contract amendment 36 att a: rhode island unified … management deloitte will leverage and reuse...

RHODE ISLAND/DELOITTE UHIP CONTRACT BRIDGING DOCUMENT 1

CONTRACT AMENDMENT 36

ATT A: Rhode Island

Unified Health Infrastructure Project

Contract Bridging Document

2 RHODE ISLAND/DELOITTE UHIP CONTRACT BRIDGING DOCUMENT

1 Preamble

This document (hereinafter the “Bridging Document”), as referenced in the Unified Health Infrastructure Project Agreement (“Agreement”) Section 1.2.1(c), dated January 8, 2013, is issued to document mutually agreed modifications to the scope, requirements, responsibilities, price and other aspects of the Services being provided by Deloitte Consulting (hereinafter “Deloitte” or “Contractor”) to the State of Rhode Island. This Bridging Document is incorporated by reference into the Agreement and will take precedence and supersede the RFP and Deloitte’s Proposal dated June 22, 2012, where addressed and clarified herein.

1.1 Guiding Principles

Rhode Island and Deloitte agree that the following principles will serve as part of the shared vision for the UHIP project. In making design decisions and evaluating proposed changes to the system, the teams will consider whether the proposed decision or change will achieve the following:

• Make a demonstrable improvement in the customer user experience

• Increase operating effectiveness

• Improve cost effectiveness and contribute to the State’s goal of achieving financial self sustainability

• Accelerate the integration of health insurance and human service programs

• Support achieving an extendable solution that evolves easily to meet ongoing regulatory and market needs

If the criteria are met, Deloitte and State will discuss the potential change and decide whether to implement the design decision or make the change, in accordance with the agreed-upon change management processes.


2 Changes to the Proposal

2.1 Task Order 9: Exchange Financial Management

The Parties agree to work diligently to finalize Task Order 9 within thirty (30) days from the Effective Date of this Agreement. Task Order 9 will be issued as a Change Order to the Agreement, and will include any updates to the Bridging Document and its attachments that may be required to finalize the scope, price, schedule and other aspects of the Services and Deliverables required for Task Order 9.

2.2 Plan Management Functionality

All references to eHealth in the Deloitte proposal should be removed. Deloitte shall meet the State’s requirements instead by leveraging other assets from states where Deloitte is under contract, augmented through new code development as needed.

2.3 Contact Center Technology

Deloitte will not perform any work related to the implementation of contact center technology (as defined below) until sixty (60) days from the effective date of the Agreement, unless otherwise directed by the State. All related schedule delivery dates shall be revised by mutual agreement if deemed necessary.

Contact center technology is defined as those products and services described in the following sections of the RFP and Proposal:

• Appendix M, requirements CAS-3 through CAS-10

• Appendix N, requirements CRM-1 through CRM-38.6


3 Clarifications to the RFP

3.1 Business Requirements Documents and Software Requirements Specifications

Detailed specifications for the UHIP are being developed using the KPMG Business and System Requirements Methodology (BSRM). The BSRM ensures a business focus by starting with the Business Requirements Definition (BRD) document. Subsequently, the System Requirement Specifications (SRS) document will expand the activities identified in the BRD that are identified for automation.

It is understood that Deloitte and the State will use Appendix M and N from the RFP and Proposal Response, as clarified in this Bridging Document, as the baseline requirements for the project (“Requirements Documents”). Deloitte will use the State’s BRD and SRS artifacts (which will include a Requirements Traceability Matrix back to the requirements in the Appendix M and N) as a key input to the requirements and design sessions.

If any of the details of the BRD or SRS lead to scope not covered by the Requirements Documents, Deloitte and the State will work together through the change control process to assess its impact to the timeline, prioritization, effort to complete and any price considerations.

The project will only consider those BRD and SRS artifacts that are fully complete and approved by the State at the start of the relevant requirement session.

3.2 Clarifications

The following comprises clarifications from Deloitte’s proposal in response to specific sections of the RFP and forms part of the collective contract and supersedes the RFP where indicated.

3.2.1 Certification Cover Form

Superseded by the certifications in the proposal and response.

3.2.2 RFP Section 1

Any scope or other requirements contained in this section are defined by the Requirements Documents (defined in section 3.1 of this document), which provide the basis for system acceptance.

All the references to schedule and milestones will be superseded and governed by the revised schedule contained in section 4 of this Bridging Document

3.2.3 RFP Section 2

Any scope or other requirements contained in this section are defined by the Requirements Documents (defined in section 3.1 of this document), which provide the basis for system acceptance.


3.2.4 RFP Section 2.6 Subcontracting

The following list of subcontractors is approved: NTT Data, PSRI, Business Focus, Deloitte Audit and Enterprise Risk Services (AERS) and Deloitte Consulting India Pvt. Ltd. .

3.2.5 RFP Section 2.23 Minority Business Enterprise and Equal Employment Opportunity

Revised Plan attached to the Agreement.

3.2.6 RFP Section 4.1.1 Management and Reporting

Requirement for Change Order response in 2 days will be adjusted in the Project Management Plan to a mutually agreeable period of no less than 10 business days

3.2.7 RFP Section 4.1 Project Management Approach - Section 4.1.6 License and

Configuration Management

Deloitte will leverage and reuse State’s existing resources and/or assets where possible and appropriate.

Management and maintenance of hardware and software licenses, including renewal activities, shall be mutually agreed in the Maintenance and Operations plans.

3.2.8 RFP Section 4.2.3 Task Order (Phase 1)

Any scope or requirements for usability and user interface contained in this section are defined by the Requirements Documents (defined in 3.1 of this document), which provide the basis for system acceptance.

3.2.9 RFP Section 4.2 Task Orders - 4.2.4 Task Order (Phase 2)

Understanding the current “As Is” state of InRhodes and determining the appropriate “To Be” model for Non-MAGI Medicaid eligibility for Rhode Island includes validating that moving to an integrated HIX/IES solution positively impacts the eligibility determination for these programs. The eligibility and enrollment/disenrollment processes are areas of the new solution that are largely impacted by upcoming changes to Medicaid policy, especially as these changes potentially increase the number of individuals in Rhode Island who may apply for and receive Medicaid. For example, if an individual does not meet the current criteria for Medicaid eligibility, he/she is ineligible to receive Medicaid Assistance. Under the new health care policies, an individual in this situation will be referred to the Health Insurance Exchange. To clarify, an individual determined ineligible for non-MAGI Medicaid would be notified through correspondence/notice generated from InRhodes until Phase 2 implementation.

3.2.10 RFP Section 4.2 Task Orders - 4.2.4 Task Order (Phase 2)

Deloitte assumes two data conversions will take place. The first data conversion for Phase 1 and Phase 2 will be performed to establish a Master Client Index supporting the integration with InRhodes for HIX MAGI eligibility prior to IES implementation. The second data conversion will be performed to implement a statewide conversion of all eligibility functions, clients and data from inRhodes to the new integrated eligibility solution. Both conversions must be completed by the established due dates in the approved work plan


Assumes no historical paper file conversion and assumes rolling back-log as cases come up for renewal, they are added to the document imaging repository

3.2.11 RFP Section 4.2 Task Orders - 4.2.6 Task Order 6 (Phase 2)

[Intentionally left blank.]

3.2.12 RFP Section 4.2 Task Orders - 4.2.7 Task Order 7: Production Hosting

The scope of services is superseded by section 9.

Hosting services will be at a fixed price for the contract period through 12/31/2015. The State retains the right to extend the services on an annual basis per the Agreement commencing from calendar year 2016 until the end of calendar year 2020 based on the pricing schedule in Appendix X. The State will notify Deloitte no less than 90 days prior to the end of each calendar year of its intent to extend the services.

3.2.13 4.2 Task Orders - 4.2.8 Task Order 8: Technology Operations and Maintenance

Adjustments will be included in this Bridging Document for the following three sections and will supersede each section:

• Maintenance and Operations (“M&O”) and Modifications and Enhancements (“M&E”) details (superseded by section 10 of this document).

• Maintenance and Operations (including Help Desk) services will be at a fixed price for the contract period through 12/31/2015. The State retains the right to extend the services on an annual basis per the Agreement from calendar year 2016 until the end of calendar year 2020 based on the pricing schedule in Appendix X. The State will notify Deloitte no less than 90 days prior to the end of each calendar year of its intent to extend the services.

• The scope of M&O services is defined in section 10.

• The State will purchase Modifications and Enhancement services on an as needed basis. On request Deloitte will provide the State with an estimate of the respective work effort based on level of effort and utilizing the submitted rate card and associated timelines and staff commitments. The State will provide at least 90 days prior notice when ordering these services.

• Help Desk Details (superseded by section 10 of this document)

• SLAs (superseded by section 7 of this document)

The second sentence of 4.2.8.5 is not applicable and is covered by Section 25.3.2 of the Agreement.

3.2.14 RFP Section 4.2 Task Orders - 4.2.9 Task Order 9: Financial Management

Pending task order 9 vendor decision; to be determined within 30 days of the date of this Agreement.


3.2.15 RFP Section 4.3.1 Milestone 15. Phase 1 Warranty and Milestone 24. Phase 2

Warranty.

Warranty will be 6 calendar months from each release, as defined and agreed to in the project plan and release plan. The releases will include releases 3, 5, 6, and 7 as defined in section 4 of this document. Warranty for subsequent releases will be limited to components that are modified as part of that release.

3.2.16 RFP Section 5.1.3 Carriers

The following language replaces the 6th and 7th bullet:

• Reporting capabilities will be provided in the solution to support external processes to administer risk management and oversight and monitoring.

3.2.17 RFP Section 6 Technical Requirements

The seventh bullet regarding ownership of third-party software products and custom-developed source code is superseded by the contract terms and conditions.

3.2.18 RFP Section 6.1.1 Accounting Requirements

Superseded by the contract terms and conditions.

3.2.19 RFP Section 6.1.2 Warranty


3.2.20 RFP Section 6.1.3 State Data Center Hosting Facility

Superseded by section 3.2.12 above.

3.2.21 RFP Section 8 Contract Terms and Conditions



4 Appendix L: Deliverables and High-Level Timeline

Deloitte will provide three incremental releases leading up to October 1, 2013, and three incremental releases following October 1, 2013, culminating in July-September, 2014. Each incremental release will represent progressive functionality.

The first three iterations will complete on or about April 30, 2013; June 28, 2013; and August 30, 2013. The specific date for each iteration will be determined in the mutually agreed-upon work plan.

The following table lists preliminary dates for potential public releases of the UHIP system. Deloitte and the State will mutually agree on the number and dates of each public release in the project plan, application development plan, and release plan (deliverables “Plan 02,” “Plan 03,” and “Plan 04”), but public releases must include at least the releases numbered 3, 5, 6, and 7, below.

# Description Phase Approximate date

1 Deployment of QHP certification and management functionality into

production so that carriers can begin to populate the Exchange with

health plans (Iteration #1)

I May 1, 2013

2 A ‘soft launch’ into production of anonymous prescreening (for MAGI-

based eligibility) and anonymous health plan browsing functionality

(Iteration #2)

I July 15, 2013

3 The work necessary to stand up a functioning Health Benefits Exchange

by October 1, 2013, including MAGI-based eligibility determination

(Iteration #3)

I October 1, 2013

4 Phase 1 functionality that is not necessary for October 1, 2013,

primarily updates and enhancements to release 3. (Iteration #4)

I December 15, 2013

5 Additional phase 1 functionality (Iteration #5)

Implementation and deployment of an online application and benefits

screener for human services programs that interfaces with the legacy

eligibility system.

I

II

March 1, 2014

6 Additional phase 1 functionality (Iteration #6) I July 1, 2014

7 Complex Medicaid eligibility

Human services eligibility

II December 1, 2016

Five deliverables in Phase 1 were specifically identified in the RFP as candidates for incremental delivery. The specific dates for each deliverable will be determined in the mutually agreed-upon work plan.

For each project iteration, Deloitte will provide incremental versions of the following deliverables:


• P1-FuncReq-n (Phase 1 Functional Requirements)

• P1-FuncDesign-n (Phase 1 Functional Design)

• P1-TechDesign-n (Phase 1 Detailed Technical Design)

• P1-TestPlan-n (Phase 1 Detailed Test Plan)

For each public release, Deloitte will also provide incremental versions of the following deliverables:

• P1-SystemTesting-n (Phase 1 System and Performance Testing)

• P1-Accept-n (Phase 1 Acceptance Test Report)

• P1-Launch-n (Open Enrollment Launch)

Deliverables, including intermediate deliverables, will be accepted after review with the understanding that deliverables will be modified as a result of subsequent releases as prioritized in the change control process. Deloitte will make changes to previously accepted deliverables in each iteration, within the following allotted modification hours:

Iteration Approximate Date Allotted Modification Hours

1 April 2013 3,000

2 June 2013 1,500

3 August 2013 500

Deloitte will work collaboratively with the State to allow for movement of the hours between the above iterations if they are not consumed with in each “sprint,” assuming that hours can be moved without risking the October 1, 2013, release.

Deloitte and the State agree that no modifications will be made to the August iteration before it goes live on October 1, 2013.

Any unused hours from increments 1, 2, 3 (“Roll-Over Hours”) will be made available for use after October 1, 2013, in support of increments 4, 5, and 6. In addition to those Roll-Over Hours, prior to August 1, 2013, the State and Deloitte will agree on an allocation of an additional 5,000 modification hours through the Change Order Process (“Modification Hours”) for changes to previously accepted deliverables in increments 4, 5, and 6. Those releases will follow the same approach as increments 1, 2, and 3. Use and allocation of the Roll Over and Modification Hours will be accomplished via the project change control process that will be defined in the Project Management Plan.

Deloitte will provide draft versions of each Deliverable to the State before submitting the final Deliverable for acceptance in order to allow sufficient time for the State to review the Deliverables. For any Deliverable, should Deloitte fail to provide a draft in a reasonable period of time prior to its final submission, then the State shall have an additional 10 business days of review time for the Deliverable.

In order to validate the overall vision and architecture of the overall application and reduce the amount of rework required in subsequent releases, Deloitte will complete the Phase 1 functional requirements and some elements of the functional design (including process


flows, screen order, high-level data elements captured per screen, and module objectives) before the first iteration is complete, with the understanding that subsequent iterations may uncover changes that will necessitate an update and re-delivery of the functional requirements and functional design may have to be updated as a result of the iterative process as prioritized in the change control process and within the agreed-upon modification allocations.

The attached Exhibit I lists the Deliverables associated with each milestone and the payment for each. Payment for each Deliverable is contingent on acceptance of the deliverable by the State, per section 6 of the Agreement. For Deliverables that iterate, payments will be prorated across each iteration on an equal basis.


5 Appendix M: Business and Functional Requirements

Appendix M from the Proposal is included here by reference, and takes precedence over Appendix M from the RFP, with the specific changes noted in the table below.

Throughout Appendix M, for requirements where Deloitte’s comment is “This is standard functionality in Deloitte's NextGen Platform,” (or similar language) the interpretation is that the requirements will be provided by Deloitte’s proposed solution as specified (and as further refined during the requirements phase), and is included in Deloitte’s scope of services.

Where Deloitte’s comment is, “Deloitte will work with Rhode Island to incorporate this functionality into Deloitte's NextGen Platform,” (or similar language) the interpretation is that the requirement is included in the scope of services.

ID Original Requirement Change or Comment

USX-5 The selected vendor shall design all user

interfaces with input from State users and

subject to State approval during all phases of

the Contract.

“State approval” will be defined as part of the

deliverable acceptance criteria.

Deloitte will provide the State access to relevant UHIP policy resources, including resources from the Deloitte Center for Health Solutions. Deloitte will provide these value added services as a courtesy and at no additional charge to the State. The Deloitte Project Director will be responsible for coordinating such access on a reasonable basis.


6 Appendix N: Technical Requirements Appendix N from the Proposal is included here by reference, and takes precedence over Appendix N from the RFP, with the specific changes noted in the table below.

Throughout Appendix N, for requirements where Deloitte’s comment is “This is standard functionality in Deloitte's NextGen Platform,” (or similar language) the interpretation is that requirements will be provided by Deloitte’s proposed solution as specified (and as further refined during the requirements phase), and is included in Deloitte’s scope of services.

Where Deloitte’s comment is, “Deloitte will work with Rhode Island to incorporate this functionality into Deloitte's NextGen Platform,” (or similar language) the interpretation is that the requirement is included in the scope of services.

ID Original Requirement Change or Comment

CCM-10 “The selected vendor shall provide complete

support for software error correction and

problem resolution. The selected vendor shall

be required to notify the State immediately.

The State shall prioritize Priority 1 and Priority

2 errors. The selected vendor shall resolve all

errors within the following timeframes:”

This requirement, along with CCM-10.1, CCM-

10.2, CCM-10.3, CCM-10.4, are deleted, as they

are duplicative with the SLAs in Appendix S.

CCM-10 “The selected vendor shall provide complete

support for software error correction and

problem resolution. The selected vendor shall

be required to notify the State immediately.

The State shall prioritize Priority 1 and Priority

2 errors. The selected vendor shall resolve all

errors within the following timeframes:”

This requirement, along with CCM-10.1, CCM-

10.2, CCM-10.3, CCM-10.4, are deleted, as they

are duplicative with the SLAs in Appendix S.

CFG-18 “The selected vendors solution facilities shall

be housed in a secure area, protected by a

defined security perimeter, with appropriate

security barriers and entry controls to include,

but not limited to:”

Delete (along with CFG-18.1, CFG-18.2, and

CFG-18.3), since the state will be responsible

for security in the data center.

CFG-18 “The selected vendors solution facilities shall

be housed in a secure area, protected by a

defined security perimeter, with appropriate

security barriers and entry controls to include,

but not limited to:”

Delete (along with CFG-18.1, CFG-18.2, and

CFG-18.3), since the state will be responsible

for security in the data center.

CFG-29 The selected vendor shall review system

security logs on a daily basis.

Vendor must also report any irregularities.

The proposed UHIP solution features this

requirement and it is part of the hosting

vendor's standard operating procedures


CFG-30 The selected vendor shall review system and

network access logs on a daily basis.

Vendor must also report any irregularities.

The proposed UHIP solution features this

requirement and it is part of the hosting

vendor's standard operating procedures

CFG-8 “The selected vendor shall provide

environmental Control including Data isolation,

HVAC, UPS, and fire suppression.”

Delete, since the state will provide

environmental controls in the data center.

CFG-8 “The selected vendor shall provide

environmental Control including Data isolation,

HVAC, UPS, and fire suppression.”

Delete, since the state will provide

environmental controls in the data center.

CRM-29 The CRM shall provide the ability to upload

attachments to correspondence records.

Deloitte will provide the ability to link

documents to CRM individual ID’s, family ID’s,

and “Case” ID’s. This is done through the

document management system and will be

available in the CRM solution in iteration 6.

CRM-30 The CRM shall provide the ability to view

related correspondence records from a single

correspondence record.

Deloitte will provide the ability to link

documents to CRM individual ID’s, family ID’s,

and “Case” ID’s. This is done through the

document management system and will be

available in the CRM solution in iteration 6.

CRM-38.1 Plug-in/double-jack monitoring This can be done physically if the phones

Rhode Island acquires for the call center

support this functionality. This can also be

done with the CRM software, which will allow a

supervisor to monitor an Agent’s call through

the Supervisor Monitor and their own phone

without the need to “plug-in” to an agents

phone.

CRM-38.2 Silent monitoring (including remote) Monitoring a call without the Agent or callers

knowledge is provided functionality.

CRM-38.5 Conferencing capability. The CRM software does have the ability to

conference in additional parties to an

INBOUND call that has gone to an agent. Once

the caller and agent are on the line, they can

conference in other people; supervisors or

other agents in the queue or someone outside

the queue. The software is NOT a conference

bridge where you would give out a number

people can call into for meetings, etc.

DAT-7.5 Data Cleanup activities associated with

conversion to the new normalized data

structure

A broad definition of the NGIS-to-Deloitte

handoff data cleanup follows. Some incoming

InRhodes data may not be immediately usable

and may require rework to put it in a usable


format to meet IES functional requirements.

Deloitte will thoroughly inventory the incoming

InRhodes data quality at the earliest possible

date. Similarly, NGIS will inventory the

exported IES data quality at the earliest

possible date. The State, NGIS, and Deloitte will

meet to delegate data cleansing

responsibilities to the appropriate organization

so as to satisfy IES functional requirements.

The proposed UHIP solution features a data

conversion plan identifying the scope of the

conversion, conversion process guided by

Deloitte's Enterprise Value Delivery for Systems

Integration methodology, schedule and

timeline. The plan shall also include data

structure model analysis, destination database

data model, data mapping, and conversion

process design.

EDM-2 The Document Imaging system shall provide

real-time sharing of client and case information

across program and jurisdictional lines.

Deloitte verifies that the system will support

the granular assignment of CRUD (Create,

Read, Update, Delete) permissions for EDM

users.

The proposed UHIP solution features the

electronic storage of documents which are

available to staff and can be shared across

program and jurisdictional lines, assuming the

proper security is configured.

The Document Imaging System includes the

purchase by Deloitte of EDM-compatible field

office scanners, the details of which are to be

finalized within 60 days of the date of this

Agreement.

EDM-4 Deloitte’s response: “Deloitte acknowledges

the SLA to have at a minimum ninety percent

(90%) of document image retrieval response

times during a given calendar day and be

within 5 seconds. The remaining ten percent

(10%) must not average more than twenty (20)

seconds for a given calendar day. Deloitte looks

forward to working with the State on the

ongoing monitoring and management of this

SLA.”

Deloitte acknowledges the SLA in Appendix S

and looks forward to working with the State on

the ongoing monitoring and management of

this SLA.”

EDM-4 Deloitte’s response: “Deloitte acknowledges

the SLA to have at a minimum ninety percent

(90%) of document image retrieval response

times during a given calendar day and be

within 5 seconds. The remaining ten percent

(10%) must not average more than twenty (20)

The specific service levels should be removed

from the response, and reference the SLAs in

Appendix S:

“Deloitte acknowledges the SLA in Appendix S

and looks forward to working with the State on


seconds for a given calendar day. Deloitte looks

forward to working with the State on the

ongoing monitoring and management of this

SLA.”

the ongoing monitoring and management of

this SLA.”

MNT-18 The selected vendor shall categorize each

Customer Service Request (change request) as

a defect or enhancement and indicate the

severity of the defect.

The vendor must document the build no. (and

other significant information) for defects and

enhancements in the Issue Log. The State

requires access to the Change Control

electronic tracking system to monitor progress

and view reports.

The proposed UHIP solution features the ability

to identify incoming requests as a defect or

enhancement along with severity, if a defect

MNT-8 “The selected vendor shall provide 24X7

availability for the web portal, and other

ancillary system components as required by

the State, in accordance with the attached

service level agreements.”

Delete, as this is covered by the SLAs in

Appendix S.

MNT-8 “The selected vendor shall provide 24X7

availability for the web portal, and other

ancillary system components as required by

the State, in accordance with the attached

service level agreements.”

Delete, as this is covered by the SLAs in

Appendix S.

REN-14.1 The Rules Engine shall be pre-populated with

all federal rules related eligibility

determination for the human services

programs included in Phase 2.

The proposed UHIP solution features pre-

populated MAGI-based Medicaid, human

services, and Exchange eligibility rules to

facilitate the development lifecycle of the

project. Deloitte will work closely with the

State to verify the rules and use the tools

proposed to promote transparency and

flexibility of rules development and testing

SEC-30 “The selected vendor shall provide the State a

report of any incidents of intrusion and hacking

regardless of outcome.”

The selected vendor shall provide the State a


regardless of outcome. Such reports must be

provided within 24 hours of a suspected

intrusion and within 48 hours of a confirmed

intrusion.

SEC-30 “The selected vendor shall provide the State a


regardless of outcome.”

“The selected vendor shall provide the State a


regardless of outcome. Such reports must be

provided within 24 hours of a suspected

intrusion and within 48 hours of a confirmed

intrusion.”


SEC-6.4 Dialup modem use is specifically disallowed

while attached to the State network

No connection should be permitted to the

State network while any other type of

connection is active. This includes wireless (if

they are using cable), cable, (if they are using

wireless), and any type of wireless broadband

unless it is the sole connection to the state

network via VPN.

SEC-79 The selected vendor’s solution shall provide

the ability to recover the User ID and password

via a secure automated method.

Ensure the secure method does not include

“Mothers Maiden Name" or "Name of First

Pet."

The proposed UHIP solution (TIM) provides out

of the box support for Forgot password

functionality.

WEB-5 The solution shall be browser-independent and

operate for most functions regardless of

browser brand, as long as the user’s browser

has broad usage and the version is recent in

publication.

Deloitte will support public website

functionality for the browsers Internet

Explorer, Firefox, Chrome, and Safari.

Satisfactory browser functionality will be

available above a browser version threshold to

be specified by Deloitte early in the project.

Administrative websites may be limited to one

browser such as Internet Explorer.

The proposed HIX solution is browser

independent and operates regardless of

browser brand. The IE solution is currently built

for Internet Explorer and may require low

complexity modifications to HTML to display

and function across browsers


7 Appendix S: Service Level Agreements

This section supersedes the tables in Appendix S in both the RFP and the Proposal.

For all of the SLAs in sections 7.2 through 7.56 the maximum and cumulative total amount at risk for Deloitte Consulting for any liquidated damages with respect to any and all failures in any month will not exceed 20% of the fees charged by Deloitte Consulting for Hosting and Maintenance and Operation Services for that month.

7.1 Performance Metrics

SLA Description Specifications Report

Period

Liquidated Damages

Phase 1 Operational Launch as agreed to in the

project plan and functional design no later than

October 1, 2013.

10/1/2013 $10,000 per calendar day

or portion thereof for day

1-10.

$20,000 per calendar day

or portion thereof for

every day thereafter.

Cap of $1 million

An Integrated Eligibility System (as agreed to in

the project plan and functional design) is live

and in production no later than December 31,

2016.

12/31/2016 $5,000 per calendar day or

portion thereof

Cap of $1 million

7.2 System Availability

The SLA applies to systems and activities under Deloitte’s direct control. System availability is defined as the servers under Deloitte’s control servicing three basic system tiers: 1) user interface, 2) business tier, and 3) data tier. The set of functions and screens utilizing all relevant servers that fall under the SLA will be established during design.

The SLAs define the hours that the production environment needs to be operational and available. This SLA also applies to the failover and disaster recovery environments when they are used for production.

The SLAs allow for exclusions for planned downtime (for example, during a major upgrade or roll out). Planned downtime will be agreed upon prior to the period to which the SLA applies and taken into consideration during the calculation.


SLA Description Specification

Report

Period

Liquidated Damages

Production

Environment Hours of

System Availability

for citizen-facing

functionality

Access Hours:24 hours/day, 7 days

a week, excluding planned

downtime.

System availability requirement is

99.9% during business hours and

95.0% during non-business hours

over the course of a calendar

month.

Business hours are defined as 6:00

AM to 12:00 AM, seven days per

week, excluding planned

downtime.

SLA applies to systems/activities

under Deloitte’s direct control.

These systems/activities will be

determined by mutual agreement

during the design phase.

Monthly

$3,500 per hour (or any portion

thereof) for any period in which the

production environment is not

operational or available during the

times set forth in the specification

with a cap of 45 hours per month.

Earn backs will be available if SLA is

exceeded for 2 consecutive months

following the month in which the

SLA was not met.

Production

Environment Hours of

System Availability

for worker-facing

functionality

System availability requirement is

99.9% during business hours and

95 % during non-business hours

over the course of a calendar

month.

Business hours are defined as 7:00

AM to 6:00 PM M-F; 7:00 AM –

2:00 PM Sat., excluding planned

downtime.

SLA applies to systems/activities

under Deloitte’s direct control.

These systems/activities will be

determined by mutual agreement

during the design phase.

After initial implementation of the system (release 3 as defined above), the State will provide Deloitte a grace period of 90 days during which the availability requirement is lowered to 99.0% during business hours for each category above.

After each major release (as mutually defined in the project plan) the State will provide Deloitte a grace period of 45 days during which the availability requirement is lowered to 99.0% during business hours for each category above. Deloitte and the State will mutually agree to define "major upgrade/implementation" to only include substantive upgrades, such as the releases 3, 5, 6, and 7.


The State retains the option to impose liquidated damages during the grace periods. Periods of unusually high transaction volumes would be an example of a period where the state could choose to not impose liquidated damages

7.3 Processing Performance

SLA Description Specification

Report

Period

Liquidated Damages

Electronic Log Files

(Maintenance)

Files saved by the

computer operating

system to record its

activities.

The Contractor must maintain the necessary

data in appropriate log files. During design,

the State and Deloitte will define log files as

being in one of three categories, with the

following respective SLAs over the course of

a calendar month:

Critical: 99.5%

Important: 95.0%

Normal: 90.0%

Monthly $1,000 per occurrence,

with a cap of 10

occurrences per month.

Earn back allowed if 100%

is achieved for 2

consecutive months

following month in which

the SLA was not met.

Electronic Log Files

(Processing)

Files saved by the

computer operating

system to record its

activities.

99.5% of electronic log files must be

processed within the next scheduled

processing window within a calendar month.

During design, the State and Deloitte will

define to which log files this SLA applies.

Monthly $1,000 per day, with a cap

of 10 days.

Earn back allowed if 100%

is achieved for 2

consecutive months

following month in which

the SLA was not met.

Inbound Files

Files coming into the

HIX from trusted

sources.

Process 100% of inbound files within the next

scheduled processing window within a

calendar month.

During design, the State and Deloitte will

define to which files and trusted sources this

SLA applies.

Deloitte will not be held responsible for

failures due to data issues caused by the

sending third party.

Monthly $1,000 per day, with a cap

of 10 days

Outbound File to Data

Services Hub

Files exported from

HIX to the Data

Services Hub

If the Data Services Hub requires batch files,

process these files at a minimum every hour

(or as frequently as the Hub requires),

excluding periods when the Hub is not

available.

Given several open questions regarding the

Data Services Hubs, this SLA will be re-visited

after design.

Monthly To be re-visited after

design.


7.4 Real-Time Transaction Performance

The SLAs below apply to all real-time transactions, including but not limited to the web portal, web-based applications, and other real-time connections, for systems under Deloitte’s control. This SLA also applies to the failover and disaster recovery environments when they are used for production.

These SLAs will be validated during performance testing to determine if the timings can be achieved (due to design changes, hardware configurations, etc.) and if changes are required, Deloitte and Rhode Island agree to mutually collaborate on the metrics.

SLA Description Specifications Report

Period

Liquidated Damages

Transactions involving the

user interface, business

tier, or database tier.

Response time for users accessing the

system must not be greater than 2.5

seconds, on average, for a given

calendar month.

Weekly $2500 per week that the

mean response time

exceeds the specification.

The State assumes the

99% provision means that

the 1% slowest response

times are thrown out

before calculating the

average.

Earn backs available for

exceeding the SLA for 2

consecutive months

following the month in

which the SLA was not

met.

Transactions that require

interface with a third party

application or COTS

application

Response time will be 10 seconds or less

for 99% of the transactions on average.

Transactions that require

integration across multiple

enterprise databases

and/or middleware

interaction

Response time will be 8 seconds or less

for 99% of the transaction on average.

Image Retrieval

The time it takes to get a

viewable image to the

application service. This

SLA applies to images

generated from systems

under Deloitte’s control.

At a minimum ninety percent (90%) of

document image retrieval response

times during a given calendar day must

be within 5 seconds. The remaining ten

percent (10%) must not average more

than twenty (20) seconds for a given

calendar day.

Deloitte and the State will establish a

test machine with a clean network that

can be used to evaluate the speed of

the image processing.

During design, the State and Deloitte

will define to which images this SLA

applies.

Cannot be held responsible for images

displayed by users without standard PC

image and processing power

(requirements to be developed).

Monthly $1,000 per day with a cap

at 5 days.

Earn backs in future

months for exceeding the

SLA for 2 consecutive

months following the

month in which the SLA

was not met.


7.5 Business Continuity SLA

SLA Description Specifications Report Period Liquidated Damages

Back up and Recovery

Backups must be executed

daily (incremental) and

weekly (full).

100% of backups will occur

on the agreed upon daily

and weekly schedule.

This excludes time that the

system is down for HW/SW

issues.

Recovery must be able to

start within one (1) hour

and complete within (4)

hours of the determination

a recovery is necessary,

excluding periods of

downtime (planned or

otherwise).

Recovery start time will be

measured by the time the

request is made to a live

contact and when the initial

steps of recovery begin.

This SLA will be reviewed

quarterly.

Upon

Occurrence for

recovery;

monthly

reporting on the

daily and weekly

back ups

$2,500 per occurrence

Failover and Fallback Failover

and fallback is the capability

to immediately switch

operations from the

production environment to

the failover environment in

the event technical problems

incapacitate the production

environment.

Failover and fallback

processes must be executed

if the primary production

configuration is unavailable.

Failure over will occur

within 20 minutes.

Failover start time will be

measured by the time the

request is made to a live

contact or when the

automated failover tools

begin processing.

After the design phase the

parties will revisit the SLA to

evaluate the impact of any

design changes on the

ability to bring the critical

applications back to

functionality within the

timeframe required herein.

Upon

Occurrence

$5,000 per occurrence

Disaster Recovery refers to

major disruptions to the

Disaster recovery processes

must be executed in the

Upon

Occurrence

$10,000 per day for each day

the site is not operational


production environment.

Plans, procedures, and

infrastructure need to be

established to recover from a

major disaster and resume

daily operations.

event of a production site

failure. Site must be

operational within 2 days.

after 2 Days of when it is

determined that disaster

recovery is required

7.6 Software Deficiency SLAs

Reference Section 18.4.2 of the Agreement

SLA Description Specification Report

Period

Liquidated Damages

Severity 1 - Fatal

Fatal Bug. HIX/IES System did not

work. Significant parts of the

HIX/IES System were inoperable.

There was no viable workaround.

Deficiency rectified within 12 hours.

If not fixed by then, Contractor

must present the State with an

emergency resolution plan.

If a workaround is implemented,

the issue is downgraded to Severity

2 and the SLA below will apply.

Problems caused outside of

Deloitte's control do not apply

Monthly $7,500 per calendar day

1-15 days beyond

Performance Standard


> 15 days beyond


Severity 2 - Serious

Serious Bug. Primary business

requirements could not be met

with the HIX/IES System. There

were no easily apparent viable

workarounds. Performance,

functionality, or usability was

seriously degraded.

Deficiency rectified within 3 days. If

not fixed by then, Contractor must

present the State with a high

priority resolution plan.

SLA is 3 days average for all severity

2s within the reporting period

If a workaround is implemented,

the issue is downgraded to Severity

3 and the SLA below will apply.



Monthly $4,000 per calendar day

1-15 days beyond



> 15 days beyond


Severity 3 - Normal

Normal Bug. Business

requirements can be met with the

HIX/IES System. Any needed

workarounds are apparent.

Performance, functionality, or

usability is not seriously degraded.

Deficiency to be rectified at next

scheduled release. Contractor must

document the fix in a

Comprehensive Issue Resolution

Plan comprising known issues.



Monthly $500 per calendar day

beyond Performance

Standard

Severity 4 - Minor

Minor Bug. Minor typos, wish list

suggestions, a nice to have, but

not required change. Would not

Deficiency to be rectified at a time

and in a manner mutually agreed to

by the parties. Contractor must

document the defect status in a

Monthly None.


impact release accuracy or

usability in any significant way.

Comprehensive Issue Resolution

Plan comprising known issues.


8 State of Rhode Island Resource Requirements

• The State will provide resources to support the project and make decisions based on the mutually agreed project plan with requisite knowledge of Rhode Island programs, policy and technology. As appropriate, State will make available other vendors (such as the branding/marketing vendor) available to the project. Deloitte expects that sufficient Rhode Island decision makers will be available to support and have the authority to make decisions on the design, development, test and implementation of the new system.

• The State of Rhode Island will authorize Deloitte to access CALT (including Rhode Island’s private community) on the State’s behalf.

• The State of Rhode Island will invite staff from Deloitte to participate on calls with CMS or other federal agencies that are related to the UHIP project as appropriate.

• The State of Rhode Island must approve the purchase of all hardware and software necessary for Deloitte to purchase for the development, conversion, testing, training and production environments within the timeline mutually agreed to in the project work plan.

• The State of Rhode Island is solely responsible for all mailroom operations, as well as, maintenance and operations of the associated mailroom equipment.

• Deloitte and the State will collaborate on the development, implementation and maintenance of the corresponding security and privacy policies, procedures and standards applicable for the solution. The State is ultimately responsible for the content and approval of these policies and standards, and Deloitte is responsible for producing the deliverables according to the project plan. These activities should commence at the beginning of the project and state staff should work and establish these standards in parallel with the design, development, testing and implementation activities so that the approved work plan dates are achieved.

• The State of Rhode Island will provide appropriate resources (e.g. approximately 2-5 dedicated resources per track), with the appropriate knowledge and skill sets and will engage other state resources as required for requirements validation, design, testing and all other phases per the approved project work plan.

• The project team will execute up to four requirements validation sessions concurrently and Deloitte assumes State SME resources, with the appropriate skills sets, will be made available to participate.

• Deloitte’s ability to meet the project schedule and the proposed fixed-cost is predicated on interface partners and data providers being ready per the project timelines, specifically, the CMS data HUB. The State of Rhode Island UHIP project manager(s) and Deloitte will monitor these external partners in order to anticipate and resolve any potential impacts to the overall project timeline.

• The State will act as liaison with the federal government (e.g., CMS) and other state agencies during the duration of the contract and will work to resolve issues or question in a manner that allows the project to adhere to the agreed upon work plan dates.


• The State of Rhode Island OHIC and the Health Benefits Exchange will be the liaison with the Health Plans including certifying health plans to be used on the exchange and work to resolve issues or question in manner that allows the project to adhere to the agreed upon work plan dates.

• Deloitte assumes Rhode Island will enter into MOU’s with the states from which the proposed solution will leverage technical components. The states include Texas, Michigan and Montana, as well as any other States that may need to be included. These states have all cooperated in providing MOU’s to other states in the past.


9 Hosting Scope of Service

9.1 Overview

The primary site for the technology to support the project will be based in the State’s Data Center in Warwick, RI. Hardware components proposed for the Warwick data center facility have been sized to support the projected growth in processing power, RAM demand, storage and backup/archival. It addresses the following categories of:

• Technology

• Cisco UCS Servers

• EMC SAN Storage

• Cisco Network Gear (all required on-premise LAN and WAN communications technology)

• EMC Backup Data Domain Technology and Tivoli Backup Management Software

A Bill of Materials is included in a later section of this document.

9.1.1 Computing Technology

The server architecture design uses the latest in virtual technology and clustering. All physical hosts in an ESX cluster are redundantly dispersed across multiple processors. This provides us the ability to handle entire processor failures without disrupting services. In the event of a single host or processor event, the virtual machines on the effected host will be brought back online automatically utilizing VMware’s HA technology. These VMs will act as if they have recovered from an unexpected reboot and will be back online supporting connections within minutes.

Cisco UCS provides a single point of management for all rack servers, and virtual devices across the environment. The GUI has an intuitive design that is simple to navigate and provides a robust alerting and notification system to ensure that our hosting subcontractor, NTT DATA, will be aware of overall architecture health at all times.

Service profile templates make adding additional hardware as simple as plug and play utilizing stateless compute technology, thus allowing NTT DATA to fully manage, configure, augment and troubleshoot the entire system remotely as needed. By using updating service profile templates, engineers can perform tasks on already existing servers such as adding NICs, HBAs, or modifying VLAN’s without having to bring the servers offline. The Fabric Interconnects are configured in an active/standby mode in order to provide full redundancy for SAN and network connectivity.

The reasoning behind the choice of Cisco is that they have significant experience in responding to customer requirements with solid technology innovations for the enterprise data center. Unified computing elevates the traditional product classification of network, server, storage, operating systems, and applications to a data center-wide vision. Cisco Unified Computing Services helps NTT DATA quickly deploy data center resources, simplify ongoing operations, and optimize infrastructure to better meet the State’s needs.


9.1.2 SAN Technology

The team will be employing EMC VNX 7500 technology, which offers redundant storage processors, power supplies, drive paths, and SAN switches. It also utilizes battery backup storage processors to ensure write cache completions and has the ability to support all types of RAID scenarios, proactive hot sparing, and instantaneous fault detection using call home features to the vendor.

The drives in the clarion are a combination of SSD, 15K, 10K, and 7.2K RPM drives to provide customizable storage solutions to fit any scenario. We will also leverage EMCs Auto-Tiering and FAST CACHE technologies to actively search for hot and cold spots within the data LUNs and proactively promote or demote these areas in 1GB chunks to a disk type that will affectively meet the IO needs of the specific applications. This removes the needed upfront design challenges of architecting the LUNs in a static and sometimes wasteful fashion.

The Unisphere management interface gives NTT DATA full control of the EMC SAN and an incredibly easy to use system to manage Disks, Pools, LUNs, and Storage groups. NTT DATA will also be using true SAN-boot for stateless computing (no hard drives needed in any of the servers). This reduces the overall cost to run and support the environment from an electrical and cooling standpoint and provides a “No moving Parts” approach.

9.1.3 Network Technology

The entire network architecture is designed to support N+1 fault tolerance. All switches have a redundant partner working in an Active/Active manor. This includes Ethernet switches, SAN switches, firewalls, internet and WAN connections. The network is built using latest switching technology from Cisco that is extremely scalable and can support high data throughput, with individual port capability of speeds up to 10 Gigabit per port.

The design of the network allows for ease of expansion for future growth. Each server will have 40 GBs of IO throughput divided between SAN and Network. This will allow NTT DATA to deliver the most out of each device and ensure bottlenecks are nonexistent.

9.1.4 Backup Infrastructure

The combination of Tivoli Storage Manager and EMC Datadomian will work together to reduce the large demand of a backup infrastructure by leveraging forever incrementals and hardware dedupe technology. This provides NTT Data to facilitate recovery of databases and files in the event of data corruption at lighting speeds and will meet the SLA demands of our client. . This technology is engineered to provide offsite storage at NTT DATA data center locations by leveraging replication technology built into the Datadomain product. Sizing was done to allow for multiple full images to be archived for compliance and audit trail capabilities.

9.1.5 Power

All of the equipment uses two power feeds per device. Each feed is supplied to our racks from distinct locations using separate UPS devices and generators to ensure a single power event on one feed will not impact our service offering. The Deloitte team will work with


contractors (listing provided by the state) to establish the power connections within the Warwick Data Center.

9.1.6 HIPAA Compliance

All technology in the Warwick data center (and that used for offsite failover and backup storage) is engineered to meet HIPAA compliance standards.

9.2 Scope of Services

The following table highlights the scope of services provided by the Deloitte/NTT hosting team:

Category What It Includes

Hardware Total Current Costs includes all on-premise hardware plus backup management

software

Includes hardware maintenance

All software cost up to and including the OS layer

Co-Location cost associated with locating racks in Rhode Island datacenter

Pricing assumes that the hosting infrastructure will experience 3% per year organic

growth of the initially configured environment from 2015 on.

Data Center Services Management of all network infrastructure (switches, firewalls, load balancers, et.)

associated with the UHIP system. NTT will work with Deloitte on the setup of this

equipment

Hardware, OS, VMWare, Remedy and other monitoring software upgrades. NTT will

adhere to all requirements in Appendix N regarding software versions and patches

VPN Access will be provided for UHIP development and state project staff

Data Center Services, cost included the following:

• Network Connectivity (Internet)

• Data Backups

• Firewall / Security services

Infrastructure

Managed Services

Provide a 1-800toll free number to report incidents or service interruptions as well as

a 247/7 portal site that can be used to provide reports and real-time and semi-real-

time reporting.

CIS Services, cost included the following:

• Gold Services (as outlined in our task write-up) for Production Environment

• Bronze Services for all Non-Production Environments

DR Technology and

Services

Disaster Recovery Services cost included the following:

All technology required at failover site (San Jose, CA)

• Data replication services


• Annual Disaster Recovery test

WAN Communication Not included in the RFP response

Redundant 45-50 Mbps Internet connections to Warwick data center

Dedicated 20 Mbps WAN link from Warwick to NTT DATA San Jose site

Network switching gear to provide network failover in case of a drop in Internet or

dedicated WAN service

All installation and management charges for initial and ongoing WAN support

Data Center

Operations Cost

Includes the cost of operating the Warwick data center technology including power,

cooling and space charges (estimated over the contract period)

NTT Cloud Discussed as part of the phased implementation of infrastructure

Provides virtual servers per some CPU, memory, and storage

Includes a one time setup fee and ongoing monthly operational fees

9.3 Hosting Bill of Materials

The Hosting Bill of Materials (“BOM”) is attached in Exhibit I.

9.4 Assumptions

The following assumptions are a subset of the assumptions provided to the state during the recent contracting meetings and bridging document creation:

• Deloitte will deploy Identity and Access Management (IAM) in four environments, i.e., Development, Unit Test, UAT, and Production. The four IAM environments will support the appropriate (up to seven in aggregate) applications (IE/HIX) non-production and production application environments

• Deloitte will deploy the out of the box (OOTB) reports provided by TIM and TAM for meeting the requirements for security auditing and exceptions.

• For the PKI integration with the HIX/IES solution, Deloitte uses the native capabilities provided by Microsoft’s Certificate Authority services for digital certificate generation and integration. Deloitte has not scoped for a complete deployment of a PKI solution as part of the project.

• Production Hardware and Non-Production Hardware are to be separate environments

• For Production, we assume a 2 to 1 subscription of virtual machines to Physical Servers

• For Non-Production, we assume a 4 to 1 subscription of virtual machines to Physical Servers

• The hardware for all Oracle products will be sized to be Physical Servers, NOT Virtual Servers due to the Oracle Licensing model

• Within the assumptions document component of the bridging document there is a table which highlights the assumptions by which the hardware and software have been sized

• General Infrastructure Assumptions (Development and Testing Environments)


• Assumes UAT is a mirror of production with less CPU, Memory, and storage. In addition, UAT is a mirror of production except when there are more than 2 servers required in production. If there are more than 2 servers planned for production, the UAT configuration shall implement 2 servers. The configuration of high availability in UAT shall mirror production however the additional servers are not required which will help to reduce cost and complexity.

• Assumes security (TAM and TIM) for test mirrors production in terms of configuration

• The Deloitte team will use a ticketing tool (Remedy) to satisfy infrastructure service related issues.

• Response time will be measured by the BMC tool, our responsibility for response time begins at the network demarc back to and including the interface servers. Application and network response time for those components not under the direct control of Deloitte are outside of our responsibilities. For the measurement of image response time, Deloitte and the State will develop a test machine to effectively and accurately test the ability of the system to acquire and display images.

• Deloitte will lead one disaster recovery test per year as scheduled by the State. Deloitte will participate in the test providing application and testing services.

• Any upgrades of equipment in local offices across Rhode Island are not included in the hardware or software fees. Deloitte will work with the State to determine the appropriate equipment/bandwidth and the impacts upon the Service Level Agreements for the application.

• The Deloitte team is using SAN Replication only for DR.

• The Deloitte team assumes that the tool used to measure the SLAs will be BMC monitoring tools.

• If State usage volumes exceed anticipated 3% growth levels, or significant upgrades or changes are made to the application environments that impact performance and SLAs during the term of this agreement, the Deloitte team will work with the State to identify necessary sizing modifications. Subsequent changes in the infrastructure components and configuration may alter the proposed annual fees. Our costs do not include network cost to provide data replication between the Rhode Island datacenter and the Deloitte team Disaster Recovery site in San Jose, CA.

• The state will reimburse the Deloitte team for the refresh that occurs in year 5 of the contract

• Data Center Services costs include the following:

• Network Connectivity (Internet)

• Data Backups

• Firewall/Security services

• CIS Services costs include the following:

• Gold Services (as outlined in our task write-up) for Production Environment

• Bronze Services for all Non-Production Environments

• Disaster Recovery Services costs include the following:

• All technology required at failover site

• Data replication services

• One Annual Disaster Recovery test has been included in our pricing


• Our approach to refreshing the infrastructure is based on a phased refresh of each environment after year 4, based on Rhode Island business needs at that time. Specific refresh requirements will be identified and implemented by mutual agreement.

The following table details our assumptions concerning the software sizing proposed for the project:

Software Assumptions

IBM Websphere Application

Server ND 8.0

• Assumes avg visits per day = 750

• Assumes peak # visits in 60 min = 400

• Assumes each user login once every hour

• Assumes during a typical session, on avg there will be 30 page requests made

during peak hour of the day

• Assumes 100 dynamic pages served during the peak hour of the day

• Assumes browser pages per second: 500*100/3600 = 13.8 (peak active users

* page visits/3600)

• Assumes Think Time = 3 min

• Assumes 100 web service messages per hour

• Assumes 0.027 web service transactions per second

IBM Tivoli Access Manager

Tivoli Identity Manager 7.1

• Assumes 20% growth year of year in consumer adoption after year 2 (using

202,000 at end of year 2)

• Assumes 2 employees per employer

• Assumes 5 staff per carrier with 5 Carriers expected

• Assumes 200 brokers and remains constant over time

• Assumes 100 Navigators and remains constant over time

• Assumes 55 internal employees and 400 eligibility worker staff and remains

constant over time

• Assumes question 91 - Section 1.1.1 Health Benefits Exchange Anticipated

Exchange Use

• Assumes that all users (internal and external) will need to access protected

resources via the use of TAM

• Assumes that external users shall use the account management features

provided by the self service application as adopted from the NextGen platform

(no TIM)

• Assumes that internal users shall use the identity management features

provided by TIM

• Users: Individual Consumers 484,800; Employers 7,500; Employees 15,000;

Carriers - Staff 25; Brokers 200; Navigators 100; Internal Staff 455; Non-prod

staff (all environments) 250

• TAM: 508,330 total users

• TIM: 705 total users (Need to make it equal to TAM = 508,330)

IBM Rational AppScan

Standard Edition 8.5

• Assumes 4 releases per year

• Assumes 5 days per vulnerability scan

• Assumes a total of 20 days of vulnerability scanning per year

IBM Q-Radar - SIEM tool Assumes Flows/Minute=25,000 (50,000 NetFlows), EPS=1000, Log Sources =

750, Network Objects = 1000.


Assumes QFlow Collector(s) for layer 7network activity monitoring.

Assumes and includes 6 TB of onboard storage

SMA OpCon/Xps Core 5.0 • Assumes 1 Core for Prod and 1 Core for Non Prod

SMA OpCon/Xps Agent 5.0 • Assumes Non Production: 3 servers with ETL + 4 servers with Java batch = 7

servers (requires 7 OpCon/Xps Agents)

• Assumes Production: 1 server for Corr Batch + 2 servers with Java batch = 3

servers (requires 3 OpCon/Xps Agents)

Netrics Tibco Patterns 4.5.1 Production

1. Given the # records to be loaded and the request rate – a single CPU Core

(TIBCO calls a processor) will easily handle the workload = 1 production

processor for TIBCO Patterns - Search

2. A full active-active configuration is needed to 100% uptime = 1 production

processor for TIBCO Patterns – Search

3. Total for production = 2 processor for TIBCO Patterns – Search

Non-production – Given the requirements and volume, assume and include 1

CPU for development, 2 CPU for testing, and 1 CPU for training/certification.

Experian Precise ID and

Knowledge ID



Assumes 2 employees per employer

• Assumes 5 staff per carrier with 5 Carriers expected

• Assumes 200 brokers and remains constant over time

• Assumes 100 Navigators and remains constant over time


constant over time


Exchange Use

• Assumes that all users (internal and external) will need their identity proofed

as part of account creation

• Users: Individual Consumers 484,800; Employers 7,500; Employees 15,000;

Carriers - Staff 25; Brokers 200; Navigators 100; Internal Staff 455; Non-prod

staff (all environments) 250

• Assumes the following number of annual transactions: CY12: 141530, CY13:

70875, CY14 - CY20: 42275

Crystal Reports 11

Professional

• Assumes 10 named users to design reports


Adobe LiveCycle Output 10.0 • Assumes total population of Rhode Island - 1.05M

• Assumes 3x the eligible population of Montana (generates ~1,500 notices

per day)

• Assumes 1/2x the eligible population of Wisconsin (generates ~7,500 notices

per day)

• MT has 150 eligibility workers (excludes registration staff, managers, central

office staff, and others who provide more , each worker processes an average

of 12 case actions per day. Each case action generates 1.1 notices

(accommodates for attachments), so the expected number of documents

generated daily is 150 * 12 * 1.1 = 1980 documents per day

• RI has 450 total workers - each worker processes an average of 12 case

actions per day. Each case action generates 1.1 notices (accommodates for

attachments), so the expected number of documents generated daily is

450*12*1.1 = 5,940

• Assume 10% of all notices are generated online and the other are all batch.

During a 20 hour window of user activity (incudes worker and citizen), that

equates to 30 docs generated per hour and then .5 docs generated per

minute.

• Assume document generation only - no requirements for content

management, AFP printing Estimate based on Adobe Digital Enterprise

Platform Document Services - Output - Capacity Planning Guide

• Assumes a total of 862,000 total seeking insurance, 273,000 for eligibility,

81,000 for enroll

• Assume on average each document generated is 3.5 pages (notices, letters,

forms)

MyEclipse Annual

Membership - Blue Edition

• Assume 125 developer seat licenses

• Assume 20% for maintenance year over year

Snagit 10 100-499U Eml ($/U) • Assumed used during the development and testing phases

• Assumes 100 licenses required for development staff, testing staff, and

project staff

• Assumes multi-user licenses (1 key, install on multiple workstations, up to

100)

• Assumes licenses are transferrable when staff leave or exit project

CA Erwin Data Modeler v8.0 • Assumes 3 licenses for DBA and database support staff

Adobe Robohelp Office 9.0 • Assumes 3 licenses for authoring support and design. No server license is

required

Oracle SQL Developer 3.1 • This is included with Oracle 11G

JSpell Pro Suite • Used for spell check in the integrated eligibility application - case notes

• Assumed Site License: Site License is defined as: If you have three or more

servers it is usually more economical to obtain a Site License. A site license has

no restriction on the number of servers that may run the software at your site

for the purchasing domain. A site is defined as a single city.


Jama Contour 3.4.2 • Requires an Oracle or mySQL database to store the requirements/test

cases/data

• Assumes use during requirements, traceability through SDLC, and all testing

phases

• Assumes 100 State staff/contractors and 150 Deloitte staff on the project

• Assumes 15% of staff will be involved/require Contour licenses full time - 35

named licenses

• Assumes 5% of all staff allocated for floating licenses (peak usage and

overage) - 15 floating licenses

Jama - JIRA Connector • Supports synchronization between items in Jama and JIRA - use for design,

development, test cases, and defects

Jama Professional Services -

Pre-Paid Service Hours

• Assumes 25 hours of professional services

Atlassian Bamboo 5.0 • Uses State of Montana model , which uses 7 agents - assume 10 agents are

required

• Assumes 10 deployment components across the solution

Atlassian Crucible 2.7 • Assumes 100 users

Atlassian FishEye 2.7 • Assumes 100 users

Atlassian Jira 5.0 • Assume >100 users and <500 users -> only 1 license available Anything above

500 is enterprise licenses

Microsoft Project Plugin to

Jira

• Assume use during planning phases for synchronization between project

plan and JIRA tasks

Adobe Captivate 5.5 • Assume 3 licenses for training staff and content creators of computer based

training

LiveZilla 4.1.0.3 • Assumes and includes Unlimited Operator License

• Assumes and includes Premium Option Statistics & Reports

• Assumes and includes Premium Option Backlink Removal

• Assumes and includes Premium Option GeoTracking

• Assumes and includes Premium Option Startpage

Snowtide Analytics PDF 2.x • Assumes 4 servers in production

• Assumes 1 year of maintenance included

• Assumes additional years of maintenance and support shall be paid in year 4

(upgrade year)

• Assumes software assurance (free upgrades and bug patches) and

guaranteed support response

• Assumes PDFTextStream is licensed on a per-server basis. You must purchase

one deployment license for each server on which you plan on using

PDFTextStream. Development (non-production) licenses are free with the

purchase of any license


Freedom Scientific JAWS 13 • Assumes 2 testers

hiSoftware AccVerify 11 • Assumes 3 testers

SugarCRM Sugar Enterprise

6.5

• Assumes there are 50 call agents or 50 SugarCRM licenses

• Assumes 500K Angel minutes

• Assumes Angel works with the human operator version of these services

(TTY/TDD) where the application can be specially built to handle the long

pauses associated with interactions of this type. The functionality would be the

same for the hearing vs the hearing impaired so a similar experience can be

had; the difference becomes the IVRs ability to wait for a response in a longer

than expected manner to give the operator the chance to get the information

from the user of the service.

Oracle Policy Automation

Rules Engine 10.4

• Oracle Policy Automation (OPA) run on 2 blades each with 6 x Intel core (12

Cores Total)

• There will be 4 users of Oracle Policy Modeler (OPM)

Oracle Database Enterprise

Edition 11gR2

• Oracle Database 11g Enterprise Edition (Production, Dev, TST/TRN/CER) will

run on 3 node cluster each with 12 Intel cores (36 cores total). This is based on

the requirement of 32 vCPUs (16 x vCPU for Production, 8 x 16 x vCPU for TST,

and 8 x vCPU for TST/TRN/CER.

• Real Application Cluster (RAC) will run on the 3 node DB cluster each with 12

Intel cores (36 cores total).

• Advanced Security will run on the 3 node DB cluster each with 12 Intel cores

(36 cores total).

• Diagnostics Pack will run on the 3 node DB cluster each with 12 Intel cores

(36 cores total).

• Tuning Pack will run on the 3 node DB cluster each with 12 Intel cores (36

cores total).

• No Oracle licenses are required for DR since NTT utilizes SAN Replication

only, not Oracle Data Guard or other Oracle replication software.

• Database server will only be active for Disaster Recovery Tests and in the

event of Disaster.

Oracle Real Application

Clusters (RAC) 11gR2

Oracle Advanced Security

11gR2

Oracle Diagnostics Pack

11gR2

Oracle Tuning Pack 11gR2

WebTrends Web Analytics 10 • Assume Elgibility = 200k txn/day

• Assume HIX = 15k txn/day

• Assume 22 working days in a month @ 200k txn/day – 4.4M txn/month @12

months -> 52.8M transactions per year for the eligibility component

• Assume 30 days per month @15k txn/day - ->450k txn/month @12 months -

> 5.4M transactions per year for the HIX component

• Assume in total, we would expect 58.2M transactions per year = 60 million

annual transactions/page views

ImageNow Client/WebNow

Combo 6.6


constant over time

• Assumes 55 internal staff (35 to 50 in call center, 10 policy and financial

management staff) are not responsible for scanning

• Assumes no more than 15 scan locations with no more than 10 users per

scan location - 150 scan users

• Assumes 20% of eligibility workers will be scanning documents at peak hour -

ImageNow Enterprise Server-

T2 6.6

ImageNow Envoy 6.6


ImageNow iScript 6.6 80 staff total

• Assumes question 91 - Section 1.1.1 Health Benefits Exchange

Anticipated Exchange Use:

For Rhode Island assumes 200,000 recipients, this is based upon an

assumption that Rhode Island is roughly 20% of Wisconsin, which scans

365,000 doc per month for 1M recipients - (4.3 docs/recipient/year). • NH

scans 170,000 docs per month for 150,000 recipients (13.5

docs/recipient/year)

• Assume .86 docs/recipient/year on the low side and 2.7 docs/recipient/year

• Assumes 540,000 on the high side and 172,000 on the low side - split the

middle for RI - 356,000 total documents scanned per year

• Assumes documents on average are 2.5 sheets and the first page is the cover

sheet and includes the OCR capability - so 3.5 sheets in total for scanned

documents

• Assumes 154,258 cover sheets at the high side and 49,142 on the low side

• Assumes Rhode Island splits the middle of these two implementations so

101,700 OCR'd files per year --- This is required for the OCR component

• Wisconsin, for example, has 150 scanner connection points across 72

counties/offices ~ 2 scanners per office

• For Rhode Island,: Assumes 15 offices with 2 high speed scanners per office

or 2 change centers with 15 scanners - this is configurable based on RI needs

• Includes and assumes the following components:

• Business Insight - BI component and provides BI component to reporting

• Standard reports library that comes with Business Insight

• Perceptive Insight - bottlenecks and productivity reporting

• Assumes no more than 100 concurrent users per the requirements

• Assume no more than 35 staff are viewing scanned documents at a time

• Assumes no back file conversion and assumes rolling back-log as cases come

up for renewal, they are added to the document imaging repository

• Assumes Approximate enrollment by program in SFY 2012:

Medicaid: 195,000

TANF: 16,000

Child Care: 6,700

SSI: 33,000

GPA: 800

SNAP: 170,000

ImageNow Message Agent

6.6

ImageNow Message Agent

Transaction Packs 6.6

ImageNow Test Environment

Licensing 6.6

Angel 2.0 Assumes 50 agents supporting call center

Assumes 50 agents spend 160 hours per month x 60 min/per = 480,000

minutes spent per month

HP Fortify 360 Assumes product for 1 server, 2 CPU

Assumes 25% maintenance

Synthetic Transaction

Monitoring – BMC TMART

(Transaction Management

Application Response Time)

Assumes monitoring capabilities meet the requirements of the RFP

Assumes virtualization software is capable of providing virtual servers to meet

the requirements of the RFP.


Real-end user monitoring –

BMC EUEM (End User

Experience Management)

Infrastructure Monitoring –

BMC BPPM (BMC

ProactiveNet Performance

Management)

VMWare

Adobe EchoSign • Assumes 45,000 signatures

• Assumes 2.5 people per family



• Assumes 2 employees per employer

• Assumes the individuals requiring e-signature include the individual

consumers, employers, and employees


Exchange Use


10 Maintenance and Operations Maintenance & Operations Activities

Deloitte will perform the following list of activities during the Term.

10.1 Maintenance and Operations

Deloitte will provide the maintenance and operations support services activities indicated below. These activities will be performed by a fixed number of staff. If the volume of activities required by the State exceeds the capacity of the fixed staff, Deloitte and State will negotiate additional change orders to increase team capacity as needed. The following tables identify the specific activities that are in the scope of this Task Order by track.

10.2 Application Maintenance Track

Application Maintenance

Area

Activities Performed

General Application

Maintenance

• Assist the State in identifying and implementing regular recurring application

updates (for instance, but not limited to COLA, FPL, etc) within the maintenance

process

• Perform text-only updates to system screens following a system maintenance

prioritization process

• Disable features and functionality where possible based on third party outages

(ie Federal services downtime)

Billing and Enrollment

(B&E) Data Fixes

• Perform analysis and triage of B&E escalations (including HSRI and Medicaid)

• Develop, test and deploy data fixes for accounts with B&E requests in UHIP and

FMS

• Develop, test and deploy service requests for accounts with B&E requests in UHIP

and FMS

• Create manual templates to update carrier systems following UHIP B&E scripting

• Triage up to 20 new escalations per day between B&E (Individual) and SHOP

based on State-designated priorities

SHOP Data Fixes

• Perform analysis and triage of daily SHOP escalations

• Develop, test and deploy data fixes for accounts with SHOP request in UHIP and

FMS

• Develop, test and deploy service requests for accounts with SHOP request in

UHIP and FMS

• Create manual templates to update carrier systems following UHIP SHOP

scripting

Medicaid Data Fixes

• Perform analysis and triage of daily Medicaid escalations

• Develop, test and deploy data fixes for Medicaid accounts



Area


• Develop, test and deploy service requests for accounts with Medicaid requests in

UHIP, InRhodes, and MMIS

• Triage and fixing activities mentioned above will be performed by the existing

application maintenance teams and tracked against the scope levels mentioned

earlier

Work products for application maintenance activities are stated below: 1. There are work products which will reflect the work the teams above are performing,

however as those work products are produced by the teams listed in Section 10.3 they are

included further below

10.3 Operations Track

Operations Area Activities Performed

SHOP Reconciliation • Perform monthly SHOP carrier extract reconciliation and fix discrepancies

• Perform root cause analysis on SHOP reconciliation discrepancies

• Continue to monitor Group XML and triage issues

834 Transaction

Reconciliation

• Perform root cause analysis on carrier and FMS recon discrepancies

• Perform monthly carrier extract recon and fix discrepancies

• Perform monthly FMS extract recon and fix discrepancies

• Perform monthly carrier audit and fix discrepancies

• Perform daily carrier audit and fix discrepancies

• Perform daily FMS audit and fix discrepancies

• Continue to monitor 999s files from the carriers and triage issues

Batches, Interfaces and

Notices Operations and

Support

• Execute and Monitor Batch Job schedule

• Execute and support system interfaces (Carrier, FMS, Federal and State

verification and MMIS)

• Perform batch issue identification and reporting

• Provide progress reports on first-time, long-running batch jobs (ie Auto-

enrollment for individual QHPs)

• Perform quality control for mutually agreed upon system generated notices (ie

Medicaid terminations)



• Support the State in creating one new manual notice per week and sending to a

specified population of individuals

• Maintain updated operations guides, including batch run book, on accessible

Sharepoint location

System Help Desk • Provide support for State workers and staff. The help desk hours of operations

will be as follows:

o Monday through Friday: 9am – 5pm EST

• Perform management of production ticketing system

• Generate daily extract and ticket inflow/outflow reports

• Initiate priority 1 and priority 2 issue triage calls

• Contact next level of support (TIER 2 or TIER 3) to develop awareness that a

priority 1 or priority 2 ticket has been opened

Work products for operations activities are stated below:

2. Weekly Reconciliation Report – Provide a weekly report of the current discrepancy levels

and action plan for 834 and SHOP transaction reconciliation activities

3. AMPM Ticket Extract – Report of UHIP system tickets including B&E and SHOP tickets and

status

10.4 Infrastructure and Technical Support Track

Infrastructure and

Technical Support Area


Hardware management • Maintain current inventory of project hardware

• Work with the State to determine hardware refresh schedule as needed

• Coordinate with State data center lead for data center maintenance and outages

• Coordinate with hosting vendor for operations of project hardware, internet

connectivity, outages and disaster recovery activities

Files Management • Archiving and Purging of Files

• Monitoring Disk Space Growth

• Managing Environment Specific Online and Batch Configuration Properties

• Managing timely Batch Data Files

• Managing Batch Framework Tables Configuration

• Continue to support any changes required for data archival and partitioning


Infrastructure and



System Performance

and Technical Support

• Participate in State Technical Team meetings

• Analyze and respond to performance issues either reported by users or through

the weekly KPIs

• Support the updating and review of technical design documents for enhancements

• When requested, provide State with report of system software product versions

and available patches.

Work products for infrastructure and technical support activities are stated below:

1. Project Hardware Inventory – Detailed listing of project hardware that resides in the

State data center.

10.5 Security Track

Security Area Activities Performed

User Account

Management M&O

Support

The user account M&O activities include administration, support, and monitoring of

following identity and access management (IAM) tools and integration with UHIP

application environment:

• IBM Security Identity Manager (ISIM)

• IBM Security Access Manager (ISAM)

The scope of M&O activities for security IAM tools includes:

1. System Maintenance and Configurations:

• Apply service packs/patches, and basic configuration enhancements

• Configuration of new ISIM/ISAM instances in one of the four physical

environments for various business needs such as development, testing,

troubleshooting, pilot, etc.

2. System Health Check and Monitoring:

• Monitor ISIM / ISAM performance and usage

• Monitor disk space growth on security servers

• Maintain, archive, and purge security logs on security servers

• LDAP support and monitoring

3. UHIP application and environment Issues/Ticket Resolution:



• Receive, resolve, and track issues/ tickets on the UHIP application security

operations such as login, password reset, multi-factor authentication, etc.

• Track and remediate vulnerabilities reported in security testing or by Vendor

Security Compliance and

Risk Management M&O

Support

The security compliance M&O activities includes the following activities:

1. Compliance Document Support

• Support updates to the following Federal compliance documents, including the

tasks listed below for each document:

• Federal Documents (System Security Plan (SSP), Safeguard Security

Report (SSR), Privacy Impact Assessment (PIA), Security Design Plan

(SDP))

i. Review and update statuses for POA&M remediation items

ii. Align with federal periodic reporting

• IRS Corrective Action Plan (CAP)

i. Monitor and review remaining remediation items with different

teams (State, Application, and Infrastructure)

ii. Prepare Federal report submission for IRS

• CMS Plan of Action & Milestones (POA&M)

i. Manage additional remediation items as a result from various

Federal compliance documentation reviews and security audits

ii. Monitor and review remaining remediation items with different

teams (State, Application, and Infrastructure)

iii. Prepare document for CMS submission

Consideration: The updates stated above do not include significant changes to

the federal compliance documents (e.g., updates of the security controls based

on major system change (e.g., Phase 2 IES), changes to existing controls and

adding any new controls based on MARS-E 2.0 release). These significant

changes to the federal compliance documents are considered out of scope for

Security M&O.

2. Security Reports

• Prepare periodic FTI Access reports

• Prepare application user-role report for access review

• Prepare and maintain security and user reports, aligned with CMS requirements,

including:

• Unauthorized access attempts

• Session inactivity timeouts

• Maximum consecutive failed login attempts

• New user registrations

• Password resets

• Password expiration for admins



3. Training Support

• Support PMO in UHIP team compliance with security training policies and

records management

4. Security Audits

• Support State with UHIP security audits aligned with CMS, IRS, and SSA, including

the following activities:

• Assembling and preparing content for Federal audits

• Assisting in physical data center walkthroughs

• Provide technical clarification and audit evidence in relation to the

Security environment

• Management of the remediation of Deloitte owned UHIP controls identified as a

result of compliance documentation readiness reviews

10.6 Help Desk Activities and Support Structure Clarifications

Help Desk personnel:

• Take initial calls, triage, open ticket

• Contact next level of support (TIER 2 or TIER 3) to develop awareness a ticket has been opened

• Receive calls for status updates, provide proactive status updates

Help Desk Hours of Operations:

• Monday through Friday: 9am – 5pm

Minimum on-site support personnel for M&O (total of 7):

• (1) Operations and Maintenance Project Manager

• (1) Programmer III

• (1) Operations and Maintenance Functional Analyst

• (1) Systems Administrator

• (1) Batch Operator

• (1) Data Base Administrator

• (1) Help Desk Operator

10.7 Staffing Approach During the Term of this Task Order Deloitte will provide a fixed level of staffing for Maintenance and Operations and Infrastructure and Technical Support activities as identified in section 4.2. Staff will be located in the Deloitte office in Providence, Rhode Island or at one of our delivery centers in Orlando, Florida, Hyderabad, India or Bangalore,


India. Deloitte will notify the State in advance of any planned staff roll-offs and obtain approval for individuals replacing any key personnel as defined in Section 4.3.

10.8 Staffing Levels The following staffing tables include the FTE counts by area that will perform the activities defined in section 2. Team capacity is based on a forty (40) hour work week and will define the amount of activities that can be done on a weekly or monthly basis. Should the State desire additional capacity, Deloitte and State will negotiate the additional capacity in a new change order.

Contract Area Staff Start Date End Date

Application Maintenance 8 1/1/2016 6/30/2016

Operations 8 1/1/2016 6/30/2016

Infrastructure and Technical Support 3 1/1/2016 6/30/2016

Security 4 1/1/2016 6/30/2016

Totals 23


11 Implementation Support and Infrastructure Services Summary

Deloitte will perform the following list of activities during the Term of this Task Order.

11.1 Implementation Support and Infrastructure Support

Deloitte will provide the implementation support and infrastructure support services activities indicated below. These activities will be performed by a fixed number of staff. If the volume of activities required by the State exceeds the capacity of the fixed staff, Deloitte and State will negotiate additional change orders to increase team capacity as needed. The following tables identify the specific activities that are in the scope of this Task Order by track.

11.2 Application Maintenance Track


Area


Incident and Problem

Management

• Perform triage and root cause analysis of up to 7 new production incidents per

day

• Perform data scripting of up to 15 tickets per month to correct accounts within

UHIP and reconcile enrollment and CMS systems

• Perform software fixes for incidents requiring code changes through a monthly

release comprised of fixes for up to 15 tickets

• Deploy software and data fixes and perform post-production validation

• Perform proactive production incident trend analysis and identification of

enhancements to reduce scripting needs

• Support the State in identifying and documenting future requirements

• Perform application resubmissions and bulk account administration

• Assist with training and quick reference guides for significant maintenance

changes

• Schedule audit findings requiring fixes for monthly maintenance releases

prioritized against other system issue fix tickets

• Perform analysis in support of ongoing audits including audit requests from the

State such as sharing test cases. This will be prioritized against other system issue

triage

Release Management • Create release notes documentation

• Facilitate a release notes review and approval process

• Update and maintain the maintenance release schedule

• Coordination with State teams for pre and post-release validation processes

• Coordination with State teams for prioritization of items to be included in the

releases



Area


Data Quality Checks • Execute existing data quality check scripts and fix anomalies

• Identify and create corresponding queries for up to 2 additional data quality

check per month

Project Management

Office (PMO)

• Facilitate a monthly prioritization meeting with the State to prioritize across all State

requests for the upcoming month including software/data fixes, audit support, and

other ad-hoc requests based on available bandwidth

• Produce weekly Key Performance Indicators (KPIs) report (not to exceed 15 metrics)

and attend State PMT meeting as requested to review report

• Produce monthly operations report on Service Level Objectives (SLOs)

• Maintain Sharepoint document repository

• Support ad-hoc State requests including workspace, access, and meeting coordination

Work products for application maintenance activities are stated below: 1. Maintenance Release Schedule – Schedule for maintenance deployment dates and

maintenance SDLC phases.

2. Maintenance Release Scope – Confirmed list of production problem or incident tickets

scoped for a maintenance release

3. JIRA Triage Dashboard – Dashboard that tracks status and progress of the triage and

analysis of new production incidents and problem tickets

4. Release Notes – Final scope for a maintenance release. Used for maintenance release

approval.

11.3 System Track

System Area Activities Performed

IRS and CMS Reporting • Perform triage and analysis on 1095A and 1095B reported issues

• Perform re-generation of 1095A and 1095B notices

• Perform pre-transmittal quality control for 1095A and 1095B notices

• Send and re-send 1095A notices to customers

• Send yearly 1095A file to CMS

• Send and re-send 1095B notices to customers

• Send yearly 1095B file to IRS


System Area Activities Performed

• Send monthly enrollment summary file to CMS

• Send monthly enrollment detail file to carriers

Carrier Support • Facilitate cross-agency/vendor 834 working sessions

• Manual batch execution and pre/post analysis for TNIA/PNIA batch jobs

• Attend and prepare content for carrier workgroup meetings

Master Client Index (MCI) and

MMIS Change File Operations

• Perform daily triage and develop, test and implement data fixes for up to 8 new

MCI and Change File production incident tickets per day, including service

requests.

• Attend and support the 3-vendor meeting and assist with cross-vendor analysis

of system concerns

• Perform UHIP to MMIS reconciliation and conduct analysis on discrepancies

based on mutually agreed upon schedule and resource availability.

System Health Check,

Monitoring and Reporting

• Application and Database Usage Monitoring.

• Coordinate server outages, maintenance, upgrades

• Perform System Monitoring and administration for solution components that

include

o Websphere Application server

o Oracle Database

o Exstream for Notices

o Oracle Policy Automation for eligibility rules

o Netrics for MCI

o OSB for enterprise services bus functions

o External service calls

• Produce daily operations report of system health

• Monitor system CPU usage, disk utilization, network monitoring

• Produce database “Top 10” lists on request

Work products for system activities are stated below:

1. Daily Systems Report – Provide a summary of execution of batch jobs

2. Weekly KPI Report – Provide trend charts for mutually agreed upon Key Performance

Indicators (KPIs)

3. Monthly Operations Report – Provides an overview of the activities and outcomes of the

Operations team

4. Daily Operations Report – Provides a daily snapshot of batch, interface and notice activity.


11.4 Enhancements Track

Enhancement Area Activities Performed

Sizing for Change

Requests

• Perform impact analysis on system components

• Perform impact analysis on components external interfaces and impacted parties

of the application

• Determine if change request is a Small ROM (rough order of magnitude)

• Determine if User Acceptance Test (UAT) is required

Prioritization and

Scheduling for Change

Requests

• For Change Requests that can be implemented within a maintenance release:

o Facilitate a prioritization meeting with the State

o Confirm Change Request implementation schedule

o Update maintenance release schedule and scope documents to include

approved Change Requests as needed

Requirements and Design

for Change Requests

• Update functional design documentation for small ROM change requests

• Update technical design document for small ROM change requests

• Update Requirements Traceability Matrix (RTM) for functional and technical

• Submit modified functional design document to the State for review and

approval for small ROM change requests

Development and Unit

Testing for Change

Requests

• Perform system code and database modifications for up to two small ROM and

one extra small ROM (<50 hour) change requests per month

• Coordinate with State for any third party changes required to support the change

request

Test and Deploy for

Change Requests

• Perform System Integration Test (SIT) and Regression testing (REG)

• Review SIT and REG exit report with the State

• Deploy enhancement changes in Production Environment after obtaining

approval from the State

• Continue to store SIT and REG scripts in JAMA


Enhancement Area Activities Performed

• Assist State with post production validation

Work products for enhancement activities are stated below: 1. Functional Design Documentation – Updates to functional design for Change Requests as

needed

2. Technical Design Documentation – Updates to technical design for Change Requests as

needed

3. SIT Exit Report – Report documenting the outcome of System Integration Test (SIT)

4. Requirements Traceability Matrix (RTM) – Updated RTM with new requirements identified

by Change Requests

11.5 Infrastructure and Technical Support Track

Infrastructure and



Database management • Monitor & Maintain Space Usage

o Schedule and monitor usage and available space

o Purge the archive and backup file

o Allocate database space

o Reorganize database objects as necessary

o Run database statistics

• Provisioning & Monitoring Security Measures

o Creation/ management of user accounts for databases required in

Applications Systems

o Creation/ enhancement of database roles and privileges

• Recovery

o Perform Regular physical online backup

o Perform on-demand regular physical offline backup

o Perform on-demand logical full backup

o Perform on-demand logical selective backup

o Perform on-demand full database recovery

o Perform on-demand partial database recovery

• Troubleshooting (DBA)

o Investigate database errors and find resolution or provide

recommendation

• Investigate the database issues related to application error and

resolving/recommending resolution.


Infrastructure and



• Other routine data base tasks

o Database Performance Monitoring

o Archival and Purge of Database elements through maintenance process

o Ongoing tuning of design for example tuning buffers, changing or adding

indexes, modifying audit logging

o Update database documentation as necessary

o Perform SQL Code Reviews of new data fixes through maintenance cycles

Software Product

Upgrades

• Monitor software product upgrades and service packs from software vendors for

third party software

• Understand impact, benefits and develop effort estimates to perform software

upgrades

• Work with the State to plan the implementation of software upgrades to prioritize

and to minimize business impact

• Develop plan to implement software upgrade

• Implement software upgrades

• Verify application functions on completion of the software upgrades

• Test upgrades

• Provide report list of software products that are no longer in use as requested

• Provide application version report as requested

• Provide operating system and software patches report (ie – Oracle, Microsoft) as

requested. Patches that have been installed will also be included in the report

Capacity planning • Review Capacity Plan on a yearly basis based on new information becoming

available

• Work with hosting vendor to create and schedule a regular space monitoring job

• Evaluate impacts of new capacity needs

• Update Capacity Plan as needed

• Ongoing support of existing environments

Work products for infrastructure and technical support activities are stated below:

2. Project Hardware Inventory – Detailed listing of project hardware that resides in the State

data center


11.6 Security Track


Cyber Threat

Management and

Infrastructure Security

The cyber threat and infrastructure security activities include the following activities:

1. QRadar system maintenance and monitoring

• Apply service packs/patches, and basic configuration enhancements

• Monitor Qradar performance and usage

• Monitor Qradar disk space growth

2. Threat management

• Review key security event monitoring logs

• Update custom reports for ongoing security monitoring

• Update / configure alert notifications for security events

• Troubleshoot issues with reports and logs

• Support security incidents investigation and resolution

3. Infrastructure security

• Plan and support known Federal (CMS, IRS, SSA) security requirements, such as

SHA-2 certificate upgrade

• Support team efforts in case of Disaster Recovery (DR) and DR Tests

11.7 Data Analytics


Database Tuning and

Database Administration

Tasks

• Monitor & Maintain Space Usage for analytics data mart and recon hub

o Schedule and monitor usage and available space

o Purge the archive and backup file

o Allocate database space

o Reorganize database objects as necessary

o Run database statistics

• Provisioning & Monitoring Security Measures

o Creation/ management of user accounts for databases required in

Applications Systems

o Creation/ enhancement of database roles and privileges

• Recovery

o Perform Regular physical online backup

o Perform on-demand regular physical offline backup

o Perform on-demand logical full backup



o Perform on-demand logical selective backup

o Perform on-demand full database recovery

o Perform on-demand partial database recovery

• Troubleshooting (DBA)

o Investigate database errors and find resolution or provide

recommendation

• Investigate the database issues related to application error and

resolving/recommending resolution

• Database Performance Monitoring

• Provide ad-hoc reports by fulfilling 2 service requests per month as prioritized by

State

Reconciliation Hub • Reconciliation Hub Source File Analysis of existing data feeds (50 dashboard

components)

o Monitor daily load of reconciliation hub source files

o Execute daily metrics on data loaded into reconciliation hub

o Validate error file record counts to reconciliation hub

o Perform root cause analysis of error data to the reconciliation hub to

the appropriate source owner

• Reconciliation Hub Dashboard Analysis

o Monitor daily load of reconciliation hub data into dashboards

o Perform root cause analysis of error data to the reconciliation hub

dashboards to the appropriate source owner

o Execute daily metrics on reconciliation hub dashboards to assess

outliers

Dashboards • Monitor Tableau Performance Logs

• Perform Dashboard Monitoring and Administration of existing Tableau

dashboards / reports

o Tableau Security Rules Maintenance

o Monitoring Load of all Dashboards

o Add/Edit user roles as required

o Execution and sending of dashboards to users requiring PDF dashboard

• Produce daily operations report of data analytics dashboards

• Update dashboards as required for upcoming releases

• Triage and fix up to 8 requests per month across ETL and Dashboard

Extract, Transfer, and Load

(ETL) Monitoring/Tuning

• Execute and Monitor ETL Job schedule

• Execute and support system interfaces (Recon Hub and data mart refreshes)



• Analyze and triage daily ETL errors

• Execute weekly and monthly ETL monitoring reports

• Monitor ETL performance logs and performance metrics

• Update ETL jobs as required for upcoming releases

• Triage and fix up to 8 requests per month across ETL and Dashboard

11.8 Implementation Support and Infrastructure Support Services

The fixed priced fees associated with the Implementation Support and Infrastructure Support Services is a total of $4,399,360 and will be invoiced evenly at $1,399,787 every other month commencing March 1, 2016, during the Term (which amount will be pro-rated for any partial month).

11.9 Term

Term of this Task Order duration (Term) commences on the Effective Date (1/1/2016) and ends on 6/30/2016.

11.10 Assumptions

The following assumptions apply to the Services provided under this Task Order:

1. All State requests for the Implementation Support team must be prioritized against other activities defined in this Task Order and based on the available capacity of the team within the target maintenance release cycle. For example, if the State requests account analysis to support a State system audit, the effort to complete this request must be prioritized along with the other production incident maintenance release items. This includes service requests and requests to perform database extracts and ad-hoc reports.

2. The State will provide a single list of priorities for the Implementation Support team that represents priorities across all agency stakeholders. Deloitte will not be responsible for reconciling priorities across agencies.

3. Deloitte staff FTEs are estimated to work forty (40) hours per work and perform the identified activities in section 2 within those hours. If the State requests a higher volume of those activities that exceeds forty (40) hours per week, the State and Deloitte agree to negotiate an additional change order to increase the team’s capacity.

4. There will be no Deliverables associated with this Task Order but several Work Products will be provided by Deloitte to the State.

5. Although Deloitte may participate in meetings with third parties or other vendors that have a relationship with the State, it will be the State’s responsibility to manage communications and schedules with those organizations (i.e. Northrup Grumman, Hewlett-Packard, CMS, IRS, CSG, PCG, KPMG, Carriers, etc.).


6. Security M&O scope does not include new security tools implementation or development of new compliance documents. For example: Updates / development of documents required as part of migration from MARS-E 1.0 to MARS-E 2.0, work tied with Phase 2 related updates and Federal approvals of documents (SSP, SSR, PIA, SDP), etc.

7. Licensing cost for new security tools or annual support is not included in M&O scope.

8. Modifications and enhancements to UHIP security environment or compliance activities will be subject to the Change Request process to be agreed to by Deloitte and the State.

9. During the month of May and June the scope of the monthly maintenance releases will be reduced to only include limited (<5) very high priority fixes in order to complete the code merge prior to Release 7.

10. Within 30 days of execution of this task order the State should identify a single, cross-agency, Maintenance and Operations lead to serve as a counterpart to the Deloitte Maintenance and Operations lead for the management and prioritization of work

11. If new carriers are added to the system a change request will be logged and all testing and system updates required as part of the carrier being added, including updating the B&E dashboard, will be performed as part of that CR

12. The State’s Contract Manager may request Deloitte reallocate the team’s bandwidth to increase small ROM change request output for critical business needs. At which point, Deloitte will assess the impact to in-process activities, KPIs and SLAs and then State and Deloitte will mutually agree on the disposition of the request.

13. This Task Order does not add, remove or modify existing software warranties. Application

maintenance capacity under this Task Order will not be used to fix software warranty items

although the deployment of application maintenance items and software warranty items

will be coordinated and consolidated into releases as needed under this Task Order.

11.11 Staffing Approach

During the Term of this Task Order Deloitte will provide a fixed level of staffing for Implementation Support, Data Analytics, Security, and Infrastructure and Technical Support activities as identified in section 4.2. Staff will be located in the Deloitte office in Providence, Rhode Island or at one of our delivery centers in Orlando, Florida, Hyderabad, India or Bangalore, India. Deloitte will notify the State in advance of any planned staff roll-offs and obtain approval for individuals replacing any key personnel as defined in Section 4.3.

11.12 Staffing Levels The following staffing tables include the FTE counts by area that will perform the activities defined in section 2. Team capacity is based on a forty (40) hour work week and will define the amount of activities that can be done on a weekly or monthly basis. Should the State


desire additional capacity, Deloitte and State will negotiate the additional capacity in a new change order.

Contract Area Staff Start Date End Date

Application Maintenance 27 1/1/2016 6/30/2016

Operations 5 1/1/2016 6/30/2016

Infrastructure and Technical Support 1 1/1/2016 6/30/2016

Data Analytics 4 3/1/2016 6/30/2016

Security 1 1/1/2016 6/30/2016

Totals 38


12 Staffing and Key Personnel

• Key Personnel assignments have been documented with State CIO

The State and Deloitte shall meet monthly to review the quality of all project staff. During such meetings:

1. The State may identify Contractor staff that shall be removed from the project due to a lack of sufficient knowledge, ability to work with state staff, or for other reasons, according to the terms of section 8.2.5 of the Agreement.

2. The State may identify exceptional Contractor staff that may be, by mutual agreement, formally identified as Key Staff based on their criticality to the project.

3. The Contractor may identify State staff that Contractor believes are materially impeding the Contractor’s ability to perform its contract responsibilities. Both parties shall mutually agree on how to address such staff issues.


13 Consolidated Responses to State Questions

13.8.1 Can you further describe how notices and other information may be translated?

Family language preferences are captured in the Worker and/or Self-Service portals and company language preferences are captured in the Self-Service portals to drive the language for written and spoken interactions. A table of allowable languages will be maintained in the system. The language preference for written interactions will drive Notices and Correspondence generated by the State and sent to the citizen or company.

Notices and correspondence are normally reviewed by State Policy and Legal experts to provide the correct verbiage. Once complete, the language is sent to outside translator services. If the state is currently sending in-language notices and correspondences, Deloitte can work with that vendor to implement the final solution.

13.8.2 If Rhode Island were to retain its existing Premium Assistance Program, RIte Share,

how would you incorporate that program into your solution?

On October 1, 2013, UHIP will ask Medicaid-eligible individuals whether they have access to employer-sponsored insurance. If so, and if the employer’s insurance offering is on the approved Rite Share list, UHIP will notify the RIte Share unit. Following the October 1 release, RIte Share will be fully integrated into the system including all existing functionality of the Microsoft Access transactional system. The existing system includes, but is not limited to, communications by State personnel with employers/employees, case management capabilities, and unique data interfaces.

13.8.3 How do you envision integrating your solution with InRhodes during Phase 1 to

ensure a seamless transfer of data and cases from the UHIP platform to traditional

eligibility processing in InRhodes? Please utilize the InRhodes “As-Is” artifacts

contained in the Bidders Library “EOHHS & DHS InRhodes Technical” folder.

There will be two specific components to effectively implementing the Phase 1 integration between UHIP and InRhodes: The technical architecture and the functional architecture. Deloitte understands both well from our experience supporting states in the incremental renewal of their Eligibility Systems.

Technical Architecture: During our early meetings, we will identify the types of integration required to connect UHIP and InRhodes. We use Extract-Transform-Load (ETL) technology provided by Pentaho for data conversion type integration, and we use an Enterprise Service Bus (ESB) for real-time data integration. We support integration using files (FTP, SFTP) as well as Services-Based Integrations (Web Services, EJB, MOM, etc.) The integration we select will be appropriate to the InRhodes technical integration capability. We will work with the InRhodes vendor to understand the existing data model and perform data mapping between the as-is and to-be data models. From that mapping we will create a messaging model that maps the data between the systems as well as normalizes the cardinality of the records/fields.

Functional Architecture: Our approach to developing the functional architecture of the integration will begin with a review of the end-to-end business processes that will need to


be supported during the period between the initial implementation of UHIP and the final phase out of InRhodes. Working from this we decompose the to-be functional processes into data integration points needed to support the end to end business flow. Based on the information provided, the following will be specific functional integration points:

• Master Client Index

• Non-Financial Data

• Financial Data

• Eligibility

• Noticing

• Inquiry

As we go through this process there will be 3 key guiding principles:

• Maintain efficient and effective eligibility business processes for workers and citizens

• The implementation of the new solution is not “held back” by limitations in the legacy system.

• Reduce the need to develop, test and implement technology that will be “thrown away” after the retirement of InRhodes

13.8.4 What is the strategy for ensuring the synchronization of data between the proposed

solution and InRhodes through both Phases 1 and 2?

Our strategy to data synchronization starts with developing and documenting a full logical data model for the UHIP/InRhodes environment and defining data into the following categories:

Program Specific Data: Identify data elements that are used by specific programs. This enables us to isolate data from the synchronization evaluation that can continue to remain in one place or the other without a need to synchronize.

Common Data: Data used across programs that will need to reside in both environments. The next step is defining the Master Client Index (MCI). The MCI provides the functionality necessary to keep client identification consistent across platforms. This is critical as the ability to synchronize is dependent on the ability to identify individuals and their data uniquely with high confidence.

The third step is defining the frequency of data synchronization. While some data will need to be kept in synch real time, other data may be able to be updated on demand or during a batch cycle. Carefully considering the options for frequency can mitigate the potential risks (outlined in detail below) around real time integration with a mainframe system.

13.8.5 How will you approach the conversion of data from InRhodes to your solution?

Deloitte will use our leading practices and approach to converting data from InRhodes to HIX/IES. The first priority is to utilize the conversion templates and design assets included in NextGen to decrease the amount of manual conversion that is required. Our process is broad and detailed, to summarize the steps in our approach:

• Collect and document data conversion requirements making sure state and Federal retention needs are accommodated as well as any special data conversion needs. In this


process, the best source for certain data is identified which can include running certain interfaces as “day 0” processes.

• Legacy data model analysis and data mapping to the new HIX/IES data model is completed.

• Conversion software and process design is executed. This includes identifying data extract formats and strategy from legacy source systems as well as software to receive these extracts and transform and load it to the new data model.

• The conversion software is constructed both for the legacy extracts as well as the new transformation.

• System testing is conducted to determine that the conversion software adheres to detailed design.

• Conversion “dry runs” are conducted which identify any deficiencies in the process, mapping or software as well as identify any critical data quality issues which may need to be addressed with either automated or manual data correction in source systems.

• A pilot including a full statewide conversion is conducted and validated to identify any opportunities to improve the conversion process.

• The final statewide conversion is executed according to task by task conversion plan which Deloitte develops in collaboration with the State and the legacy system vendor.

Throughout the dry run process, Deloitte works with the State to identify the high-quality value data corrections and needed reports to enhance the high quality and result of the data conversion. We propose a maximum of 8 dry runs to completely evaluate and correct the source system data, an activity we have planned in our project approach for Rhode Island. Deloitte’s NextGen platform includes templates and conversion utilities as accelerators for data conversion.

13.8.6 Please provide an organizational chart that reflects the role of your subcontractors;

more specifically, please show which staff positions your subcontractors will fill,

reporting relationships between subcontractor staff and your staff, and identify if

any of the key staff positions are filled by subcontractor staff.

As the primary contractor, Deloitte will provide over 80% of the solution and services for Rhode Island. After careful consideration we selected a number of strategic subcontractors, whose roles on our team are limited to either providing defined services or providing limited staff augmentation at the work team level. The following describes estimates of each subcontractor and their role:

NTT Data: NTT will provide the hosting services requested. NTT staff will report to our Deloitte Technical Architect, Rajiv Sabharwal. NTT Data will also provide staff to the Deloitte software testing team. This staff will report directly to the Deloitte Quality Assurance Manager, Geoff Silva. NTT will staff approximately 25% of the Deloitte software testing team.

PSRI: PSRI will provide staff to the Deloitte software testing team and to the Deloitte training team. The test team members will report to the Deloitte Quality Assurance Manager, Geoff Silva. The trainers will report to Deloitte’s Training and Implementation Manager. PSRI will


consist of no more than 25% of the software testing team and no more than 50% of the training team.

We will work with the state to identify a vendor for task order 9 within 30 days of contract initiation.

We can confirm that none of Deloitte’s proposed key staff is a subcontractor - all are current employees of Deloitte.

The organization chart set out under Section 11 above depicts the Deloitte UHIP Key Personnel and its’ subcontractors

13.8.7 There are many operational and policy decisions that still need to be made by the

state and vetted by different state staff and other stakeholders, How will you

facilitate getting decisions made? How would you handle a situation where

decisions are not being made in a timely enough manner or there seemed to be in

disagreement or inconsistencies in the decisions are being made by various key state

stakeholders?

Deloitte will employ several specific approaches for facilitating and accelerating policy and operational decision-making. These will be used solely or in combination depending on the issue, phase of the project and the stakeholders involved. We can support this effort as follows:

Providing Options. Wherever possible, Deloitte will present Rhode Island with 2-3 options for any specific decision point. These options will be drawn from an understanding of Rhode Island’s current operations and policy, leading practices and lessons learned from similar projects executed by Deloitte in other states and emerging information made available from external sources such as the Federal Government, UX-2014 and other early innovator states. This provides a starting point for discussion and arriving at a practical and informed decision that is Rhode Island-centric.

Leveraging Tangible Project Assets. Deloitte will come prepared to each requirement and design session with a working solution that can be modified in near real time and project design documents that can be reviewed and modified during the sessions.

Clear and Transparent Documentation. Deloitte will leverage our Application Lifecycle Management Toolset to document each decision made in the appropriate manner..

Handling situations where there is difficulty coming to agreement or gaining consistency on a decision builds upon the four specific approaches described above with the following additional techniques:

Definition of Project Wide Roles and Responsibilities. At the outset of the project Deloitte will work closely with the Rhode Island project team to define a project wide RACI Matrix (Responsible, Accountable, Consulted and Informed) that will define the role each stakeholder will have across a broad range of very granular project areas.

Blocking Items. There will be a tremendous amount of decisions to be made, yet not all will have the same potential impact to stall the project. We have found it extremely effective to identify those decision points that specifically “block” project process and document the


issue within our ALM tool set as “blocking” a specific project task or activity from completion. This enables the project team to quickly and clearly understand the impact that an outstanding issue has on a downstream project activity. Owners of these issues will see it clearly designated in the issue if and when it will block progress to a downstream project activity. This will be incredibly effective tool in sorting through and prioritizing focus on the myriad off decisions and issues that will be presented.

Managing Meeting Time. Deloitte recognizes that often decision makers will not be available to sit through multiple day long JAD sessions to make possibly one to two key decisions that they may be needed for.

13.8.8 Please describe if and how you would plan to build a provider directory, including

what you consider to be the major data elements to be included in the provider

directory. If the state wanted to develop a single authoritative provider directory

that multiple systems could use would the exchange technically be able to leverage

that functionality? Additionally would the exchange infrastructure you are

proposing be able to serve as the authoritative state provider directory and if so

how would other systems such as the APCD or HIE be able to leverage and use it?

Deloitte will develop provider directory functionality that at the highest level will receive provider directory feeds from all issuers and QHPs, normalize it across issuers and make available the scrubbed data for posting to the UHIP (or other State systems). Deloitte is providing for semi-annual updates in provider directory data.

13.8.9 Upon successful deployment in the State of Rhode Island, what is your exit strategy?

If your solution includes hosting, please address that separately. Include in your

response answers to the following: Time Schedule, State Staffing requirements,

Risks

Core to Deloitte’s solution approach for Rhode Island UHIP is the ability for Rhode Island to be completely independent of Deloitte following the successful implementation of the system. Unlike with a COTS product that would require Rhode Island to make annual maintenance payments to us and accept upgrades defined by the COTS company and their other customers, Rhode Island will have the ability to continue to share and leverage NextGen components with other states across the country completely independent of Deloitte and as it benefits Rhode Island. With Deloitte’s solution the code base is open to modification and enhancement by the State using technical skills that are available on the open market and do not require extensive training by a single company.

Time Schedule: The time schedule for exiting is determined by the needs and desires of Rhode Island. Once Rhode Island determines a turnover of the system is appropriate, Deloitte suggests a transition period of between 4 and 6 months. The duration of this timeframe is highly dependent on the rate at which Rhode Island can provide staff for the system to be transferred to.

State Staffing Requirements: Further details on state staffing requirements are found in the Rhode Island Resource Requirement Section


Operations: A system of this size and complexity requires individuals to monitor and control the daily operations of the system. This includes monitoring the batch schedule, online performance and system inputs and outputs (interfaces). Deloitte recommends Rhode Island maintain a minimum staff of 2 FTE’s to support HIX/IE operations. These individuals need to be technically proficient in the monitoring tools utilized across the platform as well as the operating systems and middleware for all components of the solution.

Platform Maintenance: Maintenance activities relate to the need to keep underlying COTS products up to date with new releases as well as to provide some basic and routine systems maintenance to the core HIX/IE solution.

Application Enhancement and Modifications: The HIX/IE solution supports a range of incredibly dynamic business processes subject to changes by Federal and State leaders on a constant basis. With Deloitte’s solution, staff with business skills can modify eligibility rules in the rules engine or configurations within the system. To maintain a highly efficient and well performing solution, some changes will require Java programmers. And all changes, regardless of whether done in the rules engine or in the configuration screens, should be tested to determine the changes have the planned impact.

Risks: The project risks will be identified, mitigated or avoided based on the probability and criticality of the risks throughout the course of the project

13.8.10 Will your reporting solution include templates for federal program reporting

requirements (such as the Exchange's required reports to CMS and IRS)? Does it

offer the ability for users to easily generate ad hoc reports?

During requirements and design sessions, we will work with the State to review the existing templates and leverage this functionality to create any additional federal reports required for the Exchange. Our proposed solution integrates with Crystal Reports, enabling authorized staff to identify data element inputs, result format, and selection criteria to generate ad-hoc reports.

13.8.11 Please indicate how your test plan will offer opportunities to engage end users, such

as Rhode Island program enrollees, in testing.

Given the importance of consumer (Rhode Island program enrollees) adoption, our test plan will include ‘focus group’ testing with an emphasis on usability and the customer experience. We will work with the state and structure this testing to determine coverage of all of the program enrollee’s functionality through the development of specific test cases with traceability to requirements.

13.8.12 You’ve proposed utilizing the State’s Data Center on p. 10.2.1-16 with the stipulation

that certain Data Center functions be upgraded. Do you propose to pay for the

upgrades or do you expect the State to pay?

See Section 9 of the Bridging Document


13.8.13 Your submittal states “Both 800x600 and 1024x768 are supported using the IE8

browser” on p. 10.2.1-17. Will users get optimum results with 800x600 screen

resolution? If not, please provide the resolution that will deliver optimum results.

The answer will determine if the State needs to upgrade its thin client system.

As noted in our proposal, our solution will work at both resolutions, but a browser resolution of 1024x768 allows the user to view the entire screen with no scroll bars. To support lower resolution, the system has been designed to place the most important navigational elements in the viewable area of a monitor set to 800x600 for backward compatibility. For optimum results based on what we have seen at other states that use NextGen, 1024x768 or above is leading for users to minimize scrolling. If a thin client system upgrade is required to support 1024x768 resolutions, Deloitte would recommend the State complete the upgrade.

13.8.14 Please provide staffing hours for Task Orders 7 and 9 in Appendix K, as requested in

the RFP

See Section 10 of this Bridging Document

13.8.15 Does your eligibility solution include address validation with an expert entity? If so,

please describe.

Deloitte’s eligibility does include the ability to use an expert entity to validate addresses. We have not included services to implement this in our proposal.

13.8.16 Please clarify the configurability, in terms of ease, of the case-worker tool in your

solution.

Deloitte’s NextGen platform is the foundational system for more than 20 plus state eligibility systems and fosters the fundamental principle of ease of use for the workers. The look, feel, and behavior of the application are tuned to support expert and novice workers, as well as intermittent users. The main focus is worker productivity. The solution includes system-generated alerts, scheduling, reports, and real-time caseload querying tools to provide a case worker with the ability to review their assignments, identify priorities, and track tasks to completion. In addition, NextGen includes functionality for users to create custom alerts, defining the priority of the task and setting a due date. For supervisors, caseload management functionality is configured to operate at a unit-level, providing an overall status across case workers managed by that supervisor, while also offering the ability for the supervisor to review the assigned tasks for each case worker under their supervision.

Users are grouped into units that define the tasks to be performed, geographical location, or supervisory structure. Any combination of these factors can be used to create a unit. These units, in combination with security roles, control the functionality which is available to the user and relevant to the tasks they are assigned. NextGen provides the flexibility for authorized staff to maintain the assignment of roles to users and users to units within the application, allowing the State to adjust user assignments and the availability of system functionality in real-time.


13.8.17 Your solution indicated three payment options, including paying by credit card and

paying directly to the health plan. Please describe how the financial transaction

would be handled between your solution and a health plan.

To be finalized based on selection of task 9 vendor

13.8.18 On page 10.2.3-8, you describe consumer assistance support, including video-based

support, integration with a help-desk, and live chat. Please describe the chat

function in more detail – does the support for the chat function also require

integration back to a help-desk? Or is the actual support for live chat features

included in your proposal?

The chat administrative functions that would be utilized by the help desk personnel supporting the end users is integrated into our solution (NextGen). Additional web service integration between the NextGen chat administration tools and our proposed Contact Management solution (SugarCRM) will also be utilized to provide a fully integrated help desk experience.

Samples of the chat administration screens are shown below:


13.8.19 Your response to Task 9 largely describes the technology required to support

financial management tasks. On page 51 of RFP 7449637, we state “In addition to

the software components necessary to support these activities, this Task Order also

seeks to procure an experienced team of business support staff to operate the first

three key financial management business functions listed above for both the

Individual and SHOP exchanges: Premium collection and processing, Facilitation and

processing of issuer payment transfers, Customer support for financial issues.”

Please describe your business support team for financial management.

To be finalized based on selection of Task 9 vendor.

13.8.20 Can you describe the differences between a case worker’s screen and a supervisor’s

screen?

Both are configurable and the difference is the type of information that will be displayed on them based on the work profile of worker or a supervisor. In other implementation of NextGen, the Supervisor has access to the same functionality as the case worker but has the added management and performance capabilities:

• Display of “rolled-up” caseload statistics for the supervisor’s unit

• Ability to rebalance caseloads/task assignments

• Access to reports which track incoming task trends and timeliness of task completion

• Access to case review tools which allow the supervisor to define sampling criteria to select cases or completed tasks and review for processing accuracy

• Ability to define unit schedules and block time on their employees’ calendars for specific tasks (e.g. blocking two hours each morning for redetermination processing)

The following is a sample Supervisor home page using a graphical interface. This could also be extended to the Case Worker home page.


13.8.21 Please provide more detail on how the proposed CRM system will be integrated with

the web portal and IVR systems

Deloitte’s proposed solution consists of three specific components for supporting Customer Relationship Management (CRM), Contact Management (CR) and Interactive Voice Response (IVR):

CRM: Management of customer/client data and the transactional processes use to support the HIX/IES business processes are provided within our NextGen solution

CR: Deloitte has proposed utilizing SugarCRM to support the contact management functions required by a call center worker and to support the management and reporting of call center activities.

IVR: Deloitte has proposed utilizing the Cloud-Based Telephony Platform Angel to provide IVR functions.


The CRM system (NextGen) will be integrated directly from the Web Portal (Self Service / HIX) using Web Service calls that receive or transmit client information in a pre-defined XML format.

The IVR system solution (Angel) will be integrated with our Contact Management (SugarCRM) and our Worker Portal (NextGen) in two ways: 1. The IVR platform provides a web page for a worker to handle calls. When a call arrives the client application or case number are provided via the phone (whisper) as well as the information is screen-popped to the worker. 2. The screen-pop will allow the worker to launch the Contact Management or Worker Portal with the information gathered from the citizen transmitted to reduce worker typing and create worker tasks.

The details of how they will integrate functionally will be determined as the specific business processes for eligibility workers, call center workers, the public and other stakeholders are defined during the project. Our proposed solution has been selected based on its flexibility to adapt to the unique needs of Rhode Island and to provide an efficient and effective platform for managing your workflow.

13.8.22 How does your proposed solution leverage functionality developed for Early

Innovator States, such as Oregon, New York, Maryland, and the New England

Consortium?

Deloitte is fully committed to leveraging assets, accelerators and functionality from dependable sources to aid in the delivery, mitigate implementation risk and timeline pressure and achieve a successful project outcome for Rhode Island.

For Health Insurance Exchange assets for example, we will draw on in-flight design and implementation projects at Washington State, Massachusetts and Oregon as well as early design blueprinting and prototyping in Wisconsin. Our implementation accelerators include over 3,000 detailed requirements, 300 detailed business processes and 100’s of test cases, most developed at other State HIX client engagements including Indiana and the MA Connector.

Deloitte’s eligibility solution follows an ‘Early Innovator’ approach as we have incorporated leading features from our suite of eligibility clients Michigan, New Mexico, Texas and Montana. Beyond this, Rhode Island will benefit from the ability to leverage additional functionality and leading practices from all of the states in our eligibility portfolio including Florida, Massachusetts, Wisconsin, Pennsylvania, New Hampshire, West Virginia, Virginia, and Connecticut to name a few. We believe we offer Rhode Island something no other vendor can match in terms of drawing from and contributing to a shared pool of solution assets in a business area that is unique and offers similarity across state boundaries. Only Deloitte with its footprint in 20 plus states in direct relevance experience is able to offer this – one of the main reasons why your peers select Deloitte.


13.8.23 Your proposal states that, "Deloitte assumes that data clean-up, data cleansing and

any required manual data conversion will be the responsibility of the State." We

expect this to be within the scope of work for the UHIP technology vendor. Please

update your proposal to include this effort.

As requested, Deloitte has updated our proposal to reflect this effort and the above referenced statement from our original proposal can be removed. In order to accomplish this, Deloitte will work with the State to establish validation criteria for the source data and where that data fails the validation criteria Deloitte will work with the State to identify default values. There is no change to our original Cost Proposal for this modification.

13.8.24 Your proposal states that, "Given the limited amount of information available about

the State’s mailroom, Deloitte has not included any proposed cost to upgrade the

State’s mailroom in our response. Upon request, Deloitte will work with the State to

determine the specific mailroom requirements, scope of work and pricing." The RFP

includes a description of the existing mailroom capacity. Please provide your

estimate of the cost necessary to upgrade or supplement this capacity.

Based on a review of the current mailroom and the needs of the new HIX/IES system, Deloitte estimates a cost of $967,000 (not included in Deloitte scope or price) to upgrade the infrastructure of the Rhode Island mailroom. This estimate assumes the following new equipment:

• 2 automated mail inserters

• 1 inkjet addressing production speed system

• 2 digital laser printers (production level speed)

• 1 automated folder

• Label printer for tray tag labels

• USPS compliant software for:

• CASS

• NCOA

• Merge/purge de-duplication

• Postal Presort processing

13.8.25 Your proposal states that, "The State is responsible for providing a Learning

Management System for training registration and posting of training materials." Our

expectation is that the training vendor will provide this capability.

Please remove this assumption from our original proposal. As requested, Deloitte will provide a Learning Management System (LMS) for the UHIP project. The following provides a description of our proposed LMS. There is no change to our original cost proposal for the addition of these services and software.

Deloitte will use the Modular Object Oriented Dynamic Learning Environment (“Moodle”) system to track staff training, to deliver and administer both the computer-based and instructor-led UHIP training programs. Moodle, which stands for “Modular Object Oriented Dynamic Learning Environment”, is a cost-effective, open source software package used by educators worldwide to deliver and manage online training. Deloitte uses Moodle to deliver


training programs because it is easy to set-up and configure. Since Moodle is an open source application, there is no purchase cost or maintenance fee.

Moodle will be used to support the following functions:

• Delivery of pre-training self-assessments

• Deployment of online training courseware

• Deployment of UHIP training materials, including training guides, handbooks, and quick reference guides

• Posting of digitally-captured ideal training sessions for use with refresher training and ongoing new worker training

• Posting of classroom and online training schedules

• Tracking training course registration

• Monitoring training course completion and assessment scores

• Administering training surveys, evaluations, and learning assessments

Deloitte will be responsible for the following during the term of the contract:

• Installation and configuration of the Moodle application

• Initial loading and ongoing updates to training materials

• System administration of Moodle

13.8.26 Please include the costs to provide the PCI payment processing in your proposal.

Costs in original proposal stand.

13.8.27 Please include integration costs for your Financial Management solution (Task Order

9) in your proposal.

Costs in original proposal stand.

13.8.28 To ensure that costs are allocated in the same way by all vendors, please update

your cost proposal such that any Phase 2 work that will be used in common by both

complex Medicaid and human services programs is accounted for in Task Order 4,

not Task Order 6.

Provided in revised cost proposal.

13.8.29 Please see the updated Appendix X spreadsheet (enclosed), which now explicitly

separates DDI for Task Order 9 from ongoing costs associated with financial

processing. The Phase 1 Milestones tab should include only DDI costs for Task Order

9; ongoing financial processing costs should be accounted for only on the Task Order

9 tab.

Costs in original proposal stand. To be finalized based on selection of task 9 vendor.