state of arkansas office of state procurement on behalf of ......jennifer tillery, analyst...

of 24

State of Arkansas

Office of State Procurement on Behalf of

the Department of

Health

Response to Bid Number: SP-20-0115

Statewide Contact Tracing Management System

June 19, 2020

Submission from WellSky Corporation in partnership with Guidehouse as subcontractor

WellSky Corporation 11300 Switzer Road Overland Park, KS 66210 855.WELLSKY wellsky.com

DocuSign Envelope ID: 092A39AE-DDC5-41D8-A50C-34F4F4BBEB48

SP-20-0115 Response Packet Page 2 of 24

RESPONSE PACKET SP-20-0115



PROPOSAL SIGNATURE PAGE

PROSPECTIVE CONTRACTOR INFORMATION

Company: WellSky Corporation

Address: 11300 Switzer Rd AR Vendor # (if known)

City: Overland Park State: KS Zip Code: 66210

Business Designation:

☐ Individual ☐ Sole Proprietorship

Corporation

☐ Public Service Corp

☐ Partnership ☐ Non- profit

Minority and Women- Owned Designation*:

Not Applicable

☐ American Indian ☐ Service-Disabled Veteran

☐ African American

☐ Hispanic American

☐ Women-Owned

☐ Asian American

☐ Pacific Islander American

AR Certification #:

* See Minority and Women-Owned Business Policy

PROSPECTIVE CONTRACTOR CONTACT INFORMATION

Contact Person:

Anthony DeCarolis Title: Regional Account Manager

Phone: 703-657-1485 Alternate Phone: 484-410-9753

Email: [email protected]

CONFIRMATION OF REDACTED COPY

☐ YES, a redacted copy of submission documents is enclosed.

NO, a redacted copy of submission documents is not enclosed. I understand a full copy of non-redacted submission documents will be released if requested.

ILLEGAL IMMIGRANT CONFIRMATION

By signing and submitting a response to this Solicitation, a Prospective Contractor agrees and certifies that they do not employ or contract with illegal immigrants. If selected, the Prospective Contractor certifies that they will not employ or contract with illegal immigrants during the aggregate term of a contract.

ISRAEL BOYCOTT RESTRICTION CONFIRMATION

By checking the box below, a Prospective Contractor agrees and certifies that they do not boycott Israel, and if selected, will not boycott Israel during the aggregate term of the contract.

Prospective Contractor does not and will not boycott Israel.



PROPOSAL SIGNATURE PAGE (continued) An official authorized to bind the Prospective Contractor to a resultant contract shall sign below.

The signature below signifies agreement that any exception that conflicts with a Requirement of this Solicitation will cause the Prospective Contractor’s proposal to be rejected.

Authorized Signature: ________________________________ Title: Senior Vice President

Printed/Typed Name: Stephen Greenberg Date: 6/19/20



INFORMATION FOR EVALUATION

● Prospective Contractors should provide a response to each item/question in this section. Prospective Contractors may expand the space under each item/question to provide a complete response.

● Prospective Contractors may also use a separate form. If using a separate form, Prospective Contractors

shall clearly and distinctly identify the section and item (i.e., E.1.A).

● Responses for each item must be limited to three hundred (300) words. Prospective Contractors should not include additional information if not pertinent to the itemized request.

Maximum

RAW Score

Available

E.1 EXPERIENCE AND QUALIFICATIONS

A. Describe previous or current engagements performed by your organization within the last three (3) years of similar size and scope to those described in the Solicitation that demonstrate your organization’s capability to perform all services required in the Solicitation. For each engagement referenced, provide the entity name, contact information (including contact name and email address), contract term dates, and geographic area serviced.

WellSky and Guidehouse offer deep experience, essential skills and capacity to rapidly scale contact tracing resources for COVID-19. Our references demonstrate our ability to deliver:

● Staffing Scale: Positioned to deploy a local workforce pool, comprising over 5,000 culturally and linguistically diverse Arkansas caregivers

● In Person and Local: Ability to supplement telephonic with in-person contact tracing and wraparound social support with presence in 53 of 75 Arkansas counties

● Technology that Promotes Transparency. Our deployment-ready workforce already uses WellSky’s proven technology, which powers training, tracing protocols, automated engagement, support coordination, and reporting



Current and Previous Engagements

Engagement Size /

Duration

Contact

Amedisys: Nation’s Largest Home

Healthcare Provider

✓ Contracted 600+ agencies representing 50,000+ caregivers in 30 days, growing to 1,400+ agencies today.

✓ Integrates 20,000+ nurses with 130,000+ in-home caregivers, including protocols for care coordination, change-in-condition reporting and triage, care initiation, clinically informed risk assessments and decision support.

✓ Enables Amedisys centralized care management center to authorize and dispatch care to patients across the contracted network of caregivers across 50 states

National 2019 –

Present

Paul Kusserow, CEO 615-928-5460 [email protected]

State of Arkansas ✓ Comprehensive review and validation of

the Initial State Transformation Plan based on qualitative analysis and consultation with Guidehouse Subject Matter Experts.

✓ Delivered recommendations empowering the State to cement long term impact.

State of Arkansas June 2018 - January 2019

Upon Request

University of Alabama at Birmingham Medicine: Call Center ✓ Provision of exemplary customer service

to patients and constituents.

Southeast U.S. 2016 - Present

Sandra Peterson Executive Director, Revenue 205-731-9744 [email protected]

U.S. Administration for Community Living

✓ Deployment of online platform all states use to report data for vulnerable populations, informing reports to Congress.

✓ Provision of telephonic assistance on reporting protocols to national user base.

National 2006 – Present

Jennifer Tillery, Analyst 202-795-7275 [email protected]



B. Include experience implementing and operating contact tracing systems.

WellSky’s clinical and operational case management resources are directly transferable to the referral intake, participant engagement and coordination needed to offer end-to-end COVID-19 response. We bring a local, Arkansas workforce of over 5,000 empathetic, trained, culturally and linguistically diverse individuals that can be activated in 5 days. Our approach is supported by our team’s direct experience serving as contact tracers with the CDC. WellSky’s connected customer base uniquely brings scale and experience in delivering contact tracing and case management programs each and every day.

Required Capabilities Experience

New case / contact outreach

Daily experience rapidly responding to new referrals and case management intervention requests to capture key information on patient profile, care team, family contacts, patient assessment, and care needs

Protocol execution Daily experience executing specific scripts and tasks on every patient interaction, securely capturing all information in the WellSky system:

● Patient engagement protocols ● Change-in-condition reporting and escalation to

case management or other clinical staff ● Care coordination protocols with healthcare and

community providers ● Collecting and documenting patient consent ● Assessment completion and documentation ● Assistance with activities of daily living and

instrumental activities of daily living

In-person support Daily experience delivering in-person, in-residence support services to vulnerable population

Local experience Caregivers are hired from within the communities they serve, experience with local events, culture, and customs. Home care agencies are trusted community partners

Confidentiality / Privacy Experience managing HIPAA compliance; data securely entered into WellSky HITRUST-certified system

5 points



C. Include the size of the system installation, a brief description of the solution provided, and the methodology employed.

The WellSky methodology leverages a pre-existing, local workforce that operates on a familiar WellSky technology platform that drives and manages the daily workflows of over 600,000 caregivers nationally. Implementation risk and time-to-scale is materially reduced by leveraging the installed base of the technology-powered network. In Arkansas, the system is used by over 5,000 care providers under the supervision of agency care and case managers. Across the network, WellSky infrastructure and programmatic capabilities enable us to:

● Contractually mandate ADH contract tracing requirements and protocols ● Deliver and monitor training and testing per ADH requirements ● Drive specified protocols for:

○ (i) telephonic contact tracing and case investigation ○ (ii) in-person contact tracing and case investigation ○ (iii) automated contact and case engagement via email, text message, or telephony ○ (iv) wraparound social support

● Determine eligibility for any integrated services ● Collect data and deliver reporting and analytics ● Support reimbursement and payment integrity.

Our workflow system and telephony-based technologies are interoperable and have the capacity for bi-directional communication across disparate platforms and constituents.

5 points

D. Include experience staffing and managing a call center utilizing remote staff with outbound unsolicited call experience specifically for health care related phone-based education.

Guidehouse has over 20 years of experience and a foundational business model that is built to leverage remote and/or onsite staff. Currently, 100% of our call center resources are working in a remote setting. We partner with healthcare provider organizations across the nation providing inbound / outbound call center services. We conduct over 3,900,000+ outbound calls and 894,000+ inbound patient calls annually. All of Guidehouse’s call center services are fully compliant with federal and state mandates, inclusive of HIPAA and TCPA.

5

points



As noted, our network scale in Arkansas is a multiple of the anticipated need for contact tracing. These care providers are trained and accustomed to engaging vulnerable populations in emotionally fraught situations to rapidly build trust. By working with Guidehouse and WellSky, ADH can ensure more Arkansans are employed first and work is not outsourced outside of Arkansas where possible. On a daily basis, staff provide services and education on complex personal and health topics, such as assistance with activities of daily living, services to remain independent in the home, and even end-of-life planning. WellSky’s technology platform is the backbone needed to deliver and monitor contact tracing, case investigations, and authorized wraparound social support. Our Care Coordination “control tower” and “teleprompter”, power a secure web-based platform to ensure call center staff are following ADH’s telephonic protocols, while leveraging the caregivers’ skills and experience in building empathetic, trusted relationships.

E. Include experience providing phone-based education about government agency program topics.

WellSky and Guidehouse bring extensive experience in:

• Directly working with patients and families to identify and establish eligibility for government programs,

• Enabling care professionals to educate citizens and connect them with governmental programs

Guidehouse Managed Services team members have extensive experience working with patients to identify and establish eligibility for government programs, inclusive of Medicaid and other charity and disability programs. These services are supported via both in-person and call center resources. WellSky’s network of over 5,000 caregivers in Arkansas are uniquely knowledgeable about government agency programs, particularly programs for supportive and wraparound services, as they work directly with citizens who are the most in need of support every day and typically receive services from government programs. Providing education on these topics and connecting citizens to resources is a natural extension of the care they provide daily. In the context of Medicaid, VA benefits, programs administered by Area Agencies on Aging, and other government programs, care and case managers in the WellSky network regularly provide counseling to vulnerable patients and their families regarding the most sensitive of topics and planning, including support for dementia care and functional limitations such as eating, drinking, toileting, bathing, and ambulation.

5 points



To illustrate WellSky’s ability to provide education, a recent example of a comparable program, as part of its national contract with Amedisys, WellSky distributed protocol training as defined by Amedisys requirements to contracted agencies (ex. protocols for coordination between personal care and home healthcare; requirements for patient engagement; change in condition reporting). In total WellSky delivered training to 1,400+ community-based health care agencies employing 130,000+ caregivers serving a diverse, vulnerable, complex, and underserved national patient base. As clinically appropriate, patients are counseled on the potential need for non-clinical personal care or for home healthcare, among other interventions.

F. Include experience providing report documentation for phone-based interviews.

Over 4,000 personal care agencies employing over 20,000 care and case managers and 600,000 caregivers use a variety of phone-based assessments and interview documentation. Examples include: ● Collection of patient and care team contact information ● Initial engagement documentation ● Needs assessments for clinical and non-medical care ● Functional limitations assessments ● Social determinants of health (SDoH) assessments ● Medication lists and schedules ● Social support assessments ● Telephony-enabled and recorded electronic signatures Guidehouse Managed Services: For compliance, training / education, and issue resolution purposes, Guidehouse’s call center system is capable of recording 100% of inbound and outbound calls, and captures team member ID, credentials, phone numbers and additional information for all calls. Call logs and recordings are indexed and organized by date, line and agent for research capability, and are stored for a minimum of seven years. In addition, we have a fully customizable customer satisfaction survey offered to all phone-based interviews to track, measure, and report on customer satisfaction and identify opportunities for remediation, performance improvement and ongoing training and development with the staff. Furthermore, the call recordings and customer satisfaction survey results are part of our extensive quality assurance (QA) processes. In addition, our call center leadership participate as active listeners on a sample of all agent calls to listen real-time in order to

5 points



further ensure quality, patient centric interactions and identify additional needs for training and development

G. Include experience managing staffing levels for onsite and remote staff where workload fluctuations were constant.

The WellSky - Guidehouse offering is unique as it leverages existing and idle capacity among a workforce of 5,000+ local, in-home care providers in Arkansas. With individuals located in 53 of Arkansas’ 75 counties, the WellSky network is scalable to meet and exceed AHD’s staffing requirements. The workforce is accustomed to delivering services as work is available to readily scale up or down, as needed. Moreover, the 35+ local providers employing this workforce are a “chassis” by which additional contact tracers, case investigators, and social support providers may be employed. The WellSky – Guidehouse partnership will leverage our best practice approach to call center resource management. In developing the staffing complement for fluid volumes, we partner with our clients to develop expected, reasonable ranges of demand, and we structure and deploy our staffing based on the predicted demand. Inherent within our solution, we develop redundant staff to help with surges in capacity. Furthermore, we continuously measure and monitor call volumes, rhythms, and cadence over time to identify any and all trends, (e.g., peak call days and times). We continuously refine the number and timing of resources deployed to best anticipate call volumes and demand. In addition, our call center resources will be 100% dedicated to supporting this partnership and will not be assigned to other clients. This continuity of service establishes consistency in the relationship and collaboration between our team and all key constituents. The commitment to dedicated, consistent resource investment promotes continuous improvement and advanced learning as we accomplish our mutual goals and objectives.

Screenshot below shows our surge modeling tools which provide insights into the various resources needed and available to address supports for testing and quarantine.

5 points



E.2 CALL CENTER CAPABILITIES

A. Discuss your organization’s capabilities in providing overall operation and management of a call center for ADH that utilizes remote staff.

Guidehouse Managed Services:

Guidehouse has provided call center services for over 20 years to more than 300 healthcare providers of varying types, sizes, and geographies. Our call center services are focused on the key principles of exemplary customer service, one call resolution, real-time flexibility, and continuous improvement. Our annual inbound and outbound call volumes are approximately 4,800,000+.

Furthermore, due to COVID-19 pandemic, Guidehouse successfully transitioned 100% of our contact center staff to a work-from-home environment. By ensuring compliance with internal operational controls, compliance protocols, and legal standards, as well as collaborating with compliance departments across dozens of our clients, the call center organization enjoys strong, compliant, remote operational controls with the physical environment, staff productivity, staff performance quality, and

5 points



training, as well as adherence to the appropriate, federal guidelines, including HIPAA and TCPA.

Veterans Affairs (VA) Office of Community Care (OCC)

In 2016, Guidehouse was engaged by the VA to support a large-scale transformation for the OCC. OCC is VA’s national office that manages the purchase of healthcare services from the private sector for a significant portion of the 9.1 million Veterans enrolled in VA’s healthcare program.

Guidehouse’s customer experience services included supporting the stand-up of both the Community Care Contact Center (C4) and Community Care Clinical Coordination Contact Center (C6). Guidehouse also provided project support for the corresponding IT projects, Community Care Enterprise Contact Center (CCECC), CommCare Customer Relationship Management (CRM) and Knowledge Management System (KMS).

C4 provides Veteran support, handling calls, Adverse Credit Reporting (nationwide), and claims for Veterans Integrated Service Network (VISN), as well as programs to Veterans and family for benefits. Due to COVID-19, almost all C4 staff have been remote. C6 was established to improve the customer experience for Veterans that are drive time or hardship eligible, or Veterans who seek community care exclusively.

B. Discuss training methods your organization employs for all call center workers whether onsite or remote.

WellSky Network Experience and Training WellSky is differentiated in that its network workforce pool of over 5,000 caregivers in Arkansas is trained to execute protocols as part of case management interventions to vulnerable populations. As part of their regular work, they are accustomed to building trust in emotionally intensive situations similar to the intensity experienced by COVID-19 cases and contacts, and to maintaining privacy of healthcare information. Moreover, as regular users of WellSky technology, they are already trained in the systems powering the contact tracing, case investigation, and social support protocols. The WellSky learning management system (LMS) is already deployed across the network of over 5,000 individuals. WellSky can readily deploy and monitor for completion of electronically distributed contact tracing training programs, such as that provided by Johns Hopkins or ASHTO. WellSky can additionally distribute testing and ensure that only those individuals who have passed the tests can be assigned to cases or contacts.

5 points



If in-person training is needed, WellSky can utilize a “train the trainer” program, leveraging the care managers and social workers who manage the workforce at a local level. Guidehouse Managed Services All Guidehouse staff go through a complex training and onboarding curriculum. This consists of classroom based, online, didactic, and other learning vehicles. Prior to being transitioned to project-based training, our team members are subject to 100% quality audit evaluation as they progress through the training cycle. As the team members transition to live-production, supervisors provide ongoing QA until representatives display sustained 95% accuracy, then staff transitions to our standard monthly QA audit process. Guidehouse’s training and education platform includes more than 85 courses with more than 240 hours of education. In addition, we conduct monthly training and education sessions driven by opportunities and lessons learned via our call recordings and ongoing QA process.

E.3 CONTACT TRACING CAPABILITIES

A. Discuss training methods your organization employs for in-person, home visit Contact Tracing.

The WellSky network is notable and distinguished for being already trained and deployed in local communities around Arkansas for a variety of case management programs, including the provision of in-home visits and social support. This workforce comprises over 5,000 individuals in 53 of Arkansas’ 75 counties. Training and protocols per the case management plan are followed, tracked and managed in the WellSky system. Therefore, the WellSky-Guidehouse offering is already significantly differentiated in the level of training, locale, enablement, and technology-monitored protocol delivery. The WellSky network is already trained in risk management by virtue of its role in the provision of in-home care to vulnerable and COVID-positive populations. The in-home care industry has oriented to guidelines from the CDC and from the Home Care Association of America for risk mitigation and use of PPE in engaging COVID-positive individuals in their homes. WellSky can reinforce the workforce training distributed via its LMS platform. To compliment the training, the WellSky platform delivers prompts upon arrival to the home of a case or contact. The contact tracer or case

5 points



investigator is prompted:

✓ To verify location via GPS upon arrival ✓ With instructions on proper protocols upon clock in ✓ To attest to the following of safety protocols as part of the encounter

reporting. In this way, the specified protocols are not only trained upon, but are embedded into and tracked within the WellSky system as part of the daily workflows of the contact tracers and case investigators.

Finally, WellSky’s network includes local care and case managers who help supervise and train the contact tracing and case investigator field staff. Their efforts are complemented by WellSky’s learning management system, which distributes training and testing programs. Completion of these programs is monitored and required within the WellSky system before contact tracers/investigators can perform the work.

B. Discuss training methods your organization employs to ensure all workers have full knowledge of HIPAA requirements.

The in-home care industry is long accustomed to HIPAA compliance in its day-to-day operations. Moreover, the WellSky LMS contains training and testing on HIPAA compliance. Finally, the WellSky platform itself used for data collection is HIPAA compliant and HITRUST certified. HITRUST comprises a 3rd party independent review of over 300 operational and technical security controls, including for HIPAA and HITECH compliance. Guidehouse Managed Services All Guidehouse team members, regardless of role and/or position, participate in Corporate Compliance, HIPAA Privacy and Security training, and targeted education on key healthcare industry laws and regulations. Compliance and privacy orientation is provided at the time of hire and annually thereafter. Additionally, throughout the year, methods of alternative education are offered through newsletters, emails, and special presentations.

5 points

C. Discuss management and oversight processes your organization employs to ensure full HIPAA compliance.

HIPAA compliance is part of the day-to-day operating protocols of the in-home care industry. Individual contact tracers and care managers are supervised by local care managers and social workers who regularly train

5 points



on and monitor for HIPAA compliance, among other protocols.

Moreover, all data is captured in a secure, web-based interface via the WellSky platform, which is itself HIPAA compliant and HITRUST certified. HITRUST comprises a 3rd party independent review of over 300 operational and technical security controls, including for HIPAA and HITECH compliance.

Guidehouse Managed Services

HIPAA compliance is part of all Guidehouse team members daily operating procedures. Guidehouse Operational Leadership monitors team members account activities for HIPAA compliance. In addition, Guidehouse Compliance coordinates various internal audits and surveys with Guidehouse Operational Leadership to verify team members’ adherence to and increase awareness of HIPAA compliance.

D. Describe processes your organization uses to rapidly disseminate and implement programmatic and operational changes to all personnel.

The WellSky platform is powered by a highly configurable workflow engine. Task assignment, operating rules and protocols, scripts, and data collection forms can be rapidly configured and modified, as needed, and thereafter immediately disseminated across the workforce. New protocols can be communicated and deployed automatically.

Additionally, contact tracers, case investigators, and social support providers are supervised by local agency care managers, case managers, or social workers. These leaders are engaged in “train the trainer” programs by which they can rollout and monitor performance relative to programmatic and operational changes.

Because all aspects of the program are enabled on a technology infrastructure, WellSky and Guidehouse will provide modeled insights into the local case prevalence and impact on market communities of health throughout the state that will focus the contact tracing investigators on the current hot spots.

5 points




Our technology is highly, easily customizable and can be deployed universally or targeted to specific processes, client environments, etc. In addition, we conduct weekly in-services with the call center team, covering trends, issues, remediations, programmatic and workflow changes. Furthermore, our supervisors have daily “touchpoints” with all remote call center employees.

Our processes include real-time QA calls where call center leadership listens in on active patient interactions with remote call center employees to identify opportunities for improvement, examples of exemplary customer service, and develop training / education curriculum.

E. Describe your organization’s capabilities in communicating with individuals who speak languages other than English. Include all languages your organization is able to provide.

The WellSky network workforce pool of 5,000+ individuals comprises native speakers of a broad variety of languages. The WellSky network can provide tracers speaking the following languages: English, Spanish, French, German, Russian, and Mandarin. To the extent a language is known upfront, referrals will be automatically routed to contact tracers or case investigators fluent in the language. If language is not known upfront, a question about language spoken will be the first for non-English speakers, and the case will be reassigned accordingly. WellSky and Guidehouse will provide the investigators local, modeled insights to inform the most common spoken languages in a local market where hot spots are occurring in order to ensure adequate support the required language. Guidehouse Managed Services Guidehouse has bilingual staff throughout our call center. For languages other than English and Spanish, we currently partner with LanguageLine to support a wide range of language requirements. For hearing impairment, Guidehouse works with our clients to identify requirements and then selects a solution that meets your needs.

5

points

E.4 COMMUNITY HEALTH CARE

B. Describe your organization’s experience and capabilities in training and collaborating with community-based health care programs and initiatives.

5 points



WellSky regularly delivers training and testing for a variety of programs via its embedded learning management system (LMS) to over 600,000 caregivers. Example programs include patient engagement protocols; change-in-condition protocols; care coordination protocols; procedures for collecting and documenting patient consent; and protocols for specific assessments (e.g., functional limitations or home safety assessments).

A recent example of a comparable program, as part of its national contract with Amedisys, WellSky distributed protocol training as defined by Amedisys requirements to contracted agencies (ex. protocols for coordination between personal care and home healthcare; requirements for patient engagement; change in condition reporting). In total WellSky delivered training to 1,400+ community-based health care agencies employing 130,000+ caregivers serving a diverse, vulnerable, complex, and underserved national patient base.

Department of Veterans Affairs (VA), Office of Community Care (OCC)

For OCC, Guidehouse provides a full complement of training services, including training strategy, training product design and development, Section 508 accessibility compliance, training evaluations, web site development and maintenance, and training conference services. To-date, our team has delivered over 240 training artifacts with greater than 2 million course completions. Training has been for both VA staff and private sector community providers and has covered all capabilities required for Veterans to receive and pay for care received from community providers. The scope has included: eligibility, referrals and authorizations, care coordination, provider network development, provider payment, revenue operations, and utilization management. Guidehouse has provided a full-time training team of approximately 15-20 resources over the past 4 years. The overall Guidehouse team supporting OCC has included approximately 125+ resources on average over the past 4 years.


Our team members work with patients to establish eligibility for government programs, inclusive of Medicaid and other charity and disability programs. These services are supported via both in-person and call center resources.

C. Describe your organization’s experience and capabilities working with and providing services for the underserved and populations or groups with health disparities

The WellSky personal care provider network served over 1,500 patients in 2019 in low income and underserved communities under the Medicaid Waiver programs in Arkansas. Nationally, the WellSky personal care

5 points



provider network served over 130,000 patients in 2019 in low income and underserved communities under the Medicaid Waiver programs.

In Arkansas, 8 of the 9 Area Agencies on Aging (AAAs) in the State use WellSky’s Aging and Disability platform to manage its Older Americans Act program. as well as bill Medicaid waiver services using the A&D claims feature. Some AAAs also administer VA programs. In total, there are 189,727 active consumers in the system as of today.

Department of Veterans Affairs (VA), Office of Community Care (OCC)

Our Guidehouse partners are engaged by the Department of Veterans Affairs (VA) to support a large-scale transformation for the Office of Community Care (OCC), impacting 9.1 million Veterans enrolled in VA’s healthcare program. The Community Care Program is VA’s first nation-wide contract transition at this scale. Leveraging both public sector and commercial expertise, Guidehouse implemented a standardized release management strategy and national deployment process across 140 VA hospitals impacting approximately 1,700 sites of care maintained by a workforce of over 300,000 along with hundreds of thousands of private sector provider network participants.

E.5 DATA MANAGEMENT AND SECURITY

A. Discuss strategies and practices your organization proposes to complete employee technology verification and vetting to ensure potential hires possess adequate technology infrastructure (phones, computers, etc.), phone access, and internet access. If your organization intends to provide necessary technology infrastructure to contact tracers, please describe how your organization will accomplish this.

WellSky remote contact tracers and case investigators are equipped with laptops and mobile phones as a condition of participation. Guidehouse and WellSky provide headsets to all contact tracers and case investigators to ensure audio quality. All data is collected via WellSky’s secure, HITRUST certified, web-based infrastructure.

Contact tracers, case investigators, or in-home care and social support providers are required to have a GPS-enabled mobile device. The WellSky platform is equipped to use GPS verification at clock-in and clock-out of the encounter to verify that the provider is at the known location of the case or contact.

Because all contact tracers, case investigators, and in-home care providers

5 points



are employees of local agencies, the local agency is contractually required to take accountability for verifying that each member of the workforce is equipped with the necessary technology and record verification within the WellSky platform for all assigned personnel.

B. Discuss your organization’s strategies for providing redundancy, fault tolerance, and an uptime of 99.9% annual website availability.

The WellSky platform is designed to be highly available, redundant, and fault tolerant. For example, the WellSky platform includes:

● Hosting in AWS, which is SOC 2 certified ● Services deployed across 3 isolated AWS availability zones (data centers) ● Fully automated environment setup and deployment processes ● Stateless and horizontally scalable application architecture ● Redundancy at critical architectural layers and components (load balancers, application servers, databases etc.) ● 24x7 monitoring and incident response process ● No downtime maintenance/upgrades ● Point-in-time backups ● Geographically distributed redundant backups ● Remote-enabled support and business functions

Guidehouse Managed Services Similarly, the Guidehouse service centers have redundant ISP connections, ensuring operational continuity in the event of provider outages. We are able to resolve most technical issues in less than 1 hour provided they are within our technology and control. We partner with our clients to ensure our teams have IT escalation plans, allowing our teams to report and work with our clients to resolve technical issues or outages outside of our infrastructure. We are up 99.9% of the time.

5

points

C. Describe the processes employed by your organization to ensure Contract Tracing personnel can capture and transmit protected health information (PHI).

Contact Tracing services will be hosted as a secure application where Tracers access and submit tracing data via secure portal that leverages the key platform security and privacy controls detailed in section E below. Tracers receive new case or contact trace information securely within the WellSky platform after it is transmitted or uploaded by ADH systems or staff. Case investigation and contact tracing interview information, including any PHI, is

5

points



securely entered into the WellSky platform. Once data is entered into the platform, it is available for secure access directly by ADH personnel or for secure integration to other systems. Today, the WellSky platform used in contact tracing, case investigation, and wraparound social support, is trusted by over 4,000 in-home care based agencies, employing over 600,000 care managers, social workers, and caregivers, including 8 of the largest 10 personal care agencies in the United States. WellSky is committed to ensuring that all identifiable personal information, including protected health information (PHI), that users provide to the platform is handled in an appropriate manner and in compliance with all applicable data privacy and security laws. Guidehouse Managed Services Our IT Security Protocols are in accordance with HIPAA safeguards, which cover the three main areas below: 1. Physical Safeguards: Physical safeguards refer to how the actual physical access to devices that store PHI is handled. 2. Technical Safeguards: The technical safeguards portion of the compliance refers to the technical aspects of networked computers and devices that communicate with each other and contain PHI in their transmissions. 3. Administrative Safeguards: The administrative safeguards cover how organizations must set up their employee policies and procedures to comply with the Security Rule.

D. Describe your organization’s level of understanding and experience working with the privacy and security practices and processes as defined by the National Institute of Standards and Technology (NIST) and Health Information Technology for Economic and Clinical Health (HITECH).

WellSky has deep familiarity with and adherence to the privacy and security practices defined by NIST and HITECH. WellSky’s operates a secure, HIPAA compliant and HITRUST certified web-based platform. HITRUST comprises a 3rd party independent review of over 300 operational and technical security controls, including for HIPAA and HITECH compliance. Based on guiding principles from the HITRUST Common Security Framework (CSF) and the NIST Cybersecurity Framework, some key built-in platform security & privacy controls include:

5 points



● Principle of Least Privilege - Access to servers and services is centrally managed and requires authentication. Access roles/ permissions are issued based on the principle of least privilege access. ● Multi-Factor Authentication - The WellSky infrastructure is divided into public and private subnets. Servers and resources are not addressable from the internet. Access to WellSky servers from outside is limited to very few ingress points in the public subnet that require multi-factor authentication. ● Data Encryption - Data is encrypted at rest (AES-256), as well as in transit (SSL/TLS) to protect the data at all times. ● Firewalls – WellSky leverages AWS security groups (aka network firewalls) extensively to control all network traffic as well as web application firewalls. ● Systems Hardening AND Patch Management – WellSky makes extensive use of immutable infrastructure such as Docker images built from hardened systems to run the application. Additionally, images are regularly updated with the latest patches to ensure that WellSky’s systems have the latest security patches. ● Secure Application Coding - WellSky employs secure coding practices (ex: OWASP best practices) and code reviews in the application development process. ● Security Monitoring – WellSky uses a variety of security monitoring tools, including ThreatStack network monitoring and Veracode static code analysis for vulnerabilities.

• SOC 2 Certified Data Center - WellSky SaaS platform is hosted in AWS, which is SOC-2 certified

E.6 IMPLEMENTATION

A. Discuss your organization’s plan for completing implementation by July 1, 2020. Include a timetable of implementation activities your organization proposes for implementation and the activities expected to be completed by ADH.

Guidehouse and WellSky are equipped to deploy the initial set of telephonic Contact Tracers for ADH via the Guidehouse call centers by July 1, 2020. Subsequent scaling among the pool workforce of 5,000+ employees across the WellSky network of providers in Arkansas will be as described below, and potentially earlier, pending the timing of notification of engagement to Guidehouse and WellSky by ADH. See below for timetable, wherein “T” is the date of contracting with ADH. T + 5 Days:

5

points



Configuration of contact tracing and case investigation workflows in the WellSky platform, per ADH protocols, including training; teleprompter for operational protocols for contact tracing and case investigation; exception handling; and data reporting. The WellSky platform is used by 39 home-based agencies with a workforce of over 5,000 employees in Arkansas. T + 5 - 60 Days: Rapid scaling of the Arkansas contact tracing and case investigation program according to volume demands.

State of Arkansas – Arkansas Department of Health Statewide Contact Tracing Management System – BID SP-20-0115

Exceptions Page

Document & Section Number

Current Language Proposed Revision Justification

Emergency Procurement Solicitation Document, Section 3 Subsection 13. Patent or Copyrights

The Contractor shall indemnify and hold the State harmless from all claims, damages and costs including attorneys' fees, arising from Contractor’s infringement of patents or copyrights.

The Contractor shall indemnify and hold the State harmless from all claims, damages and costs including attorneys' fees, arising from Contractor’s infringement of any currently existing U.S. patents or copyrights.

WellSky’s proposed solution is solely for the State’s use in the U.S., so WellSky seeks to limit the indemnification obligation accordingly.

Emergency Procurement Solicitation Document, Section 3

Any contract entered into pursuant to this solicitation shall not be assignable nor the duties

Any contract entered into pursuant to this solicitation shall not be assignable nor the duties thereunder delegable by either

WellSky requests flexibility with regard to assignment in the event of a



Subsection 14. Assignment

thereunder delegable by either party without the written consent of the other party of the contract.

party without the written consent of the other party of the contract. Notwithstanding the foregoing, Contractor may assign this Agreement to an affiliate or in connection with any merger, reorganization, or sale of substantially all of WellSky’s assets or other change of control transaction without any consent from the State.

sale, provided such sale would not disrupt the continuation of WellSky’s business.


2020-06-19T06:50:21-0700Digitally verifiable PDF exported from www.docusign.com

state of arkansas office of state procurement on behalf of ......jennifer tillery, analyst...

Documents