1
University of Massachusetts
Medical School
Request for Response (RFR)
for
Massachusetts Health Insurance Exchange and
Integrated Eligibility System (MA HIX/IES)
Independent Verification and Validation (IV&V) Services
RFR Number
CW12-JD-0038-0001
2
Table of Contents
PART ONE – SPECIFICATIONS... 4
1. Introduction... 4 2. Organization of the RFR... 5 3. Contract Term... 6 4. University Background... 6 5. Minimum Qualifications... 7 6. Preferred Qualifications... 7
7. Definitions and Acronyms... 8
8. Statistics/Data Offered for Illustration Purposes Only... 15
9. Program Overview... 15
10. Technology Background... 16
11. Scope of Work... 24
12. Compensation... 45
13. New Initiatives and Program Modifications... 47
14. Sustainability... 47
PART TWO – RESPONSE SUBMISSION REQUIREMENTS... 49
1. Response Instructions... 49 2. Business Response... 54 3. Program Response... 57 4. Cost Response... 64 5. Pre-Bidders’ Conference... 64 6. Questions... 65 7. Communications... 65 8. Amendments to the RFR... 65 9. Evaluation of Responses... 66 11. Selected Bidder... 68 12. Debriefing... 69 13. Authorizations... 69 14. RFR Timetable... 69 15. Bidders’ Checklist... 70
PART THREE – COST RESPONSE... 71
PART FOUR – LAWS, RULES, AND GUIDELINES... 74
3
PART SIX – COPIES OF STANDARD CONTRACT DOCUMENTS ON COMM-PASS ... 99
PART SEVEN – ADDITIONAL EXHIBITS ON COMM-PASS... 100
PART EIGHT – UPDATED HIX/IES PROJECT INFORMATION... 101
1. SCOPE OF WORK: PROJECT TIMELINE... 101
2. SCOPE OF WORK: WORK ORDER OVERVIEW... 111
3. SCOPE OF WORK: GENERAL REQUIREMENTS... 114
4
P
ART
O
NE
–
S
PECIFICATIONS
1.
Introduction
The University of Massachusetts Medical School (“UMMS” or the “University” or the “University of Massachusetts, Worcester Campus”) is issuing this Request for Response (“RFR”) to solicit proposals from qualified Bidders to provide
Independent Verification and Validation (“IV&V”) services for the new, state-of-the-art Health Insurance Exchange (“HIX” or “Exchange”) and Integrated
Eligibility System (“IES”) for Massachusetts health care programs that will be designed, developed and implemented with the assistance of a systems integrator. The University is selecting the systems integrator under RFR # CW12-JD-0022-0001 as modified by Amendment No. 1 thereto dated January 19, 2012. Hereinafter, RFR # CW12-JD-0022-0001, as amended, will be referred to as the “HIX/IES SI RFR”, the vendor selected as the systems integrator will be referred to as the “HIX/IES SI Contractor”, and the overall project will be referred to as the “HIX/IES Project”.
The Massachusetts Executive Office of Health and Human Services (“EOHHS”) and the Massachusetts Commonwealth Health Insurance Connector Authority (“Health Connector” or “CCA”) are collaborating with UMMS on the HIX/IES Project. EOHHS, CCA, and UMMS are collectively referred to herein as the “HIX/IES Entities”.
The University seeks an IV&V Contractor with extensive and demonstrated
experience in verifying and validating the design, development, and implementation of large scale, enterprise technology projects. The IV&V Contractor will be
required to provide all tasks, activities and IV&V Project Deliverables set forth in this RFR (collectively the “IV&V Services”).
The Contract resulting from this RFR shall be a firm, fixed price Contract for all IV&V Services specified herein.
Massachusetts currently has a Health Insurance Exchange system, a Medicaid and Children's Health Insurance Program (“CHIP”) eligibility system, and a Medicaid and CHIP enrollment system. The systems are separate, are loosely integrated, and do not meet all requirements under the Patient Protection and Affordable Care Act (“ACA”). As part of the HIX/IES Project, the systems will undergo evaluation to determine which existing technology components can be changed or enhanced, what technology components must be built, and which components must be retired. A significant goal of the HIX/IES Project is to ensure that the Massachusetts exchange is compliant with the ACA. A Health Insurance Exchange provides a portal for all persons who seek health insurance: people who want to purchase health insurance, persons eligible for Advance Premium Tax Credits, or persons seeking subsidized coverage through the Medicaid program (the “MassHealth” program in Massachusetts). All persons use the HIX/IES portal, and the system
5 determines their eligibility for financial assistance, among other things.
Additionally, the HIX/IES system needs functionality – including enrollment for individuals and small groups, and premium billing functions – to support the sale of insurance to small employer groups.
In addition, Massachusetts’sexisting electronic system (“MA21”) used to determine eligibility for state-run public health programs is more than fifteen years old. Massachusetts intends to replace its legacy MA21 eligibility platform, over time, with an Integrated Eligibility System integrated with the Health Insurance
Exchange. The MA21 system operates on old mainframe technology and does not lend itself to the technology approaches the ACA supports and Massachusetts seeks. Specifically, determining eligibility for public health programs should be conducted in an environment:
• That relies on service oriented architecture(“SOA”) • Where technology components can be shared and re-used • That uses a structured Rules Engine
The new Massachusetts HIX/IES will be designed and developed using a modular, reusable and scalable architecture that incorporates open standards technology components that can be shared with other New England states and potentially other states nationally.
The HIX/IES system will present consumers with the best information to make an informed choice regarding health insurance options. At a high level, the HIX/IES must support six core business areas set forth in the federal definition of the Exchange Business Architecture (“EBA”), including:
• Eligibility Determination and Enrollment • Plan Management • Financial Management • Customer Service • Communications • Oversight
2.
Organization of the RFR
Part One specifies the scope of work solicited.
Part Two contains information related to submission requirements that Bidders must follow, the terms of the RFR, and information relating to any Contract that results from this RFR.
6 Part Three contains cost response instructions.
Part Fourcontains reference documents for Federal and State requirements, and HIX and IES initiative regulations and Artifacts providing details behind the HIX/IES Project.
Part Fivecontains exhibits that must be submitted with each Response.
Part Six contains copies of the Contract documents resulting from this Request for Response. The selected Bidder must agree to all Contract terms set forth in Part Six.
Part Seven contains a list of exhibits that are posted on Comm-PASS as separate files.
Part Eight contains updated information related to the HIX/IES Project.
3.
Contract Term
The Contract resulting from this RFR is anticipated to begin on the date stated in Part Two, Section 14 – RFR Timetable and terminate on March 31, 2014. The Contract may be extended, at the discretion of the University, up to a total of an additional 48 months.In the event of a delay or interruption outside the control of the parties, the Contract term may be adjusted accordingly at the discretion of the University.
If funds are not otherwise made available (including funds which may be received from the federal government) for continued performance for any period of the Contract, the Contract may be terminated as of ninety (90) days following notice from the University to Contractor that funds are not otherwise available for
performance under the Contract; provided, however, that such termination will not affect either the University’s rights or the Contractor’s rights under any termination clause in the Contract. The effect of termination of the Contract will be to discharge both the Contractor and the University from future performance of the Contract, but not from their rights and obligations existing at the time of termination. The
Contractor shall be reimbursed for the reasonable value of any nonrecurring costs incurred but not amortized in the price of the Contractwhere such costs are specifically identified in the Bidder’s response to this RFR and the Statement of Work (SOW) entered into hereunder. The University shall notify the Contractor as soon as it has knowledge that funds may not be available for the continuation of the Contract.
4.
University Background
The University of Massachusetts Medical Schoolin Worcester is one of five campuses in the University of Massachusetts system. Established in 1962, the University's mission is to achieve national distinction in health sciences education, research, and public service. The Worcester campus, located in central
7 Massachusetts, is one of the fastest growing academic medical centers in the
country and is home to the Commonwealth's only public medical school.
5.
Minimum Qualifications
In order to submit a Response to this RFR, Bidders must meet the following minimum qualifications:
I. Proven IV&V experience of at least five (5) years, providing IV&V services for enterprise information technology (“IT”) applications;
II. Proven IV&V experience of at least five (5) years, providing IV&V services forgovernment health programs or commercial health insurers;
III. Demonstrated ability to provide experienced IV&V professional staff, with a minimum of five (5) years’ experience providing IV&V services;
IV. In operation as a business for a minimum of six (6) years, at least three (3) of which must have been relevant to the verification and validation of large health and human services systems; and
V. A corporation which has offices and conducts operations within the United States.
NOTE: Bidders are informed and aware that the HIX/IES Entities are conducting a separate, independent procurement for a HIX/IES SI Contractor. The selected IV&V Contractor pursuant to this RFR must not have any relationship or interest, financial, business, beneficial or otherwise, with the HIX/IES SI Contractor. The IV&V Contractor, its subsidiaries and parent companies, and all subcontractors are prohibited from participation in the contract resulting from the HIX/IES SI RFR in any capacity, including but not limited to, as HIX/IES SI Contractor, teaming partner, or subcontractor – significant or otherwise. Entities who responded to the HIX/IES SI RFR may respond to this RFR, but will be disqualified from this procurement if awarded the HIX/IES SI Contract. Bidders are referred to Part Two, Section 2(IX) Conflict of Interest and Part Five, Exhibit IX for additional information regarding conflicts of interest.
The University reserves the right to confirm that Bidders meet these requirements.
6.
Preferred Qualifications
The University is seeking a Bidder that has the following qualifications:
I. Demonstrated ability to successfully perform IV&V services for projects similar to the HIX/IES Project in size, scope, critical timing, and
8 system involves one central application integrated with several other
applications, information hubs, and external partners;
II. Strong knowledge of health care reform, ACA, CCIIO, and CMS, as specifically applicable to exchanges or similar experience;
III. Experience in customer facing, large scale, e-commerce applications that are web based;
IV. Experience working across multiple governmental agencies, organizations, and IT systems;
V. Strong knowledge of state and federal privacy and security laws and regulations;
VI. Ability to provide resources to meet required deliverables and deadlines VII. A demonstrated ability to support the delivery of projects on time, especially
with aggressive timelines; and
VIII. Experience with IV&V services in support of updating or implementing Medicaid eligibility systems in one or more states.
The University reserves the right to confirm that Bidders meet these requirements.
7.
Definitions and Acronyms
The following terms and acronyms that appear capitalized throughout the RFR shall have the meaning stated in this section, unless the context clearly indicates
otherwise. Terms and acronyms used throughout the RFR are not limited to those defined in this section.
Advance Premium Tax Credit – Under Section 1411 of the ACA (42 U.S.C. 18081), an Exchange makes an advance determination of personal income tax credit eligibility for certain individuals enrolling in coverage through the Exchange and reports related information to the IRS.
Artifact(s) – a general term for key documents and/or deliverables.
Availability - ability to maximize the time when the system is available for use. Bidder – the entity that submits a Response to this RFR.
Center for Consumer Information and Insurance Oversight(“CCIIO”) – a CMS department that is charged with helping implement many provisions of the ACA., CCIIO oversees the implementation of the provisions related to private health insurance. http://cciio.cms.gov/
9 Centers for Medicare and Medicaid Services (“CMS”) - the federal agency under the Department of Health and Human Services responsible for administering the Medicare and Medicaid programs under Titles XVIII and XIX of the Social Security Act.
Children's Health Insurance Program (“CHIP”) –a federally supported state run health plan that provides health coverage to children in families with incomes too high to qualify for Medicaid, but who cannot afford private coverage.
Cloud Computing - a remote computing environment with the scalability and security of enterprise-class platforms, coupled with robust network connectivity options.
CMS Reviews – refers collectively to Establishment Reviews and Exchange Certification.
Code Drop - the placement of code for a deployment.
Commonwealth Data –all data used or owned by the Massachusetts Executive Office of Health and Human Services, the Massachusetts Commonwealth Health Insurance Connector Authority, or the University of Massachusetts Medical School to which the Contractor gains access through the Contract resulting from this RFR. Contract - the agreement resulting from this RFR executed between the selected Bidder and the University to accomplish the purposes specified in this RFR and as defined in the University of Massachusetts Contract for Services Purchased, Exhibit XII – Contract referenced in Part Six of this RFR.
Contractor - the selected Bidder that enters into the Contract with the University to perform the IV&V Services contemplated by this RFR.
Establishment Review – shall mean the CMS establishment and Medicaid IT Reviews consisting of formal reviews and less formal consultations with CMS across the HIX/IES Project stages. These reviews are extensions of the Exchange Lifecycle process which consisted of Gate Reviews and other reviews.
Exchange Business Architecture (“EBA”) - a framework which describes the major business functions, processes, and services to be implemented by Exchanges. Exchange Certification – shall mean any CMS Exchange certification based upon the application and operational assessment of the HIX/IES system.
10 Exchange Reference Architecture (“ERA”) - provides the business architecture, information architecture, and technical architecture for the nationwide health insurance exchange(s).
Executive Office of Health and Human Services (“EOHHS”) – the
Commonwealth of Massachusetts executive agency, established by M.G.L. c. 6A, section 2, that is responsible for the administration of the MassHealth program (Medicaid), pursuant to M.G.L. c. 118E, Titles XIX and XXI of the Social Security Act, and other applicable laws and waivers thereto.
Executive Team – the executive team comprised of a senior member from each HIX/IES Entity that is responsible for interfacing with and monitoring the IV&V Vendor.
Federal Data Services Hub (“FDSH”) – the data services hub operated by the federal government to support certain functions and responsibilities of States in administering health coverage programs.
Federal Information Security Management Act (“FISMA”) – is a new subchapter to Chapter 35 of title 44, United States Code, which addresses information security:http://csrc.nist.gov/drivers/documents/FISMA-final.pdf. Federal Tax Information (“FTI”) – tax information from the federal Internal Revenue Service.
Funding Opportunity Announcement (“FOA”) – notice of a federal grant opportunity.
Health Information Technology for Economic and Clinical Health
(“HITECH”) Act – enacted as part of the American Recovery and Reinvestment Act of 2009, was signed into law on February 17, 2009, to promote the adoption and meaningful use of health information technology and the privacy and security of electronically transmitted health information.
http://www.hhs.gov/ocr/privacy/hipaa/administrative/enforcementrule/hitechenforc ementifr.html
Health Insurance Exchange (“HIX” or “Exchange”) – for purposes of this Contract, an information technology system for organizing the health insurance marketplace to help consumers and small businesses shop for coverage in a way that permits easy comparison of available plan options based on price, benefits and services, and quality. Exchanges will employ a single, streamlined eligibility process that will serve as the central point of access for individuals and small groups shopping on the Exchange, including (i) individuals who receive Advance Premium Tax Credits and (ii) for individuals receiving Medicaid or for children who receive CHIP (collectively referred to as “MassHealth” in Massachusetts).
11 Health Insurance Portability and Accountability Act of 1996 (“HIPAA”)- the federal law (42 USC §§ 1301 et seq.), enacted to improve the continuity of health insurance coverage in group and individual markets, combat waste, fraud and abuse in health insurance and health care delivery, standardize the electronic exchange of health related transactions by payers and relationship entities, and assure the privacy of Protected Health Information (“PHI”).
Health Safety Net (“HSN”) – is a program for Massachusetts residents who are not eligible for health insurance or cannot afford to buy it. For low income residents, the Health Safety Net (Free Care) pays for medically necessary services at Massachusetts community health centers (CHCs) and hospitals.
HIX/IES Entities – for purposes of this RFR, collectively, the Massachusetts Executive Office of Health and Human Services, the Massachusetts Commonwealth Health Insurance Connector Authority, and the University of Massachusetts
Medical School.
HIX/IES Entities Steering Committee (“Steering Committee”) – is the decision-making team, comprised of one core representative from each HIX/IES Entity and other programmatic, technology and business attendees from the HIX/IES Entities’ respective organizations, responsible for providing senior direction and strategy to the HIX/IES project.
HIX/IES Project Deliverables – are deliverables generated by the HIX/IES SI Contractor pursuant to the contract which is anticipated to be entered into between the HIX/IES SI Contractor and UMMS as a result of the HIX/IES SI RFR.
Independent Verification and Validation (“IV&V”) - is the process of checking that a product, service, or system meets specifications and that it fulfills its intended purpose. This process is performed by an unaffiliated 3rd party.
Information Security (“Security”) - refers to the processes, methodologies, and means which are designed and implemented to protect information systems and information – including print, electronic, or any other form of confidential, private and sensitive information or data – from unauthorized access, use, misuse,
disclosure, destruction, modification or disruption, which includes but not limited to the ability to authenticate and authorize users to provide secure access to the system in a traceable (auditable) manner.
Information Technology Division (“ITD”) - the Massachusetts Division that provides a range of centralized IT services; overseeing IT policies, standards and architecture; and promoting cross-agency collaboration and adoption of shared services.
12 Intake, Eligibility and Referral (“IE&R”) - a public-facing information system which allows individuals to initiate the application process for MassHealth and certain other state-run benefits programs.
Integrated Eligibility System (“IES” or “ED”) - the HIX component(s) that will process eligibility determinations for shopping on the Exchange, including
eligibility for the Advance Premium Tax Credit, state-subsidized health programs (MassHealth), and other human service programs.
Internal Revenue Manual (“IRM”) - a publication of the federal Internal Revenue Service describing federal tax policy.
IV&V Project Deliverables –– are deliverables generated by the IV&V Contractor pursuant to the Contract, including without limitation, deliverables described in Part One – Specifications; 11 Scope of Work, IIII IV&V Project Deliverables of this RFR.
Key Personnel - personnel directly responsible for management of the Contract; or those personnel whose professional/technical skills are determined to be essential to the successful implementation of the Contract.
MA21 - the eligibility determination system used by EOHHS to perform automated determination of MassHealth eligibility and coverage type.
Maintenance - the preventive or corrective action(s) undertaken to maintain the functionality and to improve or increase the processing performance of the software or the infrastructure on which it runs.
Massachusetts Chapter 58 of the Acts of 2006 - “An Act Providing Access to Affordable, Quality, Accountable Health Care” – the session law can be found here:
http://www.malegislature.gov/Laws/SessionLaws/Acts/2006/Chapter58. Massachusetts Commonwealth Health Insurance Connector Authority (“Health Connector” or “CCA”) - is an independent public authority that helps Massachusetts residents find health care coverage.
MassHealth - the Medicaid and State Children’s Health Insurance (“SCHIP”) programs of Massachusetts, administered by EOHHS pursuant to M.G.L. c. 118E and Titles XIX and XXI of the Social Security Act and other applicable laws and waivers, that pays for medical services for eligible individuals.
Medicaid Information Technology Architecture (“MITA”) - is an evolving CMS initiative that fosters an integrated business, information and technological approach to building management systems that are client-based and capable of sharing information across the Medicaid program organizational silos based upon
13 nationally recognized standards. Please see the Medicaid.gov website managed by CMS for more information: http://www.medicaid.gov/
Medicaid Management Information System (“MMIS”) - the state-operated system of automated and manual processes used to process Medicaid claims from providers of medical care and services furnished to Members, and to retrieve and produce service utilization and management information for program administration and audit purposes.
Member - any individual determined by EOHHS to be eligible for MassHealth benefits under M.G.L. c. 118 E and 130 CMR 410 to 650.
Milestone - a pre-defined event that marks the completion of a subset of the project activities, tasks, and deliverables scheduled in the project plan.
Modified Adjusted Gross Income (“MAGI”) – is a federal income tax definition and methodologywhich state agencies and the Exchange must use to determine financial eligibility for Medicaid and CHIP.
My Account Page (“MAP”) - an information system which allows Members to see information about their health assistance benefits or their food and cash assistance benefits online. MAP helps Members manage their MassHealth, Commonwealth Care, Health Safety Net, Children's Medical Security Plan and Healthy Start benefits, as well as the benefits received from the Department of Transitional Assistance (“DTA”). To use MAP, an individual must be the head of the household (person who signed the original application for benefits), be receiving benefits, and create and register for a Virtual Gateway Account.
NESCIES - the acronym used for the Massachusetts Early Innovator cooperative agreement with CCIIO, which refers to the “New England States Collaborative for Insurance Exchange Systems”.
Patient Protection and Affordable Care Act, Public Law 111-148 (“ACA”) - the federal law that can be found here:
http://www.gpo.gov/fdsys/pkg/PLAW-111publ148/pdf/PLAW-111publ148.pdf.
Personally Identifiable Information (“PII”) - information that can be used to uniquely identify, contact, or locate a single person or can be used with other sources to uniquely identify a single individual.
Protected Health Information (“PHI”) - shall have the same meaning as the term “protected health information” in 45 CFR § 164.501.
Qualified Health Plans (“QHPs”) - under the Affordable Care Act, starting in 2014, an insurance plan that is certified by an Exchange and that provides essential
14 health benefits, follows established limits on cost-sharing (like deductibles,
copayments, and out-of-pocket maximum amounts), and meets other requirements. A qualified health plan will have a certification by each Exchange in which it is sold.
Required Change - means any change in applicable laws, rules or regulations or change required by CCIIO, CMS, or the Commonwealth of Massachusetts, a legislative action, a legislative request, executive order, or judicial decision that requires a change in the HIX/IES system and impacts the IV&V Services. Response –Any information submitted by the Bidder in response to the
requirements outlined in this RFR, including any clarifying information requested by the University.
Reusability - ability to use individual HIX or IES system components or services developed as part of this Contract for other federal or state Exchanges.
Rules Engine - a software system that executes one or more business rules in a runtime production environment.
Senior Management Team- the advisory committee, comprised of one representative from each HIX/IES Entity, that is responsible for advising and overseeing the implementation of the day-to-day operations and resource management, including without limitation, monitoring the HIX/IES Project dashboard progress reports.
Service Oriented Architecture (“SOA”) - is a set of principles and methodologies for designing and developing software in the form of interoperable services. These services are well-defined business functionalities that are built as software
components (discrete pieces of code and/or data structures) that can be reused for different purposes.
State Medicaid Manual - a publication issued by CMS that contains the
requirements and guidelines that all states must follow in managing their Medicaid programs.
Technical Reference Architecture (“TRA”) - provides an architectural reference for the construction and integration of component-based solutions. It provides business solutions which are both scalable and flexible, integrates new and already existing business solutions in a consistent, efficient, productive manner, and defines optimal physical and logical layering strategies.
User Acceptance Testing (“UAT”) -testing conducted to determine if the requirements of a specification or contract are met to the satisfaction of the customer before the customer accepts the new system.
15 User Interface (“UI” or “Portal”) – a web-based interface which facilitates the interaction between users and an information system.
Virtual Gateway -an internet portal designed by EOHHS to provide the general public, medical providers, community-based organizations and EOHHS staff with online access to health and human services programs and information.
Work Order – a detailed description of each of the HIX/IES SI Contractor’s responsibilities under the scope of the HIX/IES SI RFR.
XML (Extensible Markup Language) – a method of creating a common information format.
8.
Statistics/Data Offered for Illustration Purposes Only
The figures stated in this RFR are estimated figures and are given only as a guideline. These figures are based on previous data or the best information at the time of writing this RFR, and shall not be construed to represent the actual data expected under the Contract as it relates to this RFR. The University does not guarantee the volume of any services.
9.
Program Overview
Massachusetts is one of several states awarded an Early Innovator Grant cooperative agreement from the Centers for Medicare and Medicaid Services’ (“CMS”) Center for Consumer Information and Insurance Oversight (“CCIIO”). The formal name for the Massachusetts cooperative agreement with CCIIO is the New England States Collaborative for Insurance Exchange Systems agreement (“NESCIES”).
As part of the NESCIES, Massachusetts is collaborating with other New England states, which may include Connecticut, Maine, New Hampshire, Rhode Island, and Vermont. Massachusetts seeks to create an ACA-compliant HIX/IES, and supports a learning collaborative where participating New England states share lessons learned from developing their respective Exchanges. Participating states also develop cost-effective, reusable technology components and best practices for implementing a HIX/IES.
Through the HIX/IES Project, reusable components may be used by New England states and other states for their Exchanges. Developing reusable components and developing plans for their reuse and implementation in other states is a significant component of this project.
16 The current Massachusetts Exchange, known as the Health Connector, is a model for the national Exchange initiative. Offering a one-stop insurance marketplace, the Connector allows individuals and small businesses to shop for and enroll in
partially subsidized or non-subsidized insurance based on a side-by-side comparison of plans. Private commercial health plans are made available to individuals, families, and certain employers in the state via the Health Connector web site.
Via the Health Connector, individuals who need help to pay for insurance coverage are advised to fill out and mail a paper application for a subsidized insurance program. Applications received from individuals – either on account of their contact with the Health Connector or a variety of other channels within the state – are processed by the MassHealth program’s MA21 system. The HIX/IES Project aims to build on the Health Connector’s successful implementation.
The ACA requires state-run exchanges to support real time eligibility for and enrollment in health plans offered through the Exchange, and for MassHealth and the Children’s Health Insurance Program (“CHIP”) programs. The current Health Connector solution must be extended to meet these requirements. The current information technology components – including those that enable eligibility determination, consumer shopping, premium billing, enrollment, and reporting – must be updated or developed to comply with federal health reform
requirements. The objective is a best-in-class HIX/IES system that meets or exceeds requirements in the ACA, maximizes flexibility, minimizes technical and operational support burdens, dynamically adapts to volatile rules, policies and legislation, and sets a new standard in consumer ease of use and satisfaction.
10.
Technology Background
This section describes the current health insurance Exchange environment in Massachusetts and the vision of the future environment.
Massachusetts plans to implement the HIX/IES in two phases. The first phase is focused on ensuring that the system meets the ACA deadline for creating an operational Exchange by October 1, 2013. In Phase II, the HIX/IES will be enhanced to become a fully integrated system for determining eligibility for a variety of state-funded health and human services programs. Phase II will be implemented in 2015.
The scope of this RFR is Phase I activities. Achieving the Phase II vision is outside of the scope of this RFR but is described in this section to help inform the IV&V Bidders’ understanding of Massachusetts’ long-term vision.
17 The following section provides a high level overview of the current application environment and a brief description of the applications.
Figure 1 – Current Environment: MA Heath Connector
The Health Connector operates the current Exchange for Massachusetts, as depicted in Figure 1 above, by offering private health plans approved by the CCA board of directors. The health plans are available to individuals, families, and certain employers in the state via the Health Connector’s Web portal. The primary responsibilities of the CCA for operating the Exchange are:
• Operating the Exchange, including contracting with commercial carriers and enrolling eligible individuals and small groups.
• Making policy decisions as authorized by Massachusetts health care legislation.
• Conducting outreach and advertising efforts to inform the public of new opportunities and responsibilities.
The current Exchange supports individual consumers, employers, general public, brokers, and administrators. It provides two separate programs: Commonwealth Care, which is an exclusive distribution channel for subsidy-eligible adults (< 300% FPL), and Commonwealth Choice, which is an alternative distribution channel for unsubsidized non-group and small-group insurance.
18 In addition to the Health Connector, there are systems that support applications to MassHealth programs and other non-health programs such as Supplemental Nutrition Assistance Program (“SNAP”) and Temporary Assistance for Needy Families (“TANF”).
Figure 2 – Current Environment: EOHHS Intake
The Intake, Eligibility & Referral (“IE&R”) system allows providers and citizens to screen and apply for several state and federal benefit programs, submit
renewals, check active benefit details from multiple external case management systems, and submit changes to data online.
IE&R provides anonymous screening service and allows providers and citizens to determine if individuals and families qualify for benefits in various state
programs.
IE&R also provides a common intake application service that captures
information entered by providers and citizens and forwards XML applications to three agency systems, while other program applications are sent to the
19 My Account Page (“MAP”) is a self-service for providers and citizens to check MassHealth and Department of Transitional Assistance (“DTA”) Benefits, and also for submission of MassHealth Change Forms and Renewals.
My Workspace (“MWS”) is a workflow tool that streamlines the processing, management, and reporting of paper documents to support eligibility and maintenance for MassHealth services.
MA21 is the system of record for MassHealth (Medicaid) and Commonwealth Care eligibility determination. It also determines eligibility for CHIP and Health Safety Net (“HSN”) programs. MA21 has batch interfaces with several state and federal agencies for various eligibility checks. MA21 also obtains referrals from other state and federal agencies for individuals who become eligible by virtue of eligibility in other state or federal programs. MA21 maintains the historical profile of an individual's eligibility, and provides web service interfaces to retrieve those profiles for customer or provider self-service.
II. Future Environment
The realization of the future HIX/IES will be achieved in two phases. Phase I will introduce an ACA-compliant HIX/IES. It will also establish the Eligibility Domain (“ED”) with eligibility determinations for shopping on the Exchange, eligibility for Advance Premium Tax Credits, and eligibility for MassHealth (Medicaid) or CHIP programs.
In Phase II, the HIX/IES will be enhanced to become a fully integrated system for determining eligibility for a variety of state-funded health and human services programs. The MA21 system will be replaced in Phase II.
The existing HIX/IES SI RFR is seeking services from a contractor to complete the realization of the Phase I vision only. The vision for Phase II is being provided since the system implemented in Phase I must be able to serve as a platform for functions performed in Phase II.
A. HIX/IES Phase I:
In Phase I, the HIX will be anchored by the HIX portal and IES, represented in Figure 3 as the Eligibility Domain. The HIX portal will serve all citizens seeking health coverage and provide an easy-to-use website for education, plan comparison and plan selection, account management, enrollment, and other features. Through the HIX portal, all consumers will have the same user experience whether they are pursuing private, partially subsidized, or Medicaid health coverage.
20
Figure 3 – Proposed Environment (HIX/IES Phase I)
The HIX/IES Entities are currently in the process of estimating the number of consumers who will pursue non-subsidized, or partially subsidized, health insurance (i.e. commercial coverage purchased through use of Advance Premium Tax Credits), or Medicaid health coverage once Phase I is implemented. Metrics are provided below to illustrate the current
distribution. The metrics represent timeframes between June and August 2011.
Table 1: Estimated Number of Consumers
Group and Percentage Program Population % of Total
Medicaid 1,197,228 78.6%
Fully Subsidized – 86%
CHIP 117,727 7.7%
Fully/Partially* subsidized –
11% Commonwealth Care 169,556 11.1%
Non-subsidized – 3% Commonwealth Choice 39,566 2.6%
Total 1,524,077
21 The IES will be the engine through which all eligibility is determined and enrollment is managed, including but not limited to eligibility for employers to use the HIX/IES, employees to shop on the HIX/IES, individuals to apply for personal exemptions, and for individuals to obtain partially or fully subsidized health insurance. For individuals being determined for Medicaid eligibility, the MA21 system will be in the backend throughout Phase I and act as a system of record for all determinations. The HIX/IES will determine eligibility for some populations whose incomes are determined using MAGI. It will also determine eligibility for some simple, non-MAGI populations. Applications for more complex, non-MAGI populations will be accepted through the HIX/IES system but will be referred to MA21 for eligibility determination. MA21 will determine eligibility only for complex non-MAGI cases in Phase I. The MMIS system will also be in the backend and provide enrollment for Medicaid members as it does today. These backend functions in MA21 and MMIS will be exposed as real time web services so the
HIX/IES can consume them.
Specifically, eligibility determinations in Phase I will be done as follows: 1. MAGI determinations will be verified with the Federal Data Services
Hub.
2. MAGI determinations will also be verified with state data sources. 3. Non-MAGI determinations will be completed through (1) business
rules scripts for simple non-MAGI determination rules moved to IES from MA21, or (2) services that expose legacy MA21 non-MAGI complex eligibility processes for IES to perform.
With this approach, in Phase I, MassHealth or Exchange shopping eligibility notices may need to be generated from data in two systems: IES and MA21. The HIX portal will ultimately interact both with MA21 for eligibility and MMIS for selection of plans for Medicaid members in real time. In the end, consumers determined eligible for Medicaid should be able to use the HIX/IES and enroll in a health plan in real time, including receiving a temporary Medicaid ID.
In Phase I, interfaces with the Federal Data Services Hub, other State systems, and insurance carriers will be critical components. Components such as Business Process Management and a Rules Engine will streamline eligibility determinations and be significant as well. Certain shared services, such as security and document management, and others will be implemented at this time.
22 B. HIX/IES Phase II:
Although this RFR is intended to govern Phase I only, Phase II is described for context purposes. In Phase II, the IES will determine eligibility for all MAGI and non-MAGI Medicaid cases as well as eligibility for human services programs including but not limited to Supplemental Nutrition Assistance Program (“SNAP”) and Temporary Assistance to Needy Families (“TANF”). The IES developed in Phase I for health programs will expand in Phase II and become the common eligibility platform for various health and human services programs. Similarly, the Business Process Management, Federal Data Hub, Master Data Management, and Rules Engine developed in Phase I will be enhanced in Phase II to provide eligibility determination for multiple state programs while leveraging two primary user interfaces:
1. HIX portal for health coverage of any type; and
2. Integrated Eligibility Portals (“IEPs”) for other programs such as: a) All MassHealth benefits
b) Health Safety Net
c) Supplemental Nutrition Assistance Program (“SNAP”) d) Temporary Assistance for Needy Families (“TANF”)
e) Emergency Aid to Elders, Disabled and Children (“EAEDC”) f) School Nutrition
g) Women, Infants and Children (“WIC”)
h) Community Services and Long-term Support - 11 programs covering Veterans, Disability and Developmental programs Note that the above list is a representative list of health and human services programs, and a process will be undertaken to determine which will be included in the scope of Phase II.
With Phase II, the MA21 system will be retired, and the eligibility systems currently supporting human services programs such as SNAP and TANF will no longer perform eligibility determinations. Many, however, will continue to maintain their importance as the system of records for their respective programs.
The following diagram represents the combined HIX and IES vision for 2015.
23
Figure 4 – Proposed Environment (HIX/IES Phase II)
24
11.
Scope of Work
This section describes the IV&V Services to be performed by the IV&V Contractor. Bidders should review the HIX/IES SI RFR (RFR # CW12-JD-0022-000, as
amended), issued by the University on or around 12/21/2011, and the more recent HIX/IES Project update contained in Part Eight of this RFR to understand the HIX/IES Project, the content of the HIX/IES SI RFR, and the IV&V Services being requested in this RFR. The HIX/IES SI RFR and other related documents are available on the Commonwealth Procurement Access & Solicitation System
(“Comm-PASS”). To locate the HIX/IES SI RFR on Comm-PASS, search for document number CW12-JD-0022-0001.
In particular, Bidders should review and fully understand the HIX/IES Project timetable in Part Eight of this RFR, Section 1 – Scope of Work: Project Timeline, Table 2. This timetable serves as the primary timeline for all of the HIX/IES SI Contractor’s tasks and deliverables and thus in turn the IV&V Contractor’s activities that shall be required to complete the IV&V Services hereunder.
I. Organization and Communication
The University seeks an IV&V Contractor that will bring to the table innovative project personnel, processes, approaches and tools to meet the requirements of the IV&VServices for the HIX/IES Project.
The IV&V Contractor will report directly to the Executive Team and will also work with the HIX/IES EntitiesSenior Management Team. The IV&V Contractor’s personnel must be organized in such a way to ensure the expectations of the
Executive Team and Senior Management Team are met and that the HIX/IES Entities project staff are well informed.
All documentation and deliverables produced in the performance of the IV&V Services must be stored in MassForge, the collaboration tool used by the HIX/IES Entities.
The individual activities within the scope of the IV&V Services, and the deliverables which will result from these activities, are described below.
II. Tasks
The IV&V Services described in this RFR must comply with IV&V regulatory requirements detailed in 45 CFR 95.626 which requires that IV&V efforts be conducted by an entity that is independent and that:
25 1. Develops a project workplan. The plan must be provided directly to CMS at
the same time it is given to the State.
2. Reviews and makes recommendations on both the management of the project, both State and vendor, and the technical aspects of the project. The IV&V provider must give the results of its analysis directly to the federal agencies that required the IV&V at the same time it reports to the State.
3. Consults with all stakeholders and assess the user involvement and buy-in regarding system functionality and the system's ability to support program business needs.
4. Conducts an analysis of past project performance sufficient to identify and make recommendations for improvement.
5. Provides risk management assessment and capacity planning services. 6. Develops performance metrics which allow tracking project completion
against milestones set by the State.
In compliance with IV&V regulatory requirements and to meet the goals of the HIX/IES Project, the IV&V Contractor shall complete the following tasks:
• Manage the IV&V Services
• Review all HIX/IES Project Deliverables • Validate automated code review results • Validate continuous integration test results
• Coordinate and conduct User Acceptance Testing (“UAT”) • Verify implementation readiness
• Verify component reusability • Perform a system audit • Perform financial reviews • Conclude the IV&V Services
A. Manage the IV&V Services
The IV&V Contractor shall develop a comprehensive project management plan (the “IV&V Services Project Management Plan”), and shall manage and carry-out the IV&V Services in accordance with the IV&V Services Project Management Plan. The IV&V Services Project Management Plan must include at a minimum the following elements:
1. Description of how the IV&V Contractor plans to carry out the IV&V Services. This description should include methodologies, strategies, standards, and approaches employed by the IV&V Contractor for
26 executing each of the IV&V activities within this Scope of Work of this RFR.
2. High level IV&V Services schedule which aligns with the HIX/IES Project Timeline.
3. Detailed schedule that includes activities, tasks, estimated start and end dates, durations, deliverables, and assigned resources to illustrate how IV&V Services will be achieved.
4. Organizational structure which reflects, among other things, the need to coordinate activities among the IV&V Contractor, the HIX/IES SI Contractor, and the HIX/IES Entities.
5. Description of resources assigned to activities, tasks and the IV&V deliverable creation.
6. Description of the deliverables produced as a result of IV&V activities.
B. Review all HIX/IES Project Deliverables
1. The IV&V Contractor shall review all HIX/IES Project Deliverables in accordance with the deliverable review process defined in the HIX/IES SI RFR, as may be updated by UMMS. The IV&V Contractor’s HIX/IES Project Deliverable review activities include, without limitation, the following:
a) Review and assessment of deliverable outlines and sample
deliverables submitted by the HIX/IES SI Contractor to determine whether the outline and sample deliverables meet the requirements of the HIX/IES Entities.
b) Development of acceptance criteria tailored to each HIX/IES Project Deliverable which (i) clearly delineate the criteria that must be satisfied for the HIX/IES Project Deliverable to be deemed
complete, and (ii) are consistent with the HIX/IES SI Contractor’s Work Orders and other HIX/IES Project requirements and
specifications.
c) Development of a checklist for eachHIX/IES Project Deliverable review, including the acceptance criteria applicable to the HIX/IES Project Deliverable.
d) Review and assessment of all HIX/IES Project Deliverables submitted by the HIX/IES SI Contractor, and reporting of findings and associated recommendations for remediation where applicable. e) Identification and summarization of issues and all other results of the
27 f) Review and assessment all subsequent HIX/IES Project Deliverable
iterations to validate remedial actions taken by the HIX/IES SI Contractor to assess if recommendations have been incorporated satisfactorily.
g) Tracking of identified issues andprogress toward resolution of issuesrelated to HIX/IES Project Deliverables.
h) Support of the approval process for each HIX/IES Project Deliverable.
2. The IV&V Contractor shall conduct an analysis of past project performance sufficient to identify and make recommendations for
improvement. Additionally, the IV&V Contractor shall facilitate HIX/IES Project compliance with the following tables that are set forth in Part Eight of this RFR:
a) Table 2: Project Timetable
b) Table 3: Code Drop Schedule within the Requirements, Design, and Development Stage
c) Table 4: Deliverables by Milestone
3. The IV&V Contractor will assess HIX/IES Project Deliverableson defined quality attributes, including but not limited to:
a) Adherence to Requirements – Does the HIX/IES Project Deliverable satisfy specified requirements?
b) Clarity – For written HIX/IES Project Deliverables, does the
HIX/IES Project Deliverable clearly state its meaning and minimize the possibility of misinterpretation?
c) Completeness – Does the HIX/IES Project Deliverable fulfill applicable requirements, with no tasks left incomplete? Is anything missing?
d) Consistency – Are the requirements contained in the HIX/IES Project Deliverable consistent both within a given HIX/IES Project Deliverable and across all HIX/IES Project Deliverables?
e) Traceability – For each HIX/IES Project Deliverable, are all
applicable requirements traceable through each phase of the software development life cycle?
f) Adherence to Laws, Rules and Guidelines (included in Part Four of the HIX/IES SI RFR) – Does the HIX/IES Project Deliverable satisfy all applicable guidelines, standards, instruction, and policies issued by project managers as well as state and federal agencies?
28 C. Validate automated code review results
The HIX/IES SI Contractor will be responsible for conducting automated code tests. The IV&V Contractor shall:
1. Review and assess the Automated Code Review component of the HIX/IES SI Contractor’s test plan.
2. Review and assess the results of Automated Code Review activities. 3. Report issues and findings, and recommend practical and feasible
solutions.
4. Track issues and findings to completion by reviewing and assessing subsequent releases.
D. Validate continuous integration results The IV&V Contractor shall:
1. Review continuous integration test plan for comprehensiveness, completeness, and traceability.
a) Verify that integration tests address all system components and all functional and non-functional requirements, and that they do not simply repeat unit tests.
b) Verify that test cases are properly mapped, through a traceability matrix, to requirements, use cases, and other Artifacts.
2. Verify timelines and tests for all releases.
a) Verify test plans for all releases so that test plans include both integration and regression tests.
3. Review and assess results from continuous integration test activities. a) Assess each system component’s integration test results against the
testing exit criteria, and summarize the test results for each component.
4. Report issues and findings, and recommend practical and feasible mitigating solutions.
5. Track issues and findings to completion by reviewing and assessing subsequent releases.
E. Coordinate and Conduct User Acceptance Testing
At a minimum, the IV&V Contractor shall conduct UAT on functionality within all Code Drop milestones as described in the HIX/IES SI RFR.
The purpose of UAT is to provide the users of a system the opportunity to validate that the delivered software components behave according to stated
29 requirements and to assess the readiness of the software for go-live. The IV&V Contractor shall coordinate and conduct all User Acceptance Testing tasks and activities including, but not limited to, the tasks described below.
The IV&V Contractor shall plan for, conduct, and provide follow-up activities for the UAT of the HIX/IES system until the UAT meets its stated exit criterion. Representatives from the HIX/IES Entities will provide subject matter expertise, review and approve the IV&V Contractor’s UAT testing deliverables, and review system readiness for go-live. While representatives from the HIX/IES Entities may also be available to conduct UAT, the responsibility rests with the IV&V Contractor.
1. Develop UAT Strategy and Plan
The IV&V Contractor shall develop a UAT plan that describes at a
minimum the approach, timing, and activities involved in coordinating and conducting User Acceptance Testing. The UAT plan should also describe the recommended depth and breadth of coverage from a functional perspective that needs to be exercised during UAT testing. The IV&V Contractor’s UAT plan shall describe at a minimum:
a) Critical factors for a successful UAT process and description for how the factors will be measured. The assessment of critical factor results will determine if UAT was a success and serve as UAT exit criteria. b) Testing metrics and success criteria for each phase or iteration of
UAT.
c) Project risks and how those risks will be addressed by the UAT task. d) Critical business workflows and how those workflows will be tested. e) All possible points of failure and how those points of failure will be
tested.
f) Traceability of UAT tests to requirements.
g) Proposal of the most appropriate points in time during the HIX/IES Project life cycle at which executing UAT testing should be
conducted.
h) Detailed UAT schedule based on the overall HIX/IES Project plan and milestone dates.
i) Proposal of UAT team composition covering technical and business knowledge areas to maximize the reliability of test outcomes.
j) Validate that the UAT test environment delivered by the HIX/IES SI Contractor satisfies all requirements in terms of features,
characteristics, connectivity and processing to facilitate successful UAT.
30 k) A test data management process that describes the identification,
creation, and maintenance of test data required to facilitate successful UAT.
l) Techniques to familiarize the UAT test team as early as possible with the system in preparation for UAT test activities. Techniques – such as requirement walkthrough sessions, blueprint and/or wireframe review sessions, screen preview sessions, system demo sessions, etc. – must be considered.
m) Test techniques and/or test methods that will be used during UAT testing.
n) Test scenarios that will be used during UAT testing.
o) Approach for documenting UAT test scripts prior to UAT test execution.
2. Execute UAT
a) Conduct and record the results of UAT.
b) Identify, log, and prioritize defects found during UAT. c) Record UAT results, including but not limited to:
(1) Number and percentage of test cases executed and not executed; (2) Number and percentage of test cases passed and failed by
functional area. 3. Follow-Up on UAT
a) Track UAT defects to closure.
b) Assess the success of UAT based on identified exit criteria.
F. Verify implementation readiness
The IV&V Contractor shall develop an approach for assessing the readiness of the HIX/IES system to support the two major implementation milestones. The IV&V Contractor shall:
1. Define a set of robust and comprehensive criteria to assess
implementation readiness for the two implementation milestones: a) Soft Launch
b) Open Enrollment Launch
31 3. Report issues and findings and recommend practical and feasible
solutions.
4. Track issues and findings to completion.
G. Verify component reusability
The HIX/IES Entities aim to create a HIX/IES that complies with provisions of the ACA. The HIX/IES Entities are committed to supporting a learning
collaborative where participating New England states can share lessons learned from developing their state-based Exchanges, as well as participate in the development of cost-effective and reusable technology components, intellectual property, and best practices for implementing Exchanges. Further, the HIX/IES Entities desire to leverage and re-use components from other states and the Federal Facilitated Exchange (FFE).
The extent to which information technology components can be shared and re-used is guided by three tiers of reusability. The lowest tier represents the lowest level of usability, whereas the highest tier represents the highest level of re-usability. The tiers and their definitions are as follows:
• Tier 1 - Reusability of HIX/IES documentation, processes, and knowledge – and the documentation, processes, and knowledge provided by other states and the FFE.
• Tier 2 - Reusability of HIX/IES components independently hosted and procured by other states – and the reusability of components provided by other states and the FFE.
• Tier 3 - Reusability of HIX/IES components shared and leveraged from common infrastructure.
The IV&V Contractor shall identify all project components generated by the HIX/IES Project and IV&V Services which are candidates for reuse, including but not limited to, documents, processes, and software components. The IV&V Contractor shall also identify components available from other states and the FFE which have potential for re-use for the HIX/IES Project. The IV&V Contractor shall verify and validate the reusability of components, and the verification should assess whether the components are reusable and at what tier.
1. Component Reusability
The IV&V Contractor shall develop the following assessments of reusability for each component:
32 a) Expected Reusability: An initial assessment of the components that
have reusability potential and the reusability level that can be expected.
b) Delivered Reusability: An assessment of the components as
documented and developed and the actual reusability level achieved. Compare the result to the component’s expected reusability.
To illustrate, the IV&V Contractor will assess the detailed design of the Business Rules Engine to determine which modules can be expected to be reused by other states. The assessment will include the level of reusability for each module.For instance, the assessment would evaluate the MAGI
calculations module and if that module is expected to have Tier 1, 2, or 3 reusability. Once the MAGI calculations module is developed, an assessment as to its actual – or delivered – reusability will be performed by the IV&V Contractor.
2. Services Reusability
The IV&V Contractor will assess services to evaluate the level to which services are business agnostic and stateless to support successful deployment of services such as:
a) SaaS: Software as a Service (e.g. Address Validation or HIPAA translator)
b) PaaS: Platform as a Service (e.g. Portal, Middleware, Database) c) IaaS: Infrastructure as a Service (e.g. Shared Data Center, Virtual
Machines)
3. Framework Reusability
The IV&V Contractor will assess the HIX/IES framework to evaluate the level to which the framework:
a) Is based on Service Oriented Architecture
b) Is developed using Federal, State, and industry best practices c) Employs a Cloud First approach
d) Follows Federal and CMS security and privacy guidelines (included in Part Four of the HIX/IES SI RFR - Laws, Rules and Guidelines)
e) Is based on Exchange Reference Architecture f) Follows ACA Section 1561 recommendations
H. Perform a System Audit 1. The IV&V Contractor shall:
33 a) Develop a plan to perform a system audit and specify, among other things, the dimensions which will be addressed in the system audit and the criteria applied to each dimension.
b) Perform the system audit
c) Report results of the system audit and recommend practical and feasible solutions.
d) Track issues and findings to completion.
2. Through the system audit, the IV&V Contractor must evaluate the system along various dimensions, including but not limited to:
a) System Effectiveness: Verify that information is pertinent to the appropriate business process and is delivered in a timely, correct, consistent and usable manner.
b) System Efficiency: Verify that the system provides information through the most optimal use of resources.
c) Confidentiality: Verify that the appropriate controls are in place to ensure compliance with the full range of security and privacy requirements in order to protect sensitive information from unauthorized use and disclosure.
(1) Sensitive information protected by privacy and security requirements includes but is not limited to:
i. PII – Personal Identifiable Information ii. PHI – Protected Health Information iii. FTI – Federal Tax Information
iv. Department of Revenue (“DOR”) wage information (2) Appropriate controls include but are not limited to:
i. Intrusion prevention/detection
ii. Vulnerability and penetration prevention/detection iii. Network hardening
iv. Identity management v. Physical access to facilities
vi. Logical access to data and processes
vii. Monitoring of system activity, logging of incidents, and action plans to prevent and/or address identified incidents
34 d) Integrity: Verifying that information is accurate and complete in
accordance with business requirements and expectations. e) Availability: Verifying that information will be available when
required by the business in the short and long term, and verifying that resources and capabilities are appropriately safeguarded. f) Compliance: Verifying that the system is in compliance with all
laws and regulations to which the business processes are subjected. g) Reliability: Verifying that the system’s users have access to the
information they need to carry out their responsibilities including meeting financial and compliance reporting responsibilities. 3. When performing the above mentioned activities, the IV&V Contractor’s
system audit must address several resources, including but not limited to: a) Data: Objects in their widest sense – structured, non-structured,
graphics, sound, and more.
b) Application Systems: The sum of manual and programmed procedures.
c) Technology: Hardware, operating systems, database management systems, networking, multimedia, and the like.
d) Facilities: All the resources that house and support the information system.
e) People: Staff skills, awareness, productivity to plan, organize, acquire, deliver, support and monitor information systems and services.
I. Perform Financial Reviews
The IV&V Contractor will perform financial reviews to assess various elements of the HIX/IES Project:
1. Assess the financial measurement baseline for the project and define how it will be tracked, define reporting for the financial health of the project, and the invoicing requirements and timelines for the project.
2. Review invoices submitted by the HIX/IES SI Contractor and determine if the terms of their submission have been met. Note that invoices will be submitted at different times and based on different terms, including:
a) when HIX/IES Project milestones are completed;
b) on a monthly basis according to work performed under Work Order 12 – Interstate (NESCIES) Support;
35 c) under other terms – for example, invoicing for services performed
under Work Order 9 – Hosting.
3. Assess on a monthly basis the percent completion of the HIX/IES Project in comparison to the percent of the amount paid to the HIX/IES SI Contractor. Develop a tracking system for this monthly assessment. 4. Review Anticipated Charge Requests (“ACR”) submitted by the HIX/IES SI
Contractor and assess the financial, schedule, and scope impact to the HIX/IES Project.
5. Review the approachto, and implementation of, cost allocations across the HIX/IES Project’s various funding sources.
6. Assess the implementation and long-term operational costs related to
hardware, software, hosting, and other decisions which affect the total cost of ownership of the HIX/IES system.
7. Establishment Review and Medicaid IT Review Reports – The IV&V Contractor shall also develop key financial artifacts needed to support the Establishment Review and Medicaid IT Review process.
J. Conclude IV&V Services
The IV&V Contractor’s end-of-project activities include but are not limited to the following:
1. Organize all IV&V information to make it useful for staff who operate and maintain the HIX/IES system.
2. Confirm that all HIX/IES Project Deliverables and allIV&V Project Deliverables are up to date and finalized.
3. Prepare an archive of all documents related to IV&V activities.
4. Prepare a final report that summarizes expectations, opportunities, and challenges related to the new HIX/IES system.
5. Coordinate end-of-project activities with the HIX/IES SI Contractor and HIX/IES Entities for a transition to stable system operation and
maintenance.
III. IV&V Project Deliverables
The following section describes the major IV&V Project Deliverables expected from the IV&V Contractor for the tasks described in the previous section. Upon UMMS’
36 request, IV&V Contractor shall consolidate certain IV&V Project Deliverable
reports into one or more reports.
The IV&V Contractor shall provide the following IV&V Project Deliverables:
A. Manage the IV&V Responsibilities.
1. IV&V Services Project Management Plan
The IV&V Services Project Management Plan as described in detail in Part One – Specifications, Section 11. Scope of Work, II. Tasks, (A) Manage the IV&V Services.
2. IV&V Monthly Review and Assessment Report
The IV&V Contractor shall provide a Monthly Review and Assessment Reports whichdescribes key information in the IV&V tasks for which work was performed in such month and plans for the upcoming month. Key information includes, but is not limited to, activities performed, key or critical results, findings or issues identified as a result of the activities performed, IV&V Deliverables approved during such month, and an updated IV&V Services Project Management Plan with details of activities expected to be performed in the upcoming month. 3. Executive Team Briefings
ExecutiveTeam briefings shall be formal presentations by the IV&V Contractor to the ExecutiveTeam to illustrate and discuss Monthly Review and Assessment Reports. Briefings shall occur no less than five (5)
business days after the issuance of the reports in final form. 4. IV&V Weekly Status Reports
Status reports shall be generated on a weekly basis for the duration of the Contract and shall describe the ongoing status and progress of IV&V tasks, deliverables and issues.
5. Issue Tracking and Reporting Plan
All HIX/IES issues identified during the IV&V Services must be reported, tracked, and resolved according to defined procedures and methods. The IV&V Contractor shall develop an issue-tracking plan that outlines these elements:
a) Reporting methods
b) Issue tracking tool or tools c) Method for setting issue priority d) Procedures issue resolution 6. IV&V Dashboard
37 The IV&V Contractor shall provide a tool, such as a dashboard, that presents all HIX/IES Project Deliverables and IV&V Project Deliverables and their status. The dashboard should also present issues identified across the various tasks as well as the recommendations for resolution, the resolution itself, and the status of the issue. The tool shall permit the HIX/IES project management team to monitor progress toward resolution of issues and implementation of related recommendations.
B. Review all HIX/IES Project Deliverables. 1. HIX/IES Project Deliverable Review Reports
The IV&V Contractor shall produce a report for each iteration of each HIX/IES Project Deliverable submitted by the HIX/IES SI Contractor. Deliverable Review Reports shall list all defects, shortcomings, issues, and problems the IV&V Contractor finds in the HIX/IES Project Deliverables, as well as recommended corrective actions.
2. HIX/IES Project Deliverable Acceptance Criteria
The IV&V Contractor shall produce a list of acceptance criteria, as approved by the HIX/IES Entities, that must be satisfied in order for a HIX/IES Project Deliverable to be deemed complete.
3. HIX/IES Project Deliverable Review Checklists
The IV&V Contractor shall produce a list which includes the set of reviews that must be executed for all HIX/IES Project Deliverables, to ensure HIX/IES Project Deliverables are assessed consistently and completely.
4. HIX/IES Project Deliverable Outline Report
The IV&V Contractor shall produce a report that summarizes all the HIX/IES Project Deliverable outlines submitted for approval to the HIX/IES Entities.
C. Validate Automated Code Review Results 1. Automated Code Review Reports
The IV&V Contractor shall develop Automated Code Review Reports to communicate Automated Code Review results.
D. Validate Continuous Integration Review Reports 1. Continuous Integration Review Reports
38 The IV&V Contractor shall develop appropriate reporting mechanisms to communicate continuous integration review resul
