state of vermont bidder response form€¦ · web viewprovide the information requested in this...

Exhibit C

State of Vermont Bidder Response Form

Request for Proposal Name: COMPREHENSIVE CORRECTIONAL HEALTHCARE SERVICES

Page | 2State of Vermont Enterprise Project Management Office 6/12/17


Vendor Instructions:

Provide the information requested in this form and submit it to the State of Vermont as part of your Request for Proposal (RFP) response. All answers must be provided within the form unless otherwise specified.

Important: This form must be completed and submitted in response to this RFP for your proposal to be considered valid. The submission must also include the eight (8) additional artifacts requested within this form (denoted by underlined green font).

See the RFP for full instructions for submitting a bid. Bids must be received by the due date and at the location specified on the cover page of the RFP.

Direct any questions you have concerning this form or the RFP to:

Stephen Fazekas, Technology Procurement Administrator State of Vermont

Office of Purchasing & Contracting 109 State Street

Montpelier VT 05609-3001E-mail Address: [email protected]



Part 1: VENDOR PROFILE

1. Complete the table below.

Item Detail

Company Name: [insert the name that you do business under]

Physical Address: [if more than one office – put the address of your head office]

Postal Address: [e.g. P.O Box address]

Business Website: [url address]

Type of Entity (Legal Status):

[sole trader/partnership/limited liability company or specify other]

Primary Contact: [name of the person responsible for communicating with the Buyer]

Title: [job title or position]

Email Address: [email]

Phone Number: [landline]

Fax Number: [fax]

2. Provide a brief overview of your company including number of years in business, number of employees, nature of business, and description of clients. Identify any parent corporation and/or subsidiaries.

3. Is your organization currently or has it previously provided solutions and/or services to any agency or entity of the Vermont State government? If so, name the State entity, the solution and/or services provided, and the dates.

State of Vermont Bidder


4. Provide a Financial Statement* for your company and label it Attachment #1 . A confidentiality statement may be included if this financial information is considered non-public information. This requirement can be filled by:

A current Dun and Bradstreet Report that includes a financial analysis of the firm; An Annual Report if it contains (at a minimum) a Compiled Income Statement and Balance Sheet verified by a Certified

Public Accounting firm; or Tax returns and financial statements including income statements and balance sheets for the most recent 3 years, and any available

credit reports.

*Some types of procurements may require bidders to provide additional or specific financial information. Any such additional requirements will be clearly identified and explained within the RFP, and may include supplemental forms in addition to this Bidder Response Form.

5. Disclose any judgments, pending or expected litigation, or other real potential financial reversals, which might materially affect the viability or stability of your company or indicate below that no such condition is known to exist.

6. Provide a list of three references similar in size and industry (preferably another governmental entity). References shall be clients who have implemented your Solution within the past 48 months.

Reference 1 Detail

Reference Company Name: [insert the name that you do business under]

Company Address: [address]

Type of Industry: [industry type: e.g., government, telecommunications, etc.]

Contact Name: [if applicable]

Contact Phone Number: [phone]

Contact Email Address: [email]

Description of system(s) implemented:

[description]

Date of Implementation: [date]



Reference 2 Detail








[description]


Reference 3 Detail








[description]




PART 2: VENDOR PROPOSAL/SOLUTION

1. Provide a description of the technology solution you are proposing.

2. Provide a description of the capabilities of the technology solution you are proposing.

3. If a proprietary software is being proposed, provide a description of the:A. Standard features and functions of the software:

B. The software licensing requirements for the solution:

C. The standard performance levels: Hours of system availability: System response time: Maximum number of concurrent users: Other relevant performance level information:

4. Give a brief description of the evolution of the system/software solution you are proposing. Include the date of the first installed site and major developments which have occurred (e.g. new versions, new modules, specific features).

5. List the total number of installations in the last 3 years by the year of installation.

6. Provide the total number of current users for the proposed system and indicate what version they are using.

7. Have you implemented the proposed solution for other government entities? If so, tell us who, when, and how that implementation went?

8. Provide a Road Map that outlines the company’s short term and long-term goals for the proposed solution/software and label it Attachment #2.

9. Provide a PowerPoint (minimum of 1 slide and maximum of 10 slides) that provides an Executive level summary of your proposal to the State. Label it Attachment #3.

10. Does your proposed solution include any warranties? If so, describe them and provide the warranty periods.

Page | State of Vermont Enterprise Project Management Office


11. Describe any infrastructure, equipment, network or hardware required to implement and/or run the solution.

12. What is your recommended way to host this solution?

13. Describe how your solution can be integrated to other applications and if you offer a standard-based interface to enable integrations.

14. Respond to the following questions about the solution being proposed:

Vendor Response/ExplanationQuestion Yes or

NoA. Does the solution use Service Oriented Architecture for

integration?B. Does the solution use a Rules Engine for business

rules?C. Does the solution use any Master Data Management?D. Does the solution use any Enterprise Content

Management software?E. Does the solution use any Case Management software?F. Does the solution use any Business Intelligence

software?G. Does the solution use any Database software?H. Does the solution use any Business Process

Management software?I. Is this a browser based solution and if so what

browsers do you support?J. Does the solution include an API for integration?



PART 3: FUNCTIONAL REQUIREMENTSThe table below lists the State’s Functional Requirements. Indicate the “Availability” for each requirement for your proposed solution. Use the “Vendor Comments” column to provide any additional information or explanations.

A - Feature is available in the core (“out-of-the-box”) solution.D - Feature is currently under development (indicate anticipated date of availability in the “Vendor Comments” column).C - Feature is not available in the core solution, but can provided with customization.N - Feature is not available.



ID#

Functional Requirement Description Availability Vendor Comments

Technical Functionality

1 The Solution shall allow users to record program admission, transfer, and discharge information for each inmate.

2 The Solution shall support tracking referral sources and the related workflow for managing admissions to the DOC.

3

The Solution shall support Scanning, Document Management, and Records Release Capabilities. This shall include scanning and managing documents that are created by other parties so that they can be included in a medical record.

4

The Solution may have the capability to identify and record the staff member who submitted the OCR/OMR form into the inmate's electronic medical record - the individual who scanned the document as well as the individual who documented inmate care.

5

The Solution shall allow users to indicate required components of medical records, files, outcome measures, satisfaction surveying, and/or required actions, and also have a companion reporting and editing Solution for identifying incomplete files or pending requirements. Ideally, the “tickler” Solution shall be linked to thestaff alert and messaging Solution.

6

The Solution shall have the functionality to limit access to all or part of an inmate medical record using role-based permissions. Role-based permissions must be easily configurable through an Administrative interface to allow staff to change and add roles as needed.

7

The Solution shall have the ability to generate a “Continuity of Care” or “Discharge Summary” document with Demographics, Insurance, Summary of Assessment and Care, and other customizable components.

8 The Solution shall allow users to record all assigned care providers (see definitions) and be date-of-service sensitive.

9The Solution shall support the ability to import and document inmate and responsible party signatures from signature pad devices (for consents for treatment, etc.)



10 The Solution shall support the national standards for signing electronic medical records.

11The Solution must be highly configurable so that established processes and data elements can be modified as new demands for tracking data are made on the State.

12The Solution must include an Administration module that allows non-technical staff to establish new user permissions and to change existing permissions

13

The Solution shall include Stedman's Medical Dictionary for spellchecking transcriptions such as radiology and pathology. Local spell-checking software, like TinySpell, can be utilized in documentation template text fields.

14The Solution shall use check-boxes or numerically coded references in the template for the "Inmate Activity Record/Timeline", as auser-friendly method of inputting routine data.

15The Solution shall have the ability to view and access other Solution functionality, such as assessments and documents while the user is on the Inmate Activity Record/Timeline.

16

The Solution shall support notifying medical, mental health, care coordination, administration, and other staff of key events whenthey occur for inmates in care (e.g. admissions and discharges, critical incidents, referrals, etc.)

17

The Solution shall support reminding, monitoring, and documenting periodic checks on inmates in care (such as checking vital signs or other medical metrics for inmates with special needs, in detoxification, on suicide watch, encounters for those that areSFI, etc.)

18

The Solution shall remind staff to complete the entry of required information, by providing an on-screen indicator. The Solution shall not prevent the access to other sections of a medical record due to incomplete fields.

19 The Solution shall include the ability to send a reminder to staff for completions of required information.

20 The Solution shall assign a unique identifier to every individual admitted to the DOC.



21 The Solution shall assign a unique identifier to all clinical and administrative staff.

22 The Solution shall have the ability to upload and store documents from DOC and non-DOC facilities.

23

The Solution shall easily integrate with voice recognition applications. The Solution shall facilitate the capture of transcription via a local third-party voice recognition application in any text field including transcriptions and clinical documentation templates. Voice recognition shall also be used for template navigation. The Solution shall provide signature capabilities andversion tracking for both transcription documents and template documents.

Documentation Functionality & Medical Record Functionality

1 The Solution shall have the ability for the DOC to develop customizable templates.

2 The Solution shall assist users by supporting a medical and medication spell-check functionality.

3 The Solution shall include the ability to pull existing inmate data into all Solution screens, reports, templates, and forms.

4The Solution shall have appropriate mechanisms for archiving and retrieving historical records as well as purging records when needed.

5The Solution shall include on-screen reminders of requiredinformation to users and include the ability for "dead stops" according to the needs of the DOC.

6 Through an interface to OMS, the Solution shall have the ability to document inmate status.

7

The Solution shall include the ability to add customized categories for clinical notes to best meet the needs of individual programs and are time stamped with the name, title and date/time of the individual submitting the note.

8 The Solution shall include the ability for progress notes to be done simultaneously and become part of individual records.



9

The Solution shall support the DOC’s need to track the completion of a variety of individual treatment, group treatment, educational activities, referral activity, care coordination activities, workflow activities, demographic data, such as the number of participants in a particular group, the program type, and location where the service was provided.

10

The Solution shall have the ability to produce a printable Summary of Assessment and Care document for every inmate, populated with existing data, and able to be accessed and viewed by a customizable range of time.

11 The Solution shall allow for the ability to document progress notes, customizable by role and function.

12The Solution shall support routing medical record documents to supervisors or others for signature or approval as required. The routing shall be configurable to meet the DOC's needs.

13 The Solution shall include the ability to lock a medical record so that only specific individual staff members can access it.

14The Solution shall produce a small pop-up window when a lockedfile is accessed that explains why the case is locked, a timestamp of when it was locked and who locked it.

15The Solution shall include the ability for an administrator to override the current level of permissions for any one inmate at anyone time.

16 The Solution shall maintain and support the tracking of all versions of medical record forms.

17The Solution shall have some mechanism for tracking and verifying that progress notes have been completed for all services entered.The Solution shall allow reminders of notes to complete.

18 The Solution shall enable the easy release of all or part of an electronic medical record, both electronically and via printing.

19 The Solution shall allow multiple staff members to write and sign a medical record note.

Log-In Functionality

1 The Solution shall be accessed through an icon on the Desktop or via the MS Windows Start Menu.



2

The Solution shall time out and lock after a period of inactivity and allow the user to log back in and continue the function they were in the process of completing. The time out period shall be configurable to the needs of the DOC.

3 The Solution shall present a Log-In screen after being initiated, requesting User ID and Password credentials.

Scheduling Requirements

1 The Solution shall have a scheduling function for the correctional facilities.

2

The Solution shall provide tracking of all offender activities including, but not limited to, healthcare appointments and attendance at treatment programs, and provide an alert if there is a scheduling conflict.

3 The Solution shall be able to allow users to view schedules for the entire facility or specific inmates by day, month, or year.

4 The Solution shall maintain detailed records of all internal and external scheduled and unscheduled movements of offenders.

Intake Functionality

1 The Solution shall support tracking the intake-related workflow for managing admissions to correctional facilities.

2 The Solution shall support tracking previous names and aliases for the inmate throughout the Solution.

3

Through an interface to OMS, the Solution shall support the import and viewing of inmate photos at admission with the option toimport and view three subsequent photos per admission, for identification purposes.

4 The Solution shall include an intake form that is customizable to meet the DOC's needs.

5

The Solution shall include the ability to record inmate monthly and annual income as well as Federal Welfare Benefits, State of Vermont Economic Services Benefits, and insurance benefits(including but not limited to Medicaid, Medicare, and private insurance).



6

The Solution shall support tickler functionality for inmate-specific pre-admission task completion, such as completing clinical reviews and approvals, obtaining required medical equipment before admission, etc.

Assessment and Treatment Planning Functionality

1

The Solution shall have tools to aid care providers in assessment and treatment planning processes. This includes tools to assist in diagnosing conditions, selecting treatment goals, developing treatment plans, documenting progress towards goals, preventing medication errors, etc. This also includes standard assessment tools used by clinical staff as well as direct access to up-to-date ICD-10 and DSM criteria for diagnosing.

2

The Solution shall allow users to record an unlimited number of DSM diagnoses (using the most up-to-date version of the DSM) and translates the diagnosis to ICD codes (using the most up-to- date version of the ICD). This should include support for all ICDdiagnoses for medical conditions. The diagnosis data should be date-sensitive.

3The Solution shall support the ability to create custom assessment tools with the ability to store, print, and export assessment scores as well as supporting standardized assessment tools.

4

The Solution shall allow users to record all individual treatment plans in SMART (Specific, Measurable, Achievable, Realistic, Timely) format, including identified problems, goals for treatment, objectives, and interventions to be provided.

5

The Solution shall have a dedicated section and specialized template, accessible and modifiable by select users, called "Individualized Treatment Plan". The "Individualized Treatment Plan" clinical note shall be generated during the admission process.

6

Using role-based permissions, the Solution shall pend "Individual Treatment Plan" notes and remain as Read/Write accessible, until finalized, by the respective staff member (e.g., nurses, Psychiatrists,Psychologists, Social Workers, Psychiatric Nurses, Mental Health Professionals, etc.).

7The Solution shall divide the “Individualized Treatment Plan” section into customizable subsections, based on the needs of theDOC.



8The Solution shall cease populating Problems, Goals, Objectives, and Interventions from the Problem list once they have been marked “Inactive”.

9The Solution shall have the capability to reflect multiple signatures from all the treatment disciplines involved in inmate care, including the inmate’s signature.

10The Solution shall have the ability to categorize the status of the Individualized Treatment Plan clinical note. The status shall be configurable according to the needs of the DOC.

11 The Solution shall include the capability to mark a treatment plan as deleted based on permission roles.

Individual Inmate Functionality

1The Solution shall have the ability to access individual inmate records by "drilling down" using a double-click on the inmate's name or cell number.

2The Solution shall populate data from all permission roles into the inmate's individual record. There shall be no duplication of data entry.

3 The Solution shall include the capability to customize chart layout screens.

4 The Solution shall include the capability to view a summary of clinical and medication information for individual inmates.

5

The Solution shall allow authorized users to assign labels/alerts to offenders for easy recognition of special case needs, including but not limited to Serious Functional Impairments (SFI), DelayedPlacement Persons, and Prison Rape Elimination Act (PREA) Standards.

Medication Administration

1The Solution shall allow users to record and monitor medications for inmates in care, including drug name, dosage, date range, and prescriber.

2The system shall maintain an active medication list and allow a user to electronically record, modify, and retrieve an inmate's active medication list as well as medication history for longitudinal care.



3

The system shall maintain active medication allergy list and allow a user to electronically record, modify, and retrieve an inmate's active medication allergy list as well as medication allergy history for longitudinal care.

4The Solution shall allow for web-based access to information about drug interactions, contraindications, and inmate drug information. (e.g. up-to-date.com).

5The subcontracted pharmacy vendor will send refill requests electronically to the Solution and shall remind prescribers when inmate prescriptions need to be refilled.

6The Solution shall include the capability to track formularies so that prescribers can select medications based upon tiered formularies, if required.

7The Solution shall support DEA requirements for instances such as controlled medication refills and the faxing/printing of controlled medications.

8 The Solution shall support printing inmate information for prescribed medications.

9

The Solution shall have appropriate alerts as needed when ordering medications (e.g., medication allergies, medication interactions, dosage warnings, etc.). The Solution should also warn about drug interactions or contraindications when acknowledged by nursingstaff.

10

The Solution shall include the capability to manage the DOC pharmacy; including inventory management of pharmacy supplies and non-controlled medications, controlled substances management, that interfaces with the electronic medication ordering, and dispensing (Medication Administration Record).

11 The system shall allow authorized users to adjust notifications provided for drug-drug and drug-allergy interaction checks.

12

The systems shall meet the 2014 criteria for computerized provider order entry (CPOE) available to staff for the purposes ofelectronically recording, changing, and accessing pharmacy and pharmaceutical data.

Medication Administration Record (MAR)



1The system shall maintain an electronic inventory process (e-MAR) to ensure the availability of daily, stock medication, and other necessary and commonly prescribed medications.

2The Solution shall include a medication administration record (MAR) to verify that all medications are administered correctly to the right inmate.

3 The MAR should also have a comment section (up to 500 characters) for specialty instructions.

4The MAR shall record the time/date of medication administration, to whom the medication was administered, and who administeredthe medication.

5 The Solution shall include the ability to record an electronic inmate signature on the MAR to verify receipt of the medication

Off-Site Documentation

1 The Solution shall track inmate transports to off-site facilities such as court and medical appointments.

2 The Solution shall track inmate leave status, including the type of leave and the times inmates came and left the building.

3The Solution shall note physical attributes of the inmate when the inmate travels outside of the facility but remains in the care andcustody of the DOC.

Laboratory Requirements

1

The Solution shall support managing routine laboratory functions, including receipt and managing of doctor’s orders for laboratory work, support for tracking in-house laboratory testing and results, and tracking routing select orders to outside laboratories and importing results from them.

2 The systems shall display the laboratory tests and values/results received in human readable format

3 The systems shall attribute, associate, or link a laboratory test and value/result with a laboratory order and inmate record.

4 The systems shall store laboratory tests and values/results.

5 The Solution shall support alerting clinical staff when lab results or other medical metrics are outside normal criteria.

6 The Solution shall support creation of sets of commonly grouped laboratory orders.



7The Solution shall support sending data to and from laboratories for laboratory testing as well as the ability to track laboratory results over time for individual inmates.

8

The systems shall electronically receive and incorporate clinical laboratory tests and values/results in accordance with the standard specified in § 170.205(j) and, at a minimum, the version of the standard specified in §170.207(c)(2).

9The systems shall display all the information for a test report that complies with CMS regulations found at 42 CFR 493.1291(c)(1) through (7).

Emergency Documentation

1

The Solution shall include the ability to document Emergency Involuntary Procedures such as segregation, restraints, or emergency medication. This shall include the ability to document de-escalation procedures used before the EIP was ordered anddocument the enactment of a plan to protect the inmate, other inmates and other staff.

2The Solution shall have the ability to emergently generate a Facesheet, Summary of Assessment and Care, and CodeDocumentation as part of the transfer of care to EMS personnel.

Consultation Functionality

1 The Solution shall include the ability to record a consultant assessment, findings, and recommendations.

2The Solution shall have a template for consultant staff (optometrists, psychologists, internists, neurologist and other specialists).

3

The Solution shall have a template to electronically document their specialty assessment findings (e.g. neurological exam for neurologists, affective or cognitive assessment inventories for psychologists, etc.).

Inmate Discharge Functionality

1The Solution shall include the capability to record discharge information. The discharge checklist and summary shall be configurable.

2 The Solution shall support the creating and faxing of letters to referral sources.



3 The Solution shall support sending electronic prescriptions or faxes to the external pharmacies.

4 The Solution shall support printing prescriptions that comply with CMS’ requirements regarding tamper-resistant prescription pads.

5The Solution shall interface with the pharmacy when an inmate is scheduled to be discharged from the facility so that appropriatemedications can be released.

6The Solution shall generate a customizable discharge report, known as the “Discharge Summary” or “Continuity of Care Document” that is customizable.

7The Solution shall record the location in which the inmate was discharged to (0.5/0.75 house, shelter, other non-DOC facility, home, etc.).

8Through an interface to the Offender Management System, the Solution shall include the ability to record customizable inmate release statuses.

9 The Solution shall support detailed discharge planning, including community providers referred to and their areas of expertise.

CPOE Requirements

1The Solution shall include the ability to utilize CPOE to order blood, urine and other laboratory tests, specialty consults, nursing orders, imaging requests and medication orders.

2The Solution shall include the ability to utilize Computerized Order Review to alert staff to new orders, review and acknowledge orders, and mark new orders as completed.

3 The Solution shall use CPOE to order medications to be administered to inmates.

4The Solution shall generate medication orders, synthesizing arecommended medication based on available medication formularies.

5 The Solution shall populate applicable data from the inmate chart into the medication order.

6 The Solution shall record, track, and route various types of orders generated by the physician or other prescribers.

7 The Solution shall notify providers of new or unreviewed laboratory and imaging results as well as consultant's notes.



8

The Solution shall include decision support mechanisms that interact with other subsections of the chart to determine and prevent administration of medications known to produce sensitivities, allergies, and interaction errors.

9

The Solution shall generate non-medication orders, such as 1:1 observation, close observation, infirmary admission and discharge, q15m observation, q60m observation and general observation, activity privileges (such as "yard usage").

10 The system shall meet the NCCHC standards P-D-04 and MH-D-04 for CPOE.

Forms to be Electronically Signed

1The Solution shall record inmate signature collectively accepting or refusing a list of notices. The list shall be configurable to meet the DOC's needs.

2

The Solution shall support generation of required forms for responsible party review and signature (e.g., financial status updates, consumer rights information, authorizations for treatment, etc.) as well as remind staff of due dates for completion.

Data Exchanges

1 The Solution shall support Interface and Data Exchange Capabilities within DOC and to external organizations.

2

The Solution shall provide the interfaces and data exchanges requested by the DOC in “Enhanced Data Sharing for DOC,” found in Appendix 5.24, Tab H of the RFP for comprehensive healthcareservices.

3 The system shall be able to process and import data including, but not limited to, a comma separated file format.

4

The system shall be configurable for 15-minute increment, daily, weekly, or monthly scheduled imports from external data sourcesor timeframes currently contained in the Electronic Health Record System.

Management and Reporting Functionality

1 The Solution shall include an ad-hoc report-writer interface that is comprehensive and easy to use.

2 The Solution shall include a report-writer interface that supports all regulatory reporting requirements.



3 The Solution shall include a report-writer interface that allows users to save reports to a library of commonly used reports.

4 The Solution shall include a report-writer interface with the ability to run reports in batches at scheduled times.

5 The system shall be able to export datasets in formats including butnot limited to Excel, comma delimited, and fixed width.

6 The Solution shall have the ability for reports to export to Microsoft Excel, Word, and Adobe PDF.

7 The Solution shall include the capability to support all state and other externally mandated reporting requirements for providers inall states in which the organization operates.

8 The Solution shall have a management reporting dashboard to help monitor key strategic and operational metrics.

9 The Solution shall support management efforts to manage clinical staff productivity by recording requirement productivity standards and supporting reporting and dashboard capabilities for managing actual productivity in comparison to requirements.

10 The Solution shall support required reporting of, or the ability to extract data for, the core and quality measures to the DOC’s regulatory, contract compliance, and accreditation agencies.

11In addition to the standard system reports, the system shall allow users to create automated reports as agreed upon by the State and the Contractor.

Quality Assurance Functionality1 The System shall provide fields, as defined by the State, required

for the continuous quality improvement (CQI) program based on the National Commission on Correctional Health (NCCHC) essential and important standards for same, as well as selected measures from National Commission on Quality Assurance-HealthEvaluation Data Information Set (NCQA-HEDIS), the Centers for Medicaid and Medicare Services (CMS).

2The Solution shall support an Internal Staff Alert and Messaging Solution to the organization's clinical and administrative staff either directly or via an interface with Microsoft Outlook.



3The system shall have data fields to input and store CQI, operational efficiency, and Pay for Performance (P4P) program data.

4 The System shall be compliant with all current (2008 and 2014) and future NCCHC standards for jails and prisons.

5 The Solution shall support customization of values in data elements (e.g. labelling code 11 v. code 12 admissions).

O6ther Health Services Requirements

1

The system shall meet the criteria for 2014 Meaningful Use (MU) Ambulatory Criteria. Criteria can be found at http://www.cms.gov/Regulations-and-Guidance/Legislation/EHRIncentivePrograms/Stage_2.html and http://www.gpo.gov/fdsys/pkg/FR-2012-09-04/pdf/2012-20982.pdf

2The System shall meet the 2014 Edition EHR Certification General Criterion. These criterion can be found at http://healthcare.nist.gov/use_testing/finalized_requirements.html

3The system shall integrate physical, behavioral, mental, pharmacy, dietary, lab functions, and care coordination in a single system.These features and functions shall be present in the initial system.

4 The system shall integrate utilization management, using InterQual and other relevant criteria, in a single system.

5The Solution shall have data fields populated from the OMS interface to view individual inmate exact daily housing designation (cell and restriction level specific).

6

The system shall have data fields populated from the OMS interface to notify users of items including, but not limited to, Special Needs, Alerts, Holds, Medical or Mental Health Conditions orAccommodations, in accordance with P-E-03 and MH-E-03.

7

The system shall have data fields to input, store, and, if applicable, import data for documentation of health benefit plan information including, but not limited to, the name of the insurer, coverage type, group/policy number, expiration date, and other information necessary for filing a claim if applicable, or determining health coverage upon release as defined by the State. Any additional requirements identified by the State that are not contained in the system will require a Change Order.



8

The systems shall store, display, and permit changes in the appropriate movement code (M-Code) to ensure that inmates for whom transfer would interfere with treatment planning or whose medical or mental health condition would be negatively affected are not transferred without approval of medical or mental health in accordance with NCCHC standards P-E-10 and MH-E-08.

9

The Solution shall permit the ordering of “Medical Diets.” The list of available “Medical Diets” will be customizable for the DOC. The Solution application shall provide the ability to document meals.

10 The system shall utilize a standardized workflow to increase inmate care and decrease errors.

PART 4: NON- FUNCTIONAL REQUIREMENTSThe tables below list the State’s Non-Functional Requirements. Indicate if your proposed solution complies in the “Comply” column.

Yes = the solution complies with the stated requirement.No = the solution does not comply with the stated requirement.N/A = Not applicable to this offering.

Describe how the requirement is met in the “Vendor Description of Compliance” column.

4.1 HostingID # Non-Functional Requirement Description Comply Vendor’s Description of Compliance

H1 Any technical solution must be hosted in a data center.H2 Any hosting provider must provide for back-up and

disaster recovery models and plans as needed for thesolution.

H3 Any hosting provider will abide by ITIL best practices for change requests, incident management, problem management and service desk.

4.2 Application Solution



ID # Non-Functional Requirement Description Comply Vendor’s Description of Compliance

A1 Any solutions vendor must provide for the backup/recovery, data retention, and disaster recovery of a contracted/hosted application solution.

A2 Any solutions vendor must provide for application management and design standard of all technology platforms and environments for the application solution (Development, Staging, Productions, DR, etc.)

A3 Any solutions vendor must engage the State of Vermont using Service Level Agreements for system and application performance, incident reporting and maintenance.

A4 The State owns any data they or their Contractor enter, migrate, or transmit into the solution and the vendor shall allow the State to pull or copy this data at any time free ofcharge.

A5 As a contract deliverable, the vendor shall supply an up-to- date data dictionary that represents all data respective of the solution it will provide. The data dictionary must contain the following attributes:

1. The technology (RDBMS platform) that hosts the data source, i.e. Oracle, SQL Server, MySQL, DB2, etc.

2. The location where the data source is hosted3. Thorough descriptions of each table in the data source4. Thorough descriptions of each column within each

table in the data source. In addition to business definitions, column descriptions must include the following detail: schema names; file group names (if applicable); data types; lengths; primary and foreign key constrains; applied formatting; applied calculations; applied aggregations; NULL-ability; default values.



4.3 SecurityAs a solution vendor, you must have documented and implemented security practices for the following and have a process to audit/monitor for adherence. Indicate “Yes” or “No” in the “Comply” column or “N/A” if the requirement is not applicable to this offering. Use the “Vendor Description of Applicable Security Processes” column to describe how you meet the requirement and the “Audit/Monitor” column to indicate how you monitor for compliance.

ID # Non-Functional RequirementDescription

Comply Vendor’s Descriptionof Applicable Security Processes

Audit/Monitor Process

S1 Input validationS2 Output encodingS3 Authentication and password

managementS4 Session managementS5 Access controlS6 Cryptographic practicesS7 Error handling and loggingS8 Data protection from

unauthorized use, modification, disclosure or destruction (accidental or intentional).

S9 Communication securityS10 System configurationS11 Database securityS12 File managementS13 Memory managementS14 Fraud detectionS15 General coding practicesS16 POA&M managementS17 Risk Assessment Practices

including but not limited to vulnerability assessment and pen testing

S18 Incident response planning and testing

S19 System Security Plan delivery



4.4 Other Non-Functional RequirementsFor each requirement listed, indicate if and how you comply or type “N/A” if it is not applicable to your offering.



ID # General Non-Functional Requirement Description

Comply Vendor’s Descriptionof Applicable Security Processes

Audit/Monitor Process

General Requirements

G1.1The Solution will provide a user interface that will be simple and consistent throughout all areas and functions of the Solution

G1.2The Solution will minimize the number of mouse clicks / user interaction to complete any action.

G1.3

The Solution will use a Graphical User Interface (GUI) to help the user navigate to the next logical step in the workflow (or freely navigate to other parts of the Solution functionality) and then allow the user toreturn to complete the in-process task.

G1.4The Solution will speak the user’s language, with words, phrases, and concepts familiar to the user, rather than Solution-oriented terms.

G1.5

The Solution will allow the users to easily navigate to a variety of functions available to them without having to move sequentially through excessive menus and screens.

G1.6

The Solution will include (at minimum) the following features and capabilities:a) Drill down and look up functionality to

minimize re-entry of information across multiple screensb) Multi-tasking and multiple window

capability, including split screens (logging in twice or once with 2 windows?)c) Search capabilities to allow retrieval by

Provider, inmate, procedure code, or othersas defined by the State.



G1.7

The Solution will support undo and redo (or provide onscreen confirmation/acceptance to the user to confirm a change that is permanent and cannot be "undone").

G1.8

The Solution will follow standardized conventions and limit the use of words, situations, or actions that have multiple meanings.

G1.9

The Solution will eliminate error-prone conditions or check for them and present users with a confirmation option before theycommit to the action.

G1.10The Solution will minimize the user’s memory load by making objects, actions, and options visible.

G1.11The Solution will provide all user instructions in a visible or easily retrievable location, when appropriate.

G1.12The Solution will allow the user to navigate to any functional component from a clientlanding page.

G1.13 The Solution will alert the user with information relevant to required next steps.

G1.14

The Solution will accommodate point and click selection and check box entry for all relevant data entries to ensure that the user does not have to enter textual data that may already be available to the Solution.

G1.15 The Solution will provide field level on-screen edits with limited user override capabilities.

G1.16The Solution will not show fields not accessible to a given user based on accessrights.



G1.17

The Solution cursor will automatically advance to the next logical input field when the maximum allowed numbers of characters have been entered for the keyed field or when the user presses the "Enter" key.

G1.18The Solution will provide the option of having a selection from the drop-down boxes automatically take the user to the next field.

G1.19 The Solution will identify invalid entries to theuser as immediately as possible.

G1.20

The Solution will be designed to include only the necessary information and functionality on screens and will be based on the user’s access level and the user’s configuration.

G1.21The Solution will be designed to include logical transitions between screens and level of detail during navigation.

G1.22The Solution will provide templates for data entry with identified mandatory and optional data fields.

G1.23The Solution will allow incomplete data sets to be saved for completion of the workflow ata later time.

G1.24 The Solution will highlight and flag required and incomplete data fields.

G1.25The Solution will include a graduated Solution of alert levels to allow users to determine urgency and relevancy.

G1.26The Solution will allow configuration of alerts by a user, for a user by a supervisor, and for a user by a Solution administrator.



G1.27

The Solution will enable central workflow alerts and transactional status. The Solution will centralize pending work items for the user as in a "work queue."

G1.28

The Solution will have the capability to push messages to the intended workers without requiring them to specifically inquire for the data (inside the Solution).

Audit and Compliance Requirements

G2.1

The Solution will maintain a record (e.g. audit trail) of all additions, changes, and deletions made to data in the Solution. This should be readily searchable by user ID or inmate ID. This must include, but is not limited to:- The user ID of the person who made the change- The date and time of the change- The information that was changed- The outcome of the event- The data before and after it was changed,and which screens were accessed and used.



G2.2

The Solution will be able to detect security- relevant events that it mediates and generate audit records for them. At a minimum the events will include those listed here:-start/stop-user login/logout-session timeout-account lockout client recordcreated/viewed/updated/deleted-scheduling-query-order-node-authentication failure-signature created/validated-Personally Identifiable Information (PII) Export-PII import-security administration events-backup and restore IRS 1075 and NIST 800-53 moderate baseline rev 54

G2.3

The Solution will provide authorized administrators with the capability to read all audit information from the audit records in the following two ways:1) The Solution will provide the audit records in a manner suitable for the user to interpret the information. The Solution will provide the capability to generate reports based on ranges of Solution date and time that audit records were collected.2) The Solution will be able to export logs into text format in such a manner as to allow correlation based on time (e.g. CoordinatedUniversal Time [UTC].



G2.4

The Solution will be able to perform time synchronization using NTP/SNTP, and use this synchronized time in all security records of time.

G2.5The Solution will have the ability to format for export recorded time stamps using UTC based on ISO 8601.

G2.6

The Solution will prohibit all users read access to the audit records, except those users that have been granted explicit read access (onlysecurity administrators).

G2.7

The Solution will protect the stored audit records from unauthorized deletion. The Solution will prevent modifications to the audit records.

G2.8 The Solution will prevent modifications to the audit records.

G2.9 The Solution will provide logging, reporting, and accessing errors and exceptions.

G2.10

The Solution will provide capability for integrating consent audit trails and data access audit trails in a consolidated searchable Solution for search/report to support consent rule enforcement or investigation including audit trails based ondeprecated rules or policies.

G2.11The Solution will generate and protect consent audit events at the same or better levels as other data access audit records.

SLRs and Performance Requirements.



G3.1

The Solution response time (defined as the time elapsed after depressing an ENTER key (or clicking on a button that submits the screen for processing) until a response is received back on the same screen) during operations will be sub secondaverage response time for 95 percent of the Real Time, search, and lookup queries (does not include ad hoc queries and analytics).Maximum response time will not exceed 15seconds except for agreed-to exclusions.

G3.2

The Solution will achieve performance for interactive transactions other than the reporting-related transactions above, conforming to the minimum acceptable performance standard of a 2 second averageresponse time, for 95% of interactions.

G3.3

The components of the Solution under Contractor control as delivered into production shall be available at a level agreed in the contract (the contracted target level of availability). This will be chosen from one ofthe three availability levels 99.9%, 99.95% or 99.99%.

G3.4The Solution will be architected with no single point of failure, supporting a high-availabilityenterprise.

G3.5The Solutions hours of operations will be 24 hours per day, 7 days per week, and 365 days a year.

G3.6

The Solution will be designed to support the planned Vermont Solutions and any anticipated expansion in scope of connectivity.



G3.7

The Solution Administration staffing requirements and workload should be minimally impacted with expanded Solution usage.

G3.8

The Solution must be built so that there is a near-linear relationship between each additional server added, and the additionalload that can be accommodated (load vs. capacity added), up to specified limits.

G3.9

The Solutions Recovery Time Objective (RTO) will be within 1 hour. In case of a disaster that effects the DOC’s operations, the entire service will be restored within 1 hour.

G3.10

The Solutions Recovery Point Objective (RPO) will be no more than 0.5 hour of data loss. In case of a disaster that effects the Care Management operations, 0.5 hour of data inputs to the Solution (but no more) may belost and need to be re-entered.

G3.11

The Solution will use fully redundant network and hardware. Hardware components (such as processor and memory) should have built- in redundancy to allow a second component to take over in the event of a failure in the primary component. Similarly, redundantpaths should also exist for networks.

G3.12

The Solution will leverage virtualization to expedite disaster recovery. Virtualization enables Solution owners to quickly reconfigure Solution platforms withouthaving to acquire additional hardware.



G3.13

The Solution will have the ability to support either a Production and hot (real time replication) disaster recovery design or a multi-host site Production design that would allow one site to seamlessly be offline andthe other site would maintain service without interruption.

G3.14

The Solution will include a disaster recovery plan and provide contingency plans for client lookup capabilities and online collaboration inthe event of a disaster.

G3.15The Solution will provide the ability to recover from data loss due to end user error and end application error.

G3.16

The Solution will provide the ability to perform archival/incremental backups and the ability to perform open/closed databasebackups.

G3.17The Solution will provide tools for managing an environment that supports both highavailability and disaster recovery.

G3.18

The Solution will have the capability of maintaining all data according to State- defined records retention guidelines (i.e. record schedule). General schedules can be found at: http://vermont- archives.org/records/schedules/general/.Specific retention disposition orders can be found at: http://vermont- archives.org/records/schedules/orders/.In general, document retentions range from 3 to 10 years. In addition to the above, note that health record data must be retained for a minimum of 7 years after Case closure.



G3.19

The Solution will include the capability to maintain all images and electronic documents according to state defined document retention guidelines (i.e. record schedule).General schedules can be found at: http://vermont- archives.org/records/schedules/general/. Specific retention disposition orders can be found at: http://vermont- archives.org/records/schedules/orders/.In general, document retentions range from 3to 10 years.

G3.20The Solution will provide on-line access of all active cases and up to 24 months for closed cases

G3.21All software developed and delivered by the Contractor must be free of viruses, malware,backdoors

G3.22The service providers Help Desk Mean Time to Restore Severity Level 1 will take no longer than 4 clock hours from notification.

G3.23The service providers Help Desk Mean Time to Restore Severity Level 2 will take no longer than 8 clock hours from notification.

G3.24

The service providers Help Desk Mean Time to Restore Severity Level 3 will take no longer than 24 hours (calendar day) fromnotification.

G3.25

All priority 3 or higher defects (testing defects) resulting from software development activities shall be resolved by the Contractor prior to the software being delivered for User Acceptance Testing andprior to deployment to production.



G3.26 The Contractor must respond to priority 1 test defects within 1 hour of notification.

G3.27 The Contractor must resolve priority 2 test defects within 4 clock hours of notification.

G3.28 The Contractor must respond to priority 3 test defects within 8 hours of notification.

G3.29 The Contractor must respond to priority 4 test defects within 5 days of notification.

G3.30 The Contractor must report on all priority 5 test defects with each reporting phase.

Interface List

G4.1

The Solution has the capacity to interface with the statewide HIE Solution supported by VITL to obtain details of interactions with and services provided to inmates by the providerin real-time.

G4.2

The Solution will maintain the interfaces to the statewide HIE which currently exist:

Lab results Radiology results Transcription

Interoperability / Interfaces Requirements

T1.1

The Solutions interfaces shall secure and protect the data and the associated infrastructure from a confidentiality,integrity, and availability perspective.

T1.2

The Solution’s interface infrastructure shall continue to operate despite failure or unavailability of individual technology components such as a server platform or network connection.



T1.3

The Solutions interfaces shall be scalable to accommodate changes in scale including changes in inmate population, transaction volume, through-put and geographical distribution. The Solution shall easily make any changes to the interface data elements/layouts and to test those changesto confirm functionality.

T1.4

The Solution shall implement, at a minimum, interfaces (both real-time or batch) with the applications and data sources listed in the section "G4 Interface List". These interfaces shall be implemented using HL7 or other applicable standard as determined by theDOC.

T1.5

The Solution shall provide the capability to perform source-to-destination file integrity checks for exchange of data and alertappropriate parties with issues.

T1.6

The Solution shall integrate with Vermont Health Information Exchange using VITLs Service Oriented Architecture (Medicity), using an Enterprise Service Bus, responsible to monitor and control routing of message exchange between services, resolve contention between communicating service components, control deployment and versioning of services and marshal use ofredundant services.

NA

T1.7The Solution’s interface interoperability shall follow the National Institute of Standards (NIST)- adopted encryption standards.



T1.8

The Solution shall provide the capabilities for a Real-Time (or near real-time) bi-directional Integrated Enterprise communication using standard PIX/PDQ XCPD/XCA, XDS.b Query or SSO formats.

T1.9

All Solution services shall be reviewed, classified, and cataloged prior to use. The Documentation Artifacts shall be modeled per ISO/IEC/IEEE 42010 Architecture Description Template as part of the Vermont Enterprise Architecture ProgramRequirements.

T1.10

All Solution services shall have key stakeholder/owners identified following the ADM Architecture Model. Role Matrix should include s/w developers, integrationists, technologists, Enterprise Architects, BusinessLeads, Testing teams, UAT Teams.

T1.11

The Solution shall provide the functionality that provides reliability for applications, services, or message flows: Load balancing, High availability, Fault tolerance, Failover, In- order delivery, Transaction support, Execution prioritization, Message prioritization. Tests for High Availability and Failover shall be completed prior to therelease to UAT.

T1.12

The Solution shall have the ability to use standards-based communication protocols, such as TCP/IP, HTTP, HTTP/S and SMTP. Protocol bridging: The ability to convert between the protocol native to the messaging platform and other protocols, such as Remote Method Invocation (RMI), IIOP and.NET remote-ing.



T1.13

The Solution shall have the capability to integrate with VITL’s MDM technology for Enterprise Master Person Index (EMPI) implemented (using Medicity) as part of the VHIE Platform in a centralized or registry styleimplementation.

Scalability and Extensibility Requirements

T2.1

The Solution will be designed for ease of maintenance and readily allow future functional enhancements. This will be accomplished through use of modern design principles for Service Oriented Architecture, applying principles of modularity, interfaceabstraction, and loose coupling.

T2.2

The Solution will be adequately flexible to keep up with ever changing technology and regulatory changes. This will be accomplished by separating workflow and business rulesinto their own separate tiers.

T2.3

The Solution will be scalable and adaptable to meet future growth and expansion/contraction needs such that the Solution can be expanded on demand and be able to retain its performance levels when adding additional users, functions, and data.

T2.4

The Solution will provide screens that are highly re-configurable based on the needs of the Vermont DOC specifically, providing the ability to reposition and rename field labels / data fields, remove or “turn-off” unused fields, maintain data, and allow addition ofcustom-defined fields.



T2.5

The Solution will enable the State to modify the labels and arrangement of information in the data model documentation templates and can create custom data fields.

T2.6The Solution will provide the ability to create and/or modify edits and business rules which determine the correctness/integrity of data.

Regulatory & Security Requirements



T3.1

The Solution will, at a minimum, provide a mechanism to comply with security requirements and safeguard requirements of the following Federal agencies / entities:- Health & Human Services (HHS) Center for Medicare & Medicaid Services (CMS)- Administration for Children & Families (ACF)- NIST 800-53r4, MARS-E and DOD 8500.2- Federal Information Security Management Act (FISMA) of 2002- Health Insurance Portability and Accountability Act (HIPAA) of 1996- Health Information Technology for Economic and Clinical Health Act (HITECH) of 2009- Privacy Act of 1974- e-Government Act of 2002- Patient Protection and Affordable Care Act of 2010, Section 1561 Recommendations- Vermont Statute 9 V.S.A. § 2440. Social security number protection (http://www.leg.state.vt.us/statutes/fullsecti on.cfm?Title=09&Chapter=062&Section=024 40)- Vermont Statute 9 V.S.A. § 2435. Notice of security breaches (http://www.leg.state.vt.us/statutes/fullsecti on.cfm?Title=09&Chapter=062&Section=024 35)

T3.2The Contractor will provide all their corresponding NIST 800-53 procedures and policies to the State security officer.



T3.3

The Solution will comply with all applicable State and Federal laws and regulations, including 42 CFR Part 2 and Health Insurance Privacy and Accountability Act (HIPAA) including privacy and client consent forrelease requirements.

T3.4

The Solution will follow HIPAA 278 standard for the electronic exchange of prior authorization information between Providersand AHS.

T3.5

The Solution will conform with the sub-parts of Section 508 of the Americans with Disabilities Act (ADA), and any other appropriate State or Federal disability legislation.

T3.6

The Solution will comply with all applicable State security policies and adhere to all legal, statutory, and regulatory requirements, asdetermined by Vermont leadership.

T3.7The Solution will implement security controls in accordance with all Federal and State security policy and regulations.

T3.8 The Solution will comply with Vermont branding standards as defined by the state.

T3.9

The Contractor will adhere to the principle of “Fail Safe” to ensure that a Solution in a failed state does not reveal any sensitiveinformation or leave any access controls open for attacks

T3.10

The Solution will allow for controlled access to participant records. Users will be able to view participant data within the Solution at the State-defined levels of access based on user security privileges.



T3.11

The Solution will maintain a level of security that is commensurate with the risk and magnitude of the harm that could result from the loss, misuse, disclosure, or modification of information.

T3.12

Information security will be built into the Solution from its inception rather than “bolted on” after the Solution has beenimplemented.

T3.13 The Solution will support security at the object level (e.g. Table, View, Index).

T3.14 The Solution will support security at the row and column level

T3.15 The Solution will support auditing at the object level (i.e. Table, Column).

T3.16

The Solution will provide the ability for concurrent users to simultaneously view the same record, documentation, and/or template.

T3.17The Solution will provide protection to maintain the integrity of data duringconcurrent access.

T3.18

The software used to install and update the Solution, independent of the mode or method of conveyance, will be certified free of malevolent software (“malware”).Contractor may self-certify compliance with this standard through procedures that make use of commercial malware scanningsoftware.

T3.19

The Solution will be configurable to prevent corruption or loss of data already accepted into the Solution in the event of a Solutionfailure (e.g. integrating with a UPS, etc.).



T3.20

The Solution will support protection of confidentiality of all Protected Health Information (PHI) delivered over the Internet or other known open networks via encryption using Advanced Encryption Standard (AES) and an open protocol such as Transport Layer Security (TLS), Secure Sockets Layer (SSL), Internet Protocol Security (IPsec), XML encryptions, or Secure/Multipurpose Internet Mail Extensions(S/MIME) or their successors. This Solution will be subject to external Auditchecks.

T3.21

The Solution, when storing PHI on any device intended to be portable/removable (e.g. smartphones, portable computers, portable storage devices), will support use of a standards-based encrypted format using AESor their successors.

T3.22

The Solution, prior to access to any PHI, will display a configurable warning or login banner approved by the State (e.g. "The Solution should only be accessed by authorized users"). If a Solution does not support pre-login capabilities, the Solution will display the banner immediately followingauthorization.

T3.23

The Contractor will review and analyze the key risks to the important assets and functions provided by the Solution to certify that the CWE/SANS Top 25 Most Dangerous Software Errors (http://cwe.mitre.org/top25)have been mitigated and document the mitigation.



T3.24

The Contractor will review the Solution and certify that the code and any new development meets or exceeds the OWASP Application Development Security Standards outlined on the www.OWASP.org site (currently https://www.owasp.org/images/4/4e/OWAS P_ASVS_2009_Web_App_Std_Release.pdf) and document in writing that they have beenmet.

Identity and Access Management

T4.1 The Solution will support a form of user authentication.

T4.2 The Solution, upon detection of inactivity of an interactive session, will prevent further viewing and access to the Solution by that session by terminating the session (or by initiating a session lock that remains in effect until the user reestablishes access using appropriate identification and authentication procedures). The inactivity timeout will beconfigurable.

T4.3 The Solution will enforce a limit of (configurable) consecutive invalid access attempts by a user. The Solution will protect against further, possibly malicious, user authentication attempts using an appropriate mechanism (e.g. locks the account/node until released by an administrator, locks the account/node for a configurable time period, or delays the next login prompt according toa configurable delay algorithm).

T4.4 The Solution will have the capability of preventing database administrators fromseeing the data in databases they maintain.



T4.5 The Solution will support grouping users by Roles, functional departments, or other organization to simplify security maintenance.

T4.6 The Solution will provide the ability to maintain a directory of all personnel who currently use or access the Solution/IVR/SQL database.

T4.7 The Solution will provide the ability to create and maintain a directory of external providers to facilitate communication and informationexchange.

T4.8 The Solution will restrict access to summarized information according to organizational policy, scope of practice, and jurisdictional law.

T4.9 The Solution must be able to associate permissions with a user using one or more of the following access controls:1) Role-Based Access Controls (RBAC; users are grouped by role and access rights assigned to these groups)2) Context-based (role-based with additional access rights assigned or restricted based on the context of the transaction such as time-of-day, workstation-location, emergency- mode, etc.).

T4.10 The Solution will provide the ability to prevent specified user(s) or groups from accessing confidential information such as a SSN, medication information and other confidential data.



T4.11 The Solution will provide the ability to limit access to certain confidential information such as an inmate’s SSN and other confidential data to providers directly involved in service of the inmate, or providersinvolved in review of the service.

T4.12 The Solution will enforce the most restrictive set of rights/privileges or accesses needed by users/groups or processes acting on behalf ofusers, for the performance of specified tasks.

T4.13 The Solution will provide the ability for authorized administrators to assign restrictions or privileges to users or groups.

T4.14 The Solution will support removal of a user's privileges without deleting the user from the Solution to ensure that the history of user’s identity and actions are maintained.

T4.15 The Solution will be able to support RBAC in compliance with the HL7 Permissions Catalog.

T4.16 The Solution will be capable of operating within an RBAC infrastructure conforming to ANSI INCITS 359-2004, American National Standard for Information Technology – RoleBased Access Control.

T4.17 The Solution will provide more advanced session management abilities such as prevention of duplicate logins, remote logout, and location-specific session timeouts.

T4.18 The Solution will provide the ability to perform Solution administration functions such as reference table maintenance andadding / removing users from the Solution.



T4.19 The Solution will allow users access based on their roles irrespective of their geographical location.

T4.20 The Solution will provide the capability to integrate with existing authentication and authorization mechanisms.

T4.21 The Solution will provide the capability to create temporary and emergency accounts and terminate those accounts automaticallyafter a user-defined period of time.

T4.22 The Solution will provide the capability to monitor events on the information Solution, detect attacks, and provide identification of unauthorized use of the Solution.

T4.23 The Solution will provide the capability to identify and report on inappropriate access to information in the Solution, based on user defined criteria.

T4.24 The Solution will enforce minimum password requirements compliant with State-providedsecurity policies.

T4.25 The Solution will allow User to change his or her password at any time.

T4.26 The Solution will have mandatory security questions for the User to answer for username and password validation in case of any user requested changes.

T4.27 The Solution will allow for online automated password reset.



T4.28 The Contractor will monitor, alert, and protect against web application attacks of internet-facing applications. Solution/hosting provider will install, configure, and manage a web application firewall on Vermont's internet-facing Solution/hosting provider ePHI Environments. Alerts and/or reports will be provided to Security officers at specifiedintervals.

T4.29 The Contractor will conduct and provide a risk assessment based upon NIST 800 - 30 guidance and methodology.

T4.30 The Contractor will conduct quarterly scans of Vermont's externally-accessible web services in the Production Environment and provide reports on the scans to VT Information Security officer/representative, including the severity of the vulnerabilitiesand remediation recommendations.

T4.31 The Contractor will provide third-party conducted penetration tests on production releases of the externally accessible web application as requested by the change control board entity. The reports shall beprovided to the security officer upon request.



T4.32 The Contractor will not transmit or store any Personally Identifiable Information (PII) using publicly available storage over the Internet or any wireless communication device, unless:1) the PII is “de-identified” in accordance with 45 C.F.R § 164.514(b) (2); or 2) encrypted in accordance with applicable law, including the American Recovery and Reinvestment Act of 2009 and as required by policies and procedures established by VT InformationSecurity Officer.

T4.33 The Contractor will perform Security Impact Assessments prior to releasing solutions into production.

T4.34 The Solution will include the same security provisions for the development, Solution test, acceptance test, and training environment asthose used in the production environment.

T4.35 The Contractor will complete and supply to VT Information Security Officer all CMS Security required documentation to include but not limited to Solution Security Plan (SSP), Risk Assessment (RA), Contingency Plan(CP).

T4.36 The Contractor must pass the Privacy/security and FTI data handling training provided by the State. FTI training is required regardlessof the presence or absence of FTI data.

T4.37 All servers shall have hardened operating Solutions by eliminating any unnecessary Solution services, accounts, network services, and limited user access rights throughout all environments.



T4.38 The Contractor will review and monitor logs for forensic purposes and security Incidents, and any anomalous activities are incorporated into the Incident management process. In the event of a security incident, the Contractor shall collect and retain evidence related to the incident. A detailed report must be provided to the State SecurityOfficer.

T4.39 The Contractor will ensure that high severity patches will be applied within seven (7) calendar days; Medium severity patches will be applied within fifteen (15) calendar days; and all others within thirty (30) calendar days. The Contractor will further ensure that required IT security notices and advisories aredistributed to appropriate personnel.

Project Management Requirements

I1.1

For Solutions which are not the incumbent EHR, once an installation date is scheduled, a Contractor installation management team will travel to the DOC to discuss the implementation process and conduct a site evaluation meeting to assess the DOC's installation needs. A customized Implementation and Training plan including specific dates, deadlines, and milestones will be produced and provided to the DOC as aresult of this meeting.

I1.2The Contractor will describe the project management approach and methodology to be used for all Solution project life cycles.



I1.3

The Contractor’s installation management team will cover all of these topics during discussions addressing the unique needs of the State in a personalized manner:-Project Integration Management-Project Scope Management-Project Time Management-Project Cost Management-Project Quality Management-Project Human Resource Management-Project Communication Management-Project Risk Management-Project Procurement Management

I1.4 The Contractor will develop a Project Charter.

I1.5

The Contractor’s installation management team will clearly define roles, accountability, timelines, and all necessary performancecriteria for a successful implementation.

I1.6The Contractor will provide best practices throughout the implementation of the Solution.

I1.7

Where available and agreed between the Contractor and the State, the Contractor will use State templates for project management deliverables.State templates listed in EPMO templates from the link:http://dii.vermont.gov/pm/pmtemplates



I1.8

The Contractor will develop a PMI-compliant Communications Management Plan as part of Appendix 5.27 “EHR Project Management Documentation and Implementation Project Schedule.” The Communications Management Plan must describe participant's roles and responsibilities, internal communications, external communications, other communications, and information management including communicationsprotocols.



I1.9

The Contractor will leverage ADS’ EPMO Project Log template as applicable to establish an “Action Items Process and Tracking Document” as part of Appendix 5.27 “EHR Project Management Documentation and Implementation Project Schedule.” The document shall be used to track and verify that unanticipated issues, action items, and tasks are assigned to a specific person for action and tracked through resolution.

ADS EPMO Project Log Template can be found in http://dii.vermont.gov/sites/dii/files/pdfs/EP MO-Project-Log-Template.pdf

The “Action Items Process and Tracking Document” issue and action item tracking document must include the following:- Date of occurrence- Description of the issue- Priority level- Impact level- Date of occurrence- Remediation strategy- Current status- The individual responsible- Target resolution date- Actual resolution date



I1.10

The Contractor must electronically provide project management documents (e.g., Project Management Plan, Project Schedule, Work Breakdown Structure, etc.) using Microsoft software products and/or PDF. The software version must be no less than a version still available on the common market and that is still supported by the manufacturer. The State will work with the Contractor in approving specific versions to assure that the application is synchronized with the State'splans.

I1.11

The Contractor will advise the State and Contractor management of progress in meeting goals and schedules contained in the work plans as well as any risks and issues during weekly progress meetings attended by the Contractor and the State. These may include walkthroughs of selected deliverablesas requested by State staff.



I1.12

The Contractor will develop weekly progress reports (see Appendix 5.27). Weekly written progress reports will be provided by the Contractor to the State one working day before each weekly meeting, and containing items to be discussed at the meeting, including:- Progress of each task/activity.- Action items and decisions from the previous meeting.- Problems encountered, proposed resolutions, and projected completion dates for problem resolution.- Planned activities for the next two reporting periods.- Status of contractually defined deliverables, milestones, and walkthroughs scheduled in the project schedule.- Updating of information on a weekly basis in the State project and portfolio management tool.- Other information as needed (per Contractor or the State).- Risks and mitigations.- Total budget and cost variance reporting- Lessons learned- Percentage complete- Resources and time required to completion Frequency of periodic reports" can be adjusted during the course of project asagreed by the State and Contractor.



I1.13

If the Contractor must substitute key staff during the project, the Contractor will submit to the State, in writing, the reason for the change and provide a completed staff experience reference form and resume for the substitute personnel. The DOC Health Services Administrator or designee will eitherapprove or reject the substitution.

I1.14The Contractor will provide contract close-out plans and manage project close-out activities in accordance with the plan.

I1.15

As part of the proposal, the Contractor will describe the staffing approach and methodology used for the project, which will include:- Estimated number of Contractor's resources needed per each phase of the project.- The number of staff resources within the following categories: Management, Business, and Technical.- The number of staff resource onsite vs. remote per the phase of the project- A description of the methodology used for releasing and adding staff to the project and managing staff PTOs- Outsourcing staff, if applicable- Types and number of resources that State needs to provide per the phase of the project and expected hours from those resources- Providing a project organization chart.



I1.16

The Contractor will describe issue escalation processes to settle disputes related to roles, responsibilities, or unmatchable level of service (i.e. what is their escalation chain), and this will be aligned with the Statesescalation plan.

I1.17

The Contractor will describe their approach to remediate and realign the project and project plan if the Contractor or the State decides that any aspect necessitates immediate attention and/or State/Contractormanagement intervention.

I1.18The Contractor will provide a project manager with AT LEAST 6 years of experience overseeing successful EHR implementations.

I1.19The Contractor will use the documentation repository that is in the "best interests of theState".

Environment Installation and Configuration Requirements



I2.1

The Contractor will submit to the State as part of their proposal, specifications for all necessary hardware, software, and tools for the six (6) environments listed here. The Contractor can propose to combine certain environments, where appropriate. The six (6) environments include:1. Production2. QA/Staging3. Development4. Test5. Training6. Disaster RecoveryContractor will submit as a component of proposal specifications for all software, hardware, and tools that would be inclusive of a full SDLC, including environment to support the following needs: Prod, QA, Staging, Development, Test, Training, DisasterRecovery.

I2.2

The Contractor will develop a technical infrastructure document which describes all hardware, Solution software, and tools necessary for each of the environmentsproposed.

I2.3

The Contractor is responsible for procuring and maintaining all hardware, software, and tools purchased under the contract until Solution acceptance for all proposed environments.

I2.4 The Contractor will source code held in escrow by an escrow agent.



I2.5

The Contractor will provide a data dictionary, data models, data flow models, process models, and other related planning and design documents to the State based on state standards (when available).

Knowledge Transfer & Training Requirements

I3.1

Refer to Appendix 5.27. The Contractor will develop (in cooperation with the State) and execute a “Knowledge Transfer and Training Plan” that describes roles and responsibilities of the State and Contractor and the approach for bringing managers, end users, and technical personnel to an appropriate level ofunderstanding with the Solution.



I3.2

The Knowledge Transfer and Training Plan will address and describe, at a minimum:- Training goals/standards and the specific plan for training technical personnel and end users.- Size of population and types of roles that need training- Strategy for providing training early in the project to allow the training goals to be implemented throughout the project life Phase.- Tasks, deliverables, and resources necessary to complete the training effort and identify tools and documentation that will be necessary to support the proposed effort.- Types of training, the specific courses and course materials, the training approach for both technical personnel and end users, and how training effectiveness will be measured.- Deliverables to support initial and ongoing training including user manuals, Solution manuals, and on-line help and training materials for technical/non-technical personnel.- Knowledge Transfer to enable the State personnel to operate, maintain, configure and modify the Solution including operation of the testing tools, supporting infrastructure, report generation, role-based permissions, and security as agreed between the State and Contractor.- Metrics for tracking progress in achieving training and knowledge transfer objectives.- Reporting progress of training andknowledge transfer activities.



- Additional training for technical staff on development, reporting and maintenance including processes and tools as needed.

I3.3

The Contractor will provide train-the-trainer and end user training documentation (including user manuals, online content, reference cards, etc.).

I3.4

The Contractor will provide the State a training course outline for review and acceptance at least thirty (30) calendar daysprior to the beginning of scheduled training.

I3.5

The Contractor will submit all training packages to the State for review and acceptance at least twenty-one (21) calendar days prior to the beginning of scheduled training.

I3.6

The Contractor will provide training materials for each enhancement release and will publish the updated manuals online in the User Areas. The manuals are provided inAdobe PDF format.

I3.7

The Contractor will provide all training materials developed for the Solution to the State. Those materials will become the property of the State and may be modified and duplicated by the State.

I3.8

The Contractor will provide electronic copies of all training materials (end-user, technical, trainee, and instructor) in a format (Word, Excel, PDF) that can be easily accessed, updated, and printed by State staff using software for which the State owns licenses, prior to deployment onto the stagingplatform.



I3.9

The Contractor will provide updated training documentation for all departments and agencies using the platform, as necessary, to incorporate new processes or functionality due to Solution releases, upgrades, orchanges throughout the contract term.

I3.10

The Contractor will schedule all training during regular work hours as approved by the State, unless the Contractor receives advance approval from the State for specific trainingat other times.

I3.11The Contractor will provide all training within the State of Vermont at locations convenient to the attendees of the training.

I3.12The Contractor will schedule staff training in a manner that is least disruptive to normal business operations.

I3.13The Contractor will provide instructions to the State on Contractor tools and proceduresused to support the training.

I3.14

The Contractor will ensure that Contractor staff members are not assigned to train State staff while concurrently working on critical path development tasks.

I3.15 The Contractor will develop end-user training on the Solution’s business functionality.

I3.16

The Contractor will provide both end-user classroom training/train-the-trainer sessions, and on-line, interactive training as agreedwith the State for all end-users.

I3.17The Contractor will develop and perform train-the-trainer training sessions, asappropriate.



I3.18

The Contractor will identify the number of staff necessary for maintenance and operations of the Solution as well as the skill sets necessary, with the States agreement.

I3.19The Contractor will develop and provide training for the technical support staff including State staff and contractors.

I3.20

For the duration of the contract, the Contractor will provide training to the technical staff if Solution upgrades have been installed and if there is a change in Solutioncomponents functionality

I3.21

The Contractor will create a training approach and needs analysis early in each project Phase which will determine the training requirements.The State of Vermont has invested in the Oracle User Productivity Kit (UPK) and has a strong preference to use this investment toprovide training to end users.

Solution Design, Development & Customization Requirements

I4.1

The State utilizes a structured Software Development Life Phase (SDLC) that is consistent with industry-standard best practices as well as State requirements for Information Technology projects. The Contractor must use a structured SDLC process, including an iterative software development methodology and incremental deployment of functionality to the production environment. This includes software and database design, Solution configuration management plan and procedures, and userinterface standards.



I4.2 The Contractor will develop a Solution Software Development Life Cycle Plan.

I4.3

The Contractor must submit a narrative describing the design and development approach and methodology with their proposal.

I4.4

All Contractor "change request" cost estimates must be fully explained, documented, approved, and available inExcel.

I4.5

The Contractor will incorporate the design and development approach into a comprehensive Design and Development Plan.

I4.6

The Contractor will apply consistent development standards for all development works as described in offeror's SDLC such as coding convention, database, and field naming convention

I4.7 The Contractor will provide the State accessto all data on the test and production server.

I4.8

The Contractor will acquire authorization from the State for the use of production Solution resources (legacy data or source files), or data derived from the States production resources.

I4.9

The Contractor will describe the overall testing approach and methodology used for the Solution deployment. The Contractor will work with the States Business Units in fine tuning the testing approach and get the States approval before starting the testingphase.



I4.10

Refer to Appendix 5.27, “EHR Project Management Documentation,” and complete the “Test Plans” section. All Integrated Solution Testing will be performed on the Enterprise Testing platform while the UAT will be performed on the Staging platform. No testing may be conducted on the production platform and all testing must be completedprior to deployment.

I4.11

Testing and Development will have their own environments, separate from Production.Neither testing nor development will be performed in the production environment.

I4.12

The Contractor will repeat the test life cycle when a failure occurs at any stage (e.g., a failure in Acceptance Testing that necessitates a code change will require the component to go back through Unit Testing,Integration Testing, and so forth).

I4.13

The Contractor will build test plans, execute test plans, and create reports. The State will evaluate the Contractor’s test plans and Contractor test results. The State may validate the testing done by augmenting itwith State testing.

I4.14

The Contractor will document the testing tools, test configurations, and related documentation. The Contractor will provide all necessary performance testing scripts with input from the States Business Units. The State will have the final say on what is anacceptable performance.

I4.15 The Contractor will provide the State with the test scripts, test results, and quality reports.



I4.16

The Contractor will provide staff to the State to answer questions and address any problems that may arise during testing conducted by the State.

I4.17

The Contractor will refine the test documents, procedures, and scripts throughout development and through fullSolution acceptance to reflect the as-built design and current requirements.

I4.18

The Contractor will allow the State to run validation and testing software against externally facing Internet applications to help identify potential security issues and shall repair any deficiencies found during thistesting.

I4.19

As Solution events contain date and time- sensitive elements, the testing infrastructure must provide a method of altering and synchronizing the Solution date throughout each test phase. This requires the ability to change the Solution date and time in somescenarios.

I4.20All components of the Solution will accommodate leap year processing and daylight savings time start/end dates.

Implementation Plan

I5.1

Refer to and complete Appendix 5.27. The Contractor will describe the implementation approach and methodology to be used forthe Solution.



I5.2

Refer to and complete Appendix 5.27. The Contractor will incorporate the implementation approach into a comprehensive “Implementation Project Schedule” which will be added to other PM plans as part of the PMO. The State requires incremental deliveries of functionality to the production environment. The State anticipates considerable collaboration with the Contractor in the plan's construction, with attention to high complexity components of the existing the State Solutions as well as the proposed Solution.

I5.3

Disaster recovery requirements relative to the physical Solution components and planning for recovery from operational failures are the responsibility of the Contractor. The Contractor will develop an Operational Recovery Plan – refer toAppendix 5.27.

I5.4

Refer to Appendix 5.27. As part of its “Implementation Plan,” the Contractor will incorporate the interface management approach for all interface mechanisms used for the Solution (e.g. batch, ESB/webservices).

I5.5

The Contractor will validate that each interface is working correctly. The Contractor will repair all interface-related problemscaused by Contractor-developed interfaces.

I5.6The Contractor will assist the State in identifying root causes for all Solution interface related problems.



I5.7

The Contractor will provide a software configuration management Solution to store, control, and track instances (baselines during the construction life cycle) of all software configuration items that will be developed forthe Solution.

I5.8The Contractor must use a widely used "industry standard" software configurationmanagement tool.

I5.9The Contractor will describe the requirements management approach and methodology used for the Solution Project.



I5.10

When functionality is ready to be delivered to the State for User Acceptance Testing (UAT), it will be delivered in the form of a pre- production release (defined as ready for production in every respect but just not yet in production). Since the State will approve all releases into production, a pre-production release is equivalent to a production release and requires the rigor associated with a production release. Upon successful completion of UAT, the State will schedule a release to be moved to the production environment.Each pre-production release will include the following:- Release-specific hardware and software Solution components.- Release description including architecture or design updates, new functionality introduced, defects fixed, modifications to interfaces with other Solutions, other changes to existing code, and any software and hardware configuration changes.- Release contents including a description of the release structure and contents and instructions for assembling and/or configuring the components of the release.- Test Plan and test execution results.- Detailed hardware and software configuration information including any software and hardware dependencies and instructions at a level of detail that will enable administration staff to rebuild and configure the hardware environment withoutoutside assistance.



- Database documentation conforming to industry standards.- Detailed configuration information for any 3rd party hardware and software.The Contractor will provide updated documentation when Solution upgrades to software or equipment occurs through thelife of the contract.

I5.11

Deployment will be iterative from both a business process and applied technology perspective and will be accepted by the State through application of the acceptance criteria in testing plans

I5.12The Contractor will assist the State with testing and release preparation in the pre- production environment

I5.13

The Contractor must provide support staffing information such as the proposed number, ratios, duration, and roles/responsibilities for on-going support (as identified in previously submitted implementation approach andplan).



I5.14

Upon successful completion of the pre- production testing, the Contractor will, in coordination with the State, create a Production Release Plan that will consist of an updated Pre-Production Release notification to assist the State in successfully releasing and maintaining the Solution in the Production environment.It must include, but not be limited to, the following components:- Updated Configuration Information required satisfying the Solution production configuration management requirements.- Updated Solution Architecture.- Updated Detailed Design, including detailed Solution, technical, and user documentation.- Deployment schedule- Blackout plan (complete/incremental)

I5.15

For proposals that would migrate the State from its existing EHR, the Contractor will provide data conversion from the legacy Solutions to the new Solution.

Quality Management Requirements

I6.1

The Contractor will describe the quality management approach and methodology used for the Solution with input from theBusiness Units.

Production Support and Transition Requirements

O1.1

If the Contractor is proposing to migrate from the current EHR Solution to a new Solution, the Contractor will describe the production support and transition approach and methodology for the Solution, as agreedbetween the Contractor and the State.



O1.2

The Contractor will describe their “Production Support and Transition Plan” in the “Implementation Project Schedule” section of Appendix 5.27.

O1.3

The Contractor will identify the root cause of corrupted data, identify Solution for fix, and repair corrupted data that is associated with a problem in the Solution.

O1.4

With concurrence from the State, the routine planned maintenance activities will be scheduled without disrupting the negotiated operational hours. Contractor will provide the State with a copy of the schedule at least 30 days in advance of the scheduledmaintenance date for approval.

O1.5

The testing tools and test configurations will be provided to the State and responsible entities and appropriate training to the State personnel will be provided as the Solution aretransitioned into support

O1.6

The Contractor will provide instructions and training for responsible entity support staff that may need to access and support the Solution remotely (e.g. through PDAs, tablet PCs through a VPN).

O1.7

The Contractor will develop an automated process for purging production Solution files as determined by the State data governanceteam.



O1.8

Upon completion of any maintenance call, the Contractor will furnish a maintenance activity report to the State within 24 hours and provide any clarification to the questions as needed, which will include, at minimum, the following:- Date and time notified.- Date and time of arrival.- If hardware, type and serial number(s) of machine(s).- If software, the module or component name of the affected software code.- Time spent for repair.- List of parts replaced and/or actions taken.- Description of malfunction or defect.- Description of root cause of malfunction or defects.- Description of fixes.

O1.9

The Contractor will produce a Solution Training Manual, which will serve as an operator's instruction manual. It will include Solution administration procedures and describe the scheduled operations of the production Solution. It will include but not be limited to specific instructions on things an operator needs to do to manage the Solution on a daily basis, descriptions of administrative tasks, instructions on how to run the job, andwhat to do in abnormal situations.



O1.10

The Solution component documentation will include at a minimum:- A Data Dictionary- Data Model(s)- Interface design specifications- Passwords & activation codes- A Developer's Manual outlining and detailing operating, maintenance, development, processes, standards, procedures, plus any other technical information required to fully support the application.- Operations Phases and procedures including batch or background process schedule, dependencies, sequencing, and timing.- Administrative Tasks including users administration, Solution security administration, reference data maintenance, creation of report templates and maintenance of service provider data and contracts.- Other reference materials and presentations required to supplement the training andsupport activities.

O1.11

The Contractor will provide documentation that describes the procedures for Solution administrators to add, update, or remove user IDs and passwords.

O1.12

The Contractor will provide the responsible entity with help and service desk scripts and decision trees for tier 1 help desk and tier 2+service desk support.



O1.13

The Contractor will provide instructions and training for responsible support staff that may need to access and support the Solution remotely.

O1.14

The Contractor will agree to continue normal operational activities pending completion of the Transition-Out Plan activities and readiness assessment, as approved by the DOC Health Services Administrator ordesignee.

Defect Resolution and Solution Acceptance Requirements

O2.1

During the maintenance period, the maximum time to restore the functionality of the Solution and resolve incidents will be within the timeframes listed below:-Severity Level One incidents will not exceed four (1) clock hours between the opening of an incident and final closure, unless a time extension is approved by the State.-Severity Level Two incidents will not exceed four (4) business hours between the opening of an incident and final closure, unless a time extension is approved by the State.-Severity Level Three incidents will not exceed twenty-four (24) business hours between the opening of an incident and final closure, unless a time extension is approvedby the State.

Solution Administration Requirements

O3.1 The Solution will provide data archiving capabilities based on State defined criteria



O3.2

The Solution will provide the capability to move all historical, expired and/or unnecessary data to offline storage according to a set of business rules and schedules to be defined by the State.

O3.3

The Solution will maintain an archival process so that accumulated historical records and log files do not consume large amounts ofdisk space.

O3.4

The Solution will provide an auto archive/purge of the log files to prevent uncontrolled growth of the log and historical records storage using administrator-set parameters.

O3.5The Solution will provide version control capabilities to ensure the integrity of all software releases.

O3.6 The Solution will provide logging and reporting for accessing errors and exceptions.

O3.7 The Solution will monitor and provide reportson any unauthorized access.

O3.8

The Solution will provide user privilege reports on demand. The format shall minimally provide role, last login, date of account creation, account type.

O3.9 All Solution communications will be protected by at least 128-bit encryption.

O3.10The Solution will be supported by public key/private key encryption Secure Socket Layer (SSL) certificates.

O3.11The Solution will use firewalls and Demilitarized Zones (DMZs) for externalaccess and remote access.



O3.12 The Solution will prevent creation of duplicate accounts.

O3.13The Solution will have the option to indicate the type of user to be set up (e.g. Solution Administrator, Case Manager).

O3.14 The Solution will create a user profile for the new user.

O3.15The Solution will assign a user the proper access roles and create a user name and temporary password.

O3.16

The Solution will have the capability to automatically deactivate a user account if there has been no log-in for a specified time (e.g., 90 days). The deactivation policy, related rules and final review requirements tobe configurable by the State.

O3.17 The Solution will lock out a user after a specified number of failed log-in attempts.

O3.18 The Solution will provide an online mechanism to unlock Users.

O3.19The Solution will display all current user- specified preferences (if existing) or defaultpreferences (if none exist).

O3.20

The Solution will allow users to set up or modify user preferences with possible override by (a) designated supervisor(s) within each department. Preferences may include but are not limited to:

a) Preferred method of communication (e.g., email, SMS, phone).

b) Subscription to alerts and notifications (e.g., changes to client record, new messages, referral changes).

c) Notification types desired.



O3.21The Solution will display the selected preferences and allow the user to confirm or modify preferences.

O3.22The Solution will send a notification to the user that the personal preferences have been updated.

O3.23

The Solution will have the ability to provide Users role-based access (as assigned/decided by VT, roles to be determined) to case management data. Users can be defined as any of the following:a) Nursesb) Charge Nursesc) Directors of Nursingd) Mental Health Professionalse) Care Coordinatorsf) Mid-Level Providersg) Medical Doctorsh) Psychiatristsi) Recreational Therapistsj) Physical Therapistsk) Psychologistsl) Health Services Administratorsm) Regional Office Staffn) DOC Health Services Division staffo) Other entities as defined by VT

O3.24The Solution will allow Solution administrators to create user groups to manage workflow.

O3.25The Solution will allow Solution administrators to assign users to specific facilities.



O3.26

The Contractor will establish an automated maintenance routine that will at a minimum:- Backup the user IDs and password data- Identify expired IDs and related data

O3.27The Contractor will use offsite storage. Data backup should be stored off-site in the event of a physical disaster.

O3.28

The Contractor will provide disk (or equivalent) backups to protect Vermont data, with procedures in place for regular backup protection with a defined timeline and scheduling. Backups of Vermont data will take place using dedicated backup servers. The Contractor will provide documentation of processes for archiving and retrievingmaterial from the off-site storage Contractor.

Solution Management Requirements

O4.1

The Solution will have the ability to generate administrative alerts and warnings when statistics indicate an impact or potential limits on Solution component performance and availability. The specific alerts will be defined by the hosting services provider. The State has a preference for the Oracle Performance Management toolsets such as OracleEnterprise Manager, Grid Control, etc.

O4.2

The Solution will allow for all changes/updates to the distributed components to be administered and completed centrally and availableimmediately to all source Solutions and sites.



O4.3

The Solution will provide Service Level Agreement (SLA) monitoring and reporting capabilities. Service Level definitions will be drafted into a single document provided as an attachment.

O4.4

The Solution will securely support the State’s and/or the Contractor’s existing remote control (i.e. support personnel ability to take over the user device for troubleshooting and support) capabilities deployed for any type ofclient workstation.

O4.5

The Solution will provide event management and monitoring functionality according to Information Technology Infrastructure Library version 3 (ITIL v3) or equivalent best practices.

O4.6

The Solution will provide Application Performance Monitoring and Management capabilities (i.e. transaction monitoring, synthetic transactions, component root cause analysis (e.g. Application ServerManagement)).

O4.7The Solution will provide transaction tracking and log consolidation capabilities across all tiers of the application.

4.5 Data ComplianceVendors and their solutions must adhere to applicable State and Federal standards, policies, and laws based on the type of data that will be stored, accessed, transmitted and/or controlled by the solution. If the “Type of Data” column is checked below, respond “Yes” or “No” in the “Comply” column and provide an explanation on how you comply in the “Vendor’s Description of Compliance” column.

Type of Data Applicable State & Federal Standards, Policies, and Laws

Comply Vendor’s Description of Compliance



☒ Publicly available information

NIST 800-171

☒ Confidential Personally Identifiable Information (PII)

State law on Notification of Security Breaches State Law on Social Security Number Protection State law on the Protection of Personal Information National Institute of Standards & Technology: NIST

SP 800-53 Revision 4 “Moderate” risk controls Privacy Act of 1974, 5 U.S.C. 552a .

☐ Payment Card Information Payment Card Industry Data Security Standard (PCI DSS) v 3.2

☐ State Financial Data Annual SSAE 18 SOC 2 Type 2 audit

☐ Federal Tax Information Internal Revenue Service Tax Information Security Guidelines for Federal, State and Local Agencies: IRS Pub 1075

☒ Personal Health Information

(PHI) Health Insurance Portability and Accountability Act

of 1996: HIPAA The Health Information Technology for Economic and

Clinical Health Act HITECH Code of Federal Regulations 45 CFR 95.621



Type of Data Applicable State & Federal Standards, Policies, and Laws

Comply Vendor’s Description of Compliance

☒ Affordable Care Act Personally Identifiable Information (PII)

Internal Revenue Service Tax Information Security Guidelines for Federal, State and Local Agencies: IRS Pub 1075

Minimum Acceptable Risk Standards for Exchanges MARS-E 2.0

☒ Medicaid Information Medicaid Information Technology Architecture MITA3.0

Code of Federal Regulations 45 CFR 95.621 ☒ Prescription Information State law on the Confidentiality of Prescription

Information☐ Student Education Data Family Educational Rights and Privacy Act: FERPA

☐ Personal Information from Motor Vehicle Records

Driver’s Privacy Protection Act (“DPPA”) 18 U.S.C. Chapter 123, §§ 2721 – 2725

☒ Criminal Records Criminal Justice Information Security Policy: CJIS

PART 5: IMPLEMENTATION/PROJECT MANAGEMENT APPROACH

1. Describe the approach you would recommend for project managing this engagement.

2. Provide a list of the standard project management deliverables that you would normally produce for this type of engagement.

3. Complete Appendix 5.27, and label this as Attachment #4.

4. What types of difficulties have other clients experienced with implementation of the proposed solution?

5. Describe the experience and qualifications of the Project Manager you would offer as the resource for this engagement. Provide a copy of their resume and label it Attachment #5.

PART 6: TECHNICAL SERVICES

1. Describe the technical services included in your proposal (e.g., business analysis, configuration, testing, implementation, etc.).



2. Provide a list of the standard deliverables for the technical services described above.

3. Provide a description of the roles/services/tasks that you will need the State to perform as part of this engagement. Describe any additional roles/services/tasks that are optional but would be beneficial for the State to provide.

4. Describe your typical conversion plan to convert data from existing systems to your proposed solution (if you are proposing to migrate from the incumbent system).

5. Describe the experience and qualifications of the technical resources proposed for this engagement. Provide their resume(s) and label them Attachment #7.

6. Describe the training that is included in your proposal.

7. Describe the system, administrator, and/or user documentation that is included in your proposal.



PART 7: MAINTENANCE AND SUPPORT SERVICES

1. Provide answers to the questions below regarding your company’s Maintenance and Support Services:

Questions Vendor ResponseService: Customer Phone &/or Email SupportWhat is the method for contacting technical support?What are the hours of operation forsupport?What is the turnaround time for responses?What is the escalation process forsupport issues?Who comprises the support team and what are their qualifications?Define your response resolution metrics and how you capture and report them.Service: Incident/Security Breach Notification and ProcessDescribe your identification and notification process for security breaches.Service: Data ManagementDescribe how data is stored, retained and backed-up (including frequency).Service: HostingDescribe the hosting service and associated service levels.



Questions Vendor ResponseService: Scheduled Maintenance/DowntimeWhat is the frequency of scheduled maintenance and downtime?What is the notification process for scheduled maintenance and downtime?Describe how “maintenance” updates are tested with customers prior to installing them in their live environments.Service: System UpgradesAre software upgrades provided aspart of the software support contract?Describe your software upgrade process.How often are new versions released?Is documentation and training provided for system upgrades?Are there additional costs for upgrades and/or new releases?Describe how and when the State will have an opportunity to test system upgrades/releases prior to live installation.Describe how the State will validate post installation and how changes will be backed out in the event that a problem is encountered.



Questions Vendor ResponseService: Bug Fixes and Minor EnhancementsDescribe the frequency and process for providing, testing, and installing bug fixes and minor enhancements.Service: Disaster RecoveryWhat is your standard RPO and RTO?

2. Describe any other services not mentioned in the above list that are included in your standard Service Level Agreement (SLA). Include a copy of your SLA with your response to this RFP. Label the SLA Attachment #8.

3. Describe how adherence to your service levels is measured and what remedies you would provide the State when performance doesn’t meet the standard?



PART 8: PRICING

1. Submit four-year pricing for your proposed solution in the table below. Fill in only the lines that are applicable to your proposal. Insert lines for additional costs, but do not delete or rename any lines in the Table. Total each column and provide a total of all columns in the “Total Implementation, plus 5 Year Costs” box on the next page.

Cost Type One Time Year 1 Year 2 Year 3 Year 4 Year 5Software

Enterprise Application: License Fees $0.00 $0.00 $0.00 $0.00 $0.00 $0.00Maintenance &/or License Fee Add-Ons $0.00 $0.00 $0.00 $0.00 $0.00 $0.00

Subscription cost $0.00 $0.00 $0.00 $0.00 $0.00 $0.00

Storage Limitations and/or Additional Fees $0.00 $0.00 $0.00 $0.00 $0.00 $0.00

Database Software: License Fees $0.00 $0.00 $0.00 $0.00 $0.00 $0.00Middleware Tools: License Fees $0.00 $0.00 $0.00 $0.00 $0.00 $0.00Operating System Software: License Fees $0.00 $0.00 $0.00 $0.00 $0.00 $0.00Upgrade Costs for Later Years $0.00 $0.00 $0.00 $0.00 $0.00 $0.00Post-Go-Live Configuration $0.00 $0.00 $0.00 $0.00 $0.00 $0.00Support and Maintenance Fees $0.00 $0.00 $0.00 $0.00 $0.00 $0.00Implementation ServicesProject Management $0.00 $0.00 $0.00 $0.00 $0.00 $0.00Requirements $0.00 $0.00 $0.00 $0.00 $0.00 $0.00Design (Architect Solution) $0.00 $0.00 $0.00 $0.00 $0.00 $0.00Development (Build, Configure or Aggregate)/Testing $0.00 $0.00 $0.00 $0.00 $0.00 $0.00

System Testing $0.00 $0.00 $0.00 $0.00 $0.00 $0.00Defect Removal $0.00 $0.00 $0.00 $0.00 $0.00 $0.00Implement/Deploy or Integrate $0.00 $0.00 $0.00 $0.00 $0.00 $0.00Quality Management $0.00 $0.00 $0.00 $0.00 $0.00 $0.00



Cost Type One Time Year 1 Year 2 Year 3 Year 4 Year 5Implementation Services ContinuedTraining $0.00 $0.00 $0.00 $0.00 $0.00 $0.00TelecomBandwidth $0.00 $0.00 $0.00 $0.00 $0.00 $0.00HardwareComputing Hardware $0.00 $0.00 $0.00 $0.00 $0.00 $0.00Storage and Backup Hardware $0.00 $0.00 $0.00 $0.00 $0.00 $0.00Network Hardware $0.00 $0.00 $0.00 $0.00 $0.00 $0.00Facilities/Data Center $0.00 $0.00 $0.00 $0.00 $0.00 $0.00HostingHosting Fees $0.00 $0.00 $0.00 $0.00 $0.00 $0.00Total Base Costs $0.00 $0.00 $0.00 $0.00 $0.00 $0.00

Total Implementation plus 5 Year Costs $ 0.00

2. Provide a confirmatory statement that the Offeror’s Appendix 5.24 “Price Proposal PIPM Calculator” has been updated to include (as indicated above) One-Time (as part of Year 1) and Year 2-5 costs.

3. Describe any assumptions you have made in relation to the above cost and pricing information.

4. Provide pricing information for any volume discounts that are available based on the number of software licenses purchased or support years purchased.

5. Provide pricing for any Functional Requirements marked as “C” (feature is not available in the core solution, but can be provided with customization).



PART 9: TERMS AND CONDITIONS

In deciding which Respondent/s to shortlist the State will take into consideration each Respondent’s willingness to meet the State’s terms and conditions. Indicate any objections or concerns to our stated terms and conditions in the RFP or any of the exhibits, addendums or attachments including Attachment C. Add lines to the table below as needed.

Important: Bidder will be bound to all terms and conditions stated in the State’s RFP, exhibits, attachments, and/or addendums except and then only to the extent specifically set forth in the table below, and only if and to the extent expressly agreed and incorporated in writing in a resulting contract. Note that exceptions to contract terms may cause rejection of the proposal.

Clause Location Concern Proposed Verbiage

[indicate RFP, exhibit, attachment or addendum, section & page number]

[briefly describe your concern about this clause] [describe your suggested alternative wording for the clause or your solution]







PART 10: AUTHORIZED COMPANY SIGNATUREI am authorized to submit a proposal to the State of Vermont in response to this RFP on behalf of my organization. The information provided as part of my organization’s response is a true and accurate representation of my organization’s ability to meet the State of Vermont’s business needs as expressed in this RFP.

Signature:

Full name:

Title:

Company:

Date:

state of vermont bidder response form€¦ · web viewprovide the information requested in this...

Documents