University of Massachusetts Medical School

Transcription

1 University of Massachusetts Medical School Request for Response (RFR) for Massachusetts Health Insurance Exchange and Integrated Eligibility System (MA HIX/IES) Independent RFR Number CW12-JD Date: May 21,

2 Table of Contents PART ONE SPECIFICATIONS Introduction Organization of the RFR Contract Term University Background Minimum Qualifications Preferred Qualifications Definitions and Acronyms Statistics/Data Offered for Illustration Purposes Only Program Overview Technology Background Scope of Work Compensation New Initiatives and Program Modifications Sustainability...47 PART TWO RESPONSE SUBMISSION REQUIREMENTS Response Instructions Business Response Program Response Cost Response Pre-Bidders Conference Questions Communications Amendments to the RFR Evaluation of Responses Selected Bidder Debriefing Authorizations RFR Timetable Bidders Checklist...70 PART THREE COST RESPONSE PART FOUR LAWS, RULES, AND GUIDELINES PART FIVE EXHIBITS FOR SUBMISSION

3 PART SIX COPIES OF STANDARD CONTRACT DOCUMENTS ON COMM-PASS PART SEVEN ADDITIONAL EXHIBITS ON COMM-PASS PART EIGHT UPDATED HIX/IES PROJECT INFORMATION SCOPE OF WORK: PROJECT TIMELINE SCOPE OF WORK: WORK ORDER OVERVIEW SCOPE OF WORK: GENERAL REQUIREMENTS HIX/IES ENTITY GOVERANCE STRUCTURES

4 1. Introduction PART ONE SPECIFICATIONS The ( UMMS or the University or the University of Massachusetts, Worcester Campus ) is issuing this Request for Response ( RFR ) to solicit proposals from qualified Bidders to provide Independent Verification and Validation ( IV&V ) services for the new, state-ofthe-art Health Insurance Exchange ( HIX or Exchange ) and Integrated Eligibility System ( IES ) for Massachusetts health care programs that will be designed, developed and implemented with the assistance of a systems integrator. The University is selecting the systems integrator under RFR # CW12-JD as modified by Amendment No. 1 thereto dated January 19, Hereinafter, RFR # CW12-JD , as amended, will be referred to as the HIX/IES SI RFR, the vendor selected as the systems integrator will be referred to as the HIX/IES SI Contractor, and the overall project will be referred to as the HIX/IES Project. The Massachusetts Executive Office of Health and Human Services ( EOHHS ) and the Massachusetts Commonwealth Health Insurance Connector Authority ( Health Connector or CCA ) are collaborating with UMMS on the HIX/IES Project. EOHHS, CCA, and UMMS are collectively referred to herein as the HIX/IES Entities. The University seeks an IV&V Contractor with extensive and demonstrated experience in verifying and validating the design, development, and implementation of large scale, enterprise technology projects. The IV&V Contractor will be required to provide all tasks, activities and IV&V Project Deliverables set forth in this RFR (collectively the IV&V Services ). The Contract resulting from this RFR shall be a firm, fixed price Contract for all IV&V Services specified herein. Massachusetts currently has a Health Insurance Exchange system, a Medicaid and Children's Health Insurance Program ( CHIP ) eligibility system, and a Medicaid and CHIP enrollment system. The systems are separate, are loosely integrated, and do not meet all requirements under the Patient Protection and Affordable Care Act ( ACA ). As part of the HIX/IES Project, the systems will undergo evaluation to determine which existing technology components can be changed or enhanced, what technology components must be built, and which components must be retired. A significant goal of the HIX/IES Project is to ensure that the Massachusetts exchange is compliant with the ACA. A Health Insurance Exchange provides a portal for all persons who seek health insurance: people who want to purchase health insurance, persons eligible for Advance Premium Tax Credits, or persons seeking subsidized coverage through the Medicaid program (the MassHealth program in Massachusetts). All persons use the HIX/IES portal, and the system 4

5 determines their eligibility for financial assistance, among other things. Additionally, the HIX/IES system needs functionality including enrollment for individuals and small groups, and premium billing functions to support the sale of insurance to small employer groups. In addition, Massachusetts sexisting electronic system ( MA21 ) used to determine eligibility for state-run public health programs is more than fifteen years old. Massachusetts intends to replace its legacy MA21 eligibility platform, over time, with an Integrated Eligibility System integrated with the Health Insurance Exchange. The MA21 system operates on old mainframe technology and does not lend itself to the technology approaches the ACA supports and Massachusetts seeks. Specifically, determining eligibility for public health programs should be conducted in an environment: That relies on service oriented architecture( SOA ) Where technology components can be shared and re-used That uses a structured Rules Engine The new Massachusetts HIX/IES will be designed and developed using a modular, reusable and scalable architecture that incorporates open standards technology components that can be shared with other New England states and potentially other states nationally. The HIX/IES system will present consumers with the best information to make an informed choice regarding health insurance options. At a high level, the HIX/IES must support six core business areas set forth in the federal definition of the Exchange Business Architecture ( EBA ), including: Eligibility Determination and Enrollment Plan Management Financial Management Customer Service Communications Oversight 2. Organization of the RFR Part One specifies the scope of work solicited. Part Two contains information related to submission requirements that Bidders must follow, the terms of the RFR, and information relating to any Contract that results from this RFR. 5

6 Part Three contains cost response instructions. Part Fourcontains reference documents for Federal and State requirements, and HIX and IES initiative regulations and Artifacts providing details behind the HIX/IES Project. Part Fivecontains exhibits that must be submitted with each Response. Part Six contains copies of the Contract documents resulting from this Request for Response. The selected Bidder must agree to all Contract terms set forth in Part Six. Part Seven contains a list of exhibits that are posted on Comm-PASS as separate files. Part Eight contains updated information related to the HIX/IES Project. 3. Contract Term The Contract resulting from this RFR is anticipated to begin on the date stated in Part Two, Section 14 RFR Timetable and terminate on March 31, The Contract may be extended, at the discretion of the University, up to a total of an additional 48 months.in the event of a delay or interruption outside the control of the parties, the Contract term may be adjusted accordingly at the discretion of the University. If funds are not otherwise made available (including funds which may be received from the federal government) for continued performance for any period of the Contract, the Contract may be terminated as of ninety (90) days following notice from the University to Contractor that funds are not otherwise available for performance under the Contract; provided, however, that such termination will not affect either the University s rights or the Contractor s rights under any termination clause in the Contract. The effect of termination of the Contract will be to discharge both the Contractor and the University from future performance of the Contract, but not from their rights and obligations existing at the time of termination. The Contractor shall be reimbursed for the reasonable value of any nonrecurring costs incurred but not amortized in the price of the Contractwhere such costs are specifically identified in the Bidder s response to this RFR and the Statement of Work (SOW) entered into hereunder. The University shall notify the Contractor as soon as it has knowledge that funds may not be available for the continuation of the Contract. 4. University Background The in Worcester is one of five campuses in the University of Massachusetts system. Established in 1962, the University's mission is to achieve national distinction in health sciences education, research, and public service. The Worcester campus, located in central 6

7 Massachusetts, is one of the fastest growing academic medical centers in the country and is home to the Commonwealth's only public medical school. 5. Minimum Qualifications In order to submit a Response to this RFR, Bidders must meet the following minimum qualifications: I. Proven IV&V experience of at least five (5) years, providing IV&V services for enterprise information technology ( IT ) applications; II. Proven IV&V experience of at least five (5) years, providing IV&V services forgovernment health programs or commercial health insurers; III. Demonstrated ability to provide experienced IV&V professional staff, with a minimum of five (5) years experience providing IV&V services; IV. In operation as a business for a minimum of six (6) years, at least three (3) of which must have been relevant to the verification and validation of large health and human services systems; and V. A corporation which has offices and conducts operations within the United States. NOTE: Bidders are informed and aware that the HIX/IES Entities are conducting a separate, independent procurement for a HIX/IES SI Contractor. The selected IV&V Contractor pursuant to this RFR must not have any relationship or interest, financial, business, beneficial or otherwise, with the HIX/IES SI Contractor. The IV&V Contractor, its subsidiaries and parent companies, and all subcontractors are prohibited from participation in the contract resulting from the HIX/IES SI RFR in any capacity, including but not limited to, as HIX/IES SI Contractor, teaming partner, or subcontractor significant or otherwise. Entities who responded to the HIX/IES SI RFR may respond to this RFR, but will be disqualified from this procurement if awarded the HIX/IES SI Contract. Bidders are referred to Part Two, Section 2(IX) Conflict of Interest and Part Five, Exhibit IX for additional information regarding conflicts of interest. The University reserves the right to confirm that Bidders meet these requirements. 6. Preferred Qualifications The University is seeking a Bidder that has the following qualifications: I. Demonstrated ability to successfully perform IV&V services for projects similar to the HIX/IES Project in size, scope, critical timing, and complexity, for example, wherein the implementation of the underlying 7

8 system involves one central application integrated with several other applications, information hubs, and external partners; II. Strong knowledge of health care reform, ACA, CCIIO, and CMS, as specifically applicable to exchanges or similar experience; III. Experience in customer facing, large scale, e-commerce applications that are web based; IV. Experience working across multiple governmental agencies, organizations, and IT systems; V. Strong knowledge of state and federal privacy and security laws and regulations; VI. Ability to provide resources to meet required deliverables and deadlines VII. A demonstrated ability to support the delivery of projects on time, especially with aggressive timelines; and VIII. Experience with IV&V services in support of updating or implementing Medicaid eligibility systems in one or more states. The University reserves the right to confirm that Bidders meet these requirements. 7. Definitions and Acronyms The following terms and acronyms that appear capitalized throughout the RFR shall have the meaning stated in this section, unless the context clearly indicates otherwise. Terms and acronyms used throughout the RFR are not limited to those defined in this section. Advance Premium Tax Credit Under Section 1411 of the ACA (42 U.S.C ), an Exchange makes an advance determination of personal income tax credit eligibility for certain individuals enrolling in coverage through the Exchange and reports related information to the IRS. Artifact(s) a general term for key documents and/or deliverables. Availability - ability to maximize the time when the system is available for use. Bidder the entity that submits a Response to this RFR. Center for Consumer Information and Insurance Oversight( CCIIO ) a CMS department that is charged with helping implement many provisions of the ACA., CCIIO oversees the implementation of the provisions related to private health insurance. 8

9 Centers for Medicare and Medicaid Services ( CMS ) - the federal agency under the Department of Health and Human Services responsible for administering the Medicare and Medicaid programs under Titles XVIII and XIX of the Social Security Act. Children's Health Insurance Program ( CHIP ) a federally supported state run health plan that provides health coverage to children in families with incomes too high to qualify for Medicaid, but who cannot afford private coverage. Cloud Computing - a remote computing environment with the scalability and security of enterprise-class platforms, coupled with robust network connectivity options. CMS Reviews refers collectively to Establishment Reviews and Exchange Certification. Code Drop - the placement of code for a deployment. Commonwealth Data all data used or owned by the Massachusetts Executive Office of Health and Human Services, the Massachusetts Commonwealth Health Insurance Connector Authority, or the to which the Contractor gains access through the Contract resulting from this RFR. Contract - the agreement resulting from this RFR executed between the selected Bidder and the University to accomplish the purposes specified in this RFR and as defined in the University of Massachusetts Contract for Services Purchased, Exhibit XII Contract referenced in Part Six of this RFR. Contractor - the selected Bidder that enters into the Contract with the University to perform the IV&V Services contemplated by this RFR. Establishment Review shall mean the CMS establishment and Medicaid IT Reviews consisting of formal reviews and less formal consultations with CMS across the HIX/IES Project stages. These reviews are extensions of the Exchange Lifecycle process which consisted of Gate Reviews and other reviews. Exchange Business Architecture ( EBA ) - a framework which describes the major business functions, processes, and services to be implemented by Exchanges. Exchange Certification shall mean any CMS Exchange certification based upon the application and operational assessment of the HIX/IES system. 9

10 Exchange Reference Architecture ( ERA ) - provides the business architecture, information architecture, and technical architecture for the nationwide health insurance exchange(s). Executive Office of Health and Human Services ( EOHHS ) the Commonwealth of Massachusetts executive agency, established by M.G.L. c. 6A, section 2, that is responsible for the administration of the MassHealth program (Medicaid), pursuant to M.G.L. c. 118E, Titles XIX and XXI of the Social Security Act, and other applicable laws and waivers thereto. Executive Team the executive team comprised of a senior member from each HIX/IES Entity that is responsible for interfacing with and monitoring the IV&V Vendor. Federal Data Services Hub ( FDSH ) the data services hub operated by the federal government to support certain functions and responsibilities of States in administering health coverage programs. Federal Information Security Management Act ( FISMA ) is a new subchapter to Chapter 35 of title 44, United States Code, which addresses information security: Federal Tax Information ( FTI ) tax information from the federal Internal Revenue Service. Funding Opportunity Announcement ( FOA ) notice of a federal grant opportunity. Health Information Technology for Economic and Clinical Health ( HITECH ) Act enacted as part of the American Recovery and Reinvestment Act of 2009, was signed into law on February 17, 2009, to promote the adoption and meaningful use of health information technology and the privacy and security of electronically transmitted health information. ementifr.html Health Insurance Exchange ( HIX or Exchange ) for purposes of this Contract, an information technology system for organizing the health insurance marketplace to help consumers and small businesses shop for coverage in a way that permits easy comparison of available plan options based on price, benefits and services, and quality. Exchanges will employ a single, streamlined eligibility process that will serve as the central point of access for individuals and small groups shopping on the Exchange, including (i) individuals who receive Advance Premium Tax Credits and (ii) for individuals receiving Medicaid or for children who receive CHIP (collectively referred to as MassHealth in Massachusetts). 10

11 Health Insurance Portability and Accountability Act of 1996 ( HIPAA )- the federal law (42 USC 1301 et seq.), enacted to improve the continuity of health insurance coverage in group and individual markets, combat waste, fraud and abuse in health insurance and health care delivery, standardize the electronic exchange of health related transactions by payers and relationship entities, and assure the privacy of Protected Health Information ( PHI ). Health Safety Net ( HSN ) is a program for Massachusetts residents who are not eligible for health insurance or cannot afford to buy it. For low income residents, the Health Safety Net (Free Care) pays for medically necessary services at Massachusetts community health centers (CHCs) and hospitals. HIX/IES Entities for purposes of this RFR, collectively, the Massachusetts Executive Office of Health and Human Services, the Massachusetts Commonwealth Health Insurance Connector Authority, and the University of Massachusetts Medical School. HIX/IES Entities Steering Committee ( Steering Committee ) is the decisionmaking team, comprised of one core representative from each HIX/IES Entity and other programmatic, technology and business attendees from the HIX/IES Entities respective organizations, responsible for providing senior direction and strategy to the HIX/IES project. HIX/IES Project Deliverables are deliverables generated by the HIX/IES SI Contractor pursuant to the contract which is anticipated to be entered into between the HIX/IES SI Contractor and UMMS as a result of the HIX/IES SI RFR. Independent Verification and Validation ( IV&V ) - is the process of checking that a product, service, or system meets specifications and that it fulfills its intended purpose. This process is performed by an unaffiliated 3rd party. Information Security ( Security ) - refers to the processes, methodologies, and means which are designed and implemented to protect information systems and information including print, electronic, or any other form of confidential, private and sensitive information or data from unauthorized access, use, misuse, disclosure, destruction, modification or disruption, which includes but not limited to the ability to authenticate and authorize users to provide secure access to the system in a traceable (auditable) manner. Information Technology Division ( ITD ) - the Massachusetts Division that provides a range of centralized IT services; overseeing IT policies, standards and architecture; and promoting cross-agency collaboration and adoption of shared services. 11

12 Intake, Eligibility and Referral ( IE&R ) - a public-facing information system which allows individuals to initiate the application process for MassHealth and certain other state-run benefits programs. Integrated Eligibility System ( IES or ED ) - the HIX component(s) that will process eligibility determinations for shopping on the Exchange, including eligibility for the Advance Premium Tax Credit, state-subsidized health programs (MassHealth), and other human service programs. Internal Revenue Manual ( IRM ) - a publication of the federal Internal Revenue Service describing federal tax policy. IV&V Project Deliverables are deliverables generated by the IV&V Contractor pursuant to the Contract, including without limitation, deliverables described in Part One Specifications; 11 Scope of Work, IIII IV&V Project Deliverables of this RFR. Key Personnel - personnel directly responsible for management of the Contract; or those personnel whose professional/technical skills are determined to be essential to the successful implementation of the Contract. MA21 - the eligibility determination system used by EOHHS to perform automated determination of MassHealth eligibility and coverage type. Maintenance - the preventive or corrective action(s) undertaken to maintain the functionality and to improve or increase the processing performance of the software or the infrastructure on which it runs. Massachusetts Chapter 58 of the Acts of An Act Providing Access to Affordable, Quality, Accountable Health Care the session law can be found here: Massachusetts Commonwealth Health Insurance Connector Authority ( Health Connector or CCA ) - is an independent public authority that helps Massachusetts residents find health care coverage. MassHealth - the Medicaid and State Children s Health Insurance ( SCHIP ) programs of Massachusetts, administered by EOHHS pursuant to M.G.L. c. 118E and Titles XIX and XXI of the Social Security Act and other applicable laws and waivers, that pays for medical services for eligible individuals. Medicaid Information Technology Architecture ( MITA ) - is an evolving CMS initiative that fosters an integrated business, information and technological approach to building management systems that are client-based and capable of sharing information across the Medicaid program organizational silos based upon 12

13 nationally recognized standards. Please see the Medicaid.gov website managed by CMS for more information: Medicaid Management Information System ( MMIS ) - the state-operated system of automated and manual processes used to process Medicaid claims from providers of medical care and services furnished to Members, and to retrieve and produce service utilization and management information for program administration and audit purposes. Member - any individual determined by EOHHS to be eligible for MassHealth benefits under M.G.L. c. 118 E and 130 CMR 410 to 650. Milestone - a pre-defined event that marks the completion of a subset of the project activities, tasks, and deliverables scheduled in the project plan. Modified Adjusted Gross Income ( MAGI ) is a federal income tax definition and methodologywhich state agencies and the Exchange must use to determine financial eligibility for Medicaid and CHIP. My Account Page ( MAP ) - an information system which allows Members to see information about their health assistance benefits or their food and cash assistance benefits online. MAP helps Members manage their MassHealth, Commonwealth Care, Health Safety Net, Children's Medical Security Plan and Healthy Start benefits, as well as the benefits received from the Department of Transitional Assistance ( DTA ). To use MAP, an individual must be the head of the household (person who signed the original application for benefits), be receiving benefits, and create and register for a Virtual Gateway Account. NESCIES - the acronym used for the Massachusetts Early Innovator cooperative agreement with CCIIO, which refers to the New England States Collaborative for Insurance Exchange Systems. Patient Protection and Affordable Care Act, Public Law ( ACA ) - the federal law that can be found here: 111publ148/pdf/PLAW-111publ148.pdf. Personally Identifiable Information ( PII ) - information that can be used to uniquely identify, contact, or locate a single person or can be used with other sources to uniquely identify a single individual. Protected Health Information ( PHI ) - shall have the same meaning as the term protected health information in 45 CFR Qualified Health Plans ( QHPs ) - under the Affordable Care Act, starting in 2014, an insurance plan that is certified by an Exchange and that provides essential 13

14 health benefits, follows established limits on cost-sharing (like deductibles, copayments, and out-of-pocket maximum amounts), and meets other requirements. A qualified health plan will have a certification by each Exchange in which it is sold. Required Change - means any change in applicable laws, rules or regulations or change required by CCIIO, CMS, or the Commonwealth of Massachusetts, a legislative action, a legislative request, executive order, or judicial decision that requires a change in the HIX/IES system and impacts the IV&V Services. Response Any information submitted by the Bidder in response to the requirements outlined in this RFR, including any clarifying information requested by the University. Reusability - ability to use individual HIX or IES system components or services developed as part of this Contract for other federal or state Exchanges. Rules Engine - a software system that executes one or more business rules in a runtime production environment. Senior Management Team- the advisory committee, comprised of one representative from each HIX/IES Entity, that is responsible for advising and overseeing the implementation of the day-to-day operations and resource management, including without limitation, monitoring the HIX/IES Project dashboard progress reports. Service Oriented Architecture ( SOA ) - is a set of principles and methodologies for designing and developing software in the form of interoperable services. These services are well-defined business functionalities that are built as software components (discrete pieces of code and/or data structures) that can be reused for different purposes. State Medicaid Manual - a publication issued by CMS that contains the requirements and guidelines that all states must follow in managing their Medicaid programs. Technical Reference Architecture ( TRA ) - provides an architectural reference for the construction and integration of component-based solutions. It provides business solutions which are both scalable and flexible, integrates new and already existing business solutions in a consistent, efficient, productive manner, and defines optimal physical and logical layering strategies. User Acceptance Testing ( UAT ) -testing conducted to determine if the requirements of a specification or contract are met to the satisfaction of the customer before the customer accepts the new system. 14

15 User Interface ( UI or Portal ) a web-based interface which facilitates the interaction between users and an information system. Virtual Gateway -an internet portal designed by EOHHS to provide the general public, medical providers, community-based organizations and EOHHS staff with online access to health and human services programs and information. Work Order a detailed description of each of the HIX/IES SI Contractor s responsibilities under the scope of the HIX/IES SI RFR. XML (Extensible Markup Language) a method of creating a common information format. 8. Statistics/Data Offered for Illustration Purposes Only The figures stated in this RFR are estimated figures and are given only as a guideline. These figures are based on previous data or the best information at the time of writing this RFR, and shall not be construed to represent the actual data expected under the Contract as it relates to this RFR. The University does not guarantee the volume of any services. 9. Program Overview Massachusetts is one of several states awarded an Early Innovator Grant cooperative agreement from the Centers for Medicare and Medicaid Services ( CMS ) Center for Consumer Information and Insurance Oversight ( CCIIO ). The formal name for the Massachusetts cooperative agreement with CCIIO is the New England States Collaborative for Insurance Exchange Systems agreement ( NESCIES ). As part of the NESCIES, Massachusetts is collaborating with other New England states, which may include Connecticut, Maine, New Hampshire, Rhode Island, and Vermont. Massachusetts seeks to create an ACA-compliant HIX/IES, and supports a learning collaborative where participating New England states share lessons learned from developing their respective Exchanges. Participating states also develop cost-effective, reusable technology components and best practices for implementing a HIX/IES. Through the HIX/IES Project, reusable components may be used by New England states and other states for their Exchanges. Developing reusable components and developing plans for their reuse and implementation in other states is a significant component of this project. 15

16 The current Massachusetts Exchange, known as the Health Connector, is a model for the national Exchange initiative. Offering a one-stop insurance marketplace, the Connector allows individuals and small businesses to shop for and enroll in partially subsidized or non-subsidized insurance based on a side-by-side comparison of plans. Private commercial health plans are made available to individuals, families, and certain employers in the state via the Health Connector web site. Via the Health Connector, individuals who need help to pay for insurance coverage are advised to fill out and mail a paper application for a subsidized insurance program. Applications received from individuals either on account of their contact with the Health Connector or a variety of other channels within the state are processed by the MassHealth program s MA21 system. The HIX/IES Project aims to build on the Health Connector s successful implementation. The ACA requires state-run exchanges to support real time eligibility for and enrollment in health plans offered through the Exchange, and for MassHealth and the Children s Health Insurance Program ( CHIP ) programs. The current Health Connector solution must be extended to meet these requirements. The current information technology components including those that enable eligibility determination, consumer shopping, premium billing, enrollment, and reporting must be updated or developed to comply with federal health reform requirements. The objective is a best-in-class HIX/IES system that meets or exceeds requirements in the ACA, maximizes flexibility, minimizes technical and operational support burdens, dynamically adapts to volatile rules, policies and legislation, and sets a new standard in consumer ease of use and satisfaction. 10. Technology Background This section describes the current health insurance Exchange environment in Massachusetts and the vision of the future environment. Massachusetts plans to implement the HIX/IES in two phases. The first phase is focused on ensuring that the system meets the ACA deadline for creating an operational Exchange by October 1, In Phase II, the HIX/IES will be enhanced to become a fully integrated system for determining eligibility for a variety of state-funded health and human services programs. Phase II will be implemented in The scope of this RFR is Phase I activities. Achieving the Phase II vision is outside of the scope of this RFR but is described in this section to help inform the IV&V Bidders understanding of Massachusetts long-term vision. I. Current Environment 16

17 The following section provides a high level overview of the current application environment and a brief description of the applications. Figure 1 Current Environment: MA Heath Connector The Health Connector operates the current Exchange for Massachusetts, as depicted in Figure 1 above, by offering private health plans approved by the CCA board of directors. The health plans are available to individuals, families, and certain employers in the state via the Health Connector s Web portal. The primary responsibilities of the CCA for operating the Exchange are: Operating the Exchange, including contracting with commercial carriers and enrolling eligible individuals and small groups. Making policy decisions as authorized by Massachusetts health care legislation. Conducting outreach and advertising efforts to inform the public of new opportunities and responsibilities. The current Exchange supports individual consumers, employers, general public, brokers, and administrators. It provides two separate programs: Commonwealth Care, which is an exclusive distribution channel for subsidy-eligible adults (< 300% FPL), and Commonwealth Choice, which is an alternative distribution channel for unsubsidized non-group and small-group insurance. 17

18 In addition to the Health Connector, there are systems that support applications to MassHealth programs and other non-health programs such as Supplemental Nutrition Assistance Program ( SNAP ) and Temporary Assistance for Needy Families ( TANF ). Figure 2 Current Environment: EOHHS Intake The Intake, Eligibility & Referral ( IE&R ) system allows providers and citizens to screen and apply for several state and federal benefit programs, submit renewals, check active benefit details from multiple external case management systems, and submit changes to data online. IE&R provides anonymous screening service and allows providers and citizens to determine if individuals and families qualify for benefits in various state programs. IE&R also provides a common intake application service that captures information entered by providers and citizens and forwards XML applications to three agency systems, while other program applications are sent to the Application Inbox for agency access and processing. 18

19 My Account Page ( MAP ) is a self-service for providers and citizens to check MassHealth and Department of Transitional Assistance ( DTA ) Benefits, and also for submission of MassHealth Change Forms and Renewals. My Workspace ( MWS ) is a workflow tool that streamlines the processing, management, and reporting of paper documents to support eligibility and maintenance for MassHealth services. MA21 is the system of record for MassHealth (Medicaid) and Commonwealth Care eligibility determination. It also determines eligibility for CHIP and Health Safety Net ( HSN ) programs. MA21 has batch interfaces with several state and federal agencies for various eligibility checks. MA21 also obtains referrals from other state and federal agencies for individuals who become eligible by virtue of eligibility in other state or federal programs. MA21 maintains the historical profile of an individual's eligibility, and provides web service interfaces to retrieve those profiles for customer or provider self-service. II. Future Environment The realization of the future HIX/IES will be achieved in two phases. Phase I will introduce an ACA-compliant HIX/IES. It will also establish the Eligibility Domain ( ED ) with eligibility determinations for shopping on the Exchange, eligibility for Advance Premium Tax Credits, and eligibility for MassHealth (Medicaid) or CHIP programs. In Phase II, the HIX/IES will be enhanced to become a fully integrated system for determining eligibility for a variety of state-funded health and human services programs. The MA21 system will be replaced in Phase II. The existing HIX/IES SI RFR is seeking services from a contractor to complete the realization of the Phase I vision only. The vision for Phase II is being provided since the system implemented in Phase I must be able to serve as a platform for functions performed in Phase II. A. HIX/IES Phase I: In Phase I, the HIX will be anchored by the HIX portal and IES, represented in Figure 3 as the Eligibility Domain. The HIX portal will serve all citizens seeking health coverage and provide an easy-to-use website for education, plan comparison and plan selection, account management, enrollment, and other features. Through the HIX portal, all consumers will have the same user experience whether they are pursuing private, partially subsidized, or Medicaid health coverage. 19

20 Figure 3 Proposed Environment (HIX/IES Phase I) The HIX/IES Entities are currently in the process of estimating the number of consumers who will pursue non-subsidized, or partially subsidized, health insurance (i.e. commercial coverage purchased through use of Advance Premium Tax Credits), or Medicaid health coverage once Phase I is implemented. Metrics are provided below to illustrate the current distribution. The metrics represent timeframes between June and August Table 1: Estimated Number of Consumers Group and Percentage Program Population % of Total Fully Subsidized 86% Medicaid 1,197, % CHIP 117, % Fully/Partially * subsidized 11% Commonwealth Care 169, % Non-subsidized 3% Commonwealth Choice 39, % Total 1,524,077 *Commonwealth Care includes members whom are both fully and partially subsidized 20

21 The IES will be the engine through which all eligibility is determined and enrollment is managed, including but not limited to eligibility for employers to use the HIX/IES, employees to shop on the HIX/IES, individuals to apply for personal exemptions, and for individuals to obtain partially or fully subsidized health insurance. For individuals being determined for Medicaid eligibility, the MA21 system will be in the backend throughout Phase I and act as a system of record for all determinations. The HIX/IES will determine eligibility for some populations whose incomes are determined using MAGI. It will also determine eligibility for some simple, non-magi populations. Applications for more complex, non-magi populations will be accepted through the HIX/IES system but will be referred to MA21 for eligibility determination. MA21 will determine eligibility only for complex non-magi cases in Phase I. The MMIS system will also be in the backend and provide enrollment for Medicaid members as it does today. These backend functions in MA21 and MMIS will be exposed as real time web services so the HIX/IES can consume them. Specifically, eligibility determinations in Phase I will be done as follows: 1. MAGI determinations will be verified with the Federal Data Services Hub. 2. MAGI determinations will also be verified with state data sources. 3. Non-MAGI determinations will be completed through (1) business rules scripts for simple non-magi determination rules moved to IES from MA21, or (2) services that expose legacy MA21 non-magi complex eligibility processes for IES to perform. With this approach, in Phase I, MassHealth or Exchange shopping eligibility notices may need to be generated from data in two systems: IES and MA21. The HIX portal will ultimately interact both with MA21 for eligibility and MMIS for selection of plans for Medicaid members in real time. In the end, consumers determined eligible for Medicaid should be able to use the HIX/IES and enroll in a health plan in real time, including receiving a temporary Medicaid ID. In Phase I, interfaces with the Federal Data Services Hub, other State systems, and insurance carriers will be critical components. Components such as Business Process Management and a Rules Engine will streamline eligibility determinations and be significant as well. Certain shared services, such as security and document management, and others will be implemented at this time. 21

22 B. HIX/IES Phase II: Although this RFR is intended to govern Phase I only, Phase II is described for context purposes. In Phase II, the IES will determine eligibility for all MAGI and non-magi Medicaid cases as well as eligibility for human services programs including but not limited to Supplemental Nutrition Assistance Program ( SNAP ) and Temporary Assistance to Needy Families ( TANF ). The IES developed in Phase I for health programs will expand in Phase II and become the common eligibility platform for various health and human services programs. Similarly, the Business Process Management, Federal Data Hub, Master Data Management, and Rules Engine developed in Phase I will be enhanced in Phase II to provide eligibility determination for multiple state programs while leveraging two primary user interfaces: 1. HIX portal for health coverage of any type; and 2. Integrated Eligibility Portals ( IEPs ) for other programs such as: a) All MassHealth benefits b) Health Safety Net c) Supplemental Nutrition Assistance Program ( SNAP ) d) Temporary Assistance for Needy Families ( TANF ) e) Emergency Aid to Elders, Disabled and Children ( EAEDC ) f) School Nutrition g) Women, Infants and Children ( WIC ) h) Community Services and Long-term Support - 11 programs covering Veterans, Disability and Developmental programs Note that the above list is a representative list of health and human services programs, and a process will be undertaken to determine which will be included in the scope of Phase II. With Phase II, the MA21 system will be retired, and the eligibility systems currently supporting human services programs such as SNAP and TANF will no longer perform eligibility determinations. Many, however, will continue to maintain their importance as the system of records for their respective programs. The following diagram represents the combined HIX and IES vision for

23 Figure 4 Proposed Environment (HIX/IES Phase II) 23

24 11. Scope of Work This section describes the IV&V Services to be performed by the IV&V Contractor. Bidders should review the HIX/IES SI RFR (RFR # CW12-JD , as amended), issued by the University on or around 12/21/2011, and the more recent HIX/IES Project update contained in Part Eight of this RFR to understand the HIX/IES Project, the content of the HIX/IES SI RFR, and the IV&V Services being requested in this RFR. The HIX/IES SI RFR and other related documents are available on the Commonwealth Procurement Access & Solicitation System ( Comm-PASS ). To locate the HIX/IES SI RFR on Comm-PASS, search for document number CW12-JD In particular, Bidders should review and fully understand the HIX/IES Project timetable in Part Eight of this RFR, Section 1 Scope of Work: Project Timeline, Table 2. This timetable serves as the primary timeline for all of the HIX/IES SI Contractor s tasks and deliverables and thus in turn the IV&V Contractor s activities that shall be required to complete the IV&V Services hereunder. I. Organization and Communication The University seeks an IV&V Contractor that will bring to the table innovative project personnel, processes, approaches and tools to meet the requirements of the IV&VServices for the HIX/IES Project. The IV&V Contractor will report directly to the Executive Team and will also work with the HIX/IES EntitiesSenior Management Team. The IV&V Contractor s personnel must be organized in such a way to ensure the expectations of the Executive Team and Senior Management Team are met and that the HIX/IES Entities project staff are well informed. All documentation and deliverables produced in the performance of the IV&V Services must be stored in MassForge, the collaboration tool used by the HIX/IES Entities. The individual activities within the scope of the IV&V Services, and the deliverables which will result from these activities, are described below. II. Tasks The IV&V Services described in this RFR must comply with IV&V regulatory requirements detailed in 45 CFR which requires that IV&V efforts be conducted by an entity that is independent and that: 24

25 1. Develops a project workplan. The plan must be provided directly to CMS at the same time it is given to the State. 2. Reviews and makes recommendations on both the management of the project, both State and vendor, and the technical aspects of the project. The IV&V provider must give the results of its analysis directly to the federal agencies that required the IV&V at the same time it reports to the State. 3. Consults with all stakeholders and assess the user involvement and buy-in regarding system functionality and the system's ability to support program business needs. 4. Conducts an analysis of past project performance sufficient to identify and make recommendations for improvement. 5. Provides risk management assessment and capacity planning services. 6. Develops performance metrics which allow tracking project completion against milestones set by the State. In compliance with IV&V regulatory requirements and to meet the goals of the HIX/IES Project, the IV&V Contractor shall complete the following tasks: Manage the IV&V Services Review all HIX/IES Project Deliverables Validate automated code review results Validate continuous integration test results Coordinate and conduct User Acceptance Testing ( UAT ) Verify implementation readiness Verify component reusability Perform a system audit Perform financial reviews Conclude the IV&V Services A. Manage the IV&V Services The IV&V Contractor shall develop a comprehensive project management plan (the IV&V Services Project Management Plan ), and shall manage and carry-out the IV&V Services in accordance with the IV&V Services Project Management Plan. The IV&V Services Project Management Plan must include at a minimum the following elements: 1. Description of how the IV&V Contractor plans to carry out the IV&V Services. This description should include methodologies, strategies, standards, and approaches employed by the IV&V Contractor for 25

26 executing each of the IV&V activities within this Scope of Work of this RFR. 2. High level IV&V Services schedule which aligns with the HIX/IES Project Timeline. 3. Detailed schedule that includes activities, tasks, estimated start and end dates, durations, deliverables, and assigned resources to illustrate how IV&V Services will be achieved. 4. Organizational structure which reflects, among other things, the need to coordinate activities among the IV&V Contractor, the HIX/IES SI Contractor, and the HIX/IES Entities. 5. Description of resources assigned to activities, tasks and the IV&V deliverable creation. 6. Description of the deliverables produced as a result of IV&V activities. B. Review all HIX/IES Project Deliverables 1. The IV&V Contractor shall review all HIX/IES Project Deliverables in accordance with the deliverable review process defined in the HIX/IES SI RFR, as may be updated by UMMS. The IV&V Contractor s HIX/IES Project Deliverable review activities include, without limitation, the following: a) Review and assessment of deliverable outlines and sample deliverables submitted by the HIX/IES SI Contractor to determine whether the outline and sample deliverables meet the requirements of the HIX/IES Entities. b) Development of acceptance criteria tailored to each HIX/IES Project Deliverable which (i) clearly delineate the criteria that must be satisfied for the HIX/IES Project Deliverable to be deemed complete, and (ii) are consistent with the HIX/IES SI Contractor s Work Orders and other HIX/IES Project requirements and specifications. c) Development of a checklist for eachhix/ies Project Deliverable review, including the acceptance criteria applicable to the HIX/IES Project Deliverable. d) Review and assessment of all HIX/IES Project Deliverables submitted by the HIX/IES SI Contractor, and reporting of findings and associated recommendations for remediation where applicable. e) Identification and summarization of issues and all other results of the HIX/IES Project Deliverable review. 26

27 f) Review and assessment all subsequent HIX/IES Project Deliverable iterations to validate remedial actions taken by the HIX/IES SI Contractor to assess if recommendations have been incorporated satisfactorily. g) Tracking of identified issues andprogress toward resolution of issuesrelated to HIX/IES Project Deliverables. h) Support of the approval process for each HIX/IES Project Deliverable. 2. The IV&V Contractor shall conduct an analysis of past project performance sufficient to identify and make recommendations for improvement. Additionally, the IV&V Contractor shall facilitate HIX/IES Project compliance with the following tables that are set forth in Part Eight of this RFR: a) Table 2: Project Timetable b) Table 3: Code Drop Schedule within the Requirements, Design, and Development Stage c) Table 4: Deliverables by Milestone 3. The IV&V Contractor will assess HIX/IES Project Deliverableson defined quality attributes, including but not limited to: a) Adherence to Requirements Does the HIX/IES Project Deliverable satisfy specified requirements? b) Clarity For written HIX/IES Project Deliverables, does the HIX/IES Project Deliverable clearly state its meaning and minimize the possibility of misinterpretation? c) Completeness Does the HIX/IES Project Deliverable fulfill applicable requirements, with no tasks left incomplete? Is anything missing? d) Consistency Are the requirements contained in the HIX/IES Project Deliverable consistent both within a given HIX/IES Project Deliverable and across all HIX/IES Project Deliverables? e) Traceability For each HIX/IES Project Deliverable, are all applicable requirements traceable through each phase of the software development life cycle? f) Adherence to Laws, Rules and Guidelines (included in Part Four of the HIX/IES SI RFR) Does the HIX/IES Project Deliverable satisfy all applicable guidelines, standards, instruction, and policies issued by project managers as well as state and federal agencies? 27

28 C. Validate automated code review results The HIX/IES SI Contractor will be responsible for conducting automated code tests. The IV&V Contractor shall: 1. Review and assess the Automated Code Review component of the HIX/IES SI Contractor s test plan. 2. Review and assess the results of Automated Code Review activities. 3. Report issues and findings, and recommend practical and feasible solutions. 4. Track issues and findings to completion by reviewing and assessing subsequent releases. D. Validate continuous integration results The IV&V Contractor shall: 1. Review continuous integration test plan for comprehensiveness, completeness, and traceability. a) Verify that integration tests address all system components and all functional and non-functional requirements, and that they do not simply repeat unit tests. b) Verify that test cases are properly mapped, through a traceability matrix, to requirements, use cases, and other Artifacts. 2. Verify timelines and tests for all releases. a) Verify test plans for all releases so that test plans include both integration and regression tests. 3. Review and assess results from continuous integration test activities. a) Assess each system component s integration test results against the testing exit criteria, and summarize the test results for each component. 4. Report issues and findings, and recommend practical and feasible mitigating solutions. 5. Track issues and findings to completion by reviewing and assessing subsequent releases. E. Coordinate and Conduct User Acceptance Testing At a minimum, the IV&V Contractor shall conduct UAT on functionality within all Code Drop milestones as described in the HIX/IES SI RFR. The purpose of UAT is to provide the users of a system the opportunity to validate that the delivered software components behave according to stated 28

29 requirements and to assess the readiness of the software for go-live. The IV&V Contractor shall coordinate and conduct all User Acceptance Testing tasks and activities including, but not limited to, the tasks described below. The IV&V Contractor shall plan for, conduct, and provide follow-up activities for the UAT of the HIX/IES system until the UAT meets its stated exit criterion. Representatives from the HIX/IES Entities will provide subject matter expertise, review and approve the IV&V Contractor s UAT testing deliverables, and review system readiness for go-live. While representatives from the HIX/IES Entities may also be available to conduct UAT, the responsibility rests with the IV&V Contractor. 1. Develop UAT Strategy and Plan The IV&V Contractor shall develop a UAT plan that describes at a minimum the approach, timing, and activities involved in coordinating and conducting User Acceptance Testing. The UAT plan should also describe the recommended depth and breadth of coverage from a functional perspective that needs to be exercised during UAT testing. The IV&V Contractor s UAT plan shall describe at a minimum: a) Critical factors for a successful UAT process and description for how the factors will be measured. The assessment of critical factor results will determine if UAT was a success and serve as UAT exit criteria. b) Testing metrics and success criteria for each phase or iteration of UAT. c) Project risks and how those risks will be addressed by the UAT task. d) Critical business workflows and how those workflows will be tested. e) All possible points of failure and how those points of failure will be tested. f) Traceability of UAT tests to requirements. g) Proposal of the most appropriate points in time during the HIX/IES Project life cycle at which executing UAT testing should be conducted. h) Detailed UAT schedule based on the overall HIX/IES Project plan and milestone dates. i) Proposal of UAT team composition covering technical and business knowledge areas to maximize the reliability of test outcomes. j) Validate that the UAT test environment delivered by the HIX/IES SI Contractor satisfies all requirements in terms of features, characteristics, connectivity and processing to facilitate successful UAT. 29

30 k) A test data management process that describes the identification, creation, and maintenance of test data required to facilitate successful UAT. l) Techniques to familiarize the UAT test team as early as possible with the system in preparation for UAT test activities. Techniques such as requirement walkthrough sessions, blueprint and/or wireframe review sessions, screen preview sessions, system demo sessions, etc. must be considered. m) Test techniques and/or test methods that will be used during UAT testing. n) Test scenarios that will be used during UAT testing. o) Approach for documenting UAT test scripts prior to UAT test execution. 2. Execute UAT a) Conduct and record the results of UAT. b) Identify, log, and prioritize defects found during UAT. c) Record UAT results, including but not limited to: (1) Number and percentage of test cases executed and not executed; (2) Number and percentage of test cases passed and failed by functional area. 3. Follow-Up on UAT a) Track UAT defects to closure. b) Assess the success of UAT based on identified exit criteria. F. Verify implementation readiness The IV&V Contractor shall develop an approach for assessing the readiness of the HIX/IES system to support the two major implementation milestones. The IV&V Contractor shall: 1. Define a set of robust and comprehensive criteria to assess implementation readiness for the two implementation milestones: a) Soft Launch b) Open Enrollment Launch 2. Assess implementation readiness based on the identified criteria 30

31 3. Report issues and findings and recommend practical and feasible solutions. 4. Track issues and findings to completion. G. Verify component reusability The HIX/IES Entities aim to create a HIX/IES that complies with provisions of the ACA. The HIX/IES Entities are committed to supporting a learning collaborative where participating New England states can share lessons learned from developing their state-based Exchanges, as well as participate in the development of cost-effective and reusable technology components, intellectual property, and best practices for implementing Exchanges. Further, the HIX/IES Entities desire to leverage and re-use components from other states and the Federal Facilitated Exchange (FFE). The extent to which information technology components can be shared and reused is guided by three tiers of reusability. The lowest tier represents the lowest level of re-usability, whereas the highest tier represents the highest level of reusability. The tiers and their definitions are as follows: Tier 1 - Reusability of HIX/IES documentation, processes, and knowledge and the documentation, processes, and knowledge provided by other states and the FFE. Tier 2 - Reusability of HIX/IES components independently hosted and procured by other states and the reusability of components provided by other states and the FFE. Tier 3 - Reusability of HIX/IES components shared and leveraged from common infrastructure. The IV&V Contractor shall identify all project components generated by the HIX/IES Project and IV&V Services which are candidates for reuse, including but not limited to, documents, processes, and software components. The IV&V Contractor shall also identify components available from other states and the FFE which have potential for re-use for the HIX/IES Project. The IV&V Contractor shall verify and validate the reusability of components, and the verification should assess whether the components are reusable and at what tier. 1. Component Reusability The IV&V Contractor shall develop the following assessments of reusability for each component: 31

32 a) Expected Reusability: An initial assessment of the components that have reusability potential and the reusability level that can be expected. b) Delivered Reusability: An assessment of the components as documented and developed and the actual reusability level achieved. Compare the result to the component s expected reusability. To illustrate, the IV&V Contractor will assess the detailed design of the Business Rules Engine to determine which modules can be expected to be reused by other states. The assessment will include the level of reusability for each module.for instance, the assessment would evaluate the MAGI calculations module and if that module is expected to have Tier 1, 2, or 3 reusability. Once the MAGI calculations module is developed, an assessment as to its actual or delivered reusability will be performed by the IV&V Contractor. 2. Services Reusability The IV&V Contractor will assess services to evaluate the level to which services are business agnostic and stateless to support successful deployment of services such as: a) SaaS: Software as a Service (e.g. Address Validation or HIPAA translator) b) PaaS: Platform as a Service (e.g. Portal, Middleware, Database) c) IaaS: Infrastructure as a Service (e.g. Shared Data Center, Virtual Machines) 3. Framework Reusability The IV&V Contractor will assess the HIX/IES framework to evaluate the level to which the framework: a) Is based on Service Oriented Architecture b) Is developed using Federal, State, and industry best practices c) Employs a Cloud First approach d) Follows Federal and CMS security and privacy guidelines (included in Part Four of the HIX/IES SI RFR - Laws, Rules and Guidelines) e) Is based on Exchange Reference Architecture f) Follows ACA Section 1561 recommendations H. Perform a System Audit 1. The IV&V Contractor shall: 32

33 a) Develop a plan to perform a system audit and specify, among other things, the dimensions which will be addressed in the system audit and the criteria applied to each dimension. b) Perform the system audit c) Report results of the system audit and recommend practical and feasible solutions. d) Track issues and findings to completion. 2. Through the system audit, the IV&V Contractor must evaluate the system along various dimensions, including but not limited to: a) System Effectiveness: Verify that information is pertinent to the appropriate business process and is delivered in a timely, correct, consistent and usable manner. b) System Efficiency: Verify that the system provides information through the most optimal use of resources. c) Confidentiality: Verify that the appropriate controls are in place to ensure compliance with the full range of security and privacy requirements in order to protect sensitive information from unauthorized use and disclosure. (1) Sensitive information protected by privacy and security requirements includes but is not limited to: i. PII Personal Identifiable Information ii. PHI Protected Health Information iii. FTI Federal Tax Information iv. Department of Revenue ( DOR ) wage information (2) Appropriate controls include but are not limited to: i. Intrusion prevention/detection ii. Vulnerability and penetration prevention/detection iii. Network hardening iv. Identity management v. Physical access to facilities vi. Logical access to data and processes vii. Monitoring of system activity, logging of incidents, and action plans to prevent and/or address identified incidents 33

34 d) Integrity: Verifying that information is accurate and complete in accordance with business requirements and expectations. e) Availability: Verifying that information will be available when required by the business in the short and long term, and verifying that resources and capabilities are appropriately safeguarded. f) Compliance: Verifying that the system is in compliance with all laws and regulations to which the business processes are subjected. g) Reliability: Verifying that the system s users have access to the information they need to carry out their responsibilities including meeting financial and compliance reporting responsibilities. 3. When performing the above mentioned activities, the IV&V Contractor s system audit must address several resources, including but not limited to: a) Data: Objects in their widest sense structured, non-structured, graphics, sound, and more. b) Application Systems: The sum of manual and programmed procedures. c) Technology: Hardware, operating systems, database management systems, networking, multimedia, and the like. d) Facilities: All the resources that house and support the information system. e) People: Staff skills, awareness, productivity to plan, organize, acquire, deliver, support and monitor information systems and services. I. Perform Financial Reviews The IV&V Contractor will perform financial reviews to assess various elements of the HIX/IES Project: 1. Assess the financial measurement baseline for the project and define how it will be tracked, define reporting for the financial health of the project, and the invoicing requirements and timelines for the project. 2. Review invoices submitted by the HIX/IES SI Contractor and determine if the terms of their submission have been met. Note that invoices will be submitted at different times and based on different terms, including: a) when HIX/IES Project milestones are completed; b) on a monthly basis according to work performed under Work Order 12 Interstate (NESCIES) Support; 34

35 c) under other terms for example, invoicing for services performed under Work Order 9 Hosting. 3. Assess on a monthly basis the percent completion of the HIX/IES Project in comparison to the percent of the amount paid to the HIX/IES SI Contractor. Develop a tracking system for this monthly assessment. 4. Review Anticipated Charge Requests ( ACR ) submitted by the HIX/IES SI Contractor and assess the financial, schedule, and scope impact to the HIX/IES Project. 5. Review the approachto, and implementation of, cost allocations across the HIX/IES Project s various funding sources. 6. Assess the implementation and long-term operational costs related to hardware, software, hosting, and other decisions which affect the total cost of ownership of the HIX/IES system. 7. Establishment Review and Medicaid IT Review Reports The IV&V Contractor shall also develop key financial artifacts needed to support the Establishment Review and Medicaid IT Review process. J. Conclude IV&V Services The IV&V Contractor s end-of-project activities include but are not limited to the following: 1. Organize all IV&V information to make it useful for staff who operate and maintain the HIX/IES system. 2. Confirm that all HIX/IES Project Deliverables and alliv&v Project Deliverables are up to date and finalized. 3. Prepare an archive of all documents related to IV&V activities. 4. Prepare a final report that summarizes expectations, opportunities, and challenges related to the new HIX/IES system. 5. Coordinate end-of-project activities with the HIX/IES SI Contractor and HIX/IES Entities for a transition to stable system operation and maintenance. III. IV&V Project Deliverables The following section describes the major IV&V Project Deliverables expected from the IV&V Contractor for the tasks described in the previous section. Upon UMMS 35

36 request, IV&V Contractor shall consolidate certain IV&V Project Deliverable reports into one or more reports. The IV&V Contractor shall provide the following IV&V Project Deliverables: A. Manage the IV&V Responsibilities. 1. IV&V Services Project Management Plan The IV&V Services Project Management Plan as described in detail in Part One Specifications, Section 11. Scope of Work, II. Tasks, (A) Manage the IV&V Services. 2. IV&V Monthly Review and Assessment Report The IV&V Contractor shall provide a Monthly Review and Assessment Reports whichdescribes key information in the IV&V tasks for which work was performed in such month and plans for the upcoming month. Key information includes, but is not limited to, activities performed, key or critical results, findings or issues identified as a result of the activities performed, IV&V Deliverables approved during such month, and an updated IV&V Services Project Management Plan with details of activities expected to be performed in the upcoming month. 3. Executive Team Briefings ExecutiveTeam briefings shall be formal presentations by the IV&V Contractor to the ExecutiveTeam to illustrate and discuss Monthly Review and Assessment Reports. Briefings shall occur no less than five (5) business days after the issuance of the reports in final form. 4. IV&V Weekly Status Reports Status reports shall be generated on a weekly basis for the duration of the Contract and shall describe the ongoing status and progress of IV&V tasks, deliverables and issues. 5. Issue Tracking and Reporting Plan All HIX/IES issues identified during the IV&V Services must be reported, tracked, and resolved according to defined procedures and methods. The IV&V Contractor shall develop an issue-tracking plan that outlines these elements: a) Reporting methods b) Issue tracking tool or tools c) Method for setting issue priority d) Procedures issue resolution 6. IV&V Dashboard 36

37 The IV&V Contractor shall provide a tool, such as a dashboard, that presents all HIX/IES Project Deliverables and IV&V Project Deliverables and their status. The dashboard should also present issues identified across the various tasks as well as the recommendations for resolution, the resolution itself, and the status of the issue. The tool shall permit the HIX/IES project management team to monitor progress toward resolution of issues and implementation of related recommendations. B. Review all HIX/IES Project Deliverables. 1. HIX/IES Project Deliverable Review Reports The IV&V Contractor shall produce a report for each iteration of each HIX/IES Project Deliverable submitted by the HIX/IES SI Contractor. Deliverable Review Reports shall list all defects, shortcomings, issues, and problems the IV&V Contractor finds in the HIX/IES Project Deliverables, as well as recommended corrective actions. 2. HIX/IES Project Deliverable Acceptance Criteria The IV&V Contractor shall produce a list of acceptance criteria, as approved by the HIX/IES Entities, that must be satisfied in order for a HIX/IES Project Deliverable to be deemed complete. 3. HIX/IES Project Deliverable Review Checklists The IV&V Contractor shall produce a list which includes the set of reviews that must be executed for all HIX/IES Project Deliverables, to ensure HIX/IES Project Deliverables are assessed consistently and completely. 4. HIX/IES Project Deliverable Outline Report The IV&V Contractor shall produce a report that summarizes all the HIX/IES Project Deliverable outlines submitted for approval to the HIX/IES Entities. C. Validate Automated Code Review Results 1. Automated Code Review Reports The IV&V Contractor shall develop Automated Code Review Reports to communicate Automated Code Review results. D. Validate Continuous Integration Review Reports 1. Continuous Integration Review Reports 37

38 The IV&V Contractor shall develop appropriate reporting mechanisms to communicate continuous integration review results. E. Coordinate and Conduct User Acceptance Testing 1. UAT Strategy and Plan The IV&V Contractor shall develop a UAT Strategy and Plan which describes at a minimum the approach, timing, and activities involved in coordinating and conducting UAT. The plan should also describe the recommended depth and breadth of coverage from a functional perspective that needs to be exercised during UAT testing. 2. UAT Procedures Guide The IV&V Contractor shall develop a UAT Procedures Guide to distribute to UAT team members as a reference manual. The UAT Procedures Guide shall include at a minimum: a) Descriptions of the goals and objectives of UAT b) Descriptions of the roles and responsibilities of the UAT team c) Descriptions of test techniques that will be used during UAT testing d) Descriptions of test methods that will be used during UAT testing e) Sample test scenarios f) Sample test cases g) Guidelines on how to identify test conditions h) Templates for test Artifacts such as test case templates, test script templates etc. i) Guideline on how to document UAT test scripts based on test cases so that UAT participants have a clear understanding of how to execute and record test results 3. UAT Reports The IV&V Contractor shall propose and develop appropriate reporting vehicles to communicate UAT testing progress and results. Reporting shall include but is not limited to: a) Executive summaries to communicate UAT progress and UAT results. b) Detailed reports to communicate UAT progress and UAT results. c) Actual UAT tests performed and the results. 38

39 The IV&V Contractor shall use appropriate industry standard metrics to communicate UAT results in graphical and tabular format. F. Verify Implementation Readiness 1. Implementation Readiness Criteria The IV&V Contractor shall develop a set of robust and comprehensive criteria that must be satisfied in order to deem a deliverable ready for implementation. 2. Implementation Readiness Reports The IV&V Contractor shall develop Implementation Readiness Reports to assess the readiness of the system for its implementation milestones. G. Verify Component Reusability 1. Reusability Reports The IV&V Contractor shall develop reusability reports to communicate its assessments of HIX/IES component reusability and re-use of components from other states and the FFE. a) An initial assessment and plan for the reusability that can be expected. This initial assessment and plan should minimally be provided for each of the four Code Drops. b) An assessment of delivered reusability. This assessment should minimally be provided for each of the four Code Drops. H. Perform a System Audit 1. System Audit Dimensions and Resources The IV&V Contractor shall develop a comprehensive description of all aspects of the system audited, the criteria applied in the system audit and the resources targeted by the system audit. 2. System Audit Report The IV&V Contractor shall develop a System Audit Report to communicate the results of the system audit. I. Perform Financial Reviews 1. Cost Allocation Plan/Methodology The IV&V Contractor shall develop the Cost Allocation Plan/Methodology artifact. This is an Establishment Review artifact 39

40 which describes the plan and approach to allocating system costs appropriately between Exchanges, Medicaid, CHIP, and other programs. 2. Financial Management Plan The IV&V Contractor shall develop the Financial Management Plan. This is an Establishment Review artifact which documents the financial measurement baseline for the project and defines how it will be tracked. The artifact will also define reporting for the financial health of the project, and the invoicing requirements and timelines for the project. 3. Financial Status Reports The IV&V Contractor shall develop regular Financial Status Reports. The Financial Status Report is an Establishment Review artifact produced on a periodic basis to report investment consumption. 4. Financial Review Reports The IV&V Contractor shall develop Financial Review Reports to communicate the results of the financial analysis described under Part One Specifications, Section 11. Scope of Work, II. Tasks, (I) Perform Financial Reviews; as well as ad hoc reports on the financial impact of key decisions and change orders. J. Conclude IV&V Services 1. IV&V Final Report The IV&V Contractor shall develop a Final Report at the conclusion of the IV&V Services. 2. Archive of All IV&V Documents The IV&V Contractor shall develop an all inclusive library of Artifacts created by the IV&V Contractor during the term of the IV&V Contract to be delivered to the HIX/IES Entities at the end of the Contract. IV. General Requirements A. IV&V Deliverable Review Process All IV&V Deliverables shall be reviewed by EOHHS and CCA, and the decision to unconditionally accept or reject any deliverable shall be communicated in writing to the IV&V Contractor by theumms Contract Manager. Once a deliverable isunconditionally accepted, and final approval is communicated by UMMS in accordance with procedures set forth below, the Contract deliverables will be deemed accepted or completed. 40

41 The deliverable review and acceptance process will include, without limitation, the following elements: 1. The IV&V Contractor will submit a deliverable outline and a sample deliverable prior to initiating the development of the deliverable. The deliverable outline will serve as the deliverable specifications and shall include at a minimum a detailed table of contents. The sample deliverable should be a deliverable produced for a project of similar size and complexity as the HIX/IES. The deliverable outline and sample deliverable shall be delivered to the UMMS Project Manager, or his/her designee. 2. EOHHS and/or CCA (as applicable) shall review the deliverable outline and sample deliverable and identify changes to the table of contents. 3. As soon as possible, but in no event later than ten (10) business days after receipt of a deliverable outline and sample deliverable, the UMMS Contract Manager, or his/her designee shall give written notice to the IV&V Contractor Project Manager of the acceptance or rejection of the deliverable outline and sample deliverable. 4. As soon as possible, but in no event later than seven (7) business days after receipt of a notice of rejection of the deliverable outline and sample deliverable, the IV&V Contractor shallmake the specified corrections and deliver an updated version of the deliverable to the UMMS Project Manager, or his/her designee. 5. The IV&V Contractor shall submit deliverables to the UMMS Project Manager, or his/her designee. To the extent there are multiple deliverables submitted at the same time, the HIX/IES Entities and IV&V Contractor will cooperate in good faith to adjust the seven (7) business day review schedule as necessary. Additionally, upon submission of each deliverable, the IV&V Contractor shall schedule a meeting with the HIX/IES Entities to walk through and explain the structure and content of the deliverable and collect immediate feedback. 6. EOHHS and/or CCA (as applicable), shall review each deliverable and evaluate whether the deliverable has clearly met in all material respects the criteria established in the Contract, individual tasks, the deliverable specifications, and any other requirements mutually agreed upon in writing by the University and the IV&V Contractor. As soon as possible, but in no event later than ten (10) business days after receipt of a completed deliverable, the UMMS Contract Manager, or his/her designee, shall give written notice to the IV&V Contractor Project Manager of acceptance or rejection of the deliverable. If the deliverable is rejected, the written notice shall also include a description of the nature and extent of the defects required to qualify the deliverable for acceptance. 7. The IV&V Contractor will act diligently to correct the specified defects and deliver an updated version of the deliverable to the UMMS Project 41

42 Manager, or his/her designee, no event later than seven (7) business days after receipt of a notice of rejection of a deliverable. 8. EOHHS and/or CCA (as applicable) will review and evaluate the updated deliverable. As soon as possible, but in no event later than seven (7) business days after resubmission of any rejected deliverable, the UMMS Contract Manager, or his/her designee, shall give written notice to the IV&V Contractor Project Manager of the status of the resubmission. A rejection of a resubmitted deliverable will include a description of the way in which the updated deliverable fails to correct the previously reported deficiency. 9. When a deliverable is accepted, the UMMS Contract Manager will sign a form indicating acceptance, and the IV&V Contractor will acknowledge receipt of the acceptance form in writing. 10. In the event UMMS accepts a deliverable that requires additional work to be entirely compliant with the pertinent specifications and until the next deliverable remedying such noncompliance, the IV&V Contractor will provide a prompt correction or workaround. 11. By submitting a deliverable, the IV&V Contractor covenants that it has performed the associated tasks in a manner that will, in concert with other tasks, meet the objectives specified in the Contract. By approving a deliverable, UMMS represents only that EOHHS and/or CCA (as applicable) have reviewed the deliverable and detected no errors or omissions of sufficient gravity to defeat or substantially threaten the attainment of those objectives and unless otherwise agreed in writing by UMMS and IV&V Contractor, to warrant the withholding or denial of payment for the work completed. UMMS approval of a deliverable does not discharge any of the IV&V Contractor s contractual obligations with respect to that deliverable, or to the quality, comprehensiveness, functionality, effectiveness, or certification of the HIX/IES system as a whole 12. Note that whenever the due date for any deliverable, or the final day on which an act is permitted or required by the Contract to be performed by either party, fall(s) on a day other than a business day, such date shall be the first business day following such day. Unless otherwise specified, the time for performance shall be prior to 3:00 p.m. Eastern Standard Time. B. Key Personnel Requirements The IV&V Contractor shall identify dedicated and forward-looking individuals who possess both a deep and a broad understanding of ACA, especially the health insurance exchange component of the law. The IV&V Contractor shall also understand the vision of the HIX/IES Project, the technologies used to build and operate it, and the desire to build reusable components for other state Exchanges and re-use components from other 42

43 Exchanges. Finally, the IV&V Contractor shall also understand what it means to independently verify and validate systems of this scale, importance, and complexity. The University has determined that the following IV&V Contractor personnel qualify as Key Personnel : Project Manager Contract Manager Quality Assurance Manager UAT Manager Lead UAT Analyst Senior Systems Analyst Financial Analyst The IV&V Contractor shall designate, as part of its Key Personnel, a Contract Manager who shall be the primary contact for all matters related to this Contract. This Contract Manager will have signatory and decision making authority for the IV&V Contractor with respect to project management, ensure that the IV&V Contractor adheres to timelines, methodologies, consumer expectations, and any other contractual requirements, and will maintain a leadership role capable of understanding the scope of the project(s) in all aspects. 1. The IV&V Contractor shall identify the most qualified individuals to serve in the Key Personnel roles and must notify the University within thirty (30) days of any personnel changes. Desired qualifications and experiences for key personnel include the following: a) Extensive multi-project experience in the types of activities for which each individual is proposed with experience in the approach and methodologies used by the IV&V Contractor; b) Seasoned, demonstrable, extensive experience in large-scale software delivery in a number of state government or commercial health insurer environments. Federally funded human services systems experience is preferred; c) Demonstrable experience performing IV&V activities on large-scale application software projects in a number of state government or commercial health insurer environments. Federally funded human services systems experience is preferred; d) Experience with Systems Development Lifecycle ( SDLC ) and the approach and methodologies used by the IV&V Contractor; and 43

44 e) Medicaid eligibility experience, as well as experience with commercial health insurer environments. 2. The IV&V Contractor shall work with the HIX/IES Entities to effectively manage the Contract as follows: (a) The IV&V Contractor shall provide for the HIX/IES Entities' review and approval a detailed job description for each Key Personnel position to be performed as part of this Contract. (b) The IV&V Contractor shall provide access for the UMMS project manager to review, interview and give final approval of participation of all new Key Personnel proposed for the Contract. (c) Whenever changes to Key Personnel, subcontractors, and/or partners occur, the IV&V Contractor shall submit, for the review and prior approval of the UMMS project manager, the names of any partners or subcontractors, their principals, and copies of such contracts that the IV&V Contractor has newly acquired for the purposes of performing this Contract. C. Key Personnel at Project Site/Facility Facility space will be provided for seven IV&V Contractor staff at the EOHHS offices in Quincy, MA where the HIX/IES Entities project team is based during the Contract period at no cost to the IV&V Contractor.All Key Personnel are required to be located at the Quincy, MA project site. The Financial Analyst may be required to spend time at the University s campus in Shrewsbury, MA. The HIX/IES Entities will provide network and accounts to IV&V Contractor staff in need of such, but the IV&V Contractor shall be responsible for providing its staff with any tools deemed necessary to complete the project, including but not limited to remote access to Massachusetts network (the Massachusetts Access to GovernmentNETwork or MAGNet ), laptop computers, necessary software, copiers, printers, office supplies, and administrative support. D. Reporting Requirements Some of the HIX/IES Project Deliverables and IV&V Project Deliverables are subject to reporting and audit as required by funding sources.the IV&V Contractor shall assist the HIX/IES Entities in meeting such requirements as directed by the University. 44

45 12. Compensation I. Payment for IV&V Services The University shall pay the Contractor a fixed price upon satisfactory approval of each IV&V Monthly Review and Assessment Report deliverable (inclusive of the tasks described therein), in accordance with the process outlined in Section 11: Scope of Work, subsection IV. General Requirements, (A) IV&V Deliverable Review Process. The University shall pay the IV&V Contractor for work satisfactorily performed in accordance with the payment schedule to be set forth in the IV&V Contract. Invoices shall be submitted to the UMMS Project Manager. II. Change Orders and/or Amendments to the Scope of Work From time to time, EOHHS or CCA may, through the UMMS Contract Manager request an enhancement to the IV&V Services that is not required by any provision of the Contract. The UMMS contract manager shall make any such Change Order request in writing. The Change Order may specify whether the requested change is to be implemented on a certain date, or placed into effect only after approval of the IV&V Contractor s Anticipated Charge Request ( ACR ) submitted in accordance with this section. Contractor shall be responsible for monitoring the need for Required Changes and shall promptly notify the UMMS Project Manager and UMMS Contract Manager in writing of any anticipated Required Changes. Such written notification shall contain sufficient information and detail to permit the UMMS Contract Manager to prepare a Change Order. A. The IV&V Contractor shall promptly, but not more than 10 calendar days after receipt of any Change Order, furnish to the UMMS contract manager a written statement that such change has no price or schedule impact on the IV&V Contractor; a written statement that the change has a schedule impact but not a price impact; or an ACR stating that there is either a price or a price and schedule impact. The ACR shall include a line-item description of the estimated labor charge for IV&V Contractor staff, based upon the IV&V Contractor s staff and rates as specified in the Contract, and any impact on the schedule. B. The IV&V Contractor shall perform no work under the Contract that will result in an additional charge to UMMS, EOHHS or CCA without first submitting an ACR to the UMMS contract manager. The ACR shall contain a description of the work to be performed, the price, and a timetable. The ACR must be approved in writing by the UMMS contract manager. 45

46 C. After submission of an ACR, the IV&V Contractor and the UMMS contract manager shall negotiate and attempt in good faith to agree upon a plan and schedule for implementation of the Change Order, including the time, manner, and amount of payment based upon the IV&V Contractor s staff and rates as specified in the Contract as well as any decrease or change to schedule. D. If the parties are unable to reach an agreement, the UMMS contract manager may direct the IV&V Contractor in writing to proceed forthwith to implement the Change Order. In such cases the parties will continue to work in good faith to reach agreement on the scope, price (if any), payment, or schedule of the Change Order, and the IV&V Contractor will be compensated for actual labor hours at the IV&V Contractor s rates as specified in the Contract. IV&V Contractor s duty to proceed applies regardless of whether the issue has been submitted to the dispute resolution process detailed below in subsection I. E. If the IV&V Contractor complies with any order, direction, interpretation or determination, written or oral, from someone other than the UMMS contract manager, with or without providing the notice in the manner and within the time specified, UMMS shall not be liable for any increased price, delay in performance or Contract nonconformance by the IV&V Contractor. F. The IV&V Contractor will not submit any invoice for adjustment under this section and will not be paid prior to approval by the UMMS contract manager of the related ACR. G. In no event shall the correction of any deliverable to obtain its approval, nor performance of any other work required under this Contract, be deemed an enhancement or modification permitting or requiring treatment as a Change Order. H. Change Orders requiring an approved ACR shall be finalized by the parties as written amendments to the Contract in accordance with paragraph 20 of the Contract found in Part Six of this RFR. I. The parties agree to work together in good faith to resolve any matters relating to Change Orders internally by escalating issues to IV&V Contractor s Contract Manager, the UMMS Contract Manager and the Executive Team. J. In the event UMMS terminates all or part of a Work Order under the SI Vendor Contract or eliminates or reduces an IV&V Project Deliverable, the parties shall enter into a Change Order setting forth the reduced scope and the agreed upon reduction in the firm fixed price. 46

47 K. IV&V Contractor is not authorized to substitute any item for any IV&V Project Deliverable identified in this Contract without the prior written consent of the UMMS Contract Manager and compliance with the change order process. 13. New Initiatives and Program Modifications The University reserves the right, at its sole discretion and at any time prior to or during the Contract term, to change any scope of work or portion thereof, whenever, in the University s judgment, the HIX/IES Project goals have been modified in any way that necessitates such changes.in the event that the scope of work for any task(s) or portions thereof must be changed, the UMMS contract manager shall notify the IV&V Contractor in writing and negotiate appropriate changes to the Contract, if any. Notwithstanding the generality of the foregoing, the University reserves the right to amend any Contract resulting from this RFR to implement new initiatives or to make program modifications related to: I. new programs of EOHHS, CCA or the University; II. expansion, reduction, or restructuring of existing programs of EOHHS, CCA or the University; III. other programs related to University business; and/or IV. programs resulting from state or federal legislation or other regulatory initiatives that may affect in whole or in part any of the components of the scope of work. Bidders should also refer to Part Two of the RFR, Section 8 Amendments to the RFR, andparagraph 20 of the Contract found in Part Six of this RFR. 14. Sustainability In 2007, the President of the University of Massachusetts signed the American College and University Presidents Climate Commitment. The University is committed to reducing the adverse environmental impact of its purchasing decisions; it is committed to buying goods and services from IV&V Contractors who share its environmental concern and commitment. The University encourages Bidders to include in their Responses economical and environmentally friendly products and service options that serve to minimize waste, reduce excess packaging, recycle, reduce, reuse, prevent pollution, and/or offer 47

48 resource efficiency. It is the University s goal to maximize environmental responsibility on its campuses. The University recommends that Bidders use recycled paper and double-sided copying for production of all printed and photocopied documents. Furthermore, the documents should be clearly marked to indicate that they are printed on recycledcontent (minimum 30% post-consumer waste) paper. For more information about the Presidents Climate Commitment, go to 48

49 PART TWO RESPONSE SUBMISSION REQUIREMENTS 1. Response Instructions I. Preparation of Responses A. All Responses must be sealed and submitted in accordance with the instructions in this Part Two, Section 1 Response Instructions. B. All Response documents must be signed in blue ink. Facsimile signatures are unacceptable. Responses that are priced or signed in pencil may be rejected as nonresponsive. Bidders are cautioned that handwritten alterations to Response documents must be initialed by the person signing the Responses, or by his/her authorized designee. Failure to do so may result in rejection of the Response. C. Response documents must be typewritten. II. Response Documents The Response documents shall consist of the following: A. Business Response The Business Response must contain the documents specified in Part Two, Section 2 Business Response of this RFR. B. Program Response The Program Response must contain the Program Response content as described in Part Two, Section 3 Program Response of this RFR. C. Cost Response The Cost Response must contain the Cost Response forms in Exhibit B to the RFR (detailed instructions are included inpart Three of this RFR). D. Electronic Version of Response In addition to the required paper documents, the Bidder must submit two electronic copies of the Response documents (as a PDF file) on separate USB flash drives or CDs that are readable on an IBM-compatible computer. Each of the two CDs or USB flash drives must contain one copy each of the Business Response, Program Response, and Cost Response. The Bidder is responsible for ensuring that there are no discrepancies between the required electronic and hard copies submitted to the 49

50 University. If any discrepancies between the versions exist and the University relies upon an element of one version or the other, which may not be the version that the Bidder intended, the Bidder nonetheless shall be bound by the submission to the University. III. Submission Instructions One original and seven copies of the Business Response, Program Response, and Cost Response must be submitted in separate sealed envelopes for each of the three types of Responses (or package if necessary). In addition, the two electronic copies must be submitted in a separate sealed envelope (or package if necessary). The Response package should include a total of four envelopes that can be sent together in one package, including: A. Envelope one one original and the required copies of the Business Response; B. Envelope two one original and the required copies of the Program Response; C. Envelope three one original and the required copies of the Cost Response; D. Envelope four two CDs or USB flash drives with electronic copies of the Business Response, Program Response, and Cost Response. Bidders must NOT include any costs in their Business or Program Responses. Cost Responses must be submitted separatelyin a clearly labeled and sealed envelope, and must only include a response to Part Three of this RFR including the required accompanying Cost Tables in Excel (Exhibit B).If any cost information is found in the Business or Program Responses, or if the CostResponse (Part Three) is not submitted in a separate, clearly labeled, sealed package, the entire Response will be disqualified. All sealed envelopes must be sent to the address in the box below. Each envelope must include the following information on the outside of the package, as indicated in the box below: The University strongly recommends that Responses are shipped using a nationally recognized commercial delivery service that provides a tracking system for the package. The University recommends that you monitor your package by its tracking number to ensure it arrives on time.it is each Bidder s responsibility to ensure that each package is marked appropriately 50

51 with all the required information (as listed in the box above) and to monitor/confirm delivery to the University. The University will not notify you upon receipt of the Response. Bidders may contact the individual named in Part Two, Section 6 Questionsto confirm that the Response has been received. The Business Response, Program Response, Cost Response, and CD disks(or USB flash drives) envelopes/packages may be shipped in the same package; however, each must be separately wrapped and labeled as described in this subsection. Please reference the Request for Response Numberon the outside of the package. IV. Directions to Drop off Responses Bidders may hand-deliver Responses to the address below: Jeff DiCiaccio Senior Director of Purchasing Purchasing Department 333 South Street, Suite Shrewsbury, MA Phone: From Boston and Points East: Take Massachusetts Turnpike (I 90) West to I 495 North. From I 495 North, take RT 9 West. Go approximately 7 miles on RT 9 West. At the 4th traffic light, (Price Chopper on right and Kia Wagner auto dealership on left), TURN LEFT onto South St. Go up the hill and TURN LEFT at the University of Massachusetts sign. TURN RIGHT at the first stop sign. The parking lot will be on your right. TURN RIGHT into the Visitor's parking lot, directly across the street from the building entrance. From 495 North/South: Take I 495 to RT 9 West. Go approximately 7 miles on RT 9 West. At the fourth traffic light, (Price Chopper on right and Kia Wagner auto dealership on left), TURN LEFT onto South St. Go up the hill and TURN LEFT at the University of Massachusetts sign. TURN RIGHT at the first stop sign. The parking lot will be on your right. TURN RIGHT into the Visitor's parking lot, directly across the street from the building entrance. 51

52 From Amherst, Hadley and Points West: Take Massachusetts Turnpike (I-90) East. Exit at exit 11 (RT 122 Millbury/Worcester). Go through the toll both; STAY LEFT on the ramp. TURN LEFT onto SR-122 North [Grafton Rd], following signs for RT- 122/Worcester/Paxton. Go approximately 0.5 miles on RT 122 N. TURN RIGHT onto the ramp for US-20 East [Southwest Cutoff]. (Keep right: 2-way traffic on the ramp!) Go approximately 4.2 miles on RT 20 East, going straight at five traffic lights. Watch for sign on left: "Shrewsbury Transmissions." At the sixth traffic light, TURN LEFT onto South St. Go approximately 0.2 mi. to 333 South St. TURN RIGHT at the University of Massachusetts sign. TURN RIGHT at the stop sign. The parking lot will be on your right. TURN RIGHT into the Visitor's parking lot, directly across the street from the building entrance. Click here to see map 52

53 V. Response Due Date Responses will be accepted until the date and time set forth in Part Two, Section14 RFRTimetable. Responses received after that date and time will not be considered. Bidders may contact the individual named in Part Two, Section6 Questions to confirm that the Response has been received. In the event that the Response is received by the University but has not reached the individual named in Part Two, Section 6 Questions as specified, the University reserves the right, but is not obligated, to accept the Response. This University right may be exercised only if the Bidder presents, in a timely manner, proof acceptable to the University that the Bidder s Response was received as specified. Inclement, Severe Weather in Regard to Response Submissions: In the event of inclement, severe weather, as determined by the University s Purchasing Office, the Purchasing Office may decide to extend the due date for the submission of Responses. The University may do this without issuing an addendum to the RFR. VI. Modification or Withdrawal of Responses A Response may be withdrawn or modified prior to the due date and time stated in Part Two, Section14 RFRTimetable. Such withdrawal or modification may be (1) in writing and signed by an authorized representative of the Bidder, or (2) made in person at the Purchasing Department, provided in the latter case that adequate identification is shown by the Bidder or its authorized representative. Telephonic withdrawals, but not modifications, will be accepted, provided written confirmation by the Bidder is mailed to the University, postmarked on or before the date and time on which Responses are due. VII. Massachusetts Public Records Law All Response and related documents submitted in response to this RFR become public records and are subject to the Massachusetts Public Records Law, M.G.L. c. 4, s. 7, ss. 26, and M.G.L. c. 66, s. 10 Any statements in submitted Responses that are inconsistent with these statutes will be disregarded. 2. Business Response The Bidder shall submit a Business Response, which shall consist of the documents specified in Subsections (I) - (XIII) of this Part Two,Section 2 Business Response. I. Transmittal Letter 53

54 The Bidder must submit the Transmittal Letter (see Part Five, Exhibit I) signed in blue ink by an individual with the authority to bind the Bidder. The Transmittal Letter must include the Bidder s name and address. II. III. IV. Bidder s Contact Information The Bidder must provide contact information for at least two (2) people at the Bidder s organization who the University can contact for clarification, notification of selection, etc. See Exhibit II in Part Five of this RFR. Certificate of Good Standing The Bidder must demonstrate compliance with Massachusetts tax laws, including M.G.L. c. 62C, s. 49A. The Bidder must submit an original or photocopy of a Certificate of Good Standing (see Exhibit III) which has been issued by the Massachusetts Department of Revenue within the past year. Certification of Non-Collusion The Bidder must sign and include in the Business Response the Certification of Non-Collusion form (see Part Five, Exhibit IV). Pursuant to M.G.L. c. 7, s. 22 (20), the Bidder certifies under penalties of perjury that its Response is in all respects bona fide, fair, and made without collusion or fraud with any person, joint venture, partnership, corporation, or other business or legal entity. The University may, by written notice to the Bidder, terminate the right of the Bidder to proceed under any Contract that may result from this RFR if the University determines that gratuities in the form of entertainment, gifts, or otherwise were offered or given by the Bidder, or agency or representative of the Bidder, to any officer or employee of the University with a view toward securing the Contract or securing favorable treatment with respect to any determination regarding the Contract and as set forth in M.G.L. c. 268A. V. Executive Order 504 Contractor Certification Form The Bidder must sign and include in the Business Response the Executive Order 504 Contractor Certification Form (see Part Five, Exhibit V). For all Contracts involving the Contractor s access to personal information, as defined in M.G.L. c. 93H, and personal data, as defined in M.G.L. c. 66A, owned or controlled by Executive Department agencies, including but not limited to the Executive Office of Health and Human Services (EOHHS) or access to other Massachusetts agency systems containing such information or data (herein collectively personal information ), Contractor certifies under the pains and penalties of perjury that the Contractor (1) has read Commonwealth of Massachusetts Executive Order 504 and agrees to protect any and all personal information; and (2) has reviewed all of the Commonwealth of Massachusetts 54

55 Information Technology Division s Security Policies under Policies and Standards. VI. VII. Certification Regarding Debarment and Suspension The Bidder must sign and include in the Business Response the Certification Regarding Debarment and Suspension (see Part Five, Exhibit VI). Certification Regarding Lobbying The Bidder must sign and include in the Business Response the Certification Regarding Lobbying (see Part Five, Exhibit VII). Exhibit C Standard Form - LLL, Disclosure Form to Report Lobbying is posted on Comm-PASS as a separate PDF file. VIII. Certification: Compliance with OMB Circular A-133 The Bidder must sign and include in the Business Response the Certification on Compliance with OMB Circular A-133 (see Part Five, Exhibit VIII). IX. Conflict of Interest As part of its Business Response, the Bidder must complete, sign, and include in the Business Response the Conflict of Interest Form (see Part Five, Exhibit IX). An authorized signatory of the Bidder, any partner(s) and any subcontractor(s) must sign the Conflict of Interest Form. X. Certificate of Insurance The Bidder shall provide insurance in standard amounts to its employees and agents to cover workers compensation, Bidder s public liability and property damage insurance, and any other insurance that may be necessary for the performance of the work under the Contract. As part of its Business Response, the Bidder must provide the University with certificates of the above insurance coverage.see Exhibit X in Part Five of this RFR. XI. Financial Disclosures As part of its Business Response, the Bidder must demonstrate that its organization and any material subcontractors are in sound financial condition, and/or that appropriate corrective measures are being taken to address and resolve any identified financial problems. Documentation provided to the University pursuant to this requirement should be labeled as Exhibit XI (A) Financial Statements, and (B) Other Disclosures, respectively, and shall include, but not be limited to all the items listed in Part Five, Exhibit XI. XII. Diverse Vendors It is the policy of UMMS that small business concerns shall have the maximum practicable opportunity to participate in the performance of contracts awarded by 55

56 UMMS. It is the goal of UMMS to provide all businesses with the maximum number of feasible opportunities to participate in procurements.ummsiscommitted to developing and sustaining relationships with a diverse group of suppliers, essential for fostering healthy competition, which in turn enables the UMMS purchasing agents to obtain the very best goods and services for UMMS. UMMS developed a campus-wide initiative called the Diverse Vendor Purchase Program to increase diverse supplier inclusion. This program is intended to include Small Disadvantaged Business; Minority-Owned Small Business, Women-Owned Small Business; HUBZone Small Business; and Veteran-Owned Small Business and Service-Disabled Veteran-Owned Small Business. If the Bidder is certified as a Diverse Vendor according to one of the categories listed in the paragraph immediately above, the Bidder should include a copy of the certificate with its Business Response. XIII. HIX/IES Special Terms and Conditions The Bidder must sign and include in the Business Response the HIX/IES Special Terms and Conditions (Attachment A, Amendment No. 1 to the Contract), see Part Six, Exhibit XIII.An authorized signatory of the Bidder must sign the HIX/IES Special Terms and Conditions. 3. Program Response Bidders shall provide a narrative response to each of the sections below. The narrative response shall demonstrate the Bidder s understanding of the needs of the University relative to the tasks described herein, describe how the Bidder will meet the requirements specified in Part One Specifications, and provide a statement of the Bidder s approach to meet those needs. Bidders should review the HIX/IES SI RFR, issued by UMMS on or around December 21, 2011, as amended on or around January 19, 2012, before preparing Responses to this RFR in addition to the more recent update described in Part Eight of this RFR. The HIX/IES SI RFR and other related documents are available on the Commonwealth Procurement Access & Solicitation System ( Comm-PASS ). To locate the HIX/IES SI RFR on Comm-PASS, search for document number CW12-JD When similar information is requested under multiple headings below, Bidders may either provide the information once and cross-reference it in other areas, or repeat the information under each heading. I. Bidder s History and Experience (see page limits in the sub-sections below) 56

57 The Bidder shall provide a brief history of its organization, including an organizational overview, a description of the business units into which the Bidder is organized, and a listing of the products and services offered by the Bidder. The Bidder shall also provide the following information on its experience: A. A description of the Bidder s experience that: (limit to 5 pagesfor the prime Bidder, and 5 pages for each subcontractor) 1. Demonstrates the Bidder meets the minimum requirements defined in Part One, Section 5 Minimum Qualifications. 2. Demonstrates any requirements defined in Part One, Section 6 Preferred Qualifications. 3. Demonstrates the Bidder s knowledge of: a) Health care reform (ACA, CMS, CCIIO) as specifically applicable to Exchanges or similar experience. b) State and Federal privacy and security laws and regulations. 4. Includes the Bidder s experience providing IV&V services on projects similar to the activities described in this RFR. B. Projects where the Bidder has provided services that demonstrate the following: (limit to 1 page per project) 1. Proven IV&V services experience of five years or more for enterprise IT applications; 2. IV&V services experience in consumer facing, large scale, e-commerce applications that are web based. Demonstrated ability to perform IV&V services on one central application integrated with several applications, information hubs and external partners. For each client listed, the Bidder must state the following: a) Contract or project name b) Name of the client s organization c) Name, title, address, and telephone number of a person at the organization who can respond to inquiries about the Bidder s involvement with the project d) Specific activities the Bidder performed under the Contract e) Dates of performance C. A list of the government entities with which the Bidder has contracted within the past five years to perform services similar to those requested in this RFR, 57

58 and the specific activities the Bidder performed under any such contracts. For each government contract, the Bidder must state the following: (limit response to 1 page per project) 1. Contract name 2. Name of the procuring government agency 3. Name, title, address, and telephone number of a person at the government entity who can respond to inquiries about the Bidder s involvement with the project 4. Specific activities the Bidder performed under the Contract 5. Dates of performance D. A statement about whether any government entity has, in the past five years, cancelled any contract with the Bidder and, if so, an explanation providing relevant details. (limit response to 1 page) II. Executive Summary (limit to 10 pages) In this subsection, the Bidder shall provide a description of the services it will provide in response to this RFR. The project description must include the following: A. The Bidder s understanding of the HIX/IES Entities vision and the HIX/IES Project s goals, objectives, and timeline; in particular, the Bidder s understanding of what it means to independently verify and validate the work performed toward the realization of the HIX/IES Project goals. B. The Bidder s understanding of the HIX/IES Project constraints and how independent verification and validation activities can mitigate them. C. The proposed Bidder teaming structure and the roles and responsibilities of each teaming partner and significant subcontractor (if applicable). D. A description of any responsibilities that will be performed off-site or offshore and an affirmative statement that these resources will not negatively impact the project in any way. E. The methodology by which the prime Bidder plans to monitor and evaluate the performance of partners and subcontractors, if applicable, and Bidder personnel. F. An overview of the Bidder s approach to the IV&V Services and the completion of activities and deliverables. G. The Bidder s proposed IV&V Services Project Management Plan, including a schedule. The plan should include all milestones and key tasks that the Bidder feels is necessary to complete the IV&V activities and deliverables. 58

59 H. A brief summary of why the Bidder offers the best IV&V solution for the HIX/IES Entities. III. Bidder s Organization (see page limits in the sub-sections below) A. Organization Chart(limit response to 10 pages) The Bidder must present its proposed organization chart. The proposed organization chart should include the management structure for project oversight and the names of all Key Personnel who will be involved in the IV&V Services. A detailed job description for each name and function shown on the organization chart must be included. The University has determined that the following IV&V Contractor personnel qualify as Key Personnel : 1. Project Manager 2. Contract Manager 3. Quality Assurance Manager 4. UAT Manager 5. Lead UAT Analyst 6. Senior Systems Analyst 7. Financial Analyst The organization chart shall include any parts of the IV&V Services for which the Bidder intends to use a teaming partner or a significant subcontractor. A separate organization chart showing the relationship of the IV&V Services to the Bidder s corporate organization must also be included. The Bidder must present a staff loading chart by month which clearly depicts the level of staffing provided directly the Bidder as well as individual subcontractors. B. Project Personnel and Résumés(limit to 5 pages per individualrésumé) The Bidder shall describe, for each individual identified as Key Personnel in the organization charts described above, the individual s roles and responsibilities in the IV&V Services. This description must: 1. Include a brief narrative describing the relevant experience of each named Key Personnel and how his or her particular experience relates to the proposed role on the IV&V Services. 2. Present any joint project experience that the Key Personnel may have had with other proposed staff members. Include each 59

60 individual s experience with projects of scope and size similar to that described in this RFR. When preparing organization charts and staffing plans, Bidders should account for all activities that must be performed to meet the scope of services described in Part One Specifications. The Bidder is required to provide a résumé for each individual identified as Key Personnel for the IV&V Services in the organization charts described above. Clearly label these individuals and their résumés as being part of the proposed team. The individual identified for the position of Project Manager may not be named for any other Key Personnel position. The Bidder s Response must delineate the functions for which each person named has responsibility and authority. C. Key Personnel References (limit response to 1 page for each named key personnel) The Bidder shall provide threeclient references, including a contact name, title, address, and telephone number, for each individual proposed as a part of the IV&V Services team and deemed Key Personnel. Each reference shall provide a description of the role the proposed staff member performed in that project, the relationship of the proposed staff member to the referenced individual, and a brief description of the overall project. IV. Detailed Narrative Response(limit response to 75 pages) The Bidder shall include in its Program Response a written narrative providing how it plans to meet the requirements of this RFR. Specifically, the Bidder must: A. Component 1: Execution Approach and Plan The Execution Approach should clearly describe how the Bidder plans to support and facilitate the goals and milestones of the HIX/IES Project and meet the requirements of the IV&V Services. While it should demonstrate the Bidder s knowledge of the HIX/IES Project and independently verifying and validating an information technology system, it should not include specific Bidder qualifications or experiences. The Bidder is encouraged to be both creative and descriptive so HIX/IES Entities have a clear understanding of how the Bidder will deliver productive and successful IV&V services. To this end, Bidders may propose alternatives, refinements, and additional tasks to the requirements outlined in Part One, Section 11 Scope of Work. 60

61 The Bidder must not omit any activities presented in this RFR. Additionally, Bidders may propose additional activities and deliverables in their response to the RFR. Any such proposed additional activity(ies) or deliverable(s) will be subject to review and approval, modification or disapproval at the time of Contract execution. The Execution Plan must be developed in such a way that it clearly shows how the IV&V Contractor will support and facilitate achievement of the stages and milestones of the HIX/IES Project and meet the requirements of the IV&V Services. The Execution Plan must also reflect how the activities described in Part One, Section 11 Scope of Work will be executed. The Bidder must include with its response the complete project plan created using Microsoft Project. The project plan must commence with the Contract start date in Part Two, Section 14 RFR Timetable, and end with the date in Part One, Section 3 Contract Term. The plan must show task duration and dependencies, list task numbers and descriptions, and include responsible parties. For purposes of creating this plan, Bidders should assume the project completion date in Part One, Section 3 Contract Termis correct. The plan should include a high level project schedule for the length of the IV&V Services as well as a detailed rolling six-month schedule that includes all activities, tasks, deliverables, staff resources, durations, and anticipated start and end dates for near term project tasks and activities. B. Component 2: IV&V Framework and Methodology The Bidder must describe its IV&V framework and methodology and how they will be used to successfully complete the IV&V Services. C. Component 3: IV&V Services Approach and Plan The Bidder shall describe the following aspects of each task:(limit to 5 pages per task) 1. Approach to performing the task and the work within it 2. Work Breakdown Structure for each task V. Assumptions, Qualifiers, and Constraints Exhibit A Assumptions, Qualifiers, and Constraints Table requires the Bidder to clearly disclose all of the assumptions (e.g., expected level of the HIX/IES Entities effort, roles, resources; scope issues), qualifiers (e.g., services or deliverables identified as basic ), or constraints (e.g., maximum number of reports, deliverables, iterations provided) that the Bidder used to develop its Response to this RFR. For all instances of assumptions, qualifiers or constraints in 61

62 the Response, the Bidder must document in Exhibit A the corresponding RFR reference numbers, exact location(s) in the Response(e.g., page, section), descriptions of the assumptions used, and the significance or impact to the HIX/IES Entities of the assumptions. The HIX/IES Entitiesare not required to accept, reject or otherwise respond to individual assumptions, qualifiers or constraints. The HIX/IES Entities will not be bound by the assertion of any Bidder purporting to bind the HIX/IES Entitiesto any such assumption, qualifier or constraint. An authorized signatory of the Bidder must sign Exhibit A Assumptions, Qualifiers, and Constraints Table. VI. Security Compliance (limit response to 10 pages) A. Bidder shall provide an explanation of its compliance with the Security and Privacy Requirements stated in the Scope of Work of the HIX/IES SI RFR(see for example, HIX/IES SI RFR Section 11: Scope of Work, subsection III: General Requirements, D, and HIX/IES SI RFR Part Four Laws, Rules and Guidelines, including: NIST rev. 3, NIST , the ISO/IEC family of information security management standards, HIPAA, MGL c. 93H, and MGL c. 93I.) B. Bidder shall provide a statement detailing all CORI checks, national criminal security background checks and government clearances, held by all staff that will be directly involved with the Contract and/or evidence of any such background checks or clearances. Bidder shall also include a representation and warranty that all current and future staff and subcontractors who will be involved with the Contract shall at a minimum, have a valid CORI check and national criminal background check. C. To the extent applicable, please describe the following elements of Bidder s security plan: 1. Information Security Management System 2. Risk Assessment Process 3. Risk treatment and mitigation process 4. Organization of Information Security 5. Human Resource Security 6. Physical and Environmental Security 7. Communications and Operations Management 8. Information Access Controls 9. Information Security Acquisition Development and Maintenance Lifecycle 10. Business Continuity Management 62

63 D. If your proposed solution will involve Cloud Computing, does Bidder s facility provide full SAS 70 Level II certified access, control, management and reporting? If so, please provide a copy of the certification. E. Bidders shall describe (1) their own and their proposed subcontractors respective internal security procedures and policies applicable to work performed by them for customers and (2) the particulars of any circumstances over the past five (5) years in which the bidder or its proposed subcontractor(s) has caused a breach of the security, confidentiality or integrity of a customer s data. VII. References (limit to 1 page per reference) The Bidder shall provide three references, preferably for services similar to those being procured by this RFR, including: (1) the name and address of the reference, (2) name of contact person, telephone number, and address, and (3) a description of the services the Bidder provided for each referenced client, preferably for services similar to those being procured by this RFR. The University reserves the right to contact by telephone or to arrange a site visit to any or all of the Bidder s references. The University may contact the Bidder s references without prior notice to the Bidder. If the Bidder plans to use a subcontractor in the significant performance of activities for any Contract resulting from this RFR, please provide references for the subcontractor as well. VIII. Subcontractors If the Bidder intends to use any subcontractor(s) to perform a role in the scope of services, the Bidder must include in its Response documents the following information regarding the subcontractors(s): A. the Business Response must include for any significant subcontractor(s) all the information required by the Bidder in Part Two, Section 2 Business Response, except that the HIX/IES Special Terms and Conditions need not be signed by the subcontractor; B. the Program Response must clearly delineate the role of any significant subcontractor(s); and C. the Cost Response must include for any significant subcontractor(s) the information required by the Bidder in Part Two, Section 4 Cost Response. 63

64 4. Cost Response The Bidder must submit a Cost Response, which shall consist of a set of Cost Tables. Cost Response instructions are contained in Part Three of the RFR. The Cost Tables for presenting the proposed costs are provided in the associated Microsoft Excel file entitled Exhibit B Cost Response. 5. Pre-Bidders Conference A pre-bidder's conference will be held on the date and time set forth in Part Two,Section 14 RFR Timetable. Prospective Bidders are encouraged to participate; however, participation is not mandatory. In order to participate in the pre-bidders conference, prospective Bidders must register by the date and time set forth in Part Two, Section 14 RFR Timetable, by contacting Jeff DiCiaccio, Senior Director of Purchasing, at the University of Massachusetts Medical School, Purchasing Department, 333 South Street, Suite , Shrewsbury, MA 01545; by to [email protected]; or by fax to (508) (telephone (508) ). At that time, the prospective Bidder will be given the location of the conference and an optional telephone conference number. No other individuals at the University, EOHHS, or CCA should be contacted regarding this procurement. Because of potential problems with connectivity, Bidders are asked not to use cellular phones if calling into the conference number. Bidders are asked not to arrive or call more than ten minutes after the scheduled start time. 6. Questions Bidders may make written inquiries concerning this RFR until the questions due date set forth in Part Two, Section 14 RFR Timetable. Bidders will be given two opportunities to submit written inquiries to the University the first set of questions are due prior to the Pre-Bidder s Conference, and the second set of questions are due after the Pre-Bidder s Conference (see Part Two, Section14 RFR Timetable). Written inquiries must be sent to Jeff DiCiaccio, Senior Director of Purchasing, at the, Purchasing Department, 333 South Street, Suite , Shrewsbury, MA 01545; by to [email protected]; or by fax to (508) (telephone (508) ). No other individuals at the University, EOHHS, or CCA should be contacted regarding this procurement. The University will review inquiries received before the deadline and, at its discretion, prepare written answers to questions which the University determines to be of general interest.any written answers will be made available to all 64

65 identified prospective Bidders. The written answers will be posted on the Comm- PASS website ( Only written answers are binding on the University. 7. Communications Prospective Bidders are prohibited from obtaining information about this RFR from any University, EOHHS, CCA or other Massachusetts state personnel, except the University representative named in Part Two, Section 6 Questions of this RFR, or the representative s designee. The University reserves the right to disqualify any Bidder that violates this section. Communications that occur outside of any formal processes that are detailed within this RFR should not be taken into consideration when preparing the Response. 8. Amendments to the RFR The University reserves the right to amend, alter, or cancel the RFR at any time prior to the deadline for submission of Responses. If such action is necessary, notice will be provided in the same manner in which the RFR was released. Bidders are solely responsible for checking Comm-PASS for any addenda or modifications that are subsequently made to this RFR. The University accepts no liability and will provide no accommodation to interested parties and Bidders who fail to check for amended RFRs. 9. Evaluation of Responses An evaluation committee comprised of representatives from EOHHS, CCA and the University will be established to review all Responses and to identify the Bidder that will provide the best value to the HIX/IES Entities.A Bidder will be selected to execute the Contract. I. Evaluation Criteria The Contract resulting from this RFR will be awarded to the Bidder that is most advantageous to the HIX/IES Project considering Business, Program, and Cost Responses. The evaluation committee shall qualitatively rate each Bidder s Program Response by evaluating it for comprehensiveness; feasibility; appropriateness; clarity; effectiveness; innovation; responsiveness to the needs of the University, EOHHS,and CCA; and responsiveness to the goals of the HIX/IES Entities and the HIX/IES Project.The University shall select the Bidder whose Response, in the aggregate, provides the best business, technical, and financial value. 65

66 All Responses will be reviewed to determine compliance with the submission requirements in Part Two, Section 1 Response Instructions. The evaluation committee will evaluate the Business Response and Program Response of all Responses that comply with the Response Instructions. The evaluation committee will evaluate the Cost Responses of all Responses that satisfy the Program Response requirements in Part Two, Section3 Program Response. In making the determination to select an IV&V Contractor, the evaluation committee will consider in order of importance the following criteria: A. Program Response 1. Detailed Narrative Response 2. Bidder s History and Experience 3. Security Compliance 4. References 5. Subcontractors 6. Assumptions, Qualifiers, and Constraints Table 7. Executive Summary 8. Bidder s Organization B. Business Response 1. HIX/IES Special Terms and Conditions 2. Transmittal Letter 3. Bidder s Contact Information 4. Conflict of Interest Form 5. Financial Disclosures 6. Diverse Vendors 7. Certificate of Good Standing 8. Certification of Non-Collusion 9. Executive Order 504 Contractor Certification Form 10. Certification Regarding Debarment and Suspension 11. Certification Regarding Lobbying 12. Certification: Compliance with OMB Circular A Certificate of Insurance C. Cost Response 66

67 The evaluation committee will (i) evaluate Responses in accordance with the criteria described above; (ii) give a composite rating of Excellent, Very Good, Good, Fair, Poor or Non-Responsive for each category of the Program Response; (iii)assign an overall rating to each Response; and (iv) compare the Responses to one another. For all qualified Bidders, the costs in Exhibit B Cost Response will be ranked from the lowest cost (most advantageous) to the highest cost (least advantageous) based on the total price proposed. When evaluating each Bidder s Cost Response, the evaluation committee will consider reasonableness and competitiveness. Cost will be one factor, but not the sole factor, in the committee s evaluation of the Responses.The University is not required to choose the Bidder that proposes the lowest costs. The University reserves the right to consider such other relevant factors as it deems appropriate in order to obtain services and terms of the best overall value to the University, EOHHS, and CCA. II. Clarification of Responses The evaluation committee may determine that some element of a Bidder s Response requires clarification to verify its responsiveness to the RFR or to facilitate a fair comparison with competing Responses. In such cases, the committee may seek clarification from the Bidder. Clarification may include an invitation to a Bidder to come to the University for a personal interview or presentation. In addition, the University may schedule an onsite visit to the Bidder s business locations. The evaluation committee, in its sole discretion, will determine which Bidders, if any, will be asked to make an oral presentation. Oral presentations may be held to allow the Bidder to clarify details or further inform the committee regarding the Bidder s organization or Response, but not to change or correct the original Responses in any way. Individuals identified as Key Personnel in the Bidder s Response may be required to attend the oral presentations.oral presentations shall not be open to the public nor to any competitors. Part Two, Section 14 RFR Timetable provides the date(s) on which an oral presentation may be held. Failure of a Bidder to agree to a date and time for an oral presentation may result in rejection of the Bidder s Response. III. Rejection of Responses The right is reserved to reject any and all Responses, to omit an item or items, or to accept any Response deemed best for the University. The University makes no 67

68 guarantee that a Contract, or any other obligation to purchase any commodities or services, will result from this RFR. The University reserves the right to waive technicalities, irregularities, and omissions if, in the opinion of the University, they are insubstantial and to do so will serve the best interest of the University. The University may determine that a Response does not comply with the submission instructions and, as such, is nonresponsive to the RFR. In that case, the University reserves the right to reject that Response. 11. Selected Bidder The University will send written notice to the Bidder selected as a result of this RFR. If the selected Bidder fails to sign the Contract offered for the Bidder s acceptance within a reasonable period of time, the University may determine that the Bidder has abandoned the Contract and shall be free to select another entity with which to execute the Contract. This RFR is not an offer to enter into an agreement with any party. It is a request to receive responses from Bidders interested in providing the services specified herein. Nothing in this RFR, or in the University s acceptance of any proposal in whole or in part, shall obligate the University to execute a contract with the Bidder. 12. Debriefing Any Bidder may request a debriefing within 10 business days following the University s announcement that it has selected a Contractor, to discuss the evaluation committee's evaluation of its Response. Requests for debriefing shall be made in writing to the individual identified in Part Two, Section 6 Questions of this RFR. Debriefing shall not include discussions of any competing Responses. 13. Authorizations The Contract awarded under this RFR is subject to all necessary federal and state agency approvals, which may include but is not limited to CMS, CCIIO, EOHHS, and CCA. 14. RFR Timetable EVENT DATE/TIME* RFR Release Date: Monday, May 21,

69 EVENT DATE/TIME* 1 st set of Questions Due Date: Friday, May 25, 2012 at 12:00 P.M. (noon) Registration deadlinefor Pre-Bidders Conference: Friday, June 1, 2012 at 12:00 P.M. (noon) Pre-Bidder s Conference: Monday, June 4, :00 1:30 P.M. at UMMS 333 South Street 4 th Floor Amphitheater Shrewsbury, MA nd set of Questions Due Date: Tuesday, June 5, 2012 at 2:00 P.M. Answers to Selected Questions: (anticipated date) Friday, June 15, 2012 Response Due Date: Friday, July 6, 2012 at 2:00 P.M. Bidder Interviews and/or Presentations, at the discretion of the University: (anticipated date) Selection of Bidder for Contract Execution: (anticipated date) Contract Start Date: (anticipated date) Thursday, July 26, 2012 and Friday, July 27, 2012 Monday, August 6, 2012 Tuesday, September 4, 2012 * Note that all times refer to times in the Eastern time zone of the United States. For information regarding the term of the Contract resulting from this RFR, see Part One, Section 3 Contract Term. 15. Bidders Checklist 69

70 This checklist is provided as a tool to assist Bidders with the submission of Responses and does not need to be returned with the Response documents: Signed Transmittal Letter Bidder s Contact Information Certificate of Good Standing Signed Certification of Non-Collusion Signed Executive Order 504 Contractor Certification Form Signed Certification Regarding Debarment and Suspension Signed Certification Regarding Lobbying Signed Certification: Compliance with OMB Circular A-133 Signed Conflict of Interest Form Certificate of Insurance Signed Financial Disclosures If applicable, a copy of certificate showing status as a Diverse Vendor per Subsection XII of Part Two, Section 2 Business Response Signed HIX/IES Special Terms and Conditions (Attachment A, Amendment No. 1 to the Contract), see Exhibit XIII in Part Six 7 copies and one original of Business Response and all of its components 7 copies and one original of Program Response and all of its components 7 copies and one original of Cost Response and all of its components 2 copies of all Response documents (as a PDF file)on separate IBMcompatible CDs or USB flash drives 70

71 PART THREE COST RESPONSE The Bidder must submit a Cost Response in accordance with the instructions presented in this section. The Cost Tables for presenting the proposed costs are provided in the associated Microsoft Excel file entitled Exhibit B Cost Response. The attached Cost Tables are required to be completed as they are presented. The Cost Response must include the following Cost Tables from Exhibit B Cost Response. Cost Table 1a Cost Summary by IV&V Monthly Review and Assessment Report Cost Table 1b - Cost Summary by Task Cost Table 2a - Manage the IV&V Services Task Cost Table 2b - Review all HIX/IES Project Deliverables Task Cost Table 2c - Validate Automated Code Review Results Task Cost Table 2d - Validate Continuous Integration Test Results Task Cost Table 2e - Coordinate and Conduct User Acceptance Testing Task Cost Table 2f - Verify Implementation Readiness Task Cost Table 2g - Verify Component Reusability Task Cost Table 2h - Perform a System AuditTask Cost Table 2i - Perform Financial Reviews Task Cost Table 2j - Conclude the IV&V ServicesTask Cost Table 3a - Cost Summary by Key Personnel Cost Table 4a - Additional Personnel Rates 71

72 Cost Table Instructions (1) Cost Table 1a Cost Table 1a serves as the summary table for Cost Tables 2a through 2j. The total of Cost Table 1a should also equal the total of Cost Table 1b. The total cost of each IV&V Monthly Review and Assessment Report should be listed in Cost Table 1a. (2) Cost Table 1b Cost Table 1a serves as the summary table for Cost Tables 2a through 2j. The total cost of each task detailed in Cost Tables 2a through 2j should be represented in Cost Table 1a Cost Summaryby Task. (3) Cost Tables 2a through 2j For Cost Table 2athrough Cost Table 2j, Bidders are required to present allcosts associated with each task by discrete cost categories. In completing Cost Table 2athrough Cost Table 2j, please observe the following rules: Use as many lines as necessary to list each significant subcontractor by name. These subcontractors must be described in the Bidder s Response in accordance with Part Two, Section 3 subsection VIII: Subcontractors; Use as many lines as necessary to list and describe all other significant direct costs that contribute to the total task cost; and No more than 5% of the total task cost may be considered miscellaneous and shown on the Other Costs line. Bidders must attach a listing of the individual items that comprise this line item. (4) Cost Table 3a Cost Summary by Key Personnel For staffing costs attributed to Key Personnel reflected in Cost Tables 2a through 2j, Bidders are required to specify details on the specific staff that comprise the Key Personnel. In Cost Table 3a, for costs attributed to Key Personnel, the Bidder must: List the name of the Key Personnel and specify if the person is an employee of the Bidder or a subcontractor. Identify the hourly rate for each Key Personnel listed. The hourly rate should be inclusive of all costs, including but not limited to travel costs. Identify the percentage of time each person is allocated to a specific task. o Example: If the 3 rd task (Validate automated code review results, as listed in Cost Table 2c) lasts three months and a person will spend half of his/her time on the task in that period of time, then the allocation should be listed 72

73 as 50%. If a person will spend a variable degree of time on a milestone over the life of the task, the average should be presented. o Note that an individual person s total percentage allocation can exceed 100% since the person can work on multiple activities, and activities can occur at different times over the course of the IV&V Services. Identify the cost of each person for each milestone. (5) Cost Table 4a Additional Personnel Rates Bidders must submit Cost Table 4a identifying the titles and hourly rates of additional personnel that might be required to perform Change Order tasks. In the column labeled Rate/Hour, please indicate the fully loaded rate for the first year of work performed. In the column labeled Lead Time to Obtain, please indicate the estimated number of days it will take to obtain personnel of each type. For each Job Title (e.g., Business Analyst, Security Architect, Tester), provide a jobdescription comparable in scope and detail to the Sample Job Descriptionbelow. Additional Personnel Rates Sample Job Description Business Analyst: 2 3 years of business analysis experience and proven abilities in the following areas: Understanding all phases of the project lifecycle; requirements gathering and documenting, definition, design, development, testing, and deployment Facilitate interview and group sessions to validate business/data requirements Mapping the requirements to the source systems Business systems planning for integrated analytic needs Writing system and UAT test scripts and conduct data testing and Q/A Ability to assess the quality of requirements documentation, identify areas for improvement, and translate such to written forms of communication Experience with UI and Web development Experience with development and executing training programs with the user community Ability to interface effectively with all levels and across organizational lines, including the business units Experience with Medicaid systems, commercial insurance systems, and eligibility-based systems a plus 73

74 PART FOUR LAWS, RULES, AND GUIDELINES This Part Four of the RFR contains reference documents for mandatory requirements, including Federal and State requirements, and HIX and IES initiative regulations and Artifacts providing details behind the Scope of Work. The selected Bidder must accept the terms of this RFR and the Contract, including, but not limited to those in this Part Four and in Part Six. The Contractor must comply with all requirements in the Part Four reference documents. I. Federal and State rules and regulations for the HIX effort include, but are not limited to, the following: A. The Patient Protection and Affordable Care Act, Public Law , the Health Care and Education Reconciliation Act, Public Law and 45 CFR Parts 74 and Public Law MAR. 23, 2010 The Patient Protection and Affordable Care Act 2. Public Law Health Care and Education Reconciliation Act of CFR Part 74 (UNIFORM ADMINISTRATIVE REQUIREMENTS FOR AWARDS AND SUBAWARDS TO INSTITUTIONS OF HIGHER EDUCATION, HOSPITALS, OTHER NONPROFIT ORGANIZATIONS, AND COMMERCIAL ORGANIZATIONS) or 45 CFR Part 92 (UNIFORM ADMINISTRATIVE REQUIREMENTS FOR GRANTS AND COOPERATIVE AGREEMENTS TO STATE, LOCAL, AND TRIBAL GOVERNMENTS) as applicable CFR parts 155, 156 and 157 (PATIENT PROTECTION AND AFFORDABLE CARE ACT; ESSTABLISHMENT OF EXCHANGES AND QUALIFIED HEALTH PLANS; EXCHANGE STANDARDS FOR EMPLOYEES; Final/Interim Rule. (to the extent Final) B. Proposed rules: 74

75 1. 45 CFR parts 155, 156 and 157 (PATIENT PROTECTION AND AFFORDABLE CARE ACT; ESSTABLISHMENT OF EXCHANGES AND QUALIFIED HEALTH PLANS; EXCHANGE STANDARDS FOR EMPLOYEES; Final/Interim Rule(to the extent Interim) 2. Medicaid Program; Eligibility Changes Under the Affordable Care Act of 2010 August 17, Patient Protection and Affordable Care Act; Exchange Functions in the Individual Market: Eligibility Determinations; Exchange Standards for Employers August 17, C. Massachusetts Chapter 58 of the Acts of An Act Providing Access to Affordable, Quality, Accountable Health Care 1. Chapter 58 of the Acts of "An Act Providing Access to Affordable, Quality, Accountable Health Care NOTE: The Massachusetts Legislature has since passed 3 amendments to make technical corrections to the Health Reform Law: a) Chapter 324 of the Acts of "An Act Relative to Health Care Access" b) c) Chapter 450 of the Acts of "An Act Further Regulating Health Care Access" d) Chapter 205 of the Acts of "An Act Further Regulating Health Care Access" D. Massachusetts laws, standards and policy regarding electronic signatures and records 1. Massachusetts Uniform Electronic Transaction Act, Mass. Gen. Laws ch. 100G 2. Massachusetts Supervisor of Public Records standards regarding the use of electronic signatures, contracts and other records including, without limitation, Supervisor of Public Records Bulletin (SPR) SPR 1-96 (Backing Up and 75

76 Archiving of Electronic Public Records); SPR 3-96 (Application of Public Records Law to Electronic Records Access); and SPR 4-96 (Fees for Access and Copying of Electronic Public Record); (Electronic Mail); SPR 1-92 (Facsimile transmissions) rmubul/bulidx.htm 3. Massachusetts Records Conservation Board standards regarding the use of electronic signatures, contracts and other records, including, without limitation, Massachusetts Statewide Records Retention Schedule, Massachusetts Information Technology Division standards regarding the use of electronic signatures, contracts and other records 5. Electronic Records Management Guidelines, jointly issued by the Massachusetts Supervisor of Records, the Massachusetts Records Conservation Board and the Massachusetts Information Technology Division II. HIX/IES Materials A. Center for Consumer Information & Insurance Oversight Exchange Regulations and Guidance B. CMS standards for connectivity, interfaces, security, and data transmission gulations.asp#topofpage C. CMS Enhanced Funding Requirements: Seven Conditions and Standards: MIT/downloads/Enhanced-Funding-Requirement-Seven-Conditions-and- Standards.pdf D. CMS Technical Reference Architecture ( TRA ), v.2.1 and supplements. Several relevant TRA supplements are listed on the CMS web site, and other supplements are under development. Supplements are available upon request E. CMS Testing Framework document workoverview.pdf 76

77 F. Collaborative Environment and Life Cycle Governance Exchange Reference Architecture ( ERA ) Supplement 0Governance%20ERA%20Supp%20Drft%20v093% pdf III. Massachusetts Information Technology Division Standards, Policy and Guidelines A. The Contractor must comply with and adhere to all Massachusetts Information Technology Division ( ITD ) policies, standards, and guidelines affecting information technology projects including without limitation the following: 1. Massachusetts Information Technology Division ( ITD ) policies, standards, and guidelines 2. ITD s Enterprise Policies and Standards 3. Massachusetts Enterprise Technical Reference Model - Service Oriented Architecture (ETRM v. 5.1) B. The Enterprise Technical Reference Model (ETRM) provides an architectural framework used to identify the standards, specifications and technologies that support the Massachusetts computing environment. 1. Massachusetts Information Technology Architecture and Enterprise Standards 2. Enterprise Information Security Policy 3. Enterprise Information Security Standards: Data Classification 4. Electronic Messaging Policy 77

78 5. Enterprise IT Asset and Risk Management Policy 6. Enterprise IT Security Incident Response Policy 7. Enterprise Physical & Environmental Security Policy 8. Wireless Security Policy & Standards 9. Enterprise Information Technology Accessibility Standards Enterprise Web Accessibility Standards Enterprise Desktop Power Management Standards Public Access Policy & Standards for e-government Applications Public Access Policy & Standards for e-government Applications: Application Security Public Access Policy & Standards for e-government Applications: Network Security 78

79 15. Enterprise Remote Access Policy Enterprise Staff Information Technology Security Policy Enterprise Website Cookie Policy Web Addresses and Hosting Website Archiving and Records Management Enterprise Information Technology Acquisition Policy Website Privacy Policies Enterprise Open Standards Policy EOHHS Accessibility Policy policy_accessibility IV. Federal Information Technology Policy and Guidelines A. US Department of Health and Human Services Office of the Chief Information Officer Policy 79

80 B. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance Guidance.pdf C. Federal Information Security Management Act of 2002 (FISMA) D. Funding Opportunity Announcement ( FOA ) Requirements for State-Operated Health Insurance Exchanges xyb8ygtkhkwfchr8fbjqr9jvjgqs2! ?oppid=65693&mode=vie W E. Guidance for Exchange and Medicaid Information Technology (IT) Systems Version df F. Harmonized Security and Privacy Framework Exchange TRA Supplement privacy security_framework/1173 G. CMS TRA Catalog of Minimum Security Controls for States Supplement %20Minimum%20Security%20Controls%20for%20States%20Supp%20Draft%2 0v%200%202% pdf H. Internal Revenue Manual ( IRM ); Part 10; Security, Privacy and Assurance I. Internal Revenue Service (IRS) Affordable Care Act Tax Provisions* J. MITA ge K. NIST Special Publication , Revision 1 L. Publication 1075: Tax Information Security Guidelines for Federal, State and Local Agencies. OMB No V. Early Innovator Cooperative Agreement (NESCIES) 80

81 A. Announcement: Cooperative Agreements to Support Innovative Exchange Information Technology Systems B. Massachusetts Application for the Cooperative Agreement to Support Innovative Exchange Information Technology Systems - New England States Collaborative Insurance Exchange Systems (NESCIES)* df VI. Enhanced Funding Requirements and Medicaid Eligibility Systems Requirements A. Enhanced Funding Requirements: Expedited Advance Planning Document Checklist MIT/downloads/Medicaid-Expedited-EE-APD-Checklist.pdf B. 42 CFR 433, Medicaid Program: Federal Funding for Medicaid Eligibility Determination and Enrollment Activities; Final Rule C. 45 CFR 95, Subpart F Automatic Data Processing Equipment and Services Conditions for Federal Financial Participation ode=45: &idno=45#45: D. State Medicaid Manual, Part 11 Medicaid Management Information Systems VII. Establishment Grants A. Establishment Grant Regulations, Guidance, and Funding Opportunity VIII. Enroll UX 2014 A. Enroll UX 2014 Project* IX. Other federal and state laws and regulations governing privacy and security of personal or confidential information 81

82 A. Health Insurance Portability and Accountability Act of 1996 ( HIPAA ) and the Health Information Technology for Economic and Clinical Health Act of 2009 ( HITECH ) rcementifr.html B. Massachusetts laws and regulations concerning the privacy and security of personal or confidential information, including without limitation: MGL c. 66A, the Massachusetts Fair Information Practices Act, MGL c. 93H, Massachusetts Data Breach Notification Law, MGL c. 93I, Disposal of Records Containing Personal Information, CMR 17.00, Standards for the Protection of Personal Information of Residents of the Commonwealth of Massachusetts, Executive Order 504, Order Regarding the Security and Confidentiality of Personal Information C. Such other terms and conditions as may be required by the Massachusetts Department of Revenue, Social Security Administration, Internal Revenue Department and other Massachusetts and Federal agencies. * Provided for informational purposes 82

83 PART FIVE EXHIBITS FOR SUBMISSION I. Exhibit Transmittal Letter Title of RFR: RFR Number: Bidder s Name: Bidder s Address: Date: Jeff DiCiaccio Senior Director of Purchasing Purchasing Department 333 South Street, Suite Shrewsbury, MA The Bidder hereby represents and warrants that: 1. The RFR and specifications have been read and understood by the Bidder; 2. The Bidder possesses the Minimum Qualifications set forth in Part One Specifications,Section 5 of this RFR; 3. The Bidder agrees to be bound by the Contract terms, and additional Contract terms and conditions, contained in Part Six of this RFR; 4. The Bidder agrees to be bound by this RFR (including all attachments and exhibits) and the Bidder s Program Response; 5. The Bidder hereby represents and warrants that the Bidder shall be bound by the terms of the Bidder s Cost Response; 6. The Response is based upon the items described in this RFR and specifications without exceptions; 7. The Response has been arrived at independently and is submitted without collusion; 8. The contents of the Response have not been disclosed by the Bidder nor, to the best of its knowledge and belief, by any of its employees or agents, to any person not an employee or agent of the Bidder, and will not be disclosed to any such person prior to the due date for the Responses; 9. No attempt has been made or will be made to induce any other person or firm not to submit a bid or Response; 10. The Bidder's Response is effective through the date a Contract is executed; 11. Neither the Bidder nor its principals, subcontractors, or affiliates are presently, nor have they been in the past five years, debarred, suspended, proposed for debarment, 83

84 declared ineligible, or voluntarily excluded from participation in any program or procurement process by any governmental entity or program; 12. The Bidder s legal name, trade name, or any other name under which the Bidder does business (if any) is ; 13. The Bidder s principal address and telephone number is ; 14. If the Bidder is not an individual, identify that the type of legal entity (e.g., corporation (profit or not for profit), limited partnership, general partnership, trust) is ; and 15. The Bidder s signature is sufficient to bind the Bidder. The undersigned has the authority to bind the Bidder to the terms of this RFR. Signature Date Print Name, Title Bidder s Organizational Name 84

85 II. Exhibit Bidder s Contact Information The Bidder must provide contact information for at least two (2) people at the Bidder s organization who the University can contact for clarification, notification of selection, etc. The contact information must include the following, at minimum: Name: Title: Job Description: Anticipated involvement in Contract: Telephone number: Mailing address: Address: Contact # 1 Contact # 2 Name: Title: Job Description: Anticipated involvement in Contract: Telephone number: Mailing address: Address: 85

86 III. Exhibit Certificate of Good Standing: Instructions The Bidder must demonstrate compliance with Massachusetts tax laws, including M.G.L. c. 62C, s. 49A. The Bidder must submit an original or photocopy of a Certificate of Good Standing which has been issued by the Massachusetts Department of Revenue ( DOR ) within the past year. Bidders can request a Certificate of Good Standing online or through the mail: 1) Online Below is a direct link* to the MA DOR website where Bidders may request a Certificate of Good Standing online: 2) Mail Bidders may download a paper application from the link* below, and submit a request to obtain a Certificate of Good Standing by sending it to the address or fax number on the form: If you have questions about how to request a Certificate of Good Standing: Call the Massachusetts Department of Revenue: (617) ; or Go to: Issuance of a Certificate of Good Standing normally takes several days if requested online. Paper applications (by mail) can take 4-6 weeks, so Bidders should apprise the Department of Revenue that the certificate is sought in connection with a Massachusetts solicitation (with a deadline). If the requested certificate is not supplied with the Response, the Bidder must submit documentation verifying the application was filed. The certificate must be provided prior to final execution of the Contract with the University. If the Bidder is formed or incorporated in a jurisdiction other than Massachusetts, the Bidder can provide a Certificate of Good Standing from the applicable jurisdiction or provide an explanation, subject to the sole satisfaction of the University, if a Certificate of Good Standing is not available. * All links included on this page were active as of spring

87 IV. Exhibit Certification of Non-Collusion The undersigned certifies under penalties of perjury that this bid or response has been made and submitted in good faith and without collusion or fraud with any other person. As used in this certification, the word "person" shall mean any natural person, business, partnership, corporation, union, committee, club, or other organization, entity, or group of individuals. Signature Date Print Name, Title Bidder s Organizational Name 87

88 V. Exhibit Executive Order 504 Contractor Certification Form BIDDER LEGAL NAME: Executive Order 504: For all Contracts involving the Contractor s access to personal information, as defined in M.G.L. c. 93H, and personal data, as defined in M.G.L. c. 66A, owned or controlled by Executive Department agencies, including but not limited to the Executive Office of Health and Human Services (EOHHS) or access to other Massachusetts agency systems containing such information or data (herein collectively personal information ), Contractor certifies under the pains and penalties of perjury that the Contractor (1) has read Commonwealth of Massachusetts Executive Order 504 and agrees to protect any and all personal information; and (2) has reviewed all of the Commonwealth of Massachusetts Information Technology Division s Security Policies under Policies and Standards. Notwithstanding any contractual provision to the contrary, in connection with the Contractor s performance under this Contract, for all state agencies in the Executive Department, including all executive offices, boards, commissions, agencies, departments, divisions, councils, bureaus, and offices, now existing and hereafter established, the Contractor shall: (1) obtain a copy, review, and comply with EOHHS s Information Security Program (ISP) and any pertinent security guidelines, standards and policies; (2) comply with all of the Commonwealth of Massachusetts Information Technology Division s Security Policies ( Security Policies ) available at under Policies and Standards; (2) communicate and enforce EOHHS s ISP and such Security Policies against all employees (whether such employees are direct or contracted) and subcontractors; (3) implement and maintain any other reasonable appropriate security procedures and practices necessary to protect personal information to which the Contractor is given access by EOHHS from the unauthorized access, destruction, use, modification, disclosure or loss; (4) be responsible for the full or partial breach of any of these terms by its employees (whether such employees are direct or contracted) or subcontractors during or after the term of this Contract, and any breach of these terms may be regarded as a material breach of this Contract; (5) in the event of any unauthorized access, destruction, use, modification, disclosure or loss of the personal information (collectively referred to as the unauthorized use ): (a) immediately notify 88

89 EOHHS if the Contractor becomes aware of the unauthorized use; (b) provide full cooperation and access to information necessary for EOHHS to determine the scope of the unauthorized use; and (c) provide full cooperation and access to information necessary for EOHHS and the Contractor to fulfill any notification requirements. Breach of these terms may be regarded as a material breach of this Contract, such that the University may exercise any and all contractual rights and remedies, including without limitation indemnification under the HIX/IES Special Terms and Conditions, withholding of payments, contract suspension, or termination. In addition, the Contractor may be subject to applicable statutory or regulatory penalties, including and without limitation, those imposed pursuant to M.G.L. c. 93H and under M.G.L. c. 214, 3B for violations under M.G.L. c. 66A. Bidder Name:. Bidder Authorized Signature:. Print Name and Title of Authorized Signatory:. Date:. 89

90 VI. Exhibit CERTIFICATION REGARDING DEBARMENT AND SUSPENSION Theundersigned (authorized official signing for Bidder) certifies to thebest of his or herknowledgeandbelief, that Bidder anditsprincipals: (a) arenotpresentlydebarred,suspended, proposed fordebarment,declaredineligible,orvoluntarily excluded from contracting with or being a contractor of a government entity (federal, state or local); (b) have not received a notice from any government entity regarding a proposed suspension or investigation of a violation of any federal or state law that could result in debarment from contracting with or being a contractor of any federal or state agency; (c) have notwithin the last3-years been convicted of or had a civil judgmentrenderedagainstthemforcommission offraudoracriminaloffenseinconnectionwith obtaining,attempting toobtain,orperforming a public (Federal, State, or local) transaction or contract underapublictransaction; violation of FederalorStateantitruststatutesorcommission of embezzlement, theft, forgery, bribery, falsification or destruction of records, making falsestatements,orreceivingstolen property; (d) are not presently indicted or otherwise criminallyorcivillycharged byagovernmental entity (federal, state, or local) with com- mission of any of the offenses enumerated in paragraph(b)ofthiscertification;and (e) have notwithin the last 3 yearshad one or morepublic transactions(federal, state, orlocal)terminated forcauseordefault. Bidder: Signed (by authorized signatory): Print name: Title: Date: 90

91 VII. Exhibit CERTIFICATION REGARDING LOBBYING By signing this certification, Bidder s authorized official named below certifies, to the best of his/her knowledge and belief, that: 1) No Federal appropriated funds have been paid or will be paid, by or on behalf of the Bidder, to any person for influencing or attempting to influence an officer or employee of any agency, a Member of Congress, an officer or employee of Congress, or an employee of a Member of Congress in connection with the awarding of any Federal contract, the making of any Federal grant, the making of any Federal loan, the entering into of any cooperative agreement, and the extension, continuation, renewal, amendment, or modification of any Federal contract, grant, loan, or cooperative agreement. 2) If any funds other than Federal appropriated funds have been paid or will be paid to any person for influencing or intending to influence an officer or employee of any agency, a Member of Congress, an officer or employee of Congress, or an employee of a Member of Congress in connection with this Federal contract, grant, loan, or cooperative agreement, the Collaborator shall complete and submit Standard Form - LLL, "Disclosure Form to Report Lobbying," to the University. 3) As applicable, the Bidder shall require that the language of this certification be included in the documents for all subcontracts and that all subcontractors shall certify and disclose accordingly. This certification is a material representation of fact upon which reliance was placed when Bidder submitted a response to the s Request for Response for Massachusetts Health Insurance Exchange and Integrated Eligibility System (MA HIX/IES), Independent RFR # CW12-JD Submission of this certification is a prerequisite for making or entering into any contract resulting from this RFR imposed by section 1352, title 31, U. S. Code. Any person who fails to file the required certification shall be subject to a civil penalty of not less than $10,000 and not more than $100,000 for each such failure. Signature Name, Title Date Bidder s Organizational Name 91

92 VIII. Exhibit CERTIFICATION: Compliance with OMB Circular A- 133 Certain services performed pursuant to any contract resulting from this University of Massachusetts Medical School s Request for Response Massachusetts Health Insurance Exchange and Integrated Eligibility System (MA HIX/IES), Independent Verification and Validation (IV&V) Services RFR # CW12-JD are subject to federal funding requirements, including compliance with OMB Circular A-133. The Federal Office of Management and Budget Circular, A-133 Audits of States, Local Governments, and Non-Profit Organizations requires that recipients of Federal awards, who are subject to the provisions of OMB Circular A-133, ensure that subcontractors comply with audit requirements of OMB Circular A-133. In order for the University of Massachusetts, Worcester campus (University) to satisfy its own A-133 requirements, we request certification from your organization that you are in compliance with A-133 requirements. Therefore, please check the appropriate lines and provide any required documents. 1) The most recent A-133 audit has been completed for Fiscal Year. a) Neither the Schedule of Findings and Questioned Costs nor the Schedule of Prior Audit Findings reported within our A-133 audit report disclose any material weaknesses, any material instances of noncompliance, or any findings related to any subcontract from the University of Massachusetts, Worcester. b) The Schedule of Findings and Questioned Costs and/or the Schedule of Prior Audit Findings reported within our A-133 audit report disclose audit findings related to Federal awards provided by the University of Massachusetts, Worcester.Enclosed is a copy of the audit reporting package required by Section.320(e) of OMB Circular A- 133 that includes the following four (4) items: Financial statements and schedule of expenditure of Federal awards, Summary of scheduled prior audit findings, Auditors reports, and Corrective action plan 2) We are not subject to the requirements of A-133 because we are (check both sections below and remit or provide a website for a copy of the most recent audited financial statement or annual report): a) A for-profit organization. (Also check applicable box in section below.) b) A non-u.s. based entity. (Also check applicable box in section below.) c) We expend less than $500,000 a year in Federal funds. (Also check applicable box in section below.) d) Other (explain) AND: OR: We are in compliance with applicable Federal, State, or Local laws and regulations, and the laws and regulations that are particular to any subcontract from the University of Massachusetts, Worcester. We further certify that there were no audit findings and/or questioned costs discovered during our most recent audit. The most recent audit revealed findings and/or questioned costs that relate to any subcontract from the University of Massachusetts, Worcester. We have enclosed a copy of, or provided a valid website to, the audited financial statement that details these findings, and agree to notify the University of Massachusetts, Worcester of the corrective action taken within (6) six months of furnishing the audited report. 92

93 Website of an annual report or audited financial statements: Bidder assures University that it complies with A-133 and that it will notify University of completion of required audits and of any adverse findings, which impact any contract resulting from this Request for Response. Upon completion of any on-going A-133 audits, the Bidder will notify University of the results, and provide a copy of any noted exceptions. Please sign and complete the section below. I certify that the statements above accurately represent the organization of which I am representative. Further, I certify that all relevant material findings in the audit report have been disclosed. Bidder : Entity Identification Number (for A-133 Audit): By: Name: Title: Date: Telephone Number: Address: 93

94 IX. Exhibit Conflict of Interest Form As part of its Business Response, the Bidder must complete, sign, and include in the Business Response this Conflict of Interest Form (Exhibit IX). An authorized signatory of the Bidder, any partner(s) and any subcontractors must sign the Conflict of Interest Form. Bidders are informed and aware that the HIX/IES Entities are conducting a separate, independent procurement for a HIX/IES SI Contractor. The selected IV&V Contractor pursuant to this RFR must not have any relationship or interest, financial, business, beneficial or otherwise, with the HIX/IES SI Contractor. The IV&V Contractor, its subsidiaries and parent companies, and all subcontractors are prohibited from participation in the contract resulting from the HIX/IES SI RFR in any capacity, including but not limited to, as HIX/IES SI Contractor, teaming partner, or subcontractor significant or otherwise. The undersigned certifies under penalties of perjury that: [check all applicable fields] (1) the Bidder or, if applicable, the partner or subcontractor, acknowledges that, in governmental contracting, even the appearance of a conflict of interest is harmful to the interests of the Commonwealth; and, therefore, the Bidder (or if applicable, the partner or subcontractor), agrees to take measures to ensure that its officers, employees, agents, consultants and/or sub-contractors comply with applicable ethical standards and requirements of the Massachusetts Conflict of Interest law, Massachusetts General Law Chapter 268 A. (2) the Bidder or, if applicable, the partner or subcontractor, acknowledges that no officer, employee, agent, consultant and/or sub-contractor of the Bidder (or, if applicable, the partner or subcontractor), participated in developing or drafting any grant or funding applications, contract or other specifications, requirements, scope of work, related to or in connection with this RFR. (3) the Bidderor if applicable, the partner or subcontractor, is disclosing any potential or actual conflict of interest, including but not limited to, any relationship or interest, financial, business, beneficial or otherwise, which is in conflict with the proper discharge of their responsibilities described under the RFR and Contract. If there is no conflict(s) of interest, so indicate. In cases where such relationship (s) and/or interests exist or appear to exist, the Bidder (or, if applicable, the partner or subcontractor), shall describe how a potential or actual conflict of interest will be avoided. The Bidder, any partner(s) or subcontractor(s), should use the box below to provide additional information, as necessary, to address items # 3 above. If any one or more of the 94

95 foregoing fields is NOT checked, please explain the reason in the space below. Attach additional pages if necessary. Signature Date Print Name, Title Bidder s Organizational Name 95

96 X. Exhibit Certificate of Insurance The Contractor shall provide insurance in standard amounts to its employees and agents to cover workers compensation, contractor's public liability and property damage insurance, and any other insurance that may be necessary for the performance of the work under the Contract. The following standard insurance amounts are required at a minimum: (a) Workers Compensation Insurance providing statutory benefits for persons employed in connection with this Contract in accordance with applicable law, including the laws of the Commonwealth of Massachusetts as well as the laws of the state where the Contractor maintains its principal place of business. In addition, Employers Liability Coverage with a limit of at least one million dollars ($1,000,000.00) per accident and per disease. (b) Automobile liability insurance covering owned, non-owned, and hired vehicles, with combined limits for bodily injury and property damage of at least $1 million per accident. The policy must be endorsed to include the University as an additional insured; (c) Commercial General Liability Insurance, including blanket contractual liability, for all damages and claims arising out of or related to injury to persons or damages to property which may arise out of or relate to the performance of the Contractor s services provided under this Contract. The insurance coverage must be acceptable to the University and name the University as an additional insured, with coverage limits of at least $1,000,000 per occurrence, $3,000,000 aggregate. If coverage is a claims-made basis, the Contractor shall maintain at least three years of reporting endorsement following the expiration of the term of the Contract. Contractor shall provide University with a certificate or other verification of coverage prior to the execution of this Contract. Contractor shall provide University with thirty (30) days prior written notice of cancellation, material change, or non-renewal of the coverage during the term of this Contract. (d) Professional liability insurance with limits of at least $1 million per occurrence and $3 million per aggregate. The policy must be endorsed to include the University as an additional insured. As part of its Business Response, the Bidder must provide the University with certificates of the above insurance coverage. Any certificates provided pursuant to this requirement should be labeled as Exhibit X Certificate of Insurance. 96

97 XI. Exhibit Financial Disclosures A. Financial Statements As part of its Business Response, the Bidder must demonstrate that its organization and any significant subcontractors are in sound financial condition, and/or that appropriate corrective measures are being taken to address and resolve any identified financial problems. Documentation provided to the University pursuant to this requirement should be labeled as Exhibit XI (A) Financial Statements and shall include, but not be limited to: (1) pro forma statement(s) for the current fiscal year; (2) financial management plan that includes a financial forecast, financial projection, and financial feasibility study that satisfy AICPA standards; (3) evidence, consisting of proof of a bank credit line or other non-contractual sources, of ability to sufficiently fund at least four months of program operations; (4) proof of an acceptable credit rating or nationwide business credit rating from a bureau such as Dun & Bradstreet; and (5) audited financial statements of the Bidder s financial condition for the Bidder s two most recent fiscal years from an audit prepared by a Certified Public Accountant ( CPA ). Disclaimer of opinion, an adverse opinion, a special report opinion, a review opinion, or a compilation report opinion by a Certified Public Accountant ( CPA ) will be grounds for rejection unless an unqualified opinion is rendered by a CPA prior to award of the Contract. If any of the above items are not available, the Bidder shall submit a statement indicating the reason the item is not included in the submission. The Bidder shall submit the best available information it has in lieu of the specified submission. The University reserves the right to request additional information. The Bidder must disclose any and all significant judgments, pending or expected litigation, or other real potential financial reversals relative to the Bidder s organization s revenue, which might materially affect the viability or stability of the Bidder s organization; or certify that no such condition is known to exist. The University may choose not to contract with a Bidder if the University, EOHHS or CCA determine that the Bidder is not in sound financial condition. 97

98 B. Other Disclosures The undersigned certifies under penalties of perjury that: [check all applicable fields] (1) The Bidder is not the subject of any current litigation or findings of noncompliance under federal or state law. (2) The Bidder has not been the subject of any past litigation or findings of noncompliance under federal or state law. (3) The Bidder s organization is not currently, nor has been, under investigation for violation of any federal or state law. If any one or more of the foregoing fields is NOT checked, please explain the reason in the space below. Attach additional pages if necessary. Signature Date Print Name, Title Bidder s Organizational Name 98

99 PART SIX COPIES OF STANDARD CONTRACT DOCUMENTS ON COMM-PASS This Part Six contains copies of the Contract documents resulting from this Request for Response. The selected Bidder will be required to agree to all Contract terms set forth in Part Six. NOTE: RFR Exhibit XIII HIX/IES Special Terms and Conditions (Attachment A, Amendment No. 1 to the Contract) must be signed and returned to the University with the Bidder s Response. This RFR has been distributed electronically using the Commonwealth of Massachusetts Procurement Access and Solicitation System (Comm-PASS), available at The following exhibits that are referenced in this Part Six of the RFR are found as separate files along with the RFR on Comm-PASS: XII. Exhibit Contract XIII. Exhibit HIX/IES Special Terms and Conditions (Bidders must sign and return with Response) XIV. Exhibit Data Management Agreement XV. Exhibit Federal Funding Reporting Requirements XVI. Exhibit Intellectual Property and Work Effort Agreement for Contractor s Employees, Consultants, and Agents 99

100 PART SEVEN ADDITIONAL EXHIBITS ON COMM- PASS The IV&V RFR is available at the Commonwealth of Massachusetts Procurement Access and Solicitation System (Comm-PASS), available at The following exhibits that are referenced in this RFR are found as separate files along with the RFR on Comm-PASS: Exhibit A Assumptions, Qualifiers and Constraints Table (Bidders must complete and return with Response) Exhibit B Cost Response (Bidders must complete and return with Response) Exhibit C Standard Form - LLL, Disclosure Form to Report Lobbying (Bidders must complete and return with Response, if applicable) 100

101 PART EIGHT UPDATED HIX/IES PROJECT INFORMATION Note that the Table numbering set forth below corresponds to the HIX/IES SI RFR. 1. SCOPE OF WORK: PROJECT TIMELINE The HIX/IES Project is comprised of four stages. The stages, including their description, timeframe, Milestones, and the Work Orders conducted in each of the stages, are outlined in Table 2 below: Table 2: Project Timetable # Stage and Description Timeframe Milestones Work Order(s) 1 Requirements, Design and Development Completing the Work Orders within the scope of the four releases. June 2012 July Project Startup 2. Business Analysis and High- Level Design 3. Design Establishment Review 4. Code Drop #1 5. Code Drop #2 6. Code Drop #3 Work Orders 1-10 and Implementation Completing the work described in the Implementation Work Order (#17) in order to meet the implementation Milestones. 3 Stabilization Conducting the work described in the Stabilization Work Order (#18) 4 Operations & Maintenance Conducting the work described in the Operations and Maintenance Work Order (#11). August 2013 September 2013 October 2013 June 2014 October 2013 September Code Drop #4 1. Soft Launch 2. Implementation Establishment Review 3. Open Enrollment Launch Work Order Stabilization Work Order Operations and Maintenance Establishment Review 2. Operations and Maintenance 3. Turnover Work Order 11 Four of the Milestones within the first stage, called the Requirements, Design and Development stage, are Code Drops. Each Code Drop has a defined scope and will follow its own system development lifecycle. For each Code Drop, system components 101

102 will be designed, developed, tested, and released if they pass all types of testing up through and including User Acceptance Testing. Components which meet this quality threshold and released will become available for re-use by other states. The requirements of each Code Drop include, but are not limited to, the items listed under Required Scope in Table 3 below. The Code Drops have timeframes, which represent the range of time for which components can be released. By way of example, Code Drop #1 requires the completion of two shared services used by HIX/IES. The address validation & standardization service may be released before the code drop deadline of 9/1/2012, and the HIPAA X12 translator service must be released by that date. Additionally, some components for the HIX/IES Project will also be included in multiple Code Drops. For example, the development of the AIMS shared service and the HIX/IES application framework will be done iteratively and released across Code Drops 1, 2, and 3. Table 3: Code Drop Schedule within the Requirements, Design, and Development Stage Code Drop Timeframe Required Scope (at minimum) Code Drop #1 7/1/ /1/2012 Address Validation & Standardization Shared Service, HIPAA X12 Translator Shared Service, AIMS Shared Service, HIX/IES Application Framework Code Drop #2 10/1/ /1/2012 AIMS Shared Service, HIX/IES Application Framework, Private Insurance, SHOP, Plan Management Code Drop #3 12/1/2012-4/1/2013 AIMS Shared Service, HIX/IES Application Framework, Subsidized Insurance, Medicaid Eligibility, Renewals, Navigator/Broker Portals, Financial Management Code Drop #4 4/1/2013-7/1/2013 Premium Billing, Notices, Business Intelligence / Data Warehouse, Other Interfaces, and Customer Service I. Milestones and Deliverables Each of the four project stages encompasses a series of project tasks, deliverables and Milestones. The HIX/IES SI Contractor is responsible for producing the deliverables and completing the Milestones listed in this section, and any additional deliverables that may be identified in order to accomplish the goals of each Milestone. A. The Requirements, Design, and Development stage includes the following Milestones: 1. Milestone 1 Project Startup: This Milestone marks the completion of those activities needed to kick off the HIX/IES Project, including the development and acceptance of an updated Project Management Plan. 102

103 2. Milestone 2 Business Analysis and High-Level Design: This Milestone marks the completion of Work Order 1, to conduct business analysis and high-level design of the HIX/IES. 3. Milestone 3 Design Establishment Review: The Design Establishment Review is one of the Establishment Reviews conducted by CMS. The review includes preliminary, on-site, and post-review activities, as well as all actions required to correct any deficiencies detected during the review, with documentation of their correction. 4. Milestone 4 - Code Drop #1: This Milestone marks the successful release of Code Drop #1. That is, the scope of Code Drop #1 has been designed, developed, and successfully tested up through and including User Acceptance Testing. 5. Milestone 5 Code Drop #2: This Milestone marks the successful release of Code Drop #2. That is, the scope of Code Drop #2 has been designed, developed, and successfully tested up through and including User Acceptance Testing. 6. Milestone 6 Code Drop #3: This Milestone marks the successful release of Code Drop #3. That is, the scope of Code Drop #3 has been designed, developed, and successfully tested up through and including User Acceptance Testing. 7. Milestone 7 Code Drop #4: This Milestone marks the successful release of Code Drop #4. That is, the scope of Code Drop #4 has been designed, developed, and successfully tested up through and including User Acceptance Testing. B. The Implementation stage includes the following Milestones: 1. Milestone 8 Soft Launch: This Milestone marks the successful implementation of the Soft Launch in August The goal of this Milestone is to satisfy all prerequisites for going live with the HIX/IES Soft Launch in production. The HIX/IES SI Contractor implements the HIX/IES and moves system components to the production environment. 2. Milestone 9 Implementation Establishment Review: The Implementation Establishment Review is one of the Establishment Reviews conducted by CMS. The review includes preliminary, onsite, and post-review activities, as well as all actions required to correct any deficiencies detected during the review, with documentation of their correction. 3. Milestone 10 Open Enrollment Launch: This Milestone marks the successful implementation of the Open Enrollment Launch in October The goal of this Milestone is to satisfy all prerequisites for going live with the HIX/IES Open Enrollment Launch in production. The HIX/IES SI Contractor implements the HIX/IES and moves system components to the production environment. 103

104 C. The Stabilization stage includes the following Milestone: 1. Milestone 11 Stabilization: This Milestone marks the end of the Stabilization period. The HIX/IES SI Contractor and the HIX/IES Entities work to ensure that the implemented system runs without errors or problems (excluding cosmetic errors) for nine months after the go-live date. D. The Operations and Maintenance stage includes the following Milestones: 1. Milestone 12 Operations and Maintenance Establishment Review: The Operations and Maintenance Establishment Review is one of the Establishment Reviews conducted by CMS. The review includes preliminary, on-site, and post-review activities, as well as all actions required to correct any deficiencies detected during the review, with documentation of their correction. 2. Milestone 13 Operations and Maintenance: This Milestone marks the completion of the activities to operate and maintain the HIX/IES after its implementation. 3. Milestone 14 Turnover: The process whereby responsibility for the HIX/IES passes from the HIX/IES SI Contractor to the HIX/IES Entities (or any third party chosen by the HIX/IES Entities, which may include hosting by HIX/IES SI Contractor as third party for purposes of this Milestone). Table 4 lists the deliverables by Milestone. Some of these deliverables are required of the Establishment Review process and are noted by Yes in the Establishment Review Artifact column; others are Massachusetts specific, as noted by No in the Establishment Review Artifact column; all the deliverables listed in Table 4 are required to be met by the HIX/IES SI Contractor. The Version column in Table 4 distinguishes which version of the document (preliminary, baseline, updated, or final) is required of the deliverable for that Milestone. Table 4.0 Deliverables by Milestone Milestone Milestone 1 - Project Startup Deliverable Table 4 - Milestones and Deliverables Date: 5/17/2012 Establishment Review Artifact Version Communication Matrix Yes U Communication Plan Yes U Project Management Plan Yes U Project Schedule Yes P Risk Analysis (Risk Management Plan) Yes U 104

105 Milestone Milestone 2 - Business Analysis and High-Level Design Milestone 3 - Design Establishment Review Deliverable Table 4 - Milestones and Deliverables Date: 5/17/2012 Establishment Review Artifact Version Risk Register (component of Risk Management Plan) Yes U Quality Management Plan and Reporting (Supplement to PMP) Staff Management Plan (Supplement to PMP) Business Process Models Yes U Business Rules Yes P Communication Matrix Yes U Communication Plan Yes U Portal Site Maps No P Project Management Plan Yes U Project Schedule Yes U Requirements Document Yes U Risk Analysis (Risk Management Plan) Yes U Risk Register (component of Risk Management Plan) Yes U Quality Management Plan and Reporting (Supplement to PMP) Staff Management Plan (Supplement to PMP) System Design Document Yes U Use Cases Yes P User Stories Yes P Wireframes No P Business Process Models Yes U Business Rules Yes U Change Management Plan (Supplement to PMP) Communication Matrix Yes U Communication Plan Yes U Configuration Management Plan (Supplement to PMP) Contingency/Recovery Plan Yes P Data Conversion Plan Yes U Data Management Plan Yes F Data Use/Data Exchange/ Interconnection Security Agreement Yes P Database Design Document Yes U Implementation Plan Yes B Information Security Risk Assessment Yes B Yes Yes Yes Yes Yes Yes P p U U F F 105

106 Milestone Milestone 4 - Code Drop #1 Deliverable Table 4 - Milestones and Deliverables Date: 5/17/2012 Establishment Review Artifact 106 Version Interface Control Document Yes F Logical Data Model Yes F MITA State Self Assessment / MITA Roadmap Yes P O&M Manual Yes P Performance Management Plan (Supplement to PMP) Performance Measures Yes U Physical Data Model Yes P Privacy Impact Assessment Yes B Project Management Plan Yes U Project Schedule Yes U Release Plan Yes F Requirements Document Yes U Risk Analysis (Risk Management Plan) Yes U Risk Register (component of Risk Management Plan) Yes U Quality Management Plan and Reporting (Supplement to PMP) SLAs/MOUs Yes P Staff Management Plan (Supplement to PMP) System Design Document Yes U System of Record Notice Yes P System Security Plan Yes B Test Plan Yes B Training Materials Yes P Training Plan (Supplement to PMP) User Manuals Yes P Use Cases Yes U User Stories Yes U Automated Code Review Results Yes P Best Practices and Guidelines for Business Process Management (BPM) No P Best Practices and Guidelines for Business Rules (BR) No P Best Practices and Guidelines for User Interface (UI) Design No P Best Practices and Guidelines for Master Data Management (MDM) No P Best Practices and Guidelines for Web Services (WS) No P Business Process Models Yes U Business Rules Yes U Yes Yes Yes Yes F U U P

107 Milestone Milestone 5 - Code Drop #2 Milestone 6 - Code Drop #3 Deliverable Table 4 - Milestones and Deliverables Date: 5/17/2012 Establishment Review Artifact Version Database Design Document Yes U EOHHS Web Service Asset Description Document No P Physical Data Model Yes U Project Schedule Yes U Requirements Document Yes U System Design Document Yes U Technical Detailed Design Document No P Test Plan Yes U Test Reports Yes P User Interface Style Guide No P Use Cases Yes U User Stories Yes U Wireframes No U Automated Code Review Results Yes U Best Practices and Guidelines for Business Process Management (BPM) No U Best Practices and Guidelines for Business Rules (BR) No U Best Practices and Guidelines for User Interface (UI) Design No U Best Practices and Guidelines for Master Data Management (MDM) No U Best Practices and Guidelines for Web Services (WS) No U Business Process Models Yes U Business Rules Yes U Database Design Document Yes U EOHHS Web Service Asset Description Document No U Physical Data Model Yes U Project Schedule Yes U Requirements Document Yes U System Design Document Yes U Technical Detailed Design Document No U Test Plan Yes U Test Reports Yes U Use Cases Yes U User Stories Yes U Wireframes No U Automated Code Review Results Yes U Best Practices and Guidelines for Business Process Management (BPM) No U Best Practices and Guidelines for Business Rules (BR) No U 107

108 Milestone Milestone 7 - Code Drop #4 Deliverable Table 4 - Milestones and Deliverables Date: 5/17/2012 Establishment Review Artifact Version Best Practices and Guidelines for User Interface (UI) Design No U Best Practices and Guidelines for Master Data Management (MDM) No U Best Practices and Guidelines for Web Services (WS) No U Business Process Models Yes U Business Rules Yes U Database Design Document Yes U EOHHS Web Service Asset Description Document No U Physical Data Model Yes U Project Schedule Yes U Requirements Document Yes U System Design Document Yes U Technical Detailed Design Document No U Test Plan Yes U Test Reports Yes U Use Cases Yes U User Stories Yes U Wireframes No U Automated Code Review Results Yes U Best Practices and Guidelines for Business Process Management (BPM) No F Best Practices and Guidelines for Business Rules (BR) No F Best Practices and Guidelines for User Interface (UI) Design No F Best Practices and Guidelines for Master Data Management (MDM) No F Best Practices and Guidelines for Web Services (WS) No F Business Process Models Yes F Business Rules Yes F Communication Matrix Yes U Communication Plan Yes U Data Conversion Plan Yes U Database Design Document Yes F EOHHS Web Service Asset Description Document No F Physical Data Model Yes F Portal Site Maps No F Project Schedule Yes U Requirements Document Yes F Risk Analysis (Risk Management Plan) Yes U Risk Register (component of Risk Management Plan) Yes U 108

109 Milestone Milestone 8 - Soft Launch Milestone 9 - Implementation Establishment Review Deliverable Staff Management Plan (Supplement to PMP) Table 4 - Milestones and Deliverables Date: 5/17/2012 Establishment Review Artifact Yes Version System Design Document Yes U Technical Detailed Design Document No U Test Plan Yes U Test Reports Yes U Training Materials Yes U Training Plan (Supplement to PMP) User Interface Style Guide No F Use Cases Yes F User Stories Yes F Wireframes No F Project Schedule Yes U Proof Implementation is Successful - Soft Launch No F Technical Detailed Design Document No F Training Progress and Completion Report No P Training Registration and Attendance Report No P Authority to Operate Yes F Automated Code Review Results Yes F CCIIO Certification Process Document No F CCIIO Certified HIX/IES No F Communication Matrix Yes U Communication Plan Yes U Contingency/Recovery Plan Yes F Data Use/Data Exchange/ Interconnection Security Agreement Yes F Implementation Plan Yes F Information Security Risk Assessment Yes F MITA State Self Assessment / MITA Roadmap Yes F O&M Manual Yes U Performance Measures Yes F POA&M Yes F Privacy Impact Assessment Yes F Project Management Plan Yes F Project Schedule Yes U Quality Management Plan and Reporting (Supplement to PMP) Yes Yes U U F 109

110 Milestone Milestone 10 - Open Enrollment Launch Milestone 11 - Stabilization Milestone 12 - O&M Establishment Review Deliverable Table 4 - Milestones and Deliverables Date: 5/17/2012 Establishment Review Artifact Version Risk Analysis (Risk Management Plan) Yes U Risk Register (component of Risk Management Plan) Yes U SLAs/MOUs Yes F Stabilization Manual No P Staff Management Plan (Supplement to PMP) System Design Document Yes F System of Record Notice Yes F System Security Plan Yes F Test Plan Yes F Test Reports Yes F Training Materials Yes F Training Plan (Supplement to PMP) User Manuals Yes F Data Conversion Plan Yes F Knowledge Transfer Plan No P Project Schedule Yes U Proof Implementation is Successful - Open Enrollment No F Training Progress and Completion Report No U Training Registration and Attendance Report No U Knowledge Transfer Plan No U Project Schedule Yes U Proof Stabilization is Successful No F Stabilization Manual No F Training Progress and Completion Report No F Training Registration and Attendance Report No F Turnover Document No P Annual Operations Readiness Report Yes U Communication Matrix Yes U Communication Plan Yes U O&M Manual Yes F Project Schedule Yes F Risk Analysis (Risk Management Plan) Yes F Risk Register (component of Risk Management Plan) Yes F Staff Management Plan (Supplement to PMP) Yes Yes Yes U F F 110

111 Milestone Milestone 13 - Operations and Maintenance Milestone 14 - Turnover Deliverable Table 4 - Milestones and Deliverables Date: 5/17/2012 Establishment Review Artifact Ongoing project status reports and other elements as defined in the Project Management Plan. Version Knowledge Transfer Plan No F Project Completion Report No F Turnover Document No F Legend for Table 4 (under column titled Version ): P = Preliminary version of the deliverable B = Baseline version of the deliverable U = Updated version of the deliverable F = Final version of the deliverable Note Regarding deliverables for the Establishment Review Milestones: The version requirements for deliverables for Milestones 7, 8, and 12 are based on the guidance provided by CMS/CCIIO. While the timing of all Establishment Reviews is not confirmed, the following estimated timeframes are known: Design Establishment Review to be held September 2012 Implementation Establishment Review to be held days before the Open Enrollment launch. Operations and Maintenance Establishment Review timeframe to be determined 2. SCOPE OF WORK: WORK ORDER OVERVIEW Work Order 1 involves gathering business requirements for the HIX/IES Project and developing a high-level design. Work Orders 2-8 and involve implementing the business requirements gathered in Work Order 1 as well as the technical requirements of the system. In these Work Orders, components will undergo detailed design and be developed, tested, and released according to the Code Drop Schedule if they pass all types of testing up through and including User Acceptance Testing. 111

112 Work Orders 9, 10, 11, 12, 17, and 18 represent a variety of other activities critical to the HIX/IES Project outside of the design, development, testing, and implementation of system components. Work Order 9 is included in the scope of work, and the HIX/IES SI Contractor will provide hosting services for all technical environments. This is otherwise known as Hosting Option C. Since Work Order 1 will determine the approach and direction for subsequent Work Orders, the HIX/IES Entities may decide to reduce the scope of subsequent Work Orders or eliminate one or more Work Orders altogether. Table 5: Work Order Summary Work Order # System Title Description 1 HIX, IES HIX Business Analysis & High-Level Design Perform business analysis and elicit, refine, and complete the business and system requirements for the HIX/IES Project. Also finalize the system architecture and the detailed system design. 2 HIX, IES HIX portals Design, develop, and test the HIX user interface/portal and associated functionalities. 3 HIX Business Components Design, develop, and test the business components (middleware, Rules Engine, Master Data Management ( MDM ), Interfaces, database etc.) needed to operate the Exchange in defined environments. 4 HIX Premium Billing Implement the premium billing solution recommended by the HIX/IES SI Contractor for the HIX/IES Project. Depending on the recommendation, this Work Order may involve designing, developing, customizing, and/or configuring the proposed solution. 5 HIX Data Conversion Perform data conversion activities required to migrate existing data from disparate Health Connector sources to the HIX domain. 6 HIX, IES 7 HIX, IES 8 HIX, IES Batch Interface, Reports, Business Intelligence & Data Warehouse Shared Services Customer Service Interfaces Design, develop, and test batch interfaces between HIX and Federal, Massachusetts Medicaid, and other Massachusetts systems. To also design, develop, and test reports, business intelligence, and data warehouse components and artifacts. Design, develop, and test shared services for identity management, address validation and standardization, and HIPAA Translator. Design, develop, and test data exchanges between HIX/IES and one or more customer service organizations and systems. 9 HIX, Hosting (optional) Provide a hosting solution, including 112

113 Work Order # System Title Description IES 10 HIX, IES 11 HIX, IES Communication, Training & User Support Operations and Maintenance 12 HIX Interstate (NESCIES) support 13 IES Medicaid Eligibility (MA21) Changes to support the Exchange 14 IES Modification to Eligibility (MA21) Workflow Applications accommodations for network and communication, security/access control, backup recovery, failover, disaster recovery, and more. Hosting solution shall support reusability of common infrastructure, information and solutions. Develop a creative and effective communication plan, including a training plan. Develop communication and training materials, including on-line help, and deliver training. Provide operations and maintenance support for all software components including but not limited to portals, batch processes, rules engine, premium billing solution, and rating engine. Operations and maintenance of shared services defined in Work Order 7 are outside of the scope of Work Order 11. Work with the HIX/IES Entities and designated New England states to develop a reusability plan. Share HIX/IES artifacts and other reusable components with other states. Assist in the creation and roll-out of shared/reusable components. Provide thought leadership and documentation on reusability lessons learned, how it can be improved and expanded, and more. Move some of the MA21 rules to IES. Enhance and/or modify the legacy MA21 system to integrate with the Exchange, the Federal Data Services Hub verification components, and the envisioned eligibility rules engine. Modify EDM and MWS to support existing manual process (scanning and storing paper documents for eligibility and enrollment) in addition to future automated process to store e- documents received from HIX/IES. 15 IES Medicaid Eligibility (MA21) Notices Design, develop and deploy a reusable notice solution. Work Order 16 intentionally deleted 17 HIX, IES Implementation 18 HIX, IES Stabilization Complete the tasks required to successfully implement the HIX/IES over two launches, including but not limited to system configuration, execution of test scripts, performance testing, and CMS Exchange Lifecycle Reviews. Address system defects in those areas within the scope of HIX/IES. Actively test and monitor the new system and its interfaces, outputs and 113

114 Work Order # System Title Description environment to address all issues pro-actively. 3. SCOPE OF WORK: GENERAL REQUIREMENTS The HIX/IES SI Contractor shall follow the Establishment Review processes. The HIX/IES SI Contractor will create and update artifacts and deliverables for all such formal reviews and less formal consultations which will be conducted throughout the HIX/IES Project. Artifacts and deliverables associated with the three formal reviews expected to be conducted are listed in Table 8 below. In addition to these documents, the HIX/IES SI Contractor shall provide support for the reviews, including without limitation, planning for the reviews and supporting the review and post-review process. The HIX/IES SI Contractor shall also provide support for the Exchange Certification process, including without limitation, the completion of any applications and the preparation of operational assessments. The HIX/IES Entities estimate that the Exchange Certification process will begin in late Summer 2012 and continue through early Winter 2012, to ensure that the Massachusetts Exchange is certified by the federal deadline of January 1, Table 8 below includes the Establishment Review and Exchange Certification requirements that the HIX/IES SI Contractor must complete. Table 8: CMS Review Requirements CMS Review Requirements Design Establishment Review Exchange Certification Implementation Establishment Review Operations and Maintenance Establishment Review Project Stage Requirements, Design and Development Requirements, Design, and Development (estimated) Implementation Operations and Maintenance 4. HIX/IES ENTITY GOVERANCE STRUCTURES 114

115 The HIX/IES governance teams consist of: the Senior Management Team ( SMT ), HIX/IES Entities Steering Committee ( Steering Committee ), and the Executive Team. 4a 4b 4c Senior Management Team ( SMT ). The HIX/IES SI Contractor s Project Manager and the UMMS HIX/IES Project Manager report to the SMT. The SMT meets periodically, but no fewer than two (2) times per month. The SMT is cochaired by EOHHS and CCA SMT Representatives. Agendas are prepared and circulated in advance of each meeting, and minutes are prepared and circulated within thirty (30) calendar days thereafter. The SMT periodically reports to the Steering Committee on progress and budget status to date, staffing recommendations, vendor selection recommendations, deliverable review and vendor payment recommendations, critical path issues, any material issues or disputes not resolved by the SMT, and proposed solutions to such issues and agreed upon resolution of previously reported issues. The SMT escalates any material issues or disputes that remain unresolved to the Steering Committee. HIX/IES Entities Steering Committee ( Steering Committee ). The HIX/IES SI Contractor shall also report to the Steering Committee. The Steering Committee will periodically review progress and budget status to date, assign staff members and oversee those staff members, resolve any major issues or disputes not resolved by the SMT (e.g., delays, scope changes, disputes or issues between HIX/IES Entities), serve as liaison with state and federal agencies, and interact with the public and advocacy groups about the HIX/IES Project. The Steering Committee meets periodically, no less than once per month. Upon request of the Steering Committee, IV&V Contractor shall attend the monthly Steering Committee meeting. The Steering Committee shall be co-chaired by EOHHS and CCA. Agendas are prepared and circulated in advance of each meeting, and minutes are prepared and circulated within thirty (30) calendar days thereafter. Executive Team. The Executive Team interfaces with and monitors the IV&V Contractor. IV&V Contractor s Project Manager shall report to the Executive Team. As requested by the University, the Contractor shall attend meetings, including without limitation, SMT, Steering Committee, and Executive Team meetings, shall prepare agendas and minutes, provide supporting documentation, prepare and present presentations and cooperate and participate in issue and/or dispute resolution. 115