Surn or VrnvroNt, CoNtRlcr FoR PnnsoNu, SnnvrcnsDrp.q.ntNInNT oF VBnuoNr Hrar,rn AccnssEQHnllrn Sor,uuoNs, Itttc.
CONTRACT AMENDMENT
It is hereby agreed by and between the State of Vermont, Department of Vermont Health Access
(the "State") and EQ Health Solutions, lnc., with a principal place of business in Baton Rouge,
Louisiana (the "Contractor") that the contract between them originally dated as of May 29,2015,
Contract # 28739, as amended to date, (the "Contract") is hereby amended effective July 1, 2018,
as follows:
L Maximum Amount. The maximum amount payable under the Contract, wherever such
from $24,113,480.00 toreference appears in the Contract, shall be changed
923,320,217.00; representing a decrease in the amount of $793,263.00. t
11. Attachment A. Specifications of Work to be Performed. The scope of services in the
Contract is hereby deleted in its entirety and replaced as set forth in the Attachment Abeginning on page 3 of this Amendment. The appendices of Attachment A are amended
as follows:
Appendix I. Functional Requirements, of Attachment A is hereby deleted in its entirety
and replaced as set forth in Appendix I beginning on page 117 of this Amendment.
Appendix II. Non-Functional Requirements, of Attachment A is hereby deleted in its
entirety and replaced as set forth in Appendix II beginning on page 178 of this
Amendment.
Appendix III. Non-Enumerated Requirements, is hereby added to Attachment Abeginning on page 225 of this Amendment.
11I. Attachment B. Payment Provisions. The payment provisions are hereby deleted in their
entirety and replaced by the Attachment B beginning on page240 of this Amendment.
IV. Attachment C. State Provisions for Con and Grants. Attachment C ishereby deleted in its entirety and replaced by the Attachment C effective December 15,20llbeginning on page 253 of this Amendment.
V. Attachment F. Agencv of Human Services' Customarv Contract Provisions.Attachment F is hereby deleted in its entirety and replaced by the Attachment F effective
May 16,2018 beginning on page260 of this Amendment.
\II. Attach . Attachment I is hereby added to the
Contract beginning on page 267 of tlns Amendment.
VII. Taxes Due to the State. Contractor further certifies under the pains and penalties ofperjury that, as of the date this contract amendment is signed, the Contractor is in good
P,lcn 1 or 268CoNrru,cr #28739
AurNnvrnNT # 2
standing with respect to, or in full compliance with a plan to pay, all taxes due the State
of Vermont.
Sr.q.rn or Ven*ronr, CoNTRAcT FoR PnRsolvc, SnnvrcnsDpplnrunnt or Vpnuoxr Hn^lr,rn AccpssEQHn,n rn Sor,urroNs, INc.
Vlll.Certification Reeardinq Suspension or Debarment. Contractor certifies under thepains and penalties of perjury that, as of the date this contract amendment is signed,neither thJ Contractor nor the Contractor's principals (officers, directors, owners, orpartners) are presently debarred, suspended, proposed for debarment, declared ineligibleor excluded from participation in federal programs, or programs supported in whole or inpart by federal funds.
The Contractor further certifies under pains and penalties of perjury that, as of the datethat this contract amendment is signed, the Contractor is not presently debarred,suspended, nor named on the State's debarment list at:
http l//bgs. vennorrt. sov/purchasi n g-contraqting/_debannent
This document consists of 268 pagos. Except as modified by this Amendment No. 2, allprovisions of the Contract remain in full force and effect.
Plcn 2o1268Conrru,ct #28739
Aupnonnnnr # 2
STATE OF VERMONT
Dnpl,nrunNT oF VnnuoNr Hn.lr,rn Accnss
CORYGUSTAFSoN,CoMMISSIoNER DATE
NOB I South, 280 State DriveWaterbury, VT 05671 -1010Phone: 802-247-0239Email: Cory.Custafson(4).vermorrt.gov
CONTRACTOR
EQ Health Solutions, Inc.
GTnq GoTEMI, PRESIDENT AND CEO DeTE
8440 Jefferson Highway, Suite 101
Baton Rouge, LA 70809225-248-7003
;;?8?E$?1r9",? 3,,9'tt3"-i, Juty 27,2o1B """t?',,n;_"#l/u!i%3i!"8i,,
Juty 26,2018
Sr^q.rn oF VERMoNI, CoNtru,cr FoR PnnsoNnr, SnnvrcnsDrpmrivrnNT oF VERMoNT Hrll,rn AccnssEQHn,Llrn Sor,urroxso INc.
ATTACHMENT ASPECIFICATIONS OF WORK TO BE PERFORMED
A. ACRONYM CATION3DES : Triple-Data Encryption Standard
A2A: Application to ApplicationACO : Accountable Care OrganizationAHS : Agency of Human ServicesAI: Action ItemANSI: American National Standards Issue
API : Application Programming Interface
APM : Application Performance MonitoringATNA: Audit Trails and Node AuthenticationB2B: Business to BusinessBI : Business IntelligenceBPEL: Business Process Execution LanguageBPMN: Business Process Modeling NotationCIA : Confi dentiality, Integrity, AvailabilityCIF- Clinical Integration Framework
CMS : Centers for Medicare and Medicaid Services
COTS : Commercial Off-The-ShelfCPU: Central Processing UnitCR: Change RequestDAD : Deliverables Acceptance DocumentDBA : Database AdministrationDBMS : Database Management SystemDED : Deliverables Expectation DocumentDi|dZ : Demilitari zed ZoneDOC: Department of CorrectionsDOD: Department of DefenseDVHA: Department of Vermont Health Access
EDI: Electronic Data InterchangeEDIFACT: Electronic Data Interchange for Administration, Commerce,
and TransportationEMPI: Enterprise Master Patient IndexESB : Enterprise Service BusETL : Extract-Transform-LoadFR : Functional RequirementGUI- Graphical User InterfaceHHS - Health and Human ServicesHIE: Health Information ExchangeHSE: Health and Human Services EnterpriseHTML: Hypertext Markup LangaageHTTP : Hl,pertext Transfer ProtocolIAM: Identity and Access Management
Plcu 3 or 268CoNrnlcr # 28739
AvrnNounNr # 2
Srarn or VnnmoNro Coxrnncr FoR Pnnsonal SnnvrcnsDnp.lnrvrnNT oF VnnuoNr Hnlr,rn AccnssEQHnar,rn Sor,urrons, INc.
IIOP : Internet Inter-ORB ProtocolIIS : Internet Information SystemsIPSec: Internet Protocol SecurityIT : Information TechnologyITIL : Information Technology Infrastructure LibraryITILv3 : Information Technology Infrastructure Library, Version 3
J2EE: Java2 Platform, Enterprise EditionJAD: Joint Application DesignJDBC : Java Database ConnectivityKPI: Key Performance IndicatorsLAN: Local Area NetworkLDAP : Lightweight Directory Access ProtocolLUN: Logical Unit NumbersMCI: Master Client IndexMITA : Medicaid Information Technology ArchitectureMMIS : Medicaid Management Information SystemM&O: Maintenance and OperationsMOM : Message-Oriented MiddlewareMOSS : MS Office SharePoint ServerMPI: Master Provider IndexNE: Non-EnumeratedNTP : Network Time ProtocolOCM : Organizational Change ManagementODBC: Open Database ConnectivityOLAP: Online Analytical ProcessOLTP : Online Transactional ProcessingPDF: Portable Document FormatPHI: Protected Health InformationPII : Personally Identifi able InformationPKI: Public Key InfrastructurePMBOK: Project Management Body of KnowledgePMI: Project Management lnstitutePMP: Project Management PlanPOC: Plan of CarePOX: Plain Old XMLRl : Release I (same as Rl Final)Rl.01 : Release 1.01 (minimal viable product)Rl Final: Release 1 Final (same as Rl)R2: Release 2R3 : Release 3RBAC: Role-Based Access ControlsRDMS : Relational Database Management SolutionsREST : Representational State TransferRIA: Rich Internet ApplicationSAN: Storage Area NetworkSDLC: Software Development Life Phase
Pr,cB 4o1268CoNrna,cr #28739
AvrnNounNT # 2
Surn on Vpnnaoxt, Contru,cr FoR PnnsoN,rl. SnnvrcrsDnpanrvrnNT oF VnnvroNr HnllrH AccrssEQHn,ll,rn SolurroNs, INc.
Plcn 5 or 268CoNrRAcr #28739
AvrnnovrnNr # 2
SLA: Service Level Agreement
SLR: Service Level RequirementS/MIME : Secure/Multipurpose Internet Mail Extensions
SME: Subject Matter ExpertSNMP : Simple Network Management ProtocolSNTP: Simple Network Time ProtocolSOA : Service Oriented ArchitectureSOAP: Simple Object Access ProtocolSSL: Secure Sockets LayerSQL: Structured Query LanguageTCP/P: Transmission Control Protocol (TCP) / Internet Protocol (IP)
TLS : Transport Layer SecurityUAT: User Acceptance Testing
UCS: Unified Computing System
UDDI: UniverSal Description, Discovery and IntegrationVCCI: Vermont Chronic Care Initiative
VHC: Vermont Health ConnectVPN: Virtual Private NetworkW3C: World Wide Web ConsortiumWAN : Wide Area NetworkWS: Web ServicesWSDL: Web Services Description LanguageWSFL: Web Services Flow LanguageWS-I : Web Services InteroperabilityXHTML: eXtensible HyperText Markup LanguageXML: eXtensible Markup LangaageXML: XML Process Definition LanguageXSLT: Extensible Style sheet Language Transformations
B. AUTHORIZED REPRESENTATIVES OF THE STATE:AII deliverables and work products described within Attachment A of this contractare subject to review and approval by the Authorized Representative of the State ordesignee(s) prior to being accepted. Payment shall not be made until a deliverable orwork product is formally accepted and approved.
Kelly GordonProject & Operations DirectorDepartment of Vermont Health Access
NOB 1 South280 State DriveWaterbury, VT 05671-1 010
Kelly. Gordon@vermont. gov802 -24 | -0146 (Waterbury)802-87 9-11 87 (Williston)
Sr,lrn or VanuoNt, CoNrn-ncr FoR PnnsoN.q.r, SnnvrcnsDnpmtnnnNT oF VnnnnoNr Hnar,rn AccnssEQHn,t lrn Sor,uuoNs, Ilvc.
Pacn 6 or 268Conrnacr #28739
AunNounNr # 2
C. AUTHORIZED REPRESENTATIVE OF THE CONTRACTOR:Mayur YermaneniEQHealth Solutions, Inc.8440 Jefferson Highway, Suite 101Baton Rouge, LA [email protected]
All work performed under this agreement shall be done under the direction and sole discretionof the Authorized Representative of the State. No work shall be performed unless directed bythe Authorized Representatives of both parties.
D. OVERVIEWCare Management technical operations arepart of the State's Medicaid Operations and areadministered by the Department of Vermont Health Access (DVHA). Through thiscontract, the State is acquiring a Care Management Solution for the Agency of HumanServices (AHS), including predictive modeling, risk stratification, and clinical/healthanalyics. Contractor shall provide such technology and services (hereinafter "Contractor'sSystem" or "Solution") in accordance with all requirements set forth in this Contract. AHSprograms provide direct care management services to Vermonters, and also oversee andmonitor services provided through contracted providers. The Contractor's System shallsupport Vermont Chronic Care Initiative (VCCI) operations, including the high-riskpregnancy population. Ultimately, additional Care Management Programs and Initiativesmay leverage this solution. The State and Contractor shall work together to develop themost efficient and cost-effective approach for the State.
E. OBJECTIVESThe project objectives are to acquire, design, and implement a Care Management Solutionto support individual and population-based approaches to health management, beginningwith the care management activities for VCCL
The Solution will support VCCI's care management needs in the following areas:
i. Utilize clinically relevant predictive risk modeling tools and gaps in care analysis ofvarious Member populations for early screening, case identification, and riskstratification of Medicaid Members including, but not limited to:
a. Members who will benefit most from some form of care managementintervention(s) (e.g., those with high utilization patterns, multiple providers,multiple conditions, polypharmacy, care gaps, possible readmissions and thosewho are at risk for complications resulting from chronic disease).
b. Members who are not currently at risk but may become at risk in the future.c. Members whose future inpatient admissions, readmissions, and Emergency
Department visits can be prevented.ii. Proactive outreach to Members'who are at risk, and to their providers, to offer
information, guidance, and support to:
Srarn or VpnuoNt, CoNtru.cr FoR Pnnsons, SnnvrcnsDnpl,nrunNT oF VnnvroNr Hnar,rn AccnssEQHnar,rn SolurroNso INc.
a. Improve health outcomes by: closing gaps in care, increasing adherence to
evidence-based care, increasing the use of preventive care, and improving self-
management and provider management of chronic illnesses.
b. Lower healthcare costs by minimizing redundancies and reducing utilizationand expenses.
iii. Develop, monitor, share, and reassess an evidence-based Plan of Care to ensure
clinically appropriate health care information and services are provided and
communicated to improve the health outcomes of Medicaid Members.
iv. Coordinate effrcient and effective delivery ofhealth care with Medicaid Members, their
providers, and community partners by removing communication barriers, bridging
gaps, and exchanging relevant and timely Member information.v. Conduct real-time care management analytics that include the ability to collect multiple
sources of data as closely from the originating source as possible (including hospital
census, claims data, pharmacy data, and clinical/bio-medical data from providers) to
identify opportunities that a Member or provider can take to improve clinical and
financial outcomes.vi. Provide robust and User-friendly reporting capabilities and Web-based tools necessary
to effectively conduct Vermont MMIS Care Management strategic planning, quality,
and performance management including clinical, utilization, and financial changes
among intervened populations.vii. Provide additional Care Management capabilities including:
a. Receive custom assessments, care plans, services from provider Agencies forState review
b. Communicate State authorization of care plans, services, and providers toprovider agencies and Members.
c. Conduct comparative analysis of provider agencies.
d. Interface with other Agency Case Management solutions for State reporting and
tracking.e. Interface with other appropriate solutions for the Agency.
Statement of WorkThe Contractor must provide a Statement of Work which details the work to be performed
consistent with the requirements for the Care Management project. The Statement of Workmust detail the work activities and tasks required to execute the project as identified by the
Project Management Strategy, Implementation Strategy, and Project Work Plan'
The Contractor will provide the following services for the Care Management Solution:
i. Collaborate and coordinate with the State to successfully implement and maintain the
care management solution.ii. Leverage PMI best practices in the areas ofprogram integration, program management,
implementation, productivity, and process improvements.
iii. Leverage Sub-Contractor's resources.
iv. Provide transparency to the State by disclosure and discussion of costs, issues, and
opportunities, including early warning and identification of the same.
v. Formulate a team to coordinate and lead care management implementation to a
successful completion:
Pacn 7 o1268CoNrnq,cr # 28739
AunNuunNT# 2
SrarB or vnnvroNt, coNtnncr FoR PrnsoN.q,L Srnvrcns pacn g or 26gDnpmrunNT or vrnvroNr Hn.rr,rn Accnss coNrnq.cr # 29739EQHrar,rn Solurrons,Inc. AunNounNr # 2
a. Determine and operate govemance structures for the Contractor's project team.b. Interface with the State's business and program governance bodies as required.c. Perform the configurations and customizations required to the Contractor's
product to meet the State's business requirements.vi. Implement the Contractor's System in a series of releases.vii. Starting with the first release date, establish a team to maintain and support the
implemented system until the scope of work termination date while maintaining servicelevels within the targets agreed by the State.
viii. Establish the work breakdown structure for the program.ix. Identify intemal and external dependencies.x. Evaluate and coordinate the (re)structuring of the Contractor's project teams on an
ongoing basis in conjunction with the State's project manager.xi. Publish weekly project status reports to the project stakeholders.xii. Provide reports to the executive management.xiii. Conduct meetings with the Contractor's steering committee on the cadence agreed to
with the State.xiv. Conduct meetings with the Department's leadership teams per the cadence agreed to
with the State.xv. Operate the Change Control Board and evaluate the financial viability of the proposed
changes.xvi. Identify and manage risks and issues for the Care Management project.
F. FUNCTIONAL R.EQUIREMENTSo All in-scope Functional Requirements (FR) and Non-Enumerated (NE) Functional
Requirements pfeviouslv outlined in this section are found in Appendix I andAppendix III. respectivelv.
G. TECHNICAL REOUIREMENTSTechnical and Non-Functional Requirements also are found in Appendix II.
1. Architecture & Policy Requirementil. Service Oriented ArchitectureThe Contractor's System will be distributed service-oriented system architecture (SOA). TheContractor's System shall be comprised of loosely coupled standard based Web services thatprovide an Application Programming Interface (API) so that the services can be invoked fromthe Rich Internet Application (RIA) User interface or a dependent service. Each service will be awell-defined encapsulated set of functionalities that does not depend on the context or state ofother services or functions.
The primary transport protocol for external facing services will be HTTPS (X.509 certificate) toensure that all traffic is encrypted and secure 256bitor better.
The Contractor's service communication or integration will be achieved through standarddescription protocols such as the Web Services Description Language (WSDL) interface format.Web services in the environment will be distributed across multiple clustered and load balancedvirtual sorvers. Production services will be centrally published via the WS-Discovery protocol to
Srnrn or VnnivroNt, CoNtn-lcr FoR PnnsoN.q'L SnnvlcrsDnp.lntvrnNT oF Vrnuoxr Hnar,rn AccnssEQHn.r.r,rn SolurroNs, INc.
a Discovery Proxy service registry to ease discovery on the network for State applications
utilizing a fixed proxy URL.
Each Contractor System service will be managed in compliance with change management
policies ensuring all changes are authorized and accurate. Web service security will be
configured for each service by endpoint policies via (WS-Policy) where requirements such as
r""*ity tokens, type of encryption, and privacy rules are established. Each service will utilize
the Brokered Authentication pattern where the service validates the credentials presented by the
State issued by a third party that both the State of Vermont and Contractor trust.
All software architecture documents and artifacts (views/viewpoints) will be modeled per
ISO/IEC/IEEE 42010 Architecture Description Template as part of the Vermont Enterprise
Architecture Program Requirements.
All SOA Services will be reviewed, classified, and cataloged prior to use. The documentation
Artifacts and Templates will be provided to the Contractor by the State of Vermont Enterprise
Architecture SOA Governance Team. Duplicate services will be rational and tiered
appropriately.
All WSDLs developed for the State will conform to the WSDL Development Standards.
The Contractor's System's SOA -related messages will be formally defined with XSD
(preferable) or DTDs. SOA artifacts will be stored in the State of Vermont's SOA Repository.
The Contractor's System's implemented services will rely on WS-Policy configuration for
message reliability (WS-Reliable Messaging).
The Contractor's System will be aligned with and leverage the HSE Platform when available and
at a date that is determined by the State and allows reasonable time for the Contractor to execute.
The Contractor's System shall be designed, built, and deployed with enterprise architecture best
practices including substantial reliance on highly configurable SOA components. The-Contractor
will be compliant with the State's SOA architecture standards as the State's needs
change.
b. HSE Platfurm AlignmentThe Contractor will provide service-oriented architecture that will allow for effective future
integration within the State's computing ecosystem.
The Contractor will leverage the Oracle "stack" and will redirect selected services to those the
State has invested in and are hosting in their infrastructure whenever and wherever possible.
The Contractor will work closely with the State to determine what products are appropriate
candidates for integration, Master Data Management (MDM), Identity Access Management
(IAM), Consent Management, and will look to utilize those that meet the intent and requirements
of the project while also providing what is necessary to support core functionality. Integration
Pacn 9 or 268
CoNrnacr #28739AvrnNovrnNT # 2
Sr,Lrn or VnnvroNt, CoNrucr FoR pnnsoivar, SnnvrcnsDnpmtvrnNT oF VnnvroNr HBlr ru AccrssEQHn^u,rtr SolurroNso lr'lc.
touch points are User authentication, clinical data exchange, member eligibility, priorauthorization, claims, and email system.
c. Technical StandardsThe Contractor's System shall be architected as a multi-tiered enterprise application composed ofseveral loosely coupled autonomous modules. The general architecture of the Contractor's Systemshall follow a service oriented (SOA) pattern and the application will be broken up into verymanageable distinct pieces of functionality, or services. The Contractor's System architecture willallow encapsulation of the State's business needs into an interchangeable component that willbeeasily plugged into the system.
The presentation layer will be developed on lll%native browser-based technology.
The Contractor's data will be warehoused in a certralized relational database system (RDMS)which will be a comprehensive, integrated management and analysis platform that will providetremendous scalability, performance, and security standardized naming conventions for ai objecttypes in the RDMS.
d. (IsabilityThe Contractor's System must be designed to provide a browser based, or a Rich IntemetApplication, that will utilize feature rich applications that will be updated over the Wide AreaNetwork (WAN) and the Internet and will deliver a consistent User experience to VermontCitizens, AHS employees, providers, contractors, and partners.
The Contractor will send and retrieve data in the background without interfering with or delayingUser interface behavior in the browser. As newer browsers are released and are more capable ofsupporting technologies such as HTML5, the Contractor will capitalize on those improvementsand incorporate them in the application.
The Contractor's System shall provide a dynamic Graphic User Interface (GUI) that allows accessto information based on a lJser's role and associated permissions. Configurable functions as wellas the current state of User interaction at any given point in time will be achieved via configurablebusiness rules or branching logic that is associated with real-time responses within the application.
The Contractor's System shall present only what is relevant to, or required of, the User toaccomplish a specific data entry or review scenario while still ensuring all pertinent data iscaptured. All fields will include appropriate User entry validation such as data type, masking, andlength.
The Contractor will use zero footprint technology, architecture, and applications that can be"styled" or "skinned" to the AHS color palette uttd iogo.
The Contractor will provide secure single sign-on options to integrate into an existing client portal.Single Sign-On Options will include:
1. SAML 2.0 Tokens and protocol2. Encrypted Post
Pacr 10 or 268CoNrnacr #28739
AnnnNnvrnNT # 2
Srarn or VnnvIoNt, Contn-lcr FoR PnnsoNar- SnnvrcssDnpantvrnNT oF VrnvroNr H'nar,rn AccpssEQHnllur Sor,uuoNs, INC.
PAGE 11 or 268
CoNrru.cr #28739AvrrNovrpnr # 2
e. IntegrationThe Contractor will integrate between disparate external trading partners via secure standards
based XML web services.
The Contractor will analyze each of the State's available service contracts to understand the
methods and data associated with each. A gap analysis will be performed to identify those instances
where the Contractor's functionality cannot be fully supported and simply remapped. Where there
is an identified gap, the Contractor shall provide the State with a proposed plan for augmenting
the State's services. Where a State managed service is not available, the Contractor will continue
the integration until an equivalent replacement is implemented by the State. The Contractor willbe fully capable of integrating with the State-wide HIE system and public registries to aggregate
additional data that AHS cannot manage directly. Where bi-directional services are required, a
service registry will be available for the State that supports the use of Web Services Description
Language (WSDL) to discover all services and understand each contract.
The following table indicates the Contractor's current services.
Enterprise Master Patient Index(EMPI)
Claims WarehouseClinical Data RepositoryService AuthorizationsMember EligibilityMedication DatabaseHealth EducationHome and Community Based Services
repository-
The interoperability features and capabilities of the Contractor's System shall leverage the State's
deployments of Master Data Management / Master Person Index technologies to present a 360-
degree view of patient clinical datato the Users.
The abovementioned will apply when integrating future capabilities that the State may require.
f. Scalability and ErtensibilfuThe Contractor will deliver the highest levels of reliability and scalability to support any State IT
initiative now and in the future. The Contractor's System will be co-located (does not share any
resources with other datacenter clients) and will be completely isolated on the Contractor's own
hardware.
The Contractor's System shall be delivered from a highly configurable network load balanced
(NLB) web farm of virtualized data center servers (these servers shall be clones of each other)'
The Contractor will not only keep up with the latest trends or changes but also adopt them when
proven stable.
The Contractor will have the Scalability and Extensibility to:
1. Have the ability to meet future growth\
Business Rules EngineBusiness Intelligence/Analytics
PlatformWorkflow EngineMember CensusProvider @hysician/Facility)Clinical Guidelines/CriteriaMapping/Geocoding
surn or vnnvroNr, coNrrucr FoR PrnsoNar, Snnvrcns plcr 12 or 26gDnpanrnanNT oF'vnnuoxr HplI,ru Accrss coNrnacr # 2g739EQIInalrn SolurroNs,INc. AvrnNuunNr # 2
2. Be configurable3. Have the flexibility to keep up with changing technology and regulatory needs4. Be easy to maintain
The Contractor's system will scale for multiple business units with different missions. (Forexample, if Department 'x' and Department 'y' both want to take advantage of automated casemanagement, the Contractor's System shall handle increasing Users while maintainingresponsiveness and insuring security, privacy, etc.)
g. Business Analytics & ReportingNEG.G.1 The Contractor's System shall support the Business Intelligence (BI) functions and willdeliver a balanced set of capabilities to the intemal State Users across three (3) areas: informationdelivery, analysis, and development. (Rl FINAL) AdditionallyNEG.G.2theContractor's Systemshall include the reporting for both canned and ad hoc reports and will have the ability to providedashboard capabilities to the State Users. NEG.G.2-1 The Contractor's System shall include thereporting for both canned and ad hoc reports, based on a person's user role and permissions, andwill have the ability to provide dashboard capabilities to tire State Users. (Rl FINAL)
NEG.G.3 The Contractor will design, develop, and execute complex data mining models andanalysis. These models will be made available and used to generate Business Intelligencedashboards. NEG.G.3-l The Contractor will design, develop, and execute complex data miningmodels and analysis. These models will be made available as Online Analytical Process (OLAP),which includes all capabilities inherent in the use of data cubes and additional capabilities inherentin the Tableau product, to Business Intelligence dashboards or ad hoc reporting, (Rl FINAL)
NEG.G.4 The Contractor's System shall provide dashboard views, graphs, and simple tables, andhighly detailed reports which drill-down to the raw data.
All reports will be available in both hardcopy and in softcopy.
NEG.G.4-1 The Contractor's System shall provide dashboard views, graphs, and simple tables,and highly detailed reports which drill-down to the raw data. All reports will be available insoftcopy with the ability to download and print hardcopy. (Rl FINAL)
NEG.G.5 The Contractor's data will be warehoused in a centralized relational database systemwhich will be a comprehensive, integrated management and analysis platform that providesscalability, performance and security. (Rl FINAL)
NEG.G.6 Data system elements that the Contractor will use in report generation and submissionprocess include:
L lnformation collected by system which incorporates User entry validation andedits to ensure data integrity on User entry. (Rl FINAL)
2. NEG.G.7 Information recorded in relational database and analyzed by analyticsteam.
3. Advanced data mining structures to deliver complex aggregations to thereporting services.
4. Statistical analysis software used to create highly complex data analysis for adhoc reports.
Srnrn or VnnvroNt, CoNtucr FoR PnnsoNar- SnnvrcnsDnp,tnnvrnNT oF VrnvroNr Hnllrn AccnssEQHnalru SoLurroNS, INC.
Plcn 13 or 268CoNrnlcr # 28739
AunxumnNr # 2
5. Submission of information either hardcopy or electronic as prescribed by AHS.
NEG.G.7-| Data system elements that the Contractor will use in report generation and submission
process include: 2. Information recorded in relational database and analyzed by analytics team. 3.
Advanced data mining structures to deliver complex aggregations to the reporting services. 4.
Statistical analysis software (John Hopkins ACG) used to create highly complex data analysis for
ad hoc reports. 5. Submission of information either hardcopy or electronic as prescribed by AHS.
(Rl FINAL)
NEG.G.8 The reporting process the Contractor will use will include these key elements:
1. Individual(s) or other sources responsible for providing the data and
information.2. Identification of the individual or process responsible for generating the report.
3. Determination of reporting media, such as hard copy or electronic (PDF, Excel,
etc.).4. Distribution parameters such as authorized recipients and number of copies.
5. NEG.G.! Creation of a logging system to track report generation and receipt.
6. Individuals authorized to request modifications in formats, distribution, and
schedules.7. NEG.G.8 Maintenance of information and data confidentiality.8. NEG.G.9 Establishment of retention schedules for archiving, disposal, and
destruction'9. NEG.G.8 Report quality assurance, and validity checking.
NEG.G.8-l The reporting process the Contractor will use will include these key elements: 1.
Individual(s) or other sources responsible for providing the data and information. 2. Identification
of the individual or process responsible for generating the report. 3. Determination of reporting
media, such as hard copy or electronic (PDF, Excel, etc.). 7. Maintenance of information and data
confidentiality,g. Report quality assurance and validity checking (Rl FINAL)
NEG.G.Q-I The reporting process the Contractor will use will include these key elements: 5.
Creation of a logging system to track report generation and receipt 8. Establishment of retention
schedules for archiving, disposal, and destruction. (Rl FINAL)
NEG.G.10 The Contractor's System shall be capable of generating scheduled predefined reports
as well as conducting ad hoc studies and analyses that provide meaningful information.
NEG.G.l0-1 The Contractor's System shall be capable of conducting ad hoc studies and analyses
that provide meaningful information. (Rl FINAL)
NEG.G.I1 The Contractor's System's capabilities will provide dynamic, and interactive data.
These Contractor's System capabilities will provide a view of all longitudinal data from the
origination of the contract. (Rl FINAL)
NEG.G.|2 The Contractor's System shall incorporate User entry validation and edits to ensure
data accuracy and completeness. Data quality and accuracy will be achieved at the database level
through integrity constiaints such as entity relationships, primary keys, foreign keys, and default
srlrn or vnnvroNt, coNrnacr FoR pnnsoN,lr, snnvrcns pacn 14 or 26gDnpmrvrnNT oF'vnnuoNr Hpar,rn Accnss coNrnq,cr # 2g739EQHnalrn SolurroNsr lnc. AvrnNovrnnr # 2
values. Advanced data mining structures will deliver complex aggregations to the Contractor'sSystem's real-time web reporting services. (Rl FINAL)
NEG.G.13 The Conhactor's System shall provide the AHS management teams with the data andinformation necessary to evaluate and validate program policies and procedures, and to administerall contract responsibilities. (Rl FINAL) The Contractor's System's real-time web-based reportingmodule provides prior authoization review activity, statuses, and authorization numbers forproviders and recipients. NEG.G.l5 The Contractor's System shall be fully compliant withMedicaid Federal and State security regulations and will make all reports and associated exportsavailable to providers and parties specified. (Rl FINAL)
NEG.G.16 The Contractor's System's dashboards will summaize apanel of common utilizationmetrics as well as a "heat" map depicting PM/PM costs. Active trend series and bar graphs will beconnected to present the User with a series measure over time, as well as a "Top 5" bar chart andaverage for each metric at the current hierarchy.
NEG.G.16-l TheContractor'sSystem'sdashboardswillsummarizeapanelofcommonutilizationmetrics as well as a bubble chart depicting unit medical costs compared to average group size andaverage PM/PM costs. Active trend series and bar graphs will be connected to present the userwith a series measure over time, as well as a "Top X" capabilities and average for each metricwithin the current hierarchy. (Rl FINAL)
NEG.G.l7 The Contractor's System's dynamic filtering capabilities will allow a User to analyzethe data for any time period to pinpoint areas of interest that could indicate potential issues wherecourse correction is needed.
All data can be exported to Excel, PowerPoint, or image format.
NEG.G.17-1 The Contractor's System's dynamic filtering capabilities will allow aUser to analyzethe data for any time period within the data to pinpoint areas of interest that could indicate potentialissues where course correction may be needed. All data can be exported to Excel (.csv),PowerPoint, or image format. (Rl FINAL)
2. Regulatory Policies, Audit Complianceo and Securitya. GeneralThe Contractor will:
i. Adhere to, harmonize, and enable federal and local regulations.ii. Protect and secure the information assets within the Contractor's System.iii. Enable Identity and Access Management.iv. Ensure. State data, including but not limited to personally identifiable information, tax
information, or HIPAA protected information, will be isolated and protected.v. Leverage an MS Office SharePoint Server (MOSS) environment.
The Contractor's security policies will be designed to prevent unauthorized personnel fromaccessing a building, resource, or stored information to minimize the risk of data breaches andinappropriate access to information.
Srarn or VcnvroNt, CoNtru,cr FoR PrnsoNar, SnnvrcrsDnp.q,nnvruNT oF' Vnnuonr Hnl'LrH AccnssEQHn,r.lrn Sor,urroNs, INc.
The Contractor's IT infrastructure will be isolated behind physical firewalls and intrusion detection
and prevention systems ensuring security and privacy of all data. In accordance with HIPAAsecurity requirements, all of the Contractor's computer systems will be protected from access by
unauthoriz"d per.on. through the use of frequently changed passwords, access codes, and other
safeguards. The telephone voice messaging system and e-mail system can only be accessed
through individualized pass codes.
All Internet applications will use 256-bit SSL AES or better standard encryption for secured
transmission of information over the Internet.
The Contractor's activity logs for all Windows server based systems will be enabled by default
and record system events continuously. The logs will provide thorough detail regarding logon, file
access, system error, event ID, security access alerts, and document print tracking. The Contractor
will ensure activity logs are routinely backed up.
The Contractor will have a comprehensive HIPAA compliance program that includes all required
privacy and security regulations. The Contractor will comply with all HIPAA requirements,
specifrcally the administrative simplification provisions of the law, and the aSsociated rules
p.rUtlrtt"d by Health and Human Services (HHS), the Department of Defense (DoD) Health
information Privacy Regulation (DoD 6025.19-R), the HIPAA Security Compliance
Memorandum (HA Policy 60-010), and the Security Standards for the Protection of Electronic
Protected Health Information. The Contractor's HIPAA policy will cover paper security, access to
data processing resources, passwords and security incident reporting, software licensing, remote
computer usage, virus, e-mail and application development security considerations.
The Contractor's policies and procedures will maintain security and confidentiality of patient
medical information, review data, and any other data identified as individually identifiable. Each
Contractor employee will be required to review and sign a confidentiality protocol upon
employment und *ill receive annual documented training to maintain security awareness and
policy.
The Contractor will monitor all health care IT related legislation and regulatory bodies to ensure
all requirements are met or exceeded.
The Contractor will monitor local and federal regulations to ensure that the Contractor's System
at all times meets or exceeds compliance. The Contractor will remain informed of any legislation
that will directly or indirectly impact work provided to the State. The Contractor will adhere to
federal security policy and laws.
The Contractor will contract with third party security firms as agreeable to the State of Vermont
to conduct annual security audits and examine the network security controls from the perspective
of an independent source.
The contractor's third-party security firm will review the following:i. Any agfeements, contracts, work obligations, or statements of work.
ii. Efficiency of network connections and their current security status.
Plcn 15 or 268
CoNrRr.cr #28739AvrnNounNT # 2
Srarp or vnnuoNr, CoNrnlcr FoR PnnsoNu, Snnvrcns PAGE 16 or 26gDnpmrvrnNT oF vnnuoNr Hnar,rn Accnss GoNTRACT # 2g739EQHrar,ru Sor,urroNs, INc. AvrnNtvrnilr # 2
iii. Current policies and procedures, and how those relate to data access.iv. Engagement management tools, controls, and reporting.v. Level of compliance in regard to regulatory requirements.vi. Current industry standing, and corporate health, of the service provider.
The Contractor's security firm will conduct application penetration testing using a well-developedmatrix of existing threats, wlnerabilities, and real-world recommendations to identify anypotential security weaknesses. A report will be produced by the firm, and shared with the State,detailing the results of the audit and any detected deficiencies or threats.
The Contractor will apply a data sensitivity matrix to all data sources to understand the associatedsensitivityrating (high, medium, and low) and the required level of controls needed to secure each.
The Contractor will monitor and control the entire software development environment from thisplatform and will be tightly coupled to development and change management practices and toolswhere software development lifecycle (SDLC) is managed.
b. Security Architecture and DesignThe Contractor will maintain in-house a certified security specialist that holds one or more of thefollowing certifi cations :
1.
ii.iii.iv.
Information Assurance Manager (IAM).Information S ystem S ecurity Manager (IS S M) Certifi cation.Certified Federal Information Security Act (FISMA) Auditor.International lnformation Systems Security Certification Consortium (ISC2) CertifiedInformation S ystem S ecurity Pro fes sional (CIS S P).Information Systems Audit and Contract Association (ISACA) Certified in Risk andInformation Systems Control (CRISC).ISACA Certified in the Governance of Enterprise IT (CGEIT).EC Council Certified Ethical Hacker (CEH).Certified EC-Council Instructor (CED.Health Information Trust Alliance (HITRUST) Common Security Framework (CSF)Practitioner.Certified HIPAA Professional (CHP).Certified HIPAA Security Specialist (CHSS).
V
vl.vii.viii.
ix.
X
xi
The Contractor will analyze the surface area vulnerability of Contractor's Systems to ensure allknown vectors of attack are considered and hardened well beyond industry best practices. TheContractor will perform a security related review of all functional and technical specifications toensure vulnerabilities are not introduced to the system using SDLC and ITIL infrastructure changecontrol processes.
The Contractor's System shall not allow access without secure User authentication and resourceauthorization (specific functionality). A11 login User names must be unique and be associated withan industry best-practices strong password. Users must change passwords on a configuredexpiration timeframe and the reuse of passwords will be limited.
Sr.lrn or VnnvroNt, CoNtru.cr FoR PrnsoNar, SrnvrcosDnpmrvrnNT oF Vrnnnonr Hnllrn AccnssEQHn,,LLru Sor,urroNs, INc.
The Contractor will use VPN appliances to secure all remote connectivity needs withininfrastructure. These appliances will provide intrusion detection and prevention, malware
protection and packet level scanning real-time while continuing to maintain a very low latency and
responsive connection
The Contractor's System shall be deployed on a no single point of failure topology that allows the
Contractor to recover from a failure of any element within the infrastructure. Fault tolerance and
failovers are accomplished with both redundancy of critical hardware such as routers, switches,
firewalls, and server hosts load balanced servers and routing.
The Contractor will:i. Provide security-related input into IT infrastructure, system, and application design.
ii. Leverage published industry standards and models to apply security best practices.
iii. Support, enable, and extend the security policy by providing specific security-related
guidance to decision makers.
iv. contain the capability to provide user and site authentication.
v. SupportVPN access.
vi. Include the ability to recover from a failure of any single element.
vii. Be easily serviceable.viii. Support the establishment and active management of data sensitivity levels.
ix. Include application and system hardening processes.
The Contractor will provide an Information Security Risk Assessment Procedure as required bythe Centers for Medicare and Medicaid Services: https://www.cms.gov/Research-Statistics-Data-
and- Systems/CMS - Information-Technolo gyllnformationS ecurity/downloads/I S-RA-Procedure.pdf.
c. Identity and Access Management (IAM)The Contractor will ensure integration platform services as these become available. The Contractor
will support all service methods for creating lJsers, deleting or de-provisioning lJsers, verifyinglogin credentials, changing passwords, and applying roles or permissions.
The Contractor will enable a consistent integrated login experience across all User interfaces
including ICN Procedure codes, regardless of the platform it is being accessed from. The
Contractor will ensure identification of Users and their associated security is abstracted from the
data source that persist it.
The Contractor will ensure the audit trail is centralized, consistent, and verbose in its level of data
capture and supports the scrutiny of security analysis or forensics meeting all compliance
requirements for chain of cirstody and activity.
The Contractor will ensure User accounts are augmented by a profile provider. This provider
allows for the addition of typed property values to be added to a User to store all additional
information required to provide context for functionality like business rules, workflow, processes,
and User preference managed from the respective User's profile screen and can also be managed
by authorized administrative Users in the security module.
PAGE 17 os268CoNrnncr # 28739
AuruNuvrnNT # 2
Sr^q.rn oF vERMoNr, coNrnacr FoR PnnsoN,c.L snnvrcns p.lcn 18 or 26gDBpmrurNT oF vnnvroNr Hnru,rn Accnss coNrnc.cr # 2g739EQHrar,rn Solurroxsr INc. AvrnNuvrnxr # 2
The Contractor will be in compliance with T3.47 RBAC and an HL7 permissions catalog needs tobe developed for role-based access among HIT/HIE services. RBAC is to be provided byimplementation of a SOA provider that delivers a standard interface.
The Contractor will:i. Enable Vermont AHS to identify Users in different contexts so that Vermont AHS
policies and User preferences can be applied consistently.ii. Deliver an integrated login experience for Users across applicable Vermont AHS
systems and channels.iii. Enable coherent audit trails and chain ofcustody records needed for security forensics
and compliance requirements.iv. Support the proactive management of User access to Vermont AHS resources including
de-provisioning when needed.v. Enable Vermont AHS to consistently identify Participants so that customer service can
be more effective.vi. Support the use of an industry standard Directory for identification and authorization.
d. ApplicationEnuyptionThe Contractor will provide:
i. Encryption of database columns and indexes for data at rest.ii. Encryption of flat files at rest and in motion.iii. Network encryption at the session layer (or lower) to secure communication streams
that traverse un-trusted networks; and to provide encryption for sensitive data in motionacross any network.
iv. Field-level encryption so custom applications can secure pertinent information withina communication stream.
v. Key management for secure creation, storage, and retrieval of encryption keys.
The Contractor will utilize transparent data encryption (TDE) a full-database-level bulk encryptiontechnique for all data at rest.
The Contractor will ensure any data that is written into the database file is encrypted including alldatabase columns and indexes and that data that is in use is not encrypted.
Data in motion will be proteoted by the SSL/TLS protocol standard between the server and anybrowser clients consuming or writing data over untrusted networks.
The Contractor's database schema will include several instances where cell or field-levelencryption will be implemented for those scenarios where the database is accessed by a non-browser based custom application that may or may not be protected over a secure protocol or hasthe potential of storing data locally for.later use.
The Contractor will support strong asymmetric keys for encryption approach.
e. Privacy and ConsentThe Contractor will ensure role-based access within the Contractor's System shall conform to the
State's policies regarding sensitive information.
The Contractor's System must be able to identify and delineate between internal and external Users
(Users outside the Agency) and must give them different levels of visibility to System data. When
displaying data, identification information tying the records back to specific Participants must be
omitted where appropriate.
In addition, the Contractor's System's configurable security elements (roles, permissions) include
the ability to store User specific configurable data fields, such as an email address, to facilitate
automated notifications and indicators such as internal/external User or department that can be
leveraged by business rule logic to support workflow.
The Contractor's System shall reset passwords without requiring a customer service
representative. Data elements only necessary to manage the account are displayed and are de-
identified to an appropriate level to ensure privacy.
f. SecurityThe Contractor will deliver a Security Plan that will address, but not be limited to, the following
subject areas.1) Security Audit2) Database SecuritY3) Software and Hardware SecuritY4) Data BackuP5) Disaster RecoverY
Security AuditThe foliowing list of capabilities is leveraged by the Contractor to provide all auditing and
monitoring of pertinent events and changes across the infrastructure:
Srlrr oF VERMoNT, CoNTRACT FoR PnnsoNar- SnnvrcnsDnr,.lnrN{nNT oF VnnvroNr IIn.c.LrH AccnssEQHn.c.LrH SoLUTIoNS, INC.
Log Collection
Automated collection of log files
Supports Windows Event Logs - both' evt
and .evtx formats
Supports Syslog log files
Configure to clear or not clear log files
Collects all generated events
Collects only certain types of events
Can export log data from one source toanother
PacB 19 or 268
CoNrRAcr # 28739AvrrNtnrnNT # 2
Log Archiving
Compression of log data
Can provide email notification of failedarchive attempts
Can automatically retry failed archive
attempts
Continues from last collected event
Scheduled time
Percent fulI (threshold)
Opens zr;pped event log files (; evt) forfevlew
Srarn or VnnvroNro Conrrucr roR pnnsoNnr, SnnvrcrsDBplntvrBNT oF VnnvroNr Hr.lLrH AccBssEQHnar,ur Sor,urroNs, INc.
Log Consolidation and Storage
Secure log aggregation and storage forWindows Event Logs and
Syslog data from devices and Oss
Supports SQL databases for log data
Provides log normalization
Supports automated compression
Monitoring
Agentless monitoring
Real-time monitoring
Configurable polling
Servers go offline/online
System shutdowns/restarts
Detect and track changes toUsers/groups/computers
Detect and track unauthorized accountusage
Detect and track printer activity
Detect policy changes
Detect account lockouts
Track logon activity
Track errors and wamings
Track changes/deletions onfi les/folders/registry keys
Ability to create custom "alarms" for logmonitoring
Reporting
Provides out-of-the-box predefined reports
Provides access to log reports via browser
Can report daily, weekly, or monthlyresults for defined data
Ability to create custom reports
Configurable report formats
Data Formats
Syslog
SQL
MS Access
. evt Log Format
Comma Delimited Text File
HTML Report Format
Comma-Delimited Report Format
Alerts and Notifications
Define alerts for events of interest
Define alert for a single event
Confi gurable thresholds
Provi des predefined a larms
Alerts.on devices and OSs supportingSyslog
Define events as either high risk,medium risk or low risk
Notification Support
Network pop-ups
E-mail messages
Pager
Short e-mail messages
Syslog messages
Database insertions
NetBIOS broadcast notification
Supports regulation of notifi cations
Sends notifications to multiple e-mailaddresses
Log Analysis and Management
Provides a tree view of events and datafor analysis
Supports extensive fi ltering options
Create custom filters for review
Provides predefined filters
Supports choice of log type to manageincluding:
Pacn 20 or 268CoNrnacr # 28739
AvrnNovrnNT # 2
Surn or VnnvroNt, CoNtru,cr F'oR PnnsoN,q,L SnRvtcnsDnp.qntvrpNT oF Vnnuoxr Hnar,tn AccpssEQHnu,ur SolurroNso INc.
HTMLbased reports Application
Security
System
DNS Server
Directory Service
File Replication Service
Audit ComplianceThe Contraitor shall contract with third party security firms, to be approved by the State ofVermont's Agency of Digital Services Security Division, which meet the State's minimum
qualification req.tire*ents, to conduct annual security audits and examine the network security
controls from the perspective of an independent source. The Contractor will be proactive in
handling security requirements that come from within the organization, as well as from outside
regulators. The contracted security firm will review the following:i. Any agreements, contracts, work obligations, or statements of work.
ii. Efficiency of network connections and their current security status.
iii. Current policies and procedures, and how those relate to data access.
iv. Engagement management tools, controls, and reporting.
v. Level of compliance in regard to regulatory requirements.
vi. Current industry standing, and corporate health, of the service provider.
The Contractor shall ensure the security firm conducts application penetration testing annually and
prior to major application releases using a well-developed matrix of existing threats,
vulnerabilities, and real-world recofilmendations to identifu any potential security weaknesses as
part of network security audit. Additional vulnerability assessments will be run quarterly. A report
is produced by the firm detailing the results of the audit and any detected deficiencies or threats.
The Contractor will immediately remediate any deficiencies or threats known, discovered, or
reported, and create controls for associated policies and procedures. The Contractor will make
available the results of audits, penetration tests, vuln".ubility assessments, and the consequent
remediation or mitigation steps to the State.
Database SecurityThe Contractor will ensure confidentiality, integrity and availability (CIA) of the Database
Management Systems responsible for managing data related to the proposed Contractor's System.
The following are Contractor's Systems and approaches to ensuring CIA.
Confidentiality:i. Data Encryption - Detailed in 1.6.3 Application Encryption.
ii. Access Control - Authentication with strong passwords.
iii. Object level authentication - Access to specific tables, stored procedures, views etc.
willbe restricted at the User level.
iv. Upgrades and patches - As soon as patches and upgrades are available and thoroughly
tested, they will be released to production.v. Intrusion Detection and Prevention (IDS) - Packet level network IDS and profiling
PAGE 2lo1268CoNrru.cr #28739
AnrnNovrnNT # 2
Srarn or vnnnnoNr, coNrnacr FoR PERSONAL snnvrcns PAGE 22 or 26gDrpmrvrnNT or vnnvroNr Hnar,rn Accnss coNrnacr # zg73gEQHn.l.r,ur Sor,urroNsr INc. AvrnNuunNr # 2
with alerts.Integrity:
i. Database Backups - Enterprise level SAN replication at the block level. Data is de-duped and transmitted to disparate data center for immediate restoration of data in theunlikely event of comrption.
ii. Track and Audit - Capture all security related events and all changes to databaseobjects and raw data.
iii. Constraints - Database design standards include enforcement of entity relationships,primary keys, foreign keys and default values.
iv. Hardware Configuration - Redundant Disk Anays (RAID l0/5) to provide datapartitioning/striping to reduce risk of data loss on drive failure.
Availability:' i. Scalable redundant hardware - Multiple routers, switches, and virtual izationhosts.
ii. Fault tolerance and failovers - deploy a no single point of failure infrastructure.Yirfila'lization of web servers in conjunction with Network Load Balancing (NLB)across the server farm.
iii. Disaster Recovery - In the event we the primary location is lost, the Contractor willreal-time replicate to a hot site that can be promoted to primary with no loss of data.
Software and Hardware SecurityThe Contractor will ensure all server operating systems are properly deployed, configured, andmanaged to meet the highest security standards and guidelines concerning HIPAA, HITECH andFISMA Compliance. The Contractor will adhere to the following guidelines in the form ofsystem/confi guration management and proactive preventive maintenance :
i. A1l of server and client operating systems are setup and maintained by qualified SystemAdministrators.
ii. Strictly adhere to best practices and software lifecycle management directives.iii. All servers are periodically scanned for malicious software, unnecessary services and
access.iv. Patch, upgrade, and test each operating environment for the latest releases. Procedures
in place to control the installation of software on operational systems.v. Remove or disable all unnecessary services, applications, and network protocols where
practical.vi. All security-related events on critical or sensitive systems are logged and audit trails
saved.vii. Access to services are logged and protected through access-control methods.viii. Adhere to Least Privilege concepts and practices to include governing all Privileged
User access.ix. Perform periodic security and penetration testing.x. Allow Third Party audits to include review of controls within the server operating
systems.xi. Conduct periodic reviews of server logs to identifli suspicious activities.
The Contractor will enforce enterprise security policies on all mobile devices, such as restrictingaccess to hardware and software, managing wireless network interfaces, and automatically
Sr.lrn or Vnnuonto CoNtnl.cr FoR Pnnsoxu, SrnvrcrsDEpARTMENT oF VBnvroNr Hnl.r,rn AccnssEQHn.rr,rn Sor,utroNs, INc.
monitoring and reporting when policy violations occur. The Contractor will adhere to the
following guidelines:i. - -Develop
and maintain a mobile device security policy which defines which types ofmobile devices are permitted to access corporate resources, the degree of access, and
how provisioning should be handled'
ii. Implement and test all prototypes of mobile devices solution(s) before rolling into a
production environment.iii. Fully secure each mobile device before allowing user access.
iv. Support strongly encrypted data communications and data storage, and remotely
wiping the device if it is lost or stolen and is at risk of having its data recovered by an
untrusted party.v. Require authentication before accessing organization resources, resetting forgotten
passwords remotely, automatically locking idle devices, and remotely locking devices
suspected of being left unlocked in an unsecured environment.
vi. Restrict which applications may be installed (through whitelisting or blacklisting),
installing and updating applications, restricting the use of synchronizalion services,
digitally signing applications, distributing the State's applications from a dedicated
mobile application store, and limiting or preventing access to the enterprise based on
the mobiie devices' operating system version or mobile device management software
client version.
The Contractor will ensure the security of Web Servers through augmentation of traditional
security mechanisms consisting of frameworks based on use of authentication, authorization,
confidentiality, arid integrity controls. The Contractor will adhere to the following guidelines:
i. Use Secure Socket Layer and Transport Layer Security (SSL and TSL). Secure Sockets
Layer uses a public key to encrypt data transferred over the SSL connection.
ii. Counter Denial of Service (DoS) attacks through replication of data and services for
improved availability. Replication and redundancy can ensure access to critical data in
the event of a fault and will enable the Contractor's System to react in a coordinated
manner to overcome disruPtions.iii. Use logging of transactions to improve non-repudiation and accountability. Non-
repudiation and accountability require logging mechanisms involved in the entire Web
Service transaction.iv. Use threat modeling, harden operating environments with the latest fixes, patches and
configurations, and conduct software security testing to include scheduled penetration
testing. The Contractor's solutions will provide a secure operating environment to
withstand avaietY of attacks.
v. Patch and upgrade the operating Contractor's System (OS), remove or disable
unnecessary -sirvices
and applications, configure OS User authentication, and
periodically test the security of the OS.
vi. Use performance analysis and simulation techniques for end to end quality of service
and quality of protection.vii. Use Web Service security standards, tools, and techniques required for traditional
security mechanism, such as firewall, intrusion detection systems (IDS), and secured
operating systems.a. These controls are in effect before implementation or deployment of Web Services
Pacn 23ot268CoNrnl,cr #28739
AnnnNowrnNT # 2
srarn or vnnvroNr, conrmcr F'oR pnnsoNal sBnvrcns pAcn24or 26gDnpanrvrnNT o['vnmaonr Hnalrn Accnss CoNrnacr # 29739EQHnn rn Sor,urroNsr INc. AvrnNounnr # 2
applications.viii' Support web browsers that use the latest security measures/controls and are supported
by the provider.ix. Only support the last three (3) browser versions to ensure the latest security
architecture.x. Use the latest utilities to conduct an optimization study, which enables us to maintain
a proactive security posture in terms of browser types, versions and configurations.
g.,Sl,,Rs and PerformanceThe Contractor shall proactively monitor the performance of the System's applications and rapidlyrespond to, and address, performance issues across the entire System. The Contractor will captureWeb page response times from the State end point down to the backend database calls. TheContractor's performance monitoring will provide dashboards with drill down capability, reports,and customized alerts to provide a mechanism for stakeholders (including State staff) to reviewS LRJperformance management.
All SLRs and performance metrics will be demonstrated during the Operational Readiness Testing.
3. Performance RequirementsThe Contractor will ensure that all data transmitted over the Internet is encrypted using 256bit ata minimum SHA1 encryption over an SSL connection.
Security and software updates will be regularly scheduled to insure the Contractor's systemsremain secure, and compatible with the latest browsers and performance. Regular system updateswill be communicated and scheduled in advance and will not be performed during peak usagetimes.
The Contractor will monitor the performance of both the storage and virtual infrastructures. TheContractor will provide real time monitoring and alerting with customizable thresholds toproactively address performance issues before they become a problem.
The Contractor will isolate and optimize performance and utilization of virtual machines, physicalservers and storage resources, and investigate Users identified by the APM tool's algorithms asdissatisfied or frustrated to identify and fix their issue, improving overall system performance.
The Contractor's monitoring solutions will be role-based and provide real-time dashboards withdrilldown capabilities described in this requirement. The Contractor's System configurationscreens will allow for easy customization.
The Contractor's System architecture will support:i. Internal State Workers and external participants.ii. Mission-criticalservices/ServiceLevelAgreements.iii. Ease of management.iv. Ability to upgrade (ease and compatibility).v. Virtualization and resource management.vi. NetworkPerformanceRequirements.vii. Meeting System response time requirements.
Sr^q,rr or VnnvroNt, CoNtnncr FoR PrRsoN,q.L SBnvrcrsDnp.q,ntvrnNT oF VnnuoNr Hn,qlrn AccpssEQHn,t r,rn SolurroNs, Iittc.
PAGE 25 or 268CoNrnacr #28739
AvrnlrovrnNr # 2
viii. The Contractor's System must provide data dashboard capabilities to facilitate real
time graphical display of technology performance metrics with drill-down capability
aligned with IT Operations (Jser's role and permissions.
4. Performance Monitoring and ManagementThe Contractor's performance Monitoring and Management will include the methods for centrally
managing system resources such as servers, backup, archiving, and recovery equipment, databases,
and applicutiont. The Contractor's methods will address auditing, tracing, and scanning the
Contractor's System.
The Contractor will be proactive in diagnosing any problem across each critical layer.
All dashboards will be monitored daily by the Contractor's systems engineers and logs will be
archived and available for auditing purposes.
The Contractor will monitor through a unified dashboard all hardware assets as well as all software
service interfaces such as relational databases.
The Contractor's System shall leverage all registries as well as draw data from the current MMIS
system to obtain teneficiary eligibility on a routine periodic schedule as determined' The
iontractor's System shall interface with the future Integrated Eligibility System to obtain
eligibility information. The Contractor's System shall interface with the Vermont HIE system to
obtain detaits of interaction with and services provide to beneficiaries by the provider in real-time.
The Contractor's System shall be capable of Exchange/Outlook integration with support from local
IT resources to ensure security and fault tolerance.
5. System AvailabilitYThe Contractor is responsible for delivering a cost-effective, high-availability environment that
minimizes the frequency and impact of system failures, reduces downtime, and minimizes
recovery time in the event of catastrophic failure.
The Contractor will provide a multi-redundant architecture which ensures the availability of the
Contractor's System.
The Contractor ensures that when one path is taken out of production temporarily for maintenance,
a redundant path will pick up the load and keep the Contractor's Systems available during the
maintenance cycle. All of the Contractor's high-density servers will be 'hot' capable so they do
not need to be powered down or taken out of commission in order to scale.
The Contractor's System shall be hosted in Tier 3 orhigher data centers, and will be equipped with
multipath burstable bandwidth from the hosting facilities.
The Contractor will identify software bottlenecks, excessive calls to the database, suppressed
errors, and system responses falling outside the minimum acceptable standards. The Contractor
will immediately fix found issues to ensure issues do not make it into the production environment.
The Contractor's Development Team will monitor the production environment using APM to
proactively identify and resolve issues not detected during the development process.
Srarr or VnnvroNro CoNrucr FoR pnRsoN.lr, SnnvrcnsDnp,lnrunNT oF VnnvroNr Hnar,tn AccnssEQHn,t lrn Sor,urIoNs, INc.
Pacn 26o1268CoNrnncr #28739
AprBNounNr # 2
6. IT Component Capacity PlanningThe Contractor will plan, size and control the system as IT Component Capacity needs change.The Contractor's plan will address, but not be limited to the following system areas:
i. Database Storage Capacityii. Real-time Integrated / Centralized Databaseiii. Data Warehouse and Data Martsiv. Knowledge Basev. Audit Log Storage
The Contractor's database instances will be centrally hosted on a primary Storage Area Network(SAN) and will be replicated real-time to a secondary site.
The Contractor will actively analyze the health of the storage systems at both the hardware andsoftware layer. The Contractor will maintain a very conservative overhead of free raw capacitythat will be immediately provisioned to grow logical drives for the databases, documentrepository or integrated knowledge bases.
All storage area networks will be full fiber channel with redundant fiber channel switches.
a. System Administration and Supporti. Account Administration
The Contractor's System shall include both authentication and authonzation mechanisms.Authentication will follow industry best practices for password strength and resetfrequency. The Contractor's System shall also automatically log a User out if a period ofinactivity is exceeded. The authoization framework will allow an administrator to securethe Contractor's System down to the object (button, menu item etc.) level. Any givenUser's access will be limited to exactly what their role or responsibility entails. EachUser's security profile will include roles. Given permission can be "denied" to exclude itfrom a given User's role.
ii. System AdministrationThe Contractor will provide ongoing support and maintenance, including customizationofthe Contractor's System computing ecosystem. The Contractor will have the State staffperform functions such as account administration, configuration of rules, reference filechanges, etc. The contractor's overall management framework will include:
1. Application management and monitoring2. Web services management3. Systems management and monitoring4. Event management5. Identity and Access Management6. Network management and monitoring7. Performance monitoring8. Print Prioritization& Management9. Workload Management
The Contractor will use technology for realtime User and application performancemonitoring (APM), as well as provide real-time actionable intelligence to rapidly respondto and address performance issues across entire software portfolio.
Srnrn or VnnvroNt, CoNtrucr FoR PnnsoNl,L SnnvrcnsDnpantvrnNT oF VnRvroNr Hnar,rn AccpssEQHnar,rn Sor,urroNs, INc.
Prcn 27 o1268Cor'lrru,cr # 28739
AvrnNovrnxr # 2
The Contractor's System shall provide advanced drill down reporting, dashboards, and
customized alerts to provide'a single viewpoint for support and technical personnel and to
proactively monitor application performance,
The Contractor's System shall capture Web page response times from the User end point
down to the backend database calls to ensure Web pages meet or exceed the SLAs set forth
in Section I - Maintenance Requirements, subsection 2 - Service Level Requirements ofthis Contract.
The Contractor will monitor web service performance, web requests, end-to-end monitor
Internet Information Systems (IIS) application pools, web site availability, load balancing
status, IIS logs and Windows events for all production Web sites. When one of the
thresholds for a monitor is exceeded, alerts will be automatically sent to the appropriate
staff, depending on the nature of the alert, a scripted action such as restarting an IIS
application pool will be automatically triggered.
The Contractor will provide active and passive monitoring of items such as Central
Processing Units (CPU), disk and memory utilization, device up time, and custom monitors
for production related services such as SQL processes, anti-virus, and in-house developed
applications. When one of the thresholds for a monitor is exceeded, alerts are automatically
."trt to the appropriate staff and depending on the nature of the alert, a scripted action such
as restarting a service will be triggered. When alerts are received regarding CPU, disk, and
memory utilization for the servers, the Contractor will proactively add resources where
needed without the need to shut down or restart the system.
The Contractor will analyze Syslogs, operating system events, World Wide Web
Consortium (W3C) \IIS logs, and perform automated reporting and alerting on the log data.
The Contractor will use unified threat management network security appliances. The
Contractor will provide centralized logging for all security events and logs while
conducting network security monitoring, analytics, reporting, and alerting'
The Contractor will monitor health, availability, and status of all network and system
devices in the infrastructure via Simple Network Management Protocol (SNMP) traps and
Syslogs. The Contractor will give each'account access levels that are in direct relation tojob functions using the Least Privilege Rule.
The Contractor will use bandwidth monitoring on all firewall interfaces which includes
VPN tunnels. The Contractor will monitor performance of both storage and virtual
infrastructures analytics-based IT management software solution designed to isolate and
optimize performance and utilization of virtual machines, physical seryers and storage
resources.
The Contractor will monitor at the server level using real time monitoring and alerting withcustomizable thresholds and proactively address performance issues before they become a
problem.
Surn or VnnuoNr, CoNrnacr F,oR pnnsoN.tr, SnnvlcnsDrpantnnpNT oF VnniuoNr Hnar,tn AccnssEQHnnlrn Sor,urroxs, INc.
lv.
v
Plcn 28 or 268Coxrnacr # 28739
AunNnnnoNr # 2
The Contractor will manage the performance of the virtual infrastructure. Performance datawill be abstracted to health, risk, and efficiency measures based off key performanceindicators and will be displayed in a roles-based access dashboard.
The Contractor will utilize a full IT service management software package built on ITIL(Information Technolo gy lnfrastructure Library) best practices.
The Contractor will track, report, and manage key ITIL processes, and track, monitor, andmeasure the workload to meet or exceed service level agreements.
iii. Audit TrailContractor shall track infrastructure and applications at a granular level across all tiers andcapture all transactions, end-to-end, from a User click, to the database record and back.The Contractor will provide accurate and timely reporting, granular business transactiongrouping and precise SLA management.
All dashboards will be monitored daily by systems engineers and logs will archived andavailable for auditing pu{poses.
Data BackupThe Contractor will use offsite storage. Data backup should be stored offsite in the eventof a physical disaster. The Contractor will ensure data is replicated near real-time andfailover is automated. Full online scheduled file level backups are snapped locally andreplicated to disparate DR data center. Database and application backup procedures mustbe updated to include backups for the Contractor's System. Full online data backups mustoccur, as well as offline backups using tape storage.
Data ArchivalThe Contractor's following data retention policies will dictate the lifecycle of data and thetimeframe at which operational databases will be truncated and archived:
1. The Contractor will maintain seven (7) years of data at the highest performingtier of storage and archive the expiring longitudinal dataset on a quarterly basisto lower tiers.
2. The Contractor will schedule maintenance utility flags for all candidate dataand will perform the archival in a hierarchical approach to ensure all datadependencies are considered.
3. The Contractor's archived data will remain retrievable via a databasemanagement system but will be segregated by schema to exclude it from theContractor's System during normal operation. This data can be restored to theproduction tier of storage by archiving utilities if necessary.
Disaster RecoveryThe Contractor will develop a High Availability & Disaster Recovery Plan for the entireContractor's System driven by State's Recovery Time Objectives. The Contractor will havea thoroughly tested Disaster Recovery Plan and Business Continuity Plan on file that can
vl.
Surn or Vnnuoxt, CoNtnacr F'oR PBnsoN,ll, SnnvrcnsDspA,nrMnNT oF VnnvroNr Hn.qltH AccnssEQHralrn Sor,uuoNso INc.
be executed in the event of an unforeseen emergency/disaster. The Contractor's computer
systems will be protected against catastrophic faitrure and business intemrptions.
The Contractor will conduct annual testing of the above-mentioned plans to determine their
validity and determine any need for revision to meet the current situation of IT resources
and peisonnel. The Contractor will ensure thatdatais protected and operations will resume
as soon as possible.
The Contractor will provide immediate redundancy locally to a secondary hardware
footprint as well as a secondary location within wide area network (WAN). The
Corrtractor's WAN will be comprised of private circuits that do not carry pdblic traffic.
In the event of a catastrophe which results in the loss of the Contractor's primary location,
a series of automated failovers and manual failovers will be enacted to cutover andpromote
the secondary location to reestablish a production environment. This will be accomplished
within required recovery time objectives with virtually no loss of data.
b. TechnicalDocumentationThe Contractor will provide comprehensive technical documentation consisting of detailed
functionality, architecture, design and code sections. The functionality section will describe the
intent of the application or module and subsections will include use case diagrams, site maps and
a field matriridentifying key data columns. The architecture section will document the overall
structure of the software including components and application interfaces. The design section willinclude an object diagram, an entity relationship diagram and a data dictionary. The code section
will list file names and the database schema structure.
Each iterative production release will include the associated technical documentation along with
the release notes.
c TechnicalEnvironmentsThe Contractor will establish:
i. Multiple environments (e.g., development, testing, training, and production)'
ii. Procedures used to migrate software from one environment to another.
iii. Steps needed to maintain the synchronization between environments.
The Contractor's software development lifecycle process will include several carefully managed
and monitored environments to include: development environment, test environment, stage
environment, and production environment.
When the Contractor's software has been fully tested, a cross-functional team of developers,
system administrators, and quality assurance analysts, led by a project manager, will prepare for
the migration process. The Contractor will document risks and resources will be assigned to
facilitaie the roll-out and review the standardized procedures. Before any software is migrated, a
full system backup will be created to ensure the integrity of data.
PncB 29 o1268CoNrru,cr #28739
AnnnNuunNT # 2
surn orvnnuoNr, coNrnacr FoR pnRsoNar. snnvrcns pacn 30 or 26gDnpanrunNT oF vrnuoNr Hnllru Accuss coNrnlcr # zg73g
AvrnnnmnNr # 2EQHnalrn Sor,urroNs, INc.
After implementation, the software will be validated in the new environment by the Contractor'srelease team. The Contractor shall provide a report regarding validation in the new environment.The State will review the report and provide comments.
H. IMPLEMENTATION1. Project Management
a. Project ManagementThe Contractor shall follow project management methodologies that are consistent with the projectManagement Institute's (PMD Project Management Body of Knowledge (PMBOK) Guide. Allstaff and subcontractors proposed to be used by the Contractor shall be required to follow aconsistent methodology for all Contract activities.
The Contractor will provide a Project Manager (hereinafter referred to as "PM") whose effort willincorporate all the tasks necessary to successfully implernent the project. These tasks will include,among others consistent with the PMBOK methodology, updating Project Plans, assigning staff,scheduling meetings, developing status reports and reviewing them with the State, addressingproject issues and change orders, and preparing presentations for State stakeholders. TheContractor's PM shall have overall responsibility for the project deliverables, schedule, ffidsuccessful implementation of the project as planned and all activities of Contractor's resources.The Contractor and subcontractor will use a unified project management tool set approved by theState Authorized Representative(s)
The State's PM shall supervise the Contractor's performance to the extent necessary to ensure thatthe Contractor meets performance expectations and standards. The Contractor's PM shall workclosely with the State's PM on a day-to-day basis. The Contractor's PM shall be on-site in Vermontas the State may require during the entire project based upon an agreed project schedule. TheContractor's PM shall be required to schedule and facilitate weekly project team status meetingseither on-site in Vermont or via tbleconference.
The Contractor PM shall provide weekly written Status Reports to the State PM. Status Reportsshall include, but not be limited to:
i. The status of tasks and deliverablesii. Issues and risksiii. Upcoming activities
The State PM will determine the exact format and content of the report document at or before theproj ect kickoff meeting.
The state shall require the following Project Management Deliverables:i. Contractor PM to work with State project team to finalize a detailed project work plan
(in Microsoft Project). The Contractor shall maintain and update the project plan (i.e.,project schedule) on a regular basis (at least weekly, if not daily).
ii. Project kickoff meeting.iii. A detailed Project Management Plan (PMP) that aligns with the State's Project
Management Plan for this project.iv. Weekly project status reports as defined above.v. Up-to-date project issues log.vi. Up{o-date risk log.
Sr.q.rn or Vnnvront, CoNtntcr FoR PnnsoNar, SnnvrcnsDnpanrvrnNT oF VnnvroNr Hrll,rn AccnssEQHru,rn Sor,uuoNs, INc.
P.a.cn 31or 268
CoNrRAcr #28739AunNonrnNr # 2
vii. Weekly project team meetings which shall include meeting agendas and meeting
discussion log, action items and update issues and risk logs accordingly.
viii. Stakeholder register.
#il ith Vermont AHS's program and project management team to
align business objectives, establish key metrics and management reporting requirements to ensure
on time, on budget delivery, with quality.
Joint eovemance structure between Contractor and the State
1.tt. Stut" PM and State Vendor Manager (hereinafter referred to as "VM") shall supervise the
Contractor's performance to the extent necessary to ensure that the Contractor meets performance
expectations and standards. The Contractor PM will work closely with the State PM and VM on a
day-to-day basis.
b. Project Work-planThe Contractor's planning management model must be approved by the State and shall align with
Vermont AHS's program and project management team, as business objectives and projects are
implemented, in addition to instituting key planning metrics and standard reporting mechanisms
to insure on time, on budget delivery, with quality. The Contractor's planning management
capability will support the overall organization in realizing its goals and in the process also help
better collaboration with the project management teams.
c. Organizational Change Management Plan
The Contractor shall develop and implement a comprehensive Otganizational Change
Management (hereinafter referred to as "OCM") plan for both internal and external staff across
functions, roles, and locations that are impacted by the Care Management Solution. The
Contractor's OCM plan will address how various State staff are anticipated to react to the change
and the development of open, timely, and consistent communication of the solution's benefits. The
plan also will address relevant training and coaching to help staff understand what is expected ofih"-, and will identify continuous feedback mechanisms to measure and adjust OCM activities.
The Contractor will:i. Use an Organizational Readiness Assessment approved by the State Authorized
Representative(s) to determine the organizational readiness of the DV_H+, other State
agencies, stakeholders, ald providers to adopt the Care Management Solution.
ii. Identify and evaluate key organizational focus areas, impacts, and risks that need to
be addressed to achieve program outcomes.
iii. Identify, analyze, and address differential impacts to various stakeholders and end-
Users.iv. Identify and evaluate the organizational capabilities (structure, stratqgy, systems,
skills, style, staff, values, etc.) required to effectively leverage the functional and
business capabilities deployed by the care Management Sblution.
v. Develop recommendations for the future organizational structure (business,
technology and Partners).vi. Develop an overall organizational change management strategy that complements the
implementation roll-out plan with specific attention to the following:
Sr.Lrn or vnnvront, contnacr FoR pnnsorrur, snnvtcrs pacn 32 ot 26gDnplRrvrnNT or vnRuoNr Hn,rr,ru Accnss coNrucr # 2g739EQHnu,rn SolurroNsr INc. ANrnNoNrENr # 2
1. Accelerated adoption of behaviors, attitudes, and operational practices requiredfor impacted staff to support the change;
2. No intemrptions to service delivery during Care Management program roll-out.vii. Develop and deliver a robust communication strategy consistent with DVHA's
operating culture and information needs of different stakeholders.viii. Conduct Change Impact Assessments to determine the impact on affected stakeholders,
including business processes, people, and technology implications to inform contentfor future communications and training activities.
ix. Conduct Periodic Assessments that track successful change adoption among affectedaudiences, and inform the OCM plan by providing structured feedback on what isworking well and identifying risks or issues.
The OCM plan will identify and evaluate the capabilities (skills, structure, roles/responsibilities,governance, etc.) required to effectively leverage the functional and business capabilities deployedby the Care Management Solution and develop recommendations for the future organizationalstructure (busines s, technolo gy, and p artners).
d. Change & Release ManagementThe Contractor shall provide a centralized solution to automate and control the software changeand release management process.
Change and release management will contain:i. Library Management-The classification, control, and storage of the physical
components of the applicationii. Version Control-The maintenance, tracking, and auditing of modifications to an
application's components over time, faciliiating the restoration of an application toprior development stages.
iii. Turnover Managemeht-The automated promotion of software changes across differentphases of the lifecycle (e.g., development, unit test, systems test, and production),including management of the approval process, production turnover, and softwaremigration control.
The Contractor shall use a change management portal, designed using ITIL and State of Vermont'sbest practices, as a central point of control over the change process that tightly integratestechnology with process. The portal will have the ability to create extensible workflows toensure that any change introduced into the IT infrastructure follows a regulated process, therebypreventing unauthorized change and eliminating the potential for system downtime or systemdegradation.
The change managernent portal includes a centralized fully customizable change dashboard. Usingthe portal, the Contractor and State will identify "key performance indicators" or process metricsthat are particularly important to the State that will be carefully designed, implemented, andmonitored.
e. Sofnuare Configuration ManagementThe Contractor will provide the automatic capture and storage of IT Service to Application,Application-to-component, and component-to-component relationships.
Srarn or Vnnn routo Contucr FoR Pnnsoxer, SnnvrcnsDnpanrunNT oF Vnnvroxr Hnar,rn'AccEssEQHnnr,rn Sor,uuoNs, INC'
The Contraptor will maintain the history of relationships and any transformation required of IT
servioe to Application, Application-to-Component, and Component-to-Component to
appropriately -uttug" and document configuration changes whioh affect the application and the
pioc"ssing environment. Management and documentation will include, but not be limited to,
source control, version control, profiles, and securityplans.
f. RelationshipManagementThe Contractor shall be responsible for the following
i. Identifying ali stakeholders, including:1. ThJse people or groups directly or indirectly involved in the project.
2. Those who are key to an effective implementation, the key decision makers and
those accountable for the delivery of the benefits'3. People in the suPPort functions.
ii. Establishing stakeholdei's baseline positions and identifying stakeholder's issues.
iii. Mapping stakeholders and assessing their needs and requirements.
iv. pormuliting a stai<eholder Management Plan using the results of the stakeholder
mapping.
g. Issue and Risk Managementihe Contractor shall be responsible for risk and issue management, including the identification,
assessment, logging, tracking/monitoring, reporting, espalation, resolution, and closeout of an
issue.
The Contractor and the State of Vermont will determine when an issue is resolved, and the State
of Vennont will approve the closeout of an issue.
h. Qualtty ManagementTheZontractor shall be responsible for quality management, which includes providing a QualityManagement Plan and performing assurance and quality conhol. The Conkactor QualityManagement Plan shall have the following elements:
Detailed definition of all deliverables by phase and associated acceptance criteria.
Defined deliverable review process.
Disciplined deliverable review process.
Regularly scheduled reviews of key project phases and milestones.
Identified tngetperformance areas and proposed methods of measurement; establish
the baseline metrics for the agreed upon goal areas; and assist the State in determining
the level of achievement of the performance goals.
The Contractor's internal qualrty management program will ensufe that the Contractor's System
shall detriver returns and business value in accordance with the envisaged usage, both functional
as well as technical,
A Quality Management Plan is required to guide the prOject team regarding qualityprocesses and
ptor"g improvement practices. The Contractor's Quality Management Plan will avoid rework and
iefects in ihe final product/deliverable(s). The Quality Management Plan will have the ability to
track quality at any stage of the project, and provide a capability to identify defects, problems,
complaints, etc. during each stage of the project.
Pacn 33 o1268CoNrnacr #28739
AMENDMENT # 2
1.
ii.iii.iv.v.
srarn or vnnuonro coNrucr FoR ppnsoN,q.r, snnvrcns p.q.cn 34 or 26gDrp,lnrurNT oF vnnuoNr Hnar,ru Accnss coNrn.tcr # 2g739EQHnar,rn Sor,urroNs, INc. AnnnNnvmNr # 2
The Contractor will define a system/process for quality control and establish, with the State,accepted standards of performance and measure against these standards. The Quality ManagementPlan will provide metrics that measure performance against standards.
The Contractor will recommend changes to the policies and practices in a manner that improvesthe quality of deliverables.
The Contractor shall:i. Set up a regular cadence of intemal and external inspections.ii. Schedule inspections with a specific pu{pose, e.g. entry and exit gates in a processiii. Establish criteria for each inspection.iv. Develop an expectation that peer reviews, code reviews, and document walkthroughs
are conducted and documented on a regular basis.v. Set up a process for random inspections ofthese review processes.
The Contractor's Quality Management Plan will include:i. Reportingii. Metrics managementiii. Documentationmanagementiv. Continuous improvementv. Adoption and alignment with the quality standards of the State
The Contractor shall identify the measurable aspects of the project such as conformance todocumentation templates, number of errors in a State document, number of defects identified,milestones met on time, schedule delays, etc.
The contractor will develop a Quality Management process that will:i. Include stakeholder participation in the quality process.ii. Include key quality messages in a cadence (weekly, bi-weekly, monthly, etc.).iii. Keep stakeholders informed and involved in process improvements.iv. Keep the information consistent.v. Track and report trends once an established pattern of metrics emerges.vi. Provide a dashboard in a "pull" location such as a SharePoint@ but also push it out to
key stakeholders; the dashboard will simple and easy to populate.vii. Provide intemal and extemal quality reviews and readouts at all levels internal and
external.viii. Provide quality audits.ix. Provide process analysis.x. Take each high-level measurement and apply a formula for achieving a metric with
expected inputs and output.xi. Establish a standard format for the metric, e.g. a percerrtage, aratio, a sum, etc.xii. Ensure the data necessary to create the metric is readily accessible and is correct, and
the measurements will be relevant.xiii. Align quality management tool usage with the project.xiv. Provide analysis, determine root cause, identify a solution, and execute continuous
improvement.
The Contractor will consistently report quality metrics.
Srarr or VnnvroNto CoNtnacr FoR PnnsoNar, SuRvrcrsDnp.qnrurNT oF VrnuoNr Hnllrn AccnssEQHn,Llrn Sor,unoNs, INc.
Pncn 35 or 268
CoNrru,cr # 28739AvrnNnnlnNr # 2
The Contractor, with the inclusion of the State, will provide inputs/outputs to quality measures.
The Contractor will align measurements, acceptance, and timelines to the project. Measures,
tracking of inputs/outputs will be monitored.
The Contractor will collaborate with stakeholders to evaluate lessons learned, and publish an
After-Action Report. A template with requirements and key quality measurements (requirement
traceability) will be prepared.
The Contractor will:i. Establish a quality control process to monitor, measure, and manage quality process'
ii. Createrealistic metrics and establish a quality dashboard.
iii. Establish tool sets to be used.
iv. Report on continuous improvement (from ground up).
v. Initiate internal audits to check the effectiveness of quality processes on the project.
rhe contraiffi?lHil:lH?tfiI',tt;" 0",,, into the project pran.
ii. Drive communication process to create a quality friendly environment.
iii. Conduct a lessons learned process post project delivery'
i. Security and Regulatory ManagementThe Contractor will maintain physical and logical security relative to the services it provides. This
will include an overview of the policies and practices to prevent, detect, and resolve security
breaches. In addition, the Contractor shall demonstrate experience and abilityto meet all regulatory
requirements (e.g., FISMA, HIPAA, and Vermont Statutes).
The Contractor will provide an information security structure that is based upon the ISO27001
framework which is in line with HIPAA and HITECH acts. The following minimum activities are
performed to ensure current and future compliance:i. A11 health care associates are mandated to undergo four stages of e-learning sessions
on HIPAA; they must complete an assessment on their HIPAA understanding.
ii. All health care associates are mandated to undergo e-learning session on revised
HITECH act and liability of a business associate.
iii. All employees are mandated to complete a course on acceptable use policy annually,
which covers aspects for privacy and security.
iv. ln addition to above, an information security awareness training program is conducted
for associates, and security controls agreed to by the State are briefed to associates
semi-annuallY.v. The staff follows a detailed and well-documented approach to risk management.
Facility level risks and account security risks assessments are conducted on an annual
basis where physical security risks and risks associated with compliance controls
agreed in MSA to comply with HIPAA/HITECH and State Statutes. Account level
security risk assessment and vulnerability assessments are conducted on a quarterly
basis checking the operating effectiveness of the controls.
vi. SAS 70 / ISO 27001 and Third-party audits are performed to check the control
effectiveness in addition to above said internal audit. The Contractor shall notify the
State's Agency of Digital Services Security Division to review and approve before live
data is entered into any third-party system.
srlrn or vnnvroNr, conrnacr FoR pnnsox,q,r, Srnvrcns plcn 36 or 26gDnpaRruBNT oF Vnnvronr Hn.qlrHAccnss CoNrnq.cr # 29739EQHnn rn Sor,urroNs, INc. AvrnNovrnNr # 2
vii. Security awareness notes are sent to all associates on a monthly basis.
Securing Customer InformationThe Contractor will have appropriate operation and technological processes and procedures thatare designed to safeguard against unauthorized access, loss, destruction, theft, use or disclosure ofdata. These controls will meet or exceed the requirements listed below.
Process Controls:i. The Contractor will act only on the basis of State instructions with respect to State data
that is processed.ii. The Contractor will not disclose State data to a third partyunder any circumstance other
than at the specified request of the State.iii. All rights, title, and interest in personal data shall remain vested solely with the State.iv. Periodic risk assessment and audits of accounts are conducted.
People Controls:The Contractor will have a well-defined Acceptable Use Policy goveming the safeguard ofconfidential information. All associates will read, understand, anA sign the AcJeptable Use policydocument. Associates who fail to comply with this policy are subject to disciplinary action,including revocation of his / her privileges. Violations of this policy may result in termination.
i. The Contractor's associates are required to sign a Non-Disclosure Agreement (NDA)ii. Stringentbackground checks are carried out on all personnel.
Technical Controls:i. Sen'ers will be hardened to standards.ii. Servers are housed in secure data centers with physical access given only to authorized
members of the system support team. Physical access to data centers and any server ismonitored continuously from a c;entralized building management system.
iii. DoD compliant tool such as Darik's Boot and Nuke (DBAN) tool is used for disksanitation.
This table references Non-Functional Requirements T3.55 and T3.56
Contractor's Role Contractor' s Responsibilities
Intrusion DetectionSystem (IDS)monitoring team
Todetect all types of malicious network traffic and computerusage. This includes:
o Network attacks against vulnerable services
o Data driven attacks on applications
o Host based attacks such as privilege escalation
o Unauthorized logins and access to sensitive files, andmalware (viruses, Trojan horses, and worms)
o Report breaches discovered by the intrusion detectionsystem
Srarn or VnnivroNt, CoNtnncr FoR PnnsoN.c,L SnnvlcnsDnp.qntvrnNT oF VnnvroNr HnllrH AccrssEQHnru,rH SoLurIoNs, INc.
P.tcn 37 or 268
CoNrru,cr #28739AvrnNovrnNr # 2
Network and SystemSupport (NSS)engineers
Any real or suspected aof computer systems or
dverse event in relation to the securitycomputer networks can be termed as a
logical security breach. A logical security incident can be
defined as network or host activity that potentially threatens thesecurity of computer systems, includes activity such as:
o Attempts (either failed or successful) to gain unauthorized
access to a sYstem or its data
o Unwanted disruption or denial of service
o The unauthoized use of a system for the processing orstorage of data
o Changes to system hardware, firmware, or software
characteristics without the owner's knowledge, instruction,or consent
Administration(Physical Security)team
Physical security incident is the act of violating an explicit or impliedphysical security policy. Incidents include activity such as:
o Attempts (either failed or successful) to gain unauthorized
accsss to the facility
o Riots / strikes which could adversely affect any of the
Contractor' s or subcontractor' s locations
o Theft of property
Intemal / external (GISto raise on their behalf)audit team
Ensure this by conducting periodic compliance activities includingrisk assessments and security audits.
Global InformationSecurity (GIS) team
Development and maintenance of security and continuity related
policies, procedures, standards and gUidelines. Ensure that the above
security policies are being followed and adhered to. Conduct periodicactivities risk assessments and securi audits.
Every associate is responsible to report any suspected / actual security
compromise and this is reiterated through regular training programs
and securi run from time to time.
Associates
Communication of Security CompromiseAll incidents are reported to the State of Vermont contacts and are accessible through the intranet,
intemet, email, intercom, or through toll-free telephone numbers. The incident reporting facility is
available 24x7 and permits anonymous incident reporting. Based on the severity of the incident,
escalation to concerned parties within defined timeframes as specified below:
i. A security incident or event is notified to the local incident response team and Global
Information Security (GIS) team.
ii. The local incident response team immediately acts on the notified incident.
iii. Perform impact analysis and provide necessary support.
iv. If the incident is low impact and can be resolved within an hour, the incident report is
submitted to the corporate incident response team and it is documented in the GIS
Portal.
srarn or vnnmoNro coNrrucr F'oR PnnsoN.q,L snnvrcns pacp 3g or 26gDnpanrunNT oF'vnnvroNr HnalurAccnss coNrnacr #zg73gEQHnar,rn Sor,urronsr INc. AurNnvrnNr # 2
v. If the incident is high impact or cannot be resolved within an hour, the team escalatesto senior management.
vi. The corporate security and incident response team acts on the incident immediately.vii. Designated State contacts will be informed of incidents as soon as they are escalated.viii. If the incident is not resolved within 4 hours from the time of incident, inform the local
Business Continuity Planning (BCP) team in case the incident warrants an invocationof the BCP.
ix. Based on the severity level, the team updates the State, project managers, and accountmanagers.
All communications are sent through one or more of the following systems:i. E-Mailii. Telephone / Mobileiii. Hotlineiv. Fax
The Contractor will establish an Emergency Contact Center (ECC) with a toll-free number,wherein Users can call 2417 and inform any incidents. The ECC is manned by trainedprofessionals, who have access to detailed information on location of nearest medical facilities,civic authorities, support teams etc. Based on the type of incident and nature of emergency, ECCprovides support to the User.
2. Environment Installation and ConfigurationThe seven.(7) environments include:
#Environment
NameDescription
Users DataPHI
(yes/no) Security Level
I Production * State users* eQH Level2Support* OperationsSupport
Live Data Yes HigVCertified
2 DisasterRecovery
State users Live Data Yes High/CertifiedSame as Production
J Staging(Vendor QA)
* State users,* eQH Leve72Support* OperationsSupport
Live Data(Copy ofPROD)
Yes High/CertifiedSame as Production
4 Training State users/Dev/CMTTesting/eQTestins
ObfuscatedData
No Medium
Srarn or VnnuoNt, CoNtru,cr FoR PnnsoNl'L SnnvlcnsDnplntvlnNT oF VnnuoNr Hn.AI,tn AccnssEQHnn rn Sor,urroNs, Inc.
PAGE 39 or 268
CoNrru,cr #28739AvrnNovrnNr # 2
5 UserAcceptanceTesting
Each of these environments will be managed by the Contractor's configuration management team.
The training and production environments reside on a web farm hosted in a perimeter network and
are isolated from the intranet by firewalls and gateway appliances. The hardware and software
hosting of all non-development environments are detailed in Sectipn G. Technical Requirements
in this Contract.
A subset of the configuration will kept in an XML file that allows for runtime configuration ofenvironment specific code. The abstraction of these configuration items allows a different version
of this file to be used for each environment and can be managed in source control in their respective
branch.
The change management process, specifically the release plan, includes steps for the promotion ofconfiguration values from development to production.
3. Knowledge Transfer & TrainingThe Contractor shall provide a Knowledge Transfer and Training Plan, The Contractor shall
identify and evaluate the knowledge to be transferred, The Contractor will determine for technical
personnel:i. The knowledge to be transferred.ii. How the knowledge will be used.
iii. Targeted Users of the knowledge, their leaming styles and levels of expertise.
iv. What knowledge is critical for success'
v. How the knowledge will be located and accessed by Users.
vi. How the knowledge will be maintained and updated.
The Contractor will determine for managers and end Users:
i. The knowledge needed to achieve current performance.
ii. Users of the knowledge.iii. What knowledge will deliver new value in the future'
The Contractor shall validate and document the knowledge. The Contractor will document all
platforms, tools and databases, and all relevant hardware and software configurations. The^Contractor
will develop and validate a complete inventory of all current system documentation,
will determine the value and application of each artifact, and will identify any gaps that need to be
corrected to effectively capture system knowledge'
The Contractor shall publish and share the knowledge. The Contractor will provide detailed system
documentation of items including but not limited to User profiles, transaction volumes, batch
windows, system environments, security and access control procedures, maintenance practices,
StateUsers/Dev/CMT Testing/eQ
ObfuscatedData
No Medium
UATLowDummy
DataNoTest Dev/eQ
Testing/CMTTesting
6
LowDummyData
NoDev7 Development
Sr.trn or vnnvroNr, conrnacr FoR PERSoNAL snnvlcps plcn 40 or 26gDrplnrmpNT oF vnnvronr Hn,tr,rnAccnss coNrucr # 29739EQHnu,ru SoLurroNs,INc. AurNovrnNr # 2
and issue resolution process. The Contractor will share this knowledge using the State's preferredmethod of exchange, including but not limited to publishing materials on shared sites andrepositories, both belonging to the State or provided and managed by the Contractor. Allknowledge repositories will facilitate efficient contextual discovery of comprehensive topicalinformation.
The Contractor will determine the best method of knowledge transfer based on factors such as:i. The type of knowledge to be transferred.ii. The purpose for transfening the knowledge.iii. The receiver's level of expertise.iv. The receiver's learning styles and preferences.v. Whether the knowledge will be applied in the same or a different environment.
The Contractor will develop training approaches that address the needs of different learning styles.After the Knowledge has been transferred and used by the recipient, the Contractor will conductan assessment of effectiveness of the knowledge transfer relative to the expected results.
il. Training StrategtThe Contractor will provide relevant, thorough, and timely education and training, and willidentify specific educational opportunities and provide individualized instructions throughout theimplementation and operational phases.
The Contractor will develop a technical and User training strategy that includes:i. Training State personnel who work on the project.ii. Training AHS and other State Users.iii. Training AHS executives.iv. Training AHS IT staff to ensure technical capabilities exists to support maintenance
and operations needs of the system.v' Method of training each of the above classifications, including approximate numbers
to be trained, estimated duration of each training component, and method to ensuretraining success. Methods include but are not limited to:
1. State-wide workshops to train Users on our program, polices, technology, andclinical decision support tools.
2. Frequent scheduled and ad-hoc webinars.3. Videos on specific system tasks and workflow related processes.
4. Design, Development, Customizationa. System Design MethodologyThe Contractor must conduct Joint Application Design (JAD) sessions at its Vermont location tofully explore and understand the functional requirements for the Care Management Solution, andoutline the number and topics of each session to be held.
The Contractor will apply component-based approaches to improve usability, extensibility,performance and maintenance which will provide the following benefits:
i. Avoiding large-scale and unnecessary rework.ii. Managing the risk of Impact on deployed systems and Users.iii. Improveusability, extensibility, performance and maintenance.
Sr.r.rn or VnnuoNt, CoNtru,cr FoR PnnsoNar, SnnvrcnsDnp.lnrvrBNT oF Vnnvroxr Hnal,trr AccnssEQHn,rlrn SolurroNs, INc.
The Contractor will utilize JAD sessions to design systems. This includes a cross sectional team
of key stakeholders with both technical and business expertise. During JAD sessions for thib
project, the Contractor and the State will come to a complete consensus on any given deliverable
and discuss those topics specific to each work stream module such as Document Management,
Workflow Management etc. across the functional requirements. These will be identified in the
Work Plan / Work Breakdown Structure (WBS).
JAD will include the following:
1 JAD Plan- the project managers will meet with the business sponsors to establish JAD
session deliverables and milestones of the JAD sessions. They will establish a JAD
Plan that includes:
a. The functional requirements needed.
b. Clear, understandable, measurable, and attainable goals.
c. The scope and limitations of the project.
d. Timelines.
2. Assemble the team. The Project Leader will develop a list of team members and clearly
define their roles and responsibilities.
3. Kickoff, The JAD sessions will start off with a kick-off meeting at which the executive
sponsor is present. Each team member will be guided to understand what he or she is
expected to do.
4. Execute the JAD sessions. The Contractor will facilitate and record the activities and
decisions of the sessions.
5. Closure. At the conclusion of the JAD sessions, the detailed design specification
document shall be produced by the Contractor within the timeframe agreed upon during
the planning stage. The solution will be presented to the JAD team and if warrarrted, a
prototype demonstrated. State approval will be obtained to proceed, as will evaluation
of the JAD process.
b. System Development Methodology
The Contractor will employ a System Development Methodology that corresponds to industry-
standard best practices approved by the State of Vermont. The Contractor will provide constant
and consistent communication, risk mitigation, collaboration, innovation, and continuous process
improvement to quickly adapt to business requirement changes and deliver functionality'
Dashboard reports will be available to team members and stakeholders alike to provide complete
transparency at every phase of the software development life cycle (SDLC). The Contractor will
ensure that the stakeholders are getting the needed functionality using ITIL v3 processes' including
change management. At every software release cycle, the project manager and stakeholders will
actively engage in an interactive demonstration of the latest functionality in the software. Product
feedback will be taken back to the development team and worked into the work item backlog to
correct anypotential issues immediately, instead of waiting until the end of the SDLC. The change
Prcn 4lot268Conrnlcr # 28739
AvrnNounNT # 2
surn or vnnivroNr, coNrucr FoR PnnsoN,q.L Snnvrcns PAGE 42 or 26gDnp,rnrunNT oF vnnuoNr Hnar,rn Accnss coNrucr # 2g739
AvrcNnnnnNr # 2EQHn,tlrn Sor,urtoNso Iwc.
management portal will automate and audit the workflow for change requests based on ITIL v3best practice guidelines and will adhere to internal change management policies.
Each work item of the project will have a mandatory business requirement, detaileddesign/technical specification, and test plan document linked to the stored document repository.Project transparency will be delivered through reports and dashboards.
The Contractor will employ Agile Methodology to develop its solution. Management of sprintsand other Agile components is solely the responsibility of the Contractor, but the State of VermontProject Team will be available for consultation on significant barriers or blockers during sprints.A small team of Business Analysts and Technical staff from the State of Vermont Project Teamwill participate with the Contractor's team to determine appropriate goals for each sprint and willreview sprint output to determine if the goal has been met. The intent is to provide the Contractorwith timely feedback and is in no way to be considered a formal approval. The Contractor is stillliable for formal deliverables listed within this contract. State of Vermont team will be informedand consulted at appropriate checkpoints leading up to production of formal Design deliverables.These checkpoints will be subject to approval by the State of Vermont and will be documented inthe work plan.
c. System Customization MethodologyContractor's System customizations will be accomplished by following the same process as theinitial VCCI development and will be prioritized by the product owner as described in "ChangeManagement", "System Design" and "system Development" life-cycle methodologies. Eachcustomization will follow the same process as any standard new development and will beprioritized.
d,. Datu Conversion Strategt, Approach and Timeline.The Contractor will create aDataMigration Plan, logical and physical extract, transform and load(ETL) plan detailing how existing State data will be migrated. This plan will include the tools usedfor migration and the Contractor's Acceptance Criteria that will be applied by its QualityAssurance team, subject to State approval. The plan will include:
i. Reconciliation process(es) and data checking reports.ii. Data profiling - The process of examining the data as it moves from source(s) to
target(s) and collecting statistics and information about that data. This profiling willprovide metrics on data quality (e.g. whether the data conforms to particular standardsor patterns) and business risk.
iii. Data validation checks - The ability to look at each data record to make sure theinformation is valid and of good quality.
iv. Validation mechanisms - The use of web services or other programmatic solutions toensure codes such as zip codes and other dataare valid and de-duplicated.
Srarn OF VERMONI, CONtnnCT FOR PnnSOnu, SnnvrCnS PACn 43 Or 268
DnpmrnnnNT oF VnnuoNr IInlLrH Accnss Conrru,cr # 28739
EQHnalru SolurroNsr lltc. AnnnNounNr # 2
v. Data stand ardization checks - Ensure that the data transition adheres to predetermined
sets of standards set by internal enterprise IT, such asHLT,ICD9/10, CPT@ and HPCS
codes.
The Contractor will ensure data integrity and consistency throughout all phases of the project, and
will work with DVHA to identify its transition data. The State will make a formal request on behalf
of the Contractor to the data source entity. The data for each transition project will be transmitted
via a secure FTP site provided by the Contractor. The Contractor will work closely with those
parties identified to get file specifications (format, layout etc.) and mapping to understand all the
various types of datasets.
Gap analysis will be performed to determine if the transition dataset includes all data elements
required to successfully extract, transform, and load (ETL) into the system. Gap issues will be
resolved in a logical and physical plan on how the data will be migrated. Included in the plan will
be the tools used formigration and the Acceptance Criteriathat will apply an execution of the
conversiorVtransition plan with an Acceptance Test. Reconciliation and data checking reports will
be run to determine that all quantitative and qualitative metrics are achieved post-migration, and
"data fixes" will be limited as much as possible with a thorough design plan.
e. Data Transition Strateglt, Approach and Timeline
The Contractor will develop a Data Transition Strategy, Approach, and Timeline to ensure
coordinated activities between the Contractor and the source entity are fully documented.
f. Testing Strateglt and Approach
The Testing plan will address the Unit Testing, System Integration testing (end-to-end application
testing), stress testing, performance testing, and UAT testing, backup and recovery testing and
installation testing. Interim testing, such as that done during Agile development, willbe delivered
to the State of Vermont Project Team according to a schedule outlined in the Work Plan. Interim
testing does not relieve the Contractor of delivering formal test results as described elsewhere in
this Contract.
Testing starts with the exploration of the requirements, elaborating on the User stories from
different perspectives. Testing is a continuous and integrated process where all parties in the
project are involved. Testing will be performed throughout each construction iteration. Testers will
be embedded in the development team and will actively participate in all aspects of the project.
Programmers and testers will work side-by-side and share the single role of quality assurance.
The test team will perform parallel, independent testing throughout the project and will be
responsible for the end-of-lifecycle testing performed during the release/transition phase of the
project. The goal of performance testing is not to find bugs, but to eliminate bottlenecks and
establish a baseline for future regression testing.
sr,lrn or vnnvroNr, coNrucr F'oR prnsoNnr, snRvrcns plcn 44 osz6gDnp.lnrvruNT oF vnmnoNr Hnar,rn Accnss conrnacr # zg73gEQHnar,rn Sor,urroNsr Iwc. AunNuvrnNr # 2
i. Performance Testing1. The Contractor will develop a Performance Testing plan that includes a clearly defined
set of expectations relevant to the component being tested. For example, for a Webapplication, the following would be included in the Performance Testing plan:
a. Expected load in terms of concurrent Users or.HTTP connections.b. Acceptable response time regardless of the expected load.
2. The following tools will be used to identify and resolve bottlenecks, at no additionalcost to the State:
a. At the application level, profilers will be used to spot inefficiencies in code (forexample, poor search algorithms).
b. At the database level, profilers and query optimizers will be used to gather alldatabase level statistics for performance testing.
c. At the operating system level, utilities or specialized kernel monitoringsoftware will be used to monitor hardware resources such as CPU, memory,swap, and disk I/O.
d. At the network level, systems engineers will use packet sniffers and variousutilities available in our environment to understand issues related to networktraffrc, switching and routing.
e. Black-box testing will also be done as part of Performance Testing.3. The Contractor will employ tools tltat can simulate concurrent Users/HTTP
connections and measure response times.4. The Contractor will leverage its existing Coded UI automation tests and will include
testing all given use case scenarios to capture performance for typical system activities.
ll.
lll.
Load TestingThe Contractor will increase the load on the Contractor's System via automated toolsas part of Performance Testing. The load is defined in terms of concurrent Users orHTTP connections and the associated traffic that can concurrently produce.Performance testing uses load testing techniques and tools for measurement andbenchmarking purposes and uses various load levels. Load testing operates at apredefined load level, the highest load that the system can accept, while still functioningproperly.
Backup and Recovery TestingThe Contractor will conduct testing of Backup and Recovery processes at intervalsdetermined in the Work Plan. The Disaster and Recovery Plan will verify backups canbe recovered when needed within the targeted r'ecovery time. Testing of backup andrecovery will be performed on a regular basis. This is done at least once a year andmore frequently if infrastructure changes (hardware or software) are introduced via thechange management process. All Contractor System modifications affecting data willbe reflected in an updated Backup and Recovery Testing plan.
Surn or VnnvroNt, CoNtucr FoR PnnsoNn, SlnvrcnsDnpannvrnNT oF VnnuoNr Ilnar,rn AccnssEQHn.lr,rn Sor,utloNs, INc.
The Contractor will make the backup and recovery testing as realistic as possible. The
Contractor will restore the targeted application and associated databases to the
secondary site and apply previously described performance and load testing scenarios
to determine if the Contractor is capable of achieving the base line performance metrics
outlined in the SLA.
5. Deploymenta. Release Development and Rollout PlanningThe Contractor wili release working software to the end User according to project schedule. The
Contractor will take a release to the targeted end User base upon successful testing and training.
The Contractor's process will ensure the accurate sequencing of deployment steps/activities to
make each ielease as successful as possible.
The Contractor will utilize an established release planning process that will engage the project
team and will result in defect free release candidates. A candidate will include all requirements
and functionality identified for the release. The Contractor will test, fix, and distribute a stable
release only with the approval of the State. The release is pre-UAT tested by the Contractor in the
testing environment. Once testing is complete, and there are qo identified defects/issues, the
release is scheduled for User Acceptance Testing (UAT). The Contractor will provide training
such that the UAT team can effectively test. UAT is conducted to obtain confirmation that the
Contractor's System meets all mutually agreed upon requirements and functionality. Static and
dynamic .o.rr"" code testing shall be completed, and flaws remediated before production. Flaws
that cannot be remediated must be accepted by the State's Chief Information Security Officer or
her/his designee. Upon achieving successful UAT, a release to production date is scheduled for
implementation.
b. Implementation StrategltThe Contractor will develop and deliver a Transition to Operations Plan for each released
implementation. The Plan will include staging activities, end User training, date and times for go-
live, implementation support services, activities to address system stabilization, and system
acceptance criteria. The Contractor will utihze a results-driven incremental (RDI) implementation
and ieployment strategy to effectively manage State specific releases. RDI consists of self-
contained implementati,on sequences or phases where each achieves a certain business result or
goal.
The project Work Plan details the projected delivery dates of all "Immediate" and "Future"
requirements that map directly to the work packages in the WBS. These work packages are
logically grouped functional requirements.
c. Transition to Maintenance and OperationsThe Contractor will, in concert with the State, manage system stabilization activities, monitor
SLRs, create and maintain an issue 1og, and work to achieve systems acceptance utilizingpredetermined criteria. At the point in which the system is stable and accepted, the Contractor willperform maintenance requirements activities as outlined in this Contract, and the release will be
entered into warrantY.
P.tcn 45 or 268
CoNrn-q.cr #28739AvrnxounNT # 2
srnrn or vnnuonr, conrucr F'oR pnnsoNar, srnvrcps pncn 46 or,26gDnplnrvrnNT oF'vnnuonr Hnar,rn Accnss coNrnq.cr # zg73gEQHnalrn Sor,urroNsr Inc. AvrnNnvmNr # 2
d,. Lessons LearnedPhased Rollout Schedule will focus on a specific objective. Each successive phase will leveragethe work and experience from prior phases.
6. Quality ManagementThe Contractor will provide Quality Management of the requirements through the traceabilitymatrices, configuration management activities, change readiness, metrics to analyze quality goals,and management of defects and issues tracking. The Contractor's Quality Management willinclude, but not be limited to, the following elements:
i. The State's management of the requirements. This includes the identification ofinconsistencies between the requirements, and the project's plans and work products.
ii. The State's Requirements Traceability Matrices (RTM) that will be used forrequirements management, and will map where in the software a given requirement isimplemented.
iii. The State's configuration management activities that include: baseline control andmonitoring of the software library. Approved changes to baseline software andlordocumentation should be made properly and consistently in all products, and nounauthorized changes are to be made.
iv. The practices and procedures that will be followed for reporting, tracking, andresolving problems or issues identified in software development, solution transition,and solution maintenance.
The purpose of the RTM is to ensure that all requirements defined for the Contractor's System aretested in the Testing Protocols. The Contractor will capture all the requirements and map them torelevant scenarios and test cases. The Contractor will create a RTM that captures the relationbetween business requirements, application features/functionality and the test design (testscenarios and test data). The RTM will be created at the very beginning of the project and it willform the basis of the project's scope.
The RTM will have bi-directional traceability, and the RTM will track the requirement "forward"by examining the output ofthe deliverables and "backward" by looking at the business requirementthat was specified for a particular feature of the product. The RTM is also used to verify that allrequirements are met and to identify changes to the scope when they occur.
The Configuration management process will include:
t.ii.iii.iv.
Identifying configurable items and defining configuration control approach.Identifying document and source code libraries.Defining and creating User groups and access control to be administered.Identifying State supplied products including documentation, tools, libraries etc.Naming conventions to be adopted:
1. Includes document / code labeling convention.2. Labeling convention to be used when using a tool.3. Criteria for base lining and identification of baselines.
Change management process - Tracking changes to configurable items over theapplication / project life-cycle.Policies for archival and disposition of project items.
vl.
vii.
Sr^q.rr or VnnnnoNt, CoNtru.cr FoR PnnsoN.q'L SnnvrcnsDnplnrvrnNT oF' VnnvroNr Hnar,rn AccnssEQHn,tlru Sor,urroNs, INc.
viii. Configuration audits - responsibilities and administration.
ix. Tracking versions, changes to configurable items and status accounting.
All of the above processes are documented in the Software Configuration Management Plan.
Throughout the lifecycle of this Contract, the Change Management process will apply to any
change that potentially affects the project scope, baseline, objectives, budget, implementation/
deployment strategy, staffing plan or content of key deliverables.
While this engagement the Change Management process may be triggered due to the followingreasons:
i. Changes in the existing requirements.ii. New additions in requirements.iii. Requirements deferred for future releases.
iv. Change in timelines.v. Change in scope.vi. Change in assumptions.vii. Any changes to software, hardware, tools and any new tool implementations for
supporting the applications in scope.
The impact of these change requests when initiated across various phases is described in the table
below:
Changes to existing Requirements Low
Addition of New Low
Requirements deferred for future releases Low
Changes in Timelines Low
Scope changes Low
Changes in Software/ Ilardware/Tools Medium Medium Hish
The total scope of work for the project defined in this Contract must be approved by the State
before the commencement of the project. The State or the Contractor may request change to this
original scope of work at any time using a formal Change Request. The Change Request must
indicate: scope, source of funds, payment provisions, points of contact, ownership of data and any
applicable data use agreement, and project specifics including goals, deliverables, phasing,
expected timelines and estimated duration. No Change Request may increase the maximum
amount payable under this contract, substantially deviate from the scope of this contract, or deviate
from any term in any part or attachment to or of this contract.
The Change Request will be evaluated for its impact on the scope, schedule, quality and cost ofproject and the evaluation reviewed in a meeting between the Contactor and the State. Based on
Prcn 47 or268CoNrru,cr #28739
AvrnNnivrnNT # 2
HighMedium
4!sbLow
High
gtghLow
Hish
HighMedium
Triggers of Change RequestsRequirementAnalysis/Planning
TestDesign
TestExecution
sr.q.rn or vnnuoNr, conrrucr FoR PERSoNAL spnvrcns PAGE 4g or 26gDnplnrunNT oF vnnuoNr Hr.ql,rn Accnss coNTRAcr # 29739EQHnllrn Sor,urroNso INc. AvrnnnvrnNr # 2
both parties' review and the mutual agreements reached, necessary Change Requests will beexecuted to the planned effort, budget, schedule and resource planning.
Both parties recognize that the Change Request process does not obviate the need for State orfederal regulatory review of amendments to the scope, budget, or maximum amount of thisagreement.
The Change Request process shall not be used in lieu of the amendment process where anamendment is appropriate. Each Change Request must clearly define payment either by rate perhour or deliverable received and approved. Each Change Request must be pre-approved beforeany work shall begin. The State will not pay for services that are not previously approved in aChange Request by both authorized representatives listed within this section. The StateAuthorized Representative and the DVHA Business Office have final authority over whether ornot a Change Request is initiated under this agreement, and a Change Request will beimplemented only upon the request of the State Authorized Representative(s). All the ChangeRequests will be recorded with the details of the requester and approver, resolution, business andtechnical impact, impact to schedule and cost, and dependencies on other rollouts.The Contractor will introduce and implement a metrics program which will help the State inmoving towards 'metric driven' organization. Performance at project level will be tracked. Metricswill be used for the following:
i. Run time status and reporting.ii. Risk index for health of program from schedule and quality perspective.iii. Positive influence on the upstream quality.iv. Realigning test strategy and plan.v. Readiness decision for quality sign off.
The Contractor will track the engagement at various levels to ensure that all aspects of theengagement including project delivery, infrastructure, quality processes, resource managementand financial issues are addressed.
Contractor Roles and Respons ibilitiesAccount Director - Owns the entire process - testing, delivery, and relationship, maintains SOW,contracts, invoicing and acts as the first point of escalation.
Project Manager - Acts as the single point of contact for the overall project, testing and ensuresthat the engagement progresses as per the pre-determined State objectives and deliverycommitments.
Test Lead - Designs the program test strategy and manages process enhancements, tools andapproaches for efficient delivery. Identifies testing requirements and test plans and test reports.
Testers - Designs and executes test cases, provides status updates, participates in meetings withproject managers as well as testing and development teams.
Defects will be measured and tracked. Following steps will be followed by the Contractor to ensuredefect resolution:
i. Each defect, as it is discovered, will be identified and recorded. Defect tracking sheetwill be stored on a shared location accessed by both the Contractor onsite and offsitetesting team and the State testing team.
Sr.trn or VBnuoNt, CoNtntcr FoR PnnsoN.ql, SnnvrcnsDnpantvrnNT oF VnnvroNr Hnu,rn AccnssEQHnn rn Sor,utloNs, Iltc.
ii. Defect will be assigned to the lead developer for module/component from the
implementation team.
iii. Lead developer from the build team will change the status to "ready for re-test."
iv. Once the defect is ready for retest, all the test cases impacted by the defect or the related
components will be executed to ensure that the defect has been rectified. Then the team
will change the defect status as "fixed and verified."v. Then the iest lead from the QA team will co-ordinate with the developer from the build
team to close the defect and finally the build team will change the defect status as
"closed."vi. Defect prevention meetings will be conducted at regular intervals between the testing
team and the development team to discuss the test execution and defect analysis.
vii. Only when the re-test has been successfully completed with no critical failures, testing
will be signed off.
7. CMS CertificationThe Contractor will develop a comprehensive project plan aligned with the State's project plan
and based on CMS requirements for the Care Management sub-system. All high-level project
planning components (scope, requirements, WBS, schedule, test plan, etc.) are to be developed by
ihe Contractor and approved by the State, as well as requirement artifacts and Contractor's System
documentation. The Contractor will create its Care Management sub-system certification plan for
sub-system review citeria, documentation and certification checklist completion that complied
with the overarching MMIS CMS certification plan.
The Contractor must participate in and support all planning activities associated with Federal
certification of the MMIS Solution. Planning activities will ensure that Vermont's Medicaidportfolio meets all CMS requirements and perforrnance standards to qualify for the highest eligible
Federal Financial Participation (FFP) rate retroactive to the first day of complete operation. While
certification application activities will occur post-implementation, the Contractor should start
preparation at the beginning of the project and continue through each step of the design,
devilopment, testing and implementation of the Care Management Solution.
PAGE 49o1268CoNrnacr #28739
AvrnNnivrrcNT # 2
responsible for:Including plans for cMS certification as part of the Project Kick-off.Adhering to CMS Standards and Conditions in all deliverables.
Mapping all requirements, gaps, use cases, testing artifacts, workflows,training documents, change management artifacts, and other applicable
artifacts to the corresponding MITA Business Area and Process.
In conjunction with the State Project Team and CMS, determining which ofthe MECT criteria are applicable to the Care Management project and
certification effort.Meeting all MECT criteria applicable to the Care Management solution'
Collaborating with the State in developing a tailored CMS Certification
Checklist, based on the CMS Certification Toolkit for those processes
supported and impacted by the Care Management Solution.
Supporting the State in all discussions with CMS regarding certification
related to the Care Management solution'Developing and executing required and suggested remediation efforts to
The Contractor isi.
ii.iii.
iv.
vi.
vii.
viii.
Srarn or vnnvroNt, coNtnacr FoR prnsoNar, snnvrcns p,rcn 50 or 26gDBplRrvrnNT oF vnnuoNr Hn,tr,rrr Accrss coNrnacr # 2g739EQHnalrn SolurroNsr INC. AunNounnr # 2
achieve certification.ix. Assisting the State in preparing certification documents and reports related to
the Care Management Solution.x. Participating in the in-person or virtual review with CMSxi. Responding to CMS post-review questions and comments
The Contractor is responsible for preparing all documentation and operational examples todemonstrate relevant criteria are met and Care Management Solution operations address allbusiness functions and performance standards and business model expectations for certification.The Contractor will participate in preparation and planning sessions prior to the certificationreview and will participate during the virhral or in-person review with CMS. The Contractor willhelp the state with mitigation of questions and findings CMS delivers to the State after the review,until all outstanding questions and action items are resolved to CMS' satisfaction.
A subsystem certification checklist will be developed in collaboration with the State for theproposed Care Management Solution as a baseline gap analysis to .determine the scope of workrequired to meet certification. The Contractor will ensure all related Contractor's Systems reviewcriteria specified in the Federal and state laws and regulations are met.
The Contractor will provide its strategy and plan for CMS Certification activities with sufficientdetail to convey alignment with the State's plan, a thorough understanding of the process, and keypoints leading to review. This deliverable will include the Certification plan with work activities,and a Microsoft Project Plan.
The Contractor will provide Evidence Packages with appropriate descriptions, development Sprintnumbers, deployrnent release notes, defect resolution, system documentation, reports, test cases,test scenarios, testing results production compliance evidence and screenshots, along with anyother pertinent information relative to the development, testing and deployment of productfunctionality. Requirements traceability will demonstrate upstream and downstream linkages,including mapping to the RFP and through all fully executed change requests.
The Contractor will support the State in all discussions related to this subsystem. The Contractorwill author all required documentation and create operational examples to demonstrate all criteriafor certification, while making sure the Contractor's System meets or exceeds performancestandards and business model expectations. Any issues identified during this certification processthat are associated with the Care Management System will be immediately remediated by theContractor's team through change management process. The Contractor will collaborate with theState and CMS to understand the deficiency and develop the plan to correct it based on theirsuggestions.
I. MAINTENANCE REOUIREMENTS1. Production Support and Transition
The Contractor shall follow ITIL V3 service management methodology as is described in detailSection G, (subsection 6.a.ii) System Administration and Support.
Sr^c.rn or VnniuoNt, CoNtrucr FoR PnnsoNar, SnnvtcnsDnpl,nrnnnNT oF' Vnnvroxr Hnu,rn AccnssEQHn.lr,rn Sor,uuoNs, INc.
^. Integrated Support ModelThe Contractor's services will include callJogging, management, monitoring, and maintenance.
Inherent components are:
i. Tiered Supportii. Service p-rformance at each tier base-lined, monitored, measured and reported
iii. Change management Processiv. Continualserviceimprovements
The support to be provided by the Contractor is indicated by the table below:
b. TransitionThe Contractor is responsible for planning and coordinating resources to ensure specifications for
the deployed Contraitor's System are realized to identifr, manage, and limit risks that could
intemrpt ihe system in operation. The Contractor will fully coordinate resources required to
successfully deploy and operate the System
c. Pre-Transition PlanningThe Contractor will engage the State Authorized Representatives to acquire an approved project
transition plan.
Transition Due Diligence is performed by the Contractor and all artifacts shall be documented.
Resource coordination will identiff, streamline, fit, and track across the capacities of people,
procedures and tools the Contractor will provide and consume timely information. The Contractor
will align resources to generate the targeted outcomes of the deployment.
PAGE 51 or 268
CoNrRr.cr # 28739AvrnNnmnNT # 2
Level ofSupport
Highlight of each Level
Database (DB)], and standard request fulfillment. For more complex requests, the
Ll teams shall defer to L2lL3 teams
) Focus on enhancing the SOPs and KBs through the course of the engagement to
ensure increased fulfillment of requests at this layer
Ileveraging
tandardsS Practiceofveti8x5 and P)-(soShall repeticoverage perfolmprovideBaseofresolution elTOrSknown (KB)acJibased Knowledgevities,
Level l
fixes/workarounds, root cause analysis, KBs
/SOP creation for repetitive incidents and enhancement of Knowledge Management
artifacts
) Staffed with functional specialists with knowledge of applications and associated
business processes with experience in direct business interaction
) Service restoration through temporaryLevel2
) Permanent fixes, application strengthening, continuous service improvement
) Dedicated team with technology-baged sharing across applications
) Staffed with application developers'and technical analystsLevel3
srarn or vrnvroNr, CoNrnacr FoR pnnsoNu, SnRvrcns pacn 52 or 26gDnpaRrryrnNT oF vnnuonr Hn.lI,rn Accnss coNrnncr # 2g739EQHnllrn Sor,urroNso INc. AvrrNnvrBNr # 2
A Configuration Management System will be available for all stakeholders to reference themodel/profile of each component of the Contractor's System.
The Contractor's timing will be represented in terms of schedules where lead-time will be providedfor accommodating anticipated stakeholder impacts of the deployment as it progresses from designto implementation to production.
d. TransitionThe Contractor will have its Subject Matter Experts (SMEs) travel to the State's preferred locationfor the transitioning of all required knowledge elements to State staff or designated entities.
Information regarding usability, supportability and operational requirements with both deploymentevent and aftermath will be coordinated with the State by the Contractor. A combination ofscheduled and on-demand information delivery regarding the service deploynent will beestablished and maintained for stakeholders, organized for User-friendliness per the stakeholder'srespective role. ,A.. knowledgebase (KB) will be generated during the Transition phase.
e. Steady StateThe Contractor's transition teams will provide support during the Service Stabilization period thatimmediately follows 'Go Live' (also referred as Steady State) to ensure a smooth and trouble-freemove from transition to maintenance and operations mode.
2. Service Level RequirementsThe parties hereby agree that the State shall pay avaried service charge based upon differentlevels of performance by the Contractor, as set forth in the table below. Under no circumstancesshall the paynent of a service credit hereunder relieve the Contractor of its obligation to addressand fix system defects or other performance issues pertaining to a service level requirement orany other obligations under this Contract. The State shall have the right to terminate thisContract for cause whenever Contractor's successive or accumulated service level failuresamount to "Chronic Under-Performance", which is defined as any of the following occurrences:
(A) Four or more of the SLRs numbered 1 through 9,15,76 or 17 are not met in a single month;or(B) Four or more of SLRs numbered 10 through 74 are not met in a calendar year; or(C) The same SLR is not met for three (3) times within a rolling 12-month period.
SLR Number andName
Service Level Requirement
After deployment of Release 1, Contractor shall monitor andreport monthly on the following SLRs numbered I through
7b, 9, and 15 throush 17
ContractorAssessment ofService Credits(sc)
SLR 1
Online AvailabilityThe components of the Solution under Contractor control asdelivered into production shall be available 99.75%. Theavailability percentage will be verified with evidence from theContractor.
Scheduled maintenance will be allowed with the prior approval ofthe State of Vermont (SoV). An ongoing monthly maintenanceschedule requires just one approval. Additional scheduledmaintenance requires SoV approval at least 2 business days in
[$ 5000.00] for eachtenth ofpercentagepoint below thecontracted level ofavailability
Sr,trr or VsRMoNt, CoNtru,cr roR Pnnsoxar, SnnvlcnsDnpantvrnNT oF VnrunoNr Hnlr,rn AccnssEQHnlr,rn Sor,urronso INc.
P^lcn 53 or 268
CoNrru.cr #28739AvrnNnvrpNr # 2
advance. Scheduled maintenance should occur outside normal
business hours.
SLR 2Online Search andLookup QueriesResponse Times
The Contractor's System response time during operations will be
5 seconds or less for 95 percent ofthe search and lookup queries
(does not include ad hoc queries and analytics). Maximumresponse time for search and lookup queries will not exceed 15
seconds except for agreed to exclusions. The Contractor shall
investigate tickets from SoV that report response times exceeding
the maximum response time and provide an analysis to SoV.
The system response time is defined as the time it takes for the
server to serylce a
[$500.00] per 0.5
seconds that themonthly averageresponse timeexceeds themaximum response
time. Seconds willbe rounded up to thenearest 0.5 ofasecond.
SLR3Dashboard ReportResponse Times
The Contractor's System shall return each Dashboard report(main, patient, provider, etc.) within 5 seconds or less, 95% ofthe time.
For each dashboard
[$ 500.00] per 0.5
seconds that themonthly average
response timeexceeds themaximum response
time. Seconds willbe rounded up to thenearest 0.5 of asecond.
SLR 4Static StandardReport ResponseTimes
The Contractor's System shall return a Static Standard report
within 5 seconds or less, 95% of the time.[$ 500.00] per 0.5
seconds that themonthly averageresponse timeexceeds themaximum responsetime. Seconds willbe rounded up to thenearest 0.5 ofasecond.
SLR5Parameter-basedReport ResponseTimes
The Contractor's System shall return a parameter-based report
within 20 seconds or less, 95% of the time.[$ 500.00] per 0.5
seconds that themonthly average
response timeexceeds themaximum response
time. Seconds willbe rounded up to thenearest 0.5 ofasecond.
SLR 6
Online ApplicationResponse Times
The Contractor's System shall achieve performance forinteractive transactions other than the reporting-relatedtransactions above, conforming to the minimum acceptable
performance standard of 5 seconds response time, for 95% ofinteractions.
[$ 500.00] per 0.5
seconds that themonthly averageresponse timeexceeds themaximum responsetime. Seconds willbe rounded up tb thenearest 0.5 ofasecond.
Srarn oFVERMont, CoNrucr F,oR pnnsoNnr, SnnvrcnsDnp,tnrvrnNT oF VnnuoNr Hnar,rn AccnssEQHrar,rn Sor,uuoNs, INc.
Pacn 54 or 268CoNrnncr #28739
AnarNounNr # 2
SLR 7aSoftwareMaintenanceRequestResolution Times:*Severity 1 -Emergencv
The service provider must resolve (i.e. find and deploy the finalsolution to Production) Severity I Maintenance requests within 4hours.
[$5000.00] per houror portion ofan hourbeyond the 4-hourtime requirement.
SLR 7bSoftwareMaintenanceRequestResolution Times:*Severity 2 -Urgent
The service provider must resolve (i.e. find and deploy the finalsolution to Staging) Severity 2 Maintenance requests within 24hours.
[$ 2000.00] per houror portion ofan hourbeyond the required24-hour timerequirements.
SLR 9 SubmittedTicket ResponseTimes toSubmitters
Tickets submitted by a user of the Contractor's system shall becategorized by the Defect Triage Group and a response(containing information related to the categorization) shall be sentto the ticket submitter. These tickets may be categorized asDefects, User Education issues, Change Requests, Governanceissues, SoV data issues, etc. Each ticket shall be response to, viaemail, phone call or automated means, and shall be received bythe submitter within five (5) business days.
[$ 100.00] perresponse sent afterfive (5) businessdays or not sent atall.
SLR 8Quality of CodeDelivered toUAT
Software deployed to the UAT environment for testing shall fixwithout defect the targeted defects for which it was deployed andadditionally not introduce any new defects (i.e. defects notcurrently in the backlog). Otherwise, the SoV may request aProcess Improvement review of the Contractor's UAT deployprocess.
SLR 10Disaster RecoveryRTO
The Contractor's System's Recovery Time Objective (RTO) willbe within 4 hours. In case of a disaster that affects the CareManagement operations, the entire service will be restored within4 hours.
[$ 500.00] per eachl0 minutes or part of10 minutes over theRTO.
SLR 11
Disaster RecoveryRPO
The Contractor's System's Recovery Point Objective (RPO) willbe no more than I hour ofdata loss. In case ofa disaster thataffects the Care Management operations, I hour of data inputs tothe Contractor's System (but no more) may be lost and needs tobe re-entered
[$ 500.00] per eachl0 minutes or part ofl0 minutes over theRPO.
SLR 12Record Retention
The Contractor's System shall include the capability to maintainall data according to State-defined records retention guidelines(i.e., record schedule). General schedules can be found at:https : //www. sec. state.vt.us/archives-records/iecords-mana gement/records-retention/general-record-schedules. aspx.Agency records schedules can be found at:https ://www. sec. state. vt.us/archives-records/records-management/records-retention /asency-record-schedules. aspx.Specific retention disposition orders can be found
[$ 100.00] per recordinstance out ofcompliance with thedefined retentionschedule.
After the start of the UAT phase for each Release, Contractorshall monitor and report monthly for the following SLRsnumbered 8
Contractor shall moaitor and report annually on the following
Service Level Requirement
SLRs numbered l0 l4
Service Level Requirement
SLR Number andName
ContractorAssessrnent ofService Credits (SC)
SLR Number andName
ContractorAssessment ofService Credits (SC)
Srnrn or VnnvroNt, CoNtru.cr FoR PrnsoN,l'r, SrnvrclsDnplnrurnNT oF VnnvIoNr Hnnl,rn AccnssEQHnu,rn Sor,urroNs, INc.
Pacr 55 or 268Coxrnacr #28739
ANrnNrivInNr # 2
at https ://www. sec.state.vt.us/archives-records/records-managemenVrecords-retentiolvdisposition-orders. aspx.
In general, record retentions range from 3 to l0 years. In addition
to the above, note that case records including Child Support-
related data must be retained for a minimum of 3 years after Case
closure and the youngest child in the case is 18 years old.
SLR 13
DocumentRetention
The Contractor's System shall the capability to maintain
all images and electronic documents according to State-defined
document retention guidelines (i.e., record schedule). General
schedules can be found at:
https://www. sec. state.vt.us/archives-records/records-mana gemenVrecords-retention/general-record-schedules. aspx.
Specific retention disposition orders can be found at:
https ://www. sec. state.vt.us/archives-records/records-mana gement/records-retention/disposition-orders. aspx.
In seneral. document retentions range from 3 to 10
[$ 100.00] per
document instanceout of compliancewith the definedretention schedule.
SLR 14
Online CaseRetention
The Contractor's System shall provide on-line access of all active
cases and up to 12 months for closed cases.[$ 100.00] per case
instance out ofcompliance with thedefined retentionschedule.
SLR 15Eligibility RulesModifications
Tickets submitted by a user of the system that request one ormore supported modifications to the Eligibility Rules shall be met
within 15 business days. To meet this SLR, eQHealth shall make
the modification available for SoV testing by deploying it to the
UAT or Staging environment. Supported modifications follow:
1) Change the Order of execution of existing Eligibility Rules;
2) Make an existing Eligibility Rule ACTIVE;3) Make an existing Eligibility Rule INACTIVE;4) Change content of an existing Eligibility Rule;
5) Delete an existing Eligibility Rule;6) Add an Eligibility Rule;7) Update the View current Eligibility Rules;
Upon completion of the ticket eQHealth shall email SoV the
updated VCCI Eligibility Rules file reflecting the change(s)
made.
[$ 100.001Perbusiness day orportion of a businessday exceeding thespecified limit of 15
business days.
COMPLIANCEPROCESS1) Within 5 businessdays of the ticket'ssubmissioneQHealth and SoVshall meet to beginevaluating the ticketand the work neededto complete it. 2)Once that evaluationis complete, theticket's status shallbe changed to "AtDevelopment",which serves as thisSLR's Start time. 3)The ticket's End timeshall be tentativelyset once themodifications havebeen made in theUAT or Stagingenvironment. 4)Once SoV verifiesthe modifications are
correct, the tentativeEnd time becomesthe actual End time.
Srarn or VnnvroNt, CoNtRl,cr FoR pERsoNAL SnnvrcnsDnpantvrnNT oF' VnnvroNr Hn,tr,ru AccnssEQHnllrn Solurrolvs, INc.
Pacn 56 or 268CoNrru,cr # 28739
AvrnuounNr #2
However, if SoVtesting finds an issuewith themodifications, theclock resumes andsteps 3 and4 arerepeated.
SLR 16LetterModifications
Tickets submitted by a user of the system that request one ormore existing letter modifications shall be met within 5 businessdays. To meet this SLR, eQHealth shall make the modificationavailable for SoV testing by deploying it to the UAT or Stagingenvironment.
[$ 100.001perbusiness day orportion of a businessday exceeding thespecified limit of 5business days. Theticket's End timeshall be tentativelyset once themodifications havebeen made in theUAT or Stagingenvironment.
SLR 17Incident Reports
An official Incident Report, required for all Severity I andSeverity 2 incidences, shall be submitted to key SoV stakeholders(Business, QA Test Lead, Project Management, Technical Lead,etc.) within 15 business days of the immediate resolution of theincident. An official Incident Report will contain at a minimumthe following: (1) Incident Number and Priority; (2) Reporr Date;(3) Type of Incident; (4) Impacted Area(s); (5) Resolution Status;(6) Resolution Details; (7) Point of Contact Information; (8) RootCause Analysis, including Corrective Actions; (9) Conclusion.
[$ 100.00] perbusiness day orportion of a businessday exceeding thespecified limit of 15
business da)rs. Timedetermination willbe taken from therecorded End time ofthe JAMA ticket (forthe incident) and theemail dateltimestamp sent to theSoV keystakeholderscontaining theattached IncidentReport.
Defects uncovered during User Acceptance Testing (UAT) and in Production will be categorizeddue to Severity. Severity is determined by the relative importance and re3ponse time requirementsfor the type ofdefect encountered.
Production Defect Severitv Response RequirementsSeverity 1 4 HoursSeverity 2 24 HoursSeverity 3 - 5 N/A. These defects are to be prioritized (see Priority Level definitions) jointlyby the State and the Contractor and scheduled accordingly for investigation, correction anddeployment into production.
Defect Severity Definitions :
i. Severity I .- A complete loss of service, the customer's business operations are halted, or acritical system failure that impacts the entire user community and no workaround is possible.
Srarn or VrcnuoNt, Colttru.cr FoR PnnsoNar- SnnvlcBsDnpanrunNT oF VnnvroNr Hn,c.LrH AccESS
EQHo.rlrn Sor,uttoNs, Inc.
Pacn 57 or 268
CoNrnacr #28739AvrnnounNr # 2
ii. Severity 2 - Service is degraded, resulting in a loss of major functions for a substantial
portion of the customer's user community. The customer's business operations are severely
ii-it.d though the customer may do some work. A workaround may be possible.
iii. Severity 3 - Service is functioning but with a loss of minor functions to a limited number ofusers. The customer's business operations can continue due to a temporary workaround.
iv. Severity 4 - Service is functioning but one person is experiencing a problem. The
customer's business operations are unaffected.
v. severity 5 - Defect is a cosmetic issue. warranty Requirements
The Contractor shall be responsible for fixing any elrors that occur during the first Contract year
and the two subsequent Contract years following the State's acceptance of each release deployed
at no additional cost. The Software Warranty period applies to all "corrective" maintenance /reactive modification of the Contractor's System performed after completion of deployment to
correct discovered faults with any functionality within the scope of original software development
efforts. All such fixes are required to occur in a reasonable timeframe (depending on severity as
defined above in Section I, subsection 2. Service Level Requirements) and shall be produced at no
additional cost to the State of Vermont.
The Contractor shall provide two (2) years of Application Warranty following deployment of each
release at no additional cost. The Contractor shall provide the equipment needed to support its staff
for duration of the project. The Contractor shall be responsible for the root cause analysis activities
to demonstrate whether a defect is related to the scope of functionality delivered by the Contractor.
The Contractor will meet Service Level Requirements by proactively reviewing performance
indicators on a daily basis, and immediately taking corrective action when an indicator is not in
compliance.
The Contractor will provide all prescribed warranties as outlined to cover any defects directly
related to the upprorr.d final scope and associated technical requirements of each release phase.
Any defects discovered during the warranty period will be remedied at no additional costs to the
State.
The Contractor will comply with all State warranty requirements.
3. Maintenance & OPerationsThe Contractor will provide a Base Software Maintenance period to begin with confirmation from
the State that the project deployment has been successfully completed and ending five (5) years
starting two (2) months prior to Release 1 go-live date. Two (2) one-year optional extension
periods must also be provided. The five (5) year agreement will be subject to annual review and
renewals. The State, at its discretion, may conduct a market pricing survey to determine if the
current pricing affangement is in the best interest of the State. Based on the results of third party
,rr*"yr, the State rnay choose to negotiate different terms or pricing with the Contractor. The
Software Maintenance periods include "adaptive" maintenance / modification of the Contractor's
System performed after completion of deployment to keep the Contractor's System usable in a
"hutrg"d or changing environment, and "perfective" maintenance which is modification of the
srarn or vnnvroNr, coNtnrcr FoR pnnsonar, snnvrcns pacE 5g or 26gDnp.q.nrunNT oF Vnnvroxr Hnar,rn Accnss Coxrru.cr # 2g739EQHnar,rn Sor,urroNs,INc. AvrnNovrnNr # 2
Contractor's System after completion of deployment to improve performance or maintainability.During this period, the Contractor shall be in charge of Software Maintenance, and optionaliyhosting and operating the Contractor's System and providing Disaster Recovery services.
The Contractor must provide Base Software Maintenance period to begin Release 1 go-live. TheContractor shall communicate and document all software faults that are not part of the scope ofthe original development effort during the Software Maintenance period. For all Contractor Systemenhancements (over 20 hours of effort) that are not part of the original scope, the Contractor shallanalyze the changes and provide cost estimates for performing those changes to Vermont AHS.
The Contractor will provide two (2) one-year optional Software Maintenance periods at theexpiration of the initial five (5) years of Software Maintenance period. The State shall be able toexercise its option to sign-up for services similat to those offered in the initial softwaremaintenance period.
a. Production Support StaffThe Contractor must provide:Ongoingmaintenance and support services, including a flexible and scalable approach to providingthe various types of personnel, including:
1. Architect2. Business Analyst/Functional Lead3. Change Management Lead4. CommunicationA.{etwork Specialist5. Database Administrator6. Database Designer7. Help Desk Specialist8. Hardware Specialist9. Operations LeadlManager10. Project Director11. Project Manager12. Programmer13. Quality Assurance Manager14. Security Systems Engineer15. SystemsAdministrator16. Technical Writer17. Test LeadlManager18. Tester19. TrainingLeadlManager20. Training Specialist
Termination Assistance Services strategy will include documentation and knowledge transfer toVermont AHS which may include other subcontractor(s).
Contractor's System operations support, including the levels of support offered and the process forrequesting support. In addition, the Contractor will provide a sunmary of the proposed strategyfor maintaining and repairing the Contractor's System:
i. Base Software Maintenance Period.ii. Incident and maintenance request reporting.
Srarn or VnnvroNt, CoNtru,cr FoR PnnsoNl't, SrnvrcnsDrpLnriunNT oF VnnuoNr Hnar,ur AccnssEQHn.llrn Sor,uuoNs, INc.
iii. Optional Extension Software Maintenance Periods
Pacr 59 or 268
CoNrnq.cr #28739AvrnNrvrnNr # 2
The Contractor will ensure due diligence in personnel selection by following a two-stage filtering
process for selecting the project staff which includes:1. Round I - Review by Care Management SMEs within Healthcare SME.
2. Round 2 - Review by Contractor Account Director.
The Contractor's Project Manager shall be responsible for the smooth on-boarding of Team
Members as per the program guidelines. The on-boarding process orients a Team Member to:
i. The general industry trends and news related to the program sponsor.
ii. The program's objectives, scope, and existing related information (e.g., PMP).
iii. The current status of the program.
iv. The program's overall otgarization strucfure
v. The program time and expense guidelines.
vi. For Team Members who travel, program travel,lodging and per diem guidelines.
vii. overview of the program's standard operating procedures.
viii. The approved process to request access to building and computing facilities'
ix. Orientation to the Team Member's project/sub-team'
x. Specific duties and expectations of the new Team Member.
xi. Detailed review of the tools and procedures the Team Member will execute to perform
required duties.xii. Overview of Program Sponsor's security and confidentially requirements.
xiii. Any other information required by contractual or compliance obligations.
The Contractor's Project Manager, in coordination with the Team Member, is responsible for
identifying the training needed to improve a Team Member's skills as required by the program.
The following are the Termination Assistance activities that will be carried out by the Contractor
to mitigate ttre transfer risk as much as possible while accomplishing the very important task ofknowledge transfer.
The Contractor team will identify relevant knowledge areas in close co-ordination with Vermont
AHS teams to identify the skills that have to be disseminated. The following kind of training, but
not limited to, will be provided as necessary:
l. lrain the Trainer-This mode of training enables State designated trainers (Core
Ieam) to gather User level knowledge regarding the application. Once trained,
it is their responsibility to train rest of the State Users. However, should the
State need Contractor team's services to train all of its lJsers, the same can be
made available to the State, through a Change Request'
2. Application Administration training-The core members of the State's team are
imparted Application Administration training. Contractor team trainers impart
training on the operational procedures.
3f#'#r:{,i;i:rlxilift Ji:trii:::r,il'"'"fi ;:ffix''.H"'.T',ir:;
p"rrf,"ctive and become ready to support the application in due course.
srarn or vBnvroNr, coNrnncr FoR pnnsonn Snnvrcns pacn 60 or 26gDnp.lnrunNT oF VrnvroNr Hnar,rn Accnss Coivrucr # 2g739EQHr,tlrn Sor,urroxs,INc. AvruNovrnNr # 2
b. SystemAdministrationThe Contractor's System shall automatically collect events logs from each system and store theinformation in a centralized database for a period of 90 up to 365 days, at which time they arepurged from the system. Log files will be archived to a different data store, if needed, beyond thespecified time period. After the logs files are collected, the Contractor will perform eventcorrelation and analysis for security related events and will send alerts when certain thresholds aremet.
The Contractor will keep a history of changes made to the Contractor's System over time and willrapidly respond to and address performance issues across our entire Contractor's System softwareportfolio. The Contractor's System shall provide advanced drill down reporting, dashboards andcustomized alerts to provide a single viewpoint for not only the State, but the Contractor's supportand technical personnel to proactively monitor application performance. The Contractor's Systemshall have the ability to capture Web page response times from the State end point down to thebackend database calls, application exceptions and much more, the Contractor will ensure theentire Contractor's System meets or exceed the agreed upon SLAs
The Contractor will monitor Web requests end-to end, monitor IIS application pools, web siteavailability, load balancing status, IIS logs and Windows events for all production Web sites.When one of the thresholds for a monitor is exceeded, alerts will be automatically sent to theappropriate staff and depending on the nature of the alert, a scripted action such as restarting anIIS application pool is automatically triggered.
The Contractor's System shall, at a minimum,utilize public key/private key encryption SecureSocket Layer (SSL) certificates , a 4096-bit key length with 256-bii encryption strength issued bya trusted Certificate Authority, for website security.
The Contractor's System shall be capable of Single sign-on (SSO) integration to any LightweightDirectory Access Protocol (LDAP) compliant repository for authentication.
The Contractor's seryer, network and database maintenance will be performed on a monthly basis.A four-hour maintenance window will be preiuranged for the 3rd Wednesday of each month. TheContractor will work with the State regarding maintenance and maintenance windows.
The Contractor's public facing servers will be located in Demilitarized Zone (DMZ). The DMZnetwork will be configured with limited connectivity to the internal resources. The use of accessrules for the servers in the DMZ will only allow traffic configured for specific IP address and portnumber to segregate traffic from the internal network. Remote access will be handled by virtualprivate networks (VPN). The firewall will perform deep packet inspections on VPN traffic withthe use of gateway anti-virus, anti-malware and anti-spyware protection.
The Contractor's System shall provide a User friendly Web based security administration modulethat allows authorized State system administrators to self-service manage granular authorizationprofiles specific to each User. All User accounts will be created with a uttiqrr. Ur"rname and strongpassword. Passwords require a change at a minimum of 90 business days and will be configuredat the State level to be changed on a more frequent basis.
The Contractor's securitymodule will provide a User's restriction to specific memberpopulations.Security administrator will grant access to one or more "Groups" that are named entities within a
Sr,c.rn or VnnvroNto Coxtru.cr FoR Pnnsonar, SnnvrcnsDEpARTMENT oF VpnvroNr Hn.c.LrH AccnssEQHnnlrn Sor,uuoNs, INc.
Pacn 61 or 268
CoNrnlcr # 28739AurnNnvrnNr # 2
State Program. Users will then be assigned specific roles (care coordinator, coach, MD reviewer,
RN, customer service, etc.). A particular User may have one role assigned in a given group and a
very different role in another depending on things like resource needs, credentials, working
privileges etc. Roles may include permissions such as delete, add, make determination, edit/view,
and search functionalities and many more.
c. Data and Document RetentionThe Contractor will implement and comply with industry standard backup procedures and
Vermont AHS' backup requirements, as well as Vermont AHS' record and document management
policies. The Contractor's System data (images, letters, and databases) will reside on the latest
technology which provides data safeguarding, backup time, recovery and operational efficiencies.
All data will be backed up near real-time and will be capable of any required Recovery Time
Objective (RTO) or Recovery Point Objective (RPO) to be defined by the State.
The Contractor will enable resource consuming activities to be offloaded from the virtual host
servers to the storage system to improve resource utilization and performance. The Contractor's
System shall create a near-instant, file system consistent, point-in-time copy or snapshot of the
individual virtual machine and the entire datastore on which the virtual machines reside. After the
snapshot is created it is then automatically replicated to another datacenter for disaster recovery
purposes. The Contractor will be able to restore virtual machines at a gtanular level; virtual
machine, entire virtual machine datastore or virtual machine disk.
For backup and recovery of databases, the Contractor's System will be configured for hourly, near-
instant, point-in-time snapshots of the database and the Logical Unit Numbers (LUNs) on which
the database files are stored. The Contractor will verify the snapshot for consistency and finally
replicates a copy to an offsite datacenter. The Contractor's System shall support both up to the
minute and point-in-time recovery methods through the automated replaying of transaction logs.
A clone or copy of the production database will be used to recover missing or deleted data without
having to restore a production database.
All data volumes will be protected. Each volume will be configured forhourly, near-instant, point-
in-time snapshots of the entire volume. The snapshots will be replicated on a nightly schedule to
another datacenter for disaster recovery. The User-driven recovery model will allow for Users to
recover single files or entire directory structures almost instantaneously.
The Contractor will maintain an effective records management program that will meet all State
requirements for record security, retention, privacy protection, and disposition. The Contractor
will employ registered health information administrators (RHIA), who participate in the
development of corporate records management policies and procedures and oversee
implementation of all protocols for intake, routing, tracking, storage, transfer and disposition and
ensure compliance with HIPAA regulations as well as all contractual requirements.
surn orvnnvroNro coNrnacrFoRpERsoNAL snnvrcns pacn 62o126gDnplnrvrnNT oF vnnvroNr Hunr,rn Accnss coxrRlcr # 2g739EQHw,rn Sor,urrons, INc. AwrnNlivrnNr # 2
The Contractor's HIPAA compliance program must be comprehensive and include all requiredprivacy and security regulations. The Contractor will comply with all HIPAA requirements,specifically the administrative simplification provisions of the law and the associated rulespublished by HHS, the DoD Health Information Privacy Regulation (DoD 6025.19-R), the HIPAASecurity Compliance Memorandum (HA Policy 60-010), and the Security Standards for theProtection of Electronic Protected Health Information. The Contractor's policy must cover papersecurity, access to data processing resources, passwords and security incident reporting, softwarelicensing, remote computer usage, virus, e-mail and application development securityconsiderations. In addition to policies and procedures for data system access, the Contractor willhave also developed and implemented policies and procedures for maintaining security andconfidentiality of patient medical information, review data, and any other data identified asindividually identifiable. Each employee is required to review and sign confidentiality protocolupon employment and receives annual documented training to maintain security awareness andpolicy.
The Contractor will employ a fulltime staff of highly qualified systems engineers experienced inmanaging state and federal contracts under the Federal Information Security Management Act(FISMA). The Contractor must develop, document, and implement a corporate wide program toprovide security for the information systems in support of operations and assets.
il. System Managementi. Application Monitoring
The Contractor's application monitoring services will ensure the Contractor's Systemmaintains a high level of availability and performance for the State and its Users. TheContractor's ITIL V3 based approach will emphasize the importance of a continual cycle
. of monitoring, reporting and subsequent action in the case of availability and performancerelated exceptions. The Contractor's primary goal will be to reduce down time throughmonitoring and management at first level (Level 1) as outlined in our Integrated TieredSupport Model.
The Contractor shall:1. Reduce downtime through monitoring availability and performance of
applications.
2. Resolve an incident before it can impact the business (proactive detection andresolution), thereby moving from reactive to proactive Service Delivery.
3. Provide insights through trend analysis of ticket / event data (dataanalytics) inorder to achieve suppression ofevents / alerts.
4. Detect unauthorized changes and ensures organizational compliance.
5. Integrate operations center at level l, thereby considerably improvingoperational effi ciency.
6. Automate repetitive manual monitoring tasks, for example manual "ready-for-business" checks.
Sr,trn or VnnuoNt, CoNtnacr F'oR PERSoNAL SrnvrcnsDrplnrvrnNT oF VnnvroNr Hn,qltH AccnssEQHnnlrn Sor,uuons, INc.
PacB 63 or 268
CoNrru.cr #28739AunNuuBNr # 2
7. Eliminate noise or false-positive application events through root cause fixes or
by optimizing event threshold levels.
8. Implement advanced monitoring techniques resulting in the reduction of mean
time to detect major incidents.
ii. ActivitiesThe Contractor will:
l. Monitor the availability of applications, related interfaces and infrastructure at
Level 1.
2. Monitor the availability of related databases at Level 1.
3. Ensure application performance is within acceptable levels as defined in SLAs..
4. Continuously monitor various application events and logs.
5. Manage events with automatic generation ofAdministrative Alerts and dispatch
through most effective means (text, Email etc.).
6. Report exceptions and create incident tickets for the same.
7. Resolve incidents where there is a KB match and escalate unresolved incidents
/ issues toL2 lL3 as per the SLA time frames via escalation procedures.
8. Monitor performance and capacity of applications and underlining
infrastructure against the baselines.g. Validate and correlate events generated either through emails or application
monitoring systems.10. Raise Incident with the relevant service catalog owner in case of an
infrastructure issue.
11. Notify the State on the infrastructure incident and resultant application
unavail ability (if anY)
12. Follow up with the service catalog owner to restore the services.
13. Analyze the corresponding incidents and give feedback to the State.
t4. Provide hand-offs with the Level-2, Level-3 application and Infrastructure
teams.
iii. Process OverviewEvent correlation - The Contractor shall correlate events to integrate the management ofalerts from multiple systems including applications, infrastructure, network etc', in a
coherent manner thus reducing false positives and prioritize citical events. Through the
intelligent rules and the topology information of the environment, the Contractor's event
correlation engine will be able to diagnose the root cause of failures and create exceptions
for the same.
Run Book Automation -The Contractor shall create a routine compilation of procedures /workflows which will contain the steps to begin, stop, and supervise the application system.
An effective run book provided by the Contractor will allow analysts, with prerequisite
expertise, to effectively manage and troubleshoot an application system. Through run book
automation, these processes can be carried out using software tools in a predetermined,
effective and accurate manner.
sr.lrn on vnnmoNr, coNrrucr FoR prnsoNt snnvrcns p.q.cn 64 or 26gDnp,mtmnNT oF'vnnuoNr Hnar,rn Accrss coNrnlcr # 2g739EQHn,llrn Sor.urroNsr INc. AvrnNowrnnr # 2
Proactive pattern analysis and trends - The Contractor shall establish a proactivemonitoring process through trend analysis of incidents / events by means of data analytics.This will help in reducing influx through problem management.
LI Utility Layer - The Contractor's Ll UtilityLayer will result in s5mergized Applicationand Infrastrucfure operations.
iv. Metrics
An end User can initiateContractor's Product S
support via a button provided in the Contractor's System or theupport Services Helpdesk can initiate a session from the
Contractor's helpdesk module by providing an invite link.
v. System Operations Support ServicesThe Contractor's Software Support Helpdesk (SSH) will provide support through directUser and internal stakeholder interaction via phone, email and help desk system. The SSHwill be a one-stop-shop for all software change requests, User assistance, system issues anddata corrections.
The Contractor's staff will be highly trained and be comprised of certified professionalswith real-world experience using the Contractor's products and will know how to resolveissues quickly and efficiently.
The SSH will have .a customer service-oriented directive with a focus on customersatisfaction and service level agreements. Communication will be prompt and accuratewith customers both internal and extemal. Customers will have the ability to engage the
Number of incidents
related to capacity and
performance of the
application
Number of run-books
automated
Number of false positivealerts on vs. total number ofalerts
Number of applications
where monitoring is notautomated
Number of events that
were not auto - ticketedNumber of trend analysisreports generated and acted
upon in a month
Yo avallability ofapplications
Number of events
misrouted due to wrongcategorization
No of newly added eventmonitoring rules to increase
monitoring effectiveness
Transaction time /response time for onlineapplications
Number of event
eliminated throughpermanent fixes (event toproblem management
integration)
Service Metrics Value Add Metrics Service Analytios Metrics
Surn or VnnuoNt, CoNtru,cr FoR PnnsoNx- SnnvrcosDpp.qntvrrNT oF VBnuoNr Hnll,ur AccnssEQHnn lrn Sor,uuoNs, Inc.
P.tcn 65 or 268CoNrn,lcr #28739
AnnnnounNr # 2
SSH through several options including a toll-free phone number, email, or web-based
entry. A11 requests for service will be logged in the corporate helpdesk management system
to enable measurement and easy transition between support staff.
1. Helpdesk Management SYstem
The Contractor's Helpdesk System will allow Users to report, view, and update
incidents. The Contractor's System shall use a work flow status bar to represent
each of the process stages an incident must go through before it is successfully
resolved and closed. The work flow will track the entire process from the
submission of an incident (New) throughout the life cycle until the request is
successfully closed (Closed).
Incident types will be assigned to designate which IT department should handle the
request. In addition, incidents will be prioritized and worked based on severity.
Severity I and Severity 2 defects are to be worked immediately and don't go
through the standard Defect Resolution process. Severity 3 - 5 defects are
prioritized and worked via the standard Defect Resolution process. Priority
assignments are as follows: 1 - critical, 2 -High,3 - Medium, and 4 - Low.
The requestor will be notified by email once the ticket has been resolved. If the
requestor has additional questions after the incident has been closed, the ticket can
be reopened.
Tickets for incidents will include record of the requester, requester's contact
information and the details of the incident.
The Contractor will:1. Maintain automated telephone system to comply with contractual
obligations.2. Maintain website functionality and Contractor's provider helpline module.
3. Ensure adequate staffing for customer service lines proportionate to call
volume.4. Remain available in queue to accept incoming customer service line calls
within answer timeframe.5. Manage operations to ensure contract performance standards are achieved,
and:6. Enable automated response service to be activated, indicating office closure
' from 5:00 P.M.-8:00 A.M. each business day, through weekends and on
state-apProved holidaYs.
7. Enable alternate automated response service to be activated, indicating
close of the office for prior aulhoization/certification line and customer
service calls, after 5:00 P'M., weekends and on holidays.
2. Toll-free Phone SystemThe Contractor will provide a toll-free customer service line. It willbe staffed from
8:00A.M. To 5:00P.M. EST, Monday through Friday, excluding the following
approved State holidays:New Year's Day Martin Luther King Day
Srarn or VnnuoNto CoNrucr F,oR pnnsoN,c,L SnnvrcrsDnpantvrnNT oF Vnnvroxr HnllrH AccnssEQHnu,rn Sor,urroNs, INc.
President's DayMemorial DayBennington Battle DayVeteran's DayChristmas Day
Plcn 66 or 268CoNrucr # 28739
AunNovrnNr # 2
Town Meeting DayIndependence DayLabor DayThanksgiving Day
Customer service representatives receiving a call of a clinical nature or memberspecificprocess issues will perform a warm transfer (remaining on the line until theconnection is completed) to a supervisor who assists the caller.
The Contractor will maintain an automated voicemail message system.1. If a representative is not available within 30 seconds, the caller will be offered
the option of continuing to hold, or to leave a voice mail message that will bereturned on the same business day if received within the last hour of the day.
For calls received outside ofbusiness hours:1. Customer Services line hours of operation will be stated2. Customer will have the option to leave voice mail message that will be returned
within one business day
Performance Standards :
3. System Incident ReportsThis shall contain Summary-level incident statistics and shall be included in theregular project status report. Statistics provided will include:l. Incidents reported by category verses SLAs2. Pass, fail, and in progress defect resolution counts3. Defect categoization and aglng
4. Adaptive Maintenance Reports and Adaptive System Enhancement ReportsThese deliverables shall provide summary-level fix statistics provided inPowerPoint format and included in the regular project status report. Statisticsprovided will include:l. Fixes available for deployment2. Summary test results for proposed deployments3. Short-term (4 week) deployment schedule
Busy signals encountered (blocked calls) None
Call response time (average speed of answer) 90olo answered within 30 seconds
Unanswered calls (abandoned calls) No more thanl0o/o of call volume
Response call to messages (voicemail) Within t hour
Response call to messages (after business hoursvoicemail)
Within 1 business day
Perfonnance Indicator Performance StandardRe Business HoursBusiness Hours
Srlrn or Vnnuoxt, CoNtRlcr FoR Pnnsox-q.L SnnvrcnsDEpARTMENT oF VnnvroNr Hnlr,rn AccnssEQHn.lr,rn Sor,urronso INc.
In addition, detailed release notes in Word format will be made available in
preparation for each release approval meeting. This will include:
1. List of defects to be delivered in this release
2. End-User impact of each defect in business language
3. Cross references to incident tickets4. Test results
The Contractor's support team shall propose releases according to the agreed
maintenance cycle atrd th" availability of fixes for release. Fixes for high-severity
defects can be released on an accelerated schedule with State's approval.
All of the Contractor's System enhancements that exceed an estimated 200 hours
and are not included as part of the original requirements scope and will be treated
as a change order. The Contractor will provide a separate functional requirement
and detailid cost estimate to the State for review and approval prior to performing
the enhancements. All warranty and maintenance periods (Base, Optional)
discussed in Section I, subsection 3 "Warranty Requirements" will also apply to all
approved enhancements'
e. Defect Resolution and Solution Acceptance
The Clntractor's defect tracking and resolution management will assess and prioritize defects.
i. Scope SeverityThe following table provides guidelines for ranking of the Scope of a defect:
Value GuidelinesSffity I - fiomplete loss of service, the customer's business operations are halted, or a
critical system failure that impacts the entire user community and no workaround is possible.
Sbverity-2 - Service is degraded, resulting in a loss of major functions for a substantial portion
of the customer's or". "o*rnrrrrity.
The customer's business operations are severely limited
though the customer may do some work. A workaround may be possible. Severity 3 - Service
is fuictioning but with a loss of minor functions to a limited number of users. The customer's
business opoutiotrr can continue due to a temporary workaround. Severity 4 - Service is
functioning but one person is experiencing a problem. The customer's business operations are
unaffected. Severity 5 - Defect is a cosmetic issue.
ii. PrioritvPriority Level (Production and UAT) definitions
Severity Defects of 3 - 5 are to be prioritized as follows:
priority 1: Critical - Defect should receive immediate effort to fix and deploy to the UAT
environment for SoV testing;
priority 2: High - Defect's prompt resolution is important and prioritized for next
available sprint.
priority 3: Medium - Defect's resolution may be prioritized for a later sprint.
P,lcn 67 on 268
CoNrnq.cr # 28739AvrnxounNT # 2
srarn or vnnuonr, coNrrucr FoR pnnsoNn snnvrcns PAGE 6g or 26gDnp.q.nrMrNT oF VnnvroNr Hnlr,ru Accrss CoNrnacr # 25739EQHnuru Sor,urroNs, INc. Aururunxr # 2
Priority 4: Low - Defect's resolution is a nice-to-have.
iii. Actions
The Contractor will have an established set of action requirements for each range ofcalculated priority value.
The Contractor will follow a process for defect resolution and acceptance:
Defect Discovery - Identification and reporting of potential defects. The informationcaptured here will be enough to reproduce the defect and allow development to determineroot cause and impact.
Defect Analysis & Prioritization - The development team will determine if the defectreport corresponds to an actual defect, ifthe defect has already been reported, and what theimpact and priority of the defect is. Prioritization using the previously described scoringapproach and scheduling of the defect resolution will then managed by the overall changemanagement process for the software development organization.
Defect Resolution -The Contractor's development team will determine the root cause,implement the changes needed to fix the defect, and document the details of the resolutionin the Team Foundation Server defect management software, and will include suggestionson how to verify the defect is fixed.
Defect Verification - The build containing the resolution to the defect will be identified,and testing of the build is performed to ensure the defect truly has been resolved, and thatthe resolution has not introduced side effects or regressions. Once all affected branches ofdevelopment have been verified as resolved, the defect can be closed.
Defect Communication - This encompasses automatic generation of defect metrics formanagement reporting and process improvement pu{poses, as well as visibility into thepresence and status of defects across all disciplines of the software development team. Thedefect log captures and reports all attributes ofa defect for transparency to all stakeholders.
System Acceptance -The defect is thoroughly validated. This is first facilitated by arevised/improved automated test that encompasses the identified defect and passes as wellas a subsequent successful User Acceptance Test. Any related documentation is updatedand the item is then released to production.
iv. Hosting and Disaster Recoverv ServicesThe Contractor's environments will be sized in accordance with planned use and beinclusive of all hardware, storage, networking, backup/restore, database, file system,monitors and other items as required to comprehensively support the effort.
Upon the State's determination that these environments are no longer required, and uponcompletion of any mutually agreed migration and direction from the State, theseenvironments will be decommissioned by the Contractor. Any Contractor hardware usagecharges arising from the use of this equipment shall no longer be the responsibility of, nor
Surn or VBnuoNt, CoNtru,cr FoR PrnsoNu, SrnvrcnsDrplntvrpNT oF VnnuoNr Hn.qlrn AccrssEQHnar,rn Sor,urtoNs, INc.
Pncn 69 or 268CoNrru,cr #28739
AunNuunNr # 2
billed to the State, and all State data or other artifacts resident on this hardware shall be
destroyed or otherwise deleted.
In advance of use, and .in consideration of State procurement, installation and
commissioning cycles, the iontractor will specify all required environments to support the
Contractor's System for the ongoing specification, design, development of the project
associated with subsequent phases including, but not limited to the following
environments:1. Full Production OPeration2. Production Replica for Fault Resiliency / Onsite Disaster Recovery
Purpo ses and defect/issue resolution purposes
3. Off-site Disaster Recovery Replication (see Disaster Recovery Section
below)4. Other environments deemed necessary by the Contractor to support
production oPerations
These environments will be sized in accordance with planned use and be inclusive of all
hardware, storage, networking, backup/restore, database, file system, monitors and other
items as required to comprehensively support the ongoing development operation of the
Contractor'i System as well as to support the debugging or resolution of issues within the
production environment.
Upon notification by the State of receipt of the hardware to support these environments in
the State Data Center, the Contractor shall install, configure and commission for ongoing
use in the project this hardware within the State Data Center should the State select this
option.
As a priced option in Attachment B - Pa5rment Provisions (expressed annually on a
monthly basis) for the ongoing operation of Infrastructure related activities.
The Contractor will specify all required environments to support the Contractor's System
for the ongoing operation of the production system in the event of a disaster or outage
condition associated with the following environments:1. Full Production OPeration2. Systems Development inclusive of then current code bases and associated
data associated with the development effort3. Other environments deemed necessary by the Contractor to support
production operations in the event ofan outage or disaster
These environments will be sized in accordance with planned use and be inclusive of all
hardware, storage, networking, backup/restore, database, file system, monitors and other
items as required to support limited development effort during the disaster or outage
condition as well as to not adversely impact or jeopardize phases that are being developed.
The Contractor's Hosting and Disaster and Recovery Service, as a priced option in
Attachment B - Payment Provisions in this Contract, shall provide the ongoing provision
of a disaster recovery site (not at a state facility) for the solution.
sr,trn or vnnuoxro CoNrucr FoR psnsoNar, snnvtcrs pacn 70 or 26gDrpanrvrnNT oF vpnuonr Hnar,rn Accnss CoNTRACT # 2g739EQHr,rlrn SolurroNso INc. AvrBNovrnNr # 2
The Contractor's computer systems (non-production, production and disaster recovery)will be hosted in premier commercial datacenter facilities in disparate geographicallocations across the country. Each facility will allow delivery of the highest levels ofreliability through multiple-provider fiber trunk access, redundant power sources andmultiple backup generators. The facilities will include 24 X 7 security guards and closed-circuit surveillance video. Access to the datacenter floor will be gained by a two-factorauthentication security system requiring a security badge swipe as well as a biometric handor fingerprint scan. An additional mantrap will prevent "tailgaters" from followingpersonnel into the hosting area. The collocated rack that hosts the Contractor's Systemequipment will have an additional keypad lock to gain physical access.
The Contractor will have isolated non-production environments to support thespecification, design, development and quality assurance of the project. The Contractorwill have training and UAT staging environments that facilitate all release activities. Whena development cycle or iteration includes tangible content, the Contractor will demonstratethat to all stakeholders via web conferencing products or directly from the internet on thestaging environment.
The Contractor's production environment shall have state-of-the-art systems that arestable, always available, with little to no unplanned outages that can be scaled quickly andeasily as the State's needs change. This production environment will have highlyredundant, fault tolerant architecture and topology.
The Contractor's Disaster Recovery (DR) environment shall mirror the productionenvironment in both hardware and software. The Contractor's System shall achieve levelsof recovery time and recovery point SLAs through the Contractor's near real-timereplication from the production environments. Each production environment will have ageographically disparate DR site ensuring that in the event of a catastrophic failure at theproduction datacenter the Contractor can resume operations from the DR site withoutintemrption
All environments will be managed by ITIL service management approach. ServiceDelivery processes will include Service Level Management, Capacity Management,Availability Management and Continuity Management. The Contractor's centralizedservice catalog will capture all information technology within the enterprise. Each servicein the catalog will have its own change management, configuration management and
' service desk policies and procedures to compartmentalize the enterprise into a highlystructured and more efficient operational unit.
J. TURN.OVER/TRANSITION PHASEThe Contractor will develop and execute a Turnover/Transition Out Plan to be approved by theState, as defined in Attachment D of this Contract.
K. Desien. Development and Implementation (DDn & ON-GOING TASK-RELATEDDELIVERABLE(S) & APPROVAL PROCESSAll work must be pre-approved by the State Authorized Representative(s) stipulated under SectionB.
Sr.lrn or VnnvroNt, CoNtucr FoR PnnsoN,c.L SnnvrcnsDnpl,nrunNT oF Vrnnnoxr Hrnr.rn AccnssEQHnar,rn Sor,urroNso INc.
All work must be reviewed and accepted by the State Authorized Representative(s) before the
Contractor may submit an invoice to the State.
Task 0 - Proiect Monitorins and Status Reportile (Recurrine Deliverable)Project monitoring provides a high level timely and accurate picture regarding all key metrics
related to project health. The following are components of the Project Monitoring and Status
Report (referred to as Progress Reports in 11.13 and 11.14 of the Non-Functional Requirements,
Appendix II).i. Financial status (earned value method)ii. Schedule (milestones and tasks)
iii. Issues and risksiv. Change ordersv. Action items
Project monitoring will include periodic reporting of the following activities:i. Graphical status of scope, schedule, and budget (red, yellow, or green)
ii. Status of work completed against the Project Work Plan
iii. Objectives for the next reporting periodiv. State responsibilities for the next reporting periodv. Recovery plan for all work activities not tracking to the approved schedule
vi. Projected completion dates compared to approved baseline key dates
vii. Escalated risks, issues (including schedule and budget), and action items
viii. Disposition of logged issues and risksix. Important decisionsx. Actual/projected Project Work Plan dates versus baseline Project Work Plan milestone
dates
xi. Budgeted to actual budget figures, and estimated cost at completion (or similar forecast
of remaining costs)xii. One-page graphical summary of the Project Work Plan status of all major tasks and
subtasks for each Phase in a Project Plan
Upon project initiation (Kickoff), the Contractor will provide required project status reporting.
A11 quantifiable Key Performance Indicators (KPI) data will be represented in a graphical manner
and the Contractor will provide real-time electronic access to project Dashboards to State
Authorized Users.
ContractorosResponsibilities
o Projectreport card\dashboard (scope, budget &schedule)
o Issues and mitigation plan discussion with State
. Key issues for Escalationo Action items
State's Responsibilities o Define the schedule for recurring ProjectMonitoring and Status frequency
o Raise concems on the project report. Update on the State related action items and issues
Prcn 7loF268CoNrru.cr # 28739
AvrnnrnlnNT # 2
St.trn or Vnnvrout, CoNtru,cr FoR PrnsoNar, SnnvrcesDtplRrunNT oF Vrnvronr Hnalur AccnssEQHw,rn Solurroils, INc.
Location o Conference Call and\or Webinaro Onsite meeting as necessary
Task I - Proiect Initiation and PlanningTask 1A - Project Kick-off Presentation
The Contractor will conduct project initiation activities as well as ongoing project planning andmanagement throughout the duration of the Contract.
Project Initiation will include the development and approval of the formal Project Charter. TheProject Charter encapsulates the formal project description, scope, authoization, business needsand objectives. Key team member introductions and points of contact determined between theState and Contractor for near term tasks. A Project kick-off presentation will be delivered tostakeholders detailing the following:
i. Project Overview (mission, goals and objectives)ii. Projecl Schedule (high level)iii. Project scope (in and out of scope)iv. Project approach (projectplan)v. Objectives and Definitionsvi. Artifactsvii. Project timeline (schedule, budget)viii. Project team roles and responsibilities (project organizational chart and team members)ix. Project management (logistics, governance, meetings, issue management, change
management, change control, issue/risk management, communication plan)x. Keys to successxi. Next Stepsxii. Questions and Answers (Q&A)xiii. Resources
ContractortsResponsibilities
Upon Deliverable disposition (Rejection / Not Accepted)Contractor shall have five (5) business days to resubmit.Organize & moderate the meeting, take minutes and follow-
on action itemsStateo s Responsibilities o Identify the Key stakeholders to participate in the
meetingo Clarify expectations and validate the project scopeo Establish the project single point of contact on the
State side, core team and the extended team for thescope ofthe project.
o The state will complete review of all payment baseddeliverables within ten (1'0) business days.
o Subsequent state reviews of previously rejected / Notaccepted deliverables will be returned withdisposition with five (5) business days.
Location Contractor Office Location
Pacn 72o1268CoNrnq.cr #28739
AvrnNnvrBNT # 2
Surn or VnnuoNt, CoNtm.cr FoR PnnsoN.q.r- SnnvrcnsDBp,qnrvrnNT oF VnnvroNr Hrar,rn AccnssEQHnnlrn Sor.urloNs, INc.
Plcn 73 or 268
Conrnlcr #28739AunNtiunNr # 2
Task 18 - Project Management Plan
The Contractor will develop the Project Management Plan to manage project execution and willdocument the actions necessary to define, prepare, integrate and coordinate the various planning
activities. This plan also defines how the project is executed, monitored and controlled and when
applicable closed. It encompasses several subsidiary plans discussed in the following sections. It
is a tivlng document and is progressively elaborated by updates throughout the course of the
project.
The Care Management Project Management Plan shall address the initiating, planning, executing,
controlling, andilosing processes. The Project Management Plan will consist of the following sub-
plans:
a. Scope Management Plan - This plan documents the project vision and goals, items that are
in-scope andout-of-scope and their prioritization, dependencies between the scope items,
and risks associated with the inclusion and removal of items from scope. The plan also
defines the process used to modi$r project scope.
b. Cost Management Plan - The Contractor is responsible for developing a plan that
indicates how project costs/budget will be incurred, controlled, and reported. The plan must
include the finalized cost and budget for the project. Cost-related progress report formatting
will be developed and included by the Contractor, consistent with AHS requirements and
format, with inputs from State team members, and must include a tracking of costs to the
project budget baseline.
c. niik Uanagement Plan - Development of a Risk Management Plan is required. The
Contractor, with the support of State team members, must submit a baseline Risk
Assessment (800-30 Risk Assessment methodology) to the State's Project Manager withinone (1) month of the project initiation.
d. guaitty Managemeni Plor- The Contractor's plan must have the following elements:
i. Defined qualityassuranceresponsibilities.ii. Detailed definition of all deliverables by project phase and associated acceptance
criteria.iii. Defined deliverable review process.
iv. Disciplined deliverable review process.
v. Regularly scheduled reviews of key project phases and milestones.
vi. Identified target performance areas and proposed methods of measurement,
baseline metrics for the agreed upon goal areas, and the level of achievement of the
performance goals as determined with the State.
e. Human Resource Management Plan - The plan for this initiative will be tied to the
proposed project timeline and phases. The Contractor is responsible for proposing the
potential rolei and responsibilities for staffing the different activities, articulating what the
Contractor will need to provide and what the State should provide.
f. Schedule Management Plan - The plan developed by the Contractor must include the
following:i. How the project schedule will be monitored for variances.
ii. What types of corrective actions will be taken to address schedule variances during
the life of the project.iii. The process, roles, and responsibilities involved in making changes to the project
srarn or vrnuoNr, coNrnncr FoR pnnsoNar, snnvrcns PAGE 74 or 269DnpmrvrnNT oF'vnnmoNr Hnllrn Accrss coNrnq.cr # 29739EQHnn ru Sor,uuoNsr INc. AvrnNuivrnNr # 2
schedule.. g. Communication Management Plan- The plan must detail the varying levels and needs of
the project's stakeholders for information regarding the project, status, accomplishments,impact on stakeholders, etc. As part of Communication Management, issues must belogged and reported bi-weekly and the plan must detail the escalation mechanisms for issueresolution. As part of the Communication Management Plan, the Contractor must alsoaddress Issues Management, wherein an issue is defined as a problem that cannot beresolved with current resources and must be escalated to management or other parties forresolution. Issue management is the process of identifiring, communicating, tracking, andresolving issues throughout the life cycle of a project and in a timely manner. It includescategorizing and prioritizing issues, as well as determining an escalation path for issuesunresolved within a predetermined length of time. It is the responsibility of each projectteam member to identify, communicate, and log issues into an issue list. Issue Managementmust include the processes, tools, and techniques used in issue identification and analysisand must describe how issues are tracked, monitored, reported on, and resolved. It mustalso identify roles and responsibilities throughout the issue life cycle as well as describehow escalation will be initiated if needed.
i. Closure Approach -Upon
the completion of the Base and Extension OperationsPeriods, the Contractor will perform all activities necessary to close out the Project.This includes:
ii. Performing formal Contract closure.iii. Updating process documentation and transferring this to the State.iv. Transitioning any relevant process andlor solution responsibilities over to the State
Project team, or to another contracted Contractor.v. This includes updating and transferring all solution documentation, performing
formal Contract closure, and transitioning any relevant solution responsibilitieiover to the State Project team.
h. Change Management Plan - The Contractor must adhere to the Change ManagementPlan, which will be developed by the Contractor and approved by the State AuthorizedRepresentative(s). The plan describes how the Change Control Board (CCB) will managethe process for review, acceptance and rejection ofchange requests. For any decisions thatcannot be made by the CCB or project management team, the decision will be escalated.In the Change Management Plan, change requests will be:
i. Drafted by the Contractor.ii. Reviewed and edited by the State project Manager.iii. Approved or rejected by the CCB with direction from State management, as
necessary.iv. Implemented by the Contractor, as necessary.
The Contractor must perform updates to the project schedule and cost estimates when changerequests are approved.
Surn orVrnmoNt, CoNtru.cr FoR PsnsoNA'L SnnvrcrsDEPARTMENT OF VNNiVTONT HN.q.LTH ACCTSS
EQIIn.r,r,rn Soluuonso INc.
Contractorts.Responsibilities
Development and maintenance of the following:Scope management planCost management planRisk management plan
Quality management planHuman resource management PlanSchedule Management Plan
Communications planClosure approach
Change management plan
State's Responsibilities Review, comment and approve
Location N/A
Task IC - Project Work plan and fully resourced Schedule
The Contractor will develop a Project Work plan that will include the Work Breakdown Structure
(hereinafter referred to as "WBS"), which decomposes the total project scope into smaller
deliverable oriented components or work packages. The WBS is then sequenced in a Logic
Network or Gantt Time Chart detailing which activity logically precedes or follows another. This
determines critical paths and dependencies of work items throughout the project. The work
packages are estimated to determine the overall project schedule as well as the specific resources
necessary to complete each package.
The Contractor shall maintain and update applicable portions of the Project Schedule no less than
bi-weekly to reflect the current status of the Project with a comparison made to the Initial and
Baseline Project Schedules. The Project Schedule shall be consistent with available State and
contracted project resources. The State resources will be identified by the State and communicated
to the Contractor prior to Schedule development. The State shall have direct electronic access to
the Project Schedule as well as all Deliverables and working papers for immediate review and
coordination of schedules and plans. The Contractor shall document any work plan or schedule
changes from the plan submitted with the Contractor's original Proposal'
The Contractor shall provide a Project Work Plan and Schedule to include identification and
integration of all Phases of the Project, the sequences of the Phases, the duration of the Phases,
andihe duration of the Project. The Contractor will deliver a Project calendar in Microsoft Project.
The Project Schedule shall identiff the resources to be provided by both the Contractor and the
State, together with the scheduled dates those resources will be required. It shall consider State
holidays, holidays that will be observed by the Contractor staff, periods during which the State has
advised that data processing systems will be unavailable to the Contractor, and the resources that
the State has committed to providing in the Contract. The Project Work Plan and Schedule, once
accepted by the State, will form the Baseline Work Plan and Schedule for the overall Care
Management Project. As part of the Project Work Plan and Schedule, the Contractor shall prepare
and submit a WBS that encompasses all activities from Project Initiation and Planning to Project
Closeout. The WBS shall define the Project's overall objectives by identifying all Project tasks
and Deliverables.
Pl,cs 75 ot 268CoNrnq.cr # 28739
AvrnNlvmNT # 2
Sr.trn or VnnvroNt, CoNtnacr FoR pnRsoNar, SrnvrcnsDnpantvrnNT oF' VnnvroNr Hn.rr,rn AccnssEQHnlr,ur Sor,urroNs, INC.
P,q.cn 76or.268CoNrrucr # 28739
AunxonnnNr # 2
ContractortsResponsibilities
Develop and update bi-weekly the following:o Work Breakdown Structure (WBS)o Gantt chart(s)o MS Project calendaro Resource assignments
Stateos Responsibilities Review and coordinate schedule and planLocation N/A
Task lD - Requirements Analysis, system Design and Development strategyThe Contractor will develop a clear understanding of the State's Care Management Solution needsand document them in terms of a strategy document. The Contractor will perform a RequirementsAnalysis throughout the project to gain a clear understanding of the intent, expectations, andconstraints associated with each functional and non-functional requirement. The Contractor willapply the information gathered to the overall project scope. This living document will serve as aguiding document for the development of the Contractor's System. The document will also outlinethe Contractor's methodology to achieving the clear understanding of the project. The Contractor'sprocess will include meetings with appropriate stakeholders and Users to determine therequirements by a system of Q&A to identify utilization, functionality, etc. This process thentranslates into a detailed system design documents that specifies the system requirements andoverall architecture.
The Contractor shall provide a Requirements Analysis, System Design and Development StrategyDocument that includes, but is not limited to, a description of:
i. The business processes and the functionality that the Care Management Solution willprovide. Please note, the State prefers that business processes for the Care ManagementSolution be generated using a Business Process Management tool that will ensure thebusiness processes will be stored and re-used by the State as needed.
ii. The methodology that will be used to:a. Analyze and validate requirements.b. Select, configure, and develop the components of the Solution.c. Create a coherent and integrated system design.
iii. The intended use of Commercial Off the Shelf (COTS) software in the creation of thesolution.
ContractortsResponsibilities
o Develop a strategy document that will demonstrate theContractor's understanding of the State care managementprogram needs.
o Document will outline various business processes that will beused in the development of the product
The document will further outline the process to:Analyze and validate requirementsSelect; configure and develop the components of the solutionCreate a coherent and
o
a
o
State'sResponsibilities
Review, comment. and approve
Location N/A
Sr.trn or VrnuoNto CoNtn,l,cr FoR PrnsoN.ql SnnvtcnsDnpantvrnNT oF VnnvroNr Hrar,rn AccnssEQHnar,rn Sor,uuoNs, INc.
Task IE - System Implementation Strategt
The Contractor will develop a System Implementation Strategy that will detail all components
necessary to ensure an on time, on budget, well-orchestrated and quality solution. The deliverables
for this task will include, but not be limited to the work plan, development approach or
methodology, integration approach, conversion strategy (where applicable), testing and
deployment strategy.
The document shall include the strategy for the implementation of all functional requirements,
starting with VCCI go-live through fulI solution implementation, to ensure that all functionality
required of the Care Management System is implemented. The Implementation Strategy must
provide aphased approach where pre-defined success criteria for each release provide input to key
"go-no go" decision points.
The Contractor's System Implementation Strategy shall also identify any technical challenges
(which, if any, are the sole responsibility of the Contractor to resolve) and include the deployrnent
schedule of the releases.
The Contractor shall provide a System Implementation Strategy document to include, but is not
limited to, the following components:i. Project implementation Planii. Target end-User population included in the Project
iii. VCCI Go-Live and Full Implementation success criteria, by release
iv. Deployment schedule by release
v. Workflow analysis and documentationvi. Technology components required for the Project, by release
vii. Identification of the source systems to be integrated, by release
viii. Identification of technical challenges the Contractor must overcome to implement the
Contractor's SYstem
ContractortsResponsibilities
r Project implementation plano Deployment scheduleo Success criteria by releaseo Rollback plano Workflow analysis and documentationo Required technology components for project. Analysis of source systems for integration by
releaseo Technical risks or challenges to implement
Contractor's System
State's Responsibilities Review, comment and approve
Location N/A
Task IF - Master Testing Strategt
The Contractor will develop a Master Testing Strategy detailing the framework for overall testing
methodology and will include the environments, tools, processes and monitoring and controlling
P.lcn 77 ot268CoNrnr,cr #28739
AurNounNT # 2
Sr.trn or vnnuoNr, coNrrucr FoR ptnsoNal snnvrcns plcn 7g or 26gDnpl,nrvmNT oF vnnvroNr HEALTH Accnss coNrrucr # 29739EQHnu,rn Sor,urroNs,INc. AnnnNovrnNr # 2
metrics. The core of this strategy aggregates all the information from the requirements,Contractor's System design, and acceptance criteria into a detailed plan for testing. The MasterTesting Strategy will detail how the Contractor will conduct testing throughout the project toensure all development meets State expectations.
The Master Testing Strategy will ensure that the Contractor has identified the major system testingactivities and associated deliverables. A separate and complete set of testing as outlined belowshall be required for each Release or module of functionality that will be put into production.Complete testing shall also be required for every Contractor's System interface that is built andput into production. The testing functions of the Project shall be iterative and span the entire lengthof the Project.
The Contractor will employ a robust test methodology based on standards set by one of thefollowing organizations in the execution of the required system testing activities:
i. Software Engineering Institute (SEI), such as the Capability Maturity Model (SEIcMM)
ii, Intemational Standards Organization, such as ISO9000iii. Institute of Electrical and Electronics Engineers (IEEE), such as IEEE 829 Standard
for Software and System Test Documentation and related standards
The Contractor shall be responsible for populating the test system(s) with the data necessary toensure the validity of the testing for all phases of testing. State staff shall not be required tomanually enter data to pre-populate the test environment for any test phase. The Contractor shalluse an automated test management tool suite to manage, assess, track, and perform the requiredtest and deployrnent support activities. The Contractor shall have a software-based defect trackingsystem capable of providing an acceptable level of detail and reporting and facilitating thefollowing functions:
i. Capture - Details about each defect will be recorded when the defect is discovered,including a description, sSrmptoms, sequence of steps to re-create it, type, and severity.
ii. Review and Assignment - Project management shall be able to review all open issuesand assign a priority level and resources responsible for resolution.
iii. Estimate and Resolution - Those assigned to resolve the defect shall be able to recordan estimated duration and delivery date, and provide adequate explanation uponresolution.
iv. Track status and history- A complete history of each defect shall be maintained so thatthe life cycle of each defect can be tracked and reported on.
v. Management reporting - The defect tracking system shall provide recurring reports toProject Management throughout the Project.
The Contractor shall provide the Master Testing Strategy deliverable that shall include:i. The test methodology to be employed for overall Contractor's System testing.ii. The automated method of populating the test systems with data.iii. Identification of the software-based tracking system that will be employed.
Additionally, the Strategy document shall also identify and include the strategy for testing eachProject Phase:
Sr.lru or Vnnmont, CoNtRLcr FoR PrnsoNg, SnnvrcnsDnpLnrunNT oF VnnvroNr Hn.c.Lfir AccpssEQHrnlrn Sor,urroNs, INC.
i. Unit and Integration Testingii. System Testingiii. End-to-End Testingiv. User AccePtance Testingv. Performance and Load Testingvi. System Regtession Testingvii. Security Testingviii. Conversion testingix. Interface Testingx. operational Readiness Testing (includes test cases and scripts)
ContractortsResponsibilities
Test methodology based on acceptable industrystandards
Automated method of populating data for system
tests
Identification of software tracking system forcapture of 'all testing activities capable ofproviding the required detail and reporting
Strategy for unit, system, end-to-end, lJseracceptance, performance, regression and security
o
o
a
testing
State's Responsibilities Review, comment and approve
Location N/A
Task lG - Requirements Traceability Plan
The Contractor will create a Requirements Traceability Plan which will describe the process and
tools utilized to document the life of a requirement providing multi-directional tracking between a
given requirement and all dependent/associated requirements and other artifacts such as use cases,
workflow diagrams, business rules, test cases, etc. as well as to relevant MITA Business Process
Areas and MITA Business Processes. This plan provides a framework to capture any change made
to a requirement as well as the governance related items specific to the change management
pro""rr. Additionally, the plan provides dependent artifact mapping to items such as functional
and technical system design documents described in following task sections.
The Contractor shall provide a Requirements Traceability Plan to detail the methodology for
tracking the specific Functional and Non-Functional requirements of the Project. The
Requirements Traceability Plan shall identify the methods, tools and technologies used to capture,
catalog and manage the Contractor's System requirements to ensure traceability to the process
workflows and detailed requirements identified in the Contract.
The Contractor shall provide a Requirements Traceability Plan document to include the approach
and method of capturing and majntaining requirements traceability throughciut the development
and deployment process. The plan shall, include:i.
- The process the Contractor shall utilize to identiff how the requirements traceability
matrix will be developed, validated, and maintained throughout the life cycle of the
Pacn 79 o1268CoNrru,cr #28739
AnnnNuunNT # 2
Sr.trr or vrnuoNr, coNrucr FoR pnnsoNar, snnvrcns pacn g0 or 26gDnpmrvrnNT oF vnnnnoNr Hnlr,rn Accnss conrnrcr # 29739EQHnn rn Sor,urroNs,INc. Annnuovrnnr # 2
Contract.ii. How requirements are validated.iii. How any new requirements (if any), as approved through the State's Change Control
Process, are analyzed and managed.iv. How the State works with the Contractor to ensure traceability of requirements to the
delivered Care Management Solution.v. Identification and implementation of the tool to be used to perform requirements
traceability.vi. Approach and methodology to track the Project requirements including:
a. Mapping the requirements to a unique identifier in the tool.b. Mapping the requirements to all associated artifacts such as use cases, workflow
diagrams, business rules, test cases, etc. as well as to relevant MITA BusinessProcess Areas and MITA Business processes.
c. Mapping the requirements to the individual test events.d. Mapping the requirements to the individual test cases, scripts and procedures.
vii. Approach for updating the status of the requirements based on the results of each testevent.
a. Each test event will include an identifier that will be linked to the correspondingrequirement(s) in the Traceability Matrix. The test event will include status ofthe event (Pass/Fail) as well as a link to any defects identified as a result of thetest.
Identification of the requirements by status (e.g., satisfied, waived).Identification of the reports to manage and validate the requirements, including TestCoverage by test event.
ContractortsResponsibilities
Requirements Traceability process, tracking tooland matrix document maintained and validatedthroughout the projectCompliance with change management process andtrackingPlan to ensure State requirement visibility andvalidation through implementation including testcoverage
Reporting to manage and validate all requirementsand
a
a
a
a
Stateos Responsibilities Periodic review of Traceability Report. Participate inchange management pro cess
Location o Conference call and\or Webinaro Onsite meeting as necessary
TASK 2 - Rqquirements Analvsis and Svstem DesisnTask 24 - Functional Specification and System Design DocumentA focused and detailed Requirements Analysis will be conducted by the Contractor to clearlyunderstand each requirement included in the final system scope. This involves frequentcommunication with Contractor's System Users to determine specific expectations so that the finalContractor's System meets the State's needs rather than attempting to mold User expectations.
vl11
ix
Sr,c.rn or VnnuoNt, Contru,cr FoR PnnsoNar, SunvrcnsDnpLnrvrrNT oF VnnuoNr HBar,rn AccnssEQHn,lr,rn Sor.uuoNs, INc.
Plcr 81 or 268Courru,cr #28739
AMnNoN,InNr # 2
This analysis provides the development team with a model of system information, function and
behavior which translates into data, architectural and component-level designs. The following are
the objectives of this analysis:
i. Identify specific needs
ii. Evaluate feasibilityiii. Technical analysisiv. Allocate functions to system elements
v. Establish schedule and constraintsvi. System definitions
The requirements analysis process bridges directly to Contractor's System Design. System Design
includes the architecture, components, modules, interfaces, and data to meet each requirement as
well as the logical and physical design of data flows, inputs and outputs of the system.
The Traceability Plan will include an associated Functional Specification and Contractor's System
design artifact for each requirement. The Functional Specification is geared towards the
Coniractor's System LJser's perspective and is the artifact that describes the requested behavior.
Typically, a mockup design is included when the requirement is related to a User interface
component. This document will not describe the technical aspects of the requirement and how itwill-be implemented. Instead, it focuses on expectations when interacting with the Contractor's
System. The goal of the Functional Design document is to inform the developers on what to build,
instruct the testers on how to test, and leJ the stakeholders know exactly what they are getting'
The technical implementation of each requirement is captured in the Contractor's System Design
document. This document details the system requirements, operating requirements, architecture,
files and database design, input formats, output formats, processing logic and external interfaces.
In order to ensure that the Contractor fully understands the system requirements, the Contractor
must lead and facilitate the process for reviewing and validating the detailed Functional and Non-
Functional Requirements documentation. The Contractor shall also conduct Joint Application
Design (JAD) sessions to fully explore and understand the functional requirements for the Care
Manigement Solution, and to identify any gaps that the Contractor shall address in order to comply
with the requirements identified in this Contract. Based upon the outcome of the JAD sessions, the
Contractor .hull do"ntnent in detail the design and development actions necessary to fully meet
DVHA's requirements. The Contractor shall lead and facilitate the process for developing the
Functional Specifications and System Design Document.
The Contractor shall develop and provide the State with Functional Specifications and System
Design Document, including, but not limited to:
111.
iv.
A comprehensive list of functional specifications to implement the Functional
Requirements, that assures no intemrption of VCCI services.
Recommendations on how to close specific gaps that require changes to the State's
business processes.
Business rules defi nition.Reporting capabilities and prebuilt reports.
User profiles and security role permissions (Roles and Privileges Matrix).
1
il
srlrn or vnnuoNr, conrucr F'oR pnnsoN.q,L Snnvrcns p.q.cn g2 or 26gDnpanrvrnNT oF VnnuoNr Hnar,rn Accnss CoNrrucr # ZS73g
ANrnNIunIBNr # 2EQHnllrn Sor,urrons, Inc.
vi. Contractor's System functionality traceable back to the Requirements TraceabilityMatrix.
vii. Contractor's System overview diagrams illustrating which Solution componentsprovide what functionality, linking back to the functional capabilities.
viii. Domain model.ix. Data IntegratiorVlnterface Design Document Contractor will gather data
specifications from internal/external hosted systems, servers, applications that will beused in the CARE target architecture.
x. Use Cases - a list of workflows mapped to business processes mapped to Contractor'sSystem requirements.
xi. User Interface screens for the Contractor's System.xii. Identification of functions or User roles that initiate workflow, receives the workflow,
and any processes that occur as a result of the workflow.xiii. List of assumptions made during the design as well as recommended next steps and
required actions that shall be confirmed by the State before the development.
'Contractor'sResponsibilities
a Facilitate the elicitation, documentation, review andvalidation of all requirements via Joint Application Design(JAD) Sessions and one-on-one SME interviewsCatalog of functional specifications (indexed andsearchable)
Schedule and conduct JAD sessions (-31) aroundfunctional and non-functional requirements with keySME(s)Create the necessary artifacts associated (example;frnalized business requirement, business rules, processflows etc.)Finalize the design requirementUpdate the overall system architectureIdentify the data sources/ data connectivityIdentify State software & integration
a
a
a
State'sResponsibilities
Key SME(s) participate in the JAD sessionsAnalyze & validate the requirementsState -off on the final
a
o
o
Location a
a
Contractor location for larger JAD sessionsState location for one-on-one meetinss with SME(s)
Task 28 - Data Integration and Interface Design DocumentThe Contractor will develop Data lntegration and Interface Design Documents for each identifiedintegration point. A catalog will be developed enumerating and describing each that will includeinformation regarding endpoint addresses, protocols (tcp/ip, http(s)), payloads (data types,formats) and security configuration. A diagram or conceptual model will also be created for eachintegration detailing the source and target systems. All data translation/mapping will be includedas well as any logical transformations of data.
Srlrn or VnnvroNt, CoNtru.cr FoR PnnsoNu, SnnvlcnsDnpl,ntvrnNT oF VnnuoNr Hnnr,rn AccnssEQHn.l.r,rn Sor,uuoNso INc.
This document must be developed based on outputs from the design sessions conducted with the
Contractor and the State. The Data Integration and Interface Design Document must include the
following components:i. Entity RelationshiP Diagramsii. Data Flow Diagramsiii. Data Dictionaryiv. Data Transformation and Loadingv. Processing controlsvi. Data Test plansvii. Conversion Testing resultsviii. Processes to manage Contractor's System installation and configuration
ix. Data backup proceduresx. InterconnectionSecurityAgreement
The Data Integration and lnterface Design Document must include the interface definitions and
design.
The Contractor must conduct a walkthrough of the final Data Integration and Interface Design
Document with the Care Management Solution Project team to validate the contents, the
incorporation of all information from the design sessions, and the incorporation of all Non-
Functlional Requirements. Approval of the Data Integration and Interface Design Document is
required before development can begin.
ContractortsResponsibilities
a Contractor will develop aData Integration and
Design Document to include EmergencyDepartment diagrams, data flow diagrams, data
dictionary, data transformation and loading process
controls, data test plans, data bactup procedures
State's Responsibilities Review, validate and approve the document
Location N/A
Task 2C - System Architecture
The Contractor will author an overall System Architecture document, which includes a conceptual
model or diagram that is a representation of the components that make up the Contractor's System,
the relationships between these components and the design principles and patterns that govern
their development. An architectural framework or industry best practices reference model will be
leveraged to provide effective visualization for all stakeholders to understand the broad scope and
compGxities of the Contractor's System. This deliverable will be maintained throughout the
project as system components are added or changed to reflect the most current state'
The Contractor shall develop a System Architecture, which details the SOA model-driven
framework being used across all the domains (e.g., services, trust and security, infrastructure) that
enables the development of service-oriented models to facilitate the interaction and
communication of technologies. This document shall describe the set of technologies that support
Care Management Solution operations, incorporating the industry best practices and standards. It
PAGE 83 or 268
CoNrru,cr #28739AunNnunNT # 2
Sr.r,ru or vnnvroxro coNrnlcr FoR ppnsonu, Snnvrcns p.q.cn g4 or 26gDnpmrvrnNT oF vnnvroNr Hrar,rn Accrss coNrnlcr # 29739EQHnlr,ru Sor,urrons,INc. AunNuvrnNr # 2
shall detail the COTS package components, design patterns, information architecture, technologyinfrastructure and the conceptual, logical and physical architectures for the Contractor's targeteibaseline System.
The Contractor shall provide the System Architecture deliverable incorporating details of anyCOTS packages thatare part of the Solution. This System Architecture shall define and document:
i. A conceptual architecture that will produce a design to fulfill Care Managementstakeholder's functional expectations.
ii. A logical architecture that identifies the SOA layers, Contractor, Service Customers,Service Broker(s), and object dependencies. To complete the logical design model, theContractor shall define the interfaces for each service, and include data field definitionsand their validation rules.
iii. A physical architecture that defines the various services of the Contractor's System andhow they shall be implemented. This shall also include details around the integrationlayers, potentially using Web Services, and various other integration technologies.
iv. A detailed list of all the proposed production environment platforms, includingHardware, OS, Networking, and all COTS and third-party systems/tools/ utilities, etc.
v. The details of Security, Privacy and Consent Management Plan for Care Management.vi. The Security Plan will provide the technical approach to satisfy the following:
a. Networksegmentationb. Perimeter securityc. Contractor's System security and data sensitivity classificationd. Intrusion management
e. Monitoring and reportingf. Host hardeningg. Remote access
h. Encryptioni. State -wide active directory services for authentication !
j. Interface securityk. Security test procedures
l. Managing network security devicesm. Security patch managementn. Secure communications over the Internet
vii. Detailed diagrams depicting all security-related devices and subsystems and theirrelationships with other systems for which they provide controls will be within theSecurity Plan.
viii. The High Availability and Disaster Recovery approach and plan describing how theContractor's System shall enable the State to provide information to its members in theevent ofa disaster.
Sr.q.rn or VrnvroNt, CoNtRl,cr FoR PERSoNAL SnnvrcnsDnpl,nrunNT oF VpniuoNr Hnu,ru AccrssEQHnar,rn Sor,unoNs, INc.
ix. How the architecture design features ensure that the Contractor's System can scale as
needed for future transaction volumes, storage requirements, and Contractor's System
usage expands over the next 10 years'
x. How the Contractor's System shall ensure performance based on expected data and
User loadin g,targetsource systems and target platforms. Areas that shall be addressed
are expected Contractor's System performance during peak transaction volumes and
key critical business activities.
xi. How the Contractor's System shall meet capacity requirements, including:
a. A description of how Contractor's System capacity and capacity requirernents
were calculated, including all formulas and calculations used in capacity
planning for the State. This shall include:
1. Business CaPacitY Management
2. Service CaPacitY Management
3. IT Component Capacity Management
4. Capacity Management Processes
5. Capacity Management Tools lnfrastructure
6. Descriptions of how capacity utilization will be monitored and capacity
thresholds will be established.
7. A description of corrective and escalation processes that will be used in
the event arry capacity thresholds are reached.
ContractorosResponsibilities
System Architecture document will include:a
a
a
o
a
a
a
a
Conceptual architectureLogical architecture layers
Physical architectureEnvironment defi nitionsSecurity, privacy and consent management plan
Disaster recovery planSystem scalabilitySystem performance
Stateo s Responsibilities Review, comment and provide feedback
Location N/A
Task 2D - Technical Design Document
The Contractor will author an overall Technical Design document (TDD) that details the system
characteristics (topology), design pattems, programming standards, naming conventions, entity
relationship diagram, third party libraries and development tools used to build the Care
Management System. The Technical Design Document will reflect the final requirements for
Contractor's System configuration and operation. This document must be developed based on
outputs from the technical design sessions conducted with the Contractor and the State.
The Technical Design Document must include the following components:
Plcn 85 or 268CoNrRLcr #28739
AurBNnvrnNT # 2
srlrn or vnnuonr, coNrucr FoR pnnson.q.r, snnvrcns PAGE g6 or 26gDnp,tnrurnNT oF vnnuoNr Hralrn Accnss colqrrucr # 29739EQHnalrn Sor,urroNso INc. AvrnNovrBNr # 2
i. Detailed description of Contractor's System architectureii. Entity Relationship Diagramsiii. Data Flow Diagramsiv. Data Dictionaryv. Data steward and data governance approach to the solutionvi. Business processes as mapped to enterprise platform componentsvii. Processing controlsviii. Processes to manage Contractor's System installation and configuration Data backup
proceduresix. Security controlsx. Availability and resilience controls such as load balancing, failover capabilities, and
fault tolerance
The Contractor may propose alternatives to any of these components, but they must be clearlyjustified and have the prior approval of the Care Management Solution Project team.
The Technical Design Document must include the interface definitions and design (includingXML/SOAP specifications for file formats), the new Contractor's System design based onreviewing existing class diagrams, sequence diagrams, updated object models that represent theinternal workings and designs of the containing subsystems that will expose the services, and thecomponent specification (details of the component that will implement the service) and serviceassignment to each layer defined in the Contractor's System architecture.
The Contractor must conduct a walkthrough ofthe final TDD with the State to validate its contents,the incorporation of all information from the design sessions, and the incorporation of all non-functional requirements. Approval of the TDD is required before development can begin. The finalTDD, once formally approved by the State, will, together with the approved FunctionalSpecifications and Design Document, constitute the complete Contractor's System definition forthe new Care Management Solution.
These two (2) deliverables will constitute the agreement between DVHA and the Contractorregarding the functionality and operation of the new Care Management Solution. The two (2)documents will be the documentation used by the Contractor during Contractor's Systemdevelopment and use cases, and will be the basis for the development of the User Acceptance Test(uAr).
Contractor'sResponsibilities
o Interface definitions and designo Object modelso Service architecture
State's Responsibilities Review, validate and approveLocation N/A
TASK 3 - Svstem Confisuration and DevelopmentTask 3A - System Implementation PlanThe Contractor will develop a System Implementation Plan that describes how the Contractor?sSystem shall be deployed and transitioned into the production operational environment. This plan
Sr.trn or VnnuoNto CoNtru,cr FoR Pnnsonar, SrnvrcnsDnpantvrnNT oF VrnvroNr Hnalrn AccnssEQHnar,ru Sor,urroNs, INC.
is utilized by change management and configuration management personnel during scheduled
implementations. The plan includes the overview of the Contractor's System, a brief description
of ihe major tasks involved, the implementation task schedule, the resources needed to support the
implementation effort and any site-specific requirements and a Rollback plan. An Implementation
Plan will also be created for each major release focusing on just the tasks associated with the
release scope. Post-implementation performance monitoring will be conducted to determine ifeach implementation is successful.
The Contractor shall develop a System Implementation Plan document that incorporates the final
Design DocumentS for Contractor's System implementation. This document shall be developed
based on outputs from the planning and design sessions conducted with the Contractor and the
State. The plan shall include detail on the following components:
i. Description of functionality for each implementation release (starting with VCCIcapacity to go-live).
ii. Releases from VCCI goJive through full implementation.iii. Roll-out/implementation schedule for each release.
iv. Points-of-contact to include individual names and contact information for each member
of the implementation team, Contractor and State.
v. Major tasks.vi. Security and privacy.vii. ImplementationsuPPort.viii. Hardware, software, facilities and materials for all Environments.
ix. Personnel and staffrng requirements.x. Outstanding issues and the mitigation plan for each'
xi. Implementation impact and otganizational change issues.
xii. Performancemonitoring.xiii. Configurationmanagementinterface.xiv. Risks and contingencies.xv. Implementationverificationandvalidation.xvi. Definitions of the criteria for both success and failure of the System Implementation
for each release.xvii. Exit plan and strategy addressing portability of Solution in the event the State wants to
bring the Solution back in-house.
The Contractor will provide a separate System Implementation Plan for each major functionalityrelease of the project, to include the elements outlined above and the following components:
i. Projectimplementationroadmap.ii. Target end-User population included in the implementation.
iii. Deployment schedule for the release.
iv. Technology components required for the Project release.
v. Identification of the source systems to be integrated for the release.
Plcn 87 or 268
CoNrru,cr # 28739AvrnNuunNT # 2
Srnrn or VrnvroNro Conrucr FoR PnnsoN.c.L SnnvrcnsDnpmtnnrNT oF VnnvroNr Hn.ql,ur AccnssEQHn,rlru Sor,urroNs, INc.
PAGE 88 or 268CoNrru.cr # 28739
AvrnNourNr # 2
ContractortsResponsibilities
o Release plans and schedules. Implementationsupporto Issues and mitigation plano Organizational change managemento Performancemonitoringo Training
State's Responsibilities Review, comment and approveLocation N/A
Task 38 - Duta Integration and Synchronizution Plan, including multiple testfiles(MMlS/claims, PBM, eligibility, VCCI legacy, etc.)
The Contractor will develop aData Integration and SSmchronization Plan that will detail all pointsof integration between the Care Management Solution and external systems. The plan will includethe gnalysis and design tasks required to understand the data, layout, protocol and frequency ofexchange. The testing, verification and validation phases of the plan will include the exchange oftest files resulting in final sign-off from all stakeholders. The Care Management Solution shalladdress the State's need for integration ofreal-time operational data of the State's relationship witha Member during service delivery, as well as integration and aggregation of data from a variety ofsiloed source systems into operational data stores, data warehouse and data marts. This data shallbe usable for operational and performance reporting (static I canned and ad hoc), shared analytics,and State-wide alerts.
The Contractor shall perform the necessary data integration arrd synchronization work toimplement the Care Management Solution in compliance with the requirements of the Statementof Work. The Contractor shall develop a detailed plan to validate all integlation andsynchronization routines, as well as the accuracy and integrity of all data integrated from the sourcesystems or otherwise generated.
The Contractor shall design, develop, and implement the technology infrastructure required toenable the Data Integration in the functional and technical specifications of this Contract andintegration of operational data residing in the existing siloed State systems. Operational DataIntegration shall focus on combining select data elements from a variety of existing data sourcesto present a dynamic / temporary view of authoized and relevant Member information, as well asthe State's relationship with that individual across all Departments and programs within the scopeof the Care Management project.
The Contractor shall provide an analytical data integration infrastructure that includes consistentdata across the Enterprise to meet the analytics needs for each Program. This data must be availablein a form suitable for the required analytics and reporting functionality, and available to authorizedUsers.
The Contractor shall provide aData Integration and Synchronization Plan to include all theelements of operational and analyical data integration described above.
Sr.lrn or VnnuoNt, CoNtru,cr FoR PnnsoNar, SnnvtcnsDnp.q,ntNIsNT oF VnnvroNr Hnar,rn AccnssEQHnn rn Sor,uuoNso INc.
ContractortsResponsibilities
a
a
Identify and catalog integration points
Analyze data payloads and s5mchronizationschedule
Data integrity and validation proceduresa
a Exception handling
State's Responsibilities Review, comment and provide feedback
Location N/A
Task 3C - System Maintenance and Support Plan
The Contractor System Maintenance and Support Plan deliverable will include the processes,
policies and responsibilities of the product support services team. Contractor's System
modifications post DDI phase can be required due to defects or evolving original requirements.
The documentation, tracking, impact analysis, testing and maintenance release process will be
detailed in this plan.
The Contractor shall provide a written plan for the Maintenance and Operations Support of the
Care Management Soiution into the Production Environment. The following documentation shall
be prepared by the Contractor and included in the System Maintenance and Support Plan provided
to the State:i. Development of Contractor2s System support structure and organization, including
estimates of manpower requirements to support operation and maintenance of the
Contractor's SYstem.
ii. contractor's System Installation and Administration Manual.
iii. Completed Code.iv. Operating Procedures Manual: Includes Diagnostic procedures, backup and restore
procedures, and disaster recovery procedures.
v. Maintenance Manual: Information to aid in analyzing and debugging the software,
apart from information already available in other delivered documentation.
vi. Maintenance and repair policies and procedures.
vii. Updated system architecture diagrams and inventory (systems, servers, etc.) that
clearly identify what is in the pilot and in production use.
viii. Care Management Solution Database Schema.
ix. Complete Data Dictionary.x. Contractor's System "Run Book" as defined by the State'
The Contractor shall provide a System Maintenance and Support Plan to include the elements
defined above.
ContractortsResponsibilities
o Development of system support structure and
organizationo Operating procedures manualo Maintenance manual
State's Responsibilities Review and comment
Location N/A
Plcn 89 or 268CoNrnlcr #28739
AunNonlnNT # 2
Sr.lrr or VnnvroNr, CoNrucr F,oR pnnsoNlr, SrnvrcnsDnplnrvrpNT oF VnnproNr Hn,q.LtH AccrssEQHnalrn Sor,urroNs, INc.
PacB 90 or 268CoNrnr,cr # 28739
AvrnNuvrpnr # 2
Task 4 - TestinsTask 4A - Test Plan
The Contractor's Test Plan will detail the systematic approach to thoroughly testing allcomponents of the Contractor's System. The plan includes u rtrut"gy for design verificatioi andcompliance, acceptance testing and regression testing. Each requirement will be tested via one ofseveral methods such as coded unit tests, manual testing and automated User interface testing. Thethree major components of the plan include:
Test coverageTest methodsTest responsibilities
1.
ii.iii.
The Contractor will be responsible for the development of a Detailed Test Plan, which includesthe following testing events:
a. Unit and Integration Testing - The Contractor shall perform Unit and Integrationtesting a, nr.err*y during ihe configuration/development process. The Sta-te willrequire the presentation of Unit and tntegration test plans and results duringscheduled development review meetings.
b. System Testing - The Contractor's System testing is aimed at proving that theContractor's System meets the stated requirements and objectives by validating thetotal system in a real-world scenario. This testing shall be performed by theContractor and supported by a limited number of State subject matterexperts/power-Users (not end-Users) at the sole discretion and to the limit deemedappropriate by the State Project Manager. Contractor's System testing will becombined into a single test phase to provide streamlined testing withoutcompromising the testing objectives.
c. Entry Criteria - The feature set, although largely defined and static, may still notbe completely finalized. The software has been unit tested, and there is a high levelof confidence the completed care Management software is ready.
d. System Test Execution -The Contractor's System Test shall utilize "real" data, andshall be performed by the Contractor or a third party. The Contractor's System testshall be intended to demonstrate the critical business functions of the Contractor'sSystem and the overall effectiveness of the User-facing aspects. The Contractorshall provide and the State shall accept the System Test Plan before it is executed.The Contractor shall incorporate the following activities during System Testing:
i. Demonstrate Critical Business Function Scenarios (as defined by andapproved by the state) - data and processes must be fully integrated acrossfunctional areas and that integration fully demonstrated.Transaction Testing (as defined by and approved by the State).Error Message Testing.Documentation Testing (as defined by and approved by the State).Help Systems Testing (as defined by and approved by the State).Demonstrate the complete Sequence of Functional Business Tasks (asdefined and approved by the State).End-to-end business process testing (as defined and approved by the State).Report Generation and Printing.
11.
iii.iv.V.
vi.
vii.viii.
Srarn oF VERMoNI, CoNtru.cr FoR PrnsoN.ll SnnvtcnsDnp,qnrvroNT oF VrnvroNr Hrllrn AccnssEQHn,ll,rn Solurrons, INc.
Pacn 91 or 268CoNrRAcr #28739
AvmNnunNr # 2
ix. Interface Testing (A11 Interfaces included in the module/system).
x. Demonstrate the Complete Sequence of Functional Business Tasks (as
defined and approved bY the State).
xi. Usability/InterfaceTesting.xii. Reliability Testing.xiii. Performance Testing (stress, load testing).xiv. Security Testing.xv. System Recovery and Restoration Testing.
xvi. Regression Testing.xvii. Integration Testing.xviii. Integrity Testing.
e. Exit Criteria _ The results of the System Test are to be presented to the State for
approval before the development Contractor's System status can be promoted to
UAT stage for end User testing. This presentation shall take the form of a livedemonstration of Contractor's System functionality as outlined below. The State
shall define, no less than 20 business days before the start of System Test phase,
the criteria necessary for State approval of test results, including requirements forpresentation of the results to the State and timeframes for State review.
f. (Jser Acceptance Testing _ The pulpose of User Acceptance Testing is to confirm
that the Contractor's System is developed according to the State's business
functionality, performance, and technical requirements and that it is ready for
enterprise deployment and operational use. During UAT, selected State End-Users
will compare the Contractor's System's functionality, features, and performance to
the State's System Requirements Documents, Design documents and State
documented UAT exit criteria.g. Entry Criteria - Prior to moving from System Testing to UAT, the Contractor's
System's feature set shall be fully defined and static. The Code shall be complete
and frozen. The final release version shall have been built from source control. This
final version shall have passed a formal Contractor QA acceptance test, which also
covers "installation" instructions on how to update the server and end User
documentation.h. Pre-Test - The Contractor shall perform the following activities prior to User
Acceptanee Testing (UAT):Build the UAT System release.
Develop and document the software build instructions for UAT.Install and configure the UAT release Contractor's System components and
database(s) on the State's testing environment.Develop and provide the required UAT Test documentation (e.g., end User
guides, systems administration manuals, LJser help files) and provide to the
State for approval for use during UAT activities.All Engineering Change Requests (ECRs) completed.Load database(s) with complete and validated production-ready dataset.
Develop comprehensive UAT Scripts that test each and every requirement
as specified in this SOW in a logical and business process-oriented manner'
1.
ii.iii.
1V
vi.vii.
sr.lrn orvnnvroNr, coNrrucrFoRPnnsoxar, srnvrcns pacn 92o126gDnpanrvrnNT oF vnnuoNr Hnl.LrH Accuss conrnq,cr # 29739EQHnar,rn Sor,urroNs, INc. AnnnunvrnNr # 2
viii. Conduct UAT - There are a number of activities that the Contractor and theState must perform for the completion of the UAT. The following activitiesshall be performed:
a. Identification of the required State and Contractor resources tosupport UAT activities.
b. Provide Contractor resources to support UAT activities.c. Development of the defect resolution management plan
(Contractor).d. Review and acceptance of the defect management plan (State).e. Development of the overall UAT Test Plan and schedule
(Contractor).f. Development of required UAT Test Cases (Contractor).
lx. Each requirement identified in the Contract shall be tested by at least oneTest Case. One Test Case may provide for the testing of multiplerequirements Review and acceptance of UAT Test Cases (State).
. x. Compilation of all relevant data needed to permit State to validate that theContractor's System meets all functional, operational, performance, andsupport requirements. This shall include:
a) The Project Statement of Work (State).b) Systems Requirements Documents (State).c) Software Requirements Document (State).d) Requirements Tractability Matrix (Contractor).e) Systems Configuration Management Data (Contractor).
D End-User Documentation (User manuals, systems administrationprocedures, and training documents) (Contractor).
g) State Approved UAT Test Plan (State).xi. Compiling and evaluating the UAT Test Results (Contractor) and State
.. approval of the UAT Results and corrective actions (State).xii. State acceptance of the overall Contractor's System and its readiness for
production deployrnent (State).xiii. The Contractor shall prioritize all problem/error tickets within two (2)
business days. Any severity 1 (causing the contractor's System to fail toperform abasic business function) problem shall be resolved within four (4)hours. The acceptability of remedial fiies will depend on the nature of theproblem, but shall be solely at the State's discretion. when UAT tests arererun, the reruns shall be treated as any other UAT test activity anddocumented accordingly.
xiv. Software shall be feature complete. Changes taking place must beconsidered by state a low risk to the underlying stability of the software.The software shall have been rigorously tested by the contractor's eA andthe original software developer's QA. There shall be a high level ofconfidence the software is working as State and members will expect.
i. Exit Criteria - The requirements for release from UAT are zero Severity 1 andSeverity 2 defects. The State desires but does not require zero Severity 3 defectsbefore deploying to production. The Release Committee will review the defects and
Srarn or VnnuoNto CoNtucr FoR Pnnsonu, SnnvrcnsDnpmrunNT oF' VnnuoNr Hn.ql,rn AccrssEQHnar,rn Sor,urroNs, INc.
P.tcn 93 or 268CoNrru,cr #28739
ANarlculvlnNr # 2
make a recommendation to the State whether to release to production or not. The
State and Contractor Project Managers will meet and mutually agree on an
acceptable level of Severity 4-5 defects in order to move forward. Defect levels ofseverity are as defined above.
i. All known problems are to be reviewed by the Release Committee. No
outstanding problems should affect overall customer expectations for the
Contractor's System. Supporting materials such as release notes, User
manuals and training manuals shall be in final form and shall also have been
verified by the Contractor's QA or other appropriate reviewers. State
support (if applicable) shall be fully prepared to support the product at this
point.ii. The Contractor shall present in person the results of the completed User
Acceptance Testing process to the State. The Contractor shall also prepare
u r"pott detailing any remaining defects of all severities and the expected
impacts of each, and deliver the Report at the same time as the presentation.
The State will review the results and approve or reject the completion of the
UAT phase.
Performance Testing - The Contractor shall perform Performance Testing.
Performance Testing shall include both Stress and Load Testing to verifyContractor's System performance in accordance with the SLRs.
k. System Regression Testing - The Contractor shall perform Regression Testing
throughout the testing process to verify Contractor's System integrity after
functional improvements or fixes have been made as a result of Contractor's
System Integration and User Acceptance test activities. Regression testing shall be
disigned to confirm that fixes have not created any new problems and that the
results are as planned. The results will also define the Contractor's System baseline
configuration to be released to the State. The Contractor team shall document all
tests performed. It shall be the responsibility of the Contractor to ensure all
automated test scripts have been assessed to ensure their proper function. The
Contractor shall provide a Test Plan that includes the elements outlined above and
a detailed schedule for each of the activities to be completed within the test phase,
including the individuals (named and role) responsible for the completion and/or
approval of each activity. Activities in the Test Plan shall include, but are not
limited to:i. Definition of the Test Phase and Objectives
ii. Entrance Criteria for the Test Phase
iii. Exit Criteria for the Test Phase
iv. Key milestones (i.e., relationship in terms of timeframes days / weeks /months, to predecessors and successor tasks) associated with each Testing
Phase, including:v. Test Case Approvalvi. Test Environment Readiness
vii. Test Start and End dates
Sr,trr on VnnuoNr, Conrucr FoR pnnsoNal SnnvrcnsDrp,tnrnasNT oF'VnnuoNr Hn,ll rn AccpssEQHnar,rn Sor,urroNs, Inc.
PAGE 94o1268CoNrnncr #28739
AnrnNunapxr # 2
viii. Code Baseline Configuration Establishedix. Code Freeze Date(s)x. Required Approval Dates for Test Cases, Entrance and Exit Criteria, etc.xi. Regression Testing start and end datesxii. Test Results Review Meeting Completionxiii. Code Promotion GoA.{o-Go Decision
ContractortsResponsibilities
Unit and integration testingSystem testingUser acceptance testing protocolsEvaluation of UAT test resultsRegression testingPerformance testingRelease test schedule
State's Responsibilities a
a
Conduct UAT testingffon release to
Location UAT testing will be conducted online in Contractor'sprovided UAT environment.
Task 48 - Test Scenarios, Test Cases and Test Scripts
The Contractor will author Test Scenarios, Cases and Scripts for all functional and non-functionalrequirements in a logical and business process-oriented manner. All UAT material will bedeveloped and executed in concert with State participation. The development methodologyleveraged will include the use of User Stories created bythe Contractor and the State. A User Storyis a description, in general language, that captures what a User does or needs to do as part of hislherjob function as it relates to the Contractor's System. Each User Story has associated testscenario(s), test case(s) and test script(s) that will effectively and accurately validate and verifythat the expected results are produced. The Test Scenarios, Test Cases and Test Scripts will coverall test events defined above and will be co-developed with State staff involved. The TestScenarios, Test Cases and Test Scripts will also be supported by Contractor-developed data sheetsthat reference the test cases to the Requirements to ensure comprehensive coverage of each testevent specified.
The test scenarios will describe the functionality that will be tested and more specifically theactions of a given actor or User. Test scenarios are typically made up of one or more test cases.
Test scripts are a set of instructions that are performed on the Contractor's System to test thefunctionality. Each User Story and associated test scenario/case will have an authored test scriptthat will provide full coverage. In addition, automated testing via unit tests and User interfaceautomation will be conducted to ensure regression coverage of previously developed code base.
To ensure that the Contractor's System has been thoroughly tested, the Contractor shall provideTest Scenarios, Test Cases and Test Scripts as well as data sheets to include all of the elementsdefined above to ensure comprehensive test coverage of each and every requirement as specified
Sr.lrr or VrRvroNto CoNtnacr FoR PnnsoN,q'L SnnvtcnsDnpanrnnnNT oF VnnvroNr HEALTH AccnssEQllnllrn Sor,urroNs, INc.
in this contract. The Test Scenarios, Test Cases, Test Scripts and data sheets will map to the unique
identification numbers assigned to all requirements in the Requirements Traceability Matrix'
Contractor'sResponsibilities
a Use cases encapsulation process flows and system
functionalityState's Responsibilities Review, comment and provide feedback
Location N/A
Task 4C - Documented System Results
The Contractor will capture all testing results via the Team Foundation Server (TFS) tracking
system. The TFS allows all stakeholders to monitor and track test progress and success/failure.
Management reporting will be available to easily visualize KPIs, trends and overall project testing
activity. Complete traceability from the requirement to the development and eventual test result is
available real-time electronically.
The Contractor shall provide comprehensive Documented System Test Results for each test event
identified for State review and approval. The Contractor shall provide Documented System Test
Results that include all of the test activities identified above, with the following components for
each test event:i. Test Coverage Matrix for each Test Phase identified above (excluding Unit and
Integration Testing).ii. Completed Systems Requirements vs. Functionality Tested Matrix for each phase and
for the Final System DeliverY.iii. Defect Reports.iv. Monthly Test Issues and Mitigation Reports.
v. Test Phase Final Results Report and Corrective Action(s) Plan.
ContractortsResponsibilities
o System results documento Reporting (defects and corrective actions)o Performance based on SLAs
Stateos Responsibilities Review and participate.
Location N/A
Task 5 - TrainineTask 5A - Training Plan
The Contractor's system Training Plan shall include a comprehensive approach to delivering the
most effective modality of training for each type of identified User. The use of multiple types ofmedia (written, video) and delivery (classroom, webinars) will be outlined including topic
boverage and schedule.
The Care Management training must provide the following benefits to the State:
i. Build adoption of person-centered service delivery to support the objectives ofVermont's 'Agency of One' vision.
ii. Increase collaboration and coordination among programs through use of the Care
P.q.cr 95 or 268CoNrnacr #28739
AvrnNoryrnNT # 2
sr,q.rr or vnnuoNr, coNrucr FoR pnnsoNu, snnvrcps PAGE 96 or 26gDnpanrunNT oF vrnuoNr Hulrn Accnss coNTRAcr # 2g739EQHnu,rn Sor,urroNsr INc. AvrnNoryrnNr # 2
Management Solution for activities such as service referrals and collaborative casemanagement.
iii. Enable authorized Contractor's System Users to be self-sufficient in the use andextension of the Contractor's System through the various configuration and parameterchange capabilities.
iv. Provide the State the ability to efficiently and effectively assume trainingresponsibilities subsequent to implementation.
The Contractor shall provide a Training Plan that meets the requirements described above and thefollowing components:
i. Overview stating the purpose and scope of the Training Plan that meets therequirements of the Training Curricula.
ii. Detailed description of the training model for adult learners.iii. Flow diagrams and detail for the training curriculum for each functional area and
integration into the end-to-end business process.iv. Specific training curricula targeted and delivered to the different Users in a manner that
meets their specific needs including, but not limited to Care Management Solution Usertraining focusing on hands-on Care Management Solution usage to enable Users toaccomplish their day-to-day activities including performance management throughbusiness analytics and reporting.
v. Training Materials Development Plans.vi. Role of the 'Training Team.'vii. Documentation style standards forthe development oftrainingmaterial (e.g., document
format, refer€nces, acron5rms, font).viii. Plan for review of training material.ix. Approach to prototyping and testing training materials with training recipients.x. Approach to modifying or adjusting training materials based on the results of the
Evaluation of Training.xi. Training Equipment Plans: Contractor shall provide all training facilities and
equipment.xii. Training Methodology and Delivery plans.xiii. Identification of the training mix including, but not limited to: Web-based learning, in-
person learning, learning-labs, and informal learning. Because of the constraints relatedto scheduling staff out of the office for multiple training sessions, Contractor shalldevelop a training mix that leverages use of on-line training tools and self-guidedlearning material that is supported by in-person training.
xiv. Identification ofplan to motivate and engage Care Management Solution Users to leamabout and use the System and complete the training.
xv. The logistical plan for preparing and delivering the training solution.xvi. Training Schedule: Schedule and timeline of training development, delivery, and
evaluation.
Srarn or VnnmoNt, CoNtnacr FoR PnnsoN.c'L SnnvrcnsDEpARTMENT or VnnnnoNr Hn,qlrn AccnssEQHo.urn Sor,urrons, Inc.
ContractortsResponsibilities
a Training approach across all releases
o Modalityo Types of Users
Training schedule, curriculum and agenda pera
release
State's Responsibilities a
a
O
Identify training particip ants
Participate in trainingProvide feedback
Location Contractor's facility, webinar and video
Task 58 - Training Manualg End-User Guides and Materials
The Contractor will develop a comprehensive Training Plan that will include materials such as
manuals, end-User guides uttdl,'id"or. Training manuals will be available in electronic format and
indexed for easy navigation to specific content or functionality. End-User guides will be available
within the Contractork System r,'iu h"lp menus and shortcuts. The video content will be available
from a training web site and will include use case scenario video topics.
The Contractor shall develop training materials in such away as to allow for the capability oftraining to continue beyond initial deployment. This construction includes the ability to modularize
the maierial. All training material shall have a consistent look and feel and shall be provided in a
soft copy format so thai the State may easily make modifications to the materials. A11 training
materials shall be maintained to reflect the latest version of the Care Management Solution and
the changes resulting from evaluations and use during acceptance, pilot testing, and
implementation. All training material shall be maintained in a centralized on-line repository'
The Contractor shall be responsible for developing and providing training materials and for
training State staff on Contraitor's System operations. The Contractor shall employ professional
trainin! staff (not technical staff) to conduct training sessions and to prepare training and User
materials. The State shall have approval over Contractor-provided staffing used for training and
over the format/content of the training to be given. The State and Contractor staff shall work
together to develop the format/content for the training and User materials that the Contractor shall
p.odrr"". These materials shall be provided to the State in both hard and soft copy. The State must
accept these materials before they are distributed to State staff for use.
Training Manuals, Guides, and Materials shall include, but not be limited to:
i. Instructor/Trainer Guides shall provide the ability for State staff to perform the training
on a continuing basis'ii. Trainee Packages shall provide the trainees exercises and usable examples with which
to practice the lessons provided during formal training.
iii. Contractor's System User Manual shall provide Care Management Solution
information. It should be as non-technical as possible and emphasize program
collaboration, and related business functions in the explanation of Care Management
Solution features, specific workflows, functions, modules and tools and the detailed
procedures for using the Care Management System. The Contractor's System User
Manual shall be designed for ease of use so that any User, regardless of his or her
P.lcn 97 or 268CoNrnacr #28739
AvrnNounNT # 2
sr.rrp or vrnryroNr, coNtnacr FoR pnnsoNar, snnvrcrs pacr 9g or 26gDnplnriuaNT oF VnnvroNr Hn.q.LrH Accnss CoNrnacr # Zg73gEQHnar,ru Sor,urrons, INc. AvrnxnvrnNr # 2
function, can readily locate, identify, understand and use the information. The manualshall include a description of the problems and issues that may arise in using the CareManagement Solution and the procedures for resolution. The manual shall includecopies of all screens with instruction on the use and function of each, including thedefinition of all data elements. Contractor's System User Manual shall include a catalogof all reports, forms, letters, and other system-generated documents (generated eitherautomatically by the Contractor's System or by the User). This catalog shall include acopy of each report, form, letter, or document together with a description of its contentsand step-by-step instruction on how to produce it.
iv. Desk Aids shall provide quick access to solutions and information that Users mostfrequently need.
v' User tips, which shall be designed as short messages that can be sent to recent traineeswith reminders about short-cuts, features, and other relevant information to promoteend-User adoption and use of the Care Management Solution.
ContractortsResponsibilities
a
a
o
Training manualsEnd-User scenario videosGeneral materials (Job aides, etc.)
State's Responsibilities Review, comment and approveLocation N/A
Task 5C - Conduct TrainingThe Contractor shall conduct system training for all participants for each release. The Contractorshall provide the training facility. The training will include Contractor's System functionalityand process flows. The training shall be conducted via classroom and webinar as per the State'sproposed training schedule. The training will include live system exercises for participants tonavigate while in training.
Task 5D - Documented Evidence of successful End-user LearningThe documentation of end-User training by the Contractor shall be specific to the type of trainingdelivered. For training delivered via classroom and Webinar a class roster wili be generateJincluding date, time and topics of training. Training conducted via the video website wiil capturethe authorized User name, dateltime and specific videos accessed. Post training User satisfactionsurveys shall be conducted after each training session to understand the effectiveness of thetraining and leverage as a continuous feedback loop to improve training content and delivery.
The Contractor shall provide Documented Evidence of Successful End-User Training at the endof each phase of training. Evidence shall include:
i. Tracking of trainee attendance and completion of training courses and modules.ii. Actions addressing any deficiencies in the proficiency of the current cohort of trainees
based on the results of the evaluation of training effectiveness.iii. An action plan to adjust or modify future training based on the evaluation outcomes.
Location Contractor' s hosting environment
Sr,trn or Vnnuoxt, CoNtnacr FoR PnnsoN,q.L SnnvtcnsDrpanrunNT oF' Vnnuonr Hnl'LrH AccnssEQHn^Llrn Sor,urroNs, INc.
ContractortsResponsibilities
o Training logso Training improvement action plan. conducttrainingsatisf@
State's Responsibilities Participate in training satisfaction surveys and
feedback
Location N/A
TASK 6 _ enlovmentTask 64 - Deployment Plan
The Contractor shall develop a Deployment Plan that defines all tasks required to release changes
to each Contractor's System environment. Each plan includes the manual and automated steps and
required tools or scripts to "roll out" a specific change set. In addition, each deployment plan
includes a ooroll back" plan to entirely reverse any deployment that was unsuccessful. An
Implementation Plan wiil also be created for each major release focusing on just the tasks
associated with the release scope. Post-implementation performance monitoring will be conducted
to determine if each implementation is successful.
The Contractor shall produce a detailed plan for deployment of the planned functionality for each
release. Moreover, the Contractor shall provide a Deployment Plan that documents all the activities
that need to be accomplished to successfully migrate the Care Management Solution from the
testing environment tolhe production environment. The Plan shall provide a detailed schedule ofactiviiies with key "go" l"no-go" decision points identified throughout the deployrnent process.
In addition, the pian-shall detail a back out and recovery process to be triggered in the event the
tumover to production fails.
ContractortsResponsibilities
a
a
a
a
Deployment schedule
Deployment environment and configurationRelease notes
Rollback plan
State's Responsibilities a Verify, validate and si ff post
Location Target environment. Developmento Testo UATo Productiono Disaster
Task 68 - System Incident and Defect Resolution Report
The Contractor will develop System Incident and Defect Resolution Reports that will be readily
available to Authorized Users electronically real-time from the tracking systems. The Contractor
will provide reports to the State that are designed to meet all requirements. The State will review
and comment on the layout and content of these reports, or the Contractor will propose, and the
State Auth oized Representative(s) will approve, the layout and content of these reports to meet
all requirements.
P.lcn 99 or 268CoNrru.cr #28739
AunNoiunNT#2
srarn op vrnuoNr, coNrru.cr FoR pnnsoNn, snnvrcns plcn 100 or 26gDnpanrvrnNT oF VBRruoNr Hnnr,rn AccEss CoNrnAcr # 2g73gEQHnn rn Sor,urroNsr INc. Aunirlovrni,qr # 2
The Contractor shall document all incidents and defects that occur during System Deployment thatare part of the Contractor's System scope and communicate with the Care Management ProjectManager within a reasonable, agreed upon time frame, on a regular basis. The System IncidentReport must contain the priority of the incident, a description of the incident, incident resolutionstatus, and the proposed course of action for remedying all open incidents.
All defect resolution requests that are part of the Contractor's System scope that occur during theWarranty period must be documented and communicated with the Care Management projectManager within a reasonable, agreed upon time frame, on a regular basis. The Defect ResolutionReport must contain the description of the maintenance request, resolution status, and the proposedcourse of action for remedying all open defect resolution requests.
All changes and fixes will be implemented based on amutually agreed upon schedule. All changeswill go through all phases of testing by the Contractor and the State Project Team. The Contractorshall document the test results and provide to the State for approval before a decision is made toput the new release into production. The Contractor shall update all required Contractor's Systemdocumentation as appropriate and provide to the State at the conclusion of any Contractor's Systemchanges.
ContractortsResponsibilities
a
o
Report content and designCapture appropriate data to support report content
o Defects, resolution, timeframesState's Responsibilities Verify and validateLocation N/A
Task 6C - Completed Detailed Functional and Technical Specffications Traceability MatrixThe Contractor will author and maintain a cross-tabular document listing all individualContractor's System requirements with columns representing the functional and technicalspecifications completeness as well as an identity cross reference to the Test Matrix. An electronicreport will also be developed for real-time access with links to each associated specificationdocument for viewing. This will also be available via reporting from the TFS system previouslydescribed in Task 4C.
After completion of each release and upon final Contractor's System delivery, the Contractor shallassemble, update, and provide an updated Complete System Design, Requirements, andSpecifications document to the Care Management Project. The document components shallinclude:
i. Updated Functional Requirements with disposition in the Functional Specifications andDesign Document (see Task 2A).
ii. Updated Technical Specifications with disposition in the Technical Design Document(see Task 2D).
Srarn or VnnuoNt, CoNtm,cr FoR PnnsoNa,r, SnnvtcrsDnp.q,ntNIrNT oF VnnvloNr llrar,tu AccnssEQHnu,nr Sor,urIons, INc.
ContractortsResponsibilities
a Updated Functional Requirements with each
release
Updated Technical Specifications with each
release
a
State's Responsibilities N/A
Location N/A
Task 6D - System Source Code and Documentation
The Contractor's Team Foundation Server (TFS) system used to manage all aspects of the
Contractor's System development process includes web-based source code and documentation
repositorier. Ctr. Contractor's System source code repository provides historical versioning,
branching and merge capabilities. The document repository can be accessed from the web and has
check irVout, approval and versioning capabilities as well. The Contractor will work with the State
to determine the personnel that require authoizatron to access either repository.
At the completion of the Project, the Contractor shall conduct a review with the State and identifu
any doc.rmentation that must be updated as a result of changes during the three-year warranty
period. The three-year waranty period starts after the full scope of the Project is released into
production. The Contractor will be required to update the documentation and provide it to the State
for review and Final Acceptance.
The following shall be updated and provided to the State's Project Manager at the completion ofthe Project:
i. Functional Specifications and Design Documentationii. System Architectureiii. TechnicalDesignDoc-umentationiv. Data Management and Synchronization Plan
v. Test Cases and Test ScriPts
vi. Training Manuals, End-User Guides, and Materials
vii. Final versions of the Contractor's System software files
The Contractor shall also transfer allfinalizedrequired documentation to the State. The format and
the medium of transfer will be at the discretion of the State.
Contractor'sResponsibilities
Update all artifacts associated with Care Management system
throughout project:Functional specifi cation and design
System architectureTechnical design documentation
Data. management and synchronization plan
Test cases and test scriPts
Training manual, User guides and materials
Final versions of the system software files (code)
State's Responsibilities N/ALocation Contractor' s hosting environment and offsite replication location
PAGE 101 or 268
CoNrru,cr #28739AvrnnounNT # 2
srarn or vnnuonr, CoNrucr FoR pnnsoNar, srnvrcns plcn 102 or 26gDnpanrvmNT oF vnnl{oNr Hnru,rs Accnss coNrnrcr # 2g739EQHnllrn Sor,urroNso Inc. AvrnnnvrnNr # 2
Task 6E - Deployment
The Contractor will deploy all the functionality associated with each release to the productionenvironment for live usage. Additionally, prior to the deployment of the production environmentthe Contractor's System shall be deployed in stage, test, and training environments for purposesof testing of contractor's system functionality and training of the users.
Task 6F - Performance SLAsThe performance SLAs will be captured via the Contractor's application monitoring tool, networkmonitoring tool and Care Management relational database. An SLA deliverable report will bedeveloped to aggregate and communicate all SLAs at the required State frequency throughout theproject. The sLAs are included in Section I, subsection 2 of this contract.
The Contractor shall provide ongoing compliance monitoring and reporting for the Service Levels(Performance Measures and Associated Remedies) above and included in dltail in Non-FunctionalRequirements.
ContractortsResponsibilities
a Track/capture all appropriate data elements toproduce each SLACompliance monitoringa
a VE to ensure SLAState's Responsibilities ReviewLocation N/A
TRANSITION TO OPERATIONSTASK 7 - Phase and Proiect Closeout. Svstem Acceptance" Maintenance and OperationsProceduresTask 7A - Readiness Approval
The State and Contractor will jointly develop readiness criteria for Go-Live for each majorsoftware release. Criteria will be jointly monitored and a Go-Live decision will be made *h"ncriteria are successfully met, as determined by the State.
Task 7B-Complete Phase Closeout
The Phase Closeout shall be facilitated by the Contractor with a comprehensive template. Thetemplate includes scope review, financial analysis, documentation, lessons learned andadministrative closure or sign-off as well as turnover to operations where applicable.
The purpose of the Phase Closeout task is to identify the conclusion of a Project Lifecycle phaseand Closeout and gather the required approver signatures. This document will signify that allrequired deliverables for the Project Phase being closed have been completed and approved withthe date of approval for each deliverable indicated. The document shall also list Exit Criteria andthe status of each for the Project Phase and Closeout. The Contractor shall provide documentationto support Phase Closeout to include the elements described above and the following components:
i. State validation that all deliverables for the Phase have been provided, accepted, andplaced in the Project repository.
Sr.q.rn or VBnuoNt, CoNtru.cr FoR PBnsoN.q,r, SnnvrcnsDnpLRtvruNT oF VnnuoNr Hp,llrn AccrssEQHnal,rn SolurroNs, INc.
ii. State validation that all Exit Criteria for the Phase have been met.
Pacn 103 or 268
CoNrnq.cr #28739AmnNuunNr # 2
ContractortsResponsibilities
o Prepare release closeout report to include release
functionality, User acceptance testing results,
requirements traceability and training completionrecords, and Data Dictionary.Release acceptance criteriao
a Transition to (production) plan
State's Responsibilities Validation and acceptance
Location N/A
Tssk 7C - Document Compendium Gap AnalysisThe Contractor will inventory all deliverables and artifacts and identify gaps in alignment with
CMS certification and MECT requirements and with current processes and practices. The gap
analysis will prioritize non-recurring deliverables. The goal is to ensure final documentation is
representative of the final solution produced and deployed, and reflects the processes used to
dwelop the deployed product. The Contractor will provide a summary of all needed updates for
all relevant artifacts. The State will review and approve the gap analysis findings and action
plans, and when acceptable, will approve through a Deliverable Acceptance Document (DAD).
Stutr upproval of Task 7C enables the Contractor to implement gap closure action plans to
complete Task 7D.
An approved Deliverables Expectation Document (DED), created by the Contractor and
approved by the State, is required in advance of completing this deliverable.
Task 7D - Document Compendium Upd'ates
The Contractor is responsible for monitoring and updating all artifacts associated with the care
management system throughout the project. Final documentation should be representative of the
final solution and current processes and practices at the conclusion of DDI that were used to
develop and deploy the product. Only items impacted during M&O, such as the Requirements
Tracea^bility tvtatrix (RTM) tool (Deliverable 6C), change requests, administrative and operations
manuals, etc., will be updated during M&O. Upon State approval of Task 7C-Document
Compendium Gap Analysis, the Contractor will implement the approved action plans to
.o*pl"t" revisions and updates to the documents identified in the Gap Analysis and approved by
the State. The Contractor will update the deliverables as approved by the State, update the
deliverables archive, and update the A100 artifact "Document Registry" to reflect any changes'
The final set of deliverables and artifact documentation reflecting the final product provided to
the State will be a Project Closeout exit criterion.
An approved DED, created by the Contractor and approved by the State, is required in advance
of completing this deliverable.
Task 7E - Maintenance and Operations Guid'e
The Contractor will develop and deliver a written comprehensive Maintenance and Operations
(M&O) Guide, which will include how the transition from Design, Development, and
implementation (DDI) to Maintenance and Operations (M&O) will occur and how activities will
Sr,lru or Vnnuoxr, Coxrucr FoR prRsoN.q.L SunvrcnsDnplnrnrnNT oF' VnnvroNr Hnaltu AccnssEQHralru Sor,urroNs, INc.
occur during M&O. The Guide will include the composition, roles and responsibilities of theContractor's M&O team related to all activities and processes that will be performed duringM&O. The Guide must enable State persoinnel to understand the processes and procedures forM&O activities, including but not limited to defect reporting and resolution, systemenhancements, change control processes, testing, End User training and support services, reportgeneration and special analyses, system incident reporting, cadence for system maintenance-andupdates, transition of base product enhancements to the Vermont system, SLR reporting andprocess improvements, and all other key support activities of the caremanagement solution inthe production environment. This will be a living document and will be updated regularly in acadence described in the Guide and approved by the State.
An approved DED, created by the Contractor and approved by the State, is required in advance ofcompleting this deliverable.
Task 7F -System Acceptance/Project Closeout
System Acceptance/Project Closeout is the final deliverable for the Design, Development andImplementation (DDI) phase of the project. It identifies the conclusion of DDI and signifies thatthe entire system and supporting operations and activities are ready to move into the Maintenanceand Operations phase. System Acceptance/Project Closeout shall be facilitated by the Contractorwith a comprehensive template. .The template includes scope review, financial analysis,documentation, lessons learned and administrative closure or sign-off as well as turnover tooperations. The Contractor will, in concert with the State, manage system stabilization activities,monitor ST.Rs, create and maintain an issue log, and work to achieve systems acceptance utilizingpredetermined criteria
The Contractor will create a State-approved System Acceptance Checklist and Exit Criteria andprovide evidence that all criteria are met, including completion of the following tasks:
i. Jama RTM review and action plan completed to address any gapsii. VCCI eQSuite@ Reports gap analysis and implemented action plan for approved reports.
Approved reports are located at the following links on the SoV and eQHealth Sharepointsites:SoV:
tsll5l 78087D87 A4-1498-4F9C-8C67-
PAGE 104 or 268CoNrnacr #28739
AunNuvrnNT # 2
7I 7D 5
EOH:
20 I 8 0426%20Reportine%20Trackine.xlsxiii. 504/508 Compliance results verifying completion of collaborative assessment,
compliance or approved action plans for addressing any gaps during M&oiv. SoV SLA Security Review results verifying compliancev. SLA Performance Review (most recent Monthly SLA Report)vi. Pilot completed and action plans implemented for transferring Customer Service
responsibilities to the Contractorvii. Document Compendium Gap Analysis and Updates (DADs)viii. Maintenance & Operations (M&O) Guide (DAD)
Srl'rn or VnnuoNt, CoNtru.cr FoR PnnsoN.c'L SnnvrcnsDnpantvrnNT oF VnnvroNr Hrl.LrH AccnssEQHnar,rn Sor,urrons, INc.
ix. VCCI System Administrator Manual (DAD)x. Defect Resolution criteria fulfilled and action plans approved for remaining defects
xi. Certification Deliverable 8A (DAD)xii. Customer Assessment complete and action plans developed and approved
The Contractor will provide evidence that all task deliverables have been updated and approved as
required by the State, transition to operations planning is complete and documented, users
understand Maintenance and Operations procedures and End lJsers, including System
Administrators, have been successfully trained on these procedures so they can execute them
successfully. The Contractor will provide evidence that an agreed upon defect resolution plan and
criteria have been successfully achieved.
In the event there are gaps in fulfilling the requirements on the System Acceptance Checklist and
Exit Criteria, the Contractor will create and implement Action Plans to close gaps. The State willvalidate that all System Acceptance and Exit Criteria on the approved checklist for Project
Closeout have been met before moving to the Maintenance and Operations phase. Waiving any
criteria is at the sole discretion of the State Authoized Representative. At the point at which all
System Acceptance and Closeout Criteria are met and written approval has been provided by the
Siate througlr a Deliverable Acceptance Document (DAD), the Contractor will perform required
maintenanci activities as outlined in this Contract and the Maintenance and Operations Guide, and
the release will be entered into warranty.
ContractortsResponsibilities
a Project clobeout report to include fulfillment of allSystem Acceptance and Exit criteria, and
completion of any Action Plans to address gaps.
State's Responsibilities Validation and acceptance
Location N/A
An approved DED, created by the Contractor and approved by the State, is required in advance
of completing this deliverable.
TASK I - CMS Certification PlannineTffivelopacomprehensiveprojectp1analignedwiththeState'sprojectplanand based on CMS requirements for the Care Management sub-system. All high-level project
planning components (scope, requirements, WBS, schedule, test plan, etc.) are to be developed by
ihe Contractor and approved by the State, as well as requirement artifacts and Contractor's System
documentation. The Contractor will creat'e its Care Management sub-system certification plan for
sub-system review citeria, documentation and certification checklist completion that complies
with the overarching MMIS CMS certification plan.
The Contractor must participate in and support all planning activities associated with Federal
certification of the MMIS Solution. Planning activities will ensure that Vermont's Medicaidportfolio meets all CMS requirements and perfornance standards to qualify for the highest eligible
Federal Financial Participation (FFP) rate retroactive to the first day of complete operation' While
certification application activities will occur post-implementation, the Contractor should start
PAGE 105 or 268CoNrntcr # 28739
AmnNonnnNT # 2
Sr.trn or vnnuoNr, coNrmcr FoR pERsoNAL snnvrcns pacn 106 or 26gDnpanrvruNT oF vnnuonr Hrar,rn Accrss coNrnq.cr # 29739EQHralrn Sor,urroNs,Ixc. AunNnunNr # 2
preparation at the beginning of the project and continue through each step of the design,development, testing and implementation of the care Management Solution.
The Conhactor is responsible for:i. Including plans for CMS Certification as part of the Project Kick-Off.ii. Adhering to CMS Standards and Conditions in all deliverables.iii. Mapping all requirements, gaps, use cases, testing artifacts, workflows,
training documents, change management artifacts, and other applicableartifacts to the corresponding MITA Business Area and Process.
iv. In conjunction with the State Project Team and CMS, determining which ofthe MECT criteria are applicable to the Care Management project andcertification effort.
v. Meeting all MECT criteria applicable to the Care Management solution.vi. Collaborating with the State in developing a tailored CMS Certification
Checklist based on the CMS Certification Toolkit for those processessupported and impacted by the Care Management Solution.
vii. Supporting the State in all discussions with CMS regarding certificationrelated to the Care Management solution.
viii. Developing and executing required and suggested remediation efforts toachieve certification.
ix. Assisting the State in preparing certification documents and reports related tothe Care Management Solution.
x. Participating in the in-person or virtual review(s) with CMS.xi. Responding to CMS post-review.questions and comments.
An approved DED, created by the Contractor and approved by the State, is required for each ofthe CMS certification deliverables described below.
Task 8A -.Care Management Subsystem Certification Planning
The Contractor will provide a comprehensive project plan that is aligned with the State's projectplan and based on CMS Certification requirements for this subsystem. The plan will include allhigh-level project planning components such as scope, milestones, and task dependencies neededto facilitate the activities necessary to obtain CMS certification. The plan will cover ReviewCriteria, Evidence Packages, Testing Scenarios, Certification Readiness Assessment and ChecklistSatisfaction. It will demonstrate a thorough understanding of the State's plan, the certificationprocess, and key points leading to CMS review. This deliverable will include the Certification planwith work activities, and aMicrosoft Project Plan.
Formal acceptance by the State of the strategy and plan documents will trigger the State to producea Deliverable Acceptance Document (DAD) for payment.
Task 88 - CertiJicution Review Criteria and Testing Scenarios
The Contractor will provide Evidence Packages with appropriate descriptions, development Sprintnumbers, deplo5rment release notes, defect resolution, system documentation, reports, testing
Sr,trn or VnnivroNt, Contnl,cr FoR Prnsonar, SnnvrcnsDnp.qnnvrrNT oF VnnmoNr Hn,llrn AccnssEQIIn.tlrn Sor.urIoNs, INc.
scenarios, test cases, testing results, production compliance evidence and screenshots, along with
any other pertinent informition relative to the development, testing and deployment of product
functionaliiy. Requirements traceability will demonstrate upstream and downstream linkages,
including mapping to the RFP and through all fully executed change requests.
Successful submission to the CMS repository of all formally approved Evidence Packages willtrigger the State to produce a Deliverable Acceptance Document (DAD) for payment.
Task 8C - CertiJication Readiness Assessment
The Contractor will provide a Certification Readiness Assessment with evidence to demonstrate
that testing scenarios, test cases, testing results, production compliance evidence, information
relative to the development, testing and deployment of product functionality, requirements
traceability and any other review criteria have been satisfied as determined by the State.
Formal approval of the Certification Readiness Assessment results will trigger the State to produce
a Deliveiable Acceptance Document (DAD) for payment'
Task 8D - CMS Cerffication Review and Acceptance
The Contractor is responsible for preparing all documentation and operational examples to
demonstrate relevant criteria are met and Care Management Solution operations address all
business functions, performance standards and business model expectations for certification' The
Contractor will participate in preparation and planning sessions prior to the certification review
and will participate during the virtual or in-person review with CMS. The Contractor will help the
state with mitigation of questions and findings CMS delivers to the State after the review, until all
outstanding questions and action items are resolved to CMS' satisfaction.
Receiptbythe State of aLetterof Certification from CMS will triggerthe State to produce a
Deliverables Acceptance Document (DAD) for payment.
ContractortsResponsibilities
o Develop CMS certification checklist for care
management sub-sYstem. Support State discussions with CMS regarding
certificationo Prepare all required documentation for care
management sub-system certificationo Participate in certification reviewso Assist with mitigation of post-review questions
and findings from CMS
State's Responsibilities Provide resources to adequately test certificationscenanosReview and deliverables
o
a
Location Certification environment
PAGE 107 or 268
CoNrnacr #28739AvrnNovrnNT # 2
Surn or VnnvroNro CoNrucr roR pnnsoNu, SnnvrcnsDnpaRrvrnNT oF VnnvroNr Hnalrn AccnssEQHnu,rn Sor,urloNs, INc.
Pacn 108 or 268CoNrRAcr #28739
AunNovrnNr # 2
TASK9-SvstemM&OTask 9A - System Incident Reports - M&OThe Contractor will deliver System Incident Reports throughout the project. This will beaccomplished via the ITIL compliant web-based Service Desk module which includescomprehensive incident management capabilities with flexible reporting. Incident reportingincludes high level dashboards as well as parametenzedreports at a granular level. Ad-ho" qrrcryfunctionality is available to authorized Users to answer specific questions related to incidents.
The Contractor must complete the following services. (The Contractor may propose additionaldeliverables as needed to achieve the task goals of System Maintenance and Operations):
System Incident Resolution - Maintenance and Operations of the Contractor's System includessoftware faults that are not a part of the scope of the original development effort. All incidents thatoccur as part of ongoing operations must be addressed and resolved within a reasonable time frameas per the SLAs.
Adaptive Maintenance - All changes and fixes will be implemented based on a mutually agreedupon schedule. All changes will go through all phases of testing by the Contractor and the Stat".The test results must be documented and provided to the State foi approval before a decision ismade to put the new release into Production. All relevant Contractor's System documentation willbe updated and provided to the State at the conclusion of any Contractor's System changes.
System Enhancements - If the State determines that Contractor's System enhancements arerequired, it will submit a request for those modifications to the Contractor. The Contractor willanalyze the changes and provide a cost estimate for performing those changes to the CareManagement Solution. These cost estimates will be negotiated based on rates proposed and agreedto. The State can then decide whether it wishes to move forward with the requested enhancernents,which will be incorporated as a change order to the Contract. All incidents that occur during theBase and Optional Extension M&O periods.must be documented and communicated with the Statewithin a reasonable, agreed upon timeframe, on a regular basis. The Contractor's System IncidentReport must contain the severity of the incident, a description of the incident, incident resolutionstatus, and the proposed course of action for remedying all open incidents.
ContractortsResponsibilities
a Prepare ongoing Contractor's System incidentreportsIncident resolution statuso
State's Responsibilities Review and commentLocation N/A
Task 98 - Adaptive Maintenance Reports
The Contractor will deliver Adaptive Maintenance Reports throughout the project. The ChangeManagement Tracking system includes verbose reporting for all types of Contractor's Systernchanges including those associated with previously deployed requirements and functionality. Each
Srarn or VsnvroNt, CoNtnacr FoR PBnsoN,q,L SnnvrcnsDap.qnrvrnNT oF VnnuoNr llnal,rn AccnssEQHnalur SolurroNs, Ixc.
item includes a detailed description of the "As Is" and "To Be" adaptive change. A real-time
parameterized report can be executed to view the details of each change.
All adaptive maintenance requests that occur during the M&O period must be documented and
communicated with the State within a reasonable, agreed upon timeframe, on a regular basis. The
Adaptive Maintenance Report must contain the description of the maintenance request, resolution
status, and the proposed course of action for remedying all open maintenance requests'
Contractor'sResponsibilities
a
a
Prepare Adaptive Maintenance Reports
Adaptive maintenance status
Stateos Responsibilities Review and comment
Location N/A
Task 9C - System Enhancement Reports
The Contractor will deliver System Enhancement Reports throughout the project. Contractor's
System Enhancements are managed by the change management tracking system as previously
described. The same data capture and reporting capabilities are available for changes specific to
the "Enhancement" change type. Detail descriptions of the Contractor's System enhancement willbe provided in the associated release notes. Corresponding training materials will be updated to
reflect changes.
A1l Contractor's System enhancement requests (changes requiring 200 or more hours of effort)
that occur during the M&O period must be documented and communicated with the State within
a reasonable, agreed upon timeframe, on a regular basis. The System Enhancement Report must
contain the des-ription of the enhancement request, progress, and the test results and outcome ofeach request.
ContractortsResponsibiHties
a
a
Prepare System Enhancement Reports
System enhancement status
State's Responsibilities Review and comment
Location N/A
Task 9D - VCCI System Administratot ManualThe Contractor is responsible for developing a VCCI System Administrator Manual that provides
documentation for Stut" rrrp"*isory and administrator positions to execute technical and
administrative features of the care management solution in support of End Users and daily
operations. The Manual will include detailed step-by-step instructions on how to perform tasks to
keep the system running effectively. The Manual will include but not be limited to the following
major components:
i. Administrator Menu, containing multiple sections, including Managing Reports, Adding
Providers, Changing Passwords, Managing Plans of Care, Survey Configuration, etc'
ii. Configuration Settings, including Dictionary, Dropdown Lists, Filtering Dropdown Lists'
other Configuration Settings, Case Manager Assignment, and Documents
iii. User Activity RePorts
Pacn 109 or 268CoNrnacr #28739
AvrnNovrnNT # 2
St.trn or Vnnuont, Conrnncr FoR pnnsonar, SnnvrcnsDrplRrvruNT oF VnnuoNr Hnar,rn AccnssEQHrar,rn Solurrons, INc.
iv. User Requests from Outside Agenciesv. Ticket Managementvi. Schedule of Data Loads and Analyses, such as ACG, eligibility, claims, etc.
This will be a living document and will be updated regularly in a cadence described in theManual and approved by the State.
An approved DED, created by the Contractor and approved by the State, is required in advanceof completing this deliverable.
Task 9E - Tier 2 Service Desk Plan
The Contractor's Tier 2 Service Desk Plan will describe the required Contractor's Systems,processes and procedures necessary to effectively support all stakeholders and Users of the CareManagement System. The plan will detail the "hand-off'or escalation from the Tier 1 team andthe policies and procedures by which each ticket is processed. This includes hours of operation,severity level turnaround timeframes, and communication mechanisms and reporting.
The Contractor is responsible for developing a Tier 2 Service Desk Plan that indicates how supportwill be provided and how escalated incidents are resolved. The Service Desk shall use ITii v3compliant Incident and Problem Management processes. The plan must include a proposedorganizational structure, service level commitments related to the resolution of logged incidents(based on issue priority or severity), and metric reporting for monitoring the Contractor's Systemand Service Deskperfonnance. The Service Desk shall use an ITIL v3 compliant COTS IT ServiceDesk solution and shall electronically interface with the Contractor's defect and qualitymanagement tools.
ContractortsResponsibilities
Contractor's System support structure andorganizationProcesses and policiesSupport tools (ticketing, voice mail etc.)Hours of operationCommunication and escalation
State's Responsibilities ReviewLocation N/A
L. TASK RELATED DELIVERABLES: PROJECT TIMELINETask Deliverable 1-C, Project Work Plan and Schedule, and the updated Project Schedulerepresent the approved schedule of record for tracking progress against completing andapproving all contract deliverables. Deliverables are considered approved when the State issuesa Deliverables Acceptance Document (DAD) signed by the State's authorized representative.
Deliverable 6-D, System Source Code and Documentation, for each release will be due uponreceipt of payment by Contractor for approved task DeliverableT-B,Phase Closeout and,7-FProject Closeout/System Acceptance.
P.q.cn 110 or 268CoNrRr,cr #28739
AvrnnnmnNT # 2
Surn or VnnvroNt, CoNtnacr FoR PnnsoN,q,L SnnvlcnsDrpantnnnNT oF VsRMoNr Hnllilr AccsssEQHnllur Sor,urronso INc.
Pacn 111 or 268
CoNrnacr #28739AurnNounnr # 2
Updated code will be delivqed to the State quarterly after Contractor receives the M&Opayments for the quarter.
M. CONTRACTOR PROJECT ORGANIZATION & STAFFING1. Staffing PIanThe following staffing plan details the Contractor personnel, level, roles and responsibilities, and
team reporting relationships and identifies the approach to providing "shoulder-to-shoulder" team
reporting relaiionships for key staff roles. This plan shows Contractor's personnel hours by phase,
by personnel level and by role for the entire project.
a. The term "Key Project Personnef', for purposes of this Contract, means Contractor personnel
deemed by the 3tut" u. being both instrumental and essential to the Contractor's satisfactory
performance of all requirements contained in this Contract. The Key Project Personnel shall be
engaged throughout both the implementation and operations periods. Changes to the positions and
responsibilities shall only be allowed with prior written permission from the State. Certain Key
Project Personnel, as further described in the Staffing Tables, are to be full-time and dedicated
solely to the Vermont Care Management account.
b. Location of Contracted Functions and Personnel
i. During the maintenance and operations (M&O) period, the Contractor's Key Project
Personnel and Subject Matter Experts will participate via telephone in Care Management-
related meetings as scheduled by the State. Additionally, during the first six months after
System Acceptance, Contractor Key Project Personnel andlor Subject Matter Experts as
r"qnested by the State will visit the Vermont State offices once each month for project
oversight and status reporting, transition and implementation of the M&O Plan, CMS
Certification preparedness and review, requirements gathering for Change Requests and
system enhancements, and training on such things as report design, system enhancements,
and functionality that introduces changes to User's workflow. Monthly onsite visits willnot be fewer than two fu|| business days and more than five full business days, determined
by an agendaand schedule developed collaboratively by the Contractor and the State.
In addition to the Contractor's Certification Lead, Contractor Key Project Personnel willbe onsite for the following certification activities:
a. Planning for the CMS Certification Review session, including preparing
content and identifying presenters;
b. Participating in practice sessions for the CMS Certification Review session;
c. Participating in the CMS Certification Review session.
After the first six months post-System Acceptance and provided M&O is operating
effectively and in accordance with the approved M&O Plan, monthly Project Status
meetings may occur via telephone and onsite visits may be reduced to once each quarter.
The Project Status Report will be distributed a minimum of 48 hours in advance of the
monthly meeting scheduled by the Contractor. Onsite visits will continue throughout the
contract term as needed for determining requirements for Change Requests and new
functionality, and to provide training for major deplo5rments.
sr.ArE oF vnnuoNr, coNrucr FoR pERsoNAL Snnvlcns PAGE ll2 op 26gDrp.c,RrNrnNT oF vnnuoxr Hnalrn Accrss coNrnlcr # 29739EQHnllrn Sor,urroNsr lllc. AprnNnvruNr # 2
ii. The State and the Contractor shall establish appropriate protocols to ensure that physicalproperty/facility security and data confidentiality safeguards are maintained.
iii. The Contractor must ensure Key Project Personnel have, and maintain, relevant currentlicense(s) andl or certifi cation(s).
iv. The Contractor shall seek and receive State approval before hiring or replacing any KeyProject Personnel and all Vermont-based staff. The Contractor shall remove Key ProjectPersonnel, if requested by the State, as well as develop a plan for the replacement of thatKey Project Personnel, all within two (2) weeks of the request for removal.
v. The Contractor must provide the State with written notification of anticipated vacancies ofKey Project Personnel within two business days of receiving the individual's resignationnotice, the Contractor's notice to terminate an individual, or the position otherwisebecoming vacant. Replacements for Key Project Personnel shall have qualifications thatmeet or exceed those specified in this Contract and shall be subject to approval by the State.The Contractor shall provide the State with status update reports every 30 days on theprogress of the replacement candidate recruiting process until a qualified candidate is hired.The Contractor shall have in place a qualified replacement within ninety (90) calendar daysof the last day of employment of the departing Key Project Personnel. Contractor shallagree to provide the first thirty (30) days of a replacement resource with equivalent skill atno additional charge.
vi. The State's right to request replacement of Contractor personnel hereunder relates solelyto the removal of individuals from work on this Contract with the State and does not createany employrnent or principal-agent relationship. Nothing in this Contract authorizes theState to direct the Contractor's termination of, or other adverse action related to, theemplo5rment of any individual.
2. Key Project PersonnelThe following table provides Contractor Key Project Personnel positions, corresponding roles andresponsibilities for the project, and minimum qualifications for each.
a. Roles and Responsibilities of contractor Key Project? personnel
Sr. Account Executive
Primarypoint of contact with the State's contract administrator, caremanagement director and other State executive sponsors for activitiesrelated to contract administration, overall project management andscheduling, coffespondence between the State and the Contractor,dispute resolution, and status reporting to the state for the duration ofthe contractAuthorized to commit the resources of the Contractor in matterspertaining to the implementation perfofinance of the contract.Responsible for ensuring all contractor-required resources identifi edby project manager are staffed on time. Responsible for addressingany issues that cannot be resolved with the Contractor's projectManager. Senior business expert in the area of care managementsystems with a strong understanding of the Contractor's businessapplicationIs expected to work 30Yo on site with State staff during the DDI Phase.
Roles and ResTitle
Sr.c.rr onVnnvroNt, Coxtnacr FoR PnRsoNal SnRvrcnsDnp,qnrvrnNT oF VnnvroNr Hnl.LrH AccnssEQHn,q.Lrn Sor-urroNs, INc.
Pacn 113 or 268
CoNrnlcr # 28739AvrnNnvrnNr # 2
Account Director
Responsible for the Engagement working with both State Leadership,
steering committees and Contractor & Subcontractor teams. Closelywork with Sr. Account Executive to ensure all the proglam operations
are being conducted as per the vision. Work with State team to
facilitate the escalation issues. Responsible for oversight of the Care
Management Project team. Responsible for all business aspects of the
reporting. To ensure all the program are being met on-time and on
budget. Expected to work 25Yo of the time onsite with State staffduring the DDI Phase. Twenty-five percent onsite commitment willconsist of an average of 4.5 business days per calendar month. The
scheduling of these days will be submitted and agreed upon by Project
Management no later than the 23rd day of the preceding month.
Project Manager
Providing onsite management of the project and is the chief liaison forthe State for design, development, and implementation project
activities as well as the project's maintenance and operational phase.
Authorized to make day-to-day project decisions. Responsible forfacilitating the project by using the project management processes,
or ganizing the proj ect, and
managing the team work activitiesconsistent with the approved workplan. Responsible for scheduling and reporting project activities,identifying resource requirements well in advance, coordinating use ofpersonnel resources, identifying issues and solving problems, and
facilitating implementation of the Contractor's System. Hostingweekly onsite status meetings, monthly milestone meetings, as well as
interim meetings. Will assign Contractor staff to those meetings as
appropriate. Will provide an agenda and develop minutes for each
meeting. Providing expert guidance ensuring that care management
policy and business rules as defined by the State are correctlyimplemented in the Contractor's solution. Advising the State regarding
best practices and recommends modifications to business processes,
which improve the overall care management program. Is expected to
work 100% on site with State staff during the DDI Phase' Must hold
current certification.
Data lHealthInformaticsAnalyst
Responsible for all State data requirements and reporting needs
including those that exceed the standard reporting package and the
information available through the decision support tool provided bythe Contractor. Providing ad hoc reporting, predictive modeling and
risk stratification reporting as requested by AHS staff and otherprogram staffs (once on-boarded). Management of procedures
associated with Contractor's Systems change orders Ensuring the
integrity of data used for care management predictive modeling, riskstratification, etc. Is expected to work 25Yo on site with State staff
Srarr or VnnuoNt, Coilrucr FoR pERsoNAL SnRvrcrsDnp.rRrunNT or VnnuoNr Hrar,rn AccnssEQHnl.I,rn Sor,urroNso Inc.
P.lcn 114 or 268CoNrnncr #28739
AvrnnrvrnNr # 2
during the DDI Phase. Twenty-five percent onsite commitments willconsist of an average of 4.5 business days per calendar month. Thescheduling of these days will be submitted and agreed upon by ProjectManagement no later than the 23rd day of the preceding month.
Account Manager
Responsible for business aspects of the project to ensure the overallproject goals are being met and that the Project Team has all thenecessary resources in terms of skill sets, knowledge and all itemsrelated to scope. Is expected to work l0o/o on site with State staffduring the DDI Phase.
Clinical ProgramAnalyst
A clinician who is responsible for clinical workflow design andbusiness rules based on theVermont Care Management program. Subject matter expert providingknowledgebase of the current product to the team and the necessarydesign and configurations changes required for customizing to AHSneeds. Is expected to work 60Yowith State staff durine DDI Phase.
Staff Contingency PlanThe Contractor shall:
a. Maintain a Contingency Plan that shows the ability and process to add more staff ifneeded to ensure the project's deliverables are met on the due date(s) and go-live dates.
b. Provide a plan to monitor the project, and how a determination to deploy contingencystaffing will be made.
3. Staff ManagementThe Contractor shall:
a. Have internal standards, policies, and procedures regarding hiring, professionaldevelopment and human resource management.
b. Ensure a continuous and steady influx of skilled and qualified resources to projectteams at all times.
c. Have a Human Resource Management Plan in place tied to the proposed projecttimeline and phases. The Contractor is responsible for proposing the potential roles andresponsibilities for staffing the different activities, articulating what the Contractor will
. need to provide and what the State should provide.
4. Training Policies and ProceduresThe Contractor shall ensure the training and ongoing education of its personnel. The Contractorshall ensure that all Subcontractor's staff receive training on and have an in-depth understandingof eQSuiteobefore Subcontractor's staff begins its engagement on the project. ForSubcontractor's staff thatthat will be on the project at its inception, this training shall becompleted prior to Task 1A Project Kickoff Presentation, and shall include, but not be limited tothe following:
Sr,q.rn or VnnuoNt, CoNtru,cr roR PnnsoNar, SnnvrcnsDnpantunNT oF VnruioNr Hnnr,rn AccnssEQHn,l,r,rn Sor,uuoNs, INc.
Pacn 115 oF 268CoNrru,cr # 28739
AvrpNrnanNr # 2
Two weeks
General introduction to the assignment:
Case management for VermontContract requirements by functionalateaWork plan and phasingProgram organizationTeam building exercises
Hands on training on the major care
management workflows from theperspectives of a case worker,manager,and system administrator, including:Creating a case for various scenarios
Case managementReporting and analyticsSystem administration and
customization
ProgramManagerProjectManagerChangeManagementLeadHealthInformationAnalystTraining/OCMLead
AssignmentMobilization,Application UseCases, andProcess Flows
One WeekDatabaseAdministrators
Administration of the eQSuite@
databases:Logical and physical architecture of the
system as configured in development,test, staging, and productionenvironmentsDatabase entity relationship diagramsand data flowsUse of third party tools, especially
Extract, Transform, and Load (ETL)Routines for backup and restore
Periodic maintenance tasks (run book)
DatabaseAdministration
One Week
Hands on training on the major Care
Management workflows from theperspectives of a case worker, manager,
and system administrator, including:Creating a case for various scenarios
Case managementReporting and analyticsSystem administration and
customization
IT BusinessAnalystIT BusinessAnalyst(Consulting)ClinicalBusinessAnalystClinicalBusinessAnalyst(Consulting)
Application UseCases forBusinessAnalysts
KNOWLEDGETRANSFER
TYPE
CONTENTWill include, but is not limited to:
AUDIENCETo include,
but not limitedto:
DURATION
Sr.lrn or Vnnvroxt, Coxtucr FoR PnnsoNn SnnvrcBsDnpmtvrpNT oF VnRvroNr Hn.ql,rn AccnssEQHrar,ru Sor,urroNs, INc.
PAGE 116 or 268CoNrnq,cr #28739
AvrnNuvrnNr # 2
TechnicalWriter
Application UseCases forQualityAssurance andTraining
QA AnalystsTrainers
Hands on Hands on training on the majorCare Management workflows from theperspectives of a case worker, manager,and system administrator, including:Creating a case for various scenariosCase managementReporting and analyticsSystem administration and
customization
One Week
5. Contractoros Use of Vermont StaffThe Contractor's staffing plan shall include the number of resources (both business andtechnical), anticipated role and responsibilities, level of participation (e.g., part time, full time)and necessary capabilities/ skills ofState Staff.
N. WORK PLANThe Contractor shall submit the project work plan (i.e., Project Schedule) deliverable for Stateapproval within thirty (30) days of project initiation.
O. REOUEST FOR APPROVAL TO SUBCONTRACTPer Attachment C, Section 19, if the Contractor chooses to subcontract work under this agreement,the Contractor must first fiIl out and submit the Request for Approval to Subcontract FormAttachment H (Required Forms) in order to seek approval from the State prior to signing anagreement with any third party. Upon receipt of the Request for Approval to Contract form, theState shall review and respond to the request within five (5) business days. Under no circumstanceshall the Contractor enter into a sub-agreement without prior authoization from the State. TheContractor shall submit the Request for Approval to Contract form to the State AuthoizedRepresentative(s) and to : AHS.DVHAGrantsContracts@vermont. gov
Should the status of any third party or Subcontractor change, the Contractor is responsible forupdating the State within fourteen (14) days of said change. For the avoidance of doubt, theContractor shall remain liable for the satisfactory performance of all work required under thisContract. Additionally, a prior written approval under this section will not constitute anamendment to the Contract unless it changes the general terms and conditions or the terms ofpayment in the base Contract.
Srarn orVBnvroNt, CoNtru,cr FoR PnRsoNu- SnnvrcnsDnp.qnrNInNT oF VBnuoNr Hnar,rn AccnssEQHnn rn Sor.uuoNs, INC.
APPENDIX I - Functional Requirements
Pacn ll7 os268Conrn,lcr # 28739
AunNrnnnNr # 2
FR FunctionalFRl General (includes Document Management;
and Community Provider/Partner Portal; AlMember, Authorized Representative,
erts and Notifications; WorkflowCentralized
Establish Case Criteria (includes Rules Management; Candidate Identifi cation /DeterminationRisk Stratification
FR2
Establish Case (Intake: Outreach; Case Assi )FR3
FR4 Perform Screening and Assessments
FR5 Treatment Plan and Outcomes
Manage Case Information (includes Case Documentation; Scheduling; Disposition;Case ClosureCare
FR6
Manage Population Health OutreachFR7
FR8Authorization D etermination (includes Referral Management; S ervice and
Treatment PlanFR9
ReportingFRlOConsent ManagementFR11
FRl2 Sample List of Reports
Section TitleNumber
Document tPlannedRelease
Requirementnumber
Requirement
R3The solution must pre-populate a letter with a date based on
rules.
businessNEl.10-001
R3The solution must have document management capabilities.FRl.10-001
R3The solution must provide letter templates.FR1.10-002
R3The solution must provide forms.FR1.10-003
R3The solution must allow a user to customize a template.FR1.10-004
R3FR1.10-005 The solution must store documents
R3The solution must be able to generate a form in hard copy.FR1.10-006
R3The solution must be able to generate a letter in hard copyFR1.10-007
General
Srarn or VnnuoNr, CoNrucr FoR pnRsoNu, SrnvrcnsDpplnrryrnNT oF' VnruroNr Hnalrn AccESSEQHual,rn Sor,urroNs, INc.
PAGE 118 or 268CoNrRlcr # 28739
AivrnNovrnxr # 2
FR1.12-001 The solution must allow a user to create state referral forms R3
FR1.12-002 The solution must allow a user to update state referral forms. R3
FR1.12-003 The solution must allow a user to delete state referral forms R3
FR1.12-004 The solution must allow a user to create letter templates. R3
FRl.12-005 The solution must allow a user to delete letter templates. R3
FR1.12-006 The solution must allow a user to update letter templates R3
Alerts and NotificationsFR1..24-
001The solution must allow a user to receive an alert based on user role. R3
FR1.24-
002solution must capture a user's preferences for his/her subscription to
notificationsThe R3
FR1.24-
003The solution must allow a user to subscribe to notifications based onbusiness rules.
R3
FR1,.24-
004The solution must allow a user to unsubscribe to notifications based onbusiness rules.
R3
FR1.87 solution must send an alert to a user based on business rules. (FRl.38)The R3
General
FR1.69-
001solution must have the ability to catalog imaged documents.The R3
FR1.83-
001The solution must have the ability to link all family member records. R3
Centralized MailingThe solution must be able to print a document for insertion into an envelopebased on business rules.
Setup Criteria
R3FR1.85-
001
Number Requirement PlannedRelease
FR2.7-001
must display a definition associated with each criterion withinThe solutionthe same window
R3
FR2.8-001
The solution must allow a user to create a criterion for vccl population R3
FR2.8-002
must allow a user to update a criterion for VCCI populationgroup.The solution R3
FR2.8-003
ution must allow a user to delete a criterion for VCCI populationThe sol R3
FR2.8-004
The solution must allow a user to record criterion for vccl population R3
Estatrlish Case Criteria
Srlrn or VrnvIoNto CoNtn-ncr FoR PnnsoNar, SnnvrcnsDnplnrvrnNT oF VBnruoNr HBalrn AccpssEQHnar,ur Sor,urroNs, Inc.
Pacn 119 or 268
CoNrR.q.cr # 28739AunNuuBNr # 2
R3The solution must allow a user to create a criterion for High-Risk pregnancyFR2.8-005
R3FR2.8-006
The solution must allow a user to update a criterion for High-Risk pregnancy
ationR3The solution must allow a user to delete a criterion for High-Risk pregnancyFR2.8-
007R3FR2.8-
008
The solution must allow a user to record criterion for High-Risk pregnancy
R3FR2.8-009
The solution must allow a user to create a criterion for Pregnant women
R3The solution must allow a user to update a criterion for Pregnant womenFR2.8-010
R3FR2.8-011
The solution must allow a user to delete a criterion for Pregnant womention
R3The solution must allow a user to record criterion for Pregnant womenFR2.8-012
R3FR2.8-013
The solution must allow a user to create a critenon for Post-Partum women
R3FR2.8-0t4
The solution must allow a user to update a criterion for Post-Partum women
R3The solution must allow a user to delete a criterion for Post-Partum womenFR2.8-015
R3FR2.8-016
The solution must allow a user to record criterion for Post-Partum women
tionRisk Stratification and Determination
R3The solution must send a notification to a user based on business rules.FRl.88
Case AssignmentPlannedRelease
Requirementnumber
Requirement
As Additional Staff to CaseR3NE3.6-
001
The solution must provide resource availability functionality
The solution must validate case assignment changes against resource
Conduct Outreach
R3N83.6-002
R3The solution must send a notification to a user based on business rules.
.JFRl.88
R3The solution must send an alert to a user based on business rules. (FR3.7)FRl.87
R3FR 1.88 The solution must send a notification to a user based on business rules.
Establish Case
Establish Case
Sr.q.rn on VnnvroNr, Conrnncr FoR pnnsoNnr, SnnvrcnsDnpaRrvrnNT oF VnnuoNr Hnnr,rn AccpssEQHnalrn Sor,urroxs, INC.
Pncn 120 or 268CoNrnacr # 28739
AupNovrnNr # 2
FR3.10-001
The solution must record the elapse time between outreach assignment andoutreach is acknowledged.
R3
FR3.21-001
The solution must allow a user to close a program specific case. R3
FRI.88 The solution must send a notification to a user based on business rules.(FR3.21)
R3
Assign Case ManagerThe solution must allow a user to send an alert based on business rules.FRl.87
Member's Profile S
R3
FR4.3-001
The solution must populate a member medication list from PBM with thefollowing parameters:a) Amount of pills.b) Measurement unit.c) Dosage.d) Date filled.e) Pharmacy.f) Prescriber.
R3
Perform Screening and AssessmentsFR4.8-001
The solution must populate the following data fields in screeningsa) Demographics,b) Clinical data,c) Previous pregnancy history,d) Primary Care Provider,e) Obstetrics (OB) Provider,f) Dental Provider,g) Dental history.
R3
FR4.8-002
The solution must populate the following data fields in assessments :
a) Demographics,b) Clinical data,c) Previous pregnancy history,d) Primary Care Provider,e) Obstetrics (OB) Provider,f) Dental Provider,g) Dental
R3
Requirementnumber
Requirement PlannedRelease
Develop Action PlansFR5.34-001
The solution must allow a user to save an action plan. R3
Perform S and Assessments
Manage Treatment Plan and Outcomes
Srarn or VnRvroNt, CoxtRLcr FoR PnnsoNl.r- SnnvrcBsDnp,q.nrN{nNT oF VpnvroNr Hr,lr,rn AccnssEQHnl.r,rn Sor,urroNs, INc.
Pacn l2l ot 268CoNrru.cr #28739
ArurNotrruNr # 2
R3The solution must allow a user to email an action plan.FR5.34-002Provide Education Materials
R3FR5.45-001
The solution must allow a user to batch education materials.
R3FR5.45-002
The solution must allow a user to print batched education materials.
Case DocumentationPlannedRelease
Requirementnumber
Requirement
R3N86.5-001
The solution must include the following attributes for every issue
a)priorityb)outcome typec)date identifiedd)source of identificatione)reviewer
R3The solution must allow a user to schedule a meeting.NE6.11-001
R3N86.1 1-
oo2The solution must allow a user to delete a meeting.
R3The solution must allow a user to update a meeting.NE6.1 1-
003R3The solution must allow a user to search for a meeting by attendees.NE6.1 1-
004R3NE6.13-
001
The solution must provide mapping functionality which will be available inprovider search tool
R3The solution must provide mapping functionality which will be av
module.
ailable inNE6.13-002
R3N86.14-001
The solution must be able to provide printable maptment.
directions to each
Close Program EnrollmentR3The solution must use nationally recognized grouper to determine gaps
metrics for medication adherence
lnN86.24-001
R3The solution must use nationally recognized grouper to determine gaps inpharmacy metrics for prescribed drug adherence
NE6.24-002
R3NE6.24-003
The solution must use nationally recognized grouper to determine gaps inrates.metrics for
R3The solution must use nationally recognized grouper to determine gaps infor adherence with therapvpharmacy metrics
NE6.25-001
Manage Case Information
Surn or Vnnnroirlt, CoNtnncr FoR pnnsoNar, SrnvrcnsDnpanrvrBNT oF Vnnuoxr Hnnr,rn AccnssEQHrar,rn Sor,urroNs, INc.
PAGE 122o1268CoNrnrcr # 28739
AvrnNtvrnNr # 2
Case DocumentationRequirementnumber
Requirement PlannedRelease
FR6.14-001
solution must be able to connect the mother's case with a newborn'scase.
The R3
FR6.14-002
The solution must be able to connect the mother's case with multiplenewbom's cases.
R3
FR6.17-001
The solution must allow a user to record a revision of a members casehistory with the following parameters:a) Needs assessmentb) Plan of Carec) Community Providersd)Community Partnerse) Case file
i contact datesii contact times.
R3
SchedulingFR6.26-001
solution must provide a calendar form with the following parameters:a)Appointment category,b)Meeting type,c)Start date,d)End date,e)Start time,f;End time,g)Attendees list,h)Meeting location,i)Meeting instructions,
The R3
FPi6.27-001
The solution must allow an attendee to be added to an appointment. R3
FR6.27-002
The solution must allow multiple attendees to be added to an appointment R3
FFi6.27-003
The solution must allow multiple attendees to be removed from anappointment.
R3
FR6.27-004
The solution must allow an attendee to be removed from an appointment. R3
FR6.30-001
solution must allow an appointment creator to attach a document to anThe R3
FR6.30002
The solution must allow an appointment creator to attach multiple documentsto an appointment.
R3
FR6.30-003
ution must allow an appointment creator to remove an attachmentThe solfrom an appointment.
R3
FR6.36-001
The solution must save an appointment invite. R3
Case Information
Sr.trn or VnnuoNt, Contru.cr FoR PnnsoN-q,L SnnvrcBs
DnpnnrvrnNT oF VnnNloNr Hw,rn AccnssEQHnar,rn Sor,uuoxs, INC.
Prcn 123o1268CoNrru.cr #28739
AvrnNnupnr # 2
FR6.37-001
The solution must electronically deliver an appointment invite to all
attendees
R3
FR6.38-001
The solution must allow an appointment attendee to accept an invite R3
FR6.38-002
The solution must allow an appointment attendee to
invite.
tentatively accept the R3
FR6.38-003
The solution must allow an appointment attendee to decline an invite. R3
FR6.38-004
The solution must allow an appointment attendee to propose a new time for
an
R3
FR6.39-001
The solution must report on appointment attendee's RSVP R3
FR6.40-001
The solution must allow a meeting attendee to include a message to RSVP R3
FRl.88 The solution must send a notification to a user based on business rules.
.41
R3
FR6.43-001
The solution must send an updated appointment invite to all attendees R3
FR6.44-001
The solution must highlight an appointment location change as part of the
invite.
R3
FR6.44-002
The solution must highlight an appointment date change as part of the
invite.
R3
FR6.44-003
The solution must highlight an appointment time change as part of the
invite.
R3
FR6.44-004
The solution must highlight a meeting location change as part of the updated
invite
R3
FR6.44-005
The solution must highlight a meeting date change as part of the updated
invite.
R3
FR6.44-006
The solution must highlight a meeting time change as part of the updated
invite.
R3
FRl.88 The solution must send a notification to a user based on business rules.
.46
R3
FR6.49-001
The solution must provide a map of the appointment location. R3
FR6.50-001
The solution must allow a meeting attendee to retrieve directions to a
location.
R3
FR6.51-001
The solution must populate the meeting location address when an attendee
to retrieve directions.
R3
FR6.52-001
The solution must display miles to an appointment location. R3
FR6.87-001
The solution must allow a referral acknow ledgement to be printed. R3
FR6.95.001
The solution must highlight the changes made to the referral R3
Surn or VnnnnoNr, CoNrucr FoR prRsoNal SnnvrcrsDrpanrvrnNT oF VBruroNr Hrar,rn AccEssEQHrlr,rn Sor,urroNs, INc.
Pacu 124o1268CoNrRAcr #28739
AvrnNnlrnNr # 2
FR1.88 The solution must send a notification to a user based on business rules. R3
FR6.101-001
The solution must have the ability to report on transitions betweenCommuni
R3
FR6.101-002
ution must have the ability to report on transitions betweenThe solCommunitv partners.
R3
FR6.101-003
The solution must have the ability to report on transitions between levels of R3
FR1.87 must send an alert to a user based on business rules. (FR6.101)The solution R3
Close EnrollmentFR6.116.001
must update a survey with a status of death when the reason forenrollment closure is death.
The solutioncase
R3
FR6.116.002
116.002 The solution must update a survey with the date of death whenenrollment closure is death.
FR6.the reason for case
R3
FR6.116003
The solution must update a member's plan of care with a status of deathlrylren the reason fol r4le program enrollment closure is death.
R3
FR6.116004
The solution must update a member's plan of care with the date of deathwhen the reason for case enrollment closure is death.
R3
FR6.1l600s
must update a gap in care with a status of death when the reasonenrollment closure is death.
The solutionfor case
R3
FR6.116.006
must update a gap in care with the date of death when thegram enrollment closure is death.reason for case pro
The solution R3
Care CoordinationFR6.120-001
must display contact information of internal unit staff involvedin member's plan of care.
The solution R3
Manase Population Health OutreachNumber Requirement Planned
ReleaseNE7.4.001
must be able to assign a user in real time to work with a clinicallead at apartner site based on zip code.
The solution R3
NE7.4.002
solution must be able to assign a user in real time to work with a clinicalartner site based on a nurse's
Thelead at a
R3
NE7.7.001
able to assign a member to a Case Manager based onThe solution must bebusiness rules.
R3
NE7.7.002
The solution mustbased on business
be able to assign a provider practice to a Case Managerrules.
R3
NE7.7.00J
solution must be able to assign a clinical lead to a case Manager basedon business rulesThe R3
Care Coordination GoalsNE7.28.001
The solution must allow a user to create a measure of improvement for adisease.
R3
NE7.28.002
must allow a user to edit a measure of improvement for aThe solutiondisease.
R3
Manage Population Health Outreach
Srarn or VnnvroNt, CoNtnncr FoR PnnsoNar, SnnvrcasDnpaRtvrnNT oF VrnwroNr Hnar,nr AccnssEQHnar,rn Sor,urroNso INc.
P.tcn 125 or 268CoNrnq,cr #28739
AMENDMENT # 2
R3NE7.28.003
The solution must allow a user to delete a measure of improvement for a
diseaseR3The solution must allow a user to report on a measure of improvement for a
disease.NE7.28.004
R3NE7.28.005
The solution must allow a user to create a performance
measure for a staff member.
improvement
R3The solution must allow a user to edit performance improvement measure for
a staff memberNE7.28.006
R3NE7.28.007
The solution must allow a user to delete performance improvement measure
for a staff memberR3The solution must allow a user to report performance improvement measure
for a staff memberNE7.28.008
R3The solution must record utilization on any data element of integrated care
coordination.NE7.28.009
R3NE7.28.010
The solution must allow a user to create a cost saving initiative on integrated
care coordination.R3The solution must allow a user to edit a cost saving initiative on integrated
care coordination.NE7.28.0ll
R3The solution must allow a user to delete a cost saving initiative on integrated
care coordinationNE7.28.072
R3NE7.28.013
The solution must allow a user to record a cost saving initiative on integrated
care coordination.of Services
R3The solution must allow a user to monitor medication adherence
interventton.NE7.38.001
R3The solution must allow a user to report on medication adherence
interventionNE7.38.002
R3NE7.38.003
The solution must allow a user to monitor on medication reconciliation
intervention over timeR3The solution must allow a user to report on medication
intervention.
reconciliationNE7.38.004
R3NE7.40.001
The solution must allow a user to monitor depression screening intervention.
R3NE7.40.002
The solution must allow a user to report on depression screening
intervention.R3The solution must allow a user to report on depression screening scoring
interventionN87.40.003
R3NE7.40.0o4
The solution must allow a user to monitor depression screening sconng
intervention.R3NE7.40.0
05
The solution must allow a user to monitor depression screening results.
R3The solution must allow a user to report on depression screbning results.NE7.40.006
R3NE7.44.001
must allow a user to monitor on-going assessment of amedical intervention over time.
The solution
Srarr or VnnvroNr, CoNrrucr FoR prnsonlr, SnRvrcnsDnplnrvrBNT oF VnnryroNr HBar,rn AccnssEQHnurn Sor,urrons, Inc.
P.rco 126ot268CoNrrucr # 28739
AvrpNptrnNr # 2
NE7.44.002
The solution must allow a user to report on on-going assessment of aparticipant's medical intervention over time.
R3
NE7.44.003
The solution must allow a user to monitor on-going assessment ofparticipant's psychosocial intervention over time.
R3
NE7.44.004
The solution must allow a user to report on on-going assessment ofparticipant's psvchosocial intervention over time.
R3
NE7.46.001
The solution must allow a user to monitor provider notification of care co-ordination enrollment intervention.
R3
NE7.46.002
The solution must allow a user to report on provider notification of care co-ordination enrollment intervention
R3
NE7.46.003
The solution must allow a user to monitor engagement level of individual oncare co-ordination intervention.
R3
NE7.46.004
The solution must allow a user to report on engagement level of panel ofon care coordination intervention.
R3
NE7.50.001
The solution must support care co-ordination integration with the followingcomponents:a) Clinical treatment guidelines,b) Disease prevention strategies ,c) Patient self-care education,d) Social suooort services.
R3
NE7.50.002
The solution must report a cost savings to the payer for each of the followingcomponents:a) Clinical treatment guidelines,b) Disease prevention strategies,c) Patient self-care education,
Social sernces
R3
Health OutreachNumber Requirement Planned
Release
FR7.18.001
The solution must be capable of receiving population data from censusdata.(G4. 1 0) Admission and discharge
R3
FR7.18.002
The solution must be capable of receiving population data from vitalstatistics. G4.t
R3
FR7.18.003
The solution must be capable of receiving population data from eHealthof FR7.18.004
R3
FR7.18.004
The solution must be capable of receiving population data from Birth R3
FR7.18.005
The solution must be capable of receiving population data from Death R3
FR7.18.006
The solution must be capable of receiving population data from Breast andCervical Cancer G4.t3
R3
Sr,q.ru or VnnvroNt, CoNtnacr FoR PnnsoNn, SBnvrcnsDnpLRrunNT oF VnnvroNr Hr.qlrH AccnssEQHn,Llrn Sor,urroNso INc.
PAGE 127 o1268CoNrnacr # 28739
AwrnNovrnur # 2
R3The solution must be capable of receiving population data
Immunization Registry. (G4. 1
fromFR7.18.007
R3The solution must be capable of receiving population data from ACO'sFR7.18.008
R3FR7.18.009
The solution must be capable of receiving population data from Blueprint.
R3The solution must allow a user to schedule an appointment with a ClinicalLead at a Provider site.
FR7.6.001
PlannedRelease
RequirementNumber
R3NE8.5.001
The solution must use a nationally recognized grouper tothat indicate a member's adherence with
determine the
number of medicationR3The solution must use nationally recognized grouper to determine
duration of each medicationtheNE8.5.00
2R3NE8.5.00
-l
The solution must use nationally recognized grouper to determine the
ratiomedicationR3The solution must use nationally recognized grouper to
continuous medication availabilidetermine the
ratio cNE8.5.004
R3The solution must use nationally recognized grouper to determine
the condition is untreated.
the risk ifNE8.5.005
R3FR8.6.00I
The solution must provide care coordinators with access to current MMIS-data.sourced
R3The solution must provide care coordinators with access to current
The solution must have access to current community provider registry
2-r-t-
datadata.sourced
hne2-l-1.the
FR8.6.002
R3FR8.6.00J
R3FR8.6.004
The solution must have access to current community partner registry
through the emergency line2-l-Idata
Referral ManagementPlannedRelease
Number Requirement
R3The solution must acknowledge the receipt of a referralN89.2.00I
R3The solution must allow a user to accept a referral.NEg.2.002
R3NE9.2.00J
The solution must allow a user to decline a referral
R3The solution must allow a user to record referral status.NE9.2.004
R3The solution must allow a user to report on the referral status.NE9.2.005
Manage Registry
Authorization Determination
Srarp or VrnnaoNr, Contnacr FoR pnnsoNn SnnvrcnsDnplntnnnNT oF' VnRvroNr Hn.rr,ru AccnssEQHrn ru SolurroNs, INc.
P.c.cn 128 or 268CoNrnacr #28739
AvrnNomrNr # 2
FRl.88 The solution must send a notification to a user based on business rules.(NEe.2)
R3
NEl0.1.001
The solution must provide clinical performance reports for any populationlevel.
R3
NEI0.1.002
The solution must provide operational performance reports forlevel.
any R3
NEl0.1.003
The solution must financial for ation level.reports any popul R3
NEl0.1.004
The solution must provide member satisfaction reports for any populationlevel
R3
NEl0.1.005
The solution must provide quality of life reports for any population level R3
NE10.2.001
solution must provide clinical performance reports at a program level.The R3
NE10.2.002
The solution must provide operational performance reports at aprogramlevel.
R3
NE10.2.003
The solution must provide financial reports at a program level R3
NE10.2.0o4
must provide member satisfaction reports at a program levelThe solution R3
NE10.2.005
solution must provide quality of life reports at a program level.The R3
NE10.3.001
The solution must report on clinical performance on member level. R3
NE10.3.002
ution must report on operational performance on a member levelThe sol R3
NE10.3.003
solution must provide financial reports on a member level.The R3
NE10.3.004
The solution must report on member satisfaction on a member level R3
NE10.3.005
The solution must report on quality of life on a member level R3
NE10.4.001
must produce an outcomes report using data from the followingsources:a) claimsb) information collected in the care management systemc) other state agenciesd) other state programse) providers
The solution
ACO
R3
NE10.6.00l
The solution must report on services. R3
N810.6.002
The solution must report on programs. R3
Reporting Requirements
Sr^lrn or VnnuoNt, CoNtru.cr F'oR PERSoNAL SnnvrcnsDnpLnrnnnNT oF' VnnvroNr Hnar,rn AccnssEQHrllrn Sor,urroNso INc.
Prcn 129o1268CoNrru.cr #28739
AvrnNuvrnnr # 2
NE10.6.003
The solution must report on clinical outcomes' R3
NE10.6.004
The solution must report on financial outcome. R3
NE10.6.005
The solution must monitor services. R3
NE10.6.006
The solution must monitor programs. R3
NE10.6.007
The solution must monitor clinical outcomes. R3
NE10.6.008
The solution must monitor financial outcomes. R3
R3NE10.7.00t
The solution must provide the ability to create an eligible population report
on any combinations of the following parameters:
a) age
b) genderc) zip code .
d) acuitye) primary diagnosisf) secondary diagnosisg) predicted riskh) PCP
recel careINE10.8.001
The solution must provide a provider population report on any
of the following parameters:
a) age
b) genderc) zip coded) acuitye) primary diagnosisf) secondary diagnosisg) predicted riskh) pcpi) populations receiving care
health service area
combinations R3
NE10.9.001
The solution must provide the ability to create an enrollment statistics
product program using any combination of the following parameters:
a; Referrals b) opt-out c) engaged d) unable to contact e) unable to reason f)
cases closed reason for cases closed health condition.
R3
R3NE10.9.002
The solution must provide the ability to create a health condition product
NE10.9.003
The solution must provide the ability to create a population participation
product program report using combination of the following parameters a) #
of participants engaged with a CC by severity level b. Total # of activeparticipants with an individuahzedplan of care.
R3
Surr or Vunvroxro CoNrnlcr F.oR pnnsoxar, SnnvlcnsDnpLnrunNT oF Vrnvronr Hrar,rn AccnssEQHn,t r,rn Sor,utroNs, INc.
PAGE 130 or 268CoNrnncr #28739
AvrnNovrnNr # 2
NE10.9.004
The solution must provide the ability to create clinical condition specificproduct program report.
R3
NE10.9.005
The solution must provide the ability to create a utilization specific productprogram using any combination of the following parameters:a) % of enrollees with 2 or more MD office visits within the last l2 monthsb) % of enrollees getting a flu vaccine c) vo of enrollee getting pneumoniavaccine within last 5 years d) Other Wellness/Preventive care screemngsbased on the member population
R3
N810.9.006
The solution must provide the ability to create preventative specific productprogram using combination of the following parameters:a) o/o of enrollees with 2 or more MD office visits within the last 12 monthsb) % of enrollees getting a flu vaccine c) % of enrollees getting pneumoniavaccine within last 5 years d) other Wellness/Preventive care screeningsbased on the member population
R3
NEl0.10002
The solution must report on sub scores in a member's assessment resultsPH UN
R3
NE10.10003
The solution must report on a member's satisfaction survey results. R3
NEl0.10004
The solution must report on a member's plan of care outcomes. R3
NE10.10.005
The solution must report on a member's length of program participation. R3
NEl0.1 1 .
001The solution must provide the ability to create an admissions financial report. R3
NEl0.l I002
The solution must provide readmissions financial report. R3
NEl0.11003
The solution must provide a length of stay financial report. R3
NEl0.11004
The solution must provide the ability to create an admissions financial reportfor specific conditions
R3
NEl0.1100s
The solution must provide a pharmacy cost financial report in relation tooverall costs.
R3
NEl0.l3-001
The solution must report on staff productivity over a predefined timeframe. R3
FRl0.14-001
The solution must report on caseload by staff over a predefined timeframe. R3
FRl0.16-001
The solution must have the ability to create a geographic variability ofchronic diseases report containing the following parameters:a) zip codeb) provider practicec) PCPd condition
R3
NEl0.17-001
The solution must provide a report with the following parameters:a. conditionb. % of enrolled members with completed assessmentsc. medication adherence
R3
Srarn or Vanvronto CoNtru,cr FoR PBnsoxll, SnnvrcnsDnp^c.RrivIBNT oF VBnuoNr Hnllrn AccnssEQHn.Llrn Sor,unoNs, INc.
PAGE 131 or 268
CoNrnq,cr # 28739AvrrNnvrnNr # 2
NE10.20001
The solution must provide a report with the following parameters:
a. AlCb. ED utilization
R3
NE10.23-001
The solution must provide a program-specificincluding the following parameters:
a. percentage ofcaseload capacityb. case with GA (General Assessment)
operational metrics report
c. staff
R3
R3NE10.27-001
The solution must provide a report comparing a Member's health profile to
member file and overall populationpro
NE10.30-001
The solution must provide a Member Report with the following parameters:
a. Member satisfaction surveyb. Plan of Care outcomesc. of
R3
NE10.32-001
The solution must provide a PCP Performance Report
parameters:a. PCPb. provider practicec. HSA
with the following
b. patients with chronic conditions within goalhange for those conditions
c. outreachd. patient datae. visit plannersf. trends over time
R3
NE10.33-001
The solution must provide a HRSA clinical.measure report for FQHC(Federally Qualified Health Center) based on HRSA requirements
R3
FRl0.5.001
The solution must provide the ability to archive reports R3
FRl0.5.002
The solution must provide the ability to delete reports R3
FRl0.l3.001
The solution must generate a report in real time based on a schedule
determined by the user
R3
FRl0.13002
The solutibn must be able to distribute a report to a subscribed user in real
time based on business rules.
R3
FRl0.13.003
The solution must allow a user to subscribe to a report distribution. R3
FRl0.13004
The solution must allow a user to unsubscribe to a report distribution. R3
FRl0.27-001
The solution must provide multi-dimensional Financial reports. R3
FR10.27-oo2
The solution must provide multi-dimensional Budget forecasting. R3
FR10.27-003
The solution must provide multi-dimensional Cash flow reports. R3
Srarn or VrnvroNr, CoNrnncr FoR pBnsoN,rr, SnnvrcnsDnplnrvrnNT oF Vnnvroxr Hnar,rn AccnssEQHnalru Sor,urroxs, INc.
Pncn 132 or 268CoNrnacr #28739
AvrnNrvrnNr # 2
FR10.27-004
The solution must provide multi-dimensional Recipient cost and User ofservices reports.
R3
FR10.27-005
The solution must provide multi-dimensional cost/benefit analysis reports. R3
FR10.27-006
The solution must provide multi-dimensional Prescription drug policy R3
FR10.27-007
The solution must provide multi-dimensional Cost and User ofprescription R3
FRt0.27-008
The solution must provide multi-dimensional Recipient participation reports. R3
FR10.27-009
The solution must provide multi-dimensional Eligibility and benefit designreports.
R3
FR10.27-010
The solution must provide multi-dimensional Geographical analysis reports R3
FRl0.27-011
The solution must provide multi-dimensional Program planning reports. R3
FR10.27-012
The solution must provide multi-dimensional Policy analysis reports. R3
FRl0.27-013
The solution must provide multi-dimensional Program performancemonitoring reports.
R3
FR10.27-014
The solution must provide multi-dimensional Medical assistance policydevelopment reoorts
R3
FRl0.27-015
The solution must provide multi-dimensional capacity planning reports R3
FR10.27-016
The solution must provide multi-dimensional Provider participation reports R3
FR10.27-017
The solution must provide multi-dimensional Service delivery patternsreports
R3
FR10.27-018
The solution must provide multi-dimensional Adequacy of and access to care R3
FR10.27-019
The solution must provide multi-dimensional euality of care reports. R3
FR10.27-020
The solution must provide multi-dimensional Outcomes assessment reports. R3
FR10.27-02r
The solution must provide multi-dimensional Disease management reports R3
FR10.27-022
The solution must provide multi-dimensional External reporting reports. R3
FRl0.27-023
The solution must provide multi-dimensional Public information reports R3
FR10.36001
The solution must have the ability to create a report to analyze effectivenessof Medicaid dollars to Medicaid
R3
FR10.36002
The solution must have the ability to create a report to analyze effectivenessofother agencies in support ofcare management goals.
.R3
FR10.37.001
The solution must allow a user to enter free-form text to be associated witheach
R3
Surn or VnniuoNt, CoNtrucr FoR PtnsoNar, SnnvrcnsDnpanrunNT oF VnnuoNr Hn,lr,rn AccpssEQIIn,lr,rs Sor,urtoNso INc.
PAcE 133 or 268
CoNrnc.cr #28739AivrnNntvrnnr # 2
FR10.37.oo2
The solution must allow a user to enter the following parameters to be
associated with a report: free-form text note field, name, date, timeR3
FRl0.38.001
The solution must be able to calculate the BMI for a member based on height
and weieht.
R3
FRl0.38.002
The solution must have access to a member's BMI from their medical
records
R3
FRl0.39001
The solution must be able to report on inpatient facility admission data on an
ad hoc basis.
R3
FR10.40001
The solution must collect the following data elements for High-Riskpregnancy:a) Gestational age at referralb) Date of contact with memberc) # of phone callsd)# of office visitse)# of home visitsf) Date closedg) Last Menstrual Period (LMP)j) Final Expected Due Datei) Date of initial prenatal visitj) Number of prenatal visitsk) Maternal oomplicationsl) Date of postpartum visitm) Birth weightn) NICU stayo) Heightp) Weight at LMPq) BMIr) Progesterone screenings) Tobacco use screeningt) Post-partum depression screeningu) Prenatal visits
R3
FR10.40.002
The solution must be able to create a High-Risk Pregnancy report with any
combination of the following parameters:
a) Gestational age at referralb) Date of contact with memberc) # of phone callsd)# of office visitse) # of home visitsf) Date closedg) Last Menstrual Period (LMP)j) Final Expected Due Datei) Date of initial prenatal visitj) Number of prenatal visitsk) Maternal complicationsl) Date of postpartum visitm) Birth weight
R3
Surn or VnnvroNr, CoNrn-tcr FoR PnnsoNar, SnnvrcnsDupanrunNT oF VnnvroNr Hnar,rrr AccnssEQHralrn Sor,urroNs, Inc.
PAGE 134o1268CoNrnq.cr # 28739
AvrnxovrnNr # 2
n) NICU stayo) Heightp) Weight at LMPq) BMIr) Progesterone screenings) Tobacco use screeningt) Post-partum depression screeningu) Prenatal visits
FR10.46001
The solution must allow a user to update a survey response based on businessrules.
R3
FR10.46.002
The solution must allow a user to delete a survey response R3
FR10.47001
The solution must provide an analysis tool for a user to review surveyresponses.
R3
FR10.49001
The solution must have the capability to display a population dashboardrepoft as per business rules.
R3
FR10.49.002
The solution must have the capability to display a program dashboard reportas per business rules.
R3
FR10.49003
The solution must have the capability to display a member-based dashboardreport as per business rules.
R3
FR10.s0-001
The solution must report an analysis of service(s) given to a member bycondition.
R3
FR10.52001
The solution must collect data on high risk families by zip code. R3
FR10.52-002
The solution must collect data sets of children in custody for department ofchildren and families by zip code.
R3
FR10.52003
The solution must report on data on high risk families by zip code R3
FR10.52004
The solution must report on geographical data sets of children in custody fordepartment of children and families.
R3
FR10.54-001
The solution must have the ability to generate federal required reports forcare
R3
The solution must have the ability to generate state required reports for care R3
Consent
FR10.54-002
Number Requirement PlannedRelease
FRl.88 The solution must send a notification to a user based on business rules(FRl1.3)
R3
FRl1.6-001
The solution must record the consent with a combination of the followingparameters:
the consent from Membera) Entity
R3
Consent Man
Srlrn or VnnuoNt, CoNtucr FoR PnnsoNar, SEnvrcssDnpa.nrnnnNT oF VnRvroNr Hnl.LrH AccnssEQHnnlrn Sor,urrons, INc.
Pacr 135 or 268
CoNrRl.cr # 28739AvrnNuvrpnr # 2
b) Providers who can share information.c) Entities who can share informationd) Individuals who can share informatione) Type and focus of the information covered (granularity and parameters to
be determined by Vermont PolicY)f) Types of information (e.g., benefit and eligibility information, medical
records, assessments, test results, claims and payments)
g) Areas of sharing (e.g., behavioral health, mental health, chronic care,
High-Risk Pregnancy)h) Purpose of the sharing of information (e.g., congruency and coordination
of care, continuity of care)
i) Expiration conditions of the consent:
i. Period of time from date consent is givenii. Specified end dateiii. Specific event (e.g., end of required collaborative
service delivery, end of treatment)Consent status
R3The solution must populate the following attributes when a member is
providing the consent:a) First name,b) Last name,c) Date of Birth.
FRl1.7.001
R3NE12.3.001
The solution must be integrated with Vermont health information exchange
R3NE'12.3.002
The solution must create claims continuity of care records'
R3The solution must create clinical continuity of care recordsNE12.3.003
R3The solution must create data profile at the member facility level.NE12.3.004
R3NE12.3.005
The solution must create data profile at physician facility level
R3The solution must create data profile at provider facility levelNE12.3.006
Health Care Reform
CR059 - Governance ReviewPlannedRelease
RequirementNumber
R3FRl.15-001
The solution must allow a user to soft delete a program segment.
R3FR1.15-002
The solution must allow a user to update a program segment.
Srarr or VnRvroxr, CoNrnlcr FoR pnnsoNnr, SrnvrcrsDnp,rnrurNT oF VrnvroNr Hnar,ru AccnssEQHnl.lrn Sor,urroNs, INC.
PAGE 136 or 268CoNrnrcr # 28739
AvrnNuvrrcNr # 2
FRl.15-003
The solution must allow a user to document the reason for removal of aSE
R3
FRl.15-004
The solution must allow a user to document the reason for updating a programsegment.
R3
FRl.15-00s
The solution must allow a member to enter free form comments. R3
FRl.15-006
The solution must allow a supervisor to edit program status details. R3
FR7.8-001
The solution must provide consistent session note types throughout thesolution.
R3
FR10.42-001
The solution must allow a supervisor to soft delete a survey based on businessrules.
R3
FR10.42-002
The solution must display a confirmation message when a survey is softdeleted.
R3
FR10.42-003
The solution must allow a user to finalize an incomplete survey. R3
FR10.42-004
The solution must confirm a survey has been "finalized incomplete" R3
FR10.42-005
The solution must report on "incomplete survey closed" status. R3
FR10.47-001
The solution must provide an analysis tool for a user to review survey R3
FR10.s8 The solution must archive a survey associated with a pervious enrollment. R3
CR074 - Reportine FR Scope Alignment and ReconciliationNumber Requirement Planne
dRelease
FR10.29-001
The solution must send a report via email. R3
FRl0.3-001
The solution must save a report template. R3
FR10.3-002
The solution must provide access to view a report template. R3
FR10.3-003
The solution must allow a user to delete a report template. R3
FR10.3-004
The solution must allow a user to update a report template. R3
NE10.21-001
The solution must report an overview of clinical outcomes for specificconditions by program episode.
R3
NE10.24-001
The solution must report the count of total Emergency Department visits for amember by hospital.
R3
NE10.24-002
The solution must report the count of total Emergency Department visit for amember for a predefined time period prior to CM intervention.
R3
Srarr or VrnuoNt, CoNtucr FoR Pnnsonar, SnnvrcnsDnpanrunNT oF' VnnvroNr Hnl.r,rn AccnssEQHr.lr,rn Sor,urroNso INc.
Plcn 137 or 268
CoNrru.cr #28739AurnNnvrnNr # 2
NE10.24-003
The solution must report the count of total Emergency Department visit for a
member for a predefined time post CM intervention.R3
NE10.28-001
The solution must report clinical metrics of VCCI eligible members' identified
conditions
R3
NE10.28-002
The solution must report clinical metrics of VCCI target members' identified
conditions
R3
NE10.28-003
The solution must report clinical metrics of VCCI enrolled members'
identified conditions.
R3
NE10.28-004
The solution must report the progress of a goal R3
NE10.28-005
The solution must report the progress of an intervention. R3
NE10.28-006
The solution must report the achievement of a goal on completion. R3
N810.28-007
The solution must report the achievement of an intervention on completion R3
FRt0.50-002
The solution must report on the impact analysis of service(s) given to a
member by condition.
R3
NE7.48-001
The solution must report on utilization pattern by provider R3
NE7.48-002
The solution must report on the adherence to condition specl fic standards ofcare.
R3
NE7.57-001
The solution must report on member collaboration. R3
NE7.57-002
The solution must report on member engagement. R3
SFR2.31 The solution must load an ACO- attributed members data file based on
business rules to determine vccl eligibility, with the following set ofcomponents:i) Re_uniqueJd Member IDii) Last_Nameiii) First_Nameiv) ACO-FLAG (0 [not attributed; or I [attributed])v) ACO_Start_Date
ACO Date should be last date of the current month's
R3
FR10.55 attributed to ACOThe solution must be able to report the list of members
based on business rules.
R3
FR10.56 The solution must allow a user to run a report to compare the ACO attribution
list from different
R3
FR2.32.001
The solution must allow a user to identify ACO-attributed members based on
the following information from the ACO-attributed file:i)ACO Flagii) ACO Start Date
ACO Date
R3
FR2.33 The solution must allow a user to identify a member who has
ACO.transitioned to R3
Srlrr or Vrnvronr, CoNrnacr FoR pnnsonnr, SnnvrcnsDnpanrvrnNT oF VnnuoNr Hn,rr,rn AccnssEQHn,rlrn Sor,urrons, Inc.
P.q.cn 138 or 268CoNrntcr # 28739
ANraNoNInNr # 2
FR2.34 The solution must flag ACo - attributed members as vccl ineligible. R3
FR10.57001
The solution must allow a user to report the outcomes of vccl populationbased on business rules.
R3
FRl0.57002
The solution must allow a user to report the outcomes of ACo populationbased on business rules.
R3
FR10.57.003
The solution must allow a user to compare the clinical outcomes report ofACO clinical outcomes of VCCI
R3
FF.7.22 The solution must display clinical data received from VHIE. R3
FF.7.23-001
The solution must maintain Laboratory(LAB) data in a datamodel R3
FR7.23-002
The solution must maintain Immunization/vaccine(vxu) data in a datamodel.
R3
FR10.58-001
The solution must report on Laboratory (LAB) data. R3
FR10.58-002
The solution must report on Immunization/ Vaccine (VXU) data. R3
FPt7.24-001
The solution must receive CCD files from the VHIE. R3
FP.7.24-oo2
The solution must maintain CCD files received from the VHIE. R3
FF.7.24-003
The solution must allow a user to view CCD files. R3
FRl.89 The solution must send a VHIE generated alert to a user based on businessrules G4
R3
Document ManagementNumber Requirement Planne
dRelease
FR1.1 Contractor's System will store State-approved letter templates.The R1FINAL
FR1.2 The contractor's System will allow users to access appropriate lettertemplates based on need and role.
R1
FINALFRl.3 contractor's System will pre-populate letters with the profile of the user,
which includes but is not limited to:a) First and last name b) Title c) Department
number, etc.)d) Contact information (email address" phone
The R1FINAL
FR1.4 The Contractor's System will pre-populate letters with the date R1
FINALFRl.5 The Contractor's System will allow Users to enter freeform text to
communicate notes / comments (number of characters as approved by theuirementsState
R1FINAL
General
Srarr or VnnuoNt, Coxtrucr roR PnnsoNc, SnnvrcnsDnp.lntupNT oF VnnmoNr Hnar,rn AccnssEQHnll,rn Solurronso INc.
P.l,cn 139 or 268
CoNrnlcr # 28739AnnnNovrnNr # 2
FRl.6 The Contractor's System will save the completed letters and associate it withMember's record.
R1
FINAL
FRl.7 The Contractor's System will allow for scanned documents to be associated
with Member's Plan of Care or record
R1
FINAL
FRl.8 The Contractor's System will allow for Users to edit letters R1FINAL
FR1.9-1 The Contractor's System will be able to access, pull, and lormat Member's
data into appropriate letters (e.g. Discharge summary will show Member's
from to st-Chronic Care then batch and
R1
FINAL
FR1.9-1* The Contractor's System will be able to access, pull, and format Member's
data into appropriate letters (e.g., Discharge summary will show Member's
from to Chronic Care then batch and mail
R1
FRl.10-1 The Contractor's System willbe able to include, at a minimum, the followingdocument management capabilities: a. Accessible letter templates and forms
b. Updateable templates through the ticketing process. Contractor will release
the updated templates to SoV for testing in an agreed upon timeframe c. Store
documents and files d. Generate materials in both hard copy and electronic
format, including forms and letters e. Create letter templates and forms for the
following areas: i. Community Provider/Partner materials ii. General
correspondence/notices for Community Provider/Partners and Members
The Contractor's System will be able to include, at a minimum, the followingdocument management capabilities: a. Accessible letter templates and forms
b. Updateable templates through the ticketing process. Contractor will release
the updated templates to SoV for testing in a timeframe mutually agreed upon
by the State of Vermont and the contractor, but shall not exceed 5 business
days after Contractor receives requirements. The requests are limited to the
current document management framework of the application. c. Store
documents and files d. Generate materials in both hard copy and electronic
format, including forms and letters e. Create letter templates and forms for the
following areas: i. Community Provider/Partner materials ii. Generalfor Provider/Partners and Members
R1
FINAL
FR1.10t The Contractor's System will be able to include, at a minimum, the followingdocument management capabilities :
a. Accessible letter templates and formsb. On-line, updateable templates that allow Users to customize on an as-
needed basisc. Store documents and filesd. Generate materials in both hard copy and electronic fOrmat, includingforms and letterse. Create letter templates and forms for the following areas: i. Community
Provider/Partner materialsii. General correspondence/notices for Community Provider/Partners and
Membersiii. Letters (financial, denial, EOMB, Notice of Decision, etc')
iv. Coordination of Benefits Letterv. Prior Authorization Letters
R2
Sr,q.rn or VnnuoNr, CoNrucr r.oR pERsoNAL SnnvtcnsDnpanrvrnNT oF VrnnaoNr Hnar,rn AccrssEQHnalrn SolurroNso INc.
P.tcn 140 or 268CoNrnacr #28739
AunNrvrpNr # 2
FRl.l0** The Contractor's System will be abledocument management capabilities :
to include, at a minimum, the following
a. Accessible letter templates and formsb. on-line, updateable templates that allow users to customize on an as-needed basisc. Store documents and filesd. Generate materials in both hard copy and electronic format, includingforms and letterse. create letter templates and forms for the following areas: i. communityProvi der/Partner material s
ii. General correspondence/noti ces for community provider/p artners andMembersiii. Letters (financial, denial, EOMB, Notice of Decision, etc.)iv. Coordination of Benefits Letterv. Prior Authorization Letters
R3
FRl.12. a
FRl.12-1The contractor's System will allow users, with appropriate access levels, tocontact eQHealth in order to create / modify / delete / update State-approvedreferral forms, letter templates, and other appropriate documentation. Thiswill be done by following an easy-to-use, well-defined process and at noadditional cost to the State.
R1FINAL
FR1.l2*FRl.12. aFRl.12-1
The Contractor's System will allow (Jsers, with appropriate access levels, tocreate / modify / delete / update State-approved referral forms, lettertemplates, and other appropriate documentation. The contractor's System willallow users, with appropriate access levels, to contact eeHealth in order tocreate / modify / delete / update State-approved referral forms, lettertemplates, and other appropriate documentation. This will be done byfollowing an easy-to-use, well-defined process and atno additional cost to theState.
R2
FRl.l2** The contractor's System will allow users, with appropriate access levels, tocreate / modifu / delete / update State-approved referral forms, letter
and other documentation
R3
Authorized and Provider/Partner PortalFRl.14 The Contractor's System will validate the information provided by the
Member, community Provider/P artner, and Authorized Repres entative.Validation will be based on at least:
a) Required field completionb) Field content types (e.g., names must not contain numbers)c) Acceptable values (e.g., no birth dates before Illll90A)d) values based on available real-time and stored data sources (e.g., vccl
information about the Medicaid Provider verifi cation
R2, R3
FRl.14*The Contractor' s System will validate the information provided by theMember, community Provider/P artner, and Authorized Repres entative.Validation will be based on at least:
a) Required field completionb) Field content types (e.g., names must not contain numbers)
values no birth dates before llllIc
R2
Srlrn or VnnvroNto CoNtnacr FoR PnRsoN,q,L SnRvrcnsDupLRrvrnNT oF VunvroNr Hnal,rn AccnssEQHp,r,lrn Sor,urroNs, INc.
Pncn 141 or 268CoNrru.cr #28739
AvrBNuupnr # 2
d) values based on available real-time and stored data sources (e.g., vinformation about the Member, Medicaid Provider verification)
CCI
R1The Contractor's System will grant and limit access to
Provider/P artner, and Authorized Representative to view/update information,Member, Community
based on User ro access ruleand
FRl.15
WorkflowR1.01The Contractor's System will allow Users to save the data at any point during
afeadata across theFRl.t6
R1The Contractor's System will automatically save work-in-progress and notify
the User that the data was savedFRl.17
Rl.01The Contractor's System will allow Users to continue wiworkflow and other components of a process atearf a single component has
not been
th other steps ofFRl.18
Rl.01FRl.19 The Contractor's System will notify Users when mandatory data fields are
R2The Contractor's System will have workflow management to
electronically send referrals or other documentation through theallow Users to
hierarch for review andlor denial
FRl.21
Alerts and NotificationsR1FINAL
The Contractor's System will have the capability to generate
notifications for Users to see aI" any stage of the case management process
The following Alerts will be introduced in Rl.02:. Case Assigned. Participant Reassigned. Member Deceased. Issues, Goals and Interventions are Closed
alerts andFR1.22-1
R1
FINALFP.I.22-2 The solution must send alerts to users
R1FINAL
The solution must allow anauthoized user to configure alertsFP.l.22-3
R1FINAL
The solution must send notifications to usersFP.L.22-4
R1
FINALhe solution must allow an atrthoized user to configure noti fications.FR1.22-5
R3The Contractor's System will allow Users to subscribe and unsuand rolebased onalerts and
bscribe toFRl.24
FR1.24-1 The solution must capture a client's preferences for his/her subscription to
alerts
FFtt.24-2 The solution must capture a client's preferences for his/her subscription to
notifications.R2The Contractor's System will allow for electronic mailing (e-
of alerts and notificationsmailing),
andbaFR1.25
Srlrn or VnnuoNr, Contrucr FoR pnnsoNlt SnnvrcnsDnpaRrunNT oF Vnnvronr Hnllur AccrssEQHnalrn Sor,uuoNs, INc.
PAGE 142ot268CoNrrucr # 28739
AivrnNovrnNr # 2
FRl.26 The contractor's System will prompt user to indicate action needed /rgquested for a specific alert
R1FINAL
FRl.27 The Contractor's S will allow User to alerts and notifi cations R1FR1.27-1 The Contractor' s System will display the priority of alerts and notifications as
defined by policy. Any changes to the priority can be managed through theR1FINAL
FR1.28 The Contractor' s System will allow User to search for alerts by Member, alertetc.
R1
FINALFR1.29 The Contractor's System will allow User to track age of alerts and
notificationsR1
FINALFRl.30 The Contractor'
or unread alertss System will allow managers / supervisors to view pendingand notifications of their staff.
a. The contractor's system will push these alerts and notifications tomanagers / supervisors after predetermined timeframe based on program
R1FINAL
FRl.30-1 The Contractor' s System will allow managers / supervisors to viewnotifications of staff includine details such as status
RIFINAL
FRl.31 The contractor's System will allow the author of an alert / notification toindicate an overdue date andlor time. The contractor's System will allow theauthor of an alert / notification to indicate an date and/or time
R1FINAL
FRl.31-1 The Contractor' s System will allow the author of an alert / notification toindicate an overdue date and/or time
R1FINAL
FRl.32 The contractor's System will send alerts/notifications to appropriate Userswhen a condition has been achieved. This may include but is not limited to:
a) Medication filledb) Progress towards goal (e.g., partially achieved in first visit and needs to be
addressed at next visit)c) Member contact requirement, per program policyd) Urinalvsis completed for substance abuse patients
R1FINAL
FRl.32-1 The contractor's System will send alerts/notifications to appropriate userswhen a condition has been achieved. This may include but is not limited to: a)Medication filled b) Progress towards goal (e.g., partially achieved in firstvisit and needs to be addressed at next visit) c) Member contact requirement,per program policy d) Urinalysis completed for substance abuse patients.The following Alerts will be introduced in Rl.02:
in Careo
RIFINAL
FRl.33 The Contractor's System will send alerts/notifications to Usubscribed or been assigned to these types of notifications,
sers who have: (1)(2) the correct
access and have a valid reason for this data
RIFINAL
FR1.36 The contractor's System will automatically create alerts based on beste. where cable
R2
FR1.36-1 The Contractor' s System will automatically create alerts based on bestpractice (e.g., prenatal checkpoints), where applicable. The following Alertwill be introduced in R1.02: . P in Care
R1FINAL
FRl.37 The Contractor' s System will allow Users to modify System-generated alerts RI
Sr,q.rn or VnnuoNt, CoNtnacr FoR PnnsoNu, SnnvrcnsDnplntvrnNT oF VrRuoNr Hnar,rn AccnssEQHn.r.r,rn SolurroNs, INc.
P.l,cn 143 or 268
CoNrnacr #28739AunuounNr # 2
FR1.37-1 The Contractor's System will store rules for system-generated alerts. Anyupdates to the alerts rules can be managed by submitting a ticket request to
the Contractor
R1
FINAL
FRl.38 The Contractor's System will send alerts to Users ofMember admissions and
discharges from hospitals, nursing homes, residential care facilities,
bed services for Mental and out of home services
R3
GeneralFRl.39 The Contractor's System will include decision support tools such as but not
limited to: a) Links to appropriate program policies aligned to appropriate
data items b) Clinical links (e.g., McKesson, InterQual) c) Standards of care
d Case
R1
FR1.40 The Contractor's System will have the ability to automatically populate the
appropriate data elements when supplied in any approved electronic format,
the execution of the business and calculations
R1
FINAL
FRl.41. a
FRl.41-1The Contractor's System will have the capability to interact
systems as needed to collect, track, and report on programswith otherat the Member and
level.
R1FINAL
FRl.42 The Contractor's System will have the capability to save all forms, reports,
documents, screens, etc. based on User role and program policy
The Contractor's System will have an easy-to-use and well-formatted print
functionality for all forms, reports, documents, screens, etc. based on User
role and
Rl.01
Rl.01FR1.43
FRl.44 The Contractor's System will provide the ability to associate a single
electronic document with multiple members if appropriate (e.g., household)R2
FRl.45 The Contractor )S System will send a notification to appropriate User when a
deadline, per policy, is approaching ( e., a PA request must be acknowledgedwill notify appropriate User at thewithin 'X I hours The Contractor' System
'N'th hour if has to be made
FR1.46 The Contractor's System will provide Users the ability to review data entered
on forms to submissionThe Contractor's System will have a spell check function for all text (e.g.,
secure case notes
R1FINALRIFINAL
FR1.47
FR1.48 The Contractor's System will automatically save information as Users
forms
R1
FINAL
FRl.49 The Contractor's System will allow Users to submit forms when allinformation is
Rl.01
FRl.50 The Contractor's System will validate that all mandatory data fields have been
completed when a Community ProvidetlPartnet, Referring Party, or User
attempts to submit a form (Note: this includes performing validations when
from one screen to the next
R2
FRl.50. a
FR1.50-1The Contractor's System will validate that all mandatory data fields have been
completed when a USer attempts to submit a form (Note: this includes
validations when from one screen to the
R1
FINAL
FRl.51 The Contractor's System will allow a User to change screens
forwards without lo data entered
(backwards or R1
Surn or VnRmoNt, CoNrnlcr roR pERsoNAL SnnvrcnsDnplntvrnNT oF VnnuoNr HnaLrn AccnssEQHn,tlrn Sor,urroNs, INc.
Pacn 144o1268CoNrnacr # 28739
AunNovrnNr # 2
FRl.51-1 The Contractor' s System will allow a User to change screens (backwards orforwards) from Surveys to other tabs within a case without losing data entered
Rl.01
FRl.53 The Contractor' s System will inform the Community Provider/Partner,Referring Party, or User of errors on the form based on the validationsperformed
R2
FRl.54 The Contractor's System will allow the Community Provider/partne4Referring Party, or User to review and update the form if there are correctableeffors
R2
FRl.54. a
FRl.54-1The contractor's System will allow the User to review and update the form ifthere are correctable errors
R1
FINALFRl.55 The contractor's System will allow for a system administrator to indicate
and fields in formsRIFINAL
FRl.56 The contractor's System will provide the ability for users to format text inThe Contractor's System (e.g., capitalization, special characters, hishlisht,
underline
R2
FRl.57 The contractor's System will display a progress indicator on all forms thatmore than one screen
RIFINAL
FRl.59 The Contractor's System will allow Users to upload acceptable file types asdefined The Contractor's S
R1FINAL
FR1.60-1 The SysteminformationVCCI, COU
will have rules-based access control at the case level and displaybased on the following: a) User role and program affiliation (e.g., etc.)
RI.01
FRl.61 The contractor's System will have a User interface written in English(including warnings, notifications and User prompts) free of grammaticalerrors and
RI.01
FRl.62 The contractor's System will contain written language targeted to the averageadult level. Note: This to all
R1
FINALFRl.63 The contractor's System will provide the capability to determine an
individual's language preference to be used on notices, correspondence andother materials
R1
FINAL
FRl.63-1 The Contractor's System will provide the capability to determine anddocument an individual's I
R1
FINALFRl.64 The Contractor )
S System will maintain a record ( audit trail) of all changeschanges or User
e.g.made to data1n the Contractor' s System System initiatedinitiated changes. This should be readily searchable by UMember ID. This must include but is not limited to:
ser ID , system ID or
a) The user ID of the person who made the change or system ID if thechange was system generated b) The date and time of the change
c) The information that was changed d) The data before and after it wase The data source if the was
Rl.01
FR1.65 The Contractor's System will record the date, time, and name of UsersMember information
Rl.01
FRl.67 The Contractor' S System will use industry standard taxonomy(les) includingbut not limited a. CMS' Heal th Plan Identifi er )Identifi er o
to:b National Provider Identifier
(HPID and Other EntityRl.01
Srarn or VnnvroNto Contn,lcr FoR PrnsoNnr, SnnvrcnsDnp^q.RtNInNT oF Vnnvronr HBnlrn AccnssEQHnurn Sor,urroNs, INC.
P.q.cn 145 or 268CoNrnq,cr #28739
AvrnNovlnNr # 2
FRl.68 The Contractor's System will provide online access to clinical guidelines
protocols approved by the State
a) The State will have the ability to select homegrown, national andlot
commercial (regularly updated) clinical guidelines and protocols (e.g.,
PubMed) to allow for different departments to view or use b) The
Contractor's System will have the capability to protect commercial
and
Contractors intellectual property
R1
FINAL
FRl.69 The Contractor's System will have the ability to support catalo ging/indexing
of all imaged documents
R3
FRl.70 The Contractor's System will allow more than one User to be logged in to and
enter data in the same at the same timeR1
FINAL
FRl.71 The Contractor's System will provide a real-time view of all Users accessing
a case
R1
FINAL
FRl.72 The Contractor's System will provide menus that are understandable by non-
technical Users and provide secure access to all functional areas
Rl.01
FRl.73 The Contractor's System will provide the ability to incorporate a non-
restrictive environment for experienced Users to directly access (direct call) a
screen or to move from one screen to another without reverting to the menu
structure
Rl.01
FRl.74 The Contractor's System will provide an online help system, available
any screen and any screen field, that provides a description of and the
processing performed by a screen or window, data entry format and
from
restrictions, explanation of error messages and other information helpful to
the User
R1
FR1.74-1 The Contractor's System will provide an online help system, available fromany screen
R1
FINAL
FRl.75 The Contractor's System will provide the ability to generate drop-down lists
to identifii options available, valid values, and code descriptions, by screen
field
Rl.01
FRl.76 The Contractor's System will allow lJsers, with appropriate access levels, to
edit drop-down list options
R1FINAL
FRl.77 The Contractor's System will have the ability to utilize the followingstandards for all system screens, windows, and reports: a) All headings and
footers standardized b) Cunent date and local time displayed c) Allreferences to dates displayed consistently throughout The Contractor's
system d) All data labels and definitions consistent throughout the
Contractor's System and clearly defined in User manuals and data element
dictionaries e) A11 generated messages should be clear and sufficientlydescriptive to provide enough information for problem correction and be
written in full English text f) Specifu User (name) with assobiated data input
g) All dropdown lists displayed consistently throughout the Contractor's
System h) All search results displayed consistently throughout the
Contractor's S 1.e. Name formats
R1
FINAL
Srarn or VnnuoNr, CoNrnncr FoR pnRsoNar, SrRvrcnsDnpmrvraNT oF VBnvroNr Hnalrn AccnssEQHrar,ru Sor,urroNs, INc.
P.q.cn 146 or 268Coxrnacr #28739
AvrnNrunNr # 2
FR1.77-1 The contractor's system will have the ability to utilize the followingstandards for all system screens, windows, and reports: a) All headings andfooters standardized b) Cunent date and local time displayed c) All referencesto dates displayed consistently throughout The contractor's System asMM/DD/YYYY e) All generated messages should be clear and sufficientlydescriptive to provide enough information for problem correction and bewritten in full English text f) Specify User (name) with associated data inputg) All dropdown lists displayed consistently throughout the contractor's
R1.01
FF.t.77-2 The Contractor's System will have the ability to utilize the followingstandards for all system screens, windows, and reports: a) All headings andfooters standardized b) Current date and local time displayed c) All referencesto dates displayed consistently throughout The contractor's System d) Alldata labels and definitions consistent throughout the Contractor's System andclearly defined in User manuals and data element dictionaries e) All generatedmessages should be clear and sufficiently descriptive to provide enoughinformation for problem correction and be written in full English text f)Specify User (name) with associated data input g) All dropdown listsdisplayed consistently throughout the Contractor' s System
R1FINAL
FRl.78 The Contractor' s System will displaypertinent Member information on allMember screens. This includes but is not limited to:
a) Member's date of birthb) Contact information (primary and alternative)c) Social security number
R1
FR1.79 The contractor's System will pre-populate data fields based on previouslyentered data entrv
R1
FRl.80 The Contractor's System will be flexible enough to allow role-based Users theability to easily and quickly reconfigure based on changing businessrequirements (e.9., approved letter templates, updated fields in the electronicreferral form
R2
FRl.80. a
FRl.80-1The contractor's System will be flexible enough to allow role-based Users tocontact eQHealth in order to reconfigure based on changing businessrequirements (e.g., approved letter templates, updated fields in the electronicreferral fo.m). This will be done by following an easy-to-use, well-defined
and at no additional cost to the State.
R1FINAL
FRl.81 The contractor's system will have the ability to display free-form narrativenotes in chronological or reverse chronological sequence, by timeline forspecific medical condition, including but not limited to:
a. Ability to review history of a case progress towards goal (e.g., note orpattern) without having to scroll through all notes from present to 'X'timeback
R1FINAL
FRl.83 The contractor's system will associate an individual Member record with theMember's family in The Contractor's System for use in data look-up
R3
CentralizedFRl.85 The contractor's System will have an efficient method for preparing hard
materials for insertion in a wide of R3
Srarn or VnnwroNt, CoNtnncr FoR PnnsoNL SnRvrcnsDnp,q,RtN{nNT oF VnnvroNr Hn.lr,rn AccnssEQHnal,rn Sor,urrons, INc.
P.q.cn 147 os268Cournq.cr # 28739
AvrnNoiunNr # 2
Setup CriteriaPlannedRelease
RequirementNumber
R1FINAL
The solution must allow a user to submit a ticket to request a
order of execution of the eligibility ruleschange to theFR2.1-
001
R1
FINALFR2.1-002
The solution must allow a user to submit a ticket to request an eligibility rule
be made active.R1
FINALThe solution must allow a user to submit a ticket to request an
be made inactive. timeframe mutually agreed upon by the State of Vermont
and the Contractor but shall not exceed 15 business days after the Contractor
receives requirements. The requests are limited to the approved eligibility
eligibility rule
rules framework of the application
FR2.1.00J
R1
FINALFR2.1-004
The solution must allow a user to submit a ticket to request a content
to an eligibility rule. The user will be able to submit a ticket to the Contractor
in order to select all, multiple or single criterion. The update will be released
for SoV testing in a timeframe mutually agreed upon by the State of Vermont
and the Contractor, but shall not exceed 15 business days after the Contractor
receives requirements. The requests are limited to the approved eligibility
change
rules framework of theR1
FINALThe solution must allow a user to submit a ticket to request the deletion ofan
ruleFR2.1-00s
R1FINAL
FR2.1-006
The solution must allow a user to submit a ticket to request the addition of an
eligibility rule.
R3The solution must allow a user to submit a ticket to request an update to the
view of an rule.FR2.1-007
R3FR2.8 The Contractor's System will allow for capturing of multi
to identify various population groups, including but not limited to:
a. vccl b. Hi-Tech c. High-Risk Pregnancy d. Pediatric Palliative care
Program e. Others as defined by the State f. Pregnant/post-partum women g.
ple criteria in order
Children to 6
RulesRl FinalFR2.13 The Contractor's System will allow for capturing of multiple sets of eligibility
rules in order to determine proglam eligibility for various AHS care
management programs, including but not limited to:
a. VCCI b. High-Risk Pregnancy c. Pediatric Palliative Care Program d.
Others as defined the StateRl.01FR2.14 The Contractor's System will maintain a record (e.g., audit trail) of
changes made. This must include but is not limited to: a) The User ID of the
person who made the change b) The date and time of change c) The
all
d The data before and after it wasinformation that was
Risk Stratification and Eligibility Determination
Establish Case Criteria
Sr.lrn or VrnvroNr, CoNrnncr FoR pnnsoN,q,r, SnnvlcnsDrpmrurNT oF VnnnnoNr HBar,ru AccnssEQHn,r.r,rn Sor,urrouso INc.
Pncn 148 or 268CoNrnc,cr # 28739
AunxovrnNr # 2
FR2.15 The contractor's System will conduct risk stratification to identify thespecific intervention populations (e.g., top 5%o, populations with gaps in care,specialty groups) including by geographic area
R1.01
FR2.16 The contractor's System will utilize clinically relevant predictive riskmodeling tools and gaps in care analysis for early screening and caseidentifi cation of Members
R1
FR2.17 The Contractor's System will identifu candidates that meet the predefinedcriteria
R1
FINALFR2.18 The Contractor's Systenr-will accept data from multiple sources to validate
program eligibility including but not limited to:a) claims b) clinical/Bio-MedicalData c) Data from Eligibility systems
R1
FR2.18-1program eligibility including but not limited to: a) Claims c) Data fromEligibility systems
The Conhactor's System will accept data from multiple sources to validate RIFINAL
FR2.19 The Contractor's System will accept and automatically screen all electronicreferrals for program eligibility
R2
FR2.20 The Contractor's System will automatically screen Candidates, in real-time,against applicable program eligibility rules and determine program elieibilitv
R2
FR2.21 The Contractor's System will provide supporting information and/ordocumentation as to why a Candidate was deemed ineligible
R2
FF.z.22 The Contractor's System will provide the ability for a User to reviewsupporting information and/or documentation of the criteria and/or eligibilityrules that a candidate did not meet at any point in time. The contractor'sSystem will not redirect a User to another screen to review the information
RIFINAL
FF.2.23 The Contractor' s System will allow a lJser, with appropriate access rights, tooverride the contractor's System's eligibility determination. For example,additional information gathered outside of the contractor's System becameavailable to overturn System's determination
R1FINAL
FF.2.24 The Contractor's System will allow a User to scan and associatedocumentation to support the User's overriding of the Contractor's System'seli gibility determination
RIFINAL
FP.2.26 The Contractor's System will log the date and time the Member wasdetermined to be eligible
R2
FP.2.27 The Contractor's System will have the ability to support flexible rules-basedlogic to determine care management program eligibility criteria for: a)Individual Member b) Target populations c) others as identified by theState during requirements and accepted via formal change control
RIFINAL
FR2.28 The Contractor's System will have the ability to use historical data to identifypotential participants for specific programs, including but not limited tohistorical data from the following programs:
a) Pediatric Palliative Care Program b) High Risk Pregnancyc) Department of Mental Health d) children with Special Health Needs e)
Alcohol and Drug Abuse Program f) Inpatient and Emergency Services g)concurrent review h) clinical operations unit i) tnpatient Psychiatry j)Substanee Abuse
R1
Srlrr or VnnuoNt, CoNtru,cr FoR PrRsoN.q,L SnnvrcnsDnpanrvrnNT oF VnRvroNr Hr.q.LrH AccEssEQHnalrn Sor,urroxs, INc.
Pacr 149 on 268CoNrnq.cr # 28739
AvrnNnunNr# 2
R3The Contractor's System will notify appropriate User when,
a Member's program eligibility needs to be re-determined (e.g., annual
redetermination, clinical change occurred)
based on policy,FF.2.29
The contractor's System will provide users a step-by-step process for R1
Conduct Outreach
FR2.30re-determination
PlannedRelease
RequirementNumber
R2The Contractor's System will support member outreach servlces
initiating contact with program-eligible Members, conducting intake
assessments) provided by User (Case Manager or third party)
(e.s.,FR3.1
Rl.01The Contractor's System will support member
initiating contact with program-eligible Members, conducting intake
assessments User Case
outreach services (e.g.,a
1
FR3FR3
1
1
R2FR3.2 The Contractor's System will automatically route Eligible Member's contact
information to User (Case Manager or third party) for outreach for non-direct
referrals l. an electronic referral The Contractor's S
R3FR3.3 The Contractor's System will notify User of the need for outreach or
intervention based on established criteria, including but not limited to:
a) Gaps in immunizations b) Clinical measures c) Other prescribed orpreventive care d) Missed schedules
R2FR3.4 The Contractor's System will allow Users (Case Manager or third party) to
log each contact made and'method used (e.g., electronic communication,
call outreach effortsR1.01FR3.4.a
FR3.4-1The Contractor's System will allow Users (Case Manager) to log each contact
made and method used (e.g., electronic communication, phone call) during
outreach effortsR2FR3.5 The Contractor's System will allow Users (Case Manager or
of each contact made during outreach efforts1og the outcome
third party) to
Rl.01FR3.5.aFR3.5-1
The Contractor's System will allow Users (Case Manager) to log the outcome
of each contact made during outreach efforts
Rl.01FR3.6 The Contractor's System will provide a predetermined list (e.g.,
menu) of contact outcomes which may include but is not limited to:
a) Contact made b) Left a voicemail c) Unable to leave voicemail
d) Met with Member in hospital, facility, etc.
dropdown
R3The Contractor's System will send alerts lnotifications to User (responsi
party) based on predetermined time intervals if the User has not
acknowledeed the case and taken action
bleFR3.7
R2FR3.8 The Contractor's System will escalate the case if the User has notthe case and taken action, based on pro policvacknowledged
R1The Contractor's System will allow User (Case Manager or third party) to
acknow outreach tFR3.9
Establish Case
Srarn or VnnvroNt, CoNrnacr FoR pERsoNAL SnnvrcnsDnpanrnrnNT oF VunvroNr Hnar,rn AccnssEQHn,tlru Sor,urroNs, INc.
P.tcB 150 or 268CoNrnq.cr # 28739
AvrnNrvrnNr # 2
FR3.l0 The contractor's system will track the time before outreach assignment isacknowledged
R3
FR3 11 The Contractor's System will display Member's contact information Rl.01FR3.12 The contractor's System will allow users to edit and/or add to Member's
contact information and indicate type (e.g., home, office, mobile) such as butnot limited to:
a) Primary phone number b) Secondary phone number c) Email address
Rl.01
FR3.13 The Contractor's System will allow Users to add additional contacts (e.g.,Member's care taker, legal guardian) and associated contact information toMember's case. Information includes but is not limited to: a) Primaryphonenumber (e.g., home, office, mobile) b) Secondary phone number (e.g., home,office, mobile) c) Email address d) Relationship to Member
RI.01
FR3.14 The Contractor's System will allow Users to send electronic communicationif an email address is available
R2
FR3.l5 The contractor's system will record all electronic communication andassociate it with the Member's case
R2
FR3.16 The Contractor's System will allow Users to document Member's decision toaccept or decline services of any and all programs Member is eligible for
Rl.01
FR3.l7 The Contractor's System will provide a predetermined list (e.g., dropdownmenu) of reasons for declining services
Rl.01
FR3.19 The contractor's System will allow a case Manager to reassign outreachefforts to an appropriate party
R2
FR3.20 The contractor's system will allow a user to create a Member case record(e.g., Member has accepted program-specific services) for each new case
R1.01
FR3.21 The Contractor's System will allow a User to close a program-specific caseand have the Contractor's System automatically notify (via email or hard copyletter) appropriate parties (including Authorized Representative, Member,Community Provider/Partner, and referral source) if the Member chooses notto effoll in the care
R2-R3
Assign Case ManagerFF.3.22 The Contractor's System will store Case Manager profiles which include but
is not limited to:a) Skill set / scope of practice b) Geographic location c) Caseloadd) Schedule I avallabilitv e) Co-management team
R1
FF.3.22-1 The Contractor's System will store case Manager profiles which include butis not limited to: a) competency/ Scope of practice b) Geographic location c)Caseload d) Schedule / availability
R1
FINAL
FR3.23 The Contractor 's System will allow Users, with appropriate access levels, toedit Case Manaser orofiles
R1
FINALFR3.24 The contractor's system will have the capability to automatically and/or
allow users to manually assign an appropriate case Manager, as determinedby specific program, based on alignment of Case Manager's prof,rle withMember's needs / profile
Rl.01
R1FINAL
Surn or Vnnvronto CoNtRl.cr FoR PnRsoN.q,L SnnvrcnsDpplntvrnNT oF VnnuoNr Hnu,rn AccsssEQHnalru Sor,urroNs, INc.
PlcB 151 or 268
CoNrru.cr #28739AMENDMENT # 2
Automatic assignment will exclude behavioral health
and will be achieved in Rl.03conditions for Rl.02
FR3.25 -1 The solution must have the ability to route a case to a staff member
FF.3.25-2 The solution must have the ability to assign a case to a staff member. R1
FR3.26 The Contractor's System will notify appropriate Case Manager of case
assignment
R1.01
FR3.27 The Contractor's System will send reminders / alerts to Case Manager, based
on predetermined time intervals, if the Case Manager has not acknowledged
the
R3
R2FR3.28 The Contractor's System will escalate the case if the Case Manager has not
acknowledged the assignment and taken action within predetermined
based on
FR3.29 The Contractor's System will have access to Case Managers schedules (e.g.,
vacation time) and will not assign or escalate if the Case Manager is
scheduled to be out ofoffice
R1
FR3.30 The Contractor's System will allow Case Manager to document decision to
accept or decline the case assignment
Rl.01
FR3.31 The Contractor's System will provide a list of applicable Case Managers forcase reassignment in the event the originally assigned Case Manager declines
assignment. The list may be based on but is not limited to: a) Geographic
location / neighboring county b) Telephonic community partner The
Contractor's System will provide a list of applicable Case Managers for case
reassignment in the event the originally assigned Case Manager declines
assignment. The list may be based on but is not limited to:
a) Geographic location / neighboring countyb) Telephonic community partner
c) Conflict of interest (e.g., family membe
R1
FINAL
FR3.31-1 The Contractor's System will provide a list of applicable Case Managers forcase reassignment in the event the originally assigned Case Manager declines
assignment. The list may be based on but is not limited to: a) Geographic
location / neiehboring county b) Telephonic community partner
Rl.02
Additional Staff to Case
FR3.33 The Contractor's System will allow authorized User to document assignment
of additional care team members (and roles) who do not have access to the
Contractor's S
R2
FR3.34 The Contractor's System will display a list of all Users who are currently or
were previously involved in Member's case
R1
FINAL
FR3.35 The Contractor's System will display a list of all current or previous programs
a Member is involved inR2
FR3.36 The contractor's System will display a list of Staff roles (e.g., Nurse) and
Internal Units for a User to select fromR2
Srarn or Vnnvronr, CoNrrucr FoR pnnsoN.q,L SnRvrcnsDnr.rRrunNT oF Vnnuour Hnar,rn AccnssEQHnll,rn SolurroNs, INC.
PAGE 152 or 268CoNrnlcr # 28739
AMnNrorvrBNr # 2
FR3.37 The Contractor's System will display a list of Users, based on role selected, inalphabetical order beginning with the last name
Rl.01
FR3.38 The Contractor's System will display a list of Internal Units in alphabeticalorder
R2
FR3.39 The contractor's System will allow for case Manager to search for a User(e.g., Care Manager) and/or Internal Unit based on multiple searchparameters, such as but not limited to:
a) Begins with b) Ends with c) Exact match
R2
FR3.40 The contractor's System will allow for all, multiple, or single options to beselected
FR3.41 The contractor's system will allow for case Manager to select reason foradditional case assignment from a predetermined list (e.g., dropdown menu)
R1
FR3.42 The Contractor's System will have access to Staff email addresses R2FR3.43 The Contractor's System will send a notification to the newly assigned Staff
andlor Internal UnitsR2
FR3.43.aFR3.43-1
The Contractor's System will send a notification to the newly assigned Staff RlFINAL
FR3.44 The contractor's system will allow for newly assigned Staff andlor InternalUnit to or decline case assignment
R2
FR3.44.aFR3.44-1
The Contractor's System will allow for newly assigned Staff to accept ordecline case assignment
Rl.01
FR3.45 The contractor's System will allow newly assigned Staff andlor Internal Unitto select from a predefined dropdown list of answers to accept or decline caseassignment
R2
FR3.45.a The contractor's System will allow newly assigned Staff to select from apredefined dropdown list of answers to accept or decline case assignment
R1
FR3.46 The Contractor's System will allow Users to document and save caseassignment decision
Rl.01
FR3.47.a The Contractor's System will allow Case Manager to assign a specificMember Problem, Goal, and/or Intervention to newly assigned Staff fromdefined down list
R1
FR3.47-l The Contractor's System will allow Case Manager to assign a specificMember including the components of the case (IGI) to newly assigned Stafffrom defined drop down list
R1
FINAL
FR3.48.a The contractor's System will allow newly assigned staff to assign specificMember Problem, Goal, and/or Intervention from defined drop down list
RI
FR3.48-t The Contractor's System will allow newly assigned Staff to assign a specificMember including the components of the case (IGI) from defined drop downlist
R1FINAL
FR3.49.aFR3.49-1
They System will send a notification to the case Manager of newly assignedStaffls decision
RI.01
Srarn or VrnvroNt, CoNtnacr FoR PBRsoNa,r- SnRvrcnsDnpanrvrrNT oF VnnvroNr Hnar,rn AccnssEQHn.Llrn Sor,urroNs, INc.
Pacn 153 or 268CoNrRlcr # 28739
AunNovrnNr # 2
GeneralRl.01FR3.50 The contractor's System will have the ability to support supervisory
operations for the management of workflow including:a) As si gnments/re- as si gnments and prioritiesb) Status querying and monitoring of individual documents and other work
steps or productsc) Work allocation and load balancingd) Approval for work assignments and work deliverables via a tiered
approache) Ability to take necessary action or provide notification when corrective
action is needed, including the ability to modify or abort a workflow process
f) Monitoring of key information regarding a process in execution,
including:i. Estimated time to completionii. Staff assigned to various process activities111. error conditions
Rl.01The Contractor's System will allow Users to skip and return to screens
outside of the workflowFR3.51
R2FR3.52 The Contractor's System will allow Users to create a case for a Member who
has not been determined ble
Member's Profile SummaryPlannedRelease
Number Requirement
R1FR4.1 The Contractor's System will display an easy-to-read summary of Member's
profile, based on lJser's role and access level and state and federal policy,(health background and needs) which includes but is not limited to:
a) Basic demographics (e.g., need for interpretation services) b) Risk acuity
c) Allergies d) Code status e) Involved Community Providers/Partners f)Most recent lab data g) Most recent appointments and upcoming
appointments h) Prior history i) Previous case workers j) Reenrollment or
new case k) Clinical triggersl) Notes m) Completed assessments n) Gaps in care (e.g., Member with
elevated A1c, Member with 4 ED visits in past 6 weeks, Member withmedication fill gaps) o) Advanced care directives p) coLST / PoLST q)
Date of last successful contact with Member r) socio economic indicators ofhealth s other insurance sources
Rl.01The Contractor's System will display an easy-to-read summary of Member's
profile, based on lJser's role and access level and state and federal policy,(health background and needs) which includes but is not limited to: a) Basic
demographics (e.g., need for interpretation services) b) Risk acuity c)
Allergies d) Code status f) Most recent lab data g) Most recent appointments
and upcoming appointments h) Prior history i) Previous case workers j)Reenrollment or new case k Clinical Notes m
FR4.1-1
Perform Screening and Assessments
Sr.tru or VnnuoNro CoNrnacr FoR pnnsoN.{r, SnnvrcnsDrpanrunNT oF VnnuoNr Hrlr,rn AccnssEQHnnlrn Sor,urroNs, INc.
PAGE 154 or 268CoNrnncr #28739
AvrnNuvrnNr # 2
assessments n) Gaps in care (e.g., Member with elevated Alc, Member with 4ED visits in past 6 weeks, Member with medication fill gaps) o) Advancedcare directives q) Date of last successful contact with Member r) socioeconomic indicators of health s) other insurance sources
FR4.1-2 The contractor's System will display an easy-to-read summary of Member'sprofile, based on user's role and access level and state and federal policy,(health background and needs) which includes but is not limited to: a) Basicdemographics (e.g., need for interpretation services) b) Risk acuity c)Allergies d) code status e) Involved community Providers/Partners f) Mostrecent lab data g) Most recent appointments and upcoming appointments h)Prior history i) Previous case workers j) Reenrollment or new case k) Clinicaltriggers l) Notes m) Completed assessments n) Gaps in care (e.g., Memberwith elevated Alc, Member with 4 ED visits in past 6 weeks, Member withmedication fill gaps) o) Advanced care directives q) Date of last successfulcontact with Member r) socio economic indicators of health s) other insurancesources
Additional fields identified during JAD session will be available in Rl.03o Risk factorso
R1
FINAL
R1FINAL
FR4.2 The contractor's System will allow Users, with appropriate access levels, togenerate and print a Member's profile summary
Rl.01
FR4.3 The contractor's system will auto-populate a Member's medication list inreal-time. Information includes but is not limited to:
a) Amount ofpills b) Date filled c) Pharmacy and Prescriber
R2, R3
FR4.4 The contractor's System will allow case Managers to reconcile Member'smedication list to monitor use and continuity of care
R1FINAL
FR4.5 The Contractor's System will allow for printing of Member's medication list Rl.01FR4.6 The Contractor's System will provide a history of the AHS programs a
Member is enrolled in. This includes but is not limited to programs:a. Previously applied to b. Currently eligible for c. Previously part of
R1
Perform Screening and AssessmentsFR4.7 The contractor's System will allow lJsers, based on role, access to completed
screenings and assessments. Information includes but is not limited to: a)Results b Date c AS
RI.01
FR4.8 The Contractor's System will auto-fill data fields in screenings andassessments as much as possible and where applicable. This may include butis not limited to Member information such as:
a) Demographics b) Clinical data c) Previous pregnancy historyd) Primary care Provider e) obstetrics (oB) Provider f) Dental provider g)
Dental history
R3
FR4.9 The contractor's System will use branching logic to determine assessmentquestions
Rl.01
Srarn or VnnuoNt, CoNtrucr FoR PnnsoN.q'L SnnvrcnsDppnnrvrnNT oF Vunvroxr Hnar,rn AccnssEQHnl.lrn Sor.urroNs, INc.
P,tcn 155 or 268
Conrnq.cr #28739AunNlunNr # 2
R1.01FR4.10 The Contractor's System will display assessment questions in abut will allow for User to move
logical order,
Rl.01The Contractor's System will allow for quick and easy responses to
assessment questions (e.g., dropdowns, radio buttons, freeform text)FR4.11
R1
FINALFR4.12 The Contractor's System will save in progress based on preset intervals
R1
FINALThe Contractor's System will flag incomplete assessments for follow-upFR4.13
R1FINAL
FR4.14 The Contractor's System will alert point-in-time Case Manager if assessment
R1.01The Contractor's System will save completed assessments
with Member's Plan of Care
and associate itFR4.15
R1.01FR4.16 The Contractor's System will maintain a record (e.g., audit trail) of all
involved in conducting an assessment. This must include but is not limited to
a) The User ID of the person who initiated the assessment
b) The User ID of the person(s) who updated / edited the assessment (Users
with edit rights to be identified by State)
c) The date and time of changes and assessment completiond) The information that was changed
parties
e The data before and after it wasR1.01The Contractor's System will provide nationally recognized screening
assessment tools for chronic conditions, psycho-social, behavioral, substance
abuse, mental health, etc. with branching logic to prevent redundancy and
and
inform the Plan of Care
FR4.17
R1The Contractor's System will notify Case Managers and/or appropriate care
team members when an assessment is due / needs to be redone (e.9., PHQg
assessments are done quarterly, High Risk Pregnancy Follow-up), as defined
by program policy
FR4.18
FR4.20
Create Plan of Care
R1FINAL
The Contractor's System will have the ability to add new assessment tools,
based on State
PlannedRelease
RequirementNumber
R1FR5.1 The Contractor's System will pre-populate and generate a
evidence-based, integtated Plan of Care (POC) and document date of creation.
Common POC fields may include but is not limited to:
a) Problem (must be case relevant/specific and measureable)
b) Problem status i) Stages of change c) Priority d) Goal(s)
e) Barrier(s) f) Intervention(s) g) Status h) Self-management
logical and
Plan
Treatment Plan and Outcomes
St.trn or VnnuoNt, CoNtnacr F,oR pnnsoN,c.L SnRvtcnsDrpantvrnNT oF VnnvroNr Hnar,rn AccnssEQHnt rH Sor,urroNs, INc.
P.q.cn 156 or 268CoNrrucr # 28739
AvrsNnvmNr # 2
FR5.l-1 The Contractor's System will pre-populate and generate a logical andevidence-based, integrated Plan of Care (POC) and document date of creation.common Poc fields may include but is not limited to: a) problem (must becase relevant/specific and measureable) b) Problem status i) Stages of changec) Priority d) Goal(s) e) Barrier(s) f) Intervention(s) g) Status h) Self-management
Rl.01
FR5.2 The contractor' s System will generate evidence-based, disease-specifi cinterventions based on standard nursing Dx and be case management specific.Interventions are program-specifi c and support evidence-based care.
Rl.01
FR5.3 The Contractor's System will provide a recommendation as to which servicesare applicable, based on answers submitted to program-specific assessments.For example, for the Pediatric Palliative care Program (PPCP), the followingservices are provided:
a) Care Coordination b) Family Training c) Expressive Therapyd) Skilled Respite e) Anticipatory Grief Counseling / Bereavement
Counseling
R3-+3R1
FR5.4 The contractor's System will allow for case Manager to edit / modify thedetails of a System-generated POC from a predefined list (e.g., dropdownmenu) that includes but is not limited to:
a) Problem (e.g., medication non-adherence, missing action plan(s), potentialknowledge deficit)b) Relevant Goals (e.g., medication adherence, Member understands how,
when, and why he or she needs to take medication)c) Relevant Interventions (e.g., phone call, review medication education,
coaching, face-to-face, care coordination)
Rl.01
FR5.5 The contractor's System will display list of problems, relevant goals andinterventions in an organized way, i.e., evidence-based by disease, bycondition, by readiness for change
Rl.01
FR5.6 The contractor's system will allow for a user, with appropriate access rights,to update the dropdown list of Problems, Interventions, and Goals
RIFINAL
FR5.7 The Contractor's System will consolidate Problems, Goals, and Interventionsif more than one disease is being addressed (i.e., redundant problems, goals,and interventions will not show up if applicable to multiple diseases) and linkback to each problem.as appropriate (LDL level link to both diabetes andcAD)
Rl.01
FR5.8 The contractor's System will allow for case Manager to assign target dates toMember's Goals and Interventions
Rl.01
FR5.9 The contractor's System will auto-populate target dates, where appropriateand based on program policy
R1
FINALFR5.11 The Contractor's System will save Plan of Care and associate it with
Member's caseRl.01
FR5.12 The Contractor's System will allow Case Manager to enter additionalcomments (freeform text) in defined sections for provider communication
RIFINAL
FR5.13 The contractor's system will display prior summaries for users to modify(e.g., to update
R2
Stl.rn or Vnnuont, CoNtru,cr FoR PnnsoNl, SrnvrcnsDnpLnrvrnNT oF VrnuoNr Hn.q.LrH AccnssEQHn.Llrn Sor,urronso lt'lc.
PAGE 157 or 268
CoNrru,cr #28739AvrrNnunNr # 2
FR5.14 The Contractor's System will provide an easy-to-document and effective
method to track Member's progress and outcomes (e.g., goal addressed,
interventron
Rl.01
FR5.15 The Contractor's S will allow for of a Member's entire POC Rl.01
FR5.16 The Contractor's System will provide a printable summary of Member's POC
that highlights pertinent information based on evidence-based best practice to
be shared with PCP (hard copy or electronically)
Rl.01
FR5.17 The Contractor's System will allow for the POC to be saved and emailed
el from within The Contractor's S
R2
FR5.17. The Contractor's System will allow for internal users to send and receive
the POC within The Contractor'sR1
FR5.17-1 System will allow for the POC to be exported as a PDF so it can be emailed or Rl.01
FR5.19 The Contractor's System will have the ability to provide role-based access to
Member's POC
R1
FR5.21 The Contractor's System will provide Users, with appropriate access rights, a
real-time view of Member information entered by registered Communityproviders/Partners. This includes but is not limited to information found in
Irn- assessments b Member's Care Plan
R3
Action Plans
FR5.26 The Contractor's System will automatically display condition-specific Action
Plan to Member's Plan of Care
R1
FINAL
FR5.27 The Contractor's System will allow for Case Manager to select Action Plan(s) R1FINAL
FR5.28 The Contractor's System will allow for all, multiple, or single Action Plan(s)
to be selected at one time
RIFINAL
FR5.29 The Contractor's System will auto-populate Action Plan(s) with available
information, where appropriate (e. g., Member contact information)R1
FINAL
FR5.30 The Contractor's System will allow for Case Managers (with appropriate
rights) to edit / modify Member's Action Plan(s). Action Plans must be in
simple, clear, concise language at an appropriate reading level for Member
R1
FINAL
FR5.31 The Contractor's System will allow for Community Providers/Partners (with
appropriate rights) to edit / modify Member's Action Plan(s). Action Plans
must be in simple, clear, concise language at an appropriate reading level for
Member
R2
FR5.32 The Contractor's System will save Action Plan(s) and
Member's Plan of Care
associate it with R1
FINAL
FR5.33 The Contractor's System will allow for printing of Action Plan(s) R1
FINAL
FR5.34 The Contractor's System will allow for Action Plan(s) to be saved and
emailed from within The Contractor'sR3
FR5.34. The Contractor's System will allow for internal users to send and receive
Action S within The Contractor's S),
R1
Srarr or VrnuoNr, CoNrnacr F.oR pnnsoxar, SnnvrcrsDnpaRrunNT oF Vnnvrorrlr Hrar,rH AccrssEQHnnr,rn Sor,urroNso INc.
PAGE 158 oF 268CoNrnncr # 28739
AvrnxovmNr # 2
Provide Education MaterialsFR5.36 contractor's system will have a repository of accepted, up-to-date and
nationally recognized electronic education materials for Case Managers toprovide to Members, that are written at an appropriate reading levetloth
for Member
The RFINAL
FR5.37 contractor's System will maintain a repository of contractor and state-provided accepted, up-to-date and nationally recognized electronic education
The
materials for Users e. health co case
R2
FR5.38 contractor's system will recommend education materials applicable toMember's Plan of care. List of educational materials germane to thecondition will be searchable and automatically displayed for userconsideration.
The R2
FR5.39 Contractor's System will allow Case Manager to select appropriateeducation materialsThe R2
FR5.40 The contractor's System will allow for all, multiple, or single educationmaterials to be selected at one time
R2
FRs.42 's System will allow for education materials to be emailedfrom within the Contractor's S
The Contractor R2
FR5.43 contractor's system will allow for education materials to be saved andTheattached to emails
R1
FR5.44 The contractor's system will allow for printing of education materials R1
FINALFR5.46 s System will save the selected education materials and
associate it with Member's Plan of Care
The Contractor' R1
FRs.46-1 contractor's System will save the selected education materials andassociate it with Member's record by uploading it in the Attachments sectionand document in session notes.
The R1FINAL
Case DocumentationNumber Requirement Planne
dRelease
FR6.1 flexibilityThe Con stractor' S will the for Ua toserystem provide modifyofdates Member's Sal
Rl.01
FR6.2 contractor's system will display list of all Problems, Goals, outcomesand Interventions associated with MemberThe R1.01
FR6.3 Contractor's System will allow Users to hide and unhide completedInterventions and GoalsThe R1
FINALFR6.4 's System will allow Users to sort by components of the pOC,
including but not limited to: Interventions, Problems, Goals and outcomes
The Contractor
e. intervention due da condi
Rl.01
FR6.5 contractor's System will allow users to select by components of thePOC, including but not limited to: Interventions, problems, Goals and
The
Outcomes intervention due condi
Rl.01
FR6.6 Thebes
contractor's System will allow for all, multiple, or single interventions toelected
R1
Case InformationM
Srarn or VnnvroNt, CoNtru.cr FoR PrnsoN.c.L SnnvrcBsDnrLRrvrBNT oF VrnvroNr Hn.q.r,rn AccrssEQHn,urn Sor,urroNs, INc.
P.tcn 159 or 268CoNrntct # 28739
AvrrNovrpur # 2
FR6.6-1 The System will allow for interventions to be selected and edited Rl.01
FR6.7 The Contractor's System will display a structured and standard form to
document completed Interventions that includes but is not limited to:
a) Date b) Mode (e.g., telephone, electronic community, face-to-face, letter)
c Duration 1n mrnutes Outcome e Notes
Rl.01
FR6.8 The Contractor's System will provide a dropdown list of outcome types forInterventions
R1.01
FR6.9 The Contractor' s System will allow for freeform text (notes) Rl.01
FR6.10 The Contractor's System will save updates and associate it with Member's
Plan of Care
Rl.01
FR6.l1 The Contractor's System will maintain a record (e.g., audit trail) of al1
changes made. This must include but is not limited to:
a) The User ID of the person who made the change b) The date and time ofchange c) The information that was changed d) The data before and after itwas
Rl.01
FR6.12 The Contractor's System will allow Users, with appropriate access rights, to
update or augment Member's contact informationRl.01
FR6.13 The Contractor's System will allow Users to designate a primary mode ofcontact
Rl.01
FR6.14 The Contractor's System will be able to connect the mother's case information
with the newborn's case information
R3
FR6.15 The Contractor's System will have the ability to monitor Member data to
determine if referred andlor authorized services are
R2
FR6.16 The Contractor's System will support follow-up actions as needed to identi fyservices delivered (claims payment information), issues impeding delivery ofservice andl or Member's
R2
R3FR6.17 The Contractor's System will have the ability to update a Member's case
history with possible revisions including but not limited to: a) Needs
assessment b) Plan of Care c) Associated Community Provider/Partner list
Case file information contact dates and times
The Contractor's System will allow Users to enter freeform text to
communicate supervisory review / comments
R2FR6.20
FPi6,22 The Contractor's System will accept claims data in both ICD-9 and ICD-I0formats
R1FINAL
FR6.25 The Contractor's System will display a calendar with options for different
views (e.g., work week, fullweek, day, month)R2
FR6.26 The Contractor's System will provide a structured and standard calendar form
that includes but is not limited to:a) Appointment category (e.g., Employee PTO, Member intervention,
services) b) Meeting type (e.g., phone call, in-person) c) start and end date
d) Start and end time e) Attendee list f) Meeting location g) Meeting
instructions h) Reminder I alert schedule (e.g., one week before, one day
2 hours
R3
Sr,rrn or VnnuoNr, CoNrucr F,oR pnnsoN,qr, SrnvrcnsDnpanrvruNT oF Vnniuoxr Hnar,rn AccnssEQHnalrn Sor,uuoNs, INc.
PAGE 160 or 268CoNrntcr # 28739
AvrnNnvrnNr # 2
FFi6.27 The contractor's system will allow for multiple attendees to be added to anqppointment
R3
FR6.28 The Contractor's System will allow email addresses to be manually entered R2FR6.29 The Contractor's System will provide a directory to store contact information R2FR6.30 The contractor's system will allow meeting creator to attach documents R3FR6.31 The Contractor's System will have access to Member calendars based on
appointments previously / currently scheduled in the contractor's systemR2
FR6.36 The Contractor's System will save appointment invites R3FR6.37 The Contractor 's System will electronically deliver appointment invites to
attendees listed (email address )R3
FR6.38 The contractor's System will allow attendees RSVP options which include:a) Accept b) Tentative c) Decline d) New time proposed
R3
FR6.39 The Contractor's System will track attendee RSVPs R3FR6.40 The Contractor's System will allow attendees to include a message to RSVP R3FR6.41 The Contractor's System will noti fy appointment creator of RSVP responses R3FR6.42 The contractor's system will allow appointment creator to modify meeting
detailsR2
FR6.43 The contractor's system will electronically deliver updated appointmentinvites to attendees listed
R3
FR6.44 The contractor's System will highlight the changes made to the appointmentdetails (e.g., location, date, time) as part of the updated invite
R3
FR6.45 The Contractor's System will allow appointment creator to cancel anappointment
R2
FR6.46 The contractor's system will electronically deliver a notification that anappointment has been cancelled to attendees listed
R3
FR6.47 The Contractor' S System will delete a cancelled appointment from calendars R2FR6.48 The ContraCtor's System will log the time, date, and User ID of the User who
theR2
FR6.49 The contractor's System will provide a map of the appointment location R3
FR6.50 The contractor's System will provide attendees the option to retrievedirections to meetins location
R3
FR6.51 The contractor's system will pre-populate the destination address based onthe appointment'location'detail when attendees opt to retrieve directions
R3
FR6.52 The Contractor's System will display miles to location R3FR6.56 The Contractor's System will allow for appointment creator to set
appointments as a recurrence. with overall start and end datesR2
FR6.58 The Contractor's System will allow Members and CommunityProviders/Partners to respond to meeting invites via respective portal account
R2
Sr.lrn or Vnnvroxt, CoNtru.cr FoR PnnsoN.q,L SnnvrcnsDnp.qnrNInNT oF VrRivroNr Hn,q,I,tn AccnssEQHnalru Sor,urroNso INc.
Plcn 161 or 268
CoNrnc.cr # 28739AunxovrnNr # 2
Document Case DispositionFR6.59 The Contractor's System will provide a simple and efficient method for
documenting a case's disposition status. The method may include a structured
and standard form that will include areas such as but is not limited to:
a) Member's progress towards achieving Goal(s) (improvement made, no
improvement, etc.) b) Risk level (high, medium, low) tied to a program or
Goal c) Opportunities available d) Case in transitione Death date Incarcerated out
RlFINAL
FR6.60 The Contractor's System will provide a pre-determined list (e.g., dropdown
men of tions for each of the areas addressed
RlFINAL
FR6.61 The Contractor's System will provide a brief defi nitiorVdescription for added
clarification for each of the predetermined list (e.g., dropdown menu) ofdi tion
R1FINAL
FR6.62 The Contractor's System will not move the User away to another windowwhen the definition/ is accessed
R1FINAL
FR6.63 The Contractor's System will provide a section to allow Users to enter
freeform text notes
Rl.01
FR6.64 The Contractor's System will save case disposition and associate it withMember's Plan of Care
Rl.01
FR6.65 The Contractor's System will maintain a record (e.g., audit trail) of allchanges made. This must include but is not limited to: a) The System as the
entity that made the change b) The date and time of change c) The
information that was changed d) The data before and after it was changedThe
Contractor's System will maintain a record (e.g., audit trail) of all changes
made. This must include but is not limited to:
a) The User ID of the person who made the change b) The date and time ofchange c) The informaiion that was changed d) The data before and after itwas
Rl.01
TransitionFR6.66 The Contractor's System will provide a structured and standard method to
initiate a referral
R1
FINAL
FR6.67 The Contractor's System will pre-populate the referral form with the profile
of the User logged into the Contractor's System (e.g., Case Manager).
Information includes but is not limited to: a) First and last name b) Title c)
Department d) Contact information (email address, Phone number. etc.)
R1
FINAL
FR6.68 The Contractor's System will pre-populate the referral form with the referral
date
R1
FINAL
FR6.69 The Contractor's System will pre-populate the referral form with the profile
of the Member that is being referred. Information includes but is not limited
to:a) First and last name b) Date of birth c) Language(s) spoken
d) Residential address e) Contact information (email address, phone number,
etc. 51S
R1FINAL
FR6.70 The Contractor's System will allow User to enter freeform text to
communicate notes / comments such as but not limited to:Rl.01
Suru or VnnuoNt, CoNrnacr FoR prRsoNlr, StnvrcnsDnp,lnrunNT or VnnvroNr Hnar,tn AccBssEQIInar,rn Sor,urroNs, INc.
PAGE 162ot268CoNrrucr # 28739
AvrnNourNr # 2
a) Reason for referral b) Referral urgency c) Explanation of attacheddocuments
FR6.71 The contractor's System will allow user to request referral acknowledgement R2
FP!6.72 The Contractor' s System will allow electronic documents to be attached to thereferral
R2
FR6.73 The contractor's System will display a pre-developed list of availableCommunity Providers/Partners, including but not limited to:
a) Substance Abuse Treatment Facilityb Food Bank
R2
FR6.74 The Contractor's System will allow User to search for appropriateCommunity Provider/Partner based on multiple combinations, such as but notlimited to:
a) Services / programs provided b) Community Providers capacityc) Proximity to Member's residential address d) Proximity to public
e s
R2
FR6.75 The Contractor's System will display a list of qualified CommunityProviders/Partners that meet the search criteria
Rl.01
FR6.76 The Contractor's System will allow User to further refine or expand criteriabased on results
R1
FR6.77 The contractor's System will allow for all, multiple, or single communityProviders/Partners to be selected at one time
RI
FR6.78 The contractor's system will save and associate referral with Member's planof Care
Rl.01
FR6.79 The Contractor's System will allow for printing of a referral R1FINAL
FR6.81 The Contractor's System will allow a User to send the referral electronicallyto identified Community s)/Partner(s)
R2
FR6.82 The contractor's system will send a secure notification to communityProvider(s)/P s) that a referral has been made
R2
FR6.83 The Contractor's System will provide a method for CommunityProvider/Partner to acknowledge receipt of referral if requested by the User.The method may include but is not limited to a structured and standard formthat includes:
a) community Provider/Partner's first and last name (main point of contact)b) community Provider/Partner's contact information (email address, phonenumber, etc.) c) Status of referral (accepted, waitlisted, declined)
R2
FR6.84 The contractor's system will allow community Provider/Partner to enterfreeform text to communicate notes / comments to referral acknow ledgement
R2
FR6.85 The contractor's System will allow community Provider/Partner to attachfiles to referral acknowledgement
R2
FR6.87 The Contractor's System will allow for ofreferral acknow R3FR6.88-1 The Contractor's System will display a list of referrals that have been made as
well as capture/display referral outcome such as - a) Refenal successful b)Referral in Progress, c) Referral withdrawn, d) Referral Unsuccessful
R1FINAL
Sr,c.rn or VnruuoNt, CoNtru.cr FoR PnRsoNnl SnnvrcnsDnpnnruBNT oF Vnnuonr Hr.ll,rn AccnssEQHn,rlrn Sor,urroNs, INc.
P.tcB 163 or 268
CoNrnq.cr # 28739AvrnNnvrnNr # 2
FR6.89 The Contractor's System will display a summary of information regarding a
submitted referral, which may include but is not limited to:
a) Date and time of referral b) User who submitted referralc) Member information d) Community Provider/Partner informatione) Service lprogramrequested f) Referral status
RI
FR6.89-1 The Contractor's System will display a summary of information regarding a
submitted referral within the system, which may include but is not limited to:
a) Date and time of referral b) User who submitted referral c) Member
information d) Community ProviderlPartnet information e) Service / program
requested 0 Refenal status
R1FINAL
FR6.90 The Contractor's System will allow for referrals to be searched by multiplefilters, such as but not limited to:
a) Date and time of referral b) User who submitted referral c) Member
information
R1
FINAL
FR6.91 The Contractor's System will allow original referrer to modify a
referral
submitted R1
FINAL
FR6.92 The Contractor's System will save and associate modified referral to
Member's Plan of Care
R1FINAL
FR6.93 The Contractor's System will maintain a record (e.g', audit trail) of allchanges made. This must include but is not limited to: a) The User ID of the
person who made the change b) The date and time of change c) The
information that was d The data before and after it was
Rl.01
FR6.94 The Contractor's System will allow a User to send the modified referral
electronically to identifi ed s
R2
FR6.95 The Contractor's System will send a notification to CommunityProvider/Partner and highlight the changes made to the referral since the
submitted referral
R3
FR6.96 The Contractor's System will allow for printing of a modified referral R1
FINALFR6.98 The Contractor's System will allow User to document and save reason for
and associate it with Member's Plan of Care
R1FINAL
FR6.99 The Contractor's System will send a cancellation notice to
Provider/Partner that referral has been withdrawnCommunity R2
FR6.100 The Contractor's System will maintain a record (e.g., audit trail) ofreferrals. This must include but is not limited to:
a) The User ID of the person who withdrew the cancellation
withdrawn
b The date and time cancellation notice was sent
R1
FINAL
FR6.10l The Contractor's System will have the ability to track transitions between
levels of care and Community Provider/Partners and alert Users when
transitions occur
R3
Close Program EnrollmentFR6.l02 The Contractor's System will display Problems in the Plan of Care that have
not been met. The Contractor's System will hide Problems that have been
but will the for a User to view at an trme
Rl.01
FR6.103 The Contractor's System will provide a simple and
closing a case for a Program enrollmentefficient method for Rl.01
Srlrn or VnnvroNr, CoNrrucr FoR pnnsoNar, SnRvrcnsDrpanrnrnNT oF VnnuoNr Hnar,rn AccrssEQHnalrn Sor,urroNs, INC.
P.lcn 164 or 268CoNrnacr # 28739
AvrnNnvrBlcr # 2
FR6.104 The contractor's system will allow for all, multiple, or single problems to beselected and updated with the same status, which can include but is notlimited to: a) Resolved b) Unresolved c) Partially resolved
Rl.01
FR6.105 The contractor's system will allow for all, multiple, or single Goals to beselected and updated with the same status, which can include but is notlimited to:
a) Met b) Unmet c) Partially met
Rl.01
FR6.106 The contractor' s System will automatically close outstanding Interventionsthat are associated with a Goal that has been statused as 'Met'
R1
FINALFR6.107 The contractor's System will save changes and associate it with Member's
Plan of CareR1
FINALFR6.108 The Contractor's System will allow for User to select reason for case closure
from a predetermined list (e.g., dropdown menu)Rl.01
FR6.109 The Contractor's System will provide a section to allow User to enterfreeform text (notes )
Rl.01
FR6.110 The Contractor's System will alertcurrently scheduled for Member
User of future appointments that are R2
FR6.111 The Contractor's System will allow User to moditi andlor cancelappointments
R2
FR6.112 The Contractor's System will allow User to designate the case as 'closed' Rl.01FR6.113 The Contractor's System will update and save case status and associate it with
Member's Plan of CareRl.01
FR6.114 The Contractor's System will maintain a record (e.g., audit trail) of allchanges made. This must include but is not limited to:
a) The User ID of the person who made the change / closed caseb) The date and time of change / closed casec) The information that was changedd) The data before and after it was changed
Rl.01
FR6.115 The contractor's system will allow users to set alerts / notifications forcertain Goals andlor Problems to follow-up on, along with appropriate contactinformation, after a case has been statused as closed
RI
FR6.116 The contractor's System will allow for all, multiple, or single components ofthe record to be selected and updated with the status of "Death" and the dateof death when the reason for Case Pro enrollment closure is death
R3
Care CoordinationFR6.118 The contractor's System will provide role-based access to Internal Units
based on need to view Member detailsR2
FR6.119 The contractor's system will display Internal units that are involved in aMember's Plan of Care
R2
FR6.120 The contractor's System will display contact information of Internal Units(main point of contact) that is involved in a Member's Plan of Care
R3
GeneralFP.6.t22 The contractor's system will have the ability to search care management data
(according to role-based access defined by the State) by any of the following:Member name, Member ID, and/or Community Provider/Partner ID
Rl.01
Srarn or VrnvroNt, CoNtRlcr FoR PrnsoN.q,L SnnvrcrsDupanrvrnNT oF VpnvroNr Hn,c.LrH AccnssEQHn,tI,rn Sor,urroNso INc.
PacB 165 or 268CoNrntcr # 28739
AvrnNourNr # 2
R2FR6.123 The Contractor's System will have the ability toassigned/decided by the State) to case management data, including but not
limited to: a) Program data and imaged documentation b) Member
information (e.g., hospitalization, LTC facility, pharmacy, PA information,State Plan services) c) Claims data, including pharmacy claims d) Historical
case, claims and enrollment data e) Eligibility information f) Benefit
packages g) Community Provider/Partner information h) Case notes i)Case activity codes j) Others as identified by the State and accepted via
provide role-based access (as
formal change controlThe Contractor's System will have the ability to monitor Rl.01FR6.124
Health Outreach
to
member adherence
PIannedRelease
RequirementNumber
R1
FINALThe Contractor's System will have the ability tobased on a preset schedule and using near real-time data, to be determined by
the State/Department, as well as on an ad-hoc basis. Panel report parameters
may include but is not limited to:a) Disease b) Population age range c) Provider (including offtce location
when locations
pull various Panel reportsFR7.1
R1.01FR7.2 The Contractor's System will store profiles of Users, which includes but is not
c locationlimited toR1
FINALFR7.3 The Contractor's System will automatically assign an appropriate User
locationon
based
R1
FINALThe Contractor's System will have the ability for User to capture contact
information of Clinical Leads at Provider sites including but not limited to:
a) Office address b) Contact information (email address, phone number, etc.)
c) Specialty area(s)
FR7.4
R1
FINALFR7.5 The Contractor's System will allow Users to log contacts with Clinical Leads
at Provider sitesR4 R3FR7.6 The Contractor's System will allow Users to schedule
Clinical Leads at Provider sites
appointments with
R1
FINALThe Contractor's System will save log of contactsFR7.7
R1FR7.8 The Contractor's System will allow Users to track conversation history and
action items with Community Partners around Population-Based Healthin-Care
R1
FINALThe Contractor's System will have a repository of appropriate, el
education materials
ectronicFR7.9
R1FINAL
The Contractor's System will allow Users to select appropriate educationImaterials based on
FR7.10
R1FR7.11 The Contractor's System will allow Users to select all, m
educational materials at one timeultiple, or single
Health OutreachManage
Srlrn or VnnuoNr, CoNrucr FoR pnnsoNar, SnRvrcnsDrpnnrvrnNT oF VnRvroxr HEALTH AccnssEQHnalrn Sor,urrons, Inc.
PAGE 166 or 268CoNrntcr #28739
AivrnnuvrrNr # 2
FR7.11-1 's System will allow Users to select educational materials forThe Contractorthe member
RFINAL
FR7.12 contractor's System will allow Users to electronically send educationalmaterials to Clinical Leads at Provider sites
The R1
FR7.13 The Contractor'associated with
s System will allow for education materials to be saved andation Health record
RI
FR7.14 The Contractor's S will allow for of education materials R1FR7.16 The Contractor's System will
performance measures basedallow the User to document and update Program
on an agreement with Clinical Leads forpopulation or practice
R1
FR7.17 The Contractor's system will provide the ability to use MMIS data to supportpopulation health analyses
R1FINAL
FR7.18 contractor's System will have the ability to receive population data fromvarious extemal entities. Data should include but not be limited to: a) Censusdata b) Vital statistics c) Public health data d) Vermont Health InformationExchange e) eHealth Exchange f) other as identified by the state duringrequirements validation and accepted via formal change control
The R3
FR7.19 The Contractor's System will'have the ability to track and maintain detail forpopulation health initiatives including but not limited to:
a) originator / source of inquiry b) Data source(s) used c) Strategy (orstrategies) developed in response to data analysis d) Trends (ED/Ip) byHospital Service Area e) Others as identified by the State during
validation and via formal control
R1
contractor's System will monitor Emergency Department admissions, re-hospitalizations, short stays and re-admissions for recidivism, and
FR7.20
M
The
for intervention
R1
FINAL
Number Requirement PlannedRelease
FR8.4 The Contractor's System will have the ability to track information as neededfor
R1
FINALFR8.5 The contractor's System will have the ability to create a patient health
registry with information about Members who may be experiencing a clinicalgap in adherence to clinical standards and barriers
R1
The Contractor's System will have access to up-to-date CommunityFR8.6 R3
Referral
MMIS and2-7-1Provider/Partner data
Number Requirement PlannedRelease
FR9.2 Contractor's System will allow documents to be attached to bothTheand electronic referrals.
R2
Authorization Determination
Srarn or VnRvroNt, CoNtnACT FoR PnnsoNal SnRvrcns
Dnp.q.nrNInNT oF VnnvroNr Hnar,rn AccnssEQHnllrn Sor,urroNs, INc.
Pacn 167 or268CoNrru.cr #28739
AvrnNuivrBNr # 2
R2FRg.6 The Contractor's System will allow Users to acknowledge
and notify Referring Party of candidate's eligibility or ineligibilityelectronic referrals
R2FRg.7 The Contractor's System will allow Users to notifli Referring Party of referral
statusR1
FINALThe contractor's System will allow User to enter freeform text to
notes / comments to referral acknowcommunicateFRg.8
R1
FINALFR9.9 The Contractor's System will allow User to attach files to referral
acknowR2The Contractor's System will allow for inter-agency referrals,
include but is not limited to: a) Date and time of refenal b) Referring party
name, contact information (e.g., email address, phone number), and role /department c) Member name and contact information d) Reason for referral
e) Preferred outcome f) Referral condition (new referral, resubmission) g)
Notes
which willFRg.10
R1FR9 11 The Contractor's System will pre-populate inter-agency
contact information, which may include but is not limited toreferrals with User's
a Role/Title dFirst name b Last name c
PlannedRelease
RequirementNumber
R1
FINALFRl0.1 The Contractor's System will be capable of pulling reports in
CSVformats
different file
R1FINAL
The Contractor's System will allow different access levels of viewing and
versusanalFRl0.2
R2The Contractor's System will save previously pulled reports for qfuture access
uick andFRl0.3
R3FR10.4 The Contractor's System will create and maintain an auditable list of all Users
and whichthat accessedR3The Contractor's System will provide a mechanism to archive and delete
oftain order toFRl0.5
R1FR10.6 The System will provide the ability to upload external data sets
BVAnalytics area of the vendor product. The Contractor's System willwithin the
the abili to external data setsR1
FINALThe Contractor's System will have the ability to produce charts, graphs, etc.
trends etc.in order to showFRl0.7
R1
FINALThe contractor's System will have access to multiple data sources
but not limited to: a) Claims b) Surveys c) Clinical/Bio-Medical DataincludingFR10.8
R1
FINALThe Contractor's System will have access to multiple data sources including
but not limited to: a ClaimsFR10.8-1
R1
FINALThe Contractor's System will provide reportingby the Contractor, such as but not limited to: a) Statistical tools i.
regression ii. Predictive modeling iii. risk stratification b)
tools, set-up and configured
Comparing c) Filtering d)
FRl0.9
Reportin
Sr,rrn or Vnnvronr, CoNrucr F,oR prnsoNar. SrnvrcnsDnpnRrwrnNT oF Vnnuoxr Hnar,rn AccEssEQHno-rn Sor,urroxso Inc.
Pacr 168 or 268CoNrnacr #28739
Avrnivnvrnxr # 2
FRl0.10 The contractor's System will have the capability for a user to select specificdataparameters, including but not limited to Member, Provider, and metricsand allow drilling down to view more detailed information, where available
R1FINAL
FRl0.r 1 The contractor's System will allow saving and attaching reports to aMember's Plan of Care or Population Health Management record
RIFINAL
FRl0.12 The Contractor's System will allow printing of reports R1FINAL
FR10.13 The contractor's System will provide reports, set-up and configured by thecontractor, to be automatically generated based on a predefined schedule anddistributed to subscribed Users on a periodic basis. Distribution may be as anelectronic attachment or a notification, alerting User that the report is ready tobe downloaded
R3
FRl0.14 The contractor's system will have the capability for users to specify certainfor standard
R1
FRl0.14-1
The Contractor's System will have the capability for Users to specify certainparameters for standard reports through the ticketing process. The followingcc Reports will be included in Rl.02: . Resource utilization Breakdown(RUB) - Overall, By Age, By Gender .IJtllization Measures -Hospitalization, ED visits, chronic condition Prevalence. clinical - chroniccondition Registry, Pharmacy Measures . Predictive - chronic conditionRegistry, Pharmacy Measures, Actuarial Cost Projections . programRecommendations - care coordination Program Profiles, care CoordinationProgram Projections . Population Reports (Frogram Metrics) - StandardReport, Provider Report, Productivity Report, Program Assessment Report .Population Reports - Encounters Report
The following BI Data Models will be included: ACG, GIC, program Metrics,and Encounters
R1FINAI-
FRl0.15 The Contractor's System will display a template for the user to specify reportparameters, which includes but is not limited to:
a) Reporting period (last month, last quarter, customized date range, etc.) b)Population characteristics c) Geography d) Member e) CommunityProvider/Partner f) Practice g) Community h) State (both cost and clinicalresults)
R1FINAL
FRl0.16 The Contractor's System will allow Users to specify one or multiple R1FINAL
FRl0.18 The Contractor's System will pull detailedthe Contractor, such as but not limited to:
reports, set-up and configured by
a) Cost reports (i.e., significant changes in spending per member, costsavings) b) Hospital admissions (based on claims data) c) ED usage (basedon claims data) d) Emergency Department visits e) provider visits fl caseduration g) Individual (e.g., Members with Diabetes Assessment completed,Members without lab data, date of last visit, etc.) g) Hospital service Area i)Dx specific (Members with Diabetes on Problem list, even if not primary) j)urinalysis completed for substance abuse patients k) case Manager's
toward achievement Case effectiveness l.e.
R1
Surn or VBnvroNt, CoNtru,cr FoR PnnsoNar, SnnvrcnsDnpanrvrnNT oF VBnvroNr IIn.q.LrH AccnssEQHnalrn Sor.urroNs, INc.
P.q.cn 169 or 268
Colrrntcr #28739AnlnNonnnxr # 2
measure reduced or no ED visits, measure reduced or no ambulatory sensitive
IP admission)
FRl0.19 The Contractor's System will leverage HEDIS for program performance
measurement
R1
FR10.20 The contractor's System will produce Panel reports that include gaps ln cafe
for specific conditions and provider grouDS
R1
FRt0.21 The Contractor's System will be able to track and measure outreach R1
FR10.22 The Contractor's System will be able to create a clinical metrics dashboard R1
FR10.24 The Contractor's System will have the ability to collect, track, and report on
outcome mgasures
R1
R1FR10.25 The Contractor's System will have the ability to generate reports to monitor
and cost ofcare to members
FR10.26 The Contractor's System will provide the ability to access and report on
encounter data for the purpose of monitoring appropriateness of care
R1FINAL
FR10.27 The Contractor's System will provide multi-dimensional, flexible, ad hoc
reports across business functions, set-up and configured by the Contractor,
which meetbut are not limited to the following reporting needs: a) Financial
reporting b) Budget forecasting c) Fiscal planning and control d) Cash flowe) Recipient cost and User of services f) Cost/benefit analysis g) Prescription
drug policy h) Cost and User of prescription drugs i) Recipient participationj) Eligibility and benefit design k) Geographical analysis l) Program
planning m) Policy analysis n) Program performance monitoring o) Medical
assistance policy development p) Capacity Planning q) Providerparticipationr) Service delivery pattems s) Adequacy of and access to care t) Quality of
care u) Outcomes assessment v) Disease management w) External reporting
x Public information
R3
FR10.28 The Contractor's System will provide the ability to generate a listing of allstandard on-line reports available, the description ofeach report, and provide
a link to the most recent
R1
FR10.29 The Contractor's System will provide a process by which reports may be
delivered by email in accordance with HIPAA rules
R3
FR10.30 The Contractor's System will provide the ability for Users to extract data,
manipulate the extracted data, and specify the desired format and media of theR1
FINAL
R1FRl0.31 The Contractor's System will provide the ability to track and store detailed
information regarding all reporting requests including but not limited to: a)
Who requested the information b) Date c) Time d) What the report included
e com Route the entire on-line
FR10.32 The Contractor's System will be able to collect, track, and report on
individual staffR1
FRl0.33 The Contractor's System will provide the ability to generate a high-cost
member report to determine potential participation in care managementRIFINAL
Surn or VnnvroNr, CoNrnacr FoR PnnsoN,rr, SnnvrcnsDnplntnanNT oF VnnvroNr Hnar,rn AccussEQHn,urn Sor,urroxs, INc.
PAGE 17O oF268CoNrnq.cr # 28739
AivrnnnvraNr # 2
FR10.34 The Contractor's System will have the ability to query both clinical andclaims data for Members in order to analyzeperformance of current programsand to conduct "what-if' analyses
Rl, R2
FR10.36 The Contractor's System will have the ability to query data and extract reportsto analyze effectiveness of Medicaid dollars granted to Medicaid programsand other agencies in support of care management goals
R3
FRl0.37 The Contractor's System will support the entry of free-form text field(number of characters as approved by the State during requirementsvalidation) associated with each request/analysis, including identification ofUser and date/time entered
R3
FRl0.38 The Contractor's System will have access to Body Mass Index (BMI) data,both by System calculation (based on height and weight) and from medicalrecords
R2, R3
FR10.39 The contractor's system will allow for ad hoc reporting of inpatient facilityadmission data
R3
FR10.40 The contractor's System will collect and report on appropriate High-RiskPregnancy data elements, set-up and configured by the Contractor. Thisincludes but is not limited to: a) Gestational age atreferral b) Date of contactwith member c) Amount and type of contact (e.g., phone call, office visit,home visit) d) Date closed e) Last Menstrual Period (LMP) f) FinalExpected Due Date g) Date of initial prenatal visit h) Number of prenatalvisits i) Maternal complications j) Date of postpartum visit k) Birth weightD NICU stay m) Height n) Weight at LMp o) BMI p) progesteronescreening q) Tobacco use screening r) Post-partum depression screening s)Prenatal visits
R3
FR10.4l The contractor's system will allow Users to pull ad hoc reports. parametersand data elements may include but are not limited to:
a) Geographic location b) Staff engagement c) Clinical metrics d)Financial metrics e) Family satisfaction f) Unplanned utilization (i.e.,Emergency Department visits for hard-to-manage pain) g) cost expenditurecomparison (children with comparable illness enrolled in PPCP versus notenrolled in PPCP) h) Diagnostic couplingi) causation / correlation (e.g., do the interventions lead to reduced costs,
what interventions speci fically) j) Cost-benefit analysis
R1
FR10.42 The contractor's System will allow an atthoized user to design a surveyinstrument for Members, family members, and CommunityProviders/Partners. The survey instrument must be highly configurabledepending on the needs of the surveyor
R2
FRl0.43 The contractor's system will allow an atthoized User to distribute theelectronic survey to Members, appropriate family members, and communityProvider/Partners. The survey can be distributed via multiple channels,including but not limited to: a) Phone b) Mail c) Online (i.e., CommunityProvider/Partner Portal) d) Email
R2
FRl0.44 The Contractor's System will allow an authoized User to schedule predefinedsurveys as a recuffence (e.g., every 3 months post intervention for up to 12months)
R2
Srarn or YnnuoNt, CoNtnacr FoR PrnsoN,q,L SnnvtcnsDpp,q.nrvrnNT oF VnnuoNr Hranrn AccESS
EQHnnlrn SolurroNs, INc.
PAGE 171or268CoNrnacr #28739
AvrnNtunNr # 2
FR10.45 The Contractor's System will accept User entered survey results (online) and
manually entered results by an authorized User
R2
FRl0.46 The Contractor's System will update the Survev Response data stores R3
FR10.47 The Contractor's System will have analysis tools for authorized Users to
revlew
R2, R3
FR10.48 The Contractor's System shall have the capability to generate and displaypopulation, program and member-based dashboard reports, set-up and
configured by the Contractor, based on claims and intervened data.
Population and program-based dashboard reports may include but is notlimited to:
a) Characteristics of a population (e.g., Number and percentage of program
participants by program type, percentage of participants enrolled in multiplepro$anls / services, highest-cost diseases, geographic conditions) b) Program
and collaboration caseload information (e.g., Number of cases by program, bycase manager worked on in a day, status (active / inactive), aggtegate view ofalerts and notifications, referrals received, new messages / shared notes,
defined case milestone and outcome objectives) c) System performance and
quality assurance reports (e.g., Data quality, System performance) d)
Program performance (e.g., correlation between program interventions and
cost, deeper cost diseases)
Member-based dashboard reports may include but is not be limited to:
a) Member's program participation compared to Member populationparticipation and overall population participation b) Member's health profile
to Member and overall ation
R3
FR10.49 The Contractor's System will have the ability to automatically or manuallypopulate, maintain and display multiple indicators at the Member level (e.g.,
disease management, TBI)
R1
FINAL
FR10.50 The Contractor's System will have the ability to conduct analysis of Member
services rendered and its direct impact on Member's conditionR2, R3
FRl0.51 The Contractor's System will collect and report on geoglaphic data sets to
include high use and high cost patterns (i.e. diabetes gaps in care and
associated care costs in the etc.
R1
FR10.52 The Contractor's System will collect and report on geographic data sets to
include but is not limited to:a) High risk families b) Children in custody for Department for Children
and Families
R3
FR10.53 The contractor's System will provide geographic mapping / hot spotting forpredefined high-risk Members and populations (e.g., zip code mapping of
ED Users
RI
FR10.54 The Contractor's System will have the ability to generate federally/state
required reports for Care Management as determined by the State.
R3
Srlrn or VnnvroNT, CoNTRACT FoR prnsoNar, SnRvrcrcsDnpanrnnnNT oF Vnruroxr HEALTH AccnssEQHn,Llrn Sor,urroNs, INc.
Pacn 172 oF 268CoNrnrcr #28739
AvrnNuvrnNr # 2
Consent ManagementNumber Requirement Planne
dRelease
FRI 1.1 The contractor's system will have the capability to allow a user to recordconsent that is given by a Member in order to share his/her informationbetween two or more agency programs and associated CommunityProviders/Partners. Agency can include other parts of state govemment.
R2
FRl1.2 The Contractor's System will support security controls to limit the entry ofconsent information to those with appropriate S ystem-level access
R1
FRl1.6 The contractor's System will record the consent and associated updates in acentral location. The consent may contain but is not limited to: a) Entityobtaining the consent from Member (pre-populated from user information)b) Specific Providers and I or entities contained in the consent (e.g., agencies,departments, program, services or providers who can share information) toallow two-way sharing of information c) Specific individuals contained in theconsent to allow two-way sharing of information d) Type and focus of theinformation covered (granularity and parameters to be determined byVermont policy) e) Types of information (e.g., benefit and eligibilityinformation, medical records, assessments, test results, claims and palmrents)f) Areas of sharing (e.g., behavioral health, mental health, Chronic Care,High-Risk Pregnancy) g) Purpose of the sharing of information (e.g.,congruency and coordination of care, continuity of care) h) Expirationconditions of the consent: i. Period of time from date consent is given ii.Specified end date iii. Specific event (e.g., end of required collaborativeservice delivery, end of treatment) iv. Other conditions
R2 R3
FRl1.7 Contractor's System will automatically populate information related tothe Member providing consent. Member information may include, but is notlimited to:
a) First and Last Name b) Date of Birth
The R3
FRl1.8 The Contractor's System will provide the option to indicate if a third party isproviding consent on behalf of a Member (conservatorship, parent, otherauthorized third party, etc.)
R1FINAL
FRl1.9 The Contractor's system will allow a User to capture verbal consent from aMember in order for Member to participate in the program and/or for caseManager to speak to Member's Authorized Representative
R1FINAL
FRl 1.1 1 The Contractor's System will provide a printer-friendly version of the consentas well as the canned forms for printing
Rl.01
FR11.14 The Contractor's System will have the capability to attach a soft copy of theconsent to a Member record. Note: The benefit of attaching a soft copy of theconsent is the ability to store Member signature. Access rights within TheContractor's System cannot be enforced until the data is entered.
R2
FR 5111 The Contractor's System will maintain an auditable record of all consentsrecorded, accessed and access attempts as well as additions, changes anddeletions to the consent
Sr.q.rn or VnnuoNt, CoNtn-a,cr FoR PnnsoN,q,L SrnvrcnsDnpaRrvrnNT oF VnnvroNr Hn.qlrH AccnssEQHn,tlrn Sor,urroNs, Inc.
Plcn 173 or 268
CoNrRtcr # 28739AvruNtvrnNr # 2
FR11.16 The Contractor's System will allow Users to capture a Member revoking
consent at any time and will notify authorized Users who will take appropriate
action
R2
FRl1.l6-1
The System will allow Users to A) capture a Member revoking consent at any
time
R1.01
FRl1.17 The Contractor's System will allow Users to capture a Member modifyingconsent at any time
R1.01
FRl1,19 The Contractor's System will allow Users to search for a Member's consent
record
R2
FRl1.20 The Contractor's System will display a list of all consent records matching the
search criteria
R2
FR11.21 The Contractor's System will allow a User to update the Member consent
record
R2
FRl1.23 The Contractor's System will allow Users to print or email a copy of the
updated consent record to the Member or another User, as appropriate and
within oolicy
R2
State of Vermont - Care Management Reporting Requirements
ReportingRequirement
Description Data Source Report orOuerv
Audience Freque
1 StaffPerformance
NEl0. 1 3 Provides detailson Staff productivity overa predefined timeframe.Staff parameters mayinclude the individual,departments, etc. R3
Contractor'sSystem
Report
Query
VCCIManagement andVCCIStaff
Ondemand
2 CapacityPlanning
NE1 0. l4 Provides detailson caseload by staffovera predefined timeframeR3
Contractor'sSystem
Report
Query
VCCIManagement
Ondemand
J VCCIMemberPopulationCount
NE10.15 Provides countof total (unduplicated)VCCI members enrolledin the Program over a
predefined timeframe as
well as total count ofmembers by condition,location, provider (Rl)
Contractor'sSystem
Report
Query
VCCIManagement
Ondemand
4 GeographicVariability byChronicDiseaseincludingchronic
NEI 0. 1 6 Provides detailson population report ongeographic variability ofchronic diseases - "hotspotters" by geographyand practice (prevalence
Contractor'sSystem
MMIS
Report
Query
VCCIManagement andVCCIStaff
Ondemand
Srarn or VnnvroNr, CoNrucr FoR pnRsoNn SnnvtcnsDppanrunNT oF Vnnuour Hn.q.LtH AccnssEQHn,urn Sor,urroNs, INc.
P.tcn 174or268CoNrnc.cr # 28739
AnnnNrunNr # 2
diseaseprevalence bypractice
of condition(s) by a)region, b) providerpractice) R3
5 MemberAdherence
NEl0. I 7 Provides detailson member adherence tomedication for a specificcondition as well as
percentage of enrolledmembers with completedassessments andmedication adherenceissues R3
Contractor'sSystem
PBM System
Needs tobe point intime, andable to pullat anytime.
VCCIManagement andVCCIStaff
Nearrealtime
6 MembertsGap in Care
NEl0.18 Identifiespossible members withgaps in care based ontheir condition (R1)
Contractor'sSystem
MMIS
Needs tobe point intime, andable to pullat anytime.
VCCIManagement andVCCIStaff
Nearrealtime
7 RegionalSnapshot
NEl0.19 Providespro gram information forspecific geographicalareas (R1)
Contractor'sSystem
Report
QueryVCCIManagement andVCCIStaff
Ondemand
8 Clinicaloutcomes byMember
NEl0.20 Providesoverview of clinicaloutcomes achieved bymember such as
improved AIC (AlC),less ED utilization, etc.(R3)
Contractor'sSystem
Report
Query
VCCIManagement andVCCIStaff
Nearrealtime
9 Clinicaloutcomes byPlan of Care
Provides overview ofclinical outcomesachieved by differentplans of care for specificconditions
Contractor'sSystem
Report
Query
VCCIManagement andVCCIStaff
Ondemand
10 Plan of CareMetrics
NEl0.22 Provides a
summary of the plan ofcare metrics by condition,etc. (R1) S
Contractor'sSystem
Report
Query
VCCIManagement andVCCIStaff
Ondemand
11 VCCIOperationalMetrics bothon individual
NEl0.23 ProvidesProgram-specificoperational metricsincluding but not limitedto:
Contractor'sSystem
Report
Query
VCCIManagement andVCCIStaff
Nearrealtime
Srlrn or VnnvroNt, CoNtnlcr FoR PnnsoNu. SnnvrcnsDnp.lnrNInNT oF VnnuoNr llnll,rn AccnssEQHn.lr,rn Sor,urroxs, INc.
P.tcn 175 or 268
CoNrnq.cr # 28739AMnNnrvrnNr # 2
and teambasis
- Percentage of caseloadcapacity, those withSNA, etc. based on givenmetrics re: staff. (R3)
I2 EmergencyDepartmentVisits
Provides a count of totalEmergency Departmentvisits by Member for apredefined time frameand hospital; review ofutilization of hospitalservices versus setting uppredefined hospital;during specifiedtimeframe --i.e. 3 monthsprior to CM intervention,then 3-month s/p CMintervention.
Contractor'sSystem
MMIS
Report
Query
VCCIManagement andVCCIStaff
Ondemand
13 ReferralSources
NEl0.25 Providesinformation on externalreferral sources TheContractor's System has
captured (Rl)
Contractor'sSystem
Report VCCIManagement andVCCIStaff
Ondemand
14 Assessmentsby ConditionoAcuity
NE10.26 Provides thenumber and type ofassessment by condition,acuity (R1)
Contractor'sSystem
Report VCCIManagement andVCCIStaff
Ondemand
15 MemberDashboard
NEl0.27 ProvidesMember's health profilecompared to Memberpopulation profile andoverall population profile(R3)
Contractor'sSystem
MMIS/enterprise
Dash-board
VCCIManagement andVCCIStaff
Ondemand
I6 ClinicalMetricsDashboard
Provides a dashboardwith clinical metrics,including but not limitedto-- Asthma, PrescriptionAdherence- CHF, ACEI/ARBAdherence- CHF, Preferred BetaBlocker Adherence- Diabetes, Annual LipidPanel (1 or more)- Achievement of
Contractor'sSystem
MMIS
Report
Query
VCCIManagement andVCCIStaff
Ondemand
Surr or Vnnuonr, CoNrrucr FoR PnnsoNaL SnnvtcnsDnplRrvrnNT oF' VnnvroNr Hnar,rn AccnssEQHnar,rn Sor,urroNs, INc.
Pacr 176 or 268CoNrntcr # 28739
AvrnNnvrpNr # 2
goals/intervention orprogress toward goals- Social needs
t7 Memberreports
NEl0.29 Provides cost ofservice for each memberfor a predefinedtimeframe (6 month lookback) (Rl)
Contractor'sSystem
MMIS
Report
Query
VCCIManagement andVCCIStaff
Nearrealtime
18 Providerreports
NE10.30 Contractor'sSystem
Report orQuery
VCCIManagement andVCCIStaff
Ondemand
t9 SASHDashboardReports
NEIO3I Provide a pointofreference forpopulation and individualhealth of SASHparticipants through avisual representation ofthe number ofparticipants within a
specific SASH site, or forall SASH sites, with afocus on key data pointsand measures collectedby SASH
Contractor'sSystem
Report SASHwellnessnurses,carecoordinators, andoperations
managers
Ondemand
20 BlueprintPCPPerformanceReports
NEl0.32 Provideperformance informationon PCPs in terms ofmeasures for keepingpatients with chronicconditions withingoalhange for thoseconditions to includedrill-down into outreachreports, specifi c patientdata and visit planners,and trending over time(such as l2-month lookback). These reportswould providecomparative analyses onproviders against otherproviders within apractice, within the HSA,and across the State. (R3)
Contractor'sSystem
Report BlueprintPCPs
Ondemand
Sr.lrn or VnnvroNt, CoNtru.cr FoR PnnsoN,q'L SnnvrcnsDnpaRtnnnNT or VrnvroNr Hn,q.r,rn AccnssEQIIn.lr,ur Sor,urroNs, INc.
Pr.cB 177 0t268CoNrnacr #28739
AMENDMENT # 2
2l FQHC UDSReports
NEl0.33 Clinicalmeasure reports requiredby HRSA for FQHCs.For example, patientsages 18 - 75 with a
diagnosis of diabetes,who meet all thenumerator targets of thiscomposite measure: Alc< 8.0, LDL < 100, BloodPressure < 140190,Tobacco non-User andfor patients withdiagnosis of ischemicvascular disease dailyaspirin use unlesscontraindicated. (R3)
Contractor'sSystem
Report FQHCS,Bi-State
Ondemand
22 To Do ListReports
NEl0.34 List those itemsthat have beiome due(based on a previouslyentered date) for the Userto work on. For example,a tobacco counselor mayindicate follow up with apatient who wasn't readyto be contacted to quitsmoking until after theholidays. (Rl)
Contractor'sSystem
Report All Users Ondemand
23 VisitCommentreport
NEl0.35 Print a
chronological summaryof interactions andoutreach for a patientrecord for sharing withother providers not usingThe Contractor's System.(Rl)
Contractor'sSystem
Report All Users Ondemand
Srarn or VnnvroNr, CoNrnacr FoR pnnsoNar, SnnvrcnsDnplRrvrnNT oF VnnvroNr Hn.q.LrH AccnssEQHnalrn Sor,urroNso INc.
IXII-
Pacn 178 or 268CoNrrucr # 28739
AvrBNnvrnNr # 2
G Generalized System Behavior RequirementsG1 UsabilityG2 Audit / ComplianceG3 Service Level Requirements (SLRs )and
PerformanceG4 Interface ListG5 General
T Technology RequirementsT1 bility / InterfacesT2 Scalability and ExtensibilityT3 Regulatory and SecurityT4 Health and Human Services Enterprise (HSE)
Platform AlignmentI Change Process Requirements - ImplementationII12 Environment Installation and ConfigurationI3 Knowledge Transfer & TrainingI4 Design, Development & CustomizationI5 Deployment16 Quality Managemento Process Requirements -o1 Production Support & Transition02 Defect Resolution and Solution Acceptanceo3 System Administrationo4 System Management
This Contract includes four (4) non-functional requirements categories andnineteen (19) sub-categories. The requirernents in each category and sub-category appear in a separate tab in this workbook. The categories and sub-categories are:l.lir i.):rLrrcriiLtlu ii'iliiilr
Srarn or VonvroNto CoNtnacr FoR PnRsoN.q,L SnnvrcnsDnplnrNInNT oF VrnvroNr Hral,rn AccnssEQHnu,rn Sor,urroNs, Inc.
Prcn 179 or268CoNrnq,cr # 28739
AnnnNrunxr # 2
The Contractor's System will provide a User interface that
will be simple and consistent throughout all areas and
Usabitity Requirements
Rl FINALGl.1
functions of the Contractor's S
Rl FINALThe Contractor's System will minimizethe number ofmouse clicks / User interaction to complete any action
Gt.2
Rl.01The Contractor's System will use a Graphical User Interface(GUD to help the User navigate to the next logical step in
the workflow, or freely navigate to other parts of The
Contractor's System functionality, and then allow the User
to return to complete the in-process task
Gl.3
RI.01GT.4 The Contractor's System will speak the Users'language,
with words, phrases and concepts familiar to the User, rather
than System-oriented termsR3-R4The Contractor's System will accommodate diverse
populations of Users including those with disabilities and
limited English proficiency as defined in section 504 of the
Rehabilitation Act of T913
Gl.5
Rl.01Gl.6 The Contractor's System will follow real-world Vermontterminology and conventions, making information appear ina natural and logical order
Rl.01The Contractor's System will allow the Users to easily
navigate to a variety of functions available to them withouthaving to move sequentially through excessive menus and
screens
GI.7
Rl.01The Contractor's System will include at minimum the
following features and capabilities :
a) Drill down and look up functionality to minimize re-
entry of information across multiple screens
b) Multi-tasking and multiple window capability, includingsplit screens
c) Search capabilities to allow retrieval by Provider,
Member, procedure code, NDC or others as defined by the
Stated) Ability to tab and mouse through data fields and screens
and to change tab order
Gl.8
Rl.01Gl.9 The Contractor's System will support undo and redo, orprovide onscreen confirmation/acceptance to the User to
confirm a change that is permanent and cannot be "undone"Rl FINALGl .10 The Contractor's System will provide Users with a clearly
marked "emergency exit" for the instances when a User
mistakenly chooses a function and such "emergency exit"must be simple with minimal
Number RequirementDescriPtion Planned Release
Suru or VrnuoNt, CoNtnacr FoR PrnsoNnr, SrnvrcnsDnpanrivrnNT oF VnnuoNr Hnlt,rn AccrssEQHnnlur SolurroNs, INc.
Plcn 180 or 268CoNrR.rcr #28739
AvrnNovrnNr # 2
G1.1 1 The Contractor's System will follow standardizedconventions and limit the use of words, situations, or actionsthat have multiple meanings
Rl FINAL
Gt.t2 The Contractor's System will eliminate error-proneconditions or check for them and present Users with aconfirmation option before they commit to the action
RI.01
Gl.13 The Contractor's System will minimizetheUser's memoryload by making oblects, actions, and options visible
Rl FINAL
Gl .14 The Contractor's System will provide the option to haverollover / tooltip help or context messages
R2
GI.15 The Contractor's System will provide all User instructionsin a visible or easily retrievable location, when apBropriate
Rl FINAL
GI.16Gl.16-1
The Contractor's System will cater to both inexperiencedand experienced Users
Rl FINAL
Rl FINALGI.18 The Contractor's System's effor messages will be expressed
in plain language, precisely indicate the problem, andsuggest a solution
Rl.01
Gl.19 The Contractor's System will use colors where they enhanceUser experience and System usability while complying withall disability requirements notated elsewhere in these
R3
Gt.20 The Contractor's System will allow the User to navigate toany functional component from a client landing pase
Rl FINAL
GT.2T The Contractor's System will alert the User withinformation relevant to required next steps
Rl.01
Gr.22 The Contractor's System will provide drop down and listboxes for all key entry, and text entry will display existingvalues for selection (system based auto fill) (but specificallydisallow User browser based autofill )
Rl.01
Gt.23 The Contractor's System will accommodate point and clickselection and check box entry for all relevant data entries toensure that the User does not have to enter textual datathatmay already be available to the Contractor's System
R1.01
Gt.24Gl.24-l
windows where usability is enhanced
The Contractor's System will facilitate data entry and willcontain pop-up list boxes for code fields in processing
Rl.01
Gt.25 The Contractor's System will provide field level on-screenedits with limited User override capabilities
Rl.01
Gt.26 The Contractor's System will provide the ability to makefields visible/invisible depending on parameters, LJser
4gb!$ consent, and access controls
Rl FINAL
GT.27 The Contractor's System will not show fields not accessibleto a given User based on access rights, member consent, norwill The Contractor's System show fields not in use
Rl.01
Surn or Vrnvronto CoNtucr FoR PnnsoNl,l, SnnvtcnsDnp,qntNInNT oF VnnuoNr Hn.q.r,rn AccnssEQHnalur Sor,uuoxs, Ilvc.
PAGE L81 or 268
CoNrru,cr #28739AvrnNnunNr # 2
G1.28 The Contractor's System cursor will automatically advance
to the next logical input field when the maximum allowednumbers of characters have been entered for the keyed fieldor when the User ses the "Enter"
Rl.01
Gt.29 The Contractor's System will provide the option of having a
selection from the drop down boxes automatically take the
User to the next field
Rl.01
G1.30 The Contractor's System will provide validation checks at
the time of each field entry as the default mechanismRl.01
Gl.31 The Contractor's System will identify invalid entries to the
User as immediately as
R1.01
GT.32 The Contractor's System will provide the ability to suggest
or automatically change entries that do not conform to data
entry standards, to be defined in the detailed system design
and meta data models in collaboration with the State
Rl.01
Gl.33 The Contractor's System will be designed to include onlythe necessary information and functionality on screens and
will be based on the Ljser's access level and the User's
confizuration
R1.01
GL.34 The Contractor's System will be designed to include logicaltransitions between screens and level of detail duringnavigation
Rl.01
Gl.35 The Contractor's System will provide templates for data
entry with identified mandatory and data fieldsRl.01
G1.36 The Contractor's System will allow incomplete data sets to
be saved for completion of the workflow at a later timeRl.01
Gt.37 The Contractor's System will highlight and flag required
and incomplete data fieldsRl.01
G1.38 The Contractor's System will include a graduated system ofalert levels to allow Users to determine urgency and
relevancy
R1 FINAL
G1.39 The Contractor's System will allow configuration ofnotifications by a User, for a User by a supervisor, and for a
User by a System administrator
R3
G1.40 The Contractor's System will allow for the request of orentry of data from extemal devices (e.e. tablets)
R1.01
G1.41 The Contractor's System will notify the User when a source
system is unavailable / inoperable and notify User. The
Contractor's System will display any alerts on the landingpage if a login is possible, or in an error web page if loggingin isn't possible.
R2
G7.42 The Contractor's System will not require Users to reenter
data due to validation errors if the Contractor's Systems can
auto-correct based on the entered data or the User can
navigate to the entry error to correct the entry
Rl.01
Surn or VnnvroNr, CoNrnacr FoR pnnsoNar, SnRvrcnsDppantvrcNT oF VnnuoNr Hnalrn AccnssEQHrar,rn Sor,urroNs, INc.
PAGE 182 or 268CoNrnncr #28739
AvrutwpNr # 2
GT.43 The Contractor's System will enable central workflow alertsand transactional status. The Contractor's System willcentralize pending work items for the User as in a "workqueue"
Rl.01
Gt.44 The Contractor's System will have the capability to pushmessages to the intended workers without requiring them tospecifically inquire for the data
RI FINAL
G1.45 The Contractor's System will provide a hover option overstate defined fields to generate a description of the dataelement
R3
Gt.46 The Contractor's System will provide linked access to helpfunctions which contain the appropriate information andsearch of all help information from every window, based onUser profiles
Rl.01
G1.48 The Contractor's System will be available on commonlyused browsers including, but not limited to, Chrome andFirefox and Microsoft Internet Explorer 9 or later versionswith the ability to provide data over a web browser interface(i.e. HTML over HTTP), and will include the capability toencrypt the data communicated over the network via SSL(HTML over HTTPS)
R2
Audit and
G2.l
uirements
The Contractor's System will maintain a record (e.g. audittrail) of all additions, changes and deletions made to data inthe system. This should be readily searchable by user ID ormember ID. This must include, but is not limited to:a) User ID of the person who made the change, b) date andtime of the change, c) Physical, softwarelhardware andlornetwork location of the person while making the change, d)Information that was changed, e) Outcome of the event, f)Data before and after it was changed, and g) Which screenswere accessed and used
R1.01
G2.2 The Contractor's System will allow an authorizedadministrator to set the inclusion or exclusion of auditableevents based on organizational policy & operatingrequirements/limits
R3
G2.2-1 The Contractor's System will allow an authorizedadministrator to request the inclusion or exclusion ofauditable events based on organizational policy & operatingrequirements/limits
R1.01
G2.3 The Contractor's System will support logging to a commonaudit engine using the schema and transports specified inAudit Trails and Audit Lo specifications. (
Rl FINAL
Srnrn or Vnnuoxto CoNtucr FoR PERSoNAL SnnvrcnsDnpanrivrrNT oF VnnvroNr Hnanrn AccnssEQHp,lLrn Sor,utroNs, INc.
Pacn 183 or 268
CoNrru.cr #28739AvrnNnvrunr # 2
G2.4 The Contractor's System will be able to detect security-
relevant events (as defined in NIST 800-53 moderate
baseline, rev 4) that it mediates and generate audit records
for them. At a minimum the events will include, but not be
limited to:a) Start/stop b) User logirVlogout c) Session timeout d)
Account lockout e) Member recordcreated/viewed/updated/deleted f) Scheduling g) Query h)
Order i) Node-authentication failure j) Sigpature
created/validated k) P ersonally Identifrable Information(PII) exportl) PII importand restore o
m) Security administration events n) Backup
Audit Event listed in IRS 1075
Rl.01
G2.5 The Contractor's System will provide authorized
administrators with the capability to read all auditinformation from the audit records in the following twoways:1) The Contractor's System will provide the audit records ina manner suitable for the User to interpret the information.The Contractor's System will provide the capability togenerate reports based on ranges of System date and timethat audit records were collected.2)The Contractor's System will be able to export logs into
text format in such a manner as to allow correlation based
on time (e.g. Coordinated Universal Time [UTC]
R1.01
G2.6 The Contractor's System will be able to perform timesynchronization using NTP/SNTP, and use thissynchronized time in all securitv records of time
R1.01
G2.7 The Contractor's System will have the ability to format forexport recorded time stamps using UTC based on ISO 8601
Rl FINAL
G2.8 The Contractor's System will prohibit all Users read access
to the audit records, except those Users that have been
sranted explicit read access
Rl.01
G2.9 The Contractor's System will protect the stored auditrecords from unauthonzed deletion. The Contractor'sSystem will prevent modifications to the audit records
RI.01
G2.t0 The Contractor's System will prevent modifications to the
audit records
Rl.01
G2.17 The Contractor's System will provide logging, reporting and
accessing elTors and exceptions
Rl.01
G2.12 The Contractor's System will provide capability forintegrating consent audit trails and data access audit trails ina consolidated searchable system for search/report to
support consent rule enforcement or investigation includingaudit trails based on rules or policies
Rl.01
Sraru or VrnvroNr, CoNrrucr FoR pnnsoNu, SnnvlcnsDnplnrvrnNT oF' VnnuoNr Hnar,rn AccEssEQHualrn SolurroNs, INc.
Pacn 184 or 268CoNrnncr # 28739
AvrnNuvrnnr # 2
G2.13 The Contractor's System will generate and protect consentaudit events at the same or better levels as other data accessaudit records
Rl.01
SLRs and Performance
G3.1 The Contractor's System response time during operationswill be 5 seconds or less for 95 percent of the search andlookup queries (does not include ad hoc queries andanalyics). Maximum response time for search and lookupqueries will not exceed 15 seconds except for agreed toexclusions. The Contractor shall investigate tickets fromSoV that report response times exceeding the maximumresponse time and provide an analysis to SoV The systemresponse time is defined as the time it takes for the server to
Rl FINAL
servlce aG3.2 The Contractor's System shall return each Dashboard report
(main, patient, provider, etc.) within 5 seconds or less, 950loof the time (
Rl FINAL
G3.3 The Contractor's System will return a Static Standard reportwithin 5 seconds or less, 95olo of the time (
Rl FINAL
G3.4 The Contractor's System will retum a parameter-basedreport within 20 seconds or less, 95olo of the time.
Rl FINAL
G3.5 The Contractor's System will achieve performance forinteractive transactions other than the reporting-relatedtransactions above, conforming to the minimum acceptableperformance standard of 5 seconds response time, for 95o/oof interactions
Rl FINAL
G3.6 The components of the Solution under Contractor control asdelivered into production shall be availabl e 99.7 5%o. Theavailability percentage will be verified with evidence fromthe Contractor. Scheduled maintenance will be allowedwith the prior approval of the State of Vermont (SoV). Anongoing monthly maintenance schedule requires just oneapproval. Additional scheduled maintenance requires SoVapproval at least 2 business days in advance. Scheduledmaintenance should occur outside normal business hours.
Rl FINAL
G3.7 The Contractor's System will be architected with no singlepoint of failure, supporting a high-availability enterprise
Rl.01
G3.8 The Contractor's System's hours of operations will be24hours per dav. 7 davs oer week- and 365 days a year (
Rl FINAL
G3.9 The Contractor 's System will have the ability to supportsession replication and transparent failover using high-availability architectural options
Rl.01
G3.10 The Contractor's System will be designed to support theplanned Vermont systems and any anticipated expansion inscope of connectivity
Rl.01
Sr,lrn or VnnvroNt, CoNtnacr FoR PrnsoNlr, SnnvrcrsDnpl,ntnlrNT oF VrnuoNr Hrar,rn AccnssEQHnn rn Sor,urroNs, INc.
Plcn 185 or 268CoNrru,cr #28739
AvrnNounNr # 2
G3.11
with expanded system usage
The Contractor' s System Administration staffi ng
requirements and workload should be minimally impactedRl FINAL
G3.72
capacity added), up to specified limit
The Contractor's System must be built so that there is a near
linear relationship between each additional server added,
and the additional load that can be accommodated (load vs.
R1.01
G3.13
restored within 4 hours
The Contractor's System's Recovery Time Objective (RTO)
will be within 4 hours. In case of a disaster that effects the
Care Management operations, the entire service will be
Rl FINAL
G3.r4 The Contractor's System's Recovery Point Objective (RPO)
will be no more than t hour of data loss. In case of adisaster that effects the Care Management operations, t hourof data inputs to the Contractor's System (but no more) maybe lost and need to be re-entered
Rl.01
G3.15 The Contractor's System will use fully redundant networkand hardware. Hardware components (such as processor
and memory) should have built-in redundancy to allow a
second component to take over in the event of a failure inthe primary component. Similarly, redundant paths should
also exist for networks
Rl.01
c3.16
havins to acquire additional hardware
The Contractor's System will leverage virtualization to
expedite disaster recovery. Yirtualization enables system
owners to quickly reconfigure system platforms without
Rl.01
G3.17 The Contractor's System will have the ability to support
either a Production and hot (real time replication) disaster
recovery design or a multi host site Production design that
would allow one site to seamlessly be offline and the other
site would maintain service without intemrption
Rl.01
G3.18 The Contractor's System will include a disaster recoveryplan and provide contingency plans for State lookupcapabilities and online collaboration in the event of adisaster
Rl.01
G3.19
error (
The Contractor's System will provide the ability to recover
from data loss due to end User error and end applicationRl FINAL
G3.20 The Contractor's System will provide the ability to perform
archival/incremental backups and the ability to performoperVclosed database backups
Rl.01
G3.27 The Contractor's System will provide tools for managing an
environment that supports both high availability and disaster
recovery
Rl.01
Srarn or VnnvroNr, CoNrrucr FoR PnnsoN.q,L SnnvrcnsDnpmrvrnNT oF VnnuoNr Hn.q.r,rn AccnssEQHnllrn Sor,uuolrs, INc.
PAGE 186 or 268CoNrucr # 28739
AvrnnuvrnNr # 2
G3.22 The Contractor's System will include the capability tomaintain all data according to state defined records retentionguidelines (i.e. record schedule). General schedules can befound at: httos://www.sec- vt.us/archives-records/records-mana gement/records-retention/ general -record-schedules.aspx. Specific retention disposition orderscan be found at : http s : //www. ses. state. vt.us/archives-records/records -mana qement/records-retention/dispo sition-orders.aspx.In general, document retentions range from 3 to 10 years. Inaddition to the above, note that case records including ChildSupport-related data must be retained for a minimum of 3years after Case closure and the youngest child in the case is18 years old.
Rl.01
G3.23 The Contractor's System will include the capability tomaintain all images and electronic documents according tostate defined document retention guidelines (i.e. recordschedule). General schedules can be found at:https ://www. sec. state.vt.us/archives-records/records-mana gement/records-retentiorV general-record-schedules.aspx. Specific retention disposition orders can befound at: httos://www vt.us/archives-records/records -mana gement/resords-retention/dispo sition-orders.aspx.In general, document retentions range from 3 to 10 years.
Rl.01
G3.24 The Contractor's System will provide on-line access of allactive cases and up to 12 months for closed cases
Rl.01
G3.25 All software developed and delivered by the Contractormust be free of viruses, malware, backdoors
RI.01
G3.26 The service provider must resolve Severity I Maintenancerequests within 4 clock hours (Rl.01)
Rl.01
G3.27 The service provider must resolve Severity 2 Maintenancerequests within 24hours
Rl FINAL
G3.28 Severity 2 Maintenance requests are to be prioritized (seePriority Level definitions) jointly by SoV and the Contractorand scheduled accordingly for investigition, correction anddeployment into production.
Rl FINAL
G3.29 All priority 3 or higher defects (testing defects) resultingfrom software development activities shall be resolved bythe Contractor prior to the software being delivered for UserAcceptance Testing and prior to deploynent to production
Rl FINAL
G3.31-1 The Contractor must resolve priority 2 test defects within anaverage of 3 (three) days, but no more than a maximum of 5(five) days. Defects with Severity levels of I through 5 shallbe responded to within 8 (eight) hours of defect notification.Response is defined as the identification of a fix and an
Rl.01
Sr.q.rn or VnnvroNt, CoNtrucr FoR PnnsoNar, SnnvrcnsDnr.q.RrvrnNT oF VnnvroNr Hn.lr,rn AccnssEQHru,rn Sor,urroNso INc.
Pncp 187 oF 268CoNrnacr #28739
AnnnNovrpxr # 2
estimate of the time frame for UAT to beginRl.01G3.32-l The Contractor must resolve priority 3 test defects within an
average of 4 (four) days, but no more than a maximum of 7(seven) days. Defects with Severity levels of 1 through 5
shall be responded to within 8 (eight) hours of defect
notification. Response is defined as the identification of a fixand an estimate of the time frame for UAT to begin.
Rl.01c3.33-1 The Contractor must resolve priority 4 test defects within an
average of 5 (five) days, but no more than a maximum of 8(eight) days. Defects with Severity levels of 1 through 5
shall be responded to within 8 (eight) hours of defect
notification. Response is defined as the identification of a fixand an estimate of the time frame for UAT to begin.
Rl.01The Contractor must resolve priority 5 test defects within an
average of 6 (six) days, but no more than a maximum of 10
(ten) days. Defects with Severity levels of 1 through 5 shall
be responded to within 8 (eight) hours of defect notification.Response is defined as the identification of a fix and an
estimate of the time frame for UAT to begin
G3.34-l
InterfaceList
Rl FINALG4.1 The Contractor's System will draw data from the current
MMIS system to confirm beneficiary eligibility on a
monthly schedule. The Contractor's System will interface
with the future Integrated Eligibility System to confirmbenefi ciary eligibility in real-time
Rl.01The Contractor's System will obtain beneficiarydemographics from the current MMIS system on a monthlyschedule. The Contractor's System will obtain beneficiarydemographics from the new EMPI and future MMISsystems on a monthly schedule
G4.2
Rl.01G4.3 The Contractor's System will obtain medical and pharmacy
paid claims details from the current MMIS system on a
weekly schedule. The Contractor's System will obtain
medical and pharmacy paid claims details from the new
MMIS system on a daily scheduleR2G4.4 The Contractor's System will interface with the current
MMIS system to obtain surgical procedure codes on a
weekly schedule and from the new MMIS system on a dailysehedule
Rl.01The Contractor's System will obtain the master list ofProviders and their demographics from the current MMISSystem on a weekly basis. The Contractor's System willinterface with the future MPI system and new MMIS system
G4.6
Number Requirement Description Planned Release
Srarn or Vnnuronr, CoNrnacr FoR PnnsoNar, SnnvrcosDnp.q.nrivruNT oF VnnvroNr Hpaltn AccnssEQHrllrn Sor,urroNs, INc.
PAGE 188 or 268CoNrnq.cr # 28739
AvmNuvrnNr # 2
as necessary to obtain the master list of Providers and theirdemographics in real-time.
G4.7 The Contractor's System will interface with the currentMMIS system on a weekly schedule and the future MMISsystem in real-time to obtain third party liability information
Rl FINAL
G4.8 The Contractor's System will interface with the VermontHIE system (VHIE) to obtain details of interactions with andservices provided to beneficiaries by the provider in real-time
R2
NFRG4.8-001
The solution must interface with the Vermont HIE system(VHIE) to receive real-time information on select clinicaldata attributed to Medicaid members.
R3
NFRG4.8-002
The solution must provide updated Medicaid populationinformation to the VHIE system based on business rules
R3
NFRG4.8-003
The solution must provide an on demand real time interfaceto the VITL Access.
R3
G4.10 The Contractor's System will draw census data (includingEmergency Department Visits and In-patient Stays) from anumber of hospital systems on a mixture of weekly anddaily schedules and will interface to receive this informationin real-time in the future. Hospital systems include, but arenot limited to: Fletcher-Allen, Copley, Central VT,Northwestern Med Center, NVRH, Bennington, andRutland.
R3
G4 11 The Contractor's System will obtain lab results in real-timeftom the statewide HIE system supported by VermontInformation Technolo gy Leaders
R3
The Contractor's System will uniquely identify eachG5.l Rl.01
General uirements
VEPro and AuthorizedMember ProviderG5.2 The Contractor's System will authenticate Users before
access to functionalitrr requiring a loginRl.01
G5.3 The Contractor's System will provide a mechanism to limitaccess to view/update information, based on User role,access rights, member consent, and program rules
Rl.01
G5.6 The Contractor's System will link the services received by aMember to the:
) Billing provider c) Plan of carea) Prior authorization b
Rl.01
Interoperability / Interfaces uirementsPlanned ReleaseNumber RequirementDescription
Number Requirement Description Planned Release
Srlrn oF VERMoNI, CoNtucr FoR PnnsoNar, SnnvrcnsDBranrvrBNT oF VnnvroNr Hn,tlrn AccnssEQHnalrn Solurrons, INc.
PLcB 189 0r 268CoNrru.cr #28739
AvrnNrunnr # 2
T1.1 The Contractor's System's interfaces will secure and protect
the data and the associated infrastructure from a
and ve.
Rl.01
Tl.2 The Contractor's System will be able to support Applicationto Application (A2A) synchronous and asynchronousmessaging using web services. The messaging capabilities
will be able to support a wide variety of A2A patterns
including, but not limited to, the following:- Data look-up and retrieval- Datalook-up with services provided by other applications- Simple bulk data transfer tolfrom other S
R2
Tt.3 The Contractor's System's interface infrastructure willcontinue to operate despite failure or unavailability ofindividual technology components such as a server platformor network connection.
RI.01
Tl.4 The Contractor's System's interfaces must be scalable to
accommodate changes in scale including changes in Userpopulation, transaction volume, throughput and
geographical distribution. The Contractor's System will be
capable of making any changes to the interface data
elements/layouts easily, and to test those changes.
R3
Tl.6 The Contractor's System will provide the capability toperform source to destination file integrity checks forexchanse ofdata and alert appropriate parties with issues
Rl.01
Tt.7 The Contractor's System's components will be committed toan advanced approach to interoperability using web services
and Service Oriented Architecture (SOA) aligned with State
standards and vision for interoperability
Rl.01
T1.14 The Contractor's System's ,message and data formats willbebased on logical representations ofbusiness objects rather
than native application data structures
Rl.01
T1.15 The Contractor's System's data transformations will be to
and from normalized formats. Normalized data formats
facilitate composition and reduce the number oftransformations that must be created and maintained. Acanonical data representation that spans the enterprise can be
used but is not required. A federated approach to data
normalization is also possibleT1.16 The Contractor's System will avoid point-to-point
integrations. Application integration, both internal and
external, will go through the central ESB except whenrequired by the State of Vermont for external applicationintegration.
R2
Tt.t7 All System services will be classified with one of thefollowing values: Presentation, Process, Business, Data,
Access, or Utility
Rl.01
Srarn or VnnvroNr, Contrucr FoR pnnsoN.lr, SnnvrcnsDnpLnrunNT oF VnnvroNr Hn,rr,rn AccEssEQHnalrn Sor,urroNs, INc.
PncB 190 or 268CoNrucr # 28739
AurNovrnnr # 2
T1.18 a) All software architecture documents and artifacts(views/viewpoints) will be modeled per ISO/IEC/IEEE42010 Architecture Description Template as part of theVermont Architecture Proglam Requirements
Rl.01
T1.19 A11 System services will have key stakeholder/ownersidentified following the ADM Architecture Model. RoleMatrix should include s/w developers, integrationists,technologists, Enterprise Architects, Business Leads,Testing teams, UAT Teams.
R2
TT.24 The following metadata attributes will be tracked for allservices in the services catalog: {name, lifecycle stafus,class, description, owner, version, revision history, releasefrequency, versioning policy, deprecation policy, messageexchange patterns, compensating transaction support,availability requirements, volume, max message size,security SLA, logging requirements)
R2
T1.26 The Contractor's System will be designed, built anddeployed with extensible and modular enterprisearchitecture best practices including substantial reliance onhighly configurable SOA components. The Contractor'sSystem will undergo, at aminimum, 2 iterations integratedwith HSEP development environment. Each iteration willhave a maximum period of 10 days. The Contractor'sSystems will have an alpha deployment on HSEP stagingEnvironment and also will have, at a minimum, three weeksof UAT Testing by Business SMEs on the HSEP StagingEnvironment
Tt.27 The Contractor's System will provide reliable, once-onlydeli of messages (reliable and non-repetitive deliverv).
R2
T1.29 The Contractor's System will provide the functionality thatprovides reliability for applications, services or messageflows:' Load balancing' High availability' Fault tolerance'Failover' In-order delivery' Transaction support' Executionpnoitization' M es s a g e pioitization. Tests for Hi ghAvailability and Failover must be completed prior to therelease to UAT.
RI.01
T1.30 The Contractor's System will provide the technology thatmanages the metadata and provides the features needed tosupport the reliable operation of services
R2
T1.31 The Contractor's System will provide support for integratingwith applications with SOA and event-driven architectures.
R2
Surn or VnRuoltt, CoNtru,cr FoR PERSoNAL SnRvrcnsDnp,qntNInNT oF' VnnvroNr Hnllrn AccnssEQHr,ll,rn SolurtoNs, INc.
P.lcn 191or 268Conrru,cr #28739
AvrnNounNr # 2
R2The Contractor's System will have the ability to track amessage from its origin to its destination (inside a firewall),inquire on the status of that message and address exceptions(for example, resend the message if a target times out).
Usually implemented via a warehouse for archivingmessages together with the associated tracking and loggingdata.
Tt.32
Rl.01The Contractor's System will have the ability to use
standards-based communication protocols, such as TCP/P,HTTP, HTTP/S and SMTP. 'Protocol bridging: The abilityto convert between the protocol native to the messagingplatform and other protocols, such as Remote MethodInvocation (RMI), IIOP and .NET remoting.
T1.33
Rl.01T1.34 The Contractor's System will seamlessly work with the
technology and programs that act as glue, transformingamong protocols, connecting to databases and linking pre-
SOA Application Programming Interfaces (APIs) to the
SOA backplaneR2T1.36 The Contractor's System will have the capability to work
with security policy manager for Web services that allowsfor centrally defined security policies that govern Web
services operations (such as access policy, logging policy,and load balancing)
R2T1.37 The Contractor's System will have the capability to integrate
with the VT MDM technology for Enterprise Master Person
Index (EMPD implemented as part of the HSE Platform in acentralized or registry style implementation. The State ofVermont has invested in enterprise licenses for Oracle
MDM and strongly prefers that it is used however if the
bidder cannot leverage this functionality initially it mustprovide for a probabilistic person index or person record
function.Scalability and Extenstbility Require'ments
Rl.01T2.l The Contractor's System will be designed for ease ofmaintenance and readily allow future functionalenhancements. This will be accomplished through use ofmodern design principles for Service Oriented Architecture,applyng principles of modularity, interface abstraction, and
loose coupling.Rl FINALT2.2 The Contractor's System will be adequately flexible to keep
up with ever changing technology and regulatory changes'
This will be accomplished by separating workflow and
business rules into their own separate tiers.
Numtrer RequirementDescriPtion Planned Release
Suru or VnRivroNro CoNrnacr FoR PnnsoNal SnnvrcnsDnplRtvrnNT oF VnnvroNr Hnar,rn AccnssEQHn,t lrn Sor,urroNs, INc.
Pacr 192ot268CoNrnncr # 28739
AvruNonanNr # 2
T2.3 The Contractor's System will be scalable and adaptable tomeet future growth and expansiorVcontraction needs suchthat The Contractor's System can be expanded on demandand be able to retain its performance levels when addingadditional LJsers, functions, and data
RI FINAL
T2.4 The Contractor's System will provide screens that are highlyre-configurable, providing ability to reposition and renamefield labels I data fields, remove or "turn-off'unused fieldsmaintain data, and allow addition of custom-defined fields
Rl.01
T2.5 The Contractor's System will enable the State to modify thelabels and arrangement of information in the data modeldocumentation templates and can create custom data fields (
Rl.01
T2.6 The Contractor's System will provide the ability to createand/or modify edits and business rules which determine thecorrestness/integrity of data
Rl.01
T2.7 The Contractor's System will provide the ability for on-lineaccess by any site connected to the organization Wide AreaNetwork (WAN)
Rl.01
T2.8 The Contractor's System will provide the capability forremote access in compliance with existing State / Federalconnectivity/security policies
RI.01
T3.1
& Security uirements
The Contractor's System will, at a minimum, provide amechanism to comply with security requirements andsafeguard requirements of the following Federal agencies /entities:- Health & Human Services (HHS) Center for Medicare &Medicaid Services (CMS)- Administration for Children & Families (ACF)- NIST 800-5314, MARS-E- Federal Information Security Management Act (FISMA)of2002- Health Insurance Portability and Accountability Act(HIPAA) of 1996- Health Information Technology for Economic and ClinicalHealth Act (HITECH) of 2009- Privacy Act of 1974- e-Government Act of 2002- Patient Protection and Affordable Care Act of 2010,Section 1 56 1 Recommendations- Vermont Statute 9 V.S.A. S 2440. Social .security numberprotection
R1.01
:l9)- Vermont Statute 9 V.S.A. 2435. Notice of
Sr.lrn or VrnuoNt, CoNtrucr FoR PERSoNAL SnnvrcnsDnpLnrurNT oF VsRMoNr Hr.ql,rn AccnssEQHnnr,rn SolurroNso INc.
Plcr 193 or 268
CoNrnacr #28739AvrnNnvrnNr # 2
breaches(https : //le eislature. vermont. gov/statutes/s ection/09/06210243
5)
T3.2 The Contractor will provide all their corresponding NIST800-53 procedures and policies to the State security officer
Rl.01
T3.3 The Contractor's System will be in compliance with allapplicable State and Federal laws and regulations, including42 CFR Part2 and Health lnsurance Privacy and
Accountability Act (HIPAA) including privacy and member
consent for release requirements (As per CR014 to be
excluded from Rl.01)
Rl FINAL
T3.3-1 The contractor's System will be in compliance with allapplicable State and Federal laws and regulations, including42 CFR part2 and Health Insurance Privacy and
Accountability Act (HIPAA) (HIPAA language only forMVP)
Rl.01
T3.5 The Contractor's System will accommodate diversepopulations of Users including those with visual and hearing
impairments, persons with low and moderate educationallevels, and the elderly
R3
T3.6 The Contractor's System will conform with the sub-parts ofSection 508 of the Rehabilitation Act of 1973, and any other
appropriate State or Federal disability legislation
R3
T3.7 The Contractor's System will conform and support the
Medicaid Information Technolo gy Architecture (MITA)v3.0 or later, and be compliant with CMS Seven Standards
and Conditions
RI.01
T3.8 The Contractor's System will comply with all applicable
State security policies and adhere to all legal, statutory, and
regulatory requirements, as determined by Vermontleadership
Rl.01
T3.9 The Contractor's System will implement security controls inaccordance with all Federal and State security policy and
regulations
Rl.01
Srlrr or VnnvroNr, CoNrrucr FoR PnRsoN.tr, SrnvrcnsDnp.q.RrvrnNT oF VnnuoNr Hnnr,rn AccnssEQHnurn Sor,urrons, Inc.
Pacr 194o1268CoNrRAcr #28739
AvrnNnvrnur # 2
T3.10 The Contractor's System will comply with accessibilityrequirements described in 45 CFR 85 and with State ofVermont accessibility requirements located athttp ://www.vermont. gov/portal/policies/accessibility.phpand included in the set of policies and standards recentlycreated for the Vermont Health Connect systems - in theprocurement library - an equivalent set of policies andstandards for the new Medicaid Operations systemsincluding Care Management and MMIS will be created inthe near future.
R3
sT3.11 The Contractor's System will adhere to the accessibilitystandard as outlined in the web guidelines and based on theW3C level 2 accessibility guidelines:(http://www.w3 .org/TR/WCAG 1 0/tull-checklist.html).
R3
T3.12 The Contractor's System will comply with Vermontstandards as defined by the state
T3.13 The Contractor's System will meet:- NIST 800-53 rev4 Moderate baseline- IRS pub 1075, which points back to NIST 800-53 rev 3- CMS requirements, which points back to NIST 800-53rev3 moderate baseline- Guidance from CMS including MITA Framework 2.0 andHarmonized Security and Privacy Framework
R1.01
T3.t4 The Contractor will adhere to the principle of "Fail Safe" toensure that a system in a failed state does not reveal anysensitive information or leave any access controls open forattacks
Rl.01
T3.15 The Contractor's System will allow for controlled access toparticipant records. Users will be able to view participantdata within The Contractor's System at the State-definedlevels of access based on User security privileees.
Rl.01
T3.16 The Contractor's System will maintain a level of securitythat is commensurate with the risk and magnitude of theharm that could result from the loss, misuse, disclosure, ormodifi cation of information
R1.01
T3.17 Information security will be built into The Contractor'sSystem from its inception rather than "bolted on" after theContractor's System has been implemented
R1.01
T3.18 The Contractor's System will support security at the objectlevel (e.g. View, Index)
Rl.01
T3.19 The Contractor's System will support security at the rowand column level
Rl.01
T3.20 The Contractor's System will support auditing at the objectlevel (i.e. Table, Column)
Rl.0l
T3.2r The Contractor's System will provide the ability forconcurrent Users to simultaneously view the same record.
Rl.01
Srarn or VnnuoNto Contu.cr FoR PnRsolcA,r, SnnvrcnsDnpl,RrvrnNT oF' VnnivroNr Hnl.LrH AccnssEQHn,r,r,rn Sor,urroNs, INc.
Plcn 195 or 268CoNrru,cr #28739
AvrpNovtrNr # 2
documentation and/or templ ate
T3.22 The Contractor's System will provide protection to maintainthe integrity of data during concurrent access
Rl.01
T3.23 The software used to install and update The Contractor'sSystem, independent of the mode or method of conveyance,
will be certified free of malevolent soflware ('omalware").
Contractor may self-certifu compliance with this standard
through procedures that make use of commercial malware
scanning software.
Rl.01
T3.24 The Contractor's System will be configurable to prevent
comrption or loss of data akeady accepted into theContractor's System in the event of a System failure (e.g.
inteerating with a UPS, etc.)
Rl.0l
T3.25 The Contractor's System will support protection ofconfidentiality of all Protected Health Information (PHI)delivered over the Internet or other known open networks
via encryption using Advanced Encryption Standard (AES)and an open protocol such as TransportLayet Security(TLS), Secure Sockets Layer (SSL), Internet ProtocolS ecurity (IPsec), XML encryptions, or S ecure/MultipurposeInternet Mail Extensions(S/MlME) or their successors. ThisSvstem will be subiect to external Audit checks.
Rl.01
T3.26 The Contractor's System, when storing PHI on any deviceintended to be portable/removable (e.g. smartphones,portable computers, portable storage devices), will support
use of a standards based encrypted format using AES ortheir successors
R2
T3.27 The Contractor's System, prior to access to any PHI, willdisplay a State-approved configurable warning or loginbanner (e.g. "The Contractor's System should only be
accessed by authorized Users"). In the event that a System
does not support preJogin capabilities, the Contractor'sSystem will display the banner immediately followingauthorization.
Rl.01
T3.28 The Contractor will review and analyze the key risks to the
important assets and functions provided by The Contractor'sSystem to certify that the CWE/SANS Top 25 MostD angerous S oft ware Errors (http ://cwe.mitre. org/t op25)have been mitigated and document the mi
Rl.01
T3.29 The Contractor will review The Contractor's System and
certify that the code and any new development meets orexceeds the OWASP Application Development Security
Standards outlined on the www.OWASP.org site (currentlyhttps://www.owasp.o rgl images/ 4/4e/OWASP-ASVS 2009-Web_App_Std-Release.pdf ) and document in writing that
they have been met.
Rl.01
Stlrn or Vrnvroivt, CoNrnlcr FoR Pnnsoulr, SnnvrcnsDnplnrunNT oF VnnvroNr Hnar,rn AccnssEQHnllrH Sor,urroNs, INc.
PAGE 196 or 268CoNrnncr # 28739
AvrnNnunnr # 2
T3.30 The Contractor's System will support a form of Userauthentication
Rl.01
T3.31 The Contractor's System upon detection of inactivity of aninteractive session will prevent further viewing and access tothe Contractor's System by that session by terminating thesession, or by initiating a session lock that remains in effectuntil the User reestablishes access using appropriateidentifi cation and authentication procedures. The inactivitytimeout will be confizurable.
Rl.01
T3.32 The Contractor's System will enforce a limit of(configurable) consecutive invalid access attempts by aUser. The Contractor's System will protect against further,possibly malicious, User authentication attempts using anappropriate mechanism (e.g. locks the account/node untilreleased by an administrator, locks the account/node for aconfigurable time period, or delays the next login promptaccording to a configurable delay aleorithm).
R1.01
T3.33 The Contractor's System will provide the capability toprevent database administrators from seeing the data indatabases theymaintain (Rl.01)
Rl FINAL
T3.34 The Contractor's System will support grouping Users byRoles, functional departments or other organization tosimplify securi ty maintenance
Rl.01
T3.35 The Contractor's System will provide the ability to maintaina directory of all personnel who currently use or access theContractor' s System/IVR/SQL database
R1.01
T3.36 The Contractor's System will provide the ability to createand maintain a directory of external providers to facilitatecommunication and information exchange
T3.31 The Contractor's System will provide the ability to identif,certain information as confidential (e.g. PII, PHI, etc.) andonly make that accessible by appropriately authorized Users
Rl.01
T3.38 The Contractor's System will restrict access to summarizedinformation according to organizatiorral policy, scope ofpractice, and iurisdictional law
Rl.01
T3.39 The Contractor's System must be able topermissions with a User using one or more of the followingaccess controls: 1) Role-Based Access Controls (RBAC;Users are grouped by role and access rights assigned to thesegroups) 2) context-based (role-based with additional accessrights assigned or restricted based on the context ofthe
such as time-of-day, workstation-location,
associate
transaction
Rl.01
l [i qo 0 ri ij iii\], il t r i/ j l 1.,\r ir({i.tiif; i$l1 i;zl ilirr r rt t lt ir r'r t(i
Number RequirementDescription Planned Release
Sr.trn or Vnnvront, Contru,cr FoR PrnsoNar, SnnvrcnsDnpa,nrwrnNT oF VBnvroNr Hnar,ru AccBssEQHn.Llrn Solurrolts, lNc.
Pacn 197 or268CoNrru.cr #28739
AvrnNnunNr # 2
emergency-mode, etc.)
T3.40 The Contractor's System will provide the ability to prevent
specified User(s) or groups from accessing confidentialinformation such as a beneficiary's SSN, medicationinformation and other confidential data
Rl.01
T3,41 The Contractor's System will provide the ability to limitaccess to certain confidential information such as a
beneficiary's SSN and other confidential data to providers
directly involved in service of the patient, or providers
involved in review of the service
R1.01
T3.44
specified tasks
The Contractor's System will enforce the most restrictive set
of rights/privileges or accesses needed by Users/groups orprocesses acting on behalf of Users, for the performance of
Rl.01
T3.45
to Users or Soups
The Contractor's System will provide the ability forauthorized administrators to assign restrictions or privileges
Rl.01
T3.46
System to ensure history of User's identity and actions
The Contractor's System will support removal of a User'sprivileges without deleting the User from the Contractor's
Rl.01
T3.47 The Contractor's System will be able to support RBAC incompliance with the HL7 Permissions Catalog
RI FINAL
T3.48 The Contractor's System will be capable of operating withinan RBAC infrastructure conforming to ANSI INCITS 359-
2004, American National Standard for InformationTechnology - Role Based Access Control
Rl.01
T3.49 The Contractor's System will provide more-advancedsession management abilities such as prevention of duplicatelogins, remote logout and session timeouts
T3.49-l The Contractor's System will provide more-advancedsession management abilities such as prevention of duplicateloeins
R1 FINAL
T3.50 The Contractor's System will provide the ability to performSystem administration functions such as reference table
maintenance and adding / removing Users from the
Contractor's System
Rl.01
T3.51 The Contractor's System will allow Users access based on
their roles irrespective of their geographical locationRl FINAL
T3.53 The Contractor's System will provide the capability tocreate temporary and emergency accounts and terminate
those accounts automatically after aUser defined period oftime
Sr.q.rn or Vnnvronr, CoNtnacr F'oR Pnnson,rr, SnnvlcnsDnpmrunNT oF VnnvroNr Hnllrn AccpssEQHnar,rn Sor,urroNs, Inc.
PAGE 198 or 268CoNrnacr #28739
AvrnNrvlnNr # 2
T3.54 The Contractor's System will provide the capability tooverride a role and restrict access to information by Users orgroups of Users
Rl.01
T3.55 The Contractor's System will provide the capability tomonitor events on the information system, detect attacks,and provide identification of unauthorized use of theContractor's System
Rl.01
T3.56 The Contractor's System will provide the capability toidentify and report on inappropriate access to information inthe Contractor's System, based on User defined criteria
Rl.01
T3.57 The Contractor's System will enforce minimum passwordrequirements compliant with State-provided securitypolicies
Rl.01
T3.58 The Contractor's System will allow User to change his orher password at any time
RI.01
T3.59 The Contractor's System will have mandatory securityquestions for the User to answer for Username and passwordvalidation in case of any User requested changes
Rl.01
T3.60 The Contractor's System will allow for online automatedpassword reset
Rl.01
T3.61 The Contractor will monitor, alert, and protect against webappli cation attacks o f internet-facing applications.Solutionlhosting provider will install, configure, andmanage a web application firewall on Vermont's internet-facing Solutionlhosting provider ePHI Environments. Alertsandlor reports will be provided to Security officers atspecified intervals
R1.01
T3.62 The Contractor will conduct and provide a risk assessmentbased upon NIST 800 - 30 guidance and methodology
Rl.01
T3.63 The Contractor will conduct quarterly scans of Vermont'sexternally accessible web services in the ProductionEnvironment, and provide reports on the scans to VTInformation Security officer / representative, including theseverity of the vulnerabilities and remediationrecommendations.
RI.01
T3.64 The Contractor will provide third-party conductedpenetration tests on production releases of the externallyaccessible web application as requested by the changecontrol board entity. The reports shall be provided to thesecurity officer upon request.
Rl.01
T3.65 The Contractor will not transmit or store any PersonallyIdentifiable Information (PIf using publicly availablestorage over the Internet or any wireless communicationdevice, unless: 1) the PII is "de-identified" in accordancewith 45 C.F.R $ 164.514(b) (2); or 2) encrypted inaccordance with applicable law, including the American
Rl.01
Srnrn or VnnvroNt, CoNlnncr FoR PrnsoNar, SnnvrcnsDnpanrunNT oF VnnvroNr Hn.c.LrH AccnssEQHnar,rn Sor,urrolvs, INc.
PAGE 199 or 268CoNrna,cr # 28739
AvrnNrvrnNr # 2
Recovery and Reinvestment Act of 2009 and as required bypolicies and procedures established by VT InformationSecurity Officer.
Rl.01T3.66 The Contractor will perform Security Impact Assessmentsprior to releasing solutions into productton
Rl FINALT3.67 The Contractor's System will include the same securityprovisions for the development, system test, acceptance test
and training environment as those used in the productionenvironment (Rl.01) (
R1.01T3.68 The Contractor will complete and supply to VT InformationSecurity Officer all CMS Security required documentationto include but not limited to System Security Plan (SSP),
Risk Assessment (RA), Contingency Plan (CP)Rl.01T3.69 The Contractor must pass the Privacy/security and FTI data
handling training provided by the State. FTI training is
required regardless of the presence ofabsence ofFTI dataRl.01T3.70 The Contractor will ensure that all servers have hardened
operating systems by eliminating any unnecessary system
services, accounts, network services, and limited User
access riehts throughout all of the environmentsRI.01The Contractor will review and monitor logs for forensic
purposes and security Incidents, and any anomalousactivities are incorporated into the Incident managementprocess. In the event of a security incident, the Contractor
will be responsible for collecting and retaining evidencerelated to the incident. A detailed report must be provided tothe State Security Officer
T3.77
R1.01T3.12 The Contractor will ensure that high severity patches will be
applied within seven (7) calendar days; Medium severitypatches will be applied within fifteen (15) calendar days;
and all others within thirty (30) calendar days. The
Contractor will further ensure that required IT securitynotices and advisories are distributed to appropriatepersonnel
HSE Platform Alignment Requirements
uirements
Rl.011I1 The Contractor will employ, maintain, and execute a projectmanagement methodology that complies with the ProjectManagement Institute (PMI) standards or equivalent-
Rl.01.2I1 The Contractor will describe the project management
Number RequirementDescriPtion Planned Release
Number RequirementDescriPtion Planned Release
Sr.q,rn or VrnvroNt, Conrrucr FoR pnnsoNar, SrnvrcnsDnp,q.nrMnNT oF VnnuoNr llnar,rn AccnssEQHnn rn Sor,urroNso INc.
Pacn 200 or 268CoNrnacr #28739
AvrnNonnnNr # 2
approach and methodology to be used for all System projectlife cycles.
I1.3 The Contractor will develop a Project Management Plan(PMP) conforming to the Project Management Body ofKnowledge (PMBOK). The PMP will incorporate thefollowing PMBOK knowledge areas: ( Project IntegrationManagement- Project Scope Management- Project Time Management - Project Cost Management-Project Quality Management- Project Human Resource Management - ProjectCommunications Management- Project Risk Management - Project ProcurementManagement
RI FINAL
It.4 The Contractor will develop a Project Charter. Rl FINALr1.5 The Contractor will develop a Project Governance Plan. The
pro.l ect governance plan will take into account and leveragethe existing AHS governance structure. (Rl
Rl FINAL
I1.6 In collaboration with the State, the Contractor will develop aBusiness Process Change Management Plan. The Stateenvisions significant process change during the developmentand implementation of The Contractor's System. TheContractor will provide plans for a change readinessassessment, gap analysis, and recommendations fororganizational andprocess changes. The Change ControlBoard will be managed by the State.
Rl.01
n.7 The Contractor will document the business processmanagement activities and outcomes described in theBusiness Process Change Management Plan. Additionally,the Contractor will document Operational and SystemChanges in the Technical Change Management Plan.
Rl.01
Il.8 Where available and agreed between the Contractor and theState, the Contractor will use State templates for projectmanagement deliverables. State templates listed in EPMOtemplates from the link: http : //epmo.vermont. gdv/templates
Rl.01
I1.9 The Contractor will develop a PMI compliantCommunications Management Plan. The CommunicationsManagement Plan must describe participant's roles andresponsibilities, intemal communications, externalcommunications, other communications and informationmanagement including communications protocols.
Rl.01
SrarB or VnnuoNt, CoNtnacr FoR PnnsoNnr, SnnvtcnsDBp.qnrvrBNT oF VnnvroNr Helr,ru AccpssEQHn,lr,rn SolurroNso INc.
P.tcn 201 or 268CoNrru,cr #28739
AunNounNr # 2
I1.10 The Contractor will leverage DII EPMO Project Logtemplate as applicable to establish an issues and action items
process and tracking document that must ensure that
unanticipated issues, action items and tasks are assigned to aspecific person for action and are tracked to resolution.
DII EPMO Project Log Template canbe found inhttp ://epmo.vermont. gov/templates/proj ectlhase
The issue and action item tracking document must includethe following:- Issue description - Issue priority - Issue status - Plan forresolution - Individual responsible for resolution - Targeted
resolution date - Actual resolution dates - Resolution action.
Rl.01
I1 11 The Contractor must electronically provide projectmanagement documents (e.g., Project Management Plan,
Project Schedule, Work Breakdown Structure, etc.) using
Microsoft software products and/or pdf. The software
version must be no less than a version still available on the
common market and that is still supported by the
manufacturer. The State will work with the Contractor inapproving specific versions to assure that the application issynchronized with the State's plans.
Rl.01
n.t2 The Contractor will advise the State and Contractormanagement of progress in meeting goals and schedules
contained in the work plans as well as any risks and issues
during weekly progress meetings attended by the Contractor
and the State. These may include walkthroughs of selected
deliverables as requested by State staff.
Rl.01
r1.13 The Contractor will develop weekly progress reports.
Weekly written progress reports will be provided by the
Contractor to the State one working day before each weeklymeeting, and containing items to be discussed at the
meeting, including:- Progress ofeach task/activity.- Action items and decisions from the previous meeting.
- Problems encountered, proposed resolutions, and projected
completion dates for problem resolution.- Planned activities for the next two reporting periods.
- Status of contractually defined deliverables, milestones,
and walkthroughs scheduled in the project schedule.
- Updating of information on a weekly basis in the State
project and portfolio management tool.- Other information as needed (per Contractor or the State).
Frequency of periodic reports can be adjusted during the
course ofproject as by the State and Contractor.
Rl.01
Sr.Lrn or VrniuoNr, Coivtnacr FoR pERsoNAL SnnvtcnsDnpmrvrnNT oF' VnnvroNr Hnar,rn AccnssEQHnu,rn Sor,urrons, INc.
Pacn 202or268CoNrnrcr # 28739
AvrnNnunNr # 2
n.t4 The Contractor will develop monthly progress reports. Theprogress report will include deliverables, milestones,walkthroughs, the State approvals, and lessons learned andwill be used by the Contractor and the State in measuringthe Contractor's progress and performance. The report willalso contain:- Issues, problems, and corrective actions, steps, andassignments.- Risks and mitigations.- Total budget and cost variance reporting- Lessons learned- Percentage complete- Resources and time required to completion
Rl.01
I1.15 If the Contractor must substitute key staff during the project,the Contractor will submit to the State, in writing, the reasonfor the change and provide a completed staff experiencereference form and resume for the substitute personnel. TheState will either approve or reject the substitution.
Rl.01
I1.16 The Contractor will provide contract close-out plans andmanage project close-out activities in accordance with theplan.
Rl.01
17.t7 As part of the proposal, the Contractor will describe thestaffing approach and methodology used for the project,which will include:- Estimated number of Contractor's resources needed pereach phase ofthe project.- The number of staff resources within the followingcategories: Management, Business, and Technical.- The number of staff resource onsite vs. remote per thephase ofthe project- A description of the methodology used for releasing andadding staff to the project and managing staff PTOs- Outsourcing staff if applicable- Types and number of resources that State needs to provideper the phase ofthe project and expected hours from thoseresources
a proiect organization chart.
Rl.01
I1.18 The Contractor will describe issue escalation process tosettle matters of dispute as it relates to roles, responsibilities,or unmatchable level of service (i.e. what is their escalationchain) and this will be aligned with the State's escalationplan.
Rl.01
I1.19 The Contractor will describe their approach to remediate andrealign the project and project plan in the event that theContractor or the State decides that any aspect necessitatesimmediate attention and/ or State/Contractor management
Rl.01
Surn or VnnuoNto Contru.cr FoR Prnson.q'r, SnnvrcnsDnpnnnvrnNT oF VnniuoNr Hn.qlrn AccnssEQHnu,rn Sor,urIoNs, hvc.
Pacn 203 or 268CoNrnacr #28739
AvrnnnvrcNr # 2
interventron.
Rl.01.20I1 The Contractor will provide a minimum of one full timeassisred PMI Certified proiect manager.
Rl.01The Contractor will describe their approach regarding the
project documentation repository. The Contractor is
recommended to align with the State's document repository.
In case the Contractor cannot, they must providejustification as to why their proposed repository works wellin the best interests of the State
n.2l
Environment Installation and
Rl.0112.l The Contractor will submit to the State as part of theirproposal, specifications for all necessary hardware, software
and tools for the seven (7) environments listed here. The
Contractor can propose to combine certain environments,
where appropriate. The seven (7) environments include:1. Production2. Disaster Recovery3. Staging (QA)4. Training5. UAT6. Test7. DevelopmentContractor will submit as a component of proposal
specifications for all software, hardware, and tools that
would be inclusive of a full SDLC, including environment
to support the following needs: Prod, QA, Staging,
Development, Test, Training, Disas er RecoveryRl.01t2.2 The Contractor will develop a technical infrastructure
document which describes all of the hardware, system
software and tools necessary for each of the environmentsproposed
Rl.0112.3 The Contractor will develop an environment configurationmanual that describes the environment installation and
for each of the environmentsconfi guration necessaryRl.0112.4 The Contractor is responsible for installing and configuring
all hardware, software and tools purchased under the
contract until System acceptance for the proposed
environmentsRl.01The Contractor is responsible for maintaining all hardware,
software and tools purchased under the contract until System
acceptance for all proposed environments
12.5
Number Requirement Description Planned Release
Srarr on VnnvroNr, Contnacr FoR pnnsoN.q,L SnnvrcnsDnpLnrvrnNT oF VnnvroNr Ilrlr,ru AccnssEQHn.urn SolurroNs, INC.
PAGE 204or268CoNrrucr # 28739
AunNovrnNr#2
12.6 The Contractor will provide the State with well documentedreadable source code and object (executable) code,documentation for all functionality developed by theContractor outside of COTS configuration, licenses toreadable source code and object (executable) code, anddocumentation for all COTS functionality and escrow ofsource code for the custom developed or integration relatedcode. All new software functionality built on top of COTSsoftware will be owned by the State.
Rl.01
t2.7 The Contractor will provide a data dictionary, data models,data flow models, process models and other related planningand design documents to the State (Rl.01)
Rl.01
The Contractor will provide an exit plan and strategy in theContractor' s S ystem Implementation Pl an deliverabl eaddressing portability of solution in case the State wants to
12.8
Knowthe solution back in-house 1.01
Transfer &
R1.0r
13.1 The Contractor will develop (in cooperation with the State)and execute a Knowledge Transfer and Training Plan thatdescribes roles and responsibilities of the State andContractor and the approach for bringing managers, endUsers, and technical personnel to an appropriate level of
with the Contractor's System
Rl.01
13.2 The Knowledge Transfer and Training Plan will address anddescribe, at a minimum- Training goals/standards and the specific plan for trainingtechnical personnel and end Users.- Size of population and types of roles that need training- Strategy for providing training early in the project to allowthe training goals to be implemented throughout the projectlife Phase.- Tasks, deliverables and resources necessary to completethe training effort and identifii tools and documentation thatwill be necessary to support proposed effort.- Types of training, the specific courses and coursematerials, the training approach for both technical personneland end LJsers, and how training effectiveness will bemeasured and addressed.- Deliverables to support initial and ongoing trainingincluding User manuals, System manuals, and on-line helpand training materials for technical/non-tebhnical personnel.- Knowledge Transfer to enable the State personnel tooperate, maintain, configure and modify The Contractor's
Rl.01
Number Requirement Description Planned Release
Sr.lrn or VnnuoNt, CoNtnacr FoR PnnsoNal SnnvrcnsDnpaRrmnNT oF VnruroNr Hnl.LrH AccpssEQHr,lr,rn Sor,uttoNs, Iltc.
PacB 205 or 268
CoNrru,cr # 28739AvroNuunNr # 2
System including operation of the testing tools, supporting
infrastructure, and security as agleed between the State and
Contractor. '
- Metrics for tracking progress in achieving training and
knowledge transfer obj ectives.- Reporting progress of training and knowledge transfer
activities.- Additional training for technical staff on development,
reporting and maintenance including processes and tools as
needed
13.3 The Contractor will provide train-the-trainer and end User
training documentation (including User manuals, onlinecontent, reference cards, etc.)
Rl.01
13.4 The Contractor will provide the State a training course
outline for review and acceptance at least thirty (30)
calendar days prior to the beginning of scheduled training
Rl.01
13.5- 1 The Contractor will submit all training packages to the State
for review and acceptance at least seven (7) calendar daysprior to the beginning of scheduled training
13.6 The Contractor will provide (customized as required)
training manuals for all classroom training they provrclg (Rl FINAL
t3.7 The Contractor will provide all training materials developed
for The Contractor's System to the State. Those materials
will become the property of the State and may be modifiedand duplicated by the State
R1.01
13.8 The Contractor will provide electronic copies of all trainingmaterials (end-User, technical, trainee and instructor) in aformat that can be easily accessed, updated and printed byState staff using software for which the State owns licenses,
prior to deployment onto the staging platform. This includes
but not limited to CDs/DVDs, and online.
Rl.01
13.9 The Contractor will provide updated training documentation
for all departments and agencies using the platform, as
necessary, to incorporate new processes or functionality due
to system releases, upgrades, or changes throughout the
contract term
Rl FINAL
13.10 The Contractor will schedule all training during regularwork hours as approved by the State, unless the Contractor
receives advance approval from the State for specifictraining at other times (Rl.01)
Rl.01
I3 11 The Contractor will provide all training within the State ofVermont at locations convenient to the attendees of the
training, unless the Contractor receives advance approval
Rl.01
Sr.q.rn or VnnuoNt, Conrnacr FoR PrnsoNar, SrnvrcnsDnplnrunNT oF' VnnvroNr Hn.tr,rn AccnssEQHnn rn Solurrons, INc.
Pncs 206 or 268CoNrru,cr # 2g:739
AurNovrnNr # 2
from the State for specific training at other locations
T3,T2 The Contractor will schedule staff training in a manner thatsruptive to the normal business operationsis least di
Rl.01
13.13 The Contractor will provide instructions to the State onContractor tools and procedures used to support the trainine
Rl.01
t3.r4 The Contractor will ensure that Contractor staff membersare not assigned to train State staff and work on critical path
tasks concurrently
Rl.01
13.1 5-1 Contractor will work with state in developing end-Usertraining on The Contractor's System business functionality
Rl.01
13.15-2 The State will assist the Contractor in developing end-Usertraining on The Contractor's System business functionality
Rl FINAL
13.16 The Contractor will provide both end-User classroomtraining/Train-the-trainer sessions and on-line, interactivetraining as agreed with the State for all end-Users
RI.01
13.t7 The Contractor will develop and perform train.the-trainertraining sessions, as appropriate
RI.01
13.18 The Contractor will identifu the number of staff necessaryfor maintenance and operations of the Contractor's Systemas well as the skill sets necessary, with the State's agreement
R3
13.19 The Contractor will develop and provide training for thetechnical support uding State staff and contractorsstaff incl
R2-R3
13.20 For the duration of the contract, the Contractor will continueto provide training to the technical staff if system upgradeshave been installed and there is a change in Systemcomponents
R2-R3
13.21 The Contractor will create a training approach and needsanalysis early in each project Phase which will determinethe training requirements. The State of Vermont hasinvested in the Oracle User Productivity Kit (UPK) and hasa strong preference to use this investment to provide trainingto end Users.
Rl.01
Solution Deslgno Development & Requirements
I4 1 The State utilizes a structured Software Development LifePhase (SDLC) that is consistent with industry-standard bestpractices as well as State requirements for InformationTechnology projects. The Contractor must use a structuredSDLC process, including an iterative software developmentmethodology and incremental deployment of functionality tothe production environment. This includes software anddatabase design, Solution configuration management planand procedures, and User interface standards.
Rl.01
Number Requirement Description Planned Release
Srlrn or VnnvroNto CoNtru,cr F'oR PnRsoNar, SnnvrcnsDnp^q.RtrvInNT or Vnnvroxr Hrantn AccnssEQHnllrn Sor,uuoNs, INc.
Pacn 207 o8268Cournacr #28739
AvrnNnivrnNr # 2
14.2 The Contractor will develop an System SoftwareLife e Plan
Rl.01
14.3
their
The Contractor must submit a narrative describing the
design and development approach and methodology withRl.01
14.4 All change request cost estimates must include the use of acost analysis tool
Rl.01
14.5 The Contractor will incorporate the design and development
approach into a comprehensive Design and DevelopmentPlan
Rl.01
14.6 The Contractor will apply consistent development standards
for all development works as described in offertory's SDLCsuch as coding convention, database and field namingconvention
R1.01
14.7 The Contractor will provide the State access to bothsource/object codes for software components and
documentation
Rl.01
14.8 The Contractor will acquire authorization from the State forthe use of production System resources (legacy data orsource files), or data derived from the State's productionresources
RI.01
14.9 The Contractor will describe the overall testing approach
and methodology used for The Contractor's System
deployment. The Contractor will work with the State's
Business Units in fine tuning the testing approach and get
the State's approval before starting the t@
Rl.01
14.10 The Contractor will incorporate the testing approach into acomprehensive Test Plan. The Test Plan will include theprocedures for documenting the completion of each test
phase, test scripts, test conditions, test cases, and test
reports. Detailed test plans will be created for the followingtesting areas:- Integration Testing- Security Testing- Performance Testing- User Acceptance Testing- Operations Acceptance TestingAll Integrated System Testing will be performed on the
Enterprise Testing platform while the UAT will be
performed on the Staging platform. No testing may be
conducted on the production platform and all testing must be
to
R1.01
14.ll The Test Plan must, at a minimum, include the followingareas:- Test philosophy (including objectives, required levels ortypes of testing, and basic strategy (develqpqg'Igqll4g and
-
Rl.01
Surr or VnnvroNro Conrrucr FoR PnnsoNar. SnnvrcnsDrpmtnanNT oF VnnnroNr Hn.ql,rn AccnssEQHna,r,rn Sor,urtoNso Iwc.
Pacr 208 or 268CoNrntcr # 28739
AvrnNpnnnNr # 2
release of major subsystems/components).- Procedures and approach to ensure the testing will satisf,ispecific objectives and demonstrate that the requirementsare met.- Procedures and approach to ensure that each phase ofthetesting is complete, and how formal reports/debriefings willbe conducted for each phase oftesting.- Approach to define tested workload types (perforrnancetesting) and test data- Overview of testing facilities, environment and specifictesting tools to be used.- Overview of processes and procedures that will be used bythe Contractor for releasing testing results and review of testresults.- Process and procedures for tracking and reporting forresults/variances/defects will be tracked and reported.- State resources required for testing during the developmentlife cycle for each testing area.- Method for review of test cases and procedures- Configuration management of the test environment- Describe User Acceptance Testing and User Sign-Off- Plan and deliverables for each testingareadescribed above- Contractor is responsible for providing detailedinstructions in modifying any desktop configuration settingsprior to the commencement of System testing.
14.12 The Test Plan will provide a detailed description of each testrequired to ensure that all of The Contractor's Systemcomponents, interfaces, and components comply with therequirements and specifi cations
Rl.01
14.T3 Testing and Development will have their own environments,separate from Production. Testing or development will notbe performed in the production environment.
Rl.01
t4.t4 The Contractor will repeat the test life cycle when a failureoccurs at any stage of testing (e.g., a failure in AcceptanceTesting that necessitates a code change will require thecomponent to go back through Unit Testing, IntegrationTesting, and so forth)
Rl.01
14.T5 The Contractor will be responsible for building test plans,executing test plans, and creating reports. The State willevaluate the Contractor test plans, and Contractor testresults, and may validate the testing done by augmenting itwith State testing.
Rl.01
14.t6 The Contractor will document the testing tools, testconfigurations and related documentation. The Contractorwill provide all necessary performance testing scripts withinput from the State's Business Units. The State will have
Rl.01
Sr,trr or VBnuoNt, CoNtrucr FoR PnnsoN,ql. SnnvrcnsDnpanrnnrNT oF VERMoNT Hnar,rn AccnssEQHnar,rn Sor,urtoNs, INc.
PrcB 209 ot268CoNrru,cr # 28739
AvrpNrunnr # 2
the final say on what is an acceptable performance.
14.17 The Contractor will provide the State with the test scripts,
test results and quality reportsRl.01
14.18 The Contractor will provide staff to the State to answerquestions and address any problems that may arise duringtestins conducted by the State
R1.01
14.19 The Contractor will refine the test documents, procedures,
and scripts throughout development and through full System
acceptance to reflect the as-built design and current
requirements
Rl.01
14.20 The Contractor will allow the State to run validation and
testing software against externally facing Internetapplications to help identify potential security issues, and
must agree to repair any deficiencies found during thistestins
Rl.01
t4.2r As System events contain date and time-sensitive elements,
the testing infrastructure must provide a method of alteringand synchronizing the Contractor's System date throughouteach test phase. This requires the ability to change the
Contractor's System date and time in some scenarios
Rl.01
14.22 The Contractor must develop a comprehensive DefectResolution Management Plan that describes the approach to
be taken in managing all problems discovered during any
testing phase and in production
Rl.01
14.23 The Contractor will install and test a single DefectResolution Tracking System that the Contractor and the
State will use collaboratively for the tracking of System
defects. security, and System issues
R1.01
14.24 The Defect Resolution Tracking System must, at a
minimum, include:- A11 defects in The Contractor's System identified duringany testing phase must be recorded, prioritized, tracked, and
resolved in a timely manner. Each must be assigned a
"Defect Level" based on the following definitions:1. Critical - Results in a complete System outage and/or is
detrimental to the majority of the development and/or testing
efforts. There is no workaround.2. Serious - System functionality is degraded with severe
adverse impact to the User and there is not an effectiveworkaround.
3. Moderate - System functionality is degraded with a
moderate adverse impact to the User but there is an effectiveworkaround.
4. Minor - No immediate adverse impact to the User.
Rl.01
Sr.q.ru or Vnru,roNt, CoNrucr roR PnnsoNnr, SrnvrcnsDnpanrunNT oF Vnnuolqr HEALTH AccnssEQHnnlrn Sor,urroNs, INc.
Pacn 210 or 268CoNrrucr # 28739
AvrnNovrpxr # 2
- The Contractor will allow the State full access to theDefect Resolution Tracking System.- The Defect Resolution Tracking System will be designedin a manner to allow for the transfer of ownership to theState following contract completion.- The processes and management of the Defect ResolutionTracking System will be addressed as part of the Quality
T#2"ff#"jjli",u address defect as such: critical andserious defects will require remediation and retesting beforeThe Contractor's System enters production. Moderate andMinor defects will be fixed and tested to the State'satisfaction prior to System acceptance.
14.2s All components of the Contractor's System willaccommodate leap year processing and daylight savingstime start/end dates
Rl.01
14.26 The Contractor will compare and contrast the design ofSystem components to CMS architectural standard. TheContractor will apply a documented and structuredArchitecture Development Methodology (ADM) for thedesign of System components. The Contractor will provideall necessary performance testing scripts with input from theState's Business Units. The State will have the final say onwhat is an acceptable performance.
Rl.01
Deployment Requirements
15.1 The Contractor will describe the implementation approachgy to be used for the Contractor's Systemand methodolo
RI.01
15.2 The Contractor will incorporate the implementationapproach into a comprehensive Implementation Plan whichwill be added to other PM plans as part of the PMO. TheState requires incremental deliveries of functionality to theproduction environment. The State anticipates considerablecollaboration with the Contractor in the plan's construction,with particular attention to high complexity components ofthe existing the State systems as well as the proposedSystem.
Rl.01
15.3 The Implementation Plan must include information ontechnical challenges, deployment schedule phasing. TheImplementation Plan will :
- Deliver Systems that include a significant portion of thetechnical infrastructure early in the schedule, withoutcompromising the quality or inherent security of TheContractor's System. This should also validate the desipn
R1.01
Number RequirementDescription Planned Release
S r,q.rn or VnnvroNto Coxtucr FoR Pnnsonar, SnnvrcnsDnpmrvruNT oF VrnvroNr Hp,qlrn AccnssEQHn,LLrn Sor,urroNs, INC.
Prcn 2llot268CoNrnacr #28739
AvrnNovrpNr # 2
and architecture.- Expose technically challenging areas of the project as soon
as possible.- Deliver customized functionality to the State inincremental pieces that are in logical business applicationsequence.
t5.4 The Contractor will develop aCapacity Plan to include, at
minimum, the following areas:
- System workload assumptions- A description of how System capacity and capacity
requirements were calculated, including all formulas and
calculations used in capacity planning for the State.
- A description of how System capacity requirements will be
met.- How capacily issues will be managed for all components
of the State project.- Descriptions of how capacity utilization will be monitoredand capacity thresholds will be established.- A description ofcorrective and escalation processes that
will be used in the event any capacity thresholds are
reached.
Rl.01
15.5 Disaster recovery requirements relative to the physical
System components and planning for recovery fromoperational failures are the responsibility of the Contractor.
The Contractor will develop an Operational Recovery Plan
that addresses the following:- Areas of the most susceptible to failure or disaster that
would result in downtime.- Recommendations for System recovery processes, or steps
to take in the event of a downtime event.- Recommendations for the State on how tocomprehensively and effectively mitigate the risk of adowntime event.- Recommendations for securing The Contractor's System
components during a period of emergency operation.- Testing Failover and DR while on Staging Platform after
testing has concluded and prior to deployment on
Production Platform.- DR requirements must include networking DR fotDatacenter access.
Rl.01
15.6 The Contractor will describe the interface management
approach and methodology used for The Contractor'sSystem Proiect
Rl.01
Srnrn or VrnvroNro Conrucr FoR PrRsoivLl, SnnvrcnsDRplntnmNT oF VrnvroNr lln.rr,ru AccnssEQHnllur Sor,urrONs, INc.
PAGE 212op268CoNrn-q.cr # 28739
AvrnNnnnnNr # 2
15.7 The Contractor will incorporate the interface managementapproach into a comprehensive Interface Management Planfor all interface mechanisms used for System (e.g. batch,ESB/web services). The Interface Management Plan will beused by the State to document the plan for integrating TheContractor's System with all systems internal and externalto the State. The Interface Management Plan will, at aminimum, document the following areas:- The approach to developing and managing internal andextemal System interfaces.- Technical tools that will be used for data transformation,transport and error recovery.- A description of how the Contractor's developmentstandards will be reconciled, to reflect use of ESB and webservices as wrappers to legacy systems. The Contractorshould produce example scenarios for integration reflectingtheir infrastructure components and toolset.- Tasks, deliverables and resources necessary to completeinterface development and implementation.- Description of how The Contractor's System developmentand test systems will work with the external interfaces.- References to applicable sections in the relevant designdocuments that describe how The Contractor's System willbe synchronized with the specific internal and externalinterfaces.- References to applicable sections in the detailed designthat describe the mappings between internal and externalSystem data and The Contractor's System data.- Descriptions of the process for managing changes to theinterfaces,both in the production and non-production environments- Interface(s) needed for maintaining data slmchronizationbetween aninterim production System and the final productionimplementation.- System interfaces, data format, frequency of updates andexpected data volume.- Process for interfacing and collaborating with interfacepartners, including roles, responsibilities, deliverables andtimelines.- How the State development and test systems will workwith the external non-production interfaces.- Interface tools
R1.01
15.8 The Contractor will validate that each interface is workingcorrectly. The Contractor will repair all interface-relatedproblems caused by Contractor -developed interfaces.
RI.01
Surn or VrnvroNt, CoNtrucr FoR PnnsoNar, SnnvrcnsDnp.lntunNT oF VnnuoNr Hralrn AccnssEQHnar,rn Sor,urroNs, INc.'
P.tcB 213 or 268CoNrru,cr #28739
AprnNovrnNr # 2
15.9 The Contractor will assist the State in identifying rootcauses for all System interface related blems
Rl.01
15.10 The Contractor will develop a Software ConfigurationManagement Plan
Rl.01
15.11 The Contractor will provide a software configurationmanagement System to store, control, and track instances
(baselines during the construction life cycle) of all softwareconfiguration items that will be developed for theContractor's System
Rl.01
15.t2 The Contractor must use a widely used "industry standard"
software confi zuration management toolRl.01
15.13 The Contractor will describe the requirements management
approach and methodology used for The Contractor'sSystem Proiect
Rl.01
T5,T4 The Contractor will incorporate the requirementsmanagement approach into a comprehensive RequirementsManagement Plan. The Requirements Management Plan
will be used by the project to assure that requirements are
met. The Requirements Management Plan will, at a
minimum, address the following areas:
- Establishment of a baseline for existing requirements.- Management of versions of requirements.- Establish and maintain the State's requirements traceabilitymatrix that willbe used for requirements management, and
will map where in the software a given req'uirement isimplemented.- A requirements change control process.
- A methodology for managing requirements in an iterativedevelopment life cycle.- Procurement, installation, and administration ofrequirements management tools.- A description of the relationship between the requirements
management role and the other roles (i.e. test management,
quality assurance management) on the project.- Publishing of standard reports related to requirementsmanagement.
R1.01
Srarr or VnnvroNT, CoNTRAcT FoR PnnsoNal SnnvrcnsDppantunNT oF VnnvroNt Hrnr,rn AccnssEQHnnr,rn Sor,urroNs, INc.
PAGE 214o1268CoNrn-q,cr # 28739
AvrnNnunNr # 2
15.15 When functionality is ready to be delivered to the State forUser Acceptance Testing (UAT), it will be delivered in theform ofa pre-production release (defined as ready forproduction in every respect but just not yet in production).Since the State will approve all releases into production, apre-production release is equivalent to a production releaseand requires the rigor associated with a production release.Upon successful completion of UAT, the State will schedulea release to be moved to the production environment.Each pre-production release will include the following:- Release-specific hardware and software Systemcomponents.- Release description including architecture or designupdates, new functionality introduced, defects fixed,modifications to interfaces with other systems, otherchanges to existing code, and any software and hardwareconfiguration changes.- Release contents including a description of the releasestructure and contents and instructions for assembling and/orconfiguring the components of the release.- Test Plan and test execution results.- Detailed hardware and software configuration informationincluding any software and hardware dependencies andinstructions at a level of detail that will enableadministration staff to rebuild and configure the hardwareenvironment without outside assistance.- Database documentation conforming to industry standards.- Uejtaited configuration information ior any 3rdiartyhardware and software.The Contractor will provide updated documentation whenSystem upgrades to software or equipment occurs throughthe life of the contract.
Rl.01
15.16 Deplo5rment will be iterative from both a business processand applied technology perspective and will be accepted bythe State through application of the acceptance criteria intesting plans
Rl.01
15.17 The Contractor will deliver to the State a requirementstraceability matrix for all delivered functionality, showinga-ll testing activities tracing to delivered functionality, and alldelivered functionality tracing to requirements in therequirements repo sitory
Rl.01
15.18 The Contractor will assist the State with testing and releasepreparation in the pre-production environment (Rl.01)
Rl.01
15.19 The Contractor must produce and execute anJmplementation Support Plan
Rl.01
Surn or VrnuoNt, CoNtn-a.cr FoR PnnsoNar, SrnvrcnsDnpaRrvrnNT oF VrnvroNr IInlLrH AccnssEQHnalrn Sor,urroNs, INc.
Pacn 215o1268CoNrnacr #28739
AnnnNounNr # 2
Rl.01t5.20 The Contractor must provide support staffing informationsuch as the proposed number, ratios, duration, and
roles/responsibilities for on-going support (as identified inpreviously submitted implementation approach aq41!4n)
RI.0115.21 The Contractor must assess the pre-implementationreadiness of each part of the organization and will document
the status in a pre-implementation readiness assessment. The
Contractor will conduct an implementation readiness reviewten days prior to cutover at each part of the organization.
Rl.0115.22 Upon successful completion of the pre-production testing,
the Contractor will, in coordination with the State, create a
Production Release Plan that will consist of an updated Pre-
Production Release notification to assist the State insuccessfully releasing and maintaining The Contractor'sSystem in the Production environment.It must include, but not be limited to, the followingcomponents:- Updated Configuration Information required satisfying The
Contractor' s System production confi guration managementrequirements.- Updated System Architecture.- Updated Detailed Design, including detailed system,
technical, and User documentation.- Deployment schedule- Blackout plan (complete/incremental)
Rl.01The Contractor will provide data conversion from legacy
systems to new System15.23
Quality Management Requirements
Rl.0116.1 The Contractor will describe the quality management
approach and methodology used for the Contractor's System
with input from the Business Units
Number RequirementDescriPtion Planned Release
Sr,q,rn or VnnvroNro CoNrnncr FoR PpnsoNu, SnRvrcnsDpplntvrnNT oF VrnuoNr Hn.ql,rn AccpssEQHnar,rn Sor,uuoNso INc.
P.lcn 216 or 268CoNrrucr # 28739
AurnnounNr # 2
6.2 The Contractor will develop a Quality Management Plan todescribe the approach they will use to ensure the quality ofThe Contractor's System and they work they perform. ThePlan will include at least the following items:. The State's management of the requirements. Thisincludes the identification of inconsistencies between therequirements, and the project's plans and work products.. The State's requirements traceability matrix that will beused for requirements management, and will map where inthe software a given requirement is implemented.. The State's configuration management activities thatinclude: baseline control, and monitoring the softwarelibrary. Approved changes to baseline software andlordocumentation should be made properly and consistently inall products, and no unauthorized changes are to be made.. The practices and procedures that will be followed forreporting, tracking, and resolving problems or issuesidentified in software development, System transition, andSystem maintenance.. The business process changes resulting from TheContractor's System.. A change readiness assessment of the State's organization.This may include a gap analysis and recommendations fororganization change required to support The Contractor'sSystem.. The quality of work products developed and delivered byContractor'ssub-Contractors/partners, if applicable.. A metrics process that describes how measurements willbe identified, collected, and analyzed to ensure that qualitygoals, including management and The Contractor's Systemgoals, are being met. It should also describe the types ofproject metrics used.. The Contractor's otganizational structure, and the rolesand responsibilities of Contractor staff as they relate toquality management.. Description of the processes and management of theDefect and Issue Tracking System for resolution of itemsand, if applicable, how corrective action plans will bedeveloped to address more significant issues.
Rl.01
Production Support and Transition uirements
o 1.1 The Contractor will describe the production support andapproach and methodology for the Contractor'stransition
R1.01
Number RequirementDescription Planned Release
Surn or VnnuoNt, Colvtru.cr FoR PrnsoNar, SnnvrcrsDnp.q,RtN{nNT oF VnnuoNr Hnar,rn AccrssEQHn,urn Sor,urroxs, Ii,lc.
Prcn 217 o1268CoNrnacr #28739
AvrnNlvrnNr # 2
System as agreed between the Contractor and the State
ot.2 The Contractor will incorporate the production support and
transition approach and readiness assessment into acomprehensive Production Support and Transition Plan
complying with the System architectural design, that willdescribe how the Contractor intends to support the System
and transition that support over to the entity responsible foron-soing production operations and support
Rl.01
o1.3 The Contractor will provide the State with regularly updated
list of personnel, contact information, and their area ofexpertise of who will be performing System productionsupport. Frequency of update will be agreed between the
Contractor and the State.
R1.01
ol.4 The Contractor will identify the root cause of comrpted data,
identify System for fix and repair comrpted data that is
associated with a problem in the System
RI.01
o1.5 With concurrence from the State, the routine planned
maintenance activities will be scheduled without disruptingthe negotiated operational hours. Contractor will providethe State with a copy of the schedule at least 30 days inadvance of the scheduled maintenance date for approval.
Rl.01
01.6 The testing tools and test configurations will be provided tothe State and responsible entities and appropriate training tothe State personnel will be provided as the System are
transitioned into support
R1.01
ot.7 The Contractor will provide instructions and training forresponsible entity support staff that may need to access and
support the System remotely (e.g. through PDAs, tablet PC's
throueh a VPN)
R1.01
o1.8 The Contractor will develop an automated process forpurging production System files ad determined but the State
data governance
Rl.01
o1.9 Upon completion of any maintenance call, the Contractorwill furnish a maintenance activity report to the State within24 hours and provide any clarification to the questions as
needed, which will include, at minimum, the following:- Date and time notified.- Date and time of arrival.- If hardware, type and serial number(s) of machine(s).- If software, the module or component name of the affected
software code.- Time spent for repair.- List of parts replaced andlor actions taken.
- Description of malfunction or defect.
- Description of root cause of malfunction or defects
RI.01
Sr.q.rn or Vnnvrott, CoNrnncr FoR pnnsoNlr, SnnvrcnsDnpanrvrnNT oF VnRvroNr Hn,lr,rn AccnssEQHnnr,rn SolurroNs, Inc.
Plcr 218 or 268CoNrnacr #28739
AunrovrnNr # 2
- Description of fixes
o1.10 The Contractor will produce documentation, which willserve as a user's instruction manual for administrative rolesof the application. It will include instructions on how tomanage the Contractor's System on a daily basis,descriptions of administrative user tasks, and what to do inabnormal situations.
R3
01.11 The Contractor's System component documentation willinclude at a minimum: (- A Data Dictionary- Data Model(s)- Interface design specifications- Passwords & activation codes- A Developer's Manual outlining and detailing operating,maintenance, development, processes, standards,procedures, plus any other technical information required tofully support the application.- Operations Phases and procedures including batch orbackground process schedule, dependencies, sequencing,and timing- Administrative Tasks including User's administration,System security administration, reference data maintenance,creation of report templates and maintenance of serviceprovider data and contracts.- Other reference materials and presentations required tosupplement the and support activities.
Rl.01
ot.t2 The Contractor will develop a High Availability & DisasterRecovery Plan for the entire System driven by State'sRecovery Time Obiectives
Rl.01
01.13 The Contractor will provide documentation that describesthe procedures for System administrators to add, update orremove User IDs and passwords
RI.01
01.14 The Contractor will submit a Service Desk Support Plan foruse by the responsible entity service desk addressing theitem including but not limited to:- Overview of support strategy assuming that the State willprovide tier t help desk support- Help and Service desk design- Help and Service desk operations (processes andprocedures)- Incident management procedures and processes includingescalation- Problem management procedures and processes- Reporting
Rl.01
01.15 The Contractor will provide the responsible entity with helpand service desk and decision trees for tier I help
Rl.01
Srarr or VnnuoNt, CoNtru,cr FoR PnnsoN.q'r, SnnvrcnsDnr.qnrNrBNT oF' VrnnnoNr Hnll,rn AccnssEQHn.rr,rn Sor,urroNs, INc.
Pr,cn 219 ot268Conrnlcr # 28739
AurNuunNr # 2
desk and Iier 2+ service desk support
This is an M&ODeliverable
01.16 The Contractor will provide a Transition-Out Plan at
minimum six months prior to production support contract
expiration. The Plan must contain transition task
descriptions for the transitioning services over to another
Contractor or Vermont, an organization chart, and jobdescriptions for all support staff.
R3ot.t7 The Contractor will provide instructions and training forresponsible agency support staff that may need to access and
support The Contractor's System remotelyThis is an M&ODeliverable
01.18 The Contractor will agree to continue normal operations
activities until completion of Transition-Out Plan activitiesand readiness assessment result is approved by the State
Rl FINALDuring the maintenance period (when no design,
development and implernentation (DDI) is occurring), the
maximum time to restore the functionality of The -
Contractor's System and resolve incidents will be within the
timeframes listed below:. Severity T.evel One incidents will not exceed four (a)
hours between the opening of an incident and final closure,
unless a time extension is approved by the State.. Severity Level Two incidents will not exceed twenty four(24) hours between the opening of an incident and finalclosure; unless a time extension is approved by the State.. Severity Level Three , Four and Five incidents are
prioritized and worked via the standard Defect Resdlutionprocess.
02.l
Rl.01Upon System acceptance, The Contractor's System will be
considered completely transitioned to production within the
State or the State's hosting partner (the responsible entity)environment and moved into the Maintenance and
Operations (M&O) phase. To prepare the State for thistransition, the Contractor, the State's hosting Contractor and
the State will collaboratively integrate the M&O Plan intothe State's M&O Plan. The Contractor will develop a formalmethodology to be used by the State and its hostingContractor to manage and operate The Contractor's System
during M&O that is documented in the State M&O Plan(s).
The M&O Plan will incorporate methodologies andpractices which will assist the State and its hosting
02.2
Srara or VnnvroNt, Contnncr FoR ptnsoNu, SnnvrcnsDnpanrvrnNT oF VnnuoNr Hrar,rn AccnssEQHnnlrn Sor,urroNs, INC.
Pacr 220o1268CoNrnacr #28739
AvrnNovruNr # 2
Contractor in successfully managing the M&O life cycle andwill address at least the following areas:. Support Model . Triage Procedures. Tools . Identificationof Roles and Responsibilities of support personnel . ReleaseManagement. Upgrades . Maintenance. On-goingOperations . Customer Support. Specific supportprocedures for production . Deliverables - RequirementTraceability Matrix, Architecture and design, test procedure,case, and scripts . Resource Requirements (staff loading) .Capacity Management . Technology Refresh. SystemSecurity. Backup and Recoverya Disaster . Defect/Issue management
System Adnrinistralion
03.1 The Contractor's System will provide data archivingbased on State defined criteria (R1.01)capabilities
Rl.01
o3.2 The Contractor's System will provide the capability to moveall historical, expired and/or unnecessary datato offlinestorage according to a set of business rules and schedule tobe defined by the State as apart of the ongoing systemoperational decision making (Rl .0 1 )
Rl.0l
03.3 The Contractor's System will maintain an archival processso that accumulated historical records and log files do not
large amounts of disk space (Rl.01)consume
R1.01
o3.4 The Contractor's System will provide an auto archive/purgeof the log files to prevent uncontrolled growth of the log andhistorical records storage using administrator-set parameters(Rl.01)
Rl.01
03.s The Contractor's System will provide version controlcapabilities to ensure the integrity of all software releases(Rl.01)
Rl.01
03.6 The Contractor's System will provide logging and reportingerrors and exceptions (R1.01)for
R1.01
03.7 The Contractor's System will monitor and provide reportson any unauthorized access (Rl.01)
Rl.01
03.8 The Contractor's System will provide User privilege reportson demand. The format shall minimally provide role, lastlogin, date of account creation, account type. (Rl FINAL)
Rl FINAL
03.8-l The Contractor's System will provide User privilege reportson request. The format shall minimally provide role, lastlogin, date of account creation, account type. (Rl.01)
Rl.01
03.9 All System communications will be protected by at least256-bit encryption
Rl.01
Number RequirementDescription Planned Release
Sr.l,rn or VBnvroNt, Coxtru.cr FoR PrnsoN.ql, SnnvrcnsDnpanrnnnNT oF VnniuoNr Hnar,tn AccrssEQHnllrn Sor,urroNs, INc.
Prcrc 221o1268Conrnacr #28739
AvrnxnvrnNr # 2
03.10 The Contractor's System will be supported by publickey/private key encryption Secure Socket Layer (SSL)
certificates
RI.01
03.11 The Contractor's System will provide admin tools and
maintenance routines to change access rights quicklyRl.01
03.12 The Contractor's System will use firewalls and
Demilitarized Zones (DMZs) for external access and remote
access
Rl.01
03.13 The Contractor's System will allow System administratorsto create and manage User accounts
Rl.01
03.14 The Contractor's System will prevent creation of duplicateaccounts
RI.01
03.15 The Contractor's System will allow System administratorsto assim status and permissions to User accounts
Rl.01
03.16 The Contractor's System will allow a system administratorto create new roles and profiles
Rl.01
03.17 The Contractor's System will allow system administrators tocreate and manage User roles
Rl.01
03.18 The Contractor's System will have the option to indicate the
type of User to be set up (e.g. System Administrator, Case
Manaser)
Rl.01
03.19 The Contractor's System will allow the grouping of multipleroles for the purpose of assigning access rights to those
roles.
Rl.01
o3.20 The Contractor's System will create a User profile for thenew User
R1.01
03.2r The Contractor's System will assign a User the proper
access roles and create a User name and temporarypassword (
Rl.01
c3.22 The Contractor's System will have the capability toautomatically deactivate a User account if there has been no
log-in for a specified time (e.g., 90 days). The deactivationpolicy, related rules and final review requirements to be
confizurable by the State.
Rl FINAL
o3.23 The Contractor's System will lock out a User after a
specified number of failed log-in attemptsRl.01
03.24 The Contractor's System will provide an online mechanismto unlock Users
RI.01
03.25 The Contractor's System will display all current User-specified preferences (ifexisting) or default preferences (ifnone exist)
Rl.01
Sr,q.rr or VnRwroNr, Coxrrucr FoR PnnsoNu, SnnvrcnsDrp.lRrvrnNT oF' Vnnuoxr Hrar,rn AccEssEQHnalrn Sor,urroNs, INc.
Pacn 222on268CoNrRlcr #28739
AnanNovrnrvr # 2
03.26 The Contraotor's System will allow Users to set up ormodify User preferences. Preferences may include:
a) Preferred method of communication (system emails)b) Subscription to alerts and notifications (e.g., changes to
member record, new messages, referral changes)c) Notification types desired
R3
03.27 The Contractor's System will display the selectedpreferences and allow the User to confirm or modifupreferences
R3
03.28 The Contractor's System will send a notification to the Userthat the personal preferences have been updated
Rl FINAL
03.29 The Contractor's System will have the ability to provideonline role-based access (as assigned/decided by VT) to casemanagement data, including but not limited to:
a) Program data and imaged documentationb) Member information (e.g., hospitalizatron, LTC facility,
pharmacy, PA information, State Plan services)c) Claims data (medical, pharmacy)d) Historical case, claims and enrollment datae) Eligibility informationf) Benefit packagesg) Provider informationh) Case notesi) Case activity codesj) Others as identified by VT and accepted via formal
change control
R1.01
03.30 The Contractor's System will have the ability to provideUsers role-based access (as assigned/decided by VT, roles tobe determined) to case management data. Users can bedefined as any of the following:
a) VT staffb) Nursesc) Other State agenciesd) Contractorse) Social workersf) Other entities as defined by VT
Rl.01
03.31 The Contractor's System will allow System administratorsto create User groups to manage workflow
R2
o3.32 The Contractor's System will allow System administratorsto assigr Users to particular local offi ces
R3
03.33 The Contractor's System will allow System administratorsto assign Users to particular User groups / units
R1.01
o3.34 The Contractor's System will allow System administratorsto assign Users to particular supervisors
R3
Surn or VrnuoNt, CoNtru.cr FoR PnnsoN.q'L SnnvrcBsDnplnrvrnNT oF VnnvroNr Hralrn AccrssEQHrar,rn Sor,urtoNs, INc.
P.r,cn 223o1268Conrru,cr #28739
AunNuivmNr # 2
Rl.0103.35 The Contractor will establish an automated maintenance
routine that will at a minimum: (Rl.01)- backup the User IDs and password data
- identifu expired IDs and related dataRl.0103.36 The Contractor will use offsite storage. Data backup should
be stored offsite in the event of a physical disaster
Rl.0103.37 The Contractor will provide a combination of disk and tape
(or equivalent) backups to protect Vermont data. Withprocedures in place for regular backup protection with a
defined timeline and scheduling. Backups of Vermont data
will take place using dedicated backup servers and tape (or
equivalent) libraries. Unless otherwise required by law,backup tapes will be encrypted, labeled, and shipped to asecure, fire-safe off-site storage vault facility managed by aPayment Card Industry (PCf Data Security Standard
certified Third Party Contractor where they will be retained
in accordance with requirements. The backup tapes will be
transported to the off-site facility on a daily basis by the
third-party storage Contractor. The Contractor will provide
documentation of processes for archiving and retrievingmaterial from the off-site storage Contractor
uirements
Rl.0104.1 The Contractor's System will have the ability to generate
administrative alerts and warnings when statistics indicatean impact or potential limits on System componentperformance and availability. The specific alerts will be
defined by the hosting services provider. The State has a
preference for the Oracle Performance Management toolsets
such as Oracle Enterprise Manager, Grid etc.Rl.01The Contractor's System will allow for all changes/updates
to the distributed components to be administered and
completed centrally and available immediately to all source
systems and sites
C,4.2
Rl.01The Contractor's System will provide Service LevelAgreement (SLA) monitoring and reporting capabilitiesService Level definitions will be drafted into a single
document provided as an attachment.
o,4.3
Rl.01The Contractor's System will securely support remote
control access (i.e. support personnel ability to take over the
User device for troubleshooting and support) capabilitiesdeploved for any type of User workstation
04.4
Rl.01104.5 The Contractor's System will provide event management
and monitoring functionality according to Inform4{gn-
Number RequirementDescriPtion Planned Releaase
Sr.lrn or VunuoNro CoNtnacr FoR PnnsoN,lr, SnnvlcrsDrpanrMsNT oF Vnnvronr Hw,rn AccEssEQHnlr,rn Sor,urroNs, INC.
P.q.cB 224o1268CoNrnq,cr # 28739
Annnxovrnxr # 2
Technology Infrastructure Library version 3 (ITIL v3) orequivalent best practices
04.6 The Contractor's System will provide ApplicationPerformance Monitoring and Management capabilities (i. e.transaction monitoring, synthetic transactions, componentroot cause analysis (e.g. Application Server Management)
Rl.01
o,4.7 The Contractor's System will provide State searchabletransaction tracking and log consolidation capabilities acrossall tiers of the application
Rl.01
Sr,q.rn or VnnvroNto CoNtnncr FoR PnnsoNar, SnnvrcnsDnp,q.RrvrnNT oF VnnuoNr lln.q.I.rn AccnssEQHnu,rn Sor,urroNs, INC.
P.c.cn 225 or 268CoNrnq,cr #28739
AunNovrnNr # 2
APPENDIX III- Non-Enumerated Functional Requirements
Appendix III. Non-Enumerated Functional Requirements
Non-Enumerated Functional RequirementNEGeneral (includes Document Management; Member,Authorized Representative, and CommunityProvider/P artner P ortal ; Alerts and Notifi cations ;
CentralizedWorkflow
NEl
Establish Case Criteria (includes Rules Management;
C andidate Identifi cation / Ri sk S tratification ; Eli gibilityNE2
Establish Case : Outreach; Case AssignmentNE3Perform Screening and AssessmentsNE4Manage Treatment Plan and OutcomesNE5Manage Case Information (includes Case
Documentation; Scheduling; Disposition; Transition;Care Coordination; Case Closure)
NE6
Manage Population Health OutreachNE7Manage RegistryNE8Authorization Determination (includes ReferralManagement; Service and Treatment PlanAuthorization)
NE9
ReportingNEl O
Consent
Sample List of ReportsNE11
Non-EnumeratedFunctional Requirement Number
Section Title
Document ManagementPlannedRelease
Requirementnumber
Requirement
R1
FINALallow the end-Users to work with scanned images or PDFs at
their point of origination without leaving the Contractor'sworkflow and User interface
NE1.1
R2NE1.22 notify the appropriate case manager for that specific member
that the document (and document ) has been received.R1FINAL
NEl.7 Other dynamic content includes User entered data that ispopulated from predefined fields in the Contractor's System
such as notes, comments, and letter specific text.R2Prompt persons (State employee, Contractor) during the letter
creation step of the Correspondence module.NEl.8
R2These text fields will include a required field constraint.NE1.9
General
Sr,rrn or VnnvroNr, CoNrnlcr FoR PrnsoN,tr, SnnvrcnsDnp,tnrvrnNT oF' VrnuoNr Hn.q.LrH AccnssEQHnalrn Sor,urroNs, INc.
Pacn 226o1268CoNrnrcr #28739
AvrnNuvrnNr # 2
NEl.1 0 Pre-populate future, or static date based on business rulesR2-R3
NEl.1 I enter freeform text in letters that can be applied to all selectedor identified members.
R2
NEl.12 Edit pre-populated date R2NEl.13 Allow User to freely navigate and allow information to be
changed on any page of the wtzardprior to submission.RIFINAL
NEl.14 Allow for Users to be edited R1
FINALNEl.15 Allow for Users to be deactivated R1
FINALNEl,1 6 Shall also allow for password sets/resets RI
FINALNEl.1 7 A role encapsulates specific User type scenarios in the
Contractor's System through a predefined set of permissions.These permissions will be mutually exclusive from roles andwill be assigned directly to a User in addition to a role. Thesepermissions can be applied at the data field level
R1FINAL
NEl.18 Include a configurable service-oriented workflow engine toallow the modeling of business processes and the executionand management of workflows. Activities to be modeledinclude assign.
R1FINAL
NEl.19 Execute the appropriate event at each step of the workflowprocess, based on that step ofthe process.
R1FINAL
NEl.20 Provide a workflow engine that allows the User to graphicallymodel the workflow processes and easily update them withouta core release of the Contractor's System requiring no
R1
FINAL
NE1.21 Generate Alerts and Notifications based on business rules asnecessary
RIFINAL
NEl.22 library of alerts and notifications to which will bepreconfigured rules that can be "attached" to a specificmember or defined globally.
R3 R2
NE1.23 Present the User, when logging in, with a pop-up boxinforming the User of new or unconfirmed alerts ornotifications that have been generated and allow the User tonavigate to the alerts sections of the Contractor's System toread and address each alertlnotification.
R1
FINAL
Sr,q.rr or VnRvrollt, Contnacr FoR PBnsoN.q'L SnnvrcBsDnrnnrvrBNT oF VunuoNr Hnalrn AccrssEQHnar,rn Sor,urroNs, INc.
Pacn 227 ot268Coxrnacr # 28739
AvrnNrvrnNr # 2
R1FINAL
NEl.24 Additionally, to a login prompt, as a User is actively workingin the Contractor's System a dashboard indicator will appear
to let the User know an alert or notification has arrived.R1FINAL
Provide links to program policies that will be visible at
appropriate times while navigating through a case.NE1.26
R1
FINALNEl.27 The Member information will allow a User to drill down from
a summarized view to the detail data.
Document ManagementPlannedRelease
RequirementRequirementnumber
R1
FINALNE2.I Provide step-by-step instructions to Users with appropriate
access through the Business Rules Management System(BRMS) for reviewing existing rules, modifying/editing rules
R1
FINALProvide an authoring tool that contains a rules library built on
State policies for Program eligibility criteria and Services
elieibilitv criteria.
NE2.2
R1
FINALNE2.3 Provide a front-end authoring tool that will allow State staff to
work on the rules on their schedule.R1
FINALEnable the rules built with the authoring system to be tested
without intemrpting the production environment.NE2.4
R1
FINALContain rules that are nested in a chained hierarchy orgrouped as named "Rule Sets"; which are groupings ofindividual rules allowing for the application of multiple,single. or all criteria for either eligibility or services criteria.
NE2.5
R1FINAL
NE2.6 Rules will be versioned to mirror system source code and be
maintained in the same repository and allow for capturing ofmultiple criteria sets to identify various population groups,
based on program policy.
R1
FINALUse a nationally recognized grouper such as J
adjusted clinical groups (ACG) System@ to determineprosram elieibility and severity levels.
ohns HopkinsNE2.8
R1
FINALEligibility rules criteria will be based andlor on nationalpractice zuidelines.
NE2.9
Rl FinalEach criterion will be used to evaluate and verify against
individual claims (both medical and pharmacy) data.NE2.10
The Contractor will provide training to appropriate AHSpersonnel on the ACG toolkit and allow for self-service
management and will work closely with the state to establish
an effective process for design and change management ofeach progtam's associated set of program eligibility rules.
NE2.13
Establish Case Criteria
Sr.q.rn oF VERMoNT, CoNrnacr FoR PnnsoNar, SrnvrcnsDrpanrvruNT oF VnRlroNr Hn,q.I,rn AccnssEQHnlI,rn Sor,urroNs, INc.
P.tcn 228 ot 268CoNrnA.cr # 28739
AnapNovrnr.lr # 2
NE2.14 Allow for program eligibility rules to be selected as active orinactive by using beginning dates and end dates for eachcriterion.
R1
NE2.15 Accept data through the Clinical Integration Framework (CIF) R1
FINALNE2.16 Run eligibility and risk stratification each time eligibility data
is obtainedRIFINAL
NE2.17 Send a referral with an initial/updated severity level to theassigned care coordinator.
R1
FINAL
CaseRequirementnumber
Requirement PlannedRelease
NE3.1 Route program-eligible Member contact information toappropriate User for outreach based on geography, loadbalance by case manager supervisors or filtered and mass-assigned by some other operational policv.
R2
NE3.2 a case manager when a case is assigned through theAlerts module. This assignment functionality will allow formultiple case management resources (case manager/internal
Alert
unit) to be simul assigned, listed and managed.
R2
NE3.3 Provide real-time care coordinator case mix profile visible toAuthorized Users.
Assign Additional Staff to CaseNE3.6 Case assignment changes and health edits will be validated
against the resources availability functionality.R3
Member's Profile SummarvRequirementnumber
Requirement PlannedRelease
NE4.1 Include a Member's medication list which will includemedications that have been automatically populated via theclaims and pharmacy data feeds as well as those that havebeen manually entered.
R1
Perform Screening and AssessmentsNE4.2 Support the ability to apply a weighted scoring assignment to
assessment and screening questions and aggregate the resultsto a final assessment score throueh the Form builder module.
R1
Perform Screening and Assessments
Establish Case
Srarn on VnruroNt, CoNtnacr FoR PBnsoNnr, SnRvrcnsDnp,q.nrvIBNT oF VnRnroNr Hnar,rn AccESSEQHn.rr,rn Sor-urroNs, INc.
' Pacr229ot268CoNrRacr # 28739
AmnwnvrnNr # 2
Create Plan of CarePlannedRelease
RequirementRequirementnumber
R2NE5.2 Provide a report that shows all Plan of Care items that have
been resolved in addition to those that are currently beingworked on by the care management staff.
Provide Education Materials
R2Members will have the ability to access specific educationtools throueh the Education Resources.
NE5.3
Case DocumentationPlannedRelease
Requirementnumber
Requirement
R1FINAL
Provide a configurable survey module that drivesdevelopment of the Plan of Care problems, goals, and
results/outcomes.
NE6.1
R1FINAL
NE6.2 Provide a configurable survey module which will be mapped,
and will auto-generate the Plan of Care based on system
configuration and evidence based standards for each
assessment/surveyR1FINAL
Provide a supplemental, searchable issues library that will be
available to allow manual selection of problems/goals by the
User.
NE6.3
R1
FINALEach problem/issue will be listed in the system and have
associated goals and interventions and will support structuredand standar dized, documentati on.
NE6.4
R3NE6.5 Problem attributes will include, but not be limited to, priority,outcome type, date identified, and source of identification and
reviewed by status.R1
FINALGoal attributes will include, but not be limited to, goal type,status, target completion, and actual completion dates.
NE6.6
R1FINAL
N86.7 Interventions will include, but not be limited to, interventiontypes, status, proiected and actual completion dates.
R1FINAL
NE6.8 Support mandated external reporting of incidents as required
by State and Federal lawR3 R2NE6.9 Allow for all, multiple, or single interventions to be selected
and then have any subsequent edits (such as Notes, Dates,
to all the selected Interventions.etc.) apply
Manage Treatment Plan and Outcomes
Manage Case Information
Sr.q.rr or Vnnvroxr, CoNrnacr FoR PBnsoNA.r, SnRvrcnsDrplRrvrnNT oF VunvroNr Hnlr rn AccnssEQHnalrn Sor,urroNs, INc.
Pacr 230 on 268CoNrntcr # 28739
AvrpNovrnNr # 2
NE6.l0 Allow Users to enter freeform text to communicatesupervisory review / comments that can only be viewed byUsers authorized to do so.
R2
SchedulingNE6.1 1 Allow authorized Users to create and modify meetings and
search by attendees.R3
NE6.l2 Allow the User to 'Block out' times unavailable R3 RlNE6.13 Provide mapping functionality which will be available within
the provider search tool and the scheduling module.R3
NE6.14 Provide printable map directions to each appointment. R3Document Case DispositionNE6.16 Provide State configurable disposition status fields. R1
FINALNE6.l7 Allow for cases to be automatically referred/ transferred to
other care management staff including a follow up Plan ofCare for new staff.
R1
NE6.18 Support documentation of the disposition post hospitaldischarge, Plan of Care status and the final case closure status.
R1
FINALCase TransitionNE6.21 Referrals are associated with referring, and referred entities. R1
FINALClose Program EnrollmentNE6.22 Allow member case data to be dynamic and updated in real-
time for stakeholder review on case status via the appropriatemechanism (portal, interface, etc.).
R2
NE6.23 Allow for follow up flags to be visible reminders on the Userdashboard based on follow-up criteria.
R1
NE6.24 Use a nationally recognized grouper, such as Johns HopkinsACG System integration, for gap in Pharmacy metricsregarding medicatiorVprescribed drug adherence andpossession rates.
R3
NE6.25 Use a nationally recognized grouper, such as Johns HopkinsACG System integration, for member's adherence withtherapy.
R3
NE6.26 Leverage a nationally recognized pharmacy data base such as
First Databanks'MedKnowledge to provide drug searchcapabilities, medication reconciliation, and contraindicationwamings.
R1FINAL
Care CoordinationNE6.27 Provide an integrated web based application and portals. R1
FINALNE6.29 Provide a modular, highly connected framework to allow all
stakeholders to collaborate electronically to improve thepopulation health including care management module.
R1FINAL
Srarn or VunuoNt, CoNtucr FoR PnnsoNar, SnnvrcnsDnp.q.nrvrnNT oF VnRvroxr Hnar,rn AccnssEQHn,lr,rn Sor-urroNso INc.
PAGE 231ot268Coxrnact # 28739
AvrnNovrnNr # 2
R1
FINALProvide a modular, highly connected framework to allow allstakeholders to collaborate electronically to improve thepopulation health including care coordination productivitymodule.
NE6.30
R1
FINALNE6.31 Provide a modular, highly connected framework to allow all
stakeholders to collaborate electronically to improve thepopulation health including report module.
R1
FINALNE6.32 Provide a modular, highly connected framework to allow all
stakeholders to collaborate electronically to improve thepopulation health including health and wellness module.
R1
FINALNE6.33 Provide a modular, highly connected framework to allow all
stakeholders to collaborate electronically to improve thepopulation health including evidence based care module.
R2Provide a direct link to communicate with Users through the
Messaging module. Internal and extemal Users/partnersactively working on or related to a member's case will be
section ofthe case record.listed in the case assigrtment
NE6.34
Manage Population Health OutreachPlannedRelease
RequirementRequirementnumber
R1
FINALNE7.1 The Contractor's System shall: i. NE7.1 Produce standard
reports monthly, except as otherwise defined during JointApplication Design (hereinaft er called "JAD") sessions.
R1Provide ad hoc reporting capability that allows development
by both Contractor and StateNE7.2
R1Have a DatalHealth Informatics Analyst on staff to develop
and assist the State in developing ad hoc and routine reportsNE7.3
R3NE7.4 Automatically assign lJsers, based on predeterminedparameters such as geographic location, to work with ClinicalLeads at provider and partner sites to address issues
highlighted in panel reportsR1NE7.5 Use predictive modeling analytics tools to provide details on
population health initiativesRIUse predictive modeling analytics tools to identify areas
where population health initiatives may be indicatedNE7.6
R3Be configurable per State specifications including by providerpractice site and/or clinical leads, with automatic member
assignment based on parameters, including but not limited togeosraphic and facility location, condition, staff license, etc'
NE7.7
R1NE7.8 Allow Users to document and log all contacts made withmembers, providers, practice andlor clinical leads, and otherparticipant's on a member/patient's treatment team including
and State defined and configurable fieldssystem pre-defined
Manage Population Health Outreach
Sr.q.rn oF VERMoNT, CoNrrucr FoR PBRsoN.c,L SnnvrcssDnplnrivrnNT oF' VnnvroNr Hnar,rn AccrssEQHnn ur Sor,urroNs, INc.
Pacn 232o1268CoNrnrcr # 28739
AvruNuwrnNr # 2
N87.9 Be configurable to support session notes in which type ofcontact, method of contact, and content of contact can all bedocumented
R1
FINAL
NE7.10 Provide fields that are configurable at the State level R1
FINALN87.11 Integrate with a predictive modeling tool such as Johns
Hopkins ACG and utilize claims data to analyze a populationon dimensions including but not limited to chronic condition,age, gender, Primary Care Provider (PCP), programenrollment
R1FINAL
Program Education MaterialsNE7.12 Integrate with a nationally recognized health care
knowledgebase (e.g., Health wise@) with continuous updatesto provide evidence based educational materials that can beviewed online, printed or electronically sent to a patientandlor provider and other stakeholders involved in membercare.
R1FINAL
NE7.13 Track all educational correspondence and recordcorrespondence history that is viewable to Users.
R1FINAL
Care Coordination Program GoalsNE7.14 Support targeting specific chronic disease processes for a
member and support management of chronic illnesses, otherco-morbid health conditions, behavioral health issues, andlorpsychosocial issues
R1
FINAL
NE7.15 Support evaluation of quality, continuity, accessibility,timeliness and outcomes of care management servicesprovided including process and quality improvement featuresto monitor care coordination efficiency, including but notlimited to
R1FINAL
NE7.16 Monitoring evidence of the participant-physician-carecoordinator relationship
RIFINAL
NE7.17 Monitoring care across all health care settings R1
FINALNE7.18 Documenting and monitoring social support needs,
interventions and results of the population.R1FINAL
NE7.19 Development, implementation, monitoring, and evaluation ofindividualized care plans. (Rl.02) (Rl FINAL)
R1FINAL
NE7.20 Coaching and behavior modification activities to promoteparticipant self-care
R1
FINALNE7.21 Monitoring of participant health status via administration of
evidence based health risk assessments (HRA) and diseasespecific assessments, self-care education, coaching andbehavior modification, wellness screenings, in person andtelephonic on-going engagement, and resolution of barriers tocare.
R1FINAL
Sr,trn or VnnvroNto Contnacr FoR PnnsoNar, SnnvrcnsDnplnrrvrrNT oF Vnnvrour IIn.q.LrH AccrssEQHnnlrn Sor.urroNs, INc.
Pacn 233o1268CoNrn-q.cr # 28739
AvrnNoutwr # 2
N87.22 Identification of participants for care coordination services
based on but not limited to program eligibility criteria,predictive modeling and current utilization pro fi1es
R1
FINAL
NE7.23 Support multidisciplinary Users engaged as members of the
care management team
R1
FINALN87.24 DocumenVtrend improvement in participant clinical and
financial measures and quality of life (survey tools, evidencebased tools)
R1
FINAL
NE7.25 Support and promote physician adherence to evidence based
care standards for each disease process, via reporting and
trending by provider of treatment gaps
R1
N87.26 Support and promote physician understanding and adherence
to nationally recognized practice guidelines via gap in care
report
R1
N87.27 Support reduction in treatment variation by monitoring,evaluating, and reporting on physician treatment againstnational and state standards, and provider peers
R1
NE7.28 Manage and document utilization and cost savings based on
integrated care coordination including but not limited to thetotal population vs. program eligible and intervenedpopulation(s), disease specific measures of improvement, and
staff specifi c performance improvement
R3
Scope of ServicesNE7.29 Track delivery of services that are holistic, individualized, and
evidence based and track multiple modes of communicationand engagement, including but not limited to
R1FINAL
NE7.30 In person, telephonic, electronic including via provider and
patient portals, and/or mail and other written forms ofcommunications
R1FINAL
NE7.31 Interventions for monitoring and tracking include R1
NE7.32 Predictive modeling to population identification for VCCIeligible members by the vendor including high risk/costconditions and participants; as well as via other methods
R1
NE7.33 Risk stratification to ensure the right interventions are beingprovided to the right participants
R1FINAL
N87.34 Establishment and ttilization of a Medical Home R1
FINALNE7.35 Health Education tools and related tracking of supports
provided by member and UserR1FINAL
NE7.36 Health Coaching supports provided for behavior change RIFINAL
NE7.37 Health and wellness promotion services and goals includinglifestyle modifi cations.
R1
FINALNE7.38 Medication Adherence/medication reconciliation tracking to
support evidence based care
R3
Srarn or VrnuoNr, CoNrucr FoR PrRsoNlt SnnvrcnsDpplnrvruNT oF' VnnvroNr Hnl.t,tn AccnssEQHrar,rn SolurroNs, INc.
Pacn 234or'268CoNrnacr #28739
AvrnNrunNr # 2
NE7.39 Smoking Cessation resources and progress toward goalachievement
R1
FINALNE7.40 Depression Screening and related scoring and trending of
resultsR3
NE7.41 Assessment of psychosocial barriers to health and progresstoward resolution
R2
NE7.42 Medical and psychosocial referrals and status of results. R1
FINALNE7.43 Monitoring o f face-to -face collaboration frequency between
care coordinators and program participants and impact onresults
R1FINAL
NE7.44 On-going assessment of the participant's medical and
lsychosocial issues with comparisons over timeR3
NE7.4s Ability to develop and implement an individualized,collaborative plan of care among treatment/support team
R1FINAL
NE7.46 Electronic monitoring tools and systems for Providernotification of care coordination enrollment and related
level by individual and panel of patients
R3
NE7.47 Tracking of on-going, frequent interactions between carecoordinators and a participant's designated medical home
RIFINAL
NE7.48 Provider profile reporting capability related to utilizationpattems and adherence to condition specific standards of care
{gap in care reports).
R3
NE7.49 Provider education materials to support evidence-basedpractice guidelines.
R1
FINALProgramsNE7.50 The Contractor's System shall include the following
components to support care coordination integration ofclinical treatment guidelines, disease prevention strategies,patient self-care education, and social support services while
a quantifiable cost savings to the payer
R3
NE7.51 Population Identification that will be performed by theContractor's analytic staff and include use of predictivemodeling tools to identit, members based on medical andpharmacy claims, data, analTrtics data, provider, facility, orparticipant sel f-referral s
RIFINAL
NE7.52 Population Stratifi cation that categorizes eligible membersinto severity levels based on predictive model data findings,clinical data, andlor assessment findings. Stratification will beupdated regularly based on clinical data receipt, carecoordinator encounter, andlor at least every six months for theentire population
R1
FINAL
NE7.53 Evidence-based care guidelines to support Plan of Caredevelopment and monitoring of treatment adherence byprovider and member
RIFINAL
Srarn or VnnvroNt, CoNtru.cr FoR PBRsoNu, SnnvrcnsDnp.q,nrNInNT oF VnnvroNr Hn.ll,rn AccnssEQHnalrn Sor.urroNs, INc.
Paca 235o1268CoNrnacr #28739
AunNuvrnNr # 2
R1
FINALNE7.54 Monitoring of member engagement and readiness to change,
tracking progress toward clinical and psychosocial problemas outlined in the Plan of Care goalsresolution/goals
R1FINAL
Development, implementation, sharing, and monitoring ofprogress on individualizedplans of care goals as generated byresponse to evidence based health assessments, systemgenerated triggers and case manager results
NE7.55
R2NE7.s6 Documentation and management of Care Transitionsincluding from inpatient to outpatient settings as well as levels
of service provisionR3t.Monitoring participant collaboration andNE7.57R2Monitoring provider and practice level collaboration and
engagementNE7.58
Manaqe RegistryPlannedRelease
RequirementRequirementnumber
R1NE8.1 Support bi-directional exchange of clinical and other data inmultiple standard protocols and formats via the ClinicalIntegration Framework (CIF) module. Supported
will include but not be limited toformats/protocolsR1FINAL
NE8.3 Maintain performance measures at the member and other
designated levels and a static "snapshot" captured at an agreed
upon frequency for graphic trending analysis to include 'rollup' for population level reporting
R1FINAL
Analyze all available data, including the predictive modelingengine output, to generate a panel of clinical gaps
N88.4
R1
FINALAnalyze all available data to generate a panel of clinical gapsNE8.4-1
R3Use a nationally recognized grouper (e.g., Johns HopkinsACG) to determine medication gaps that indicate a member'sadherence with therapy, including but not limited to: thenumber and duration of gap, medication possession ratio(MPR), continuous medication availability ratio (CSA), and
risks if untreated.
NE8.5
Referral ManagementPlannedRelease
Requirementnumber
Requirement
R2NE9.I Create and route referrals electronicallyR2 R3Acknowledge referrals, accept referrals, and track referral
status. The Contractor's System shall setup automated
notifications related to the referral
NEg.2
Manage Registry
Authorization Determination
Srarr oF VERMoNT, CoNrnncr FoR PnnsoN,c.L SnRvrcnsDnplnrvrnNT oF VnnvroNr Hrar,rn AccnssEQHnllnr Sor,urroNs, INc.
P.q,ca 236 ot 268Courrutcr # 28739
AvrBNrvrcNr # 2
NEg.3 Allow a User to modify or withdraw a referral. R1FINAL
NE9.4 Search for referrals R1Prior AuthorizationNE9.15 The Contractor's System shall support all the uploading of
supporting documentation for review by Authorized Usersand via their respective portals.
R2
Requirementnumber
Requirement PlannedRelease
N810.1 Where applicable, provide reports consisting of clinical andoperational performance measures (through Inter-raterReliability tools), financial, satisfaction, and quality of lifemeasures on a population level.
R3
NE10.2 Where applicable, provide reports consisting of clinical andoperational performance measures (through Inter-raterReliability tools), financial, satisfaction, and quality of lifemeasures on a program level
R3
NE10.3 Where applicable, provide reports consisting of clinical andoperational performance measures (through Inter-raterReliability tools), financial, satisfaction, and quality of lifemeasures on a@individual level.
R3
NE10.4 Complete outcomes reporting must be semi-annually and morefrequently as requested by the State. Outcomes and reportingdata will be based on claims data, information collected in theCare Management Contractor's System, other State agencies orprograms, providers, ACOs, etc.
R3
NE10.5 Structure the reporting processes to ensure consistentand interpretation of data that is gathered.
R1
NE10.6 Monitor and report on service, program, clinical and financialoutcomes, which support program operational, regulatory andcertifieation goals.
R2-R3
NE10.7 These reports may include but are not limited to: Eligiblepopulation;
i. Population distribution (age, gender, geography,acuity)
Population that received care.
R3
NEl0.8 These reports may include but are not limited to:Eligible population (aft er exclusionary criteria applied);
iii. Population (age, gender, geography, acuity)Population that received care.
R3
N810.9 These reports may include but are not limited to:Product Program Reports on
R3
Reporting Requirements
Sr.lrn or VnniuoNt, CoNtRlcr FoR PrnsoNn SnnvrcnsDnpaRtvrnNT oF VnnuoNr HBnlrn AccBssEQHn,ll,rn Sor,urroNso INc.
Prcn 237 o1268CoNrru,cr #28739
AvrnNnurNr# 2
i. Enrollment statistics, (e.g., referrals, opt-out, engaged,
unable to contact and reason, cases closed and reason, health
condition, etc.)ii. Health Conditioniii. Participation-Totala. # of active participation (engaged with a CC) by severitylevel;b. Total # of active participants with an individualized plan ofcare.
iv. Clinical- Condition specificv . Utllization and Preventativea.Vo of enrollees with 2 or more MD office visits within 12
monthsb. o/o of enrollees getting a flu vaccinec. o/o of ewollees getting pneumonia vaccine within last 5
yearsd. Other Wellness/Preventive care screenings based on themember population.
NEl0.10
viMember satisfaction surveyPlan of Care outcome\
Length of program pation
R3
N810.11V
These reports may include but are not limited:Length of stayvi. Admissions for specific conditionsPharmacy costs in relation to overall costs
R3
NE10.l2 Total # patients referred, enrolled, number of member and
provider encountersTotal # patients unable to contactc. Related to no valid phone #d. Related to unable to reach the patient either in person
or.telephonicallyNumber of initial screenings completed
RI
NEl0.l3 Description: Provides details on Staff productivity over apredefined timeframe. Staff parameters may include theindividual, departments, etc.
R3
NEl0.14 Provides details on caseload by staffover a predefined
timeframe.
R3
NE10.l6 Provides details on population report on geographic
variability ofchronic diseases - "hot spotters" by geography
and practice (prevalence of condition(s) by a) region, b)provider practice)
R3
NEl0.17 Description: Provides details on member adherence tomedication for a specific condition as well as percentage ofenrolled members with completed assessments and
medication adherence issues
R3
Srarn or VnRvroNr, CoNrnacr FoR PunsoNar, SnnvrcnsDnpanruuNT oF VnnmoNr HEALTH AccnssEQHnnlrn Sor,uuoNs, INc.
Plcr 238 or 268Conrnacr # 28739
AvrnNovrnNr # 2
NE10.20 Provides overview of clinical outcomes achieved by memberimproved AIC (A1C), less ED utilization, etc.such as
R3
NE10.23 Provides Program-specific operational metrics including butnot limited to: - Percentage of caseload capacity, those withSNA, etc. based on given metrics re: staff.
R3
NE10.27 Provides Member's health profile compared to Memberpqpulation profile and overall population profile
R3
NE10.30 Product Member Reports oni. Member satisfaction surveyii. Plan of Care outcomesiii. Length of program participation
R3
NE10.32 Provide performance information on PCPs in terms ofmeasures for keeping patients with chronic conditions withingoalhange for those conditions to include drill-down intooutreach reports, specific patient data and visit planners, andtrending over time (such as 12-month look back). Thesereports would provide comparative analyses on providersagainst other providers within a practice, within the HSA, andacross the State.
R3
NE10.33 Clinical measure reports required by HRSA for FQHCs. Forexample, patients ages 18 - 75 with a diagnosis of diabetes,who meet all the numerator targets of this composite measure:A1c < 8.0, LDL < 100, Blood Pressure < 140190, Tobacconon-User and for patients with diagnosis of ischemic vasculardisease daily aspirin use unless contraindicated.
R3
C o nse nt Manage m ent Re q uire mentsContract#28739Requirementnumber
Requirement PlannedRelease
NEl 1.4 sort and filter by pertinent fields, for a member's consentrecord
R1FINAL
Health Care ReformContracf#28739Requirementnumber
Requirement PlannedRelease
NE12.1 Align with Vermont's health care reform plans during theterm of the Contract. (Rl FINAL)
R2
NE12.2 Provide integration with HSE platform and MMIS system tocreate a continuity of record at the person level. (Rl FINAL)
R1
FINAL
Consent Management Requirements
Health Care Reform
Srarn or VnnuoNto CoNtRlcr FoR PrnsoNar, SnnvrcnsDnp.q.nrvrnNT oF VnnivroNr Hnar,rn AccnssEQHnllrn Sor,urroNs, INc.
P.tcr 239 or268CoNrnacr # 28739
AvrnxrprnNr # 2
R3NE12.3 Provide integration with Vermont Health InformationExchange (HIE) to create claims and clinical continuity of care
records and the creation of data profiles at the member,physician, and provider facility levels for data transparency.
C ase Msnase m ent C ertilic atio nPlannedRelease
RequirementContract#28739Requirementnumber
R1FINAL
NEl3.1 Meet and maintain the requiremsnts that will allow State
programs to secure certification in Case Management by theNational Committee for Quality Assurance (NCQA). (RlFINAL)
R1FINAL
NE13.2 Meet and maintain the requirements that will allow State
programs to secure certification in Disease Managementandlor Health Utilization Management by the UtilizationReview Accreditation Commission (URAC) or NationalCommittee for Quality Assurance (NCQA).
Case Management Certification
Srlrn or VnnuoNt, CoNrrucr FoR PnRsoNar, SnnvrcnsDnpanrvrnNT oF VnnvroNr Hnar,rn AccEssEQHnllrn Sor,urroNs, INC.
Prcn 240ot268CoNrnq,cr # 28739
AmnNovrnNr # 2
ATTACHMENT B - PAYMENT PROVISIONS
The maximum dollar amount payable under this contract is not intended as any form of aguaranteed amount. The Contractor will be paid for services actually performed, as specified inAttachment A, up to the maximum allowable amount specified on page I of the Contract.
1. Contractor must submit a certificate of insurance that meets the minimum coverage amountsrequired under this Contract prior to commencement of any work and submission of anyinvoice to the State.
2. Invoices must be rendered on Contractor's standard billhead or official letterhead. Contractorshall include the Contract # of this contract on all invoices. The Contractor shall submitinvoices for the previous period on the 5th busiqess day of the next month. The Contractorshall submit invoices to the State for actual hours worked or deliverables accepted andapproved by the State Authorized Representative, in accordance with the rates and schedulesoutlined in this Agreement.
3. Unless otherwise specifically provided in Attachment A, Contractor shall issue to the State,monthly in arrears, an invoice in U.S. Dollars for the amounts due for work provided inAttachment A provided in the previous month. Fach invoice shall include such detail andcategories of information as mutually agreed upon by the parties. Each invoice shall itemizethe specific sections of the Statement of Work on which such Charge is based and includecalculations used to establish such Charges. Invoices shall be coded and charges segregatedas directed by the State to facilitate proper accounting among multiple funding sources anddifferent cost allocations among different parts of the solution. All periodic Charges underthis agreement (excluding charges based upon actual usage or consumption of Services) shallbe computed on a calendar month basis and shall be prorated for any partial month.
4. Invoices must be submitted electronically to: [email protected]
5. Payment of each invoice is due within thirty (30) days of receipt of correct invoice.Contractor shall be paid based on documentation anditemization of work performed andincluded in invoicing as required by 32 V.S.A. $ 463.
6. Per Attachment A, G (2), Contractor shall submit monthly reports regarding Service LevelRequirements to the State. Any credits due to the State based on this monthly report shall bereflected in the following month's invoice.
7. Contract Maximuma. All rates set forth in this contract are all-inclusive, no expenses, benefits or insurance
will be deemed reimbursable to the Contractor by the State under this Contract.
Srlrn or VnnuoNt, CoNtrucr FoR PnnsoN.q.L SnnvlcnsDnpa.nrvrnNT oF VnRvroNr Hnl.LrH AccnssEQIInar,ru Sor.urroNs, INc.
Table B-1 Total Cost Summary Base Years
Pacn 241o1268CoNrnlcr #28739
AvrnNnvrnNr # 2
$11 1,450
$25,650
s3,213,750
$1,057,731
$23,320,217
$11,078,735
$7,775,901
$57,000
$ I I 1,450
$25,650
$3,213,750
$734,006
$0
$11,917,757
Total Costsincluding One-Time Costs andOngoing Costs
s7,775,901
$57,000
$0
$2,484,000
1,701,668
$0
$40,000
$9,500
s642,750
$90,082
$40,000
$9,500
$642,7s0
$318,912
$0
$2.714,665
$1,703,503
$0$11,400
$31,450
$6,6s0
s64L7s0
s325,0t2
$0
92,7r4,665
sr,697,403
$0
$0
$642,750
$0
$0
$2,r33,777
sl,468,227
$22,800
$0
$0
$1,870,650
$1,205,100
$22,800
$0
$0
$642,750$0
s323,725
11,402,460
$11,078,735
Packaged SoftwareCosts
Change Requests
Total Costs
SolutionImplementation
ApplicationMaintenance and
Operations Support
Hosting and DisasterRecovery Support(Until FullDeployment)
Hosting after fuIldeployment
Disaster Recovery afterfull deployment
Total DDIOne-time
Costs
M&OCosts
Year 1
M&OCostsYear 2
M&OCostsYear 4
M&OCostsYear 5
Total Cost Summary
Description
TotaICosts
Total M&OCosts
M&O Costs
Year 3
Sr,q.rn or VnRnnoNt, CoNrnacrDnp.lnrlrnNT oF Vrnuoxr Hnlt,rn AccnssEQ Hnlr,rH SoLUTToNS, INC.
P.lcn 242 oF 268CoNrnq.cr 28739
AvrnNnvrrxr #2
b. In the event the State elects to pursue either of the optional years after Year 5 (Years 6 and 7) of this Contract, the Contractoragrees to the prices for its work indicated in its bid to the State as follows:
Table B-2 Years 6 & 7
c. TASKS 1 -10 -Deliverable Based Payments for DDI and On-Going Task(s)The Contractor will perform TASKS 0 through 10, as specified in Attachment A of this Contract, on a fixed price basis, withpayments tied to contractually-defined deliverables and the State's finding of satisfactory performance. Deliverables areconsidered approved when the State issues a Deliverables Acceptance Document (DAD) signed by the State's authorizedrepresentative.
Deliverable 6-D, System Source Code and Documentation, for each Release will be due upon receipt of payment by Contractorfor approved Deliverable J-8, Phase Acceptance and after 7-F Project Closeout/System Acceptance. Updated code will bedelivered to the State quarterly after Contractor receives all M&O payments for the quarter.
$3,403,556
$0
$80,000
$19,000
$1,285,s00
$179,944
$4,968,000
$4,968,000
$3,403,556
$0
$80,000
$19,000
$1,285,s00
9179,944
$4,968,000
$1,701,888
$0
$40,000
$9,500
$642,750
$89,862
$2,484,000
$1,701,668
$0
$40,000
$9,s00
$642,750
$90,082
$2,484,000
Solution Implementation
Application Maintenance and Operations Support
Hosting and Disaster Recovery Support (Until FullDeployment)
Hosting after fuIl deployment
Disaster Recovery after full deployment
Packaged Software Costs
Change Requests
Hardware Costs (if applicable)
Total Costs
Total OngoingCosts
M&O CostsYear 6
M&O CostsYear7
TotalCostsTotal M&O Costs
Total Cost Summarv (Optional Years 6 & 7)
Description
Srarn or Vnnuonto CoNtru,ctDnpanrvrnNT oF Vnnvrour Hn.q.LrH AccnssEQ He.Lr,ru Sor,urroNs, INc.
Table B-3 Task-Related Deliverables
Table B-4 DDI Task Related Deliverables.
Prcn 243o1268CoNrru,cr 28739
AvrnNnvrnNr.#2
The actual due dates for deliverables are reflected in the approved Project Plan and
Schedule for each major release, as indicated in Attachment A. The baseline Project
Schedule typically is reviewed and updated weekly, as needed. Enclosed herein is the
deliverables-based payment sequence:
Ongoing across the
Contraot Lifecycle(Months 1-60)
9179,026*
Proj ect Status Reporting (recurring
throughout the length of the Contract,
frequency to be determined with State)
*The Contractor shall invoice for Task 0
monthly and shall not exceed $2,983.77 a
month without prior written approvalfrom the State AuthorizedRepresentative(s).
Task 0 - Project Monitoring and Status
Reporling
QE 6/2016Release 1$89,513
Task 1A - Project Kick-offPresentation
QE 6/2016Release I$89,513
Task 18 - Project ManagementPlan
$89,513QE 6/2016Release 1Task lD (R1) - Requirements
Analysis, System Design and
Development Strategy
$71,610.30QE 6/2016Task 1C -
Project Work Plan and fullyresourced Schedule
1 .0 1
QE 6/2016Rl Final $167,090.70
Task lC -Project Work Plan and fullyresourced Schedule
QE 6/2016Release I$268,539
Task 1E - System ImplementationStrategy
QE 6/2016Release 1 $t79,026Task lF - Master Testing Strategy
QE 6/2016Release 1$111,891
Task 1G - Requirements
Traceability Plan
MajorReleaseNumber
State ofVermontPayment
EstimatedPayment Date(by StateFiscal Year
Quarter End)
Release totalDELIVERABLE
Surr or VnnvroNr, CoNtnacrDnp.q.RrNrnNT oF VnnuoNr Hn,qlrH AccnssEQ Hnlr ur Sor.urroNs,INc.
PacB 244o1268CoNrrucr 28739
AvrnNovrnNr #2
Task 2,{ - FunctionalSpecification and System DesignDocument
1.01 $26,853.90QE 6/2016
Task 2,{ - FunctionalSpecification and Systern DesignDocument
Rl Final -$62,659.10QE 6/2016
Task 28 - Data Integration andInterface Design Document
Release 1
$179,026 QE 6/20r6
Task 3,{ - System ImplementationPlan
Release 1$44,756 QE 6/2016
Task 38 -Datalntegration andSynchronization Plan, includingmultiple test files (MMlS/claims,PBM, eligibility, VCCI legacy,etc.)
Release 1
$477,402
QE 6/2016
Task 2C -System Architecture Release 1 $358,052 QE 6/2016Task 2D - Technical DesignDocument
1 .0 1$59,675.33 QE 6/2016
Task 2D - Technical DesignDocument
Rl Final$119,350.66 QE 6/2016
Task 4,{ (R1) - Test Plan $59,675 QE 6/2016Task 5,{ (R1) -Training Plan
1 .0 1$17,902.50 QE 6/2016
Task 5,A' (R1) -Training Plan
Rl Final $4t,772.50 QE 9/2016
Task 6,4. (R1) -Deployment Plan 1.01 $17,902.50 QE 6/2016Task 6,4. (R1) -Deployment Plan Rl Final s4t,772.50 QE 12/2016
Task 48 (Rl) - Test Scenarios,Test Cases and Test Scripts
1 .0 1 $7,161.00QE 6/2016
Task 48 (R1) - Test Scenarios,Test Cases and Test Scripts
R1 Final $16,709.00QE 12/2016
Task 4C (Rl) - DocumentedSystem Test Results
1 0 1$35,805.30 QE 6/2016
Task 4C (R1) - DocumentedSystem Test Results
Rl Final $83,545.70 QE r2/2016
Task 58 (R1) - Training Manuals,End-User Guides and Materials
1.01$17,902.50
QE 6/2016
Task 58 (Rl) - Training Manuals,End-User Guides and Materials
Rl Final $4t,772.50 QE 3/2017
Task 68 (R1) - System Incidentand Defect Resolution Report
1.01 $7,161.00 QE 6/2016
Task 68 (R1) - System Incidentand Defect Resolution Report
Rl Final $16,709.00 QE 12/2016
Sr,trn or VpnuoNt, CoxtnlctDnpmrvmNT oF Vnnvronr Hnar,rn AccnssEQ Hnar,rn Sor,urrons, INc.
PAGE 245o8268Conrru,cr 28739
AvrnNpvrnNr #2
Task 3C - System Maintenance
Support Plan$238,701 QE 6/2016
Task 6C -Completed Detailed Functionaland Technical SpecificationsTraceability Matrix
1.01
$35,805.30
QE 6/2016
Task 6C -Completed Detailed Functionaland Technical Specifications
Traceability Matrix
Rl Final $83,545.70
QE 12/2016
Task 5C Conduct Training - Rl 1.01 $3,580.50QE 6/2016
Task 5C Conduct Training - Rl R1 Final $8,354.50QE 12/2016
Task 5D(R1) -
Documented Evidence ofSuccessful End-User Learning -
R1
1.01
$35,805.30
QE 12/2016
Task 5D(R1) -Documented Evidence ofSuccessful End-User Learning -R1
Rl Final $83,545.70
QE 6/2016
Task 7A R1 Readiness Approval 1.01 $13,426.80QE 6/2016
Task 7A Rl Readiness Approval Rl Final $37,329.20QE 12/2016
Task 9E - Tier 2 Service DeskPlan
Release 1
8477,402QE 6/2016
Task 6E Deployment (R1) 1.01 $53,707.80 QE 6/2016
Task 6E Deployment (R1) Rl Final $125,318.20 QE 12/2016
Task 6F (R1) - Performance SLAs 1.01 $214,830.90 QE 6/2016
Task 6F (R1) - Performance SLAs R1 Final s501,272.r0 Q,E 12/2016
Task 6D (R1) - System Source
Code and Documentation After 7-B $59,675QE 6/2017
Task 78 (R1) -Complete Rl Phase Close Out
Release 1$954,805
$5,721,367QE 6/2017
Task lD (R2) - Requirements
Analysis, System Design and
Development Strategy
Release 2
$111,891QE s/2017
Task 4,A' (R2) - Test Plan Release 2 $59,675 QE e/2017
Task 54. (R2) - Training Plan Release 2 $59,675 QE 6/2017
Sr,rru or VnnuoNr, CoNrucrDnplRrvrnNT oF' VnnvroNr Hpaltn AccnssEQ Hnar,rn SolurroNs, INc.
Pacn 246o1268CoNrnacr 28739
AvrnnnprnNr #2
Task 6,{ (R2) -Deployment Plan Release 2 $59,675 QE 6/2017Task 48 (R2) - Test Scenarios,Test Cases and Test Scripts
Release 2$23,870 QE 9/2017
Task 4C (R2) - DocumentedSystem Test Results
Release 2$119,351 QE 9/2017
Task 58 (R2) - Training Manuals,End-User Guides and MaterialsUpdates
Release 2
$59,675QE 9/2017
Task 68 (R2) - System Incidentand Defect Resolution Report
Release 2$23,970 QE r2/2017
Task 6C - Completed DetailedFunctional and TechnicalSpecifications Traceability Matrix
Release 2
$119,351QE 9/20r7
Task 5C Conduct Training - R2 Release 2 $1 1,935 QE 9/2017Task 5D (R2) - DocumentedEvidence of Successful End-UserLearning
Release 2
$119,351QE 9/2017
Task 7,{ R2 Readiness Approval Release 2 $44,756 QE 6/2017Task 6E Deployment (R2) Release 2 $44,756 QE 9/20r7Task 6F (R2) - Performance SLAs Release 2 $t79,026 QE 9/2017Task 6D (R2) - System SourceCode and Documentation
Release 2
After 7-B $59, 67s QE 12/20r7
Task 78 (R2) - Complete R2Phase Close Out
Release 2$477,402
$r,573,934QE 12/2017
Task lD (R3) - RequirementsAnalysis, System Design andDevelopment Strategy
Release 3
$11 1,891QE s/20r8
Task 4,{ (R3) - Test Plan Release 3 $59,675 QE 6/2018Task 54 (R3) - Training Plan Release 3 $59,675 QE s/20r8Task 6A (R3) -Deployment Plan Release 3 $59,675 QE 3/2018Task 48 (R3) - Test Scenarios,
Test Cases and Test Scripts
Release 3$23,870 QE 6/2018
Task 4C (R3) -DocumentedSystem Test Results
Release 3$119,351 QE 6/2018
Task 58 (R3) - Training Manuals,End-User Guides and MaterialsUpdates
Release 3
$59,675QE 6/2018
Task 68 (R3) - System Incidentand Defect Resolution Report
Release 3$23,870 QE 6/2018
Task 6C (R3) - CompletedDetailed Functional and TechnicalSpecifications Traceability Matrix
Release 3
$238,702QE 6/2018
Task 5C Conduct Training - R3 Release 3 $11,935 QE 6/2018
Srarn or Vnnuoxt, CoNtru.ctDnpl,RtunN orVnnuoNr Hn,q.r,rnAccnssEQ Hnar,ru Sor,urroNs, INc.
P.c.crc 247 or 268Conrru,cr 28739
AunNuunxr #2
Task 5D (R3) - Documented
Evidence of Successful End-UserLearning
Release 3
$119,351QE 6/2018
Task 7A R3 Readiness Approval Release 3 $44,756 QE 6/2018
Task 6E Deployment (R3) Release 3 944,756.0 QE 6/2018
Task 6F (R3) - Performance SLAs Release 3 $t79,026 QE 6/2018
Task 6D (R3) - System Source
Code and Documentation
Release 3,
After 7-B $59,675QE 9/2018
Task 78 (R3) - Complete R3
Phase Close Out
Release 3$172,059
81,387,942QE 6/2018
Task 7C Closeout Deliverable -
Document Compendium Gap
Analysis
Before 7F
$72,454 QE e/2018
Task 7D Closeout Deliverable -Document Compendium Updates
Before 7F$72,454
QE 9/2018
Task 7E Closeout Deliverable -Maintenance and OperationsGuide
Before 7F
$140,646QE 9/2018
Task 9D - Closeout DeliverableVCCI System AdministratorManual
Before 7F
$r40,647QE 9/2018
Task 7F - Closeout Deliverable -
System Acceptance/Proj ect
Closeout
End of DDIProject before
tullM&Obegins
$477,402
$903,60s
QE e/2018
Task 8A Care Management
Subsystem Certification Planning
Project$179,026
QE 6/2018
Task 88 Develop CertificationReview Criteria and TestingScenarios
Project$179,026
QE 9/2018
Task 8C Certification Readiness
Assessment
Project$779,026 QE 9/2018
Task 8D Certification Review and
Acceptance
Project$r79,026
$716,104
QE r2/2018
Task 9,A. - System IncidentReports -M&O (Until FullDeployment) One-time payment,
reports due monthly
R1 $119,351 *
Paid after allRl deployedand approved
QE 9/2017
Task 98 - Adaptive Maintenance
Reports (Until Full Deployment)One-time payment, reports due
monthly
R1
$119,351 *QE e/2017
St,l'rn or VnnuoNr, CoxrucrDnplntunNT oF VunuoNr Hn^lLrH AccnssEQ Hrlr,rn Sor,urroNs, Ixc.
Pacn 248o1268Conrru,cr 28739
ANrnNnrvrnNr #2
Task 9C - System EnhancementReports (Until Full Deployment)One-time payment, reports duemonthly
R1 $358,052 *
Not paid untilall parts of Rlare deployedand approved $s96,754
QE 9/2017
$11,r75,047Task 0 Project Status Reports -Monthly at$2,983.77
Ongoing$t79,026
$179,026TOTAL Task Deliverables $11,354,073Hosting & Disaster RecoverySupport Until Full Deployment(Quarterly)
Quarterly $5,700.0
xAll deliverables and artifacts shall be monitored by the Contractor and updated, as needed.
d. The Contractor will provide the packaged software, Maintenance and OperationsActivities related, Hosting & Disaster Recovery and hardware costs listed below on afixed price basis. Following is the payment schedule.
Table B-5 Maintenance and Schedule
Healthwise (Enterprise License)FirstDatabank (Enterprise License)Geocoding (Web Service Subscription)Coding Libraries (CPT, ICD9-10 APDRG etc.) (EnterpriseAccess with Annual Updates)in-Rule (Business Rule Management System) (EnterpriseAccess, with 5 User Licenses)Mirth Match (Enterprise License)
Quality Reporting (Per Member Per Month Licensing)Johns Hopkins ACG (Predictive Modeling) (Per Member PerMonth Licensing)eQHealth eQSuite@ (Per Member Per Month Licensing)
Monthly $ 53,563 *
*Until all packaged sbftware is in use, cost is as follows: Monthly $ 51,438
Packaged Software Frequency Total Cost
On-goingData Loads
SystemIncidentReports
Monthly $100,425 $122,352 $141,450 $141,958 $141,805 $141,805 $141,824
M&OActivities
YEAR3
YEAR YEAR67Frequency
1 ) 4 5
YEAR YEAR YEAR YEAR
Srnrn or Vnnvroxr, CoNrRl,crDnpanrvrcNT oF VnnvroNr Hnll,rn AccnssEQ Hnnr,ru SolurroNs, INC.
P^q.cn 249 ot268Conrru,cr 28739
AvrnNoprnNr #2
AdaptiveMaintenanceReports
SystemEnhancementReports
Web-based
State trainingon SystemEnhance-ments
Performance
SLAsHosting &DisasterRecoverySupport
Quarterly 0 0 $12,375 $12,375 $72,375 $12,375 $12,375
e. Change RequestsWork performed under Change Requests called out in Table B-1 shall not exceed
$1,057,731during the life of the contract and is designated for DDI and M&O. TheChange Request line-item shall be billed per hour as utilized. As of contract execution,the base rate for Change Request development hours is $115.00 per houf and remains atthat rate throughout completion of the Design, Development and Implementation (DDI)phase. Change Request development hours are not expended for new project proposaldevelopment.
Any unused DDI Change Request funds may be carried over to the following year.
Unused M&O Change Request funds may not be carried over to the following year.
Change Request hourly rates during the Maintenance and Operations phase will be as
follows:
8. Implementation of Other Programs.The implementation of other AHS Programs shall be based on the houfly rate for additionalprogram services. Composite hourly rates will be as follows:
9. Retainase. The State will hold back I}Yo of each DDI deliverable payment and DDI ChangeRequest payment as retainage. Contractor rnay submit a single invoice for all retainage withheld
n/a nla $118 $118 $120Year 1 Year 2 Year 3 Yeat 4 Year 5
$11s $1 1s $1 18 $118 $120Year 1 Year 2 Year 3 Year 4 Year 5
Srnrr or VnnvroNr, CoNrucrDppanrvrnNT oF VnnnnoNr Hr.ql,rn AccnssEQ Hrar,ru Sor,urroNs, INc.
PacB 250 or 268CoNrnlcr 28739
AvrnNnvrnNr #2
six (6) months after the acceptance by the State of each deliverable, which will be paid to theContractor in full, subject to the terms and conditions of the Contract.
The State will hold back l0%o retainage for Maintenance and Operations, M&O ChangeRequests, Hosting, and Disaster Recovery, which can be requested by the Contractor.90-daysafter the initial invoice is submitted.
The State will not hold back any retainage on packaged software and hardware related payments
Payment of each invoice is due within thirty (30) days of receipt.
L0. Pavment Disputes.In order to dispute an invoice, or any part thereof, the State must set forth in writing theamount(s) disputed and the specific basis or reason for the dispute, which shall be reasonablydetailed and not general or speculative in nature (hereinafter referred to as "Payment DisputeNotice"). The State shall forward a Pa5rment Dispute Notice to Contractor on or prior to the duedate of the invoice disputed. The State shall not dispute any invoice unless the State believes, ingood faith, that the State is being charged for Services that have not been provided or at priceshigher than those set forth in this agreement, or that manifest effors in calculation or the likehave occurred, or that the State is otherwise being charged for items contrary to work describedin the Attachment A of this contract.
Upon compliance with the foregoing provisions, the State may, at its option, withhold paymentof the disputed amount(s) of the invoice, and shall remit to Contractor the undisputed amount(s),if any, in a timely manner. Upon receipt of the Payment Dispute Notice, both parties shall makereasonable, diligent, good faith efforts to resolve the dispute as soon as possible in accordancewith the dispute resolution procedures set forth below:
il. General. Unless specifically provided otherwise in this agreement, any dispute orcontroversy between the parties hereunder shall be resolved as provided in this Section. Adispute over payment will not entitle Contractor to withhold, suspend or decrease itsrequired performance under this Agreement. Contractor shall continue performing itsobligations hereunder while the parties are seeking to resolve,any dispute in accordancewith this Article, unless and until such obligations are terminated or expire in accordancewith the provisions of this agreement and the existence of such dispute shall not relievethe Contractor of any of its obligations under this agreement.
b. Informal Dispute Resolution. The parties may attempt to resolve any dispute orcontroversy hereunder, informally by submitting the dispute, in writing, to ProjectManagers responsible for the State and the Contractor ("Project Managers"),the State'sVendor Manager, and the State's general counsel (collectively referred to as "InformalDispute Resolution Team") who shall meet in person or by telephone conference call inan effort to resolve the dispute, as often as they deem necessary to gather and analyze anyinformation relevant to the resolution of the dispute, but not less than once every day.
Surn or Vnnivront, CoNtnn ctDnp.qnrNInNT oF' VBnuoNr Hrar,rn AccESSEQ Hna.r,rn Sor.urroNso lltc.
1.
11.
P.lcn 251ot268CoNrnlcr 28739
AnnrNounNr #2
During the course of attempting to resolve the dispute informally, all reasonable
requests for non-privileged information related to the dispute, made by one party to
the other, shall be honored; provided, however, in attempting to resolve the dispute,
the conduct and activities of the parties, any offers of compromise, all settlement
proposals andlor information exchanged shall: (i) be considered information that is
confidential and proprietary to each of the parties and therefore, prohibited from
disclosure by either of them; (ii) be considered settlement discussions, and shall be
inadmissible in any subsequent proceedings; and (iii) in no way be construed or
deemed to preclude, prohibit or restrict either PaftY, at any time or in any manner,
from proceeding to litigation or otherwise exercisingany right or remedy available to
it under this agreement, at law or in equity.If the Informal Dispute Resolution Team determines in good faith that resolution
through continued discussions does not appear likely or if the dispute is not resolved
within five (5) business days after the dispute has been submitted in writing, either
Party may notify the other Party and this notification shall escalate the dispute
(hereinafter referred to as an "Escalation Notice"). To escalate the dispute the
following procedure must be followed:
1) The Informal Dispute Resolution Team shall gather any additional information. relevant to the resolution of the dispute and which may be necessary and
appropriate for presentation to the Contractor Account Director and an executive
designated by the State responsible for the Services involved in such dispute.
2) The Informal Dispute Resolution Team shall, within fifteen (15) business days
after the Escalation Notice has been given, submit a report to the Contractor
Account Director and Executive designated by the State (hereinafter referred to as
"State Executive") which includes a description of the nature, extent and basis ofthe dispute, how the dispute arose, the U.S. dollar amount involved in the dispute,
any agreed upon statements of fact , a fair, accurate and complete representation ofthe positions of each of the parties in the dispute, and any other informationrelevant to the dispute, including information that represents agreed upon
stipulations and statements of fact, as well as points of disagreement between the
parties (hereinafter referred to as the "Report";. The Report shall include one or
more recofirmendations and alternatives, which the parties believe the Contractor
Account Director, and designated State Executive should consider. A descriptiqnof the projected impact of the failure to resolve the dispute promptly and amicablyshall also be included in the submission. Each Party may include separate
statements of impact, recommendations or other information to the extent any ofthe Parties cannot or do not agree on particular items.
3) Not later than ten (10) days after the Report in connection with any dispute is
submitted the Contractor Account Director and designated State Executive forreview, they shall meet in an attempt to resolve the dispute. Either Party may
request additional information, material, advice and input from individuals and
organizations inside or outside the State and Contractor's organization.4) If the Contractor Account Director and designated State Executive are unable to
resolve the dispute within five (5) business days after the aforesaid meeting date,
Srarn or Vrnvront, CoNtrucrDnplnrunNT oF VnnuoNr llw,rn AccnssEQ Hnlr,rn Sor,urroNso INc.
Prcn 252ot268CoNrnlcr 28739
AvraNrivmNr#2
the parties may mutually agree to refer the dispute to non-binding mediation,which shall be conducted using the rules and procedures promulgated by theAmerican Arbitration Association, applicable to mediation in a location to beagreed upon in Vermont, where the parties agree all such proceedings shall beconducted. Such mediation shall be conducted by a qualified neutral, independentthird-party mediator, knowledgeable in the subject matter of the dispute and, if theparties cannot agree upon a mediator, each party shall select such a mediator andthe two (2) mediators so selected shall mutually agree upon a third and themediation shall, in that case, be conducted by a panel of the three (3) mediators soselected. Each party shall bear its own expenses and an equal share of theexpenses of the mediator(s) and the any related fees.
5) If the Parties accept and agree to the mediators'recommondations or otherwisereach agreement resolving the dispute, such agreement shall be made in writingand once duly executed, shall be binding on the parties; provided, however, thatfor the avoidance of any doubt or ambiguity, nothing in this agreement shall beconstrued as restricting, prohibiting, preventing or otherwise impairing eitherparty from proceeding to litigation, instituting judicial or other proceedings,including a formal claim or legal action, or from pursuing any and all other legal,equitable or contractual remedies available to such party, at any time.Notwithstanding anything in this agreement to the contrary, the State shall notagree to arbitration and the State shall not waive any right to a trial by jury.
Sr.trn or VnnnnoNt, CoNtnactDnp.c.nrvrnNT oF VnnvroNr IInlLrH AccBssEQ Hr.a.r,rn SolurroNs, INc.
P.tcn 253 or 268CoNrnlcr 28739
AvrnxounNr #2
ATTACHMENT C: STANDARD STATE PROVISIONSFOR CONTRACTS AND GRANTS
REvISED DEcEMBER 15, 2017
1. Definitions: For purposes of this Attachment, "Party" shall mean the Contractor, Grantee or
Subrecipient, with whom the State of Vermont is executing this Agreement and consistent with the form ofthe Agreement. "Agreement" shall mean the specific contract or grant to which this form is attached.
2. Entire Agreement: This Agreement, whether in the form of a contract, State-funded grant, or Federally-
funded gtuttt, t"p.esents the entire agleement between the parties on the subject matter. A11 prior
agreements, representations, statements, negotiations, and understandings shall have no effect.
3. Governing Law, Jurisdiction and Venuel No Waiver of Jury Trial: This Agreement will be govemed
by the laws of the State of Vermont. Any action or proceeding brought by either the State or the Party inconnection with this Agreement shall be brought and enforced in the Superior Court of the State of Vermont,
Civil Division, Washington Unit. The Party irrevocably submits to the jurisdiction of this court for any
action or proceeding regarding this Agreement. The Party agrees that it must fnst exhaust any applicable
administrative remedies with respect to any cause of action that it may have against the State with regard
to its performance under this Agreement. Party agrees that the State shall not be required to submit to
binding arbitration or waive its right to a jury trial.
4. Sovereign Immunity: The State reserves all immunities, defenses, rights or actions arising out of the
State's sovereign status or under the Eleventh Amendment to the United States Constitution. No waiver ofthe State's immunities, defenses, rights or actions shall be implied or otherwise deemed to exist by reason
of the State's entry into this Agreement.
5. No Employee Benefits tr'or Party: The Party understands that the State will not provide any individual
retiremenl benefits, group life insurance, group health and dental insurance, vacation or sick leave, workers
compensation or other benefits or services available to State employees, nor will the State withhold any
state or Federal taxes except as required under applicable tax laws, which shall be determined in advance
of execution of the Agreement. The Party understands that all tax retums required by the Internal Revenue
Code and the State of Vermont, including but not limited to income, withholding, sales and use, and rooms
and meals, must be filed by the Party, and information as to Agreement iqcome will be provided by the
State of Vermont to the Internal Revenue Service and the Vermont Department of Taxes.
6. Independence: The Party will act in an independent capacity and not as officers or employees of the
State.
7. Defense and Indemnity: The Party shall defend the State and its officers and employees against all thirdparty claims or suits arising in whole or in part from any act or omission of the Party or of any agent of the
Party in connection with the performance of this Agreement. The State shall notify the Party in the event
of any such claim or suit, and the Party shall immediately retain counsel and otherwise provide a complete
defense against the entire claim or suit. The State retains the right to participate at its own expense in the
defense of any claim. The State shall have the right to approve all proposed settlements of such claims or
suits.
After a final judgment or settlement, the Party may request recoupment of specific defense costs and may
file suit in Washington Superior Court requesting recoupment. The Party shall be entitled to recoup costs
only upon a showing that such costs were entirely unrelated to the defense of any claim arising from an act
or omission of the Party in connection with the performance of this Agreement.
Sr,trn or Vrnvronr, CoNtnacrDnpmrvrnNT oF VnnvroNr HEALTH AccnssEQ Hnllrn Sor,urroNso INc.
PacB 254or268CoNrRacr 28739
AnnBNovrnivr #2
The Party shall indemnifu the State and its officers and employees if the State, its officers or employeesbecome legally obligated to pay any damages or losses arising from any act or omission of the Party or anagent of the Party in connection with the performance of this Agreement.
Notwithstanding any contrary language anywhere, in no event shall the terms of this Agreement or anydocument furnished by the Party in connection with its performance under this Agreement obligate theState to (1) defend or indemnify the Party or any third party, or (2) otherwise be liable for the expenses orreimbursement, including attorneys' fees, collection costs or other costs of the Party or any third party.
8. Insurance: Before commencing work on this Agreement the Party must provide certificates of insuranceto show that the following minimum coverages are in effect. It is the responsibility of the Party to maintaincurrent certificates of insurance on file with the State through the term of this Agreement. No warranty ismade that the coverages and limits listed herein are adequate to cover and protect the interests of the Partyfor the Party's operations. These are solely minimums that have been established to protect the interests ofthe State.
Workers Compensation: With respect to all operations performed, the Party shall carry workers'compensation insurance in accordance with the laws of the State of Vermont. Vermont will accept an out-of-state employer's workers' compensation coverage while operating in Vermont provided that theinsurance carrier is licensed to write insurance in Vermont and an amendatory endorsement is added to thepolicy adding Vermont for coverage purposes. Otherwise, the party shall secure a Vermont workers'compensation policy, if necessary to comply with Vermont law.
General Liability and Property Damage: With respect to all operations performed under this Agreement,the Party shall carry general liability insurance having all major divisions of coverage including, but notlimited to:
Premises - Operations
Products and Completed Operations
Personal Inj.rry LiabilityContractual LiabilityThe policy shall be on an occurrence form and limits shall not be less than:
$1,000,000 Each Occurrence
$2,000,000 General Aggregate
$ 1, 000,000 Products/Completed Operations Aggregate
$1,000,000 Personal & Advertising InjuryAutomotive Liability: The Party shall carry automotive liability insurance covering all motor vehicles,including hired and non-owned coverage, used in connection with the Agreement. Limits of coverage shallnot be less than $500,000 combined single limit. If performance of this Agreement involves construction,or the transport of persons or hazardous materials, limits of coverage shall not be less than $1,000,000combined single limit.
Additional Insured. The General Liability and Property Damage coverages required for performance of thisAgreement shall include the State of Vermont and its agencies, departments, officers and employees asAdditional Insureds. If performance of this Agreement involves construction, or the transport of personsor hazardous materials, then the required Automotive Liability coverage shalt include the State of Vermontand its agencies, departments, officers and employees as Additional Insureds. Coverage shall be primaryand non-contributory with any other insurance and self-insurance.
Notice of Cancellation or Change. There shall be no cancellation, change, potential exhaustion of aggregatelimits or non-renewal of insurance coverage(s) without thirty (30) days written prior written notice to theState.
Sr.q.rn or VBnuoNt, CoNtructDnpaRrvrnNT oF VBnvroNr Hnm,tn AccnssEQ Hn.Llrn Sor.urroxso INc.
P.q.cn 255 or 268CoNrru,cr 28739
AvrnnrvrnNr #2
9. Reliance by the State on Representations: All payments by the State under this Agreement will be
made in reliance upon the accuracy of all representations made by the Party in accordance with this
Agreement, including but not limited to bills, invoices, progress reports and other proofs of work.
1"0. False Claims Act: The Party acknowledges that it is subject to the Ve?mont False Claims Act
as set forth in 32 V.S.A. $ 630 et seq. If the Party violates the Vermont False Claims Act it shall
be liable to the State for civil penalties, treble damages and the costs of the investigation and
prosecution of such violation, including attorney's fees, except as the same may be reduced by a
iourt of competent jurisdiction. The Party's liability to the State under the False Claims Act shall
not be limited notwithstanding any agreement of the State to otherwise limit Party's liability.
11. Whistleblower Protections: The Party shall not discriminate or retaliate against one of itsemployees or agents for disclosing information concerning a violation of law, fraud, waste, abuse
of authority or acts threatening health or safety, including but not limited to allegations concerning
the False Claims Act. Further, the Party shall not require such employees or agents to forego
monetary awards as a result of such disclosures, nor should they be required to report misconduct
to the Party or its agents prior to reporting to any govemmental entity andlot the public.
12. Location of State Data: No State data received, obtained,.or generated by the Party in connection withperformance under this Agreement shall be processed, transmitted, stored, or transferred by any means
outside the continental United States, except with the express written permission of the State.
13. Records Available for Audit: The Party shall maintain all records pertaining to performance under
this agreement. o'Records" means any written or recorded information, regardless of physical form or
characteristics, which is produced or acquired by the Party in the performance of this agreement. Records
produced or acquired in a machine readable electronic format shall be maintained in that format. The
iecords described shall be made available at reasonable times during the period of the Agreement and for
three years thereafter or for any period required by law for inspection by any authorized representatives ofthe State or Federal Govemment. If any litigation, claim, or audit is started before the expiration of the
three-year period, the records shall be retained until all litigation, claims or audit findings involving the
records have been resolved.
14. Fair Employment Practices and Americans with Disabilities Act: Party agrees to comply with the
requirement of 21 V.S.A. Chapter 5, Subchapter 6, relating to fair employment practices, to the full extent
applicable. Party shall also ensure, to the fulI extent required by the Americans with Disabilities Act of1990, as amended, that qualified individuals with disabilities receive equitable access to the services,
programs, and activities provided by the Party under this Agreement.
15. Set Off: The State may set off any sums which the Party owes the State against any sums due the Party
under this Agreement; provided, however, that any set off of amounts due the State of Vermont as taxes
shall be in accordance with the procedures more specifically provided hereinafter.
16. Taxes Due to the State:
A. Party understands and acknowledges responsibility, if applicable, for compliance with State tax
laws, including income tax withholding for employees performing services within the State,
payment of use tax on property used within the State, corporate and/or personal income tax on
income eamed within the State.
Sr,lrn or VrnvroNro CoNrucrDnpaRtvrnNT oF Vnnvrorvr IIn.c.LrH AccnssEQ Hnru,ru Sor,urroNs, INc.
Pacn 256oF268CoNrnlcr 28739
AvrnNnvrnNr #2
B. Party certifies under the pains and penalties of perjury that, as of the date this Agreement is signed,the Party is in good standing with respect to, or in full compliance with, a plan to pay any and alltaxes due the State of Vermont.
C. Party understands that final payment under this Agreement may be withheld if the Commissionerof Taxes determines that the Party is not in good standing with respect to or in full compliance witha plan to pay any and all taxes due to the State of Vermont.
D. Party also understands the State may set off taxes (and related penalties, interest and fees) due tothe State of Vermont, but only if the Party has failed to make an appeal within the time allowed bylaw, or an appeal has been taken and finally determined and the Party has no further legal recourseto contest the amounts due.
17. Taxation of Purchases: All State purchases must be invoiced tax free. An exemption certificate willbe furnished upon request with respect to otherwise taxable items.
18. Child Support: (Only applicable if the Party is a natural person, not a corporation or partnership.) Partystates that, as of the date this Agreement is signed, he/she:
A. is not under any obligation to pay child support; orB. is under such an obligation and is in good standing with respect to that obligation; orC. has agreed to a payment plan with the Vermont Office of Child Support Services and is in full
compliance with that plan.
Party makes this statement with regard to support owed to any and all children residing in Vermont. lnaddition, if the Party is a resident of Vermont, Party makes this statement with regard to support owed toany and all children residing in any other state or territory of the United States.
19. Sub-Agreements: Party shall not assign, subcontract or subgrant the performance of this Agreementor any portion thereof to any other Party without the prior written approval of the State. Party shall beresponsible and liable to the State for all acts or omissions of subcontractors and any other personperforming work under this Agreement pursuant to an agreement with Party or any subcontractor.In the case this Agreement is a contract with a total cost in excess of $250,000, the party shall provide tothe State a list ofall proposed subcontractors and subcontractors' subcontractors, together with the identityof those subcontractors' workers compensation insurance providers, and additional required or requestedinformation, as applicable, in accordance with Section 32 of The Vermont Recovery and Reinvestment Actof 2009 (Act No. 54).
Party shall include the following provisions of this Attachment C in all subcontracts for work performedsolely for the State of Vermont and subcontracts for work performed in the State of Vermont: Section 10("False Claims Act"); Section 11 ("Whistleblower Protections"); Section 12 ("Location of State Data");Section 14 ("Fair Employment Practices and Americans with Disabilities Act"); Section 16 ("Taxes Duethe State"); Section 18 ("Child Support"); Section 20 ("No Gifts or Gratuities"); Section 22 (*CefiifrcationRegarding Debarment"); Section 30 ("State Facilities"); and Section 32.A (*Certification Regarding Useof State Funds").
20. No Gifts or Gratuities: Party shall not give title or possession of anlhing of substantial value(including property, curency, travel and/or education programs) to any officer or employee of the Stateduring the term of this Agreement.
21. Copies: Party shall use reasonable best efforts to ensure that all written reports prepared under thisAgreement are printed using both sides of the paper.
Sr.lrn or VnnvroNto CoNtru,ctDEPARTMENT OF VNNUONT HN.q.LTH ACCNSS
EQ Hr,lr,ur Sor,urroNs, INc.
Pacn 257 o1268Coxrru.cr 28739
AvrnNnunNr#2
22. Certifrcation Regarding Debarment: Party certifies under pains and penalties of perjury that, as ofthe date that this Agreement is signed, neither Party nor Party's principals (officers, directors, owners, or
partners) are presently debarred, suspended, proposed for debarment, declared ineligible or excluded fromparticipation in Federal programs, or programs supported in whole or in part by Federal funds.
Party further certifies under pains and penalties of perjury that, as of the date that this Agreement is signed,
Party is not presently debarred, suspended, nor named on the State's debarment list at:
http ://b gs.vermont. gov/purchasing/debarment
23. Conflict of Interest: Party shall fully disclose, in writing, any conflicts of interest or potential
conflicts of interest.
24. Confidentiality: Party acknowledges and agrees that this Agreement and any and all
information obtained by the State from the Party in connection with this Agreement are subject to
the State of Vermont Access to Public Records Act, 1 V.S.A. $ 315 et seq.
25. Force Majeure: Neither the State nor the Party shall be liable to the other for any failure or
delay of performance of any obligations under this Agreement to the extent such failure or delay
shall have been wholly or principally caused by acts or events beyond its reasonable control
rendering performance illegal or impossible (excluding strikes or lock-outs) ("Force Majeure").
Where Force Majeure is asserted, the nonperforming party must prove that it made all reasonable
efforts to remove, eliminate or minimize such cause of delay or damages, diligently pursued
performance of its obligations under this Agreement, substantially fulfilled all non-excused
obligations, and timely notified the other party of the likelihood or actual occurrence of an event
described in this paragraph.
26. Marketing: Party shall not refer to the State in anypublicitymaterials, information pamphlets,
press releases, research reports, advertising, sales promotions,trade shows, or marketing materials
or similar communications to third parties except with the prior written consent of the State.
2T.Termination:A. Non-Appropriation: If this Agreement extends into more than one fiscal year of the State
(July 1 to June 30), and if appropriations are insufficient to support this Agreement, the
State may cancel at the end of the fiscal year, or otherwise upon the expiration of existing
appropriation authority. In the case that this Agreement is a Grant that is funded in wholeor in part by Federal funds, and in the event Federal funds become unavailable or reduced,
the State may suspend or cancel this Grant immediately, and the State shall have no
obligation to pay Subrecipient from State revenues.
B. Termination for Cause: Either party may terminate this Agreement if aparty materially
breaches its obligations under this Agreement, and such breach is not cured within thirty(30) days after delivery of the non-breaching party's notice or such longer time as the non-
breaching party may specify in the notice.
C. Termination Assistance: Upon nearing the end of the final term or termination of this
Agreement, without respect to cause, the Party shall take all reasonable and prudent
measures to facilitate any transition required by the State. A11 State property, tangible and
Srarn or Vunuoxr, CoNrucrDrpantnrnNT oF Vnnvroivr Hal.LrH AccnssEQ Hnu,rn Sor,urroNs, INc.
Pacn 258 or 268CoNrnlcr 28739
AvrnNlvrnnr #2
intangible, shall be returned to the State upon demand at no additional cost to the State ina format acceptable to the State.
28. Continuity of Performance: In the event of a dispute between the Party and the State, eachparty will continue to perform its obligations under this Agreement during the resolution of thedispute until this Agreement is terminated in accordance with its tqrms.
29. No Implied Waiver of Remedies: Either party's delay or failure to exercise qny right, poweror remedy under this Agreernent shall not impair any such right, power or remedy, or be construedas a waiver of any such right, power or remedy. All waivers must be in writing.
30. State Facilities: If the State makes space available to the Party in any State facility during theterm of this Agreement for purposes of the Party's performance under this Agreement, the Partyshall only use the space in accordance with all policies and procedures governing access to anduse of State facilities which shall be made available upon request. State facilities will be madeavailable to Party on an "AS IS, WHERE IS" basis, with no warranties whatsoever.
31. Requirements Pertaining Only to Federal Grants and Subrecipient Agreements: If this Agreementis a grant that is funded in whole or in part by Federal funds:
A. Requirement to Have a Single Audit: The Subrecipient will complete the Subrecipient ArurualReport annually within 45 days after its fiscal year end, informing the State of Vermont whether ornot a Single Audit is required for the prior fiscal year. If a Single Audit is required, the Subrecipientwill submit a copy of the audit report to the granting Party within 9 months. If a single audit is notrequired, only the Subrecipient Annual Report is required.
For fiscal years ending before December 25,2015, a Single Audit is required if the subrecipientexpends $500,000 or more in Federal assistance during its fiscal year and must be conducted inaccordance with OMB Circular ,4.-133. For fiscal years ending on or after December 25,2075, aSingle Audit is required if the subrecipient expends $750,000 or more in Federal assistance duringits fiscal year and must be conducted in accordance with 2 CFR Chapter I, Chapter II, Part 200,Subpart F. The Subrecipient Annual Report is required to be submitted within 45 days, whether ornot a Single Audit is required.
B. Internal Controls: In accordance with 2 CFR Part II, $200.303, the Party must establish andmaintain effective internal control over the Federal award to provide reasonable assurance that theParty is managing the Federal award in compliance with Federal statutes, regulations, and the termsand conditions of the award. These internal controls should be in compliance with guidance in"Standards for Internal Control in the Federal Govemment" issued by the Comptroller General ofthe United States and the "lrtemal Control lntegrated Framework", issued by the Committee ofSponsoring Organizations of the Treadway Commission (COSO).
C. Mandatory Disclosures: ln accordance with 2 CFR Part II, $200.113,Party must disclose, in atimely manner, in writing to the State, all violations of Federal criminal law involving fraud,bribery, or gratuity violations potentially affecting the Federal award. Failure to make requireddisclosures may result in the imposition of sanctions which may include disallowance of costsincurred, withholding of payments, termination of the Agreement, suspension/debarment, etc.
Srarn or VnnvroNt, CoNtn,n'ctDnpl,nrunNT oF VERMoNT HBar,ru AccnssEQ Hnar,rn Sor,urroNs, INc.
Plcn 259 or 268CoNrm,cr 28739
AvrnNnvrnirr #2
32. Requirements Pertaining Only to State-Funded Grants:
A. Certification Regarding Use of State Funds: If Party is an employer and this Agreement is aState-funded grant in excess of $1,001, Party certifies that none of these State funds will be used to
interfere with or restrain the exercise of Party's employee's rights with respect to unionization.
B. Good Standing Certification (Act 154 of 2016): If this Agreement is a State-funded grant, Party
hereby represents: (i) that it has signed and provided to the State the form prescribed by the
Secretary of Administration for purposes of certi$ing that it is in good standing (as provided inSection 13(aX2) of Act 154) with the Agency of Natural Resources and the Agency of Agriculture,
Food and Markets, or otherwise explaining the circumstances surrounding the inability to so certify,
and (ii) that it will comply with the requirements stated therein.
(End of Standard Provisions)
Sr.q.rn or VnnvroNro CoNrnacrDnpanrivrnNT oF VnnvroNr Hnar,rn AccnssEQ Hnlr ru Sor,urroNs,INc.
PlcB 260 or 268Colsrnacr 28739
AvrnNovmNr#2
ATTACHMENT FAGENCY OF HUMAN SERVICES' CUSTOMARY CONTRACT PROVISIONS
1. Definitions: For purposes of this Attachment F, the term o'Agreement" shall mean the form ofthe contract or grant, with all of its parts, into which this Attachment F is incorporated. Themeaning of the term "Party" when used in this Attachment F shall mean any named party to thisAgreement other than the State of Vermont, the Agency of Human Services (AHS) and any ofthe departments, boards, offices and business units named in this Agreement. As such, theterm "Party'' shall mean, when used in this Attachment F, the Contractor or Grantee with whomthe State of Vermont is executing this Agreement. If Party, whenpermittedto do so underthis Agreement, seeks by way of any subcontract, sub-grant or other form ofprovider agreementto employ any other person or entity to perform any of the obligations of Party under thisAgreement, Party shall be obligated to ensure that all terms of this Attachment F are followed.As such, the term *Partt''as
used herein shall also be construed as applicable to, and describingthe obligations of, any subcontractor, sub-recipient or sub-grantee of this Agreement. Any suchuse or construction of the term "Party'' shall not, however, give any subcontractor, sub-recipientor sub-grantee any substantive right in this Agreement without an express written agreement tothat effect by the State of Vermont.
2. Agencv of Human Services: The Agency of Human Services is responsible for overseeingall contracts and grants entered by any of its departments, boards, offices and business units,however denominated. The Agency of Human Services, through the business office of theOffice of the Secretary, and through its Field Services Directors, will share with any namedAHS-associated party to this Agreemenl oversight, monitoring and enforcementresponsibilities. Party agrees to cooperate with both the named AHS-associated party to thiscontract and with the Agency of Human Services itself with respect to the resolution of anyissues relating to the performance and interpretation of this Agreement, payment matters andlegal compliance.
3. Medicaid Prosram Parties (applicable to any Party providing services and supports paidforunder Vermont's Medicaid program and Vermont's Global Commitment to Health Waiver);
Inspection and Retention of Records: In addition to any other requirement under thisAgreement or at law, Partymust fulfill all state and federal legal requirements, and will complywith all requests appropriate to enable the Agency of Human Services, the U.S. Department ofHealth and Human Services (along with its Inspector General and the Centers for Medicareand Medicaid Services), the Comptroller General, the Government Accounting Office, or anyof their designees: (i) to evaluate through inspection or other means the quality,appropriateness, and timeliness of services performed under this Agreement; and (ii) to inspectand audit any records, financial data, contracts, computer or other electronic systems of Partyrelating to the performance of services under Vermont's Medicaid program and Vermont'sGlobal Commitment to Health Waiver. Party will retain for ten years all documents requiredto be retained pursuant to 42 CFR a38.3(u).
Sr.trn or VnnvroNt, CoNtru,ctDnpanrivrrNT oF VpnvroNr IIn,q,LrH AccnssEQ Hn.nlru Sor.uuoNs, INc.
Prcn 261o1268CoNrru.cr 28739
AnnnnrunNr #2
4
Subcontractins for Medicaid Services: Notwithstanding any permitted subcontracting ofservices to be performed under this Agreement, Party shall remain responsible for ensuring
that this Agreement is fully performed according to its terms, that subcontractor remains incompliance with the terms hereof, and that subcontraotor complies with all state and federal
laws and regulations relating to the Medicaid program in Vermont. Subcontracts, and any
service provider agreements entered into by Party in connection with the performance of this
Agreement, must clearly specify in writing the responsibilities of the subcontractor or other
service provider and Party must retain the authority to revoke its subcontract or service
provider agreement or to impose other sanctions if the performance of the subcontractor or
service provider is inadequate or if its perfofinance deviates from any requirement of this
Agteement. Party shall make available on request all contracts, subcontracts and service
provider agreements between the Party, subcontractors and other service providers to the
Agency of Human Services and any of its departments as well as to the Center for Medicare
and Medicaid Services.
Medicaid Notificution of Termination Requirements: Party shall follow the Department ofVermont Health Access Managed-Care-Organization enrollee-notification requirements, to
include the requirement that Party provide timely notice of any termination of its practice.
Encounter Data; Party shall provide encounter data to the Agency of Human Services andlot
ttr d"p"rt"r"tttr ""d
ensure further that the data and services provided can be linked to and
supported by enrollee eligibility files maintained by the State.
Federal Medicaid Svstem Securitv Requirements Compliance: Party shall provide a security
plan, risk assessment, and security controls review document within three months of the start
date of this Agreement (and update it annually thereafter) in order to support audit compliance
with 45 CFR 95.621 subpart F, ADP System Security Requirements and Review Process.
Workplace Vrolence Preventio (applicable to any Party and any
subcontractors and sub-grantees whose employees or otlter service providers deliver social ormental health services directly to individual recipients of such sbrvices):
Party shall establish a written workplace violence prevention and crisis response policymeeting the requirements of Act 109 (2016), 33 VSA $S201(b), for the benefit of employees
delivering direct social or mental health services. Party shall, in preparing its policy, consult
with the guidelines promulgated by the U.S. Occupational Safety and Health Administrationfor Preventing Worlcplace Violence for Healthcare and Social Services Workers, as those
guidelines may from time to time be amended.
Party,through its violence protection and crisis response committee, shall evaluate the efficacy
of its policy, and update the policy as appropri ate, atleast annually. The policy and any written
evaluations thereof shall be provided to employees delivering direct social or mental health
services.
Srarn or VnnuoNr, CoNrrucrDnplnrvrnNT oF' VnnuoNr Hrar,rn AccrssEQ Hnar,rn Solurrons, Ir,rc.
Pncn 262 or268CoNrnc.cr 28739
AmrNrvrcNr #2
Party will ensure that any subcontractor and sub-grantee who hires employees (or contractswith service providers) who deliver social or mental health services directly to individualrecipients of such services, complies with all requirements of this Section.
5. Non-Discrimination:
Party shall not discriminate, and will prohibit its employees, agents, subcontractors, sub-grantees and other service providers from discrimination, on the basis of age under the AgeDiscrimination Act of I975, on the basis of handicap under section 504 of the RehabilitationAct of 1973, on the basis of sex under Title IX of the Education Amendments of 1972, and onthe basis of race, color or national origin under Title VI of the Civil Rights Act of 1964. Partyshall not refuse, withhold from or deny to any person the benefit of services, facilities, goods,privileges, advantages, or benefits of public accommodation on the basis of disability, race,creed, color, national origin, marital status, sex, sexual orientation or gender identity asprovided by Title 9 V.S.A. Chapter 139.
No person shall on the grounds of religion or on the grounds of sex (including, on the groundsthat a woman is pregnant), be excluded from participation in, be denied the benefits of, or besubjected to discrimination, to include sexual harassment, under any program or activitysupported by State of Vermont and/or federal funds.
Party further shall comply with the non-discrimination requirements of Title VI of the CivilRights Act of 1964, 42 USC Section 2000d, et seq., and with the federal guidelinespromulgated pursuant to Executive Order 13166 of 2000, requiring that contractors andsubcontractors receiving federal funds assure that persons with limited English proficiency canmeaningfully access services. To the extent Party provides assistance to individuals withlimited English proficiency through the use of oral or written translation or interpretiveservices, such individuals cannot be required to pay for such services.
6. Emplovees and Independent Contractors:
Party agrees that it shall comply with the laws of the State of Vermont with respect to theappropriate classification of its workers and service providers as "employees" and"independent contractors" for all purposes, to include for purposes related to unemploymentcompensation insurance and workers compensation coverage, and proper payment andreporting of wages. Party agrees to ensure that all of its subcontractors or sub-grantees alsoremain in legal compliance as to the appropriate classification of "workers" and "independentcontractors" relating to. unemployment coinpensation insurance and workers compensationcoverage, and proper payment and reporting of wages. Party will on request provide to theAgency of Human Services information pertaining to the classification of its employees toinclude the basis for the classification. Failure to comply with these obligations may result intermination of this Agreement.
7. Data Protection and Privacv:
Srarn or VnRvroxt, CoNtuctDnpanrvrpNT oF VBnuoNr Hnar,rn AccnssEQ Hnar,rn Sor,uuoNs, Ittc.
P.q,cn 263 or 268CoNrnq.cr 28739
AvrrNuvrnNr #2
Protected Health Information; Party shall maintain the privacy and security of all individuallyidentifiable health information acquired by or provided to it as a part of the performance ofthis Agreement. Party shall follow federal and state law relating to privacy and security ofindividually identifiable health information as applicable, including the Health Insurance
Portability and Accountability Act (HIPAA) and its federal regulations.
Substance Abuse Treatment Information: Substance abuse treatment information shall be
maintained in compliance with 42 C.F.R. Part 2 if the Party or subcontractor(s) are Part 2covered programs, or if substance abuse treatment information is received from a Part 2
covered program by the Party or subcontractor(s).
Protection of Perqonal Information: Party agrees to comply with all applicable state and
federal statutes to assure protection and security of personal information, or of any personallyidentifiable information (PI!, including the Security Breach Notice Act, 9 V.S.A. $ 2435, theSocial Security Number Protection Act,9 V.S.A. S 2440, the Document Safe Destruction Act,9 V.S.A. 5 2445 and 45 CFR 155.260. As used here, PII shall include any information, in anymedium, including electronic, which can be used to distinguish or trace an individual'sidentity, such as his/her name, social security number, biometric records, etc., either alone orwhen combined with any other personal or identifiable information that is linked or linkableto a specific person, such as date and place or birth, mother's maiden name, etc.
Other Confidential Consumer Information: Party agrees to comply with the requirements ofAHS Rule No. 08-048 concerning access to and uses of personal information relating to anybeneficiary or recipient of goods, services or other forms of support. Party further agrees tocomply with any applicable Vermont State Statute and other regulations respecting the right toindividual privacy. Party shall ensure that all of its employees, subcontractors and otherservice providers performing services under this agreement understand and preserve thesensitive, confidential and non-public nature of information to which they may have access.
Data Breaches: Party shall report to AHS, though its Chief Information Officer (CIO), anyimpermissible use or disclosure that compromises the security, confidentiality or privacy ofany form of protected personal information identified above within 24 hours of the discoveryof the breach. Party shall in addition comply with any other data breach notificationrequirements required under federal or state law.
8. Abuse and Neslect of Children and Vulnerable Adults:
Abuse Registrv. Party agrees not to employ any individual, to use any volunteer or otherservice provider, or to otherwise provide reimbursement to any individual who in theperformance of services connected with this agreement provides care, custody, treatment,transportation, or supervision to children or to vulnerable adults if there has been a
substantiation of abuse or neglect or exploitation involving that individual. Party is responsiblefor confirming ds to each individual having such contact with children or vulnerable adults thenon-existence of a substantiated allegation of abuse, neglect or exploitation by verifying thatfact though (a) as to vulnerable adults, the Adult Abuse Registry maintained by the Departmentof Disabilities, Aging and Independent Living and (b) as to children, the Central ChildProtection Registry (unless the Party holds a valid child care license or registration from the
Srlrn or VnnryroNt, CoNrucrDrpmtunNT oF VnnvroNt Hn,tr,rn AccnssEQ Hr.ll,rn Sor,urroNs, INc.
Pacn 264o1268CoNrnq.cr 28739
AiurNnnnnN.r #2
Division of Child Development, Department for Children and Families). See 33 V.S.A.$a919(a)(3) and 33 V.S.A. 96911(cX3).
Reoortins of Abuse, Neslect, or Exploitation. Consistent with provisions of 33 V.S.A.$a913(a) and $6903, Party and any of its agents or employees who, in the performance ofservices connected with this agreement, (a) is a caregiver or has any other contact with clientsand (b) has reasonable cause to believe that a child or vulnerable adult has been abused orneglected as defined in Chapter 49 or abused, neglected, or exploited as defined in Chapter 69of Title 33 V.S.A. shall: as to children, make a report containing the information required by33 V.S.A. $4914 to the Commissioner of the Department for Children and Families within24hours; or, as to a vulnerable adult, make a report containing the information required by 33V.S.A. $6904 to the Division of Licensing and Protection at the Department of Disabilities,Aging, and Independent Living within 48 hours. Party will ensure that its agents or employeesreceive training on the reporting of abuse or neglect to children and abuse, neglect orexploitation of vulnerable adults.
9. Information Technolosv Svstems:
Computins and Communication: Party shall select, in consultation with the Agency of HumanServices' Information Technology unit, one of the approved methods for secure access to theState's systems and data, if required. Approved methods are based on the type of workperformed by the Party as part of this agreement. Options include, but are not limited to:
1. Party's provision of certified computing equipment, peripherals and mobile devices, ona separate Party's network with separate internet access. The Agency of HumanServices' accounts may or may not be provided.
2. State supplied and managed equipment and accounts to access state applications anddata, including State issued active directory accounts and application specific accounts,which follow the National lnstitutes of Standards and Technology (NIST) security andthe Health Insurance Portability & Accountability Act (HIPAA) standards.
Intellectual Propertv/V|/ork Product Ownership: All data, technical information, materialsfirst gathered, originated, developed, prepared, or obtained as a condition of this agreementand used in the performance of this agreement -- including, but not limited to all reports,surveys, plans, charts, literature, brochures, mailings, recordings (video or audio), pictures,drawings, analyses, graphic representations, software computer progrhms and accompanyingdocumentation and printouts, notes and memoranda, written procedures and documents, whichare prepared for or obtained specifically for this agreement, or are a result of the servicesrequired under this grant -- shall be considered "work for hire" and remain the property of theState of Vermont, regardless of the state of completion unless otherwise specified in thisagreement. Such items shall be delivered to the State of Vermont upon 3O-days notice by theState. With respect to software computer programs and / or source codes first developed forthe State, all the work shall be considered "work for"hire," i.e., the State, not the Party (or
Sr.q.rB or Vnnuoxt, CoNrucrDnpantunNT oF VnnvroNr Hnar,rn AccpssEQ Hn,o.r,rn Sor,utroNs, INc.
P.r.cr 265 o1268CoNrru.cr 28739
AivrnNrniunxr #2
subcontractor or sub-grantee), shall have fulI and complete ownership of all software computerprograms, documentation and/or source codes developed.
Party shall not sell or copyright a work product or item produced under this agreement withoutexplicit permission from the State of Vermont.
If Party is operating a system or application on behalf of the State of Vermont, Party shall notmake information entered into the system or application available for uses by any other partythan the State of Vermont, without prior authoizationby the State. Nothing herein shall entitlethe State to pre-existing Party's materials.
Party acknowledges and agrees that should this agreement be in support of the State's
implementation of the Patient Protection and Affordable Care Act of 2010, Party is subject tothe certain property rights provisions of the Code of Federal Regulations and a Grant from theDepartment of Health and Human Services, Centers for Medicare & Medicaid Services. Suchagreement will be subject to, and incorporates here by reference, 45 CFR 74.36,45 CFR 92.34and 45 CFR 95.617 governing rights to intangible property.
Securitv and Data Transfers: Party shall comply with all applicable State and Agency ofHuman Services'policies and standards, especially those related to privacy and security. TheState will advise the Party of any new policies, procedures, or protocols developed during theterm of this agreement as they are issued and will work with the Party to implement anyrequired.
Partywill ensure the physical and data security associated with computer equipment, includingdesktops, notebooks, and otherportable devices, used in connection with this Agreement. Partywill also assure that any media or mechanism used to store or transfer data to or from the State
includes industry standard security mechanisms such as continually up-to-date malwareprotection and encryption. Party will make every reasonable effort to ensure media or data filestransferred to the State are virus and spyware free. At the conclusion of this agreement andafter successful delivery of the data to the State, Party shall securely delete data (includingarchival backups) from Party's equipment that contains individually identifiable records, inaccordance with standards adopted by the Agency of Human Services.
Putty, in the event of a data breach, shall comply with the terms of Section 7 above.
10. Other Provisions:
Environmental Tobacco Smoke. Public Law 103-227 (also known as the Pro-Children Act of1994) and Vermont's Act 135 (2014) (An act relating to smoking in lodging establishments,hospitals, and child care facilities, and on State lands) restrict the use of tobacco products incertain settings. Party shall ensure that no person is permitted: (i) to use tobacco products ortobacco substitutes as defined in 7 V.S.A. $ 1001 on the premises, both indoor and outdoor, ofany licensed child care center or afterschool program at any time; (ii) to use tobacco productsor tobacco substitutes on the premises, both indoor and in any outdoor areadesignated for child
Sr.lrn or VrnvroNr, CoxrnacrDnpanrvrnNT oF VERMoNT Hnnr,rn AccnssEQ Hnar,rn Sor,urroNs, INc.
P^lcn 266o1268CoNrru.cr 28739
AunNnvrnxr #2
care, health or day care services, kindergarten, pre-kindergarten, elementary, or secondaryeducation or library services; and (iii) to use tobacco products or tobacco substitutes on thepremises of a licensed or registered family child care home while children are present and incare. Party will refrain from promoting the use of tobacco products for all clients and frommaking tobacco products available to minors.
Failure to comply with the provisions of the federal law may result in the imposition of a civilmonetary penalty of up to $1,000 for each violation and/or the imposition of an administrativecompliance order on the responsible entity. The federal Pro-Children Act of 1994, however,does not apply to portions of facilities used for inpatient drug or alcohol treatment; serviceproviders whose sole source of applicable federal funds is Medicare or Medicaid; or facilitieswhere Women, Infants, & Children (WIC) coupons are redeemed.
2-1-1 Database.' If Party provides health or human services within Vermont, or if Partyprovides such services near the Vermont border readily accessible to residents of Vermont,Party shall adhere to the "InclusiorVExclusion" policy of Vermont's United Way'Vermont2ll(Vermont 2ll), and will provide to Vermont 2Il relevant descriptive information regardingits agency, programs and/or contact information as well as accurate and up to date informationto its database as requested. The "Inclusion/Exclusion" policy can be found atwww. 1 1.ore.
Voter Registratio n; Wherr designated by the Secretary of State, Party agrees to become a voterregistration agency as defined by I7 V.S.A. $2103 (41), and to comply with the requirementsof state and federal law pertaining to such agencies.
Drus Free Workplsce Act: Party will assure a drug-free workplace in accordance with 45CFR Part 76.
Lobbvine: No federal funds under this agreement may be used to influence or attempt toinfluence an officer or employee of any agency, a member of Congress, an officer or employeeof Congress, or an employee of a mernber of Congress in connection with the awarding of anyfederal contract, continuation, renewal, amendments other than federal appropriated funds.
AHS ATT. F 5/]6/20]8
Surn or VnnuoNr, CoNrnncrDnp.c.nrvrnNT oF Vrnivronr Hn.q.LrH AccnssEQ Ho,ll,rn Sor,uuoNso INc.
P.q.cn 267 or.268CoNrru,cr 28739
Avrnuournr#2
ATTACHMENT IADA COMPLIANCE CLARIFICATION
Section 508 Standards for Electronic and Information Technology
Background:Section 508 is a subsection of the Americans with Disabilities Act (ADA). As stated on theADA.gov website (https://www.ada.gov/508/) "Section 508 of the Rehabilitation Act (29 U.S.C.
$ 794d) requires that Federal agencies' electronic and information technology is accessible topeoplq with disabilities, including employees and members of the public." The Department ofJustice (United States Department of Justice, Civil Rights Division) monitors compliance ofSection 508 at the federal and state level.
S 1194.1 Purpose.The purpose of this part is to implement section 508 of the Rehabilitation Act of T973,as amended(29 U.S.C. 794d). Section 508 requires that when Federal agencies develop, procure, maintain, oruse electronic and information technology, Federal employees with disabilities have access to and
use of information and data that is comparable to the access and use by Federal employees whoare not individuals with disabilities, unless an undue burden would be imposed on theagency. Section 508 also requires that individuals with disabilities, who are members of the publicseeking information or services from a Federal agency, have access to and use of information and
data that is comparable to that provided to the public who are not individuals with disabilities,unless an undue burden would be imposed on the agency.
ScopeSection 508 compliance checklists have been developed by various federal agencies, the mostcomprehensive is the "section 508 Applicable Standards Worksheet" published by HomelandSecurity.This worksheet helps entities identify all the applicable electronic and information technologystandards specific to each circumstance. Additional standards were added to Section 508 toincorporate telecommunications and Video / Multimedia projects. As the MMIS CareManagement project does not include new telecommunications or video/multimedia developmentas part of the development scope, these standards can be waived. After careful review of thestandards listed, there is no perceived "undue burden" to eQ at this time.
Using the Applicable Standards Worksheet, there are four (4) out of eight (8) standards that are
applicable to this project.
1. Functional Performance Criteria (this always applies)2. Information, Documentation, and Support3. Software Applications and Operating Systems4. Web Based Intranet and Internet Information Applications
Sr.q.rn or Vnnvront, CoNrrucrDnpl,nrunNT oF VnnvroNr Hnar,rn AccEssEQ Hnar,rn Sor,urrons, Illc.
Pacr 268 or 268Conrnncr 28739
AunuovrnNr#2
MethodMany of the mandatory functional criteria revolve around the application being able to supportassistive technology such as screen readers.The items within the checklist can be verified in the same manner as non-functional requirements:1. Test2. Inspection / Observation3. Attestation
Web Content Accessibility Guidelines (WCAG) are complimentary to Section 508, and manyelements overlap. Many of the web-based items found within the Homeland Security checklistscan be tested via web-browser add-ons that inspect each screen for applicable accessibility rules.
Should a standard/guideline not be met, and testing/observationlattestation will not resolve thestandard, eQ Health will review the level of effort it would take to remedy the accessibilityshortfall, to determine if "undue burden" would be placed upon them.If "undue burden" is determined, eQ Health will provide written attestation clearly detailing thelevel of effort, the impact to the project, and the impact to eQ Health.
The State of Vermont's QA and Testing Team is willing to identify applicable 508 Standardscooperatively with eQ Health, and determine which standards will be tested, inspected/observed,or attested.
SoV testers will make use of web-based browser tools to generate accessibility audits, develop testcases for standards that require inspection/observation, and will create 'mock' test cases to uploadattestation and audit documents for compliance reporting through Jama.
Top Related