ADDENDUM NO. 2 December 2, 2020 Title: CMS . - Cook County Health

Transcription

ADDENDUM NO. 2December 2, 2020Title: CMS Interoperability and Patient Access Final RuleRFP # H20-00381. GeneralThis addendum revises RFP documents. This addendum is issued to respondents of record prior toexecution of contract, and forms a part of contract documents and modifies previously issueddocuments. Insofar as previously issued contract documents are inconsistent with modificationsindicated by this addendum, modifications indicated by this addendum shall govern. Where any partof the contract documents are modified by this addendum, all unaltered provisions shall remain ineffect.2. Addendum Acknowledgement FormAcknowledge receipt of this addendum in the space provided on the Addendum AcknowledgementForm. Proposers must include the signed form with their response. Failure to do so will subjectProposers to disqualification.3. Changes and Clarifications4. AttachmentsPage 1 of 18

Section of the RFP12Section 5 , Contract3QuestionAs one-step to slow the spread of COVID-19virus, it is highly recommended thatemployers, including state and federalorganizations, implement teleworkingtechnologies to the greatest extentpossible. Is CCH open to accept responsesto this RFP by electronic mail ONLY?CCHHS ResponseNo. One hard copy proposal is requiredincluding an electronic (e-mailed copy)copy of the complete proposal.Please confirm who will be contracting theEntity - Cook County Health or Health PlanServices?Please confirm response date for XXXX NonDisclosure Agreement requestCook County Health would be thecontracting agency.Does HPS have an in-house identityprovider?a) If yes, have you implemented OAuth 2.0for authorization and OpenID Connect 1.0for authentication?b) Please share the product name andversion.c) If not, is there a plan to onboard a newidentity provider such as Okta, Ping etc.?d) What is the support expected from thevendor - enhance the existing IDP or setupa new IDPHow are the members accessing themember portal and being authenticated?Health Plan Services does not have an inhouse identity provider and are requestingan integrated solution for authorizationand authentication.Are you looking to perform the riskassessment in house and expect the vendorto support the process? Are you looking foradvisory services to help define a riskassessment frameworkWe expect the vendor to haveresponsibility for performing the securityrisk assessment and providing satisfactoryresults based on an established frameworksuch as the NIST Cybersecurity Frameworkor a SOC2 audit and review with CCH’ssecurity teamVendor will not connect to DW forprovider data. Provider JSON file will besent to vendor to load.Not applicableGeneral4Section 2, Consentand IdentityManagement5Section 2, Consentand IdentityManagement6Section 3, 3rd PartyApplicationSupport7Section 4, ProviderDirectory API8Section 6,Technical Supportand TrainingAldera provider directory data – Is providerdirectory data available in HPS Payer DW aswell? If not, then how would the data bemade available for the vendor system?Is HPS expecting only Product training oralso looking for training HPS stakeholderson CMS mandate and FHIR. Please provideestimated number of users to be trained.Vendor to provide Consent Managementand Identity Management solution.HPS is only requesting product training.Training on the CMS mandate or FHIR willnot be required. HPS is estimating that 10 users will require training.Page 2 of 18

Section of the RFP9General10General11General12QuestionIs HPS looking for consulting services thatdrive the program implementation or SMEtime to provide guidance and clarificationon the mandate.Do the HPS core system SMEs have thebandwidth to extract the data in commoninformation model format and share withthe vendor or are you expecting thevendor to perform end to end integrationof the product to the source systems.Are there any other clinical systems beyondthe systems that you have provided thatinclude the following data - lab data- HEDIS or any other quality measures- care management- disease management- utilization managementHow do you plan to uniquely identifymembers, across systems?General1314GeneralWhat are your existing capabilities aroundETL and data transformationGeneralDo you have an API management tool; if sowhich tool is it?15GeneralWhat aspects of highly-sensitive(behavioral, substance abuse, HIV/AIDS,etc.) data labelling or tagging do youalready have in place both from HPS andCook County Health standpoint?CCHHS ResponseProject management will be provided byHPS for both the Medicaid and Medicareproducts, but there is an expectation thatthe vendor will also supply projectmanagement resources and subjectmatter expertise to ensure a successfulimplementation for the vendor’s scope ofservices.HPS is expecting the vendor to performend to end integration of the product tothe source systems.Yes. Population health/HEDIS: Vital DataTechnology Care management and diseasemanagement: Various vendors forcare management (per the tablewithin the RFP) Utilization management: Proprietarysystem owned by our Third PartyAdministrator (Evolent).CountyCare: Members are uniquelyidentified in Medicaid using their recipientidentification number (RIN)MoreCare: Members are uniquelyidentified using their MoreCare IDnumber.Vendor will receive the following files in astandard JSON format: Claims/EOB,Provider, Clinical, Member Roster.Health Plan Services does not currentlyhave an API management tool.Health Plan Services does have somemembership/population labeling andtagging in place and capabilities tosegment the population for highlysensitive populations. Currently, HPS hastagging in place for pregnant women,special needs children, children that are instate custody, among others.Page 3 of 18

Section of the RFP16QuestionHow are you planning on managing consentboth to applications and to 3rd partyrepresentatives?Section 2, Consentand IdentityManagement17What is the projected membership growthYoY by LOB over next 5 yearsGeneral188.3 Number ofCopies195.6205.6215.622BlankGiven the current times with COVID-19 andintricate logistics, would there be anexception to submit the soft copy of theRFP response over mail instead of a hardcopy.Is the 35% MBE/WBE Partication based onContract Labor Dollars or Total ContractDollars?GeneralSection 2.2, Page10Is the portal off-the-shelf software withpublished APIs and if so, what vendorplatform?2425Section 2.2, Page1026Section 2.2, Page10For member portal authentication,members self register to create usernameand password for access to member portalusing member id, first/last name, memberdob.Due to the variable nature of the Medicaidmembership due to the COVID-19 crisis,CountyCare is currently in the process ofreforecasting its membership projectionsin future years.No. One hard copy proposal is requiredincluding an electronic (e-mailed copy)copy of the complete proposal.The 35% participation is based on theTotal Contract dollars.The Cook County Office of ContractCompliance uses a diversity managementsystem which requires companies toHow does the Government Track MBE/WBE affirm and confirm vendor paymentParticipation?details.Does the MBE/WBE have to have to haveNo. but must be MBE/WBE participant,Past Performance to qualify as an eligible(else apply for waiver)MBE/WBE Participant?BlankBlankWhat Department/Organization is theContract with Cook County Health or CookCounty Health, Health Plan Services23CCHHS ResponseVendor is expected to provide solution tomanage Patient Consent and 3rd PartyApprovals.Does the portal support SAML or OAuthsingle sign-on?What APIs and interoperability supportexist for the portal, as well as any testinginfrastructure and documentation?The contract is with Cook County Health.Health Plan Services is a department ofCook County Health.Health Plan Services uses Aldera MemberPortal from Evolent Health. Portal doesnot have FHIR APIs for member portal.Vendor will receive incremental data filesfor vendor to store and provide APIresponses.Portal supports SAML.Refer to Question 24.Page 4 of 18

Section of the RFPQuestion27Section 6.1, Page11Does “Cloud Hosted” mean that the Countyis requiring only a public cloud hostedproposal or is a private cloud alsoacceptable?Is HPS expecting that this support be 1st tierHelp Desk support for end users or is thesupport expected to support HPSstaff only?System Diagram,Page 13Is this an auto-correct/typo for“Transformation Layer” ?Section 4.1.1, Page11282930General31GeneralWhat is the expected number ofclinicians/providers to be listed within theproposed solution?What is the expected number of end usersof the proposed solution? (i.e. loginaccounts)CCHHS ResponsePrivate cloud and Software-as-a-Serviceare also acceptable. Before a contract issigned, all vendors will be required tocomplete a security assessment thatincludes a detailed outline and diagram ofthe solution architecture and data flowdiagrams, who is hosting the service,where data is hosted, a SOC 2 report,associated security parameters, etc. Thisdocument must be reviewed andapproved by the CCH Compliance andSecurity teams.Health Plan Services is interested inlearning about vendor capabilities andpricing for both 1st tier Help Desk Supportand/or support for HPS staff.Yes, “transformation layer” was intended.Health Plan Services has a robust providernetwork in the Cook County Health areafor both Medicare and Medicaid lines ofbusiness. CountyCare has over 4,500primary care providers, 20,000 specialists,and 70 hospitals. MoreCare has a smallernetwork as it serves a smaller, morespecialized membership.The expected number of end users of theproposed solution is less than 10.Page 5 of 18

Section of the RFP32Overview ofExistingInfrastructure3334Section 4.2 #7,Page 9General35General365.4 VendorSolutionCapabilities andServices37QuestionIn order to provide implementation pricingthat includes populating the solution's FHIRrepository with data from claims, EHRs,other clinical systems, provider directory,and drug formulary systems, we will needan inventory of the data sources expectedto be included in the initial implementationphase. If possible, please provide a list ofall external systems that would beproviding data, including the followingdetails: 1) System Type (e.g Claims DataWarehouse); 2) Vendor and Version (e.g.Microsoft SQL Server V.15); 3) ExpectedData (e.g Historical Clinical Data); 4) DataFormat (e.g. X12 or Proprietary Flat File); 5)Support Interfaces (e.g. ODBC or Flat FileExport); 6) Number of Records (e.g. 1million records)The RFP references the need for “Advanceddata analytics and reportingcapabilities”. Can you be more specific inregard to the data analytics or reportingrequirements for the solution?As one step to slow the spread of COVID-19virus, it is highly recommended thatemployers, including state and federalorganizations, implement teleworkingtechnologies to the greatest extentpossible. Is Health Plan Services (HPS) opento accept responses to this RFP byelectronic mail ONLY?What date and time is the pre-proposalconference? Is there an option to attendthe conference remotely via a virtualconference?What is the Cook County Health'sdeployment preference? Vendor SaaS, OnPremise at CCH or other?What is CCH data architecture preference,centralized data storage or data façade?CCHHS ResponseVendors will receive the following 4 Files:1.Claims/EOB JSON2.Provider JSON3.Clinical JSON4.Member Roster JSONHealth Plan Services requires that thateach of our vendors provides reporting todemonstrate compliance with their scopeof work.No. One hard copy proposal is requiredincluding an electronic (e-mailed copy)copy of the complete proposal.A Pre-Proposal conferences is notplanned. Prospective Proposers maysubmit questions during the openquestion period.All cloud hosted / SaaS solutions areacceptable. CCH does not prefer to hostthis solution on premise. Proposer willneed to provide a detailed outline anddiagram of the solution and how it isarchitected, who is hosting the service,where it is hosted, SOC 2 report, and allassociated security parameters.All data architectures will be considered.Most current CCH systems use centralizeddata architectures.Page 6 of 18

Section of the RFP5.4 VendorSolutionCapabilities andServicesQuestionDoes CCH have resources/expertise toextract and map the data into the standardformats (such as CPCDS, USCDI, CMS JSON,HL7), or are you looking for the vendor toprovide this expertise?395.4 VendorSolutionCapabilities andServices405.4 VendorSolutionCapabilities andServices415.4 VendorSolutionCapabilities andServices5.4 VendorSolutionCapabilities andServicesCan we request CCH to provide thefollowing for both patient and providerresources: 1)Interface type (REST/SOAP,JMS, File, other), 2)Format type ( CARINCPCDS, USCDI, HIPAA X12, HL7, CMS JSON,custom), System Name?1. Claims/Encounters2. 835/EOB3. Pharma Claims4. Clinical Data5. Provider Directory Data6. Formulary7. Member/Coverage DataWhat authentication mechanism does CCHcurrently use to authenticate memberaccess? (E.g. LDAP, Active Directory, RDMSwith Username/password, Security MgtSoftware such as PING)?Does CCH's existing authenticationmechanism support OAuth 2.0 securityframework?3842435.4 VendorSolutionCapabilities andServicesAre there any restrictions to utilize acombination of on and offshore resourceseither in the implementation process or ongoing support? (Please note: For anyoffshore work, PHI will always remain in USOnshore and cannot betransferred/downloaded offshore).Does CCH require the vendor to providemember identity service and registration orwill this be provided through CCH's existingMember Portal?CCHHS ResponseMedical and behavioral claims will beavailable in CPCDS, though HPS willrequire the flexibility to be able to ingestnon-standard formats as required. Thiswill be determined in partnership with theselected vendor during discovery andbased on vendor capacity/expertise aswell.Specifications for each interface will bedetermined during project discovery andimplementation.Vendor to provide Consent Managementand Identity Management solution.Vendor to provide Consent Managementand Identity Management solution.We do not allow off-shore resourcesPlease provide pricing and capabilities formember identity, consent andregistration.Page 7 of 18

4445Section of the RFP5.4 VendorSolutionCapabilities andServicesQuestionDoes CCH has member helpline to answerenrollment and member identificationquestions (member lost the card, can’tfigure out the member ID, wants to knowthe coverage, etc.)?a. Are there any electronic methods like email-based helpdesk, Live Chat?b. What questions are asked from aMember to identify him/her on the phone?CCHHS ResponseHealth Plan Services’ Medicare andMedicaid products have respectivemember helplines to answer enrollmentand member identification questions.a) There are no electronic means;though chat box functionality viathe CountyCare website is slatedto go-live 01/01/2021.b) Customer Service Reps verify 3 outof the 5 following identifiers:Name, DOB, Address, Phonenumber, member ID5.4 VendorSolutionCapabilities andServicesWhat is the current method of capturingthe consent when a member delegatesaccess to his/her information to anotherperson?a. How that “other person” is currentlyidentified (driver’s license, SSN, etc.)?Head of household and caregiverinformation are provided from Healthcareand Family Services for CountyCaremembers. Consent for others as allowedby the member are stored within themember management system.POA forms are stored in Aldera. Memberservices can accept a verbal consent thatis valid for day of call only. CSRs verifiesspeaking with member on phone andallows member to verbally give consentfor another individual to speak on theirbehalf.465.7 Cost Proposal47Is CCH open to the vendor providingmultiple pricing options based ondeployment preferences?Please provide the membership count, byLOB, that should be considered in scope forthis interoperability implementation?5.7 Cost Proposal485.6 MBE/WBEParticipationIs there a score or % value CCH expects toassign to this requirement?YesCountyCare: 373 members ACA: 95K FHP: 237K ICP: 30K MLTSS: 6K SNC: 5KMoreCare: 500 membersThe Cook County Office of ContractCompliance recommended a 35%MBE/WBE Goal ParticipationPage 8 of 18

4950515253Section of the RFP3. Schedule, pg. 8Section 5-TablePayer to PayerData Exchange, pg.115.6 MBE/WBEParticipation, pg.235.10 Contract, pg.248.3 Number ofCopies & 8.4Format, pg. 28-29QuestionIf there is a delay in receiving your answers,will the submission timeline adjustaccordingly?Due to the Thanksgiving holiday andalready approved PTO, will CCH/HPSconsider a 1- week extension for theproposal with a new due date to December11, 2020?Please clarify in Question 5.2, that you arelooking for response to section 4.2 and 4.3?CCHHS ResponseThe due date for the proposal has beenextended to December 15th .You seek software that integrates with HPSinternal systems and data sources incompliance with CMS Interoperability andPatient Access Final Rule requirements.SaaS is software licensing and deliverymodel in which software is licensed on asubscription basis and is centrally hostedmuch like Microsoft or Oracle.No. Proposers must apply for waiver anddemonstrate good faith of efforts taken toidentify participation opportunities.Please refer to EDS pages 1-3 of theEconomic Disclosure Statement andCertification form.Accordingly, will you waive the MBE/WBEparticipation requirement since no services(personnel) will be needed to implementthis software?You seek software that integrates with HPSinternal systems and data sources incompliance with CMS Interoperability andPatient Access Final Rule requirements.SaaS is software licensing and deliverymodel in which software is licensed on asubscription basis and is centrally hostedmuch like Microsoft or Oracle.Accordingly, the contract for this softwareshould be on vendor paper vs. CCH/HPSpaper. Will you revise this section to reflectlicensing of software vs. services? Can avendor include a sample contract?With the event of the rising COVID casesacross the nation and in order to keep ouremployees safe, will CCH/HPS consider anelectronic submission vs. paper? ChangeHealthcare appreciates this considerationfor the safety of our employees.CorrectThe Contract will be on CCH paper,Proposer may include a sample contract.No. One hard copy proposal is requiredincluding an electronic (e-mailed copy)copy of the complete proposal.Page 9 of 18

54Section of the RFP11 Appendix B –SecurityQuestionnaire, pg.24QuestionPlease clarify how to fill out the securityquestionnaire? The questionnaire appearsto already be filled out and only has Yes/Nodrop down on Tab A and Tab G.Additionally, if the vendor has HITRUSTcertification, is there a need to completethe Security Questionnaire?CCHHS ResponseThe questionnaire was provided withsome examples of how to complete theform. There is a how to guide in one ofthe tabs that outlines how the formshould be completed. Essentially youanswer the questions ranking your answer1-5, 5 being the highest possiblescore. You will need to submit supportingevidence/documentation for each answeryou provide.You will need to complete the entire formand answer all questions555.13 EconomicDisclosureStatement, pg.25With the event of the rising COVID casesacross the nation and in order to keep ouremployees safe, will CCH/HPS consider anelectronic signatures in lieu of obtainingoriginal? Change Healthcare appreciatesthis consideration for the safety of ouremployees.Does CCH currently do any business todaywith AWS? If yes, what solutions?Electronic Signatures are acceptable.56NA57NAIs Interoperability vendor experience orproduct integration using Apigee APIgateway solutions required or preferred byCCH?Is Interoperability vendor involvement andexperience with CARIN and Da Vincirequired or preferred by CCH?All interoperability vendors and APIgateway solutions will be considered.58NA59NADo you haves cost transparency vendor?60NA61NAIs Interoperability vendor experience withclinical data integration and EMR vendorintegration important in the short-term orlong-term for CCH?Does CCH currently use Federated ID formember identity matching andauthentication?UnknownExperience with CARIN or Da Vinci is notrequired though if the vendor has anyexperience with these initiatives, CCHwould be interested in learning pastexperience and how your solutionsupports these initiatives (per 5.4.1.4)No, HPS does not have a cost transparencyvendor.CCH HPS has a strong preference forselecting a vendor that has experiencewith clinical data integration in both theshort-term and long-term.CountyCare: Members are uniquelyidentified in Medicaid using their recipientidentification number (RIN)MoreCare: Members are uniquelyidentified using their MoreCare IDnumber.Page 10 of 18

62Section of the RFPNAQuestionDoes CCH think it will need an initialreadiness assessment to scope your CMSInteroperability project?63NADoes CCH think it will need project ortechnical resources to help you aggregateand format data to meet the CMSInteroperability requirements?64NA65NA66NAHow is CCH thinking about managingmember identity management, enrollmentand obtaining member consent for CMSInteroperability requirements for 3rd PartyApp vendor access to member data?How many member email addresses to CCHhave on file to send member enrollmentinformation and invitations to? Is printingand mailing member information andinvitations needed or expected from theInteroperability vendor partner?Is CCH going to manage the initial andongoing 3rd Party App vendor certification/ attestation or does CCH expect theirInteroperability vendor partner to managethat on CCH’s behalf?CCHHS ResponseCountyCare will require scoping/discoveryto begin at the start of the project,including clear documentation of businessrequirements for the CCH HPS products tobe signed off by CCH. CCH does not expectto conduct a formal readiness review.There is an expectation that the vendorwill accept some non-standard formatswhich will may require technical resourcesto support aggregation and dataformatting.CCH would be interested in learning aboutthe bidders capabilities for memberidentity management, enrollment, andobtaining member consent within theapplication.CCH will not expect the vendor to printand mail enrollment invitations tomembers. Approximately 45,000 validemail addresses.CCH expects their interoperability vendorpartner to manage 3rd party app vendorcertification or attestation.Page 11 of 18

67Section of the RFPNA684.4694.4QuestionWhat “future state recommendations andarchitecture” would CCH like to receivefrom Interoperability partner vendors thatwould leverage the Interoperabilityinfrastructure?o Clinical data / record retrieval?o Price Transparency?o Medical Shopping (Shop, Book and Pay)?o Member out-of-pocket bill presentmentand payments to providers thru the CCHmember portal / app (like Mint.com forMember bills / payments to Providers)?O Digital Patient solutions (check-in,appointment scheduling, etc.)? Payer toProvider payments?O Other future clinical, financial oradministrative roadmap solutions that CCHis interested in partnering/ buying andintegrating with the Interoperability dataand API infrastructure / platform that itdoesn’t want to build internally?CCHHS ResponseHPS is interested in learning about allpotential future opportunities forpartnership and capabilities of thepotential and selected vendors.How many Clinical Provider connectionsshould we assume in the pricing proposal (aconnection is thought of as an end pointconnector for the provider to push or pullclinical data from a backend EMR)?For those connections, what are theunderlying backend EMR’s associated tothe connections (i.e. Cerner, Epic, eCW,Meditech, etc.)?Who will be responsible for the contractualrelationships to those Providerorganizations to the Health Plan and whoseresponsibility to set the terms of thecontract (example frequency of dataupdates, whether push of data, or pull ofdata, volume of queries allowed, whetherbulk queries are supported, etc.)?Please provide a count of number ofmembers who will need access to the FHIRrepository? Is 300K members an accuratecount of the expected member accounts toextract data to the FHIR repository (neededfor sizing costs)?To be determined in project discovery.As this is a new level of data availability forour members, we do not have a precedentfor utilization, though would not expect20% utilization or 75,000 members.Page 12 of 18

Section of the RFP704.4714.472General734.4744.4QuestionPlease provide more detail on CookCounty’s current existing HPS memberportal?Will this vendor be able to integrate withOpenID for its existing member portal forthe Patient API?Should the proposed solution do a singledata connector to the claims system(Evolent through the business hub) thatwould include pharmacy claims?Alternatively, should our solution include aseparate connection to the PharmacyBenefit Management System or pull fromthe Payer Data Warehouse?In other words, can we assume the actualdata ingestion shall occur from the PayerData Warehouse for the claims ingestion(not Evolent)?Apart from HIPAA requirements, does CookCounty Health need any additionalCompliance requirements, such as NIST forits cloud hosting options?Does Cook County Health have an existingIdentity Management Solution that willneed to be integrated?Does Cook County Health have anEnterprise Master Person Index (EMPI)Solution?If so, will Cook County Health want that tobe included with our solution?75GeneralWhat is the tentative timeline to start theprogram?GeneralDoes Cook County Health have any specificoperational specific requirements (reports,etc.)?4.4Does Cook County Health utilize a thirdparty for provider directory?If yes, should we assume the need tointegrate separately with this vendor?7677CCHHS ResponseVendor to provide Consent Managementand Identity Management solution.Please provide pricing for single ormultiple connections. Claims processingoccurs within the third partyadministrator, PBM, and dental/visionvendor systems. Due to the requirementthat data be made available 1 day afteradjudication and data lag, multipleconnections may be required.Vendors must follow NIST requirementsNo. HPS is requesting that the vendorprovide identity management on itsbehalf.Cook County Health does not have anEMPI solution.HPS is planning to contract and kick-offthe implementation in January; scopingand business requirement developmentshould be completed by the end ofFebruary to ensure go-live of the programby June 15.To be determined in project discovery.CCH does utilize a third party for providerdirectory though this will not be aseparate connection as it is, Evolent, thesame vendor that processes medical andbehavioral claims.Page 13 of 18

Section of the RFP784.479General80GeneralQuestionWhat system does Cook County Healthcurrently use for its claims processing(Evolent only)? Are all members on acommon, single system for claimsprocessing? Are the pharmacy claims alsoloaded to the same claims processingsystem so that all data extracts are some asingle data source or will the data be pulledfrom a single data warehouse?Are there any restrictions in providingongoing services from location outside USas long as all PHI viewing is isolated towithin the US only?On average, what is Cook County Health’monthly claims volume?Please provide separate figures for medicalclaims, pharmacy claims, and any othersthat are received81General824.3835.584GeneralSurround solutions and services - As aservice company we have standardized onspecific technologies and services tooperation our solution. Will there be anyrestrictions that we need to anticipate?"If the response is “D/M/T/N” to any of thebelow qualifications, please providecomment and additional detail in less than10 pages single spaced". What is theoverall limit for the section 4.3 responseincluding when the response is "Y"?Can you please clarify what is meant by theline items "Cloud-hosted by HPS"and "On-premise installation" in Section 5.5under "FHIR API Server" on page 21 of theRFP?Will Cook County Health considerelectronic-only submission of the RFPresponse and pricing model due to COVID?CCHHS ResponseClaims processing occurs within Evolent,the pharmacy benefits manager, anddental/vision vendor systems. Due to therequirement that data be made available 1day after adjudication and data lag,multiple connections may be required.We do not allow off-shore resourcesAverage Monthly Claims Volume for 2020Medical Claims 438,516All solutions and services will beconsidered. Before a contract is signed, allvendors will be required to complete asecurity assessment that includes adetailed outline and diagram of thesolution architecture and data flowdiagrams, who is hosting the service,where data is hosted, a SOC 2 report,associated security parameters, etc. Thisdocument must be reviewed andapproved by the CCH Compliance andSecurity teams.HPS is requesting the additional datawithin 10 page single spaced. If the bidderwould like to provide responses when theanswer is yes, that would be permissible.Please disregard "Cloud-hosted by HPS.”“On-premise installation” means softwarethat is installed and runs on the premisesat CCH, as opposed to cloud-based.No. One hard copy proposal is requiredincluding an electronic (e-mailed copy)copy of the complete proposal.Page 14 of 18

Section of the al93General94GeneralQuestionCCHHS ResponseCurrently for your two hospitals andnumerous health centers, do they all run onthe same EHR system? What is the systemand or systems?Yes, they all run on Cerner.Yes, as Medicaid and Medicare plans arerequired to have the program in place byJuly 2020, we are expecting aWill your rollout include both County Caresimultaneous rollout, but would be openmembers and More Care membersto taking a phased approach i

Title: CMS Interoperability and Patient Access Final Rule RFP # H20-0038 1. General This addendum revises RFP documents. This addendum is issued to respondents of record prior to . and Identity Management solution. 6 Section 3, 3rd Party Application Support Are you looking to perform the risk assessment in house and expect the vendor