilities such as prevention of duplicatelogins, remote logout and session timeouts

T3.49-l The Contractor's System will provide more-advancedsession management abilities such as prevention of duplicateloeins

R1 FINAL

T3.50 The Contractor's System will provide the ability to performSystem administration functions such as reference table

maintenance and adding / removing Users from the

Contractor's System

Rl.01

T3.51 The Contractor's System will allow Users access based on

their roles irrespective of their geographical locationRl FINAL

T3.53 The Contractor's System will provide the capability tocreate temporary and emergency accounts and terminate

those accounts automatically after aUser defined period oftime

Sr.q.rn or Vnnvronr, CoNtnacr F'oR Pnnson,rr, SnnvlcnsDnpmrunNT oF VnnvroNr Hnllrn AccpssEQHnar,rn Sor,urroNs, Inc.


AvrnNrvlnNr # 2

T3.54 The Contractor's System will provide the capability tooverride a role and restrict access to information by Users orgroups of Users

Rl.01

T3.55 The Contractor's System will provide the capability tomonitor events on the information system, detect attacks,and provide identification of unauthorized use of theContractor's System

Rl.01

T3.56 The Contractor's System will provide the capability toidentify and report on inappropriate access to information inthe Contractor's System, based on User defined criteria

Rl.01

T3.57 The Contractor's System will enforce minimum passwordrequirements compliant with State-provided securitypolicies

Rl.01

T3.58 The Contractor's System will allow User to change his orher password at any time

RI.01

T3.59 The Contractor's System will have mandatory securityquestions for the User to answer for Username and passwordvalidation in case of any User requested changes

Rl.01

T3.60 The Contractor's System will allow for online automatedpassword reset

Rl.01

T3.61 The Contractor will monitor, alert, and protect against webappli cation attacks o f internet-facing applications.Solutionlhosting provider will install, configure, andmanage a web application firewall on Vermont's internet-facing Solutionlhosting provider ePHI Environments. Alertsandlor reports will be provided to Security officers atspecified intervals

R1.01

T3.62 The Contractor will conduct and provide a risk assessmentbased upon NIST 800 - 30 guidance and methodology

Rl.01

T3.63 The Contractor will conduct quarterly scans of Vermont'sexternally accessible web services in the ProductionEnvironment, and provide reports on the scans to VTInformation Security officer / representative, including theseverity of the vulnerabilities and remediationrecommendations.

RI.01

T3.64 The Contractor will provide third-party conductedpenetration tests on production releases of the externallyaccessible web application as requested by the changecontrol board entity. The reports shall be provided to thesecurity officer upon request.

Rl.01

T3.65 The Contractor will not transmit or store any PersonallyIdentifiable Information (PIf using publicly availablestorage over the Internet or any wireless communicationdevice, unless: 1) the PII is "de-identified" in accordancewith 45 C.F.R $ 164.514(b) (2); or 2) encrypted inaccordance with applicable law, including the American

Rl.01

Srnrn or VnnvroNt, CoNlnncr FoR PrnsoNar, SnnvrcnsDnpanrunNT oF VnnvroNr Hn.c.LrH AccnssEQHnar,rn Sor,urrolvs, INc.

PAGE 199 or 268CoNrna,cr # 28739

AvrnNrvrnNr # 2

Recovery and Reinvestment Act of 2009 and as required bypolicies and procedures established by VT InformationSecurity Officer.

Rl.01T3.66 The Contractor will perform Security Impact Assessmentsprior to releasing solutions into productton

Rl FINALT3.67 The Contractor's System will include the same securityprovisions for the development, system test, acceptance test

and training environment as those used in the productionenvironment (Rl.01) (

R1.01T3.68 The Contractor will complete and supply to VT InformationSecurity Officer all CMS Security required documentationto include but not limited to System Security Plan (SSP),

Risk Assessment (RA), Contingency Plan (CP)Rl.01T3.69 The Contractor must pass the Privacy/security and FTI data

handling training provided by the State. FTI training is

required regardless of the presence ofabsence ofFTI dataRl.01T3.70 The Contractor will ensure that all servers have hardened

operating systems by eliminating any unnecessary system

services, accounts, network services, and limited User

access riehts throughout all of the environmentsRI.01The Contractor will review and monitor logs for forensic

purposes and security Incidents, and any anomalousactivities are incorporated into the Incident managementprocess. In the event of a security incident, the Contractor

will be responsible for collecting and retaining evidencerelated to the incident. A detailed report must be provided tothe State Security Officer

T3.77

R1.01T3.12 The Contractor will ensure that high severity patches will be

applied within seven (7) calendar days; Medium severitypatches will be applied within fifteen (15) calendar days;

and all others within thirty (30) calendar days. The

Contractor will further ensure that required IT securitynotices and advisories are distributed to appropriatepersonnel

HSE Platform Alignment Requirements

uirements

Rl.011I1 The Contractor will employ, maintain, and execute a projectmanagement methodology that complies with the ProjectManagement Institute (PMI) standards or equivalent-

Rl.01.2I1 The Contractor will describe the project management



Sr.q,rn or VrnvroNt, Conrrucr FoR pnnsoNar, SrnvrcnsDnp,q.nrMnNT oF VnnuoNr llnar,rn AccnssEQHnn rn Sor,urroNso INc.


AvrnNonnnNr # 2

approach and methodology to be used for all System projectlife cycles.

I1.3 The Contractor will develop a Project Management Plan(PMP) conforming to the Project Management Body ofKnowledge (PMBOK). The PMP will incorporate thefollowing PMBOK knowledge areas: ( Project IntegrationManagement- Project Scope Management- Project Time Management - Project Cost Management-Project Quality Management- Project Human Resource Management - ProjectCommunications Management- Project Risk Management - Project ProcurementManagement

RI FINAL

It.4 The Contractor will develop a Project Charter. Rl FINALr1.5 The Contractor will develop a Project Governance Plan. The

pro.l ect governance plan will take into account and leveragethe existing AHS governance structure. (Rl

Rl FINAL

I1.6 In collaboration with the State, the Contractor will develop aBusiness Process Change Management Plan. The Stateenvisions significant process change during the developmentand implementation of The Contractor's System. TheContractor will provide plans for a change readinessassessment, gap analysis, and recommendations fororganizational andprocess changes. The Change ControlBoard will be managed by the State.

Rl.01

n.7 The Contractor will document the business processmanagement activities and outcomes described in theBusiness Process Change Management Plan. Additionally,the Contractor will document Operational and SystemChanges in the Technical Change Management Plan.

Rl.01

Il.8 Where available and agreed between the Contractor and theState, the Contractor will use State templates for projectmanagement deliverables. State templates listed in EPMOtemplates from the link: http : //epmo.vermont. gdv/templates

Rl.01

I1.9 The Contractor will develop a PMI compliantCommunications Management Plan. The CommunicationsManagement Plan must describe participant's roles andresponsibilities, intemal communications, externalcommunications, other communications and informationmanagement including communications protocols.

Rl.01

SrarB or VnnuoNt, CoNtnacr FoR PnnsoNnr, SnnvtcnsDBp.qnrvrBNT oF VnnvroNr Helr,ru AccpssEQHn,lr,rn SolurroNso INc.

P.tcn 201 or 268CoNrru,cr #28739

AunNounNr # 2

I1.10 The Contractor will leverage DII EPMO Project Logtemplate as applicable to establish an issues and action items

process and tracking document that must ensure that

unanticipated issues, action items and tasks are assigned to aspecific person for action and are tracked to resolution.

DII EPMO Project Log Template canbe found inhttp ://epmo.vermont. gov/templates/proj ectlhase

The issue and action item tracking document must includethe following:- Issue description - Issue priority - Issue status - Plan forresolution - Individual responsible for resolution - Targeted

resolution date - Actual resolution dates - Resolution action.

Rl.01

I1 11 The Contractor must electronically provide projectmanagement documents (e.g., Project Management Plan,

Project Schedule, Work Breakdown Structure, etc.) using

Microsoft software products and/or pdf. The software

version must be no less than a version still available on the

common market and that is still supported by the

manufacturer. The State will work with the Contractor inapproving specific versions to assure that the application issynchronized with the State's plans.

Rl.01

n.t2 The Contractor will advise the State and Contractormanagement of progress in meeting goals and schedules

contained in the work plans as well as any risks and issues

during weekly progress meetings attended by the Contractor

and the State. These may include walkthroughs of selected

deliverables as requested by State staff.

Rl.01

r1.13 The Contractor will develop weekly progress reports.

Weekly written progress reports will be provided by the

Contractor to the State one working day before each weeklymeeting, and containing items to be discussed at the

meeting, including:- Progress ofeach task/activity.- Action items and decisions from the previous meeting.

- Problems encountered, proposed resolutions, and projected

completion dates for problem resolution.- Planned activities for the next two reporting periods.

- Status of contractually defined deliverables, milestones,

and walkthroughs scheduled in the project schedule.

- Updating of information on a weekly basis in the State

project and portfolio management tool.- Other information as needed (per Contractor or the State).

Frequency of periodic reports can be adjusted during the

course ofproject as by the State and Contractor.

Rl.01

Sr.Lrn or VrniuoNr, Coivtnacr FoR pERsoNAL SnnvtcnsDnpmrvrnNT oF' VnnvroNr Hnar,rn AccnssEQHnu,rn Sor,urrons, INc.

Pacn 202or268CoNrnrcr # 28739

AvrnNnunNr # 2

n.t4 The Contractor will develop monthly progress reports. Theprogress report will include deliverables, milestones,walkthroughs, the State approvals, and lessons learned andwill be used by the Contractor and the State in measuringthe Contractor's progress and performance. The report willalso contain:- Issues, problems, and corrective actions, steps, andassignments.- Risks and mitigations.- Total budget and cost variance reporting- Lessons learned- Percentage complete- Resources and time required to completion

Rl.01

I1.15 If the Contractor must substitute key staff during the project,the Contractor will submit to the State, in writing, the reasonfor the change and provide a completed staff experiencereference form and resume for the substitute personnel. TheState will either approve or reject the substitution.

Rl.01

I1.16 The Contractor will provide contract close-out plans andmanage project close-out activities in accordance with theplan.

Rl.01

17.t7 As part of the proposal, the Contractor will describe thestaffing approach and methodology used for the project,which will include:- Estimated number of Contractor's resources needed pereach phase ofthe project.- The number of staff resources within the followingcategories: Management, Business, and Technical.- The number of staff resource onsite vs. remote per thephase ofthe project- A description of the methodology used for releasing andadding staff to the project and managing staff PTOs- Outsourcing staff if applicable- Types and number of resources that State needs to provideper the phase ofthe project and expected hours from thoseresources

a proiect organization chart.

Rl.01

I1.18 The Contractor will describe issue escalation process tosettle matters of dispute as it relates to roles, responsibilities,or unmatchable level of service (i.e. what is their escalationchain) and this will be aligned with the State's escalationplan.

Rl.01

I1.19 The Contractor will describe their approach to remediate andrealign the project and project plan in the event that theContractor or the State decides that any aspect necessitatesimmediate attention and/ or State/Contractor management

Rl.01

Surn or VnnuoNto Contru.cr FoR Prnson.q'r, SnnvrcnsDnpnnnvrnNT oF VnniuoNr Hn.qlrn AccnssEQHnu,rn Sor,urIoNs, hvc.


AvrnnnvrcNr # 2

interventron.

Rl.01.20I1 The Contractor will provide a minimum of one full timeassisred PMI Certified proiect manager.

Rl.01The Contractor will describe their approach regarding the

project documentation repository. The Contractor is

recommended to align with the State's document repository.

In case the Contractor cannot, they must providejustification as to why their proposed repository works wellin the best interests of the State

n.2l

Environment Installation and

Rl.0112.l The Contractor will submit to the State as part of theirproposal, specifications for all necessary hardware, software

and tools for the seven (7) environments listed here. The

Contractor can propose to combine certain environments,

where appropriate. The seven (7) environments include:1. Production2. Disaster Recovery3. Staging (QA)4. Training5. UAT6. Test7. DevelopmentContractor will submit as a component of proposal

specifications for all software, hardware, and tools that

would be inclusive of a full SDLC, including environment

to support the following needs: Prod, QA, Staging,

Development, Test, Training, Disas er RecoveryRl.01t2.2 The Contractor will develop a technical infrastructure

document which describes all of the hardware, system

software and tools necessary for each of the environmentsproposed

Rl.0112.3 The Contractor will develop an environment configurationmanual that describes the environment installation and

for each of the environmentsconfi guration necessaryRl.0112.4 The Contractor is responsible for installing and configuring

all hardware, software and tools purchased under the

contract until System acceptance for the proposed

environmentsRl.01The Contractor is responsible for maintaining all hardware,

software and tools purchased under the contract until System

acceptance for all proposed environments

12.5


Srarr on VnnvroNr, Contnacr FoR pnnsoN.q,L SnnvrcnsDnpLnrvrnNT oF VnnvroNr Ilrlr,ru AccnssEQHn.urn SolurroNs, INC.

PAGE 204or268CoNrrucr # 28739

AunNovrnNr#2

12.6 The Contractor will provide the State with well documentedreadable source code and object (executable) code,documentation for all functionality developed by theContractor outside of COTS configuration, licenses toreadable source code and object (executable) code, anddocumentation for all COTS functionality and escrow ofsource code for the custom developed or integration relatedcode. All new software functionality built on top of COTSsoftware will be owned by the State.

Rl.01

t2.7 The Contractor will provide a data dictionary, data models,data flow models, process models and other related planningand design documents to the State (Rl.01)

Rl.01

The Contractor will provide an exit plan and strategy in theContractor' s S ystem Implementation Pl an deliverabl eaddressing portability of solution in case the State wants to

12.8

Knowthe solution back in-house 1.01

Transfer &

R1.0r

13.1 The Contractor will develop (in cooperation with the State)and execute a Knowledge Transfer and Training Plan thatdescribes roles and responsibilities of the State andContractor and the approach for bringing managers, endUsers, and technical personnel to an appropriate level of

with the Contractor's System

Rl.01

13.2 The Knowledge Transfer and Training Plan will address anddescribe, at a minimum- Training goals/standards and the specific plan for trainingtechnical personnel and end Users.- Size of population and types of roles that need training- Strategy for providing training early in the project to allowthe training goals to be implemented throughout the projectlife Phase.- Tasks, deliverables and resources necessary to completethe training effort and identifii tools and documentation thatwill be necessary to support proposed effort.- Types of training, the specific courses and coursematerials, the training approach for both technical personneland end LJsers, and how training effectiveness will bemeasured and addressed.- Deliverables to support initial and ongoing trainingincluding User manuals, System manuals, and on-line helpand training materials for technical/non-tebhnical personnel.- Knowledge Transfer to enable the State personnel tooperate, maintain, configure and modify The Contractor's

Rl.01


Sr.lrn or VnnuoNt, CoNtnacr FoR PnnsoNal SnnvrcnsDnpaRrmnNT oF VnruroNr Hnl.LrH AccpssEQHr,lr,rn Sor,uttoNs, Iltc.

PacB 205 or 268

CoNrru,cr # 28739AvroNuunNr # 2

System including operation of the testing tools, supporting

infrastructure, and security as agleed between the State and

Contractor. '

- Metrics for tracking progress in achieving training and

knowledge transfer obj ectives.- Reporting progress of training and knowledge transfer

activities.- Additional training for technical staff on development,

reporting and maintenance including processes and tools as

needed

13.3 The Contractor will provide train-the-trainer and end User

training documentation (including User manuals, onlinecontent, reference cards, etc.)

Rl.01

13.4 The Contractor will provide the State a training course

outline for review and acceptance at least thirty (30)

calendar days prior to the beginning of scheduled training

Rl.01

13.5- 1 The Contractor will submit all training packages to the State

for review and acceptance at least seven (7) calendar daysprior to the beginning of scheduled training

13.6 The Contractor will provide (customized as required)

training manuals for all classroom training they provrclg (Rl FINAL

t3.7 The Contractor will provide all training materials developed

for The Contractor's System to the State. Those materials

will become the property of the State and may be modifiedand duplicated by the State

R1.01

13.8 The Contractor will provide electronic copies of all trainingmaterials (end-User, technical, trainee and instructor) in aformat that can be easily accessed, updated and printed byState staff using software for which the State owns licenses,

prior to deployment onto the staging platform. This includes

but not limited to CDs/DVDs, and online.

Rl.01

13.9 The Contractor will provide updated training documentation

for all departments and agencies using the platform, as

necessary, to incorporate new processes or functionality due

to system releases, upgrades, or changes throughout the

contract term

Rl FINAL

13.10 The Contractor will schedule all training during regularwork hours as approved by the State, unless the Contractor

receives advance approval from the State for specifictraining at other times (Rl.01)

Rl.01

I3 11 The Contractor will provide all training within the State ofVermont at locations convenient to the attendees of the

training, unless the Contractor receives advance approval

Rl.01

Sr.q.rn or VnnuoNt, Conrnacr FoR PrnsoNar, SrnvrcnsDnplnrunNT oF' VnnvroNr Hn.tr,rn AccnssEQHnn rn Solurrons, INc.

Pncs 206 or 268CoNrru,cr # 2g:739

AurNovrnNr # 2

from the State for specific training at other locations

T3,T2 The Contractor will schedule staff training in a manner thatsruptive to the normal business operationsis least di

Rl.01

13.13 The Contractor will provide instructions to the State onContractor tools and procedures used to support the trainine

Rl.01

t3.r4 The Contractor will ensure that Contractor staff membersare not assigned to train State staff and work on critical path

tasks concurrently

Rl.01

13.1 5-1 Contractor will work with state in developing end-Usertraining on The Contractor's System business functionality

Rl.01

13.15-2 The State will assist the Contractor in developing end-Usertraining on The Contractor's System business functionality

Rl FINAL

13.16 The Contractor will provide both end-User classroomtraining/Train-the-trainer sessions and on-line, interactivetraining as agreed with the State for all end-Users

RI.01

13.t7 The Contractor will develop and perform train.the-trainertraining sessions, as appropriate

RI.01

13.18 The Contractor will identifu the number of staff necessaryfor maintenance and operations of the Contractor's Systemas well as the skill sets necessary, with the State's agreement

R3

13.19 The Contractor will develop and provide training for thetechnical support uding State staff and contractorsstaff incl

R2-R3

13.20 For the duration of the contract, the Contractor will continueto provide training to the technical staff if system upgradeshave been installed and there is a change in Systemcomponents

R2-R3

13.21 The Contractor will create a training approach and needsanalysis early in each project Phase which will determinethe training requirements. The State of Vermont hasinvested in the Oracle User Productivity Kit (UPK) and hasa strong preference to use this investment to provide trainingto end Users.

Rl.01

Solution Deslgno Development & Requirements

I4 1 The State utilizes a structured Software Development LifePhase (SDLC) that is consistent with industry-standard bestpractices as well as State requirements for InformationTechnology projects. The Contractor must use a structuredSDLC process, including an iterative software developmentmethodology and incremental deployment of functionality tothe production environment. This includes software anddatabase design, Solution configuration management planand procedures, and User interface standards.

Rl.01


Srlrn or VnnvroNto CoNtru,cr F'oR PnRsoNar, SnnvrcnsDnp^q.RtrvInNT or Vnnvroxr Hrantn AccnssEQHnllrn Sor,uuoNs, INc.

Pacn 207 o8268Cournacr #28739

AvrnNnivrnNr # 2

14.2 The Contractor will develop an System SoftwareLife e Plan

Rl.01

14.3

their

The Contractor must submit a narrative describing the

design and development approach and methodology withRl.01

14.4 All change request cost estimates must include the use of acost analysis tool

Rl.01

14.5 The Contractor will incorporate the design and development

approach into a comprehensive Design and DevelopmentPlan

Rl.01

14.6 The Contractor will apply consistent development standards

for all development works as described in offertory's SDLCsuch as coding convention, database and field namingconvention

R1.01

14.7 The Contractor will provide the State access to bothsource/object codes for software components and

documentation

Rl.01

14.8 The Contractor will acquire authorization from the State forthe use of production System resources (legacy data orsource files), or data derived from the State's productionresources

RI.01

14.9 The Contractor will describe the overall testing approach

and methodology used for The Contractor's System

deployment. The Contractor will work with the State's

Business Units in fine tuning the testing approach and get

the State's approval before starting the t@

Rl.01

14.10 The Contractor will incorporate the testing approach into acomprehensive Test Plan. The Test Plan will include theprocedures for documenting the completion of each test

phase, test scripts, test conditions, test cases, and test

reports. Detailed test plans will be created for the followingtesting areas:- Integration Testing- Security Testing- Performance Testing- User Acceptance Testing- Operations Acceptance TestingAll Integrated System Testing will be performed on the

Enterprise Testing platform while the UAT will be

performed on the Staging platform. No testing may be

conducted on the production platform and all testing must be

to

R1.01

14.ll The Test Plan must, at a minimum, include the followingareas:- Test philosophy (including objectives, required levels ortypes of testing, and basic strategy (develqpqg'Igqll4g and

-

Rl.01

Surr or VnnvroNro Conrrucr FoR PnnsoNar. SnnvrcnsDrpmtnanNT oF VnnnroNr Hn.ql,rn AccnssEQHna,r,rn Sor,urtoNso Iwc.

Pacr 208 or 268CoNrntcr # 28739

AvrnNpnnnNr # 2

release of major subsystems/components).- Procedures and approach to ensure the testing will satisf,ispecific objectives and demonstrate that the requirementsare met.- Procedures and approach to ensure that each phase ofthetesting is complete, and how formal reports/debriefings willbe conducted for each phase oftesting.- Approach to define tested workload types (perforrnancetesting) and test data- Overview of testing facilities, environment and specifictesting tools to be used.- Overview of processes and procedures that will be used bythe Contractor for releasing testing results and review of testresults.- Process and procedures for tracking and reporting forresults/variances/defects will be tracked and reported.- State resources required for testing during the developmentlife cycle for each testing area.- Method for review of test cases and procedures- Configuration management of the test environment- Describe User Acceptance Testing and User Sign-Off- Plan and deliverables for each testingareadescribed above- Contractor is responsible for providing detailedinstructions in modifying any desktop configuration settingsprior to the commencement of System testing.

14.12 The Test Plan will provide a detailed description of each testrequired to ensure that all of The Contractor's Systemcomponents, interfaces, and components comply with therequirements and specifi cations

Rl.01

14.T3 Testing and Development will have their own environments,separate from Production. Testing or development will notbe performed in the production environment.

Rl.01

t4.t4 The Contractor will repeat the test life cycle when a failureoccurs at any stage of testing (e.g., a failure in AcceptanceTesting that necessitates a code change will require thecomponent to go back through Unit Testing, IntegrationTesting, and so forth)

Rl.01

14.T5 The Contractor will be responsible for building test plans,executing test plans, and creating reports. The State willevaluate the Contractor test plans, and Contractor testresults, and may validate the testing done by augmenting itwith State testing.

Rl.01

14.t6 The Contractor will document the testing tools, testconfigurations and related documentation. The Contractorwill provide all necessary performance testing scripts withinput from the State's Business Units. The State will have

Rl.01

Sr,trr or VBnuoNt, CoNtrucr FoR PnnsoN,ql. SnnvrcnsDnpanrnnrNT oF VERMoNT Hnar,rn AccnssEQHnar,rn Sor,urtoNs, INc.

PrcB 209 ot268CoNrru,cr # 28739

AvrpNrunnr # 2

the final say on what is an acceptable performance.

14.17 The Contractor will provide the State with the test scripts,

test results and quality reportsRl.01

14.18 The Contractor will provide staff to the State to answerquestions and address any problems that may arise duringtestins conducted by the State

R1.01

14.19 The Contractor will refine the test documents, procedures,

and scripts throughout development and through full System

acceptance to reflect the as-built design and current

requirements

Rl.01

14.20 The Contractor will allow the State to run validation and

testing software against externally facing Internetapplications to help identify potential security issues, and

must agree to repair any deficiencies found during thistestins

Rl.01

t4.2r As System events contain date and time-sensitive elements,

the testing infrastructure must provide a method of alteringand synchronizing the Contractor's System date throughouteach test phase. This requires the ability to change the

Contractor's System date and time in some scenarios

Rl.01

14.22 The Contractor must develop a comprehensive DefectResolution Management Plan that describes the approach to

be taken in managing all problems discovered during any

testing phase and in production

Rl.01

14.23 The Contractor will install and test a single DefectResolution Tracking System that the Contractor and the

State will use collaboratively for the tracking of System

defects. security, and System issues

R1.01

14.24 The Defect Resolution Tracking System must, at a

minimum, include:- A11 defects in The Contractor's System identified duringany testing phase must be recorded, prioritized, tracked, and

resolved in a timely manner. Each must be assigned a

"Defect Level" based on the following definitions:1. Critical - Results in a complete System outage and/or is

detrimental to the majority of the development and/or testing

efforts. There is no workaround.2. Serious - System functionality is degraded with severe

adverse impact to the User and there is not an effectiveworkaround.

3. Moderate - System functionality is degraded with a

moderate adverse impact to the User but there is an effectiveworkaround.

4. Minor - No immediate adverse impact to the User.

Rl.01

Sr.q.ru or Vnru,roNt, CoNrucr roR PnnsoNnr, SrnvrcnsDnpanrunNT oF Vnnuolqr HEALTH AccnssEQHnnlrn Sor,urroNs, INc.

Pacn 210 or 268CoNrrucr # 28739

AvrnNovrpxr # 2

- The Contractor will allow the State full access to theDefect Resolution Tracking System.- The Defect Resolution Tracking System will be designedin a manner to allow for the transfer of ownership to theState following contract completion.- The processes and management of the Defect ResolutionTracking System will be addressed as part of the Quality

T#2"ff#"jjli",u address defect as such: critical andserious defects will require remediation and retesting beforeThe Contractor's System enters production. Moderate andMinor defects will be fixed and tested to the State'satisfaction prior to System acceptance.

14.2s All components of the Contractor's System willaccommodate leap year processing and daylight savingstime start/end dates

Rl.01

14.26 The Contractor will compare and contrast the design ofSystem components to CMS architectural standard. TheContractor will apply a documented and structuredArchitecture Development Methodology (ADM) for thedesign of System components. The Contractor will provideall necessary performance testing scripts with input from theState's Business Units. The State will have the final say onwhat is an acceptable performance.

Rl.01

Deployment Requirements

15.1 The Contractor will describe the implementation approachgy to be used for the Contractor's Systemand methodolo

RI.01

15.2 The Contractor will incorporate the implementationapproach into a comprehensive Implementation Plan whichwill be added to other PM plans as part of the PMO. TheState requires incremental deliveries of functionality to theproduction environment. The State anticipates considerablecollaboration with the Contractor in the plan's construction,with particular attention to high complexity components ofthe existing the State systems as well as the proposedSystem.

Rl.01

15.3 The Implementation Plan must include information ontechnical challenges, deployment schedule phasing. TheImplementation Plan will :

- Deliver Systems that include a significant portion of thetechnical infrastructure early in the schedule, withoutcompromising the quality or inherent security of TheContractor's System. This should also validate the desipn

R1.01


S r,q.rn or VnnvroNto Coxtucr FoR Pnnsonar, SnnvrcnsDnpmrvruNT oF VrnvroNr Hp,qlrn AccnssEQHn,LLrn Sor,urroNs, INC.

Prcn 2llot268CoNrnacr #28739

AvrnNovrpNr # 2

and architecture.- Expose technically challenging areas of the project as soon

as possible.- Deliver customized functionality to the State inincremental pieces that are in logical business applicationsequence.

t5.4 The Contractor will develop aCapacity Plan to include, at

minimum, the following areas:

- System workload assumptions- A description of how System capacity and capacity

requirements were calculated, including all formulas and

calculations used in capacity planning for the State.

- A description of how System capacity requirements will be

met.- How capacily issues will be managed for all components

of the State project.- Descriptions of how capacity utilization will be monitoredand capacity thresholds will be established.- A description ofcorrective and escalation processes that

will be used in the event any capacity thresholds are

reached.

Rl.01

15.5 Disaster recovery requirements relative to the physical

System components and planning for recovery fromoperational failures are the responsibility of the Contractor.

The Contractor will develop an Operational Recovery Plan

that addresses the following:- Areas of the most susceptible to failure or disaster that

would result in downtime.- Recommendations for System recovery processes, or steps

to take in the event of a downtime event.- Recommendations for the State on how tocomprehensively and effectively mitigate the risk of adowntime event.- Recommendations for securing The Contractor's System

components during a period of emergency operation.- Testing Failover and DR while on Staging Platform after

testing has concluded and prior to deployment on

Production Platform.- DR requirements must include networking DR fotDatacenter access.

Rl.01

15.6 The Contractor will describe the interface management

approach and methodology used for The Contractor'sSystem Proiect

Rl.01

Srnrn or VrnvroNro Conrucr FoR PrRsoivLl, SnnvrcnsDRplntnmNT oF VrnvroNr lln.rr,ru AccnssEQHnllur Sor,urrONs, INc.

PAGE 212op268CoNrn-q.cr # 28739

AvrnNnnnnNr # 2

15.7 The Contractor will incorporate the interface managementapproach into a comprehensive Interface Management Planfor all interface mechanisms used for System (e.g. batch,ESB/web services). The Interface Management Plan will beused by the State to document the plan for integrating TheContractor's System with all systems internal and externalto the State. The Interface Management Plan will, at aminimum, document the following areas:- The approach to developing and managing internal andextemal System interfaces.- Technical tools that will be used for data transformation,transport and error recovery.- A description of how the Contractor's developmentstandards will be reconciled, to reflect use of ESB and webservices as wrappers to legacy systems. The Contractorshould produce example scenarios for integration reflectingtheir infrastructure components and toolset.- Tasks, deliverables and resources necessary to completeinterface development and implementation.- Description of how The Contractor's System developmentand test systems will work with the external interfaces.- References to applicable sections in the relevant designdocuments that describe how The Contractor's System willbe synchronized with the specific internal and externalinterfaces.- References to applicable sections in the detailed designthat describe the mappings between internal and externalSystem data and The Contractor's System data.- Descriptions of the process for managing changes to theinterfaces,both in the production and non-production environments- Interface(s) needed for maintaining data slmchronizationbetween aninterim production System and the final productionimplementation.- System interfaces, data format, frequency of updates andexpected data volume.- Process for interfacing and collaborating with interfacepartners, including roles, responsibilities, deliverables andtimelines.- How the State development and test systems will workwith the external non-production interfaces.- Interface tools

R1.01

15.8 The Contractor will validate that each interface is workingcorrectly. The Contractor will repair all interface-relatedproblems caused by Contractor -developed interfaces.

RI.01

Surn or VrnvroNt, CoNtrucr FoR PnnsoNar, SnnvrcnsDnp.lntunNT oF VnnuoNr Hralrn AccnssEQHnar,rn Sor,urroNs, INc.'

P.tcB 213 or 268CoNrru,cr #28739

AprnNovrnNr # 2

15.9 The Contractor will assist the State in identifying rootcauses for all System interface related blems

Rl.01

15.10 The Contractor will develop a Software ConfigurationManagement Plan

Rl.01

15.11 The Contractor will provide a software configurationmanagement System to store, control, and track instances

(baselines during the construction life cycle) of all softwareconfiguration items that will be developed for theContractor's System

Rl.01

15.t2 The Contractor must use a widely used "industry standard"

software confi zuration management toolRl.01

15.13 The Contractor will describe the requirements management

approach and methodology used for The Contractor'sSystem Proiect

Rl.01

T5,T4 The Contractor will incorporate the requirementsmanagement approach into a comprehensive RequirementsManagement Plan. The Requirements Management Plan

will be used by the project to assure that requirements are

met. The Requirements Management Plan will, at a

minimum, address the following areas:

- Establishment of a baseline for existing requirements.- Management of versions of requirements.- Establish and maintain the State's requirements traceabilitymatrix that willbe used for requirements management, and

will map where in the software a given req'uirement isimplemented.- A requirements change control process.

- A methodology for managing requirements in an iterativedevelopment life cycle.- Procurement, installation, and administration ofrequirements management tools.- A description of the relationship between the requirements

management role and the other roles (i.e. test management,

quality assurance management) on the project.- Publishing of standard reports related to requirementsmanagement.

R1.01

Srarr or VnnvroNT, CoNTRAcT FoR PnnsoNal SnnvrcnsDppantunNT oF VnnvroNt Hrnr,rn AccnssEQHnnr,rn Sor,urroNs, INc.

PAGE 214o1268CoNrn-q,cr # 28739

AvrnNnunNr # 2

15.15 When functionality is ready to be delivered to the State forUser Acceptance Testing (UAT), it will be delivered in theform ofa pre-production release (defined as ready forproduction in every respect but just not yet in production).Since the State will approve all releases into production, apre-production release is equivalent to a production releaseand requires the rigor associated with a production release.Upon successful completion of UAT, the State will schedulea release to be moved to the production environment.Each pre-production release will include the following:- Release-specific hardware and software Systemcomponents.- Release description including architecture or designupdates, new functionality introduced, defects fixed,modifications to interfaces with other systems, otherchanges to existing code, and any software and hardwareconfiguration changes.- Release contents including a description of the releasestructure and contents and instructions for assembling and/orconfiguring the components of the release.- Test Plan and test execution results.- Detailed hardware and software configuration informationincluding any software and hardware dependencies andinstructions at a level of detail that will enableadministration staff to rebuild and configure the hardwareenvironment without outside assistance.- Database documentation conforming to industry standards.- Uejtaited configuration information ior any 3rdiartyhardware and software.The Contractor will provide updated documentation whenSystem upgrades to software or equipment occurs throughthe life of the contract.

Rl.01

15.16 Deplo5rment will be iterative from both a business processand applied technology perspective and will be accepted bythe State through application of the acceptance criteria intesting plans

Rl.01

15.17 The Contractor will deliver to the State a requirementstraceability matrix for all delivered functionality, showinga-ll testing activities tracing to delivered functionality, and alldelivered functionality tracing to requirements in therequirements repo sitory

Rl.01

15.18 The Contractor will assist the State with testing and releasepreparation in the pre-production environment (Rl.01)

Rl.01

15.19 The Contractor must produce and execute anJmplementation Support Plan

Rl.01

Surn or VrnuoNt, CoNtn-a.cr FoR PnnsoNar, SrnvrcnsDnpaRrvrnNT oF VrnvroNr IInlLrH AccnssEQHnalrn Sor,urroNs, INc.

Pacn 215o1268CoNrnacr #28739

AnnnNounNr # 2

Rl.01t5.20 The Contractor must provide support staffing informationsuch as the proposed number, ratios, duration, and

roles/responsibilities for on-going support (as identified inpreviously submitted implementation approach aq41!4n)

RI.0115.21 The Contractor must assess the pre-implementationreadiness of each part of the organization and will document

the status in a pre-implementation readiness assessment. The

Contractor will conduct an implementation readiness reviewten days prior to cutover at each part of the organization.

Rl.0115.22 Upon successful completion of the pre-production testing,

the Contractor will, in coordination with the State, create a

Production Release Plan that will consist of an updated Pre-

Production Release notification to assist the State insuccessfully releasing and maintaining The Contractor'sSystem in the Production environment.It must include, but not be limited to, the followingcomponents:- Updated Configuration Information required satisfying The

Contractor' s System production confi guration managementrequirements.- Updated System Architecture.- Updated Detailed Design, including detailed system,

technical, and User documentation.- Deployment schedule- Blackout plan (complete/incremental)

Rl.01The Contractor will provide data conversion from legacy

systems to new System15.23

Quality Management Requirements

Rl.0116.1 The Contractor will describe the quality management

approach and methodology used for the Contractor's System

with input from the Business Units


Sr,q,rn or VnnvroNro CoNrnncr FoR PpnsoNu, SnRvrcnsDpplntvrnNT oF VrnuoNr Hn.ql,rn AccpssEQHnar,rn Sor,uuoNso INc.

P.lcn 216 or 268CoNrrucr # 28739

AurnnounNr # 2

6.2 The Contractor will develop a Quality Management Plan todescribe the approach they will use to ensure the quality ofThe Contractor's System and they work they perform. ThePlan will include at least the following items:. The State's management of the requirements. Thisincludes the identification of inconsistencies between therequirements, and the project's plans and work products.. The State's requirements traceability matrix that will beused for requirements management, and will map where inthe software a given requirement is implemented.. The State's configuration management activities thatinclude: baseline control, and monitoring the softwarelibrary. Approved changes to baseline software andlordocumentation should be made properly and consistently inall products, and no unauthorized changes are to be made.. The practices and procedures that will be followed forreporting, tracking, and resolving problems or issuesidentified in software development, System transition, andSystem maintenance.. The business process changes resulting from TheContractor's System.. A change readiness assessment of the State's organization.This may include a gap analysis and recommendations fororganization change required to support The Contractor'sSystem.. The quality of work products developed and delivered byContractor'ssub-Contractors/partners, if applicable.. A metrics process that describes how measurements willbe identified, collected, and analyzed to ensure that qualitygoals, including management and The Contractor's Systemgoals, are being met. It should also describe the types ofproject metrics used.. The Contractor's otganizational structure, and the rolesand responsibilities of Contractor staff as they relate toquality management.. Description of the processes and management of theDefect and Issue Tracking System for resolution of itemsand, if applicable, how corrective action plans will bedeveloped to address more significant issues.

Rl.01

Production Support and Transition uirements

o 1.1 The Contractor will describe the production support andapproach and methodology for the Contractor'stransition

R1.01


Surn or VnnuoNt, Colvtru.cr FoR PrnsoNar, SnnvrcrsDnp.q,RtN{nNT oF VnnuoNr Hnar,rn AccrssEQHn,urn Sor,urroxs, Ii,lc.

Prcn 217 o1268CoNrnacr #28739

AvrnNlvrnNr # 2

System as agreed between the Contractor and the State

ot.2 The Contractor will incorporate the production support and

transition approach and readiness assessment into acomprehensive Production Support and Transition Plan

complying with the System architectural design, that willdescribe how the Contractor intends to support the System

and transition that support over to the entity responsible foron-soing production operations and support

Rl.01

o1.3 The Contractor will provide the State with regularly updated

list of personnel, contact information, and their area ofexpertise of who will be performing System productionsupport. Frequency of update will be agreed between the

Contractor and the State.

R1.01

ol.4 The Contractor will identify the root cause of comrpted data,

identify System for fix and repair comrpted data that is

associated with a problem in the System

RI.01

o1.5 With concurrence from the State, the routine planned

maintenance activities will be scheduled without disruptingthe negotiated operational hours. Contractor will providethe State with a copy of the schedule at least 30 days inadvance of the scheduled maintenance date for approval.

Rl.01

01.6 The testing tools and test configurations will be provided tothe State and responsible entities and appropriate training tothe State personnel will be provided as the System are

transitioned into support

R1.01

ot.7 The Contractor will provide instructions and training forresponsible entity support staff that may need to access and

support the System remotely (e.g. through PDAs, tablet PC's

throueh a VPN)

R1.01

o1.8 The Contractor will develop an automated process forpurging production System files ad determined but the State

data governance

Rl.01

o1.9 Upon completion of any maintenance call, the Contractorwill furnish a maintenance activity report to the State within24 hours and provide any clarification to the questions as

needed, which will include, at minimum, the following:- Date and time notified.- Date and time of arrival.- If hardware, type and serial number(s) of machine(s).- If software, the module or component name of the affected

software code.- Time spent for repair.- List of parts replaced andlor actions taken.

- Description of malfunction or defect.

- Description of root cause of malfunction or defects

RI.01

Sr.q.rn or Vnnvrott, CoNrnncr FoR pnnsoNlr, SnnvrcnsDnpanrvrnNT oF VnRvroNr Hn,lr,rn AccnssEQHnnr,rn SolurroNs, Inc.

Plcr 218 or 268CoNrnacr #28739

AunrovrnNr # 2

- Description of fixes

o1.10 The Contractor will produce documentation, which willserve as a user's instruction manual for administrative rolesof the application. It will include instructions on how tomanage the Contractor's System on a daily basis,descriptions of administrative user tasks, and what to do inabnormal situations.

R3

01.11 The Contractor's System component documentation willinclude at a minimum: (- A Data Dictionary- Data Model(s)- Interface design specifications- Passwords & activation codes- A Developer's Manual outlining and detailing operating,maintenance, development, processes, standards,procedures, plus any other technical information required tofully support the application.- Operations Phases and procedures including batch orbackground process schedule, dependencies, sequencing,and timing- Administrative Tasks including User's administration,System security administration, reference data maintenance,creation of report templates and maintenance of serviceprovider data and contracts.- Other reference materials and presentations required tosupplement the and support activities.

Rl.01

ot.t2 The Contractor will develop a High Availability & DisasterRecovery Plan for the entire System driven by State'sRecovery Time Obiectives

Rl.01

01.13 The Contractor will provide documentation that describesthe procedures for System administrators to add, update orremove User IDs and passwords

RI.01

01.14 The Contractor will submit a Service Desk Support Plan foruse by the responsible entity service desk addressing theitem including but not limited to:- Overview of support strategy assuming that the State willprovide tier t help desk support- Help and Service desk design- Help and Service desk operations (processes andprocedures)- Incident management procedures and processes includingescalation- Problem management procedures and processes- Reporting

Rl.01

01.15 The Contractor will provide the responsible entity with helpand service desk and decision trees for tier I help

Rl.01

Srarr or VnnuoNt, CoNtru,cr FoR PnnsoN.q'r, SnnvrcnsDnr.qnrNrBNT oF' VrnnnoNr Hnll,rn AccnssEQHn.rr,rn Sor,urroNs, INc.

Pr,cn 219 ot268Conrnlcr # 28739

AurNuunNr # 2

desk and Iier 2+ service desk support

This is an M&ODeliverable

01.16 The Contractor will provide a Transition-Out Plan at

minimum six months prior to production support contract

expiration. The Plan must contain transition task

descriptions for the transitioning services over to another

Contractor or Vermont, an organization chart, and jobdescriptions for all support staff.

R3ot.t7 The Contractor will provide instructions and training forresponsible agency support staff that may need to access and

support The Contractor's System remotelyThis is an M&ODeliverable

01.18 The Contractor will agree to continue normal operations

activities until completion of Transition-Out Plan activitiesand readiness assessment result is approved by the State

Rl FINALDuring the maintenance period (when no design,

development and implernentation (DDI) is occurring), the

maximum time to restore the functionality of The -

Contractor's System and resolve incidents will be within the

timeframes listed below:. Severity T.evel One incidents will not exceed four (a)

hours between the opening of an incident and final closure,

unless a time extension is approved by the State.. Severity Level Two incidents will not exceed twenty four(24) hours between the opening of an incident and finalclosure; unless a time extension is approved by the State.. Severity Level Three , Four and Five incidents are

prioritized and worked via the standard Defect Resdlutionprocess.

02.l

Rl.01Upon System acceptance, The Contractor's System will be

considered completely transitioned to production within the

State or the State's hosting partner (the responsible entity)environment and moved into the Maintenance and

Operations (M&O) phase. To prepare the State for thistransition, the Contractor, the State's hosting Contractor and

the State will collaboratively integrate the M&O Plan intothe State's M&O Plan. The Contractor will develop a formalmethodology to be used by the State and its hostingContractor to manage and operate The Contractor's System

during M&O that is documented in the State M&O Plan(s).

The M&O Plan will incorporate methodologies andpractices which will assist the State and its hosting

02.2

Srara or VnnvroNt, Contnncr FoR ptnsoNu, SnnvrcnsDnpanrvrnNT oF VnnuoNr Hrar,rn AccnssEQHnnlrn Sor,urroNs, INC.

Pacr 220o1268CoNrnacr #28739

AvrnNovruNr # 2

Contractor in successfully managing the M&O life cycle andwill address at least the following areas:. Support Model . Triage Procedures. Tools . Identificationof Roles and Responsibilities of support personnel . ReleaseManagement. Upgrades . Maintenance. On-goingOperations . Customer Support. Specific supportprocedures for production . Deliverables - RequirementTraceability Matrix, Architecture and design, test procedure,case, and scripts . Resource Requirements (staff loading) .Capacity Management . Technology Refresh. SystemSecurity. Backup and Recoverya Disaster . Defect/Issue management

System Adnrinistralion

03.1 The Contractor's System will provide data archivingbased on State defined criteria (R1.01)capabilities

Rl.01

o3.2 The Contractor's System will provide the capability to moveall historical, expired and/or unnecessary datato offlinestorage according to a set of business rules and schedule tobe defined by the State as apart of the ongoing systemoperational decision making (Rl .0 1 )

Rl.0l

03.3 The Contractor's System will maintain an archival processso that accumulated historical records and log files do not

large amounts of disk space (Rl.01)consume

R1.01

o3.4 The Contractor's System will provide an auto archive/purgeof the log files to prevent uncontrolled growth of the log andhistorical records storage using administrator-set parameters(Rl.01)

Rl.01

03.s The Contractor's System will provide version controlcapabilities to ensure the integrity of all software releases(Rl.01)

Rl.01

03.6 The Contractor's System will provide logging and reportingerrors and exceptions (R1.01)for

R1.01

03.7 The Contractor's System will monitor and provide reportson any unauthorized access (Rl.01)

Rl.01

03.8 The Contractor's System will provide User privilege reportson demand. The format shall minimally provide role, lastlogin, date of account creation, account type. (Rl FINAL)

Rl FINAL

03.8-l The Contractor's System will provide User privilege reportson request. The format shall minimally provide role, lastlogin, date of account creation, account type. (Rl.01)

Rl.01

03.9 All System communications will be protected by at least256-bit encryption

Rl.01


Sr.l,rn or VBnvroNt, Coxtru.cr FoR PrnsoN.ql, SnnvrcnsDnpanrnnnNT oF VnniuoNr Hnar,tn AccrssEQHnllrn Sor,urroNs, INc.

Prcrc 221o1268Conrnacr #28739

AvrnxnvrnNr # 2

03.10 The Contractor's System will be supported by publickey/private key encryption Secure Socket Layer (SSL)

certificates

RI.01

03.11 The Contractor's System will provide admin tools and

maintenance routines to change access rights quicklyRl.01

03.12 The Contractor's System will use firewalls and

Demilitarized Zones (DMZs) for external access and remote

access

Rl.01

03.13 The Contractor's System will allow System administratorsto create and manage User accounts

Rl.01

03.14 The Contractor's System will prevent creation of duplicateaccounts

RI.01

03.15 The Contractor's System will allow System administratorsto assim status and permissions to User accounts

Rl.01

03.16 The Contractor's System will allow a system administratorto create new roles and profiles

Rl.01

03.17 The Contractor's System will allow system administrators tocreate and manage User roles

Rl.01

03.18 The Contractor's System will have the option to indicate the

type of User to be set up (e.g. System Administrator, Case

Manaser)

Rl.01

03.19 The Contractor's System will allow the grouping of multipleroles for the purpose of assigning access rights to those

roles.

Rl.01

o3.20 The Contractor's System will create a User profile for thenew User

R1.01

03.2r The Contractor's System will assign a User the proper

access roles and create a User name and temporarypassword (

Rl.01

c3.22 The Contractor's System will have the capability toautomatically deactivate a User account if there has been no

log-in for a specified time (e.g., 90 days). The deactivationpolicy, related rules and final review requirements to be

confizurable by the State.

Rl FINAL

o3.23 The Contractor's System will lock out a User after a

specified number of failed log-in attemptsRl.01

03.24 The Contractor's System will provide an online mechanismto unlock Users

RI.01

03.25 The Contractor's System will display all current User-specified preferences (ifexisting) or default preferences (ifnone exist)

Rl.01

Sr,q.rr or VnRwroNr, Coxrrucr FoR PnnsoNu, SnnvrcnsDrp.lRrvrnNT oF' Vnnuoxr Hrar,rn AccEssEQHnalrn Sor,urroNs, INc.

Pacn 222on268CoNrRlcr #28739

AnanNovrnrvr # 2

03.26 The Contraotor's System will allow Users to set up ormodify User preferences. Preferences may include:

a) Preferred method of communication (system emails)b) Subscription to alerts and notifications (e.g., changes to

member record, new messages, referral changes)c) Notification types desired

R3

03.27 The Contractor's System will display the selectedpreferences and allow the User to confirm or modifupreferences

R3

03.28 The Contractor's System will send a notification to the Userthat the personal preferences have been updated

Rl FINAL

03.29 The Contractor's System will have the ability to provideonline role-based access (as assigned/decided by VT) to casemanagement data, including but not limited to:

a) Program data and imaged documentationb) Member information (e.g., hospitalizatron, LTC facility,

pharmacy, PA information, State Plan services)c) Claims data (medical, pharmacy)d) Historical case, claims and enrollment datae) Eligibility informationf) Benefit packagesg) Provider informationh) Case notesi) Case activity codesj) Others as identified by VT and accepted via formal

change control

R1.01

03.30 The Contractor's System will have the ability to provideUsers role-based access (as assigned/decided by VT, roles tobe determined) to case management data. Users can bedefined as any of the following:

a) VT staffb) Nursesc) Other State agenciesd) Contractorse) Social workersf) Other entities as defined by VT

Rl.01

03.31 The Contractor's System will allow System administratorsto create User groups to manage workflow

R2

o3.32 The Contractor's System will allow System administratorsto assigr Users to particular local offi ces

R3

03.33 The Contractor's System will allow System administratorsto assign Users to particular User groups / units

R1.01

o3.34 The Contractor's System will allow System administratorsto assign Users to particular supervisors

R3

Surn or VrnuoNt, CoNtru.cr FoR PnnsoN.q'L SnnvrcBsDnplnrvrnNT oF VnnvroNr Hralrn AccrssEQHrar,rn Sor,urtoNs, INc.

P.r,cn 223o1268Conrru,cr #28739

AunNuivmNr # 2

Rl.0103.35 The Contractor will establish an automated maintenance

routine that will at a minimum: (Rl.01)- backup the User IDs and password data

- identifu expired IDs and related dataRl.0103.36 The Contractor will use offsite storage. Data backup should

be stored offsite in the event of a physical disaster

Rl.0103.37 The Contractor will provide a combination of disk and tape

(or equivalent) backups to protect Vermont data. Withprocedures in place for regular backup protection with a

defined timeline and scheduling. Backups of Vermont data

will take place using dedicated backup servers and tape (or

equivalent) libraries. Unless otherwise required by law,backup tapes will be encrypted, labeled, and shipped to asecure, fire-safe off-site storage vault facility managed by aPayment Card Industry (PCf Data Security Standard

certified Third Party Contractor where they will be retained

in accordance with requirements. The backup tapes will be

transported to the off-site facility on a daily basis by the

third-party storage Contractor. The Contractor will provide

documentation of processes for archiving and retrievingmaterial from the off-site storage Contractor

uirements

Rl.0104.1 The Contractor's System will have the ability to generate

administrative alerts and warnings when statistics indicatean impact or potential limits on System componentperformance and availability. The specific alerts will be

defined by the hosting services provider. The State has a

preference for the Oracle Performance Management toolsets

such as Oracle Enterprise Manager, Grid etc.Rl.01The Contractor's System will allow for all changes/updates

to the distributed components to be administered and

completed centrally and available immediately to all source

systems and sites

C,4.2

Rl.01The Contractor's System will provide Service LevelAgreement (SLA) monitoring and reporting capabilitiesService Level definitions will be drafted into a single

document provided as an attachment.

o,4.3

Rl.01The Contractor's System will securely support remote

control access (i.e. support personnel ability to take over the

User device for troubleshooting and support) capabilitiesdeploved for any type of User workstation

04.4

Rl.01104.5 The Contractor's System will provide event management

and monitoring functionality according to Inform4{gn-

Number RequirementDescriPtion Planned Releaase

Sr.lrn or VunuoNro CoNtnacr FoR PnnsoN,lr, SnnvlcrsDrpanrMsNT oF Vnnvronr Hw,rn AccEssEQHnlr,rn Sor,urroNs, INC.

P.q.cB 224o1268CoNrnq,cr # 28739

Annnxovrnxr # 2

Technology Infrastructure Library version 3 (ITIL v3) orequivalent best practices

04.6 The Contractor's System will provide ApplicationPerformance Monitoring and Management capabilities (i. e.transaction monitoring, synthetic transactions, componentroot cause analysis (e.g. Application Server Management)

Rl.01

o,4.7 The Contractor's System will provide State searchabletransaction tracking and log consolidation capabilities acrossall tiers of the application

Rl.01

Sr,q.rn or VnnvroNto CoNtnncr FoR PnnsoNar, SnnvrcnsDnp,q.RrvrnNT oF VnnuoNr lln.q.I.rn AccnssEQHnu,rn Sor,urroNs, INC.

P.c.cn 225 or 268CoNrnq,cr #28739

AunNovrnNr # 2

APPENDIX III- Non-Enumerated Functional Requirements

Appendix III. Non-Enumerated Functional Requirements

Non-Enumerated Functional RequirementNEGeneral (includes Document Management; Member,Authorized Representative, and CommunityProvider/P artner P ortal ; Alerts and Notifi cations ;

CentralizedWorkflow

NEl

Establish Case Criteria (includes Rules Management;

C andidate Identifi cation / Ri sk S tratification ; Eli gibilityNE2

Establish Case : Outreach; Case AssignmentNE3Perform Screening and AssessmentsNE4Manage Treatment Plan and OutcomesNE5Manage Case Information (includes Case

Documentation; Scheduling; Disposition; Transition;Care Coordination; Case Closure)

NE6

Manage Population Health OutreachNE7Manage RegistryNE8Authorization Determination (includes ReferralManagement; Service and Treatment PlanAuthorization)

NE9

ReportingNEl O

Consent

Sample List of ReportsNE11

Non-EnumeratedFunctional Requirement Number

Section Title

Document ManagementPlannedRelease

Requirementnumber

Requirement

R1

FINALallow the end-Users to work with scanned images or PDFs at

their point of origination without leaving the Contractor'sworkflow and User interface

NE1.1

R2NE1.22 notify the appropriate case manager for that specific member

that the document (and document ) has been received.R1FINAL

NEl.7 Other dynamic content includes User entered data that ispopulated from predefined fields in the Contractor's System

such as notes, comments, and letter specific text.R2Prompt persons (State employee, Contractor) during the letter

creation step of the Correspondence module.NEl.8

R2These text fields will include a required field constraint.NE1.9

General

Sr,rrn or VnnvroNr, CoNrnlcr FoR PrnsoN,tr, SnnvrcnsDnp,tnrvrnNT oF' VrnuoNr Hn.q.LrH AccnssEQHnalrn Sor,urroNs, INc.

Pacn 226o1268CoNrnrcr #28739

AvrnNuvrnNr # 2

NEl.1 0 Pre-populate future, or static date based on business rulesR2-R3

NEl.1 I enter freeform text in letters that can be applied to all selectedor identified members.

R2

NEl.12 Edit pre-populated date R2NEl.13 Allow User to freely navigate and allow information to be

changed on any page of the wtzardprior to submission.RIFINAL

NEl.14 Allow for Users to be edited R1

FINALNEl.15 Allow for Users to be deactivated R1

FINALNEl,1 6 Shall also allow for password sets/resets RI

FINALNEl.1 7 A role encapsulates specific User type scenarios in the

Contractor's System through a predefined set of permissions.These permissions will be mutually exclusive from roles andwill be assigned directly to a User in addition to a role. Thesepermissions can be applied at the data field level

R1FINAL

NEl.18 Include a configurable service-oriented workflow engine toallow the modeling of business processes and the executionand management of workflows. Activities to be modeledinclude assign.

R1FINAL

NEl.19 Execute the appropriate event at each step of the workflowprocess, based on that step ofthe process.

R1FINAL

NEl.20 Provide a workflow engine that allows the User to graphicallymodel the workflow processes and easily update them withouta core release of the Contractor's System requiring no

R1

FINAL

NE1.21 Generate Alerts and Notifications based on business rules asnecessary

RIFINAL

NEl.22 library of alerts and notifications to which will bepreconfigured rules that can be "attached" to a specificmember or defined globally.

R3 R2

NE1.23 Present the User, when logging in, with a pop-up boxinforming the User of new or unconfirmed alerts ornotifications that have been generated and allow the User tonavigate to the alerts sections of the Contractor's System toread and address each alertlnotification.

R1

FINAL

Sr,q.rr or VnRvrollt, Contnacr FoR PBnsoN.q'L SnnvrcBsDnrnnrvrBNT oF VunuoNr Hnalrn AccrssEQHnar,rn Sor,urroNs, INc.

Pacn 227 ot268Coxrnacr # 28739

AvrnNrvrnNr # 2

R1FINAL

NEl.24 Additionally, to a login prompt, as a User is actively workingin the Contractor's System a dashboard indicator will appear

to let the User know an alert or notification has arrived.R1FINAL

Provide links to program policies that will be visible at

appropriate times while navigating through a case.NE1.26

R1

FINALNEl.27 The Member information will allow a User to drill down from

a summarized view to the detail data.

Document ManagementPlannedRelease

RequirementRequirementnumber

R1

FINALNE2.I Provide step-by-step instructions to Users with appropriate

access through the Business Rules Management System(BRMS) for reviewing existing rules, modifying/editing rules

R1

FINALProvide an authoring tool that contains a rules library built on

State policies for Program eligibility criteria and Services

elieibilitv criteria.

NE2.2

R1

FINALNE2.3 Provide a front-end authoring tool that will allow State staff to

work on the rules on their schedule.R1

FINALEnable the rules built with the authoring system to be tested

without intemrpting the production environment.NE2.4

R1

FINALContain rules that are nested in a chained hierarchy orgrouped as named "Rule Sets"; which are groupings ofindividual rules allowing for the application of multiple,single. or all criteria for either eligibility or services criteria.

NE2.5

R1FINAL

NE2.6 Rules will be versioned to mirror system source code and be

maintained in the same repository and allow for capturing ofmultiple criteria sets to identify various population groups,

based on program policy.

R1

FINALUse a nationally recognized grouper such as J

adjusted clinical groups (ACG) System@ to determineprosram elieibility and severity levels.

ohns HopkinsNE2.8

R1

FINALEligibility rules criteria will be based andlor on nationalpractice zuidelines.

NE2.9

Rl FinalEach criterion will be used to evaluate and verify against

individual claims (both medical and pharmacy) data.NE2.10

The Contractor will provide training to appropriate AHSpersonnel on the ACG toolkit and allow for self-service

management and will work closely with the state to establish

an effective process for design and change management ofeach progtam's associated set of program eligibility rules.

NE2.13

Establish Case Criteria

Sr.q.rn oF VERMoNT, CoNrnacr FoR PnnsoNar, SrnvrcnsDrpanrvruNT oF VnRlroNr Hn,q.I,rn AccnssEQHnlI,rn Sor,urroNs, INc.

P.tcn 228 ot 268CoNrnA.cr # 28739

AnapNovrnr.lr # 2

NE2.14 Allow for program eligibility rules to be selected as active orinactive by using beginning dates and end dates for eachcriterion.

R1

NE2.15 Accept data through the Clinical Integration Framework (CIF) R1

FINALNE2.16 Run eligibility and risk stratification each time eligibility data

is obtainedRIFINAL

NE2.17 Send a referral with an initial/updated severity level to theassigned care coordinator.

R1

FINAL

CaseRequirementnumber


NE3.1 Route program-eligible Member contact information toappropriate User for outreach based on geography, loadbalance by case manager supervisors or filtered and mass-assigned by some other operational policv.

R2

NE3.2 a case manager when a case is assigned through theAlerts module. This assignment functionality will allow formultiple case management resources (case manager/internal

Alert

unit) to be simul assigned, listed and managed.

R2

NE3.3 Provide real-time care coordinator case mix profile visible toAuthorized Users.

Assign Additional Staff to CaseNE3.6 Case assignment changes and health edits will be validated

against the resources availability functionality.R3

Member's Profile SummarvRequirementnumber


NE4.1 Include a Member's medication list which will includemedications that have been automatically populated via theclaims and pharmacy data feeds as well as those that havebeen manually entered.

R1

Perform Screening and AssessmentsNE4.2 Support the ability to apply a weighted scoring assignment to

assessment and screening questions and aggregate the resultsto a final assessment score throueh the Form builder module.

R1

Perform Screening and Assessments

Establish Case

Srarn on VnruroNt, CoNtnacr FoR PBnsoNnr, SnRvrcnsDnp,q.nrvIBNT oF VnRnroNr Hnar,rn AccESSEQHn.rr,rn Sor-urroNs, INc.

' Pacr229ot268CoNrRacr # 28739

AmnwnvrnNr # 2

Create Plan of CarePlannedRelease


R2NE5.2 Provide a report that shows all Plan of Care items that have

been resolved in addition to those that are currently beingworked on by the care management staff.

Provide Education Materials

R2Members will have the ability to access specific educationtools throueh the Education Resources.

NE5.3

Case DocumentationPlannedRelease

Requirementnumber

Requirement

R1FINAL

Provide a configurable survey module that drivesdevelopment of the Plan of Care problems, goals, and

results/outcomes.

NE6.1

R1FINAL

NE6.2 Provide a configurable survey module which will be mapped,

and will auto-generate the Plan of Care based on system

configuration and evidence based standards for each

assessment/surveyR1FINAL

Provide a supplemental, searchable issues library that will be

available to allow manual selection of problems/goals by the

User.

NE6.3

R1

FINALEach problem/issue will be listed in the system and have

associated goals and interventions and will support structuredand standar dized, documentati on.

NE6.4

R3NE6.5 Problem attributes will include, but not be limited to, priority,outcome type, date identified, and source of identification and

reviewed by status.R1

FINALGoal attributes will include, but not be limited to, goal type,status, target completion, and actual completion dates.

NE6.6

R1FINAL

N86.7 Interventions will include, but not be limited to, interventiontypes, status, proiected and actual completion dates.

R1FINAL

NE6.8 Support mandated external reporting of incidents as required

by State and Federal lawR3 R2NE6.9 Allow for all, multiple, or single interventions to be selected

and then have any subsequent edits (such as Notes, Dates,

to all the selected Interventions.etc.) apply

Manage Treatment Plan and Outcomes

Manage Case Information

Sr.q.rr or Vnnvroxr, CoNrnacr FoR PBnsoNA.r, SnRvrcnsDrplRrvrnNT oF VunvroNr Hnlr rn AccnssEQHnalrn Sor,urroNs, INc.

Pacr 230 on 268CoNrntcr # 28739

AvrpNovrnNr # 2

NE6.l0 Allow Users to enter freeform text to communicatesupervisory review / comments that can only be viewed byUsers authorized to do so.

R2

SchedulingNE6.1 1 Allow authorized Users to create and modify meetings and

search by attendees.R3

NE6.l2 Allow the User to 'Block out' times unavailable R3 RlNE6.13 Provide mapping functionality which will be available within

the provider search tool and the scheduling module.R3

NE6.14 Provide printable map directions to each appointment. R3Document Case DispositionNE6.16 Provide State configurable disposition status fields. R1

FINALNE6.l7 Allow for cases to be automatically referred/ transferred to

other care management staff including a follow up Plan ofCare for new staff.

R1

NE6.18 Support documentation of the disposition post hospitaldischarge, Plan of Care status and the final case closure status.

R1

FINALCase TransitionNE6.21 Referrals are associated with referring, and referred entities. R1

FINALClose Program EnrollmentNE6.22 Allow member case data to be dynamic and updated in real-

time for stakeholder review on case status via the appropriatemechanism (portal, interface, etc.).

R2

NE6.23 Allow for follow up flags to be visible reminders on the Userdashboard based on follow-up criteria.

R1

NE6.24 Use a nationally recognized grouper, such as Johns HopkinsACG System integration, for gap in Pharmacy metricsregarding medicatiorVprescribed drug adherence andpossession rates.

R3

NE6.25 Use a nationally recognized grouper, such as Johns HopkinsACG System integration, for member's adherence withtherapy.

R3

NE6.26 Leverage a nationally recognized pharmacy data base such as

First Databanks'MedKnowledge to provide drug searchcapabilities, medication reconciliation, and contraindicationwamings.

R1FINAL

Care CoordinationNE6.27 Provide an integrated web based application and portals. R1

FINALNE6.29 Provide a modular, highly connected framework to allow all

stakeholders to collaborate electronically to improve thepopulation health including care management module.

R1FINAL

Srarn or VunuoNt, CoNtucr FoR PnnsoNar, SnnvrcnsDnp.q.nrvrnNT oF VnRvroxr Hnar,rn AccnssEQHn,lr,rn Sor-urroNso INc.

PAGE 231ot268Coxrnact # 28739

AvrnNovrnNr # 2

R1

FINALProvide a modular, highly connected framework to allow allstakeholders to collaborate electronically to improve thepopulation health including care coordination productivitymodule.

NE6.30

R1


stakeholders to collaborate electronically to improve thepopulation health including report module.

R1


stakeholders to collaborate electronically to improve thepopulation health including health and wellness module.

R1


stakeholders to collaborate electronically to improve thepopulation health including evidence based care module.

R2Provide a direct link to communicate with Users through the

Messaging module. Internal and extemal Users/partnersactively working on or related to a member's case will be

section ofthe case record.listed in the case assigrtment

NE6.34

Manage Population Health OutreachPlannedRelease


R1

FINALNE7.1 The Contractor's System shall: i. NE7.1 Produce standard

reports monthly, except as otherwise defined during JointApplication Design (hereinaft er called "JAD") sessions.

R1Provide ad hoc reporting capability that allows development

by both Contractor and StateNE7.2

R1Have a DatalHealth Informatics Analyst on staff to develop

and assist the State in developing ad hoc and routine reportsNE7.3

R3NE7.4 Automatically assign lJsers, based on predeterminedparameters such as geographic location, to work with ClinicalLeads at provider and partner sites to address issues

highlighted in panel reportsR1NE7.5 Use predictive modeling analytics tools to provide details on

population health initiativesRIUse predictive modeling analytics tools to identify areas

where population health initiatives may be indicatedNE7.6

R3Be configurable per State specifications including by providerpractice site and/or clinical leads, with automatic member

assignment based on parameters, including but not limited togeosraphic and facility location, condition, staff license, etc'

NE7.7

R1NE7.8 Allow Users to document and log all contacts made withmembers, providers, practice andlor clinical leads, and otherparticipant's on a member/patient's treatment team including

and State defined and configurable fieldssystem pre-defined

Manage Population Health Outreach

Sr.q.rn oF VERMoNT, CoNrrucr FoR PBRsoN.c,L SnnvrcssDnplnrivrnNT oF' VnnvroNr Hnar,rn AccrssEQHnn ur Sor,urroNs, INc.

Pacn 232o1268CoNrnrcr # 28739

AvruNuwrnNr # 2

N87.9 Be configurable to support session notes in which type ofcontact, method of contact, and content of contact can all bedocumented

R1

FINAL

NE7.10 Provide fields that are configurable at the State level R1

FINALN87.11 Integrate with a predictive modeling tool such as Johns

Hopkins ACG and utilize claims data to analyze a populationon dimensions including but not limited to chronic condition,age, gender, Primary Care Provider (PCP), programenrollment

R1FINAL

Program Education MaterialsNE7.12 Integrate with a nationally recognized health care

knowledgebase (e.g., Health wise@) with continuous updatesto provide evidence based educational materials that can beviewed online, printed or electronically sent to a patientandlor provider and other stakeholders involved in membercare.

R1FINAL

NE7.13 Track all educational correspondence and recordcorrespondence history that is viewable to Users.

R1FINAL

Care Coordination Program GoalsNE7.14 Support targeting specific chronic disease processes for a

member and support management of chronic illnesses, otherco-morbid health conditions, behavioral health issues, andlorpsychosocial issues

R1

FINAL

NE7.15 Support evaluation of quality, continuity, accessibility,timeliness and outcomes of care management servicesprovided including process and quality improvement featuresto monitor care coordination efficiency, including but notlimited to

R1FINAL

NE7.16 Monitoring evidence of the participant-physician-carecoordinator relationship

RIFINAL

NE7.17 Monitoring care across all health care settings R1

FINALNE7.18 Documenting and monitoring social support needs,

interventions and results of the population.R1FINAL

NE7.19 Development, implementation, monitoring, and evaluation ofindividualized care plans. (Rl.02) (Rl FINAL)

R1FINAL

NE7.20 Coaching and behavior modification activities to promoteparticipant self-care

R1

FINALNE7.21 Monitoring of participant health status via administration of

evidence based health risk assessments (HRA) and diseasespecific assessments, self-care education, coaching andbehavior modification, wellness screenings, in person andtelephonic on-going engagement, and resolution of barriers tocare.

R1FINAL

Sr,trn or VnnvroNto Contnacr FoR PnnsoNar, SnnvrcnsDnplnrrvrrNT oF Vnnvrour IIn.q.LrH AccrssEQHnnlrn Sor.urroNs, INc.

Pacn 233o1268CoNrn-q.cr # 28739

AvrnNoutwr # 2

N87.22 Identification of participants for care coordination services

based on but not limited to program eligibility criteria,predictive modeling and current utilization pro fi1es

R1

FINAL

NE7.23 Support multidisciplinary Users engaged as members of the

care management team

R1

FINALN87.24 DocumenVtrend improvement in participant clinical and

financial measures and quality of life (survey tools, evidencebased tools)

R1

FINAL

NE7.25 Support and promote physician adherence to evidence based

care standards for each disease process, via reporting and

trending by provider of treatment gaps

R1

N87.26 Support and promote physician understanding and adherence

to nationally recognized practice guidelines via gap in care

report

R1

N87.27 Support reduction in treatment variation by monitoring,evaluating, and reporting on physician treatment againstnational and state standards, and provider peers

R1

NE7.28 Manage and document utilization and cost savings based on

integrated care coordination including but not limited to thetotal population vs. program eligible and intervenedpopulation(s), disease specific measures of improvement, and

staff specifi c performance improvement

R3

Scope of ServicesNE7.29 Track delivery of services that are holistic, individualized, and

evidence based and track multiple modes of communicationand engagement, including but not limited to

R1FINAL

NE7.30 In person, telephonic, electronic including via provider and

patient portals, and/or mail and other written forms ofcommunications

R1FINAL

NE7.31 Interventions for monitoring and tracking include R1

NE7.32 Predictive modeling to population identification for VCCIeligible members by the vendor including high risk/costconditions and participants; as well as via other methods

R1

NE7.33 Risk stratification to ensure the right interventions are beingprovided to the right participants

R1FINAL

N87.34 Establishment and ttilization of a Medical Home R1

FINALNE7.35 Health Education tools and related tracking of supports

provided by member and UserR1FINAL

NE7.36 Health Coaching supports provided for behavior change RIFINAL

NE7.37 Health and wellness promotion services and goals includinglifestyle modifi cations.

R1

FINALNE7.38 Medication Adherence/medication reconciliation tracking to

support evidence based care

R3

Srarn or VrnuoNr, CoNrucr FoR PrRsoNlt SnnvrcnsDpplnrvruNT oF' VnnvroNr Hnl.t,tn AccnssEQHrar,rn SolurroNs, INc.

Pacn 234or'268CoNrnacr #28739

AvrnNrunNr # 2

NE7.39 Smoking Cessation resources and progress toward goalachievement

R1

FINALNE7.40 Depression Screening and related scoring and trending of

resultsR3

NE7.41 Assessment of psychosocial barriers to health and progresstoward resolution

R2

NE7.42 Medical and psychosocial referrals and status of results. R1

FINALNE7.43 Monitoring o f face-to -face collaboration frequency between

care coordinators and program participants and impact onresults

R1FINAL

NE7.44 On-going assessment of the participant's medical and

lsychosocial issues with comparisons over timeR3

NE7.4s Ability to develop and implement an individualized,collaborative plan of care among treatment/support team

R1FINAL

NE7.46 Electronic monitoring tools and systems for Providernotification of care coordination enrollment and related

level by individual and panel of patients

R3

NE7.47 Tracking of on-going, frequent interactions between carecoordinators and a participant's designated medical home

RIFINAL

NE7.48 Provider profile reporting capability related to utilizationpattems and adherence to condition specific standards of care

{gap in care reports).

R3

NE7.49 Provider education materials to support evidence-basedpractice guidelines.

R1

FINALProgramsNE7.50 The Contractor's System shall include the following

components to support care coordination integration ofclinical treatment guidelines, disease prevention strategies,patient self-care education, and social support services while

a quantifiable cost savings to the payer

R3

NE7.51 Population Identification that will be performed by theContractor's analytic staff and include use of predictivemodeling tools to identit, members based on medical andpharmacy claims, data, analTrtics data, provider, facility, orparticipant sel f-referral s

RIFINAL

NE7.52 Population Stratifi cation that categorizes eligible membersinto severity levels based on predictive model data findings,clinical data, andlor assessment findings. Stratification will beupdated regularly based on clinical data receipt, carecoordinator encounter, andlor at least every six months for theentire population

R1

FINAL

NE7.53 Evidence-based care guidelines to support Plan of Caredevelopment and monitoring of treatment adherence byprovider and member

RIFINAL

Srarn or VnnvroNt, CoNtru.cr FoR PBRsoNu, SnnvrcnsDnp.q,nrNInNT oF VnnvroNr Hn.ll,rn AccnssEQHnalrn Sor.urroNs, INc.

Paca 235o1268CoNrnacr #28739

AunNuvrnNr # 2

R1

FINALNE7.54 Monitoring of member engagement and readiness to change,

tracking progress toward clinical and psychosocial problemas outlined in the Plan of Care goalsresolution/goals

R1FINAL

Development, implementation, sharing, and monitoring ofprogress on individualizedplans of care goals as generated byresponse to evidence based health assessments, systemgenerated triggers and case manager results

NE7.55

R2NE7.s6 Documentation and management of Care Transitionsincluding from inpatient to outpatient settings as well as levels

of service provisionR3t.Monitoring participant collaboration andNE7.57R2Monitoring provider and practice level collaboration and

engagementNE7.58

Manaqe RegistryPlannedRelease


R1NE8.1 Support bi-directional exchange of clinical and other data inmultiple standard protocols and formats via the ClinicalIntegration Framework (CIF) module. Supported

will include but not be limited toformats/protocolsR1FINAL

NE8.3 Maintain performance measures at the member and other

designated levels and a static "snapshot" captured at an agreed

upon frequency for graphic trending analysis to include 'rollup' for population level reporting

R1FINAL

Analyze all available data, including the predictive modelingengine output, to generate a panel of clinical gaps

N88.4

R1

FINALAnalyze all available data to generate a panel of clinical gapsNE8.4-1

R3Use a nationally recognized grouper (e.g., Johns HopkinsACG) to determine medication gaps that indicate a member'sadherence with therapy, including but not limited to: thenumber and duration of gap, medication possession ratio(MPR), continuous medication availability ratio (CSA), and

risks if untreated.

NE8.5

Referral ManagementPlannedRelease

Requirementnumber

Requirement

R2NE9.I Create and route referrals electronicallyR2 R3Acknowledge referrals, accept referrals, and track referral

status. The Contractor's System shall setup automated

notifications related to the referral

NEg.2

Manage Registry


Srarr oF VERMoNT, CoNrnncr FoR PnnsoN,c.L SnRvrcnsDnplnrvrnNT oF VnnvroNr Hrar,rn AccnssEQHnllnr Sor,urroNs, INc.

P.q,ca 236 ot 268Courrutcr # 28739

AvrBNrvrcNr # 2

NEg.3 Allow a User to modify or withdraw a referral. R1FINAL

NE9.4 Search for referrals R1Prior AuthorizationNE9.15 The Contractor's System shall support all the uploading of

supporting documentation for review by Authorized Usersand via their respective portals.

R2

Requirementnumber


N810.1 Where applicable, provide reports consisting of clinical andoperational performance measures (through Inter-raterReliability tools), financial, satisfaction, and quality of lifemeasures on a population level.

R3

NE10.2 Where applicable, provide reports consisting of clinical andoperational performance measures (through Inter-raterReliability tools), financial, satisfaction, and quality of lifemeasures on a program level

R3

NE10.3 Where applicable, provide reports consisting of clinical andoperational performance measures (through Inter-raterReliability tools), financial, satisfaction, and quality of lifemeasures on a@individual level.

R3

NE10.4 Complete outcomes reporting must be semi-annually and morefrequently as requested by the State. Outcomes and reportingdata will be based on claims data, information collected in theCare Management Contractor's System, other State agencies orprograms, providers, ACOs, etc.

R3

NE10.5 Structure the reporting processes to ensure consistentand interpretation of data that is gathered.

R1

NE10.6 Monitor and report on service, program, clinical and financialoutcomes, which support program operational, regulatory andcertifieation goals.

R2-R3

NE10.7 These reports may include but are not limited to: Eligiblepopulation;

i. Population distribution (age, gender, geography,acuity)

Population that received care.

R3

NEl0.8 These reports may include but are not limited to:Eligible population (aft er exclusionary criteria applied);

iii. Population (age, gender, geography, acuity)Population that received care.

R3

N810.9 These reports may include but are not limited to:Product Program Reports on

R3

Reporting Requirements

Sr.lrn or VnniuoNt, CoNtRlcr FoR PrnsoNn SnnvrcnsDnpaRtvrnNT oF VnnuoNr HBnlrn AccBssEQHn,ll,rn Sor,urroNso INc.

Prcn 237 o1268CoNrru,cr #28739

AvrnNnurNr# 2

i. Enrollment statistics, (e.g., referrals, opt-out, engaged,

unable to contact and reason, cases closed and reason, health

condition, etc.)ii. Health Conditioniii. Participation-Totala. # of active participation (engaged with a CC) by severitylevel;b. Total # of active participants with an individualized plan ofcare.

iv. Clinical- Condition specificv . Utllization and Preventativea.Vo of enrollees with 2 or more MD office visits within 12

monthsb. o/o of enrollees getting a flu vaccinec. o/o of ewollees getting pneumonia vaccine within last 5

yearsd. Other Wellness/Preventive care screenings based on themember population.

NEl0.10

viMember satisfaction surveyPlan of Care outcome\

Length of program pation

R3

N810.11V

These reports may include but are not limited:Length of stayvi. Admissions for specific conditionsPharmacy costs in relation to overall costs

R3

NE10.l2 Total # patients referred, enrolled, number of member and

provider encountersTotal # patients unable to contactc. Related to no valid phone #d. Related to unable to reach the patient either in person

or.telephonicallyNumber of initial screenings completed

RI

NEl0.l3 Description: Provides details on Staff productivity over apredefined timeframe. Staff parameters may include theindividual, departments, etc.

R3

NEl0.14 Provides details on caseload by staffover a predefined

timeframe.

R3

NE10.l6 Provides details on population report on geographic

variability ofchronic diseases - "hot spotters" by geography

and practice (prevalence of condition(s) by a) region, b)provider practice)

R3

NEl0.17 Description: Provides details on member adherence tomedication for a specific condition as well as percentage ofenrolled members with completed assessments and

medication adherence issues

R3

Srarn or VnRvroNr, CoNrnacr FoR PunsoNar, SnnvrcnsDnpanruuNT oF VnnmoNr HEALTH AccnssEQHnnlrn Sor,uuoNs, INc.

Plcr 238 or 268Conrnacr # 28739

AvrnNovrnNr # 2

NE10.20 Provides overview of clinical outcomes achieved by memberimproved AIC (A1C), less ED utilization, etc.such as

R3

NE10.23 Provides Program-specific operational metrics including butnot limited to: - Percentage of caseload capacity, those withSNA, etc. based on given metrics re: staff.

R3

NE10.27 Provides Member's health profile compared to Memberpqpulation profile and overall population profile

R3

NE10.30 Product Member Reports oni. Member satisfaction surveyii. Plan of Care outcomesiii. Length of program participation

R3

NE10.32 Provide performance information on PCPs in terms ofmeasures for keeping patients with chronic conditions withingoalhange for those conditions to include drill-down intooutreach reports, specific patient data and visit planners, andtrending over time (such as 12-month look back). Thesereports would provide comparative analyses on providersagainst other providers within a practice, within the HSA, andacross the State.

R3

NE10.33 Clinical measure reports required by HRSA for FQHCs. Forexample, patients ages 18 - 75 with a diagnosis of diabetes,who meet all the numerator targets of this composite measure:A1c < 8.0, LDL < 100, Blood Pressure < 140190, Tobacconon-User and for patients with diagnosis of ischemic vasculardisease daily aspirin use unless contraindicated.

R3

C o nse nt Manage m ent Re q uire mentsContract#28739Requirementnumber


NEl 1.4 sort and filter by pertinent fields, for a member's consentrecord

R1FINAL

Health Care ReformContracf#28739Requirementnumber


NE12.1 Align with Vermont's health care reform plans during theterm of the Contract. (Rl FINAL)

R2

NE12.2 Provide integration with HSE platform and MMIS system tocreate a continuity of record at the person level. (Rl FINAL)

R1

FINAL

Consent Management Requirements

Health Care Reform

Srarn or VnnuoNto CoNtRlcr FoR PrnsoNar, SnnvrcnsDnp.q.nrvrnNT oF VnnivroNr Hnar,rn AccnssEQHnllrn Sor,urroNs, INc.

P.tcr 239 or268CoNrnacr # 28739

AvrnxrprnNr # 2

R3NE12.3 Provide integration with Vermont Health InformationExchange (HIE) to create claims and clinical continuity of care

records and the creation of data profiles at the member,physician, and provider facility levels for data transparency.

C ase Msnase m ent C ertilic atio nPlannedRelease

RequirementContract#28739Requirementnumber

R1FINAL

NEl3.1 Meet and maintain the requiremsnts that will allow State

programs to secure certification in Case Management by theNational Committee for Quality Assurance (NCQA). (RlFINAL)

R1FINAL

NE13.2 Meet and maintain the requirements that will allow State

programs to secure certification in Disease Managementandlor Health Utilization Management by the UtilizationReview Accreditation Commission (URAC) or NationalCommittee for Quality Assurance (NCQA).

Case Management Certification

Srlrn or VnnuoNt, CoNrrucr FoR PnRsoNar, SnnvrcnsDnpanrvrnNT oF VnnvroNr Hnar,rn AccEssEQHnllrn Sor,urroNs, INC.

Prcn 240ot268CoNrnq,cr # 28739

AmnNovrnNr # 2

ATTACHMENT B - PAYMENT PROVISIONS

The maximum dollar amount payable under this contract is not intended as any form of aguaranteed amount. The Contractor will be paid for services actually performed, as specified inAttachment A, up to the maximum allowable amount specified on page I of the Contract.

1. Contractor must submit a certificate of insurance that meets the minimum coverage amountsrequired under this Contract prior to commencement of any work and submission of anyinvoice to the State.

2. Invoices must be rendered on Contractor's standard billhead or official letterhead. Contractorshall include the Contract # of this contract on all invoices. The Contractor shall submitinvoices for the previous period on the 5th busiqess day of the next month. The Contractorshall submit invoices to the State for actual hours worked or deliverables accepted andapproved by the State Authorized Representative, in accordance with the rates and schedulesoutlined in this Agreement.

3. Unless otherwise specifically provided in Attachment A, Contractor shall issue to the State,monthly in arrears, an invoice in U.S. Dollars for the amounts due for work provided inAttachment A provided in the previous month. Fach invoice shall include such detail andcategories of information as mutually agreed upon by the parties. Each invoice shall itemizethe specific sections of the Statement of Work on which such Charge is based and includecalculations used to establish such Charges. Invoices shall be coded and charges segregatedas directed by the State to facilitate proper accounting among multiple funding sources anddifferent cost allocations among different parts of the solution. All periodic Charges underthis agreement (excluding charges based upon actual usage or consumption of Services) shallbe computed on a calendar month basis and shall be prorated for any partial month.

4. Invoices must be submitted electronically to: [email protected]

5. Payment of each invoice is due within thirty (30) days of receipt of correct invoice.Contractor shall be paid based on documentation anditemization of work performed andincluded in invoicing as required by 32 V.S.A. $ 463.

6. Per Attachment A, G (2), Contractor shall submit monthly reports regarding Service LevelRequirements to the State. Any credits due to the State based on this monthly report shall bereflected in the following month's invoice.

7. Contract Maximuma. All rates set forth in this contract are all-inclusive, no expenses, benefits or insurance

will be deemed reimbursable to the Contractor by the State under this Contract.

Srlrn or VnnuoNt, CoNtrucr FoR PnnsoN.q.L SnnvlcnsDnpa.nrvrnNT oF VnRvroNr Hnl.LrH AccnssEQIInar,ru Sor.urroNs, INc.

Table B-1 Total Cost Summary Base Years

Pacn 241o1268CoNrnlcr #28739

AvrnNnvrnNr # 2

$11 1,450

$25,650

s3,213,750

$1,057,731

$23,320,217

$11,078,735

$7,775,901

$57,000

$ I I 1,450

$25,650

$3,213,750

$734,006

$0

$11,917,757

Total Costsincluding One-Time Costs andOngoing Costs

s7,775,901

$57,000

$0

$2,484,000

1,701,668

$0

$40,000

$9,500

s642,750

$90,082

$40,000

$9,500

$642,7s0

$318,912

$0

$2.714,665

$1,703,503

$0$11,400

$31,450

$6,6s0

s64L7s0

s325,0t2

$0

92,7r4,665

sr,697,403

$0

$0

$642,750

$0

$0

$2,r33,777

sl,468,227

$22,800

$0

$0

$1,870,650

$1,205,100

$22,800

$0

$0

$642,750$0

s323,725

11,402,460

$11,078,735

Packaged SoftwareCosts

Change Requests

Total Costs

SolutionImplementation

ApplicationMaintenance and

Operations Support

Hosting and DisasterRecovery Support(Until FullDeployment)

Hosting after fuIldeployment

Disaster Recovery afterfull deployment

Total DDIOne-time

Costs

M&OCosts

Year 1

M&OCostsYear 2

M&OCostsYear 4

M&OCostsYear 5

Total Cost Summary

Description

TotaICosts

Total M&OCosts

M&O Costs

Year 3

Sr,q.rn or VnRnnoNt, CoNrnacrDnp.lnrlrnNT oF Vrnuoxr Hnlt,rn AccnssEQ Hnlr,rH SoLUTToNS, INC.

P.lcn 242 oF 268CoNrnq.cr 28739

AvrnNnvrrxr #2

b. In the event the State elects to pursue either of the optional years after Year 5 (Years 6 and 7) of this Contract, the Contractoragrees to the prices for its work indicated in its bid to the State as follows:

Table B-2 Years 6 & 7

c. TASKS 1 -10 -Deliverable Based Payments for DDI and On-Going Task(s)The Contractor will perform TASKS 0 through 10, as specified in Attachment A of this Contract, on a fixed price basis, withpayments tied to contractually-defined deliverables and the State's finding of satisfactory performance. Deliverables areconsidered approved when the State issues a Deliverables Acceptance Document (DAD) signed by the State's authorizedrepresentative.

Deliverable 6-D, System Source Code and Documentation, for each Release will be due upon receipt of payment by Contractorfor approved Deliverable J-8, Phase Acceptance and after 7-F Project Closeout/System Acceptance. Updated code will bedelivered to the State quarterly after Contractor receives all M&O payments for the quarter.

$3,403,556

$0

$80,000

$19,000

$1,285,s00

$179,944

$4,968,000

$4,968,000

$3,403,556

$0

$80,000

$19,000

$1,285,s00

9179,944

$4,968,000

$1,701,888

$0

$40,000

$9,500

$642,750

$89,862

$2,484,000

$1,701,668

$0

$40,000

$9,s00

$642,750

$90,082

$2,484,000

Solution Implementation

Application Maintenance and Operations Support

Hosting and Disaster Recovery Support (Until FullDeployment)

Hosting after fuIl deployment

Disaster Recovery after full deployment

Packaged Software Costs

Change Requests

Hardware Costs (if applicable)

Total Costs

Total OngoingCosts

M&O CostsYear 6

M&O CostsYear7

TotalCostsTotal M&O Costs

Total Cost Summarv (Optional Years 6 & 7)

Description

Srarn or Vnnuonto CoNtru,ctDnpanrvrnNT oF Vnnvrour Hn.q.LrH AccnssEQ He.Lr,ru Sor,urroNs, INc.

Table B-3 Task-Related Deliverables

Table B-4 DDI Task Related Deliverables.

Prcn 243o1268CoNrru,cr 28739

AvrnNnvrnNr.#2

The actual due dates for deliverables are reflected in the approved Project Plan and

Schedule for each major release, as indicated in Attachment A. The baseline Project

Schedule typically is reviewed and updated weekly, as needed. Enclosed herein is the

deliverables-based payment sequence:

Ongoing across the

Contraot Lifecycle(Months 1-60)

9179,026*

Proj ect Status Reporting (recurring

throughout the length of the Contract,

frequency to be determined with State)

*The Contractor shall invoice for Task 0

monthly and shall not exceed $2,983.77 a

month without prior written approvalfrom the State AuthorizedRepresentative(s).

Task 0 - Project Monitoring and Status

Reporling

QE 6/2016Release 1$89,513

Task 1A - Project Kick-offPresentation

QE 6/2016Release I$89,513

Task 18 - Project ManagementPlan

$89,513QE 6/2016Release 1Task lD (R1) - Requirements

Analysis, System Design and

Development Strategy

$71,610.30QE 6/2016Task 1C -

Project Work Plan and fullyresourced Schedule

1 .0 1

QE 6/2016Rl Final $167,090.70

Task lC -Project Work Plan and fullyresourced Schedule

QE 6/2016Release I$268,539

Task 1E - System ImplementationStrategy

QE 6/2016Release 1 $t79,026Task lF - Master Testing Strategy

QE 6/2016Release 1$111,891

Task 1G - Requirements

Traceability Plan

MajorReleaseNumber

State ofVermontPayment

EstimatedPayment Date(by StateFiscal Year

Quarter End)

Release totalDELIVERABLE

Surr or VnnvroNr, CoNtnacrDnp.q.RrNrnNT oF VnnuoNr Hn,qlrH AccnssEQ Hnlr ur Sor.urroNs,INc.

PacB 244o1268CoNrrucr 28739

AvrnNovrnNr #2

Task 2,{ - FunctionalSpecification and System DesignDocument

1.01 $26,853.90QE 6/2016

Task 2,{ - FunctionalSpecification and Systern DesignDocument

Rl Final -$62,659.10QE 6/2016

Task 28 - Data Integration andInterface Design Document

Release 1

$179,026 QE 6/20r6

Task 3,{ - System ImplementationPlan

Release 1$44,756 QE 6/2016

Task 38 -Datalntegration andSynchronization Plan, includingmultiple test files (MMlS/claims,PBM, eligibility, VCCI legacy,etc.)

Release 1

$477,402

QE 6/2016

Task 2C -System Architecture Release 1 $358,052 QE 6/2016Task 2D - Technical DesignDocument

1 .0 1$59,675.33 QE 6/2016

Task 2D - Technical DesignDocument

Rl Final$119,350.66 QE 6/2016

Task 4,{ (R1) - Test Plan $59,675 QE 6/2016Task 5,{ (R1) -Training Plan

1 .0 1$17,902.50 QE 6/2016

Task 5,A' (R1) -Training Plan

Rl Final $4t,772.50 QE 9/2016

Task 6,4. (R1) -Deployment Plan 1.01 $17,902.50 QE 6/2016Task 6,4. (R1) -Deployment Plan Rl Final s4t,772.50 QE 12/2016

Task 48 (Rl) - Test Scenarios,Test Cases and Test Scripts

1 .0 1 $7,161.00QE 6/2016

Task 48 (R1) - Test Scenarios,Test Cases and Test Scripts

R1 Final $16,709.00QE 12/2016

Task 4C (Rl) - DocumentedSystem Test Results

1 0 1$35,805.30 QE 6/2016

Task 4C (R1) - DocumentedSystem Test Results

Rl Final $83,545.70 QE r2/2016

Task 58 (R1) - Training Manuals,End-User Guides and Materials

1.01$17,902.50

QE 6/2016

Task 58 (Rl) - Training Manuals,End-User Guides and Materials

Rl Final $4t,772.50 QE 3/2017

Task 68 (R1) - System Incidentand Defect Resolution Report

1.01 $7,161.00 QE 6/2016


Rl Final $16,709.00 QE 12/2016

Sr,trn or VpnuoNt, CoxtnlctDnpmrvmNT oF Vnnvronr Hnar,rn AccnssEQ Hnar,rn Sor,urrons, INc.

PAGE 245o8268Conrru,cr 28739

AvrnNpvrnNr #2

Task 3C - System Maintenance

Support Plan$238,701 QE 6/2016

Task 6C -Completed Detailed Functionaland Technical SpecificationsTraceability Matrix

1.01

$35,805.30

QE 6/2016

Task 6C -Completed Detailed Functionaland Technical Specifications

Traceability Matrix

Rl Final $83,545.70

QE 12/2016

Task 5C Conduct Training - Rl 1.01 $3,580.50QE 6/2016

Task 5C Conduct Training - Rl R1 Final $8,354.50QE 12/2016

Task 5D(R1) -

Documented Evidence ofSuccessful End-User Learning -

R1

1.01

$35,805.30

QE 12/2016

Task 5D(R1) -Documented Evidence ofSuccessful End-User Learning -R1

Rl Final $83,545.70

QE 6/2016

Task 7A R1 Readiness Approval 1.01 $13,426.80QE 6/2016

Task 7A Rl Readiness Approval Rl Final $37,329.20QE 12/2016

Task 9E - Tier 2 Service DeskPlan

Release 1

8477,402QE 6/2016

Task 6E Deployment (R1) 1.01 $53,707.80 QE 6/2016

Task 6E Deployment (R1) Rl Final $125,318.20 QE 12/2016

Task 6F (R1) - Performance SLAs 1.01 $214,830.90 QE 6/2016

Task 6F (R1) - Performance SLAs R1 Final s501,272.r0 Q,E 12/2016

Task 6D (R1) - System Source

Code and Documentation After 7-B $59,675QE 6/2017

Task 78 (R1) -Complete Rl Phase Close Out

Release 1$954,805

$5,721,367QE 6/2017

Task lD (R2) - Requirements

Analysis, System Design and

Development Strategy

Release 2

$111,891QE s/2017

Task 4,A' (R2) - Test Plan Release 2 $59,675 QE e/2017

Task 54. (R2) - Training Plan Release 2 $59,675 QE 6/2017

Sr,rru or VnnuoNr, CoNrucrDnplRrvrnNT oF' VnnvroNr Hpaltn AccnssEQ Hnar,rn SolurroNs, INc.

Pacn 246o1268CoNrnacr 28739

AvrnnnprnNr #2

Task 6,{ (R2) -Deployment Plan Release 2 $59,675 QE 6/2017Task 48 (R2) - Test Scenarios,Test Cases and Test Scripts

Release 2$23,870 QE 9/2017

Task 4C (R2) - DocumentedSystem Test Results

Release 2$119,351 QE 9/2017

Task 58 (R2) - Training Manuals,End-User Guides and MaterialsUpdates

Release 2

$59,675QE 9/2017


Release 2$23,970 QE r2/2017

Task 6C - Completed DetailedFunctional and TechnicalSpecifications Traceability Matrix

Release 2

$119,351QE 9/20r7

Task 5C Conduct Training - R2 Release 2 $1 1,935 QE 9/2017Task 5D (R2) - DocumentedEvidence of Successful End-UserLearning

Release 2

$119,351QE 9/2017

Task 7,{ R2 Readiness Approval Release 2 $44,756 QE 6/2017Task 6E Deployment (R2) Release 2 $44,756 QE 9/20r7Task 6F (R2) - Performance SLAs Release 2 $t79,026 QE 9/2017Task 6D (R2) - System SourceCode and Documentation

Release 2

After 7-B $59, 67s QE 12/20r7

Task 78 (R2) - Complete R2Phase Close Out

Release 2$477,402

$r,573,934QE 12/2017

Task lD (R3) - RequirementsAnalysis, System Design andDevelopment Strategy

Release 3

$11 1,891QE s/20r8

Task 4,{ (R3) - Test Plan Release 3 $59,675 QE 6/2018Task 54 (R3) - Training Plan Release 3 $59,675 QE s/20r8Task 6A (R3) -Deployment Plan Release 3 $59,675 QE 3/2018Task 48 (R3) - Test Scenarios,

Test Cases and Test Scripts

Release 3$23,870 QE 6/2018

Task 4C (R3) -DocumentedSystem Test Results

Release 3$119,351 QE 6/2018

Task 58 (R3) - Training Manuals,End-User Guides and MaterialsUpdates

Release 3

$59,675QE 6/2018


Release 3$23,870 QE 6/2018

Task 6C (R3) - CompletedDetailed Functional and TechnicalSpecifications Traceability Matrix

Release 3

$238,702QE 6/2018

Task 5C Conduct Training - R3 Release 3 $11,935 QE 6/2018

Srarn or Vnnuoxt, CoNtru.ctDnpl,RtunN orVnnuoNr Hn,q.r,rnAccnssEQ Hnar,ru Sor,urroNs, INc.

P.c.crc 247 or 268Conrru,cr 28739

AunNuunxr #2

Task 5D (R3) - Documented

Evidence of Successful End-UserLearning

Release 3

$119,351QE 6/2018

Task 7A R3 Readiness Approval Release 3 $44,756 QE 6/2018

Task 6E Deployment (R3) Release 3 944,756.0 QE 6/2018

Task 6F (R3) - Performance SLAs Release 3 $t79,026 QE 6/2018

Task 6D (R3) - System Source

Code and Documentation

Release 3,

After 7-B $59,675QE 9/2018

Task 78 (R3) - Complete R3

Phase Close Out

Release 3$172,059

81,387,942QE 6/2018

Task 7C Closeout Deliverable -

Document Compendium Gap

Analysis

Before 7F

$72,454 QE e/2018

Task 7D Closeout Deliverable -Document Compendium Updates

Before 7F$72,454

QE 9/2018

Task 7E Closeout Deliverable -Maintenance and OperationsGuide

Before 7F

$140,646QE 9/2018

Task 9D - Closeout DeliverableVCCI System AdministratorManual

Before 7F

$r40,647QE 9/2018

Task 7F - Closeout Deliverable -

System Acceptance/Proj ect

Closeout

End of DDIProject before

tullM&Obegins

$477,402

$903,60s

QE e/2018

Task 8A Care Management

Subsystem Certification Planning

Project$179,026

QE 6/2018

Task 88 Develop CertificationReview Criteria and TestingScenarios

Project$179,026

QE 9/2018

Task 8C Certification Readiness

Assessment

Project$779,026 QE 9/2018

Task 8D Certification Review and

Acceptance

Project$r79,026

$716,104

QE r2/2018

Task 9,A. - System IncidentReports -M&O (Until FullDeployment) One-time payment,

reports due monthly

R1 $119,351 *

Paid after allRl deployedand approved

QE 9/2017

Task 98 - Adaptive Maintenance

Reports (Until Full Deployment)One-time payment, reports due

monthly

R1

$119,351 *QE e/2017

St,l'rn or VnnuoNr, CoxrucrDnplntunNT oF VunuoNr Hn^lLrH AccnssEQ Hrlr,rn Sor,urroNs, Ixc.

Pacn 248o1268Conrru,cr 28739

ANrnNnrvrnNr #2

Task 9C - System EnhancementReports (Until Full Deployment)One-time payment, reports duemonthly

R1 $358,052 *

Not paid untilall parts of Rlare deployedand approved $s96,754

QE 9/2017

$11,r75,047Task 0 Project Status Reports -Monthly at$2,983.77

Ongoing$t79,026

$179,026TOTAL Task Deliverables $11,354,073Hosting & Disaster RecoverySupport Until Full Deployment(Quarterly)

Quarterly $5,700.0

xAll deliverables and artifacts shall be monitored by the Contractor and updated, as needed.

d. The Contractor will provide the packaged software, Maintenance and OperationsActivities related, Hosting & Disaster Recovery and hardware costs listed below on afixed price basis. Following is the payment schedule.

Table B-5 Maintenance and Schedule

Healthwise (Enterprise License)FirstDatabank (Enterprise License)Geocoding (Web Service Subscription)Coding Libraries (CPT, ICD9-10 APDRG etc.) (EnterpriseAccess with Annual Updates)in-Rule (Business Rule Management System) (EnterpriseAccess, with 5 User Licenses)Mirth Match (Enterprise License)

Quality Reporting (Per Member Per Month Licensing)Johns Hopkins ACG (Predictive Modeling) (Per Member PerMonth Licensing)eQHealth eQSuite@ (Per Member Per Month Licensing)

Monthly $ 53,563 *

*Until all packaged sbftware is in use, cost is as follows: Monthly $ 51,438

Packaged Software Frequency Total Cost

On-goingData Loads

SystemIncidentReports

Monthly $100,425 $122,352 $141,450 $141,958 $141,805 $141,805 $141,824

M&OActivities

YEAR3

YEAR YEAR67Frequency

1 ) 4 5

YEAR YEAR YEAR YEAR

Srnrn or Vnnvroxr, CoNrRl,crDnpanrvrcNT oF VnnvroNr Hnll,rn AccnssEQ Hnnr,ru SolurroNs, INC.

P^q.cn 249 ot268Conrru,cr 28739

AvrnNoprnNr #2

AdaptiveMaintenanceReports

SystemEnhancementReports

Web-based

State trainingon SystemEnhance-ments

Performance

SLAsHosting &DisasterRecoverySupport

Quarterly 0 0 $12,375 $12,375 $72,375 $12,375 $12,375

e. Change RequestsWork performed under Change Requests called out in Table B-1 shall not exceed

$1,057,731during the life of the contract and is designated for DDI and M&O. TheChange Request line-item shall be billed per hour as utilized. As of contract execution,the base rate for Change Request development hours is $115.00 per houf and remains atthat rate throughout completion of the Design, Development and Implementation (DDI)phase. Change Request development hours are not expended for new project proposaldevelopment.

Any unused DDI Change Request funds may be carried over to the following year.

Unused M&O Change Request funds may not be carried over to the following year.

Change Request hourly rates during the Maintenance and Operations phase will be as

follows:

8. Implementation of Other Programs.The implementation of other AHS Programs shall be based on the houfly rate for additionalprogram services. Composite hourly rates will be as follows:

9. Retainase. The State will hold back I}Yo of each DDI deliverable payment and DDI ChangeRequest payment as retainage. Contractor rnay submit a single invoice for all retainage withheld

n/a nla $118 $118 $120Year 1 Year 2 Year 3 Yeat 4 Year 5

$11s $1 1s $1 18 $118 $120Year 1 Year 2 Year 3 Year 4 Year 5

Srnrr or VnnvroNr, CoNrucrDppanrvrnNT oF VnnnnoNr Hr.ql,rn AccnssEQ Hrar,ru Sor,urroNs, INc.

PacB 250 or 268CoNrnlcr 28739

AvrnNnvrnNr #2

six (6) months after the acceptance by the State of each deliverable, which will be paid to theContractor in full, subject to the terms and conditions of the Contract.

The State will hold back l0%o retainage for Maintenance and Operations, M&O ChangeRequests, Hosting, and Disaster Recovery, which can be requested by the Contractor.90-daysafter the initial invoice is submitted.

The State will not hold back any retainage on packaged software and hardware related payments

Payment of each invoice is due within thirty (30) days of receipt.

L0. Pavment Disputes.In order to dispute an invoice, or any part thereof, the State must set forth in writing theamount(s) disputed and the specific basis or reason for the dispute, which shall be reasonablydetailed and not general or speculative in nature (hereinafter referred to as "Payment DisputeNotice"). The State shall forward a Pa5rment Dispute Notice to Contractor on or prior to the duedate of the invoice disputed. The State shall not dispute any invoice unless the State believes, ingood faith, that the State is being charged for Services that have not been provided or at priceshigher than those set forth in this agreement, or that manifest effors in calculation or the likehave occurred, or that the State is otherwise being charged for items contrary to work describedin the Attachment A of this contract.

Upon compliance with the foregoing provisions, the State may, at its option, withhold paymentof the disputed amount(s) of the invoice, and shall remit to Contractor the undisputed amount(s),if any, in a timely manner. Upon receipt of the Payment Dispute Notice, both parties shall makereasonable, diligent, good faith efforts to resolve the dispute as soon as possible in accordancewith the dispute resolution procedures set forth below:

il. General. Unless specifically provided otherwise in this agreement, any dispute orcontroversy between the parties hereunder shall be resolved as provided in this Section. Adispute over payment will not entitle Contractor to withhold, suspend or decrease itsrequired performance under this Agreement. Contractor shall continue performing itsobligations hereunder while the parties are seeking to resolve,any dispute in accordancewith this Article, unless and until such obligations are terminated or expire in accordancewith the provisions of this agreement and the existence of such dispute shall not relievethe Contractor of any of its obligations under this agreement.

b. Informal Dispute Resolution. The parties may attempt to resolve any dispute orcontroversy hereunder, informally by submitting the dispute, in writing, to ProjectManagers responsible for the State and the Contractor ("Project Managers"),the State'sVendor Manager, and the State's general counsel (collectively referred to as "InformalDispute Resolution Team") who shall meet in person or by telephone conference call inan effort to resolve the dispute, as often as they deem necessary to gather and analyze anyinformation relevant to the resolution of the dispute, but not less than once every day.

Surn or Vnnivront, CoNtnn ctDnp.qnrNInNT oF' VBnuoNr Hrar,rn AccESSEQ Hna.r,rn Sor.urroNso lltc.

1.

11.

P.lcn 251ot268CoNrnlcr 28739

AnnrNounNr #2

During the course of attempting to resolve the dispute informally, all reasonable

requests for non-privileged information related to the dispute, made by one party to

the other, shall be honored; provided, however, in attempting to resolve the dispute,

the conduct and activities of the parties, any offers of compromise, all settlement

proposals andlor information exchanged shall: (i) be considered information that is

confidential and proprietary to each of the parties and therefore, prohibited from

disclosure by either of them; (ii) be considered settlement discussions, and shall be

inadmissible in any subsequent proceedings; and (iii) in no way be construed or

deemed to preclude, prohibit or restrict either PaftY, at any time or in any manner,

from proceeding to litigation or otherwise exercisingany right or remedy available to

it under this agreement, at law or in equity.If the Informal Dispute Resolution Team determines in good faith that resolution

through continued discussions does not appear likely or if the dispute is not resolved

within five (5) business days after the dispute has been submitted in writing, either

Party may notify the other Party and this notification shall escalate the dispute

(hereinafter referred to as an "Escalation Notice"). To escalate the dispute the

following procedure must be followed:

1) The Informal Dispute Resolution Team shall gather any additional information. relevant to the resolution of the dispute and which may be necessary and

appropriate for presentation to the Contractor Account Director and an executive

designated by the State responsible for the Services involved in such dispute.

2) The Informal Dispute Resolution Team shall, within fifteen (15) business days

after the Escalation Notice has been given, submit a report to the Contractor

Account Director and Executive designated by the State (hereinafter referred to as

"State Executive") which includes a description of the nature, extent and basis ofthe dispute, how the dispute arose, the U.S. dollar amount involved in the dispute,

any agreed upon statements of fact , a fair, accurate and complete representation ofthe positions of each of the parties in the dispute, and any other informationrelevant to the dispute, including information that represents agreed upon

stipulations and statements of fact, as well as points of disagreement between the

parties (hereinafter referred to as the "Report";. The Report shall include one or

more recofirmendations and alternatives, which the parties believe the Contractor

Account Director, and designated State Executive should consider. A descriptiqnof the projected impact of the failure to resolve the dispute promptly and amicablyshall also be included in the submission. Each Party may include separate

statements of impact, recommendations or other information to the extent any ofthe Parties cannot or do not agree on particular items.

3) Not later than ten (10) days after the Report in connection with any dispute is

submitted the Contractor Account Director and designated State Executive forreview, they shall meet in an attempt to resolve the dispute. Either Party may

request additional information, material, advice and input from individuals and

organizations inside or outside the State and Contractor's organization.4) If the Contractor Account Director and designated State Executive are unable to

resolve the dispute within five (5) business days after the aforesaid meeting date,

Srarn or Vrnvront, CoNtrucrDnplnrunNT oF VnnuoNr llw,rn AccnssEQ Hnlr,rn Sor,urroNso INc.

Prcn 252ot268CoNrnlcr 28739

AvraNrivmNr#2

the parties may mutually agree to refer the dispute to non-binding mediation,which shall be conducted using the rules and procedures promulgated by theAmerican Arbitration Association, applicable to mediation in a location to beagreed upon in Vermont, where the parties agree all such proceedings shall beconducted. Such mediation shall be conducted by a qualified neutral, independentthird-party mediator, knowledgeable in the subject matter of the dispute and, if theparties cannot agree upon a mediator, each party shall select such a mediator andthe two (2) mediators so selected shall mutually agree upon a third and themediation shall, in that case, be conducted by a panel of the three (3) mediators soselected. Each party shall bear its own expenses and an equal share of theexpenses of the mediator(s) and the any related fees.

5) If the Parties accept and agree to the mediators'recommondations or otherwisereach agreement resolving the dispute, such agreement shall be made in writingand once duly executed, shall be binding on the parties; provided, however, thatfor the avoidance of any doubt or ambiguity, nothing in this agreement shall beconstrued as restricting, prohibiting, preventing or otherwise impairing eitherparty from proceeding to litigation, instituting judicial or other proceedings,including a formal claim or legal action, or from pursuing any and all other legal,equitable or contractual remedies available to such party, at any time.Notwithstanding anything in this agreement to the contrary, the State shall notagree to arbitration and the State shall not waive any right to a trial by jury.

Sr.trn or VnnnnoNt, CoNtnactDnp.c.nrvrnNT oF VnnvroNr IInlLrH AccBssEQ Hr.a.r,rn SolurroNs, INc.

P.tcn 253 or 268CoNrnlcr 28739

AvrnxounNr #2

ATTACHMENT C: STANDARD STATE PROVISIONSFOR CONTRACTS AND GRANTS

REvISED DEcEMBER 15, 2017

1. Definitions: For purposes of this Attachment, "Party" shall mean the Contractor, Grantee or

Subrecipient, with whom the State of Vermont is executing this Agreement and consistent with the form ofthe Agreement. "Agreement" shall mean the specific contract or grant to which this form is attached.

2. Entire Agreement: This Agreement, whether in the form of a contract, State-funded grant, or Federally-

funded gtuttt, t"p.esents the entire agleement between the parties on the subject matter. A11 prior

agreements, representations, statements, negotiations, and understandings shall have no effect.

3. Governing Law, Jurisdiction and Venuel No Waiver of Jury Trial: This Agreement will be govemed

by the laws of the State of Vermont. Any action or proceeding brought by either the State or the Party inconnection with this Agreement shall be brought and enforced in the Superior Court of the State of Vermont,

Civil Division, Washington Unit. The Party irrevocably submits to the jurisdiction of this court for any

action or proceeding regarding this Agreement. The Party agrees that it must fnst exhaust any applicable

administrative remedies with respect to any cause of action that it may have against the State with regard

to its performance under this Agreement. Party agrees that the State shall not be required to submit to

binding arbitration or waive its right to a jury trial.

4. Sovereign Immunity: The State reserves all immunities, defenses, rights or actions arising out of the

State's sovereign status or under the Eleventh Amendment to the United States Constitution. No waiver ofthe State's immunities, defenses, rights or actions shall be implied or otherwise deemed to exist by reason

of the State's entry into this Agreement.

5. No Employee Benefits tr'or Party: The Party understands that the State will not provide any individual

retiremenl benefits, group life insurance, group health and dental insurance, vacation or sick leave, workers

compensation or other benefits or services available to State employees, nor will the State withhold any

state or Federal taxes except as required under applicable tax laws, which shall be determined in advance

of execution of the Agreement. The Party understands that all tax retums required by the Internal Revenue

Code and the State of Vermont, including but not limited to income, withholding, sales and use, and rooms

and meals, must be filed by the Party, and information as to Agreement iqcome will be provided by the

State of Vermont to the Internal Revenue Service and the Vermont Department of Taxes.

6. Independence: The Party will act in an independent capacity and not as officers or employees of the

State.

7. Defense and Indemnity: The Party shall defend the State and its officers and employees against all thirdparty claims or suits arising in whole or in part from any act or omission of the Party or of any agent of the

Party in connection with the performance of this Agreement. The State shall notify the Party in the event

of any such claim or suit, and the Party shall immediately retain counsel and otherwise provide a complete

defense against the entire claim or suit. The State retains the right to participate at its own expense in the

defense of any claim. The State shall have the right to approve all proposed settlements of such claims or

suits.

After a final judgment or settlement, the Party may request recoupment of specific defense costs and may

file suit in Washington Superior Court requesting recoupment. The Party shall be entitled to recoup costs

only upon a showing that such costs were entirely unrelated to the defense of any claim arising from an act

or omission of the Party in connection with the performance of this Agreement.

Sr,trn or Vrnvronr, CoNtnacrDnpmrvrnNT oF VnnvroNr HEALTH AccnssEQ Hnllrn Sor,urroNso INc.

PacB 254or268CoNrRacr 28739

AnnBNovrnivr #2

The Party shall indemnifu the State and its officers and employees if the State, its officers or employeesbecome legally obligated to pay any damages or losses arising from any act or omission of the Party or anagent of the Party in connection with the performance of this Agreement.

Notwithstanding any contrary language anywhere, in no event shall the terms of this Agreement or anydocument furnished by the Party in connection with its performance under this Agreement obligate theState to (1) defend or indemnify the Party or any third party, or (2) otherwise be liable for the expenses orreimbursement, including attorneys' fees, collection costs or other costs of the Party or any third party.

8. Insurance: Before commencing work on this Agreement the Party must provide certificates of insuranceto show that the following minimum coverages are in effect. It is the responsibility of the Party to maintaincurrent certificates of insurance on file with the State through the term of this Agreement. No warranty ismade that the coverages and limits listed herein are adequate to cover and protect the interests of the Partyfor the Party's operations. These are solely minimums that have been established to protect the interests ofthe State.

Workers Compensation: With respect to all operations performed, the Party shall carry workers'compensation insurance in accordance with the laws of the State of Vermont. Vermont will accept an out-of-state employer's workers' compensation coverage while operating in Vermont provided that theinsurance carrier is licensed to write insurance in Vermont and an amendatory endorsement is added to thepolicy adding Vermont for coverage purposes. Otherwise, the party shall secure a Vermont workers'compensation policy, if necessary to comply with Vermont law.

General Liability and Property Damage: With respect to all operations performed under this Agreement,the Party shall carry general liability insurance having all major divisions of coverage including, but notlimited to:

Premises - Operations

Products and Completed Operations

Personal Inj.rry LiabilityContractual LiabilityThe policy shall be on an occurrence form and limits shall not be less than:

$1,000,000 Each Occurrence

$2,000,000 General Aggregate

$ 1, 000,000 Products/Completed Operations Aggregate

$1,000,000 Personal & Advertising InjuryAutomotive Liability: The Party shall carry automotive liability insurance covering all motor vehicles,including hired and non-owned coverage, used in connection with the Agreement. Limits of coverage shallnot be less than $500,000 combined single limit. If performance of this Agreement involves construction,or the transport of persons or hazardous materials, limits of coverage shall not be less than $1,000,000combined single limit.

Additional Insured. The General Liability and Property Damage coverages required for performance of thisAgreement shall include the State of Vermont and its agencies, departments, officers and employees asAdditional Insureds. If performance of this Agreement involves construction, or the transport of personsor hazardous materials, then the required Automotive Liability coverage shalt include the State of Vermontand its agencies, departments, officers and employees as Additional Insureds. Coverage shall be primaryand non-contributory with any other insurance and self-insurance.

Notice of Cancellation or Change. There shall be no cancellation, change, potential exhaustion of aggregatelimits or non-renewal of insurance coverage(s) without thirty (30) days written prior written notice to theState.

Sr.q.rn or VBnuoNt, CoNtructDnpaRrvrnNT oF VBnvroNr Hnm,tn AccnssEQ Hn.Llrn Sor.urroxso INc.

P.q.cn 255 or 268CoNrru,cr 28739

AvrnnrvrnNr #2

9. Reliance by the State on Representations: All payments by the State under this Agreement will be

made in reliance upon the accuracy of all representations made by the Party in accordance with this

Agreement, including but not limited to bills, invoices, progress reports and other proofs of work.

1"0. False Claims Act: The Party acknowledges that it is subject to the Ve?mont False Claims Act

as set forth in 32 V.S.A. $ 630 et seq. If the Party violates the Vermont False Claims Act it shall

be liable to the State for civil penalties, treble damages and the costs of the investigation and

prosecution of such violation, including attorney's fees, except as the same may be reduced by a

iourt of competent jurisdiction. The Party's liability to the State under the False Claims Act shall

not be limited notwithstanding any agreement of the State to otherwise limit Party's liability.

11. Whistleblower Protections: The Party shall not discriminate or retaliate against one of itsemployees or agents for disclosing information concerning a violation of law, fraud, waste, abuse

of authority or acts threatening health or safety, including but not limited to allegations concerning

the False Claims Act. Further, the Party shall not require such employees or agents to forego

monetary awards as a result of such disclosures, nor should they be required to report misconduct

to the Party or its agents prior to reporting to any govemmental entity andlot the public.

12. Location of State Data: No State data received, obtained,.or generated by the Party in connection withperformance under this Agreement shall be processed, transmitted, stored, or transferred by any means

outside the continental United States, except with the express written permission of the State.

13. Records Available for Audit: The Party shall maintain all records pertaining to performance under

this agreement. o'Records" means any written or recorded information, regardless of physical form or

characteristics, which is produced or acquired by the Party in the performance of this agreement. Records

produced or acquired in a machine readable electronic format shall be maintained in that format. The

iecords described shall be made available at reasonable times during the period of the Agreement and for

three years thereafter or for any period required by law for inspection by any authorized representatives ofthe State or Federal Govemment. If any litigation, claim, or audit is started before the expiration of the

three-year period, the records shall be retained until all litigation, claims or audit findings involving the

records have been resolved.

14. Fair Employment Practices and Americans with Disabilities Act: Party agrees to comply with the

requirement of 21 V.S.A. Chapter 5, Subchapter 6, relating to fair employment practices, to the full extent

applicable. Party shall also ensure, to the fulI extent required by the Americans with Disabilities Act of1990, as amended, that qualified individuals with disabilities receive equitable access to the services,

programs, and activities provided by the Party under this Agreement.

15. Set Off: The State may set off any sums which the Party owes the State against any sums due the Party

under this Agreement; provided, however, that any set off of amounts due the State of Vermont as taxes

shall be in accordance with the procedures more specifically provided hereinafter.

16. Taxes Due to the State:

A. Party understands and acknowledges responsibility, if applicable, for compliance with State tax

laws, including income tax withholding for employees performing services within the State,

payment of use tax on property used within the State, corporate and/or personal income tax on

income eamed within the State.

Sr,lrn or VrnvroNro CoNrucrDnpaRtvrnNT oF Vnnvrorvr IIn.c.LrH AccnssEQ Hnru,ru Sor,urroNs, INc.

Pacn 256oF268CoNrnlcr 28739

AvrnNnvrnNr #2

B. Party certifies under the pains and penalties of perjury that, as of the date this Agreement is signed,the Party is in good standing with respect to, or in full compliance with, a plan to pay any and alltaxes due the State of Vermont.

C. Party understands that final payment under this Agreement may be withheld if the Commissionerof Taxes determines that the Party is not in good standing with respect to or in full compliance witha plan to pay any and all taxes due to the State of Vermont.

D. Party also understands the State may set off taxes (and related penalties, interest and fees) due tothe State of Vermont, but only if the Party has failed to make an appeal within the time allowed bylaw, or an appeal has been taken and finally determined and the Party has no further legal recourseto contest the amounts due.

17. Taxation of Purchases: All State purchases must be invoiced tax free. An exemption certificate willbe furnished upon request with respect to otherwise taxable items.

18. Child Support: (Only applicable if the Party is a natural person, not a corporation or partnership.) Partystates that, as of the date this Agreement is signed, he/she:

A. is not under any obligation to pay child support; orB. is under such an obligation and is in good standing with respect to that obligation; orC. has agreed to a payment plan with the Vermont Office of Child Support Services and is in full

compliance with that plan.

Party makes this statement with regard to support owed to any and all children residing in Vermont. lnaddition, if the Party is a resident of Vermont, Party makes this statement with regard to support owed toany and all children residing in any other state or territory of the United States.

19. Sub-Agreements: Party shall not assign, subcontract or subgrant the performance of this Agreementor any portion thereof to any other Party without the prior written approval of the State. Party shall beresponsible and liable to the State for all acts or omissions of subcontractors and any other personperforming work under this Agreement pursuant to an agreement with Party or any subcontractor.In the case this Agreement is a contract with a total cost in excess of $250,000, the party shall provide tothe State a list ofall proposed subcontractors and subcontractors' subcontractors, together with the identityof those subcontractors' workers compensation insurance providers, and additional required or requestedinformation, as applicable, in accordance with Section 32 of The Vermont Recovery and Reinvestment Actof 2009 (Act No. 54).

Party shall include the following provisions of this Attachment C in all subcontracts for work performedsolely for the State of Vermont and subcontracts for work performed in the State of Vermont: Section 10("False Claims Act"); Section 11 ("Whistleblower Protections"); Section 12 ("Location of State Data");Section 14 ("Fair Employment Practices and Americans with Disabilities Act"); Section 16 ("Taxes Duethe State"); Section 18 ("Child Support"); Section 20 ("No Gifts or Gratuities"); Section 22 (*CefiifrcationRegarding Debarment"); Section 30 ("State Facilities"); and Section 32.A (*Certification Regarding Useof State Funds").

20. No Gifts or Gratuities: Party shall not give title or possession of anlhing of substantial value(including property, curency, travel and/or education programs) to any officer or employee of the Stateduring the term of this Agreement.

21. Copies: Party shall use reasonable best efforts to ensure that all written reports prepared under thisAgreement are printed using both sides of the paper.

Sr.lrn or VnnvroNto CoNtru,ctDEPARTMENT OF VNNUONT HN.q.LTH ACCNSS

EQ Hr,lr,ur Sor,urroNs, INc.

Pacn 257 o1268Coxrru.cr 28739

AvrnNnunNr#2

22. Certifrcation Regarding Debarment: Party certifies under pains and penalties of perjury that, as ofthe date that this Agreement is signed, neither Party nor Party's principals (officers, directors, owners, or

partners) are presently debarred, suspended, proposed for debarment, declared ineligible or excluded fromparticipation in Federal programs, or programs supported in whole or in part by Federal funds.

Party further certifies under pains and penalties of perjury that, as of the date that this Agreement is signed,

Party is not presently debarred, suspended, nor named on the State's debarment list at:

http ://b gs.vermont. gov/purchasing/debarment

23. Conflict of Interest: Party shall fully disclose, in writing, any conflicts of interest or potential

conflicts of interest.

24. Confidentiality: Party acknowledges and agrees that this Agreement and any and all

information obtained by the State from the Party in connection with this Agreement are subject to

the State of Vermont Access to Public Records Act, 1 V.S.A. $ 315 et seq.

25. Force Majeure: Neither the State nor the Party shall be liable to the other for any failure or

delay of performance of any obligations under this Agreement to the extent such failure or delay

shall have been wholly or principally caused by acts or events beyond its reasonable control

rendering performance illegal or impossible (excluding strikes or lock-outs) ("Force Majeure").

Where Force Majeure is asserted, the nonperforming party must prove that it made all reasonable

efforts to remove, eliminate or minimize such cause of delay or damages, diligently pursued

performance of its obligations under this Agreement, substantially fulfilled all non-excused

obligations, and timely notified the other party of the likelihood or actual occurrence of an event

described in this paragraph.

26. Marketing: Party shall not refer to the State in anypublicitymaterials, information pamphlets,

press releases, research reports, advertising, sales promotions,trade shows, or marketing materials

or similar communications to third parties except with the prior written consent of the State.

2T.Termination:A. Non-Appropriation: If this Agreement extends into more than one fiscal year of the State

(July 1 to June 30), and if appropriations are insufficient to support this Agreement, the

State may cancel at the end of the fiscal year, or otherwise upon the expiration of existing

appropriation authority. In the case that this Agreement is a Grant that is funded in wholeor in part by Federal funds, and in the event Federal funds become unavailable or reduced,

the State may suspend or cancel this Grant immediately, and the State shall have no

obligation to pay Subrecipient from State revenues.

B. Termination for Cause: Either party may terminate this Agreement if aparty materially

breaches its obligations under this Agreement, and such breach is not cured within thirty(30) days after delivery of the non-breaching party's notice or such longer time as the non-

breaching party may specify in the notice.

C. Termination Assistance: Upon nearing the end of the final term or termination of this

Agreement, without respect to cause, the Party shall take all reasonable and prudent

measures to facilitate any transition required by the State. A11 State property, tangible and

Srarn or Vunuoxr, CoNrucrDrpantnrnNT oF Vnnvroivr Hal.LrH AccnssEQ Hnu,rn Sor,urroNs, INc.

Pacn 258 or 268CoNrnlcr 28739

AvrnNlvrnnr #2

intangible, shall be returned to the State upon demand at no additional cost to the State ina format acceptable to the State.

28. Continuity of Performance: In the event of a dispute between the Party and the State, eachparty will continue to perform its obligations under this Agreement during the resolution of thedispute until this Agreement is terminated in accordance with its tqrms.

29. No Implied Waiver of Remedies: Either party's delay or failure to exercise qny right, poweror remedy under this Agreernent shall not impair any such right, power or remedy, or be construedas a waiver of any such right, power or remedy. All waivers must be in writing.

30. State Facilities: If the State makes space available to the Party in any State facility during theterm of this Agreement for purposes of the Party's performance under this Agreement, the Partyshall only use the space in accordance with all policies and procedures governing access to anduse of State facilities which shall be made available upon request. State facilities will be madeavailable to Party on an "AS IS, WHERE IS" basis, with no warranties whatsoever.

31. Requirements Pertaining Only to Federal Grants and Subrecipient Agreements: If this Agreementis a grant that is funded in whole or in part by Federal funds:

A. Requirement to Have a Single Audit: The Subrecipient will complete the Subrecipient ArurualReport annually within 45 days after its fiscal year end, informing the State of Vermont whether ornot a Single Audit is required for the prior fiscal year. If a Single Audit is required, the Subrecipientwill submit a copy of the audit report to the granting Party within 9 months. If a single audit is notrequired, only the Subrecipient Annual Report is required.

For fiscal years ending before December 25,2015, a Single Audit is required if the subrecipientexpends $500,000 or more in Federal assistance during its fiscal year and must be conducted inaccordance with OMB Circular ,4.-133. For fiscal years ending on or after December 25,2075, aSingle Audit is required if the subrecipient expends $750,000 or more in Federal assistance duringits fiscal year and must be conducted in accordance with 2 CFR Chapter I, Chapter II, Part 200,Subpart F. The Subrecipient Annual Report is required to be submitted within 45 days, whether ornot a Single Audit is required.

B. Internal Controls: In accordance with 2 CFR Part II, $200.303, the Party must establish andmaintain effective internal control over the Federal award to provide reasonable assurance that theParty is managing the Federal award in compliance with Federal statutes, regulations, and the termsand conditions of the award. These internal controls should be in compliance with guidance in"Standards for Internal Control in the Federal Govemment" issued by the Comptroller General ofthe United States and the "lrtemal Control lntegrated Framework", issued by the Committee ofSponsoring Organizations of the Treadway Commission (COSO).

C. Mandatory Disclosures: ln accordance with 2 CFR Part II, $200.113,Party must disclose, in atimely manner, in writing to the State, all violations of Federal criminal law involving fraud,bribery, or gratuity violations potentially affecting the Federal award. Failure to make requireddisclosures may result in the imposition of sanctions which may include disallowance of costsincurred, withholding of payments, termination of the Agreement, suspension/debarment, etc.

Srarn or VnnvroNt, CoNtn,n'ctDnpl,nrunNT oF VERMoNT HBar,ru AccnssEQ Hnar,rn Sor,urroNs, INc.

Plcn 259 or 268CoNrm,cr 28739

AvrnNnvrnirr #2

32. Requirements Pertaining Only to State-Funded Grants:

A. Certification Regarding Use of State Funds: If Party is an employer and this Agreement is aState-funded grant in excess of $1,001, Party certifies that none of these State funds will be used to

interfere with or restrain the exercise of Party's employee's rights with respect to unionization.

B. Good Standing Certification (Act 154 of 2016): If this Agreement is a State-funded grant, Party

hereby represents: (i) that it has signed and provided to the State the form prescribed by the

Secretary of Administration for purposes of certi$ing that it is in good standing (as provided inSection 13(aX2) of Act 154) with the Agency of Natural Resources and the Agency of Agriculture,

Food and Markets, or otherwise explaining the circumstances surrounding the inability to so certify,

and (ii) that it will comply with the requirements stated therein.

(End of Standard Provisions)

Sr.q.rn or VnnvroNro CoNrnacrDnpanrivrnNT oF VnnvroNr Hnar,rn AccnssEQ Hnlr ru Sor,urroNs,INc.

PlcB 260 or 268Colsrnacr 28739

AvrnNovmNr#2

ATTACHMENT FAGENCY OF HUMAN SERVICES' CUSTOMARY CONTRACT PROVISIONS

1. Definitions: For purposes of this Attachment F, the term o'Agreement" shall mean the form ofthe contract or grant, with all of its parts, into which this Attachment F is incorporated. Themeaning of the term "Party" when used in this Attachment F shall mean any named party to thisAgreement other than the State of Vermont, the Agency of Human Services (AHS) and any ofthe departments, boards, offices and business units named in this Agreement. As such, theterm "Party'' shall mean, when used in this Attachment F, the Contractor or Grantee with whomthe State of Vermont is executing this Agreement. If Party, whenpermittedto do so underthis Agreement, seeks by way of any subcontract, sub-grant or other form ofprovider agreementto employ any other person or entity to perform any of the obligations of Party under thisAgreement, Party shall be obligated to ensure that all terms of this Attachment F are followed.As such, the term *Partt''as

used herein shall also be construed as applicable to, and describingthe obligations of, any subcontractor, sub-recipient or sub-grantee of this Agreement. Any suchuse or construction of the term "Party'' shall not, however, give any subcontractor, sub-recipientor sub-grantee any substantive right in this Agreement without an express written agreement tothat effect by the State of Vermont.

2. Agencv of Human Services: The Agency of Human Services is responsible for overseeingall contracts and grants entered by any of its departments, boards, offices and business units,however denominated. The Agency of Human Services, through the business office of theOffice of the Secretary, and through its Field Services Directors, will share with any namedAHS-associated party to this Agreemenl oversight, monitoring and enforcementresponsibilities. Party agrees to cooperate with both the named AHS-associated party to thiscontract and with the Agency of Human Services itself with respect to the resolution of anyissues relating to the performance and interpretation of this Agreement, payment matters andlegal compliance.

3. Medicaid Prosram Parties (applicable to any Party providing services and supports paidforunder Vermont's Medicaid program and Vermont's Global Commitment to Health Waiver);

Inspection and Retention of Records: In addition to any other requirement under thisAgreement or at law, Partymust fulfill all state and federal legal requirements, and will complywith all requests appropriate to enable the Agency of Human Services, the U.S. Department ofHealth and Human Services (along with its Inspector General and the Centers for Medicareand Medicaid Services), the Comptroller General, the Government Accounting Office, or anyof their designees: (i) to evaluate through inspection or other means the quality,appropriateness, and timeliness of services performed under this Agreement; and (ii) to inspectand audit any records, financial data, contracts, computer or other electronic systems of Partyrelating to the performance of services under Vermont's Medicaid program and Vermont'sGlobal Commitment to Health Waiver. Party will retain for ten years all documents requiredto be retained pursuant to 42 CFR a38.3(u).

Sr.trn or VnnvroNt, CoNtru,ctDnpanrivrrNT oF VpnvroNr IIn,q,LrH AccnssEQ Hn.nlru Sor.uuoNs, INc.

Prcn 261o1268CoNrru.cr 28739

AnnnnrunNr #2

4

Subcontractins for Medicaid Services: Notwithstanding any permitted subcontracting ofservices to be performed under this Agreement, Party shall remain responsible for ensuring

that this Agreement is fully performed according to its terms, that subcontractor remains incompliance with the terms hereof, and that subcontraotor complies with all state and federal

laws and regulations relating to the Medicaid program in Vermont. Subcontracts, and any

service provider agreements entered into by Party in connection with the performance of this

Agreement, must clearly specify in writing the responsibilities of the subcontractor or other

service provider and Party must retain the authority to revoke its subcontract or service

provider agreement or to impose other sanctions if the performance of the subcontractor or

service provider is inadequate or if its perfofinance deviates from any requirement of this

Agteement. Party shall make available on request all contracts, subcontracts and service

provider agreements between the Party, subcontractors and other service providers to the

Agency of Human Services and any of its departments as well as to the Center for Medicare

and Medicaid Services.

Medicaid Notificution of Termination Requirements: Party shall follow the Department ofVermont Health Access Managed-Care-Organization enrollee-notification requirements, to

include the requirement that Party provide timely notice of any termination of its practice.

Encounter Data; Party shall provide encounter data to the Agency of Human Services andlot

ttr d"p"rt"r"tttr ""d

ensure further that the data and services provided can be linked to and

supported by enrollee eligibility files maintained by the State.

Federal Medicaid Svstem Securitv Requirements Compliance: Party shall provide a security

plan, risk assessment, and security controls review document within three months of the start

date of this Agreement (and update it annually thereafter) in order to support audit compliance

with 45 CFR 95.621 subpart F, ADP System Security Requirements and Review Process.

Workplace Vrolence Preventio (applicable to any Party and any

subcontractors and sub-grantees whose employees or otlter service providers deliver social ormental health services directly to individual recipients of such sbrvices):

Party shall establish a written workplace violence prevention and crisis response policymeeting the requirements of Act 109 (2016), 33 VSA $S201(b), for the benefit of employees

delivering direct social or mental health services. Party shall, in preparing its policy, consult

with the guidelines promulgated by the U.S. Occupational Safety and Health Administrationfor Preventing Worlcplace Violence for Healthcare and Social Services Workers, as those

guidelines may from time to time be amended.

Party,through its violence protection and crisis response committee, shall evaluate the efficacy

of its policy, and update the policy as appropri ate, atleast annually. The policy and any written

evaluations thereof shall be provided to employees delivering direct social or mental health

services.

Srarn or VnnuoNr, CoNrrucrDnplnrvrnNT oF' VnnuoNr Hrar,rn AccrssEQ Hnar,rn Solurrons, Ir,rc.

Pncn 262 or268CoNrnc.cr 28739

AmrNrvrcNr #2

Party will ensure that any subcontractor and sub-grantee who hires employees (or contractswith service providers) who deliver social or mental health services directly to individualrecipients of such services, complies with all requirements of this Section.

5. Non-Discrimination:

Party shall not discriminate, and will prohibit its employees, agents, subcontractors, sub-grantees and other service providers from discrimination, on the basis of age under the AgeDiscrimination Act of I975, on the basis of handicap under section 504 of the RehabilitationAct of 1973, on the basis of sex under Title IX of the Education Amendments of 1972, and onthe basis of race, color or national origin under Title VI of the Civil Rights Act of 1964. Partyshall not refuse, withhold from or deny to any person the benefit of services, facilities, goods,privileges, advantages, or benefits of public accommodation on the basis of disability, race,creed, color, national origin, marital status, sex, sexual orientation or gender identity asprovided by Title 9 V.S.A. Chapter 139.

No person shall on the grounds of religion or on the grounds of sex (including, on the groundsthat a woman is pregnant), be excluded from participation in, be denied the benefits of, or besubjected to discrimination, to include sexual harassment, under any program or activitysupported by State of Vermont and/or federal funds.

Party further shall comply with the non-discrimination requirements of Title VI of the CivilRights Act of 1964, 42 USC Section 2000d, et seq., and with the federal guidelinespromulgated pursuant to Executive Order 13166 of 2000, requiring that contractors andsubcontractors receiving federal funds assure that persons with limited English proficiency canmeaningfully access services. To the extent Party provides assistance to individuals withlimited English proficiency through the use of oral or written translation or interpretiveservices, such individuals cannot be required to pay for such services.

6. Emplovees and Independent Contractors:

Party agrees that it shall comply with the laws of the State of Vermont with respect to theappropriate classification of its workers and service providers as "employees" and"independent contractors" for all purposes, to include for purposes related to unemploymentcompensation insurance and workers compensation coverage, and proper payment andreporting of wages. Party agrees to ensure that all of its subcontractors or sub-grantees alsoremain in legal compliance as to the appropriate classification of "workers" and "independentcontractors" relating to. unemployment coinpensation insurance and workers compensationcoverage, and proper payment and reporting of wages. Party will on request provide to theAgency of Human Services information pertaining to the classification of its employees toinclude the basis for the classification. Failure to comply with these obligations may result intermination of this Agreement.

7. Data Protection and Privacv:

Srarn or VnRvroxt, CoNtuctDnpanrvrpNT oF VBnuoNr Hnar,rn AccnssEQ Hnar,rn Sor,uuoNs, Ittc.

P.q,cn 263 or 268CoNrnq.cr 28739

AvrrNuvrnNr #2

Protected Health Information; Party shall maintain the privacy and security of all individuallyidentifiable health information acquired by or provided to it as a part of the performance ofthis Agreement. Party shall follow federal and state law relating to privacy and security ofindividually identifiable health information as applicable, including the Health Insurance

Portability and Accountability Act (HIPAA) and its federal regulations.

Substance Abuse Treatment Information: Substance abuse treatment information shall be

maintained in compliance with 42 C.F.R. Part 2 if the Party or subcontractor(s) are Part 2covered programs, or if substance abuse treatment information is received from a Part 2

covered program by the Party or subcontractor(s).

Protection of Perqonal Information: Party agrees to comply with all applicable state and

federal statutes to assure protection and security of personal information, or of any personallyidentifiable information (PI!, including the Security Breach Notice Act, 9 V.S.A. $ 2435, theSocial Security Number Protection Act,9 V.S.A. S 2440, the Document Safe Destruction Act,9 V.S.A. 5 2445 and 45 CFR 155.260. As used here, PII shall include any information, in anymedium, including electronic, which can be used to distinguish or trace an individual'sidentity, such as his/her name, social security number, biometric records, etc., either alone orwhen combined with any other personal or identifiable information that is linked or linkableto a specific person, such as date and place or birth, mother's maiden name, etc.

Other Confidential Consumer Information: Party agrees to comply with the requirements ofAHS Rule No. 08-048 concerning access to and uses of personal information relating to anybeneficiary or recipient of goods, services or other forms of support. Party further agrees tocomply with any applicable Vermont State Statute and other regulations respecting the right toindividual privacy. Party shall ensure that all of its employees, subcontractors and otherservice providers performing services under this agreement understand and preserve thesensitive, confidential and non-public nature of information to which they may have access.

Data Breaches: Party shall report to AHS, though its Chief Information Officer (CIO), anyimpermissible use or disclosure that compromises the security, confidentiality or privacy ofany form of protected personal information identified above within 24 hours of the discoveryof the breach. Party shall in addition comply with any other data breach notificationrequirements required under federal or state law.

8. Abuse and Neslect of Children and Vulnerable Adults:

Abuse Registrv. Party agrees not to employ any individual, to use any volunteer or otherservice provider, or to otherwise provide reimbursement to any individual who in theperformance of services connected with this agreement provides care, custody, treatment,transportation, or supervision to children or to vulnerable adults if there has been a

substantiation of abuse or neglect or exploitation involving that individual. Party is responsiblefor confirming ds to each individual having such contact with children or vulnerable adults thenon-existence of a substantiated allegation of abuse, neglect or exploitation by verifying thatfact though (a) as to vulnerable adults, the Adult Abuse Registry maintained by the Departmentof Disabilities, Aging and Independent Living and (b) as to children, the Central ChildProtection Registry (unless the Party holds a valid child care license or registration from the

Srlrn or VnnryroNt, CoNrucrDrpmtunNT oF VnnvroNt Hn,tr,rn AccnssEQ Hr.ll,rn Sor,urroNs, INc.

Pacn 264o1268CoNrnq.cr 28739

AiurNnnnnN.r #2

Division of Child Development, Department for Children and Families). See 33 V.S.A.$a919(a)(3) and 33 V.S.A. 96911(cX3).

Reoortins of Abuse, Neslect, or Exploitation. Consistent with provisions of 33 V.S.A.$a913(a) and $6903, Party and any of its agents or employees who, in the performance ofservices connected with this agreement, (a) is a caregiver or has any other contact with clientsand (b) has reasonable cause to believe that a child or vulnerable adult has been abused orneglected as defined in Chapter 49 or abused, neglected, or exploited as defined in Chapter 69of Title 33 V.S.A. shall: as to children, make a report containing the information required by33 V.S.A. $4914 to the Commissioner of the Department for Children and Families within24hours; or, as to a vulnerable adult, make a report containing the information required by 33V.S.A. $6904 to the Division of Licensing and Protection at the Department of Disabilities,Aging, and Independent Living within 48 hours. Party will ensure that its agents or employeesreceive training on the reporting of abuse or neglect to children and abuse, neglect orexploitation of vulnerable adults.

9. Information Technolosv Svstems:

Computins and Communication: Party shall select, in consultation with the Agency of HumanServices' Information Technology unit, one of the approved methods for secure access to theState's systems and data, if required. Approved methods are based on the type of workperformed by the Party as part of this agreement. Options include, but are not limited to:

1. Party's provision of certified computing equipment, peripherals and mobile devices, ona separate Party's network with separate internet access. The Agency of HumanServices' accounts may or may not be provided.

2. State supplied and managed equipment and accounts to access state applications anddata, including State issued active directory accounts and application specific accounts,which follow the National lnstitutes of Standards and Technology (NIST) security andthe Health Insurance Portability & Accountability Act (HIPAA) standards.

Intellectual Propertv/V|/ork Product Ownership: All data, technical information, materialsfirst gathered, originated, developed, prepared, or obtained as a condition of this agreementand used in the performance of this agreement -- including, but not limited to all reports,surveys, plans, charts, literature, brochures, mailings, recordings (video or audio), pictures,drawings, analyses, graphic representations, software computer progrhms and accompanyingdocumentation and printouts, notes and memoranda, written procedures and documents, whichare prepared for or obtained specifically for this agreement, or are a result of the servicesrequired under this grant -- shall be considered "work for hire" and remain the property of theState of Vermont, regardless of the state of completion unless otherwise specified in thisagreement. Such items shall be delivered to the State of Vermont upon 3O-days notice by theState. With respect to software computer programs and / or source codes first developed forthe State, all the work shall be considered "work for"hire," i.e., the State, not the Party (or

Sr.q.rB or Vnnuoxt, CoNrucrDnpantunNT oF VnnvroNr Hnar,rn AccpssEQ Hn,o.r,rn Sor,utroNs, INc.

P.r.cr 265 o1268CoNrru.cr 28739

AivrnNrniunxr #2

subcontractor or sub-grantee), shall have fulI and complete ownership of all software computerprograms, documentation and/or source codes developed.

Party shall not sell or copyright a work product or item produced under this agreement withoutexplicit permission from the State of Vermont.

If Party is operating a system or application on behalf of the State of Vermont, Party shall notmake information entered into the system or application available for uses by any other partythan the State of Vermont, without prior authoizationby the State. Nothing herein shall entitlethe State to pre-existing Party's materials.

Party acknowledges and agrees that should this agreement be in support of the State's

implementation of the Patient Protection and Affordable Care Act of 2010, Party is subject tothe certain property rights provisions of the Code of Federal Regulations and a Grant from theDepartment of Health and Human Services, Centers for Medicare & Medicaid Services. Suchagreement will be subject to, and incorporates here by reference, 45 CFR 74.36,45 CFR 92.34and 45 CFR 95.617 governing rights to intangible property.

Securitv and Data Transfers: Party shall comply with all applicable State and Agency ofHuman Services'policies and standards, especially those related to privacy and security. TheState will advise the Party of any new policies, procedures, or protocols developed during theterm of this agreement as they are issued and will work with the Party to implement anyrequired.

Partywill ensure the physical and data security associated with computer equipment, includingdesktops, notebooks, and otherportable devices, used in connection with this Agreement. Partywill also assure that any media or mechanism used to store or transfer data to or from the State

includes industry standard security mechanisms such as continually up-to-date malwareprotection and encryption. Party will make every reasonable effort to ensure media or data filestransferred to the State are virus and spyware free. At the conclusion of this agreement andafter successful delivery of the data to the State, Party shall securely delete data (includingarchival backups) from Party's equipment that contains individually identifiable records, inaccordance with standards adopted by the Agency of Human Services.

Putty, in the event of a data breach, shall comply with the terms of Section 7 above.

10. Other Provisions:

Environmental Tobacco Smoke. Public Law 103-227 (also known as the Pro-Children Act of1994) and Vermont's Act 135 (2014) (An act relating to smoking in lodging establishments,hospitals, and child care facilities, and on State lands) restrict the use of tobacco products incertain settings. Party shall ensure that no person is permitted: (i) to use tobacco products ortobacco substitutes as defined in 7 V.S.A. $ 1001 on the premises, both indoor and outdoor, ofany licensed child care center or afterschool program at any time; (ii) to use tobacco productsor tobacco substitutes on the premises, both indoor and in any outdoor areadesignated for child

Sr.lrn or VrnvroNr, CoxrnacrDnpanrvrnNT oF VERMoNT Hnnr,rn AccnssEQ Hnar,rn Sor,urroNs, INc.

P^lcn 266o1268CoNrru.cr 28739

AunNnvrnxr #2

care, health or day care services, kindergarten, pre-kindergarten, elementary, or secondaryeducation or library services; and (iii) to use tobacco products or tobacco substitutes on thepremises of a licensed or registered family child care home while children are present and incare. Party will refrain from promoting the use of tobacco products for all clients and frommaking tobacco products available to minors.

Failure to comply with the provisions of the federal law may result in the imposition of a civilmonetary penalty of up to $1,000 for each violation and/or the imposition of an administrativecompliance order on the responsible entity. The federal Pro-Children Act of 1994, however,does not apply to portions of facilities used for inpatient drug or alcohol treatment; serviceproviders whose sole source of applicable federal funds is Medicare or Medicaid; or facilitieswhere Women, Infants, & Children (WIC) coupons are redeemed.

2-1-1 Database.' If Party provides health or human services within Vermont, or if Partyprovides such services near the Vermont border readily accessible to residents of Vermont,Party shall adhere to the "InclusiorVExclusion" policy of Vermont's United Way'Vermont2ll(Vermont 2ll), and will provide to Vermont 2Il relevant descriptive information regardingits agency, programs and/or contact information as well as accurate and up to date informationto its database as requested. The "Inclusion/Exclusion" policy can be found atwww. 1 1.ore.

Voter Registratio n; Wherr designated by the Secretary of State, Party agrees to become a voterregistration agency as defined by I7 V.S.A. $2103 (41), and to comply with the requirementsof state and federal law pertaining to such agencies.

Drus Free Workplsce Act: Party will assure a drug-free workplace in accordance with 45CFR Part 76.

Lobbvine: No federal funds under this agreement may be used to influence or attempt toinfluence an officer or employee of any agency, a member of Congress, an officer or employeeof Congress, or an employee of a mernber of Congress in connection with the awarding of anyfederal contract, continuation, renewal, amendments other than federal appropriated funds.

AHS ATT. F 5/]6/20]8

Surn or VnnuoNr, CoNrnncrDnp.c.nrvrnNT oF Vrnivronr Hn.q.LrH AccnssEQ Ho,ll,rn Sor,uuoNso INc.

P.q.cn 267 or.268CoNrru,cr 28739

Avrnuournr#2

ATTACHMENT IADA COMPLIANCE CLARIFICATION

Section 508 Standards for Electronic and Information Technology

Background:Section 508 is a subsection of the Americans with Disabilities Act (ADA). As stated on theADA.gov website (https://www.ada.gov/508/) "Section 508 of the Rehabilitation Act (29 U.S.C.

$ 794d) requires that Federal agencies' electronic and information technology is accessible topeoplq with disabilities, including employees and members of the public." The Department ofJustice (United States Department of Justice, Civil Rights Division) monitors compliance ofSection 508 at the federal and state level.

S 1194.1 Purpose.The purpose of this part is to implement section 508 of the Rehabilitation Act of T973,as amended(29 U.S.C. 794d). Section 508 requires that when Federal agencies develop, procure, maintain, oruse electronic and information technology, Federal employees with disabilities have access to and

use of information and data that is comparable to the access and use by Federal employees whoare not individuals with disabilities, unless an undue burden would be imposed on theagency. Section 508 also requires that individuals with disabilities, who are members of the publicseeking information or services from a Federal agency, have access to and use of information and

data that is comparable to that provided to the public who are not individuals with disabilities,unless an undue burden would be imposed on the agency.

ScopeSection 508 compliance checklists have been developed by various federal agencies, the mostcomprehensive is the "section 508 Applicable Standards Worksheet" published by HomelandSecurity.This worksheet helps entities identify all the applicable electronic and information technologystandards specific to each circumstance. Additional standards were added to Section 508 toincorporate telecommunications and Video / Multimedia projects. As the MMIS CareManagement project does not include new telecommunications or video/multimedia developmentas part of the development scope, these standards can be waived. After careful review of thestandards listed, there is no perceived "undue burden" to eQ at this time.

Using the Applicable Standards Worksheet, there are four (4) out of eight (8) standards that are

applicable to this project.

1. Functional Performance Criteria (this always applies)2. Information, Documentation, and Support3. Software Applications and Operating Systems4. Web Based Intranet and Internet Information Applications

Sr.q.rn or Vnnvront, CoNrrucrDnpl,nrunNT oF VnnvroNr Hnar,rn AccEssEQ Hnar,rn Sor,urrons, Illc.

Pacr 268 or 268Conrnncr 28739

AunuovrnNr#2

MethodMany of the mandatory functional criteria revolve around the application being able to supportassistive technology such as screen readers.The items within the checklist can be verified in the same manner as non-functional requirements:1. Test2. Inspection / Observation3. Attestation

Web Content Accessibility Guidelines (WCAG) are complimentary to Section 508, and manyelements overlap. Many of the web-based items found within the Homeland Security checklistscan be tested via web-browser add-ons that inspect each screen for applicable accessibility rules.

Should a standard/guideline not be met, and testing/observationlattestation will not resolve thestandard, eQ Health will review the level of effort it would take to remedy the accessibilityshortfall, to determine if "undue burden" would be placed upon them.If "undue burden" is determined, eQ Health will provide written attestation clearly detailing thelevel of effort, the impact to the project, and the impact to eQ Health.

The State of Vermont's QA and Testing Team is willing to identify applicable 508 Standardscooperatively with eQ Health, and determine which standards will be tested, inspected/observed,or attested.

SoV testers will make use of web-based browser tools to generate accessibility audits, develop testcases for standards that require inspection/observation, and will create 'mock' test cases to uploadattestation and audit documents for compliance reporting through Jama.

t \II. Attach - Department of Vermont Health Access

Documents

Transcript of t \II. Attach - Department of Vermont Health Access